26
25
* along with this program. If not, see
27
26
* <http://www.gnu.org/licenses/>.
29
* Contact the authors at <mandos@fukt.bsnet.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
33
#define _LARGEFILE_SOURCE
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE */
88
#include <sys/klog.h> /* klogctl() */
89
#endif /* __linux__ */
92
/* All Avahi types, constants and functions
40
#include <net/if.h> /* if_nametoindex */
95
42
#include <avahi-core/core.h>
96
43
#include <avahi-core/lookup.h>
97
44
#include <avahi-core/log.h>
99
46
#include <avahi-common/malloc.h>
100
47
#include <avahi-common/error.h>
103
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
106
init_gnutls_session(),
108
#include <gnutls/openpgp.h>
109
/* gnutls_certificate_set_openpgp_key_file(),
110
GNUTLS_OPENPGP_FMT_BASE64 */
113
#include <gpgme.h> /* All GPGME types, constants and
116
GPGME_PROTOCOL_OpenPGP,
50
#include <sys/types.h> /* socket(), inet_pton() */
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
52
struct in6_addr, inet_pton() */
53
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
54
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
#include <unistd.h> /* close() */
57
#include <netinet/in.h>
58
#include <stdbool.h> /* true */
59
#include <string.h> /* memset */
60
#include <arpa/inet.h> /* inet_pton() */
61
#include <iso646.h> /* not */
64
#include <errno.h> /* perror() */
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
119
75
#define BUFFER_SIZE 256
121
#define PATHDIR "/conf/conf.d/mandos"
122
#define SECKEY "seckey.txt"
123
#define PUBKEY "pubkey.txt"
125
78
bool debug = false;
126
static const char mandos_protocol_version[] = "1";
127
const char *argp_program_version = "mandos-client " VERSION;
128
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
130
/* Used for passing in values through the Avahi callback functions */
132
AvahiSimplePoll *simple_poll;
81
gnutls_session_t session;
134
82
gnutls_certificate_credentials_t cred;
135
unsigned int dh_bits;
136
83
gnutls_dh_params_t dh_params;
137
const char *priority;
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
89
gpgme_data_t dh_crypto, dh_plain;
141
/* global context so signal handler can reach it*/
142
mandos_context mc = { .simple_poll = NULL, .server = NULL,
143
.dh_bits = 1024, .priority = "SECURE256"
144
":!CTYPE-X.509:+CTYPE-OPENPGP" };
146
sig_atomic_t quit_now = 0;
147
int signal_received = 0;
150
* Make additional room in "buffer" for at least BUFFER_SIZE more
151
* bytes. "buffer_capacity" is how much is currently allocated,
152
* "buffer_length" is how much is already used.
154
size_t incbuffer(char **buffer, size_t buffer_length,
155
size_t buffer_capacity){
156
if(buffer_length + BUFFER_SIZE > buffer_capacity){
157
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
161
buffer_capacity += BUFFER_SIZE;
163
return buffer_capacity;
169
static bool init_gpgme(const char *seckey,
170
const char *pubkey, const char *tempdir){
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
172
95
gpgme_engine_info_t engine_info;
176
* Helper function to insert pub and seckey to the engine keyring.
178
bool import_key(const char *filename){
181
gpgme_data_t pgp_data;
183
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
189
rc = gpgme_data_new_from_fd(&pgp_data, fd);
190
if(rc != GPG_ERR_NO_ERROR){
191
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
192
gpgme_strsource(rc), gpgme_strerror(rc));
196
rc = gpgme_op_import(mc.ctx, pgp_data);
197
if(rc != GPG_ERR_NO_ERROR){
198
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
199
gpgme_strsource(rc), gpgme_strerror(rc));
203
ret = (int)TEMP_FAILURE_RETRY(close(fd));
207
gpgme_data_release(pgp_data);
212
fprintf(stderr, "Initializing GPGME\n");
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
216
102
gpgme_check_version(NULL);
217
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
218
if(rc != GPG_ERR_NO_ERROR){
219
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
220
gpgme_strsource(rc), gpgme_strerror(rc));
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
224
/* Set GPGME home directory for the OpenPGP engine only */
225
rc = gpgme_get_engine_info(&engine_info);
226
if(rc != GPG_ERR_NO_ERROR){
105
/* Set GPGME home directory */
106
rc = gpgme_get_engine_info (&engine_info);
107
if (rc != GPG_ERR_NO_ERROR){
227
108
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
228
109
gpgme_strsource(rc), gpgme_strerror(rc));
231
112
while(engine_info != NULL){
232
113
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
233
114
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
234
engine_info->file_name, tempdir);
115
engine_info->file_name, homedir);
237
118
engine_info = engine_info->next;
239
120
if(engine_info == NULL){
240
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
244
/* Create new GPGME "context" */
245
rc = gpgme_new(&(mc.ctx));
246
if(rc != GPG_ERR_NO_ERROR){
247
fprintf(stderr, "bad gpgme_new: %s: %s\n",
248
gpgme_strsource(rc), gpgme_strerror(rc));
252
if(not import_key(pubkey) or not import_key(seckey)){
260
* Decrypt OpenPGP data.
261
* Returns -1 on error
263
static ssize_t pgp_packet_decrypt(const char *cryptotext,
266
gpgme_data_t dh_crypto, dh_plain;
269
size_t plaintext_capacity = 0;
270
ssize_t plaintext_length = 0;
273
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
276
/* Create new GPGME data buffer from memory cryptotext */
277
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
279
if(rc != GPG_ERR_NO_ERROR){
121
fprintf(stderr, "Could not set home dir to %s\n", homedir);
125
/* Create new GPGME data buffer from packet buffer */
126
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
127
if (rc != GPG_ERR_NO_ERROR){
280
128
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
281
129
gpgme_strsource(rc), gpgme_strerror(rc));
331
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
334
194
/* Seek back to the beginning of the GPGME plaintext data buffer */
335
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
336
perror("gpgme_data_seek");
337
plaintext_length = -1;
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
343
plaintext_capacity = incbuffer(plaintext,
344
(size_t)plaintext_length,
346
if(plaintext_capacity == 0){
348
plaintext_length = -1;
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
203
if (*new_packet == NULL){
207
new_packet_capacity += BUFFER_SIZE;
352
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
354
212
/* Print the data, if any */
360
217
perror("gpgme_data_read");
361
plaintext_length = -1;
364
plaintext_length += ret;
368
fprintf(stderr, "Decrypted password is: ");
369
for(ssize_t i = 0; i < plaintext_length; i++){
370
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
372
fprintf(stderr, "\n");
377
/* Delete the GPGME cryptotext data buffer */
378
gpgme_data_release(dh_crypto);
220
new_packet_length += ret;
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
380
231
/* Delete the GPGME plaintext data buffer */
381
232
gpgme_data_release(dh_plain);
382
return plaintext_length;
233
return new_packet_length;
385
static const char * safer_gnutls_strerror(int value){
386
const char *ret = gnutls_strerror(value); /* Spurious warning from
387
-Wunreachable-code */
236
static const char * safer_gnutls_strerror (int value) {
237
const char *ret = gnutls_strerror (value);
389
239
ret = "(unknown)";
393
/* GnuTLS log function callback */
394
static void debuggnutls(__attribute__((unused)) int level,
396
fprintf(stderr, "GnuTLS: %s", string);
243
void debuggnutls(__attribute__((unused)) int level,
245
fprintf(stderr, "%s", string);
399
static int init_gnutls_global(const char *pubkeyfilename,
400
const char *seckeyfilename){
248
int initgnutls(encrypted_session *es){
404
253
fprintf(stderr, "Initializing GnuTLS\n");
407
ret = gnutls_global_init();
408
if(ret != GNUTLS_E_SUCCESS){
409
fprintf(stderr, "GnuTLS global_init: %s\n",
410
safer_gnutls_strerror(ret));
256
if ((ret = gnutls_global_init ())
257
!= GNUTLS_E_SUCCESS) {
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
415
/* "Use a log level over 10 to enable all debugging options."
418
263
gnutls_global_set_log_level(11);
419
264
gnutls_global_set_log_function(debuggnutls);
422
/* OpenPGP credentials */
423
gnutls_certificate_allocate_credentials(&mc.cred);
424
if(ret != GNUTLS_E_SUCCESS){
425
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
429
safer_gnutls_strerror(ret));
430
gnutls_global_deinit();
267
/* openpgp credentials */
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
269
!= GNUTLS_E_SUCCESS) {
270
fprintf (stderr, "memory error: %s\n",
271
safer_gnutls_strerror(ret));
435
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
436
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
276
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
440
281
ret = gnutls_certificate_set_openpgp_key_file
441
(mc.cred, pubkeyfilename, seckeyfilename,
442
GNUTLS_OPENPGP_FMT_BASE64);
443
if(ret != GNUTLS_E_SUCCESS){
445
"Error[%d] while reading the OpenPGP key pair ('%s',"
446
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
447
fprintf(stderr, "The GnuTLS error is: %s\n",
448
safer_gnutls_strerror(ret));
452
/* GnuTLS server initialization */
453
ret = gnutls_dh_params_init(&mc.dh_params);
454
if(ret != GNUTLS_E_SUCCESS){
455
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
456
" %s\n", safer_gnutls_strerror(ret));
459
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
460
if(ret != GNUTLS_E_SUCCESS){
461
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
462
safer_gnutls_strerror(ret));
466
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
472
gnutls_certificate_free_credentials(mc.cred);
473
gnutls_global_deinit();
474
gnutls_dh_params_deinit(mc.dh_params);
478
static int init_gnutls_session(gnutls_session_t *session){
480
/* GnuTLS session creation */
482
ret = gnutls_init(session, GNUTLS_SERVER);
486
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
487
if(ret != GNUTLS_E_SUCCESS){
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
283
if (ret != GNUTLS_E_SUCCESS) {
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
287
ret, CERTFILE, KEYFILE);
288
fprintf(stdout, "The Error is: %s\n",
289
safer_gnutls_strerror(ret));
293
//GnuTLS server initialization
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
295
!= GNUTLS_E_SUCCESS) {
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
297
safer_gnutls_strerror(ret));
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in prime generation: %s\n",
304
safer_gnutls_strerror(ret));
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
310
// GnuTLS session creation
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
312
!= GNUTLS_E_SUCCESS){
488
313
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
489
314
safer_gnutls_strerror(ret));
495
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
497
gnutls_deinit(*session);
500
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
501
if(ret != GNUTLS_E_SUCCESS){
502
fprintf(stderr, "Syntax error at: %s\n", err);
503
fprintf(stderr, "GnuTLS error: %s\n",
504
safer_gnutls_strerror(ret));
505
gnutls_deinit(*session);
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf(stderr, "Syntax error at: %s\n", err);
320
fprintf(stderr, "GnuTLS error: %s\n",
321
safer_gnutls_strerror(ret));
511
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
514
gnutls_deinit(*session);
517
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
518
if(ret != GNUTLS_E_SUCCESS){
519
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
325
if ((ret = gnutls_credentials_set
326
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Error setting a credentials set: %s\n",
520
329
safer_gnutls_strerror(ret));
521
gnutls_deinit(*session);
525
333
/* ignore client certificate if any. */
526
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
334
gnutls_certificate_server_set_request (es->session,
528
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
337
gnutls_dh_set_prime_bits (es->session, DH_BITS);
533
/* Avahi log function callback */
534
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
535
__attribute__((unused)) const char *txt){}
342
void empty_log(__attribute__((unused)) AvahiLogLevel level,
343
__attribute__((unused)) const char *txt){}
537
/* Called when a Mandos server is found */
538
static int start_mandos_communication(const char *ip, uint16_t port,
539
AvahiIfIndex if_index,
541
int ret, tcp_sd = -1;
544
struct sockaddr_in in;
545
struct sockaddr_in6 in6;
345
int start_mandos_communication(const char *ip, uint16_t port,
346
unsigned int if_index){
348
struct sockaddr_in6 to;
349
encrypted_session es;
547
350
char *buffer = NULL;
548
char *decrypted_buffer = NULL;
351
char *decrypted_buffer;
549
352
size_t buffer_length = 0;
550
353
size_t buffer_capacity = 0;
553
gnutls_session_t session;
554
int pf; /* Protocol family */
568
fprintf(stderr, "Bad address family: %d\n", af);
572
ret = init_gnutls_session(&session);
354
ssize_t decrypted_buffer_size;
357
char interface[IF_NAMESIZE];
578
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
360
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
582
tcp_sd = socket(pf, SOCK_STREAM, 0);
364
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
584
366
perror("socket");
592
memset(&to, 0, sizeof(to));
594
to.in6.sin6_family = (sa_family_t)af;
595
ret = inet_pton(af, ip, &to.in6.sin6_addr);
597
to.in.sin_family = (sa_family_t)af;
598
ret = inet_pton(af, ip, &to.in.sin_addr);
370
if(if_indextoname(if_index, interface) == NULL){
372
perror("if_indextoname");
378
fprintf(stderr, "Binding to interface %s\n", interface);
381
memset(&to,0,sizeof(to)); /* Spurious warning */
382
to.sin6_family = AF_INET6;
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
601
385
perror("inet_pton");
605
389
fprintf(stderr, "Bad address: %s\n", ip);
609
to.in6.sin6_port = htons(port); /* Spurious warnings from
611
-Wunreachable-code */
613
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
614
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
616
if(if_index == AVAHI_IF_UNSPEC){
617
fprintf(stderr, "An IPv6 link-local address is incomplete"
618
" without a network interface\n");
621
/* Set the network interface number as scope */
622
to.in6.sin6_scope_id = (uint32_t)if_index;
625
to.in.sin_port = htons(port); /* Spurious warnings from
627
-Wunreachable-code */
392
to.sin6_port = htons(port); /* Spurious warning */
394
to.sin6_scope_id = (uint32_t)if_index;
635
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
636
char interface[IF_NAMESIZE];
637
if(if_indextoname((unsigned int)if_index, interface) == NULL){
638
perror("if_indextoname");
640
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
641
ip, interface, port);
644
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
647
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
648
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
651
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
654
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
660
if(strcmp(addrstr, ip) != 0){
661
fprintf(stderr, "Canonical address form: %s\n", addrstr);
671
ret = connect(tcp_sd, &to.in6, sizeof(to));
673
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
397
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
676
410
perror("connect");
684
const char *out = mandos_protocol_version;
687
size_t out_size = strlen(out);
688
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
689
out_size - written));
694
written += (size_t)ret;
695
if(written < out_size){
698
if(out == mandos_protocol_version){
414
ret = initgnutls (&es);
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
712
424
fprintf(stderr, "Establishing TLS session with %s\n", ip);
719
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
726
ret = gnutls_handshake(session);
730
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
732
if(ret != GNUTLS_E_SUCCESS){
427
ret = gnutls_handshake (es.session);
429
if (ret != GNUTLS_E_SUCCESS){
734
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
431
fprintf(stderr, "\n*** Handshake failed ***\n");
740
/* Read OpenPGP packet that contains the wanted password */
438
//Retrieve OpenPGP packet that contains the wanted password
743
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
441
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
753
buffer_capacity = incbuffer(&buffer, buffer_length,
755
if(buffer_capacity == 0){
764
sret = gnutls_record_recv(session, buffer+buffer_length,
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
452
buffer_capacity += BUFFER_SIZE;
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
771
462
case GNUTLS_E_INTERRUPTED:
772
463
case GNUTLS_E_AGAIN:
774
465
case GNUTLS_E_REHANDSHAKE:
776
ret = gnutls_handshake(session);
781
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
783
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
466
ret = gnutls_handshake (es.session);
468
fprintf(stderr, "\n*** Handshake failed ***\n");
789
475
fprintf(stderr, "Unknown error while reading data from"
790
" encrypted session with Mandos server\n");
791
gnutls_bye(session, GNUTLS_SHUT_RDWR);
476
" encrypted session with mandos server\n");
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
795
buffer_length += (size_t) sret;
800
fprintf(stderr, "Closing TLS session\n");
808
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
812
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
814
if(buffer_length > 0){
815
ssize_t decrypted_buffer_size;
482
buffer_length += (size_t) ret;
486
if (buffer_length > 0){
816
487
decrypted_buffer_size = pgp_packet_decrypt(buffer,
819
if(decrypted_buffer_size >= 0){
491
if (decrypted_buffer_size >= 0){
822
492
while(written < (size_t) decrypted_buffer_size){
827
ret = (int)fwrite(decrypted_buffer + written, 1,
828
(size_t)decrypted_buffer_size - written,
493
ret = (int)fwrite (decrypted_buffer + written, 1,
494
(size_t)decrypted_buffer_size - written,
830
496
if(ret == 0 and ferror(stdout)){
832
498
fprintf(stderr, "Error writing encrypted data: %s\n",
833
499
strerror(errno));
837
504
written += (size_t)ret;
506
free(decrypted_buffer);
843
/* Shutdown procedure */
846
free(decrypted_buffer);
515
fprintf(stderr, "Closing TLS session\n");
849
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
854
gnutls_deinit(session);
519
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
522
gnutls_deinit (es.session);
523
gnutls_certificate_free_credentials (es.cred);
524
gnutls_global_deinit ();
861
static void resolve_callback(AvahiSServiceResolver *r,
862
AvahiIfIndex interface,
864
AvahiResolverEvent event,
868
const char *host_name,
869
const AvahiAddress *address,
871
AVAHI_GCC_UNUSED AvahiStringList *txt,
872
AVAHI_GCC_UNUSED AvahiLookupResultFlags
874
AVAHI_GCC_UNUSED void* userdata){
528
static AvahiSimplePoll *simple_poll = NULL;
529
static AvahiServer *server = NULL;
531
static void resolve_callback(
532
AvahiSServiceResolver *r,
533
AvahiIfIndex interface,
534
AVAHI_GCC_UNUSED AvahiProtocol protocol,
535
AvahiResolverEvent event,
539
const char *host_name,
540
const AvahiAddress *address,
542
AVAHI_GCC_UNUSED AvahiStringList *txt,
543
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
544
AVAHI_GCC_UNUSED void* userdata) {
546
assert(r); /* Spurious warning */
877
548
/* Called whenever a service has been resolved successfully or
886
553
case AVAHI_RESOLVER_FAILURE:
887
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
888
" of type '%s' in domain '%s': %s\n", name, type, domain,
889
avahi_strerror(avahi_server_errno(mc.server)));
554
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
555
" type '%s' in domain '%s': %s\n", name, type, domain,
556
avahi_strerror(avahi_server_errno(server)));
892
559
case AVAHI_RESOLVER_FOUND:
894
561
char ip[AVAHI_ADDRESS_STR_MAX];
895
562
avahi_address_snprint(ip, sizeof(ip), address);
897
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
898
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
899
ip, (intmax_t)interface, port);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
901
int ret = start_mandos_communication(ip, port, interface,
902
avahi_proto_to_af(proto));
904
avahi_simple_poll_quit(mc.simple_poll);
567
int ret = start_mandos_communication(ip, port,
568
(unsigned int) interface);
908
574
avahi_s_service_resolver_free(r);
911
static void browse_callback(AvahiSServiceBrowser *b,
912
AvahiIfIndex interface,
913
AvahiProtocol protocol,
914
AvahiBrowserEvent event,
918
AVAHI_GCC_UNUSED AvahiLookupResultFlags
920
AVAHI_GCC_UNUSED void* userdata){
923
/* Called whenever a new services becomes available on the LAN or
924
is removed from the LAN */
932
case AVAHI_BROWSER_FAILURE:
934
fprintf(stderr, "(Avahi browser) %s\n",
935
avahi_strerror(avahi_server_errno(mc.server)));
936
avahi_simple_poll_quit(mc.simple_poll);
939
case AVAHI_BROWSER_NEW:
940
/* We ignore the returned Avahi resolver object. In the callback
941
function we free it. If the Avahi server is terminated before
942
the callback function is called the Avahi server will free the
945
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
946
name, type, domain, protocol, 0,
947
resolve_callback, NULL) == NULL)
948
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
949
name, avahi_strerror(avahi_server_errno(mc.server)));
952
case AVAHI_BROWSER_REMOVE:
955
case AVAHI_BROWSER_ALL_FOR_NOW:
956
case AVAHI_BROWSER_CACHE_EXHAUSTED:
958
fprintf(stderr, "No Mandos server found, still searching...\n");
964
/* stop main loop after sigterm has been called */
965
static void handle_sigterm(int sig){
970
signal_received = sig;
971
int old_errno = errno;
972
if(mc.simple_poll != NULL){
973
avahi_simple_poll_quit(mc.simple_poll);
978
int main(int argc, char *argv[]){
979
AvahiSServiceBrowser *sb = NULL;
984
int exitcode = EXIT_SUCCESS;
985
const char *interface = "eth0";
986
struct ifreq network;
988
bool take_down_interface = false;
991
char *connect_to = NULL;
992
char tempdir[] = "/tmp/mandosXXXXXX";
993
bool tempdir_created = false;
994
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
995
const char *seckey = PATHDIR "/" SECKEY;
996
const char *pubkey = PATHDIR "/" PUBKEY;
998
bool gnutls_initialized = false;
999
bool gpgme_initialized = false;
1002
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1003
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1008
/* Lower any group privileges we might have, just to be safe */
1015
/* Lower user privileges (temporarily) */
1027
struct argp_option options[] = {
1028
{ .name = "debug", .key = 128,
1029
.doc = "Debug mode", .group = 3 },
1030
{ .name = "connect", .key = 'c',
1031
.arg = "ADDRESS:PORT",
1032
.doc = "Connect directly to a specific Mandos server",
1034
{ .name = "interface", .key = 'i',
1036
.doc = "Network interface that will be used to search for"
1039
{ .name = "seckey", .key = 's',
1041
.doc = "OpenPGP secret key file base name",
1043
{ .name = "pubkey", .key = 'p',
1045
.doc = "OpenPGP public key file base name",
1047
{ .name = "dh-bits", .key = 129,
1049
.doc = "Bit length of the prime number used in the"
1050
" Diffie-Hellman key exchange",
1052
{ .name = "priority", .key = 130,
1054
.doc = "GnuTLS priority string for the TLS handshake",
1056
{ .name = "delay", .key = 131,
1058
.doc = "Maximum delay to wait for interface startup",
1061
* These reproduce what we would get without ARGP_NO_HELP
1063
{ .name = "help", .key = '?',
1064
.doc = "Give this help list", .group = -1 },
1065
{ .name = "usage", .key = -3,
1066
.doc = "Give a short usage message", .group = -1 },
1067
{ .name = "version", .key = 'V',
1068
.doc = "Print program version", .group = -1 },
1072
error_t parse_opt(int key, char *arg,
1073
struct argp_state *state){
1076
case 128: /* --debug */
1079
case 'c': /* --connect */
1082
case 'i': /* --interface */
1085
case 's': /* --seckey */
1088
case 'p': /* --pubkey */
1091
case 129: /* --dh-bits */
1093
tmpmax = strtoimax(arg, &tmp, 10);
1094
if(errno != 0 or tmp == arg or *tmp != '\0'
1095
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1096
argp_error(state, "Bad number of DH bits");
1098
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1100
case 130: /* --priority */
1103
case 131: /* --delay */
1105
delay = strtof(arg, &tmp);
1106
if(errno != 0 or tmp == arg or *tmp != '\0'){
1107
argp_error(state, "Bad delay");
1111
* These reproduce what we would get without ARGP_NO_HELP
1113
case '?': /* --help */
1114
argp_state_help(state, state->out_stream,
1115
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1116
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1117
case -3: /* --usage */
1118
argp_state_help(state, state->out_stream,
1119
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1120
case 'V': /* --version */
1121
fprintf(state->out_stream, "%s\n", argp_program_version);
1122
exit(argp_err_exit_status);
1125
return ARGP_ERR_UNKNOWN;
1130
struct argp argp = { .options = options, .parser = parse_opt,
1132
.doc = "Mandos client -- Get and decrypt"
1133
" passwords from a Mandos server" };
1134
ret = argp_parse(&argp, argc, argv,
1135
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
577
static void browse_callback(
578
AvahiSServiceBrowser *b,
579
AvahiIfIndex interface,
580
AvahiProtocol protocol,
581
AvahiBrowserEvent event,
585
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
588
AvahiServer *s = userdata;
589
assert(b); /* Spurious warning */
591
/* Called whenever a new services becomes available on the LAN or
592
is removed from the LAN */
1142
perror("argp_parse");
1143
exitcode = EX_OSERR;
1146
exitcode = EX_USAGE;
1152
avahi_set_log_function(empty_log);
1155
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1156
from the signal handler */
1157
/* Initialize the pseudo-RNG for Avahi */
1158
srand((unsigned int) time(NULL));
1159
mc.simple_poll = avahi_simple_poll_new();
1160
if(mc.simple_poll == NULL){
1161
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1162
exitcode = EXIT_FAILURE;
1166
sigemptyset(&sigterm_action.sa_mask);
1167
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1169
perror("sigaddset");
1170
exitcode = EXIT_FAILURE;
1173
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1175
perror("sigaddset");
1176
exitcode = EXIT_FAILURE;
1179
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1181
perror("sigaddset");
1182
exitcode = EXIT_FAILURE;
1185
/* Need to check if the handler is SIG_IGN before handling:
1186
| [[info:libc:Initial Signal Actions]] |
1187
| [[info:libc:Basic Signal Handling]] |
1189
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1191
perror("sigaction");
1192
return EXIT_FAILURE;
1194
if(old_sigterm_action.sa_handler != SIG_IGN){
1195
ret = sigaction(SIGINT, &sigterm_action, NULL);
1197
perror("sigaction");
1198
exitcode = EXIT_FAILURE;
1202
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1204
perror("sigaction");
1205
return EXIT_FAILURE;
1207
if(old_sigterm_action.sa_handler != SIG_IGN){
1208
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1210
perror("sigaction");
1211
exitcode = EXIT_FAILURE;
1215
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1217
perror("sigaction");
1218
return EXIT_FAILURE;
1220
if(old_sigterm_action.sa_handler != SIG_IGN){
1221
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1223
perror("sigaction");
1224
exitcode = EXIT_FAILURE;
1229
/* If the interface is down, bring it up */
1230
if(interface[0] != '\0'){
1231
if_index = (AvahiIfIndex) if_nametoindex(interface);
596
case AVAHI_BROWSER_FAILURE:
598
fprintf(stderr, "(Browser) %s\n",
599
avahi_strerror(avahi_server_errno(server)));
600
avahi_simple_poll_quit(simple_poll);
603
case AVAHI_BROWSER_NEW:
604
/* We ignore the returned resolver object. In the callback
605
function we free it. If the server is terminated before
606
the callback function is called the server will free
607
the resolver for us. */
609
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
611
AVAHI_PROTO_INET6, 0,
612
resolve_callback, s)))
613
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
614
avahi_strerror(avahi_server_errno(s)));
617
case AVAHI_BROWSER_REMOVE:
620
case AVAHI_BROWSER_ALL_FOR_NOW:
621
case AVAHI_BROWSER_CACHE_EXHAUSTED:
626
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
627
AvahiServerConfig config;
628
AvahiSServiceBrowser *sb = NULL;
631
int returncode = EXIT_SUCCESS;
632
const char *interface = "eth0";
633
unsigned int if_index;
634
char *connect_to = NULL;
637
static struct option long_options[] = {
638
{"debug", no_argument, (int *)&debug, 1},
639
{"connect", required_argument, 0, 'c'},
640
{"interface", required_argument, 0, 'i'},
643
int option_index = 0;
644
ret = getopt_long (argc, argv, "i:", long_options,
665
if_index = if_nametoindex(interface);
1232
666
if(if_index == 0){
1233
667
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1234
exitcode = EXIT_FAILURE;
1242
/* Re-raise priviliges */
1250
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1251
messages about the network interface to mess up the prompt */
1252
ret = klogctl(8, NULL, 5);
1253
bool restore_loglevel = true;
1255
restore_loglevel = false;
1258
#endif /* __linux__ */
1260
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1263
exitcode = EXIT_FAILURE;
1265
if(restore_loglevel){
1266
ret = klogctl(7, NULL, 0);
1271
#endif /* __linux__ */
1272
/* Lower privileges */
1280
strcpy(network.ifr_name, interface);
1281
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1283
perror("ioctl SIOCGIFFLAGS");
1285
if(restore_loglevel){
1286
ret = klogctl(7, NULL, 0);
1291
#endif /* __linux__ */
1292
exitcode = EXIT_FAILURE;
1293
/* Lower privileges */
1301
if((network.ifr_flags & IFF_UP) == 0){
1302
network.ifr_flags |= IFF_UP;
1303
take_down_interface = true;
1304
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1306
take_down_interface = false;
1307
perror("ioctl SIOCSIFFLAGS");
1308
exitcode = EXIT_FAILURE;
1310
if(restore_loglevel){
1311
ret = klogctl(7, NULL, 0);
1316
#endif /* __linux__ */
1317
/* Lower privileges */
1326
/* sleep checking until interface is running */
1327
for(int i=0; i < delay * 4; i++){
1328
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1330
perror("ioctl SIOCGIFFLAGS");
1331
} else if(network.ifr_flags & IFF_RUNNING){
1334
struct timespec sleeptime = { .tv_nsec = 250000000 };
1335
ret = nanosleep(&sleeptime, NULL);
1336
if(ret == -1 and errno != EINTR){
1337
perror("nanosleep");
1340
if(not take_down_interface){
1341
/* We won't need the socket anymore */
1342
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1348
if(restore_loglevel){
1349
/* Restores kernel loglevel to default */
1350
ret = klogctl(7, NULL, 0);
1355
#endif /* __linux__ */
1356
/* Lower privileges */
1358
if(take_down_interface){
1359
/* Lower privileges */
1365
/* Lower privileges permanently */
1377
ret = init_gnutls_global(pubkey, seckey);
1379
fprintf(stderr, "init_gnutls_global failed\n");
1380
exitcode = EXIT_FAILURE;
1383
gnutls_initialized = true;
1390
tempdir_created = true;
1391
if(mkdtemp(tempdir) == NULL){
1392
tempdir_created = false;
1401
if(not init_gpgme(pubkey, seckey, tempdir)){
1402
fprintf(stderr, "init_gpgme failed\n");
1403
exitcode = EXIT_FAILURE;
1406
gpgme_initialized = true;
1413
if(connect_to != NULL){
1414
/* Connect directly, do not use Zeroconf */
1415
/* (Mainly meant for debugging) */
1416
char *address = strrchr(connect_to, ':');
1417
if(address == NULL){
1418
fprintf(stderr, "No colon in address\n");
1419
exitcode = EXIT_FAILURE;
1429
tmpmax = strtoimax(address+1, &tmp, 10);
1430
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1431
or tmpmax != (uint16_t)tmpmax){
1432
fprintf(stderr, "Bad port number\n");
1433
exitcode = EXIT_FAILURE;
1441
port = (uint16_t)tmpmax;
1443
address = connect_to;
1444
/* Colon in address indicates IPv6 */
1446
if(strchr(address, ':') != NULL){
1456
ret = start_mandos_communication(address, port, if_index, af);
1458
exitcode = EXIT_FAILURE;
1460
exitcode = EXIT_SUCCESS;
1470
AvahiServerConfig config;
1471
/* Do not publish any local Zeroconf records */
671
if(connect_to != NULL){
672
/* Connect directly, do not use Zeroconf */
673
/* (Mainly meant for debugging) */
674
char *address = strrchr(connect_to, ':');
676
fprintf(stderr, "No colon in address\n");
680
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
682
perror("Bad port number");
686
address = connect_to;
687
ret = start_mandos_communication(address, port, if_index);
696
avahi_set_log_function(empty_log);
699
/* Initialize the psuedo-RNG */
700
srand((unsigned int) time(NULL));
702
/* Allocate main loop object */
703
if (!(simple_poll = avahi_simple_poll_new())) {
704
fprintf(stderr, "Failed to create simple poll object.\n");
709
/* Do not publish any local records */
1472
710
avahi_server_config_init(&config);
1473
711
config.publish_hinfo = 0;
1474
712
config.publish_addresses = 0;
1475
713
config.publish_workstation = 0;
1476
714
config.publish_domain = 0;
1478
716
/* Allocate a new server */
1479
mc.server = avahi_server_new(avahi_simple_poll_get
1480
(mc.simple_poll), &config, NULL,
1483
/* Free the Avahi configuration data */
717
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
718
&config, NULL, NULL, &error);
720
/* Free the configuration data */
1484
721
avahi_server_config_free(&config);
1487
/* Check if creating the Avahi server object succeeded */
1488
if(mc.server == NULL){
1489
fprintf(stderr, "Failed to create Avahi server: %s\n",
1490
avahi_strerror(error));
1491
exitcode = EXIT_FAILURE;
1499
/* Create the Avahi service browser */
1500
sb = avahi_s_service_browser_new(mc.server, if_index,
1501
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1502
NULL, 0, browse_callback, NULL);
1504
fprintf(stderr, "Failed to create service browser: %s\n",
1505
avahi_strerror(avahi_server_errno(mc.server)));
1506
exitcode = EXIT_FAILURE;
1514
/* Run the main loop */
1517
fprintf(stderr, "Starting Avahi loop search\n");
1520
avahi_simple_poll_loop(mc.simple_poll);
1525
fprintf(stderr, "%s exiting\n", argv[0]);
1528
/* Cleanup things */
1530
avahi_s_service_browser_free(sb);
1532
if(mc.server != NULL)
1533
avahi_server_free(mc.server);
1535
if(mc.simple_poll != NULL)
1536
avahi_simple_poll_free(mc.simple_poll);
1538
if(gnutls_initialized){
1539
gnutls_certificate_free_credentials(mc.cred);
1540
gnutls_global_deinit();
1541
gnutls_dh_params_deinit(mc.dh_params);
1544
if(gpgme_initialized){
1545
gpgme_release(mc.ctx);
1548
/* Take down the network interface */
1549
if(take_down_interface){
1550
/* Re-raise priviliges */
1557
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1559
perror("ioctl SIOCGIFFLAGS");
1560
} else if(network.ifr_flags & IFF_UP) {
1561
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1562
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1564
perror("ioctl SIOCSIFFLAGS");
1567
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1571
/* Lower privileges permanently */
1580
/* Removes the temp directory used by GPGME */
1581
if(tempdir_created){
1583
struct dirent *direntry;
1584
d = opendir(tempdir);
1586
if(errno != ENOENT){
1591
direntry = readdir(d);
1592
if(direntry == NULL){
1595
/* Skip "." and ".." */
1596
if(direntry->d_name[0] == '.'
1597
and (direntry->d_name[1] == '\0'
1598
or (direntry->d_name[1] == '.'
1599
and direntry->d_name[2] == '\0'))){
1602
char *fullname = NULL;
1603
ret = asprintf(&fullname, "%s/%s", tempdir,
1609
ret = remove(fullname);
1611
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1618
ret = rmdir(tempdir);
1619
if(ret == -1 and errno != ENOENT){
1625
sigemptyset(&old_sigterm_action.sa_mask);
1626
old_sigterm_action.sa_handler = SIG_DFL;
1627
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1628
&old_sigterm_action,
1631
perror("sigaction");
1634
ret = raise(signal_received);
1635
} while(ret != 0 and errno == EINTR);
1640
TEMP_FAILURE_RETRY(pause());
723
/* Check if creating the server object succeeded */
725
fprintf(stderr, "Failed to create server: %s\n",
726
avahi_strerror(error));
727
returncode = EXIT_FAILURE;
731
/* Create the service browser */
732
sb = avahi_s_service_browser_new(server, (AvahiIfIndex)if_index,
734
"_mandos._tcp", NULL, 0,
735
browse_callback, server);
737
fprintf(stderr, "Failed to create service browser: %s\n",
738
avahi_strerror(avahi_server_errno(server)));
739
returncode = EXIT_FAILURE;
743
/* Run the main loop */
746
fprintf(stderr, "Starting avahi loop search\n");
749
avahi_simple_poll_loop(simple_poll);
754
fprintf(stderr, "%s exiting\n", argv[0]);
759
avahi_s_service_browser_free(sb);
762
avahi_server_free(server);
765
avahi_simple_poll_free(simple_poll);