104
46
#include <avahi-common/malloc.h>
105
47
#include <avahi-common/error.h>
108
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
111
init_gnutls_session(),
113
#include <gnutls/openpgp.h>
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
118
#include <gpgme.h> /* All GPGME types, constants and
121
GPGME_PROTOCOL_OpenPGP,
50
#include <sys/types.h> /* socket(), inet_pton() */
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
52
struct in6_addr, inet_pton() */
53
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
54
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
#include <unistd.h> /* close() */
57
#include <netinet/in.h>
58
#include <stdbool.h> /* true */
59
#include <string.h> /* memset */
60
#include <arpa/inet.h> /* inet_pton() */
61
#include <iso646.h> /* not */
64
#include <errno.h> /* perror() */
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
124
75
#define BUFFER_SIZE 256
126
#define PATHDIR "/conf/conf.d/mandos"
127
#define SECKEY "seckey.txt"
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
131
78
bool debug = false;
132
static const char mandos_protocol_version[] = "1";
133
const char *argp_program_version = "mandos-client " VERSION;
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
135
static const char sys_class_net[] = "/sys/class/net";
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
139
/* Doubly linked list that need to be circularly linked when used */
140
typedef struct server{
143
AvahiIfIndex if_index;
145
struct timespec last_seen;
150
/* Used for passing in values through the Avahi callback functions */
152
AvahiSimplePoll *simple_poll;
81
gnutls_session_t session;
154
82
gnutls_certificate_credentials_t cred;
155
unsigned int dh_bits;
156
83
gnutls_dh_params_t dh_params;
157
const char *priority;
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
89
gpgme_data_t dh_crypto, dh_plain;
159
server *current_server;
162
/* global context so signal handler can reach it*/
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
164
.dh_bits = 1024, .priority = "SECURE256"
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
168
sig_atomic_t quit_now = 0;
169
int signal_received = 0;
171
/* Function to use when printing errors */
172
void perror_plus(const char *print_text){
174
fprintf(stderr, "Mandos plugin %s: ",
175
program_invocation_short_name);
180
__attribute__((format (gnu_printf, 2, 3)))
181
int fprintf_plus(FILE *stream, const char *format, ...){
183
va_start (ap, format);
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
186
program_invocation_short_name));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
191
* Make additional room in "buffer" for at least BUFFER_SIZE more
192
* bytes. "buffer_capacity" is how much is currently allocated,
193
* "buffer_length" is how much is already used.
195
size_t incbuffer(char **buffer, size_t buffer_length,
196
size_t buffer_capacity){
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
202
buffer_capacity += BUFFER_SIZE;
204
return buffer_capacity;
207
/* Add server to set of servers to retry periodically */
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
211
server *new_server = malloc(sizeof(server));
212
if(new_server == NULL){
213
perror_plus("malloc");
216
*new_server = (server){ .ip = strdup(ip),
218
.if_index = if_index,
220
if(new_server->ip == NULL){
221
perror_plus("strdup");
224
/* Special case of first server */
225
if (mc.current_server == NULL){
226
new_server->next = new_server;
227
new_server->prev = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
233
new_server->prev->next = new_server;
234
mc.current_server->prev = new_server;
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
238
perror_plus("clock_gettime");
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
250
95
gpgme_engine_info_t engine_info;
254
* Helper function to insert pub and seckey to the engine keyring.
256
bool import_key(const char *filename){
259
gpgme_data_t pgp_data;
261
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
267
rc = gpgme_data_new_from_fd(&pgp_data, fd);
268
if(rc != GPG_ERR_NO_ERROR){
269
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
270
gpgme_strsource(rc), gpgme_strerror(rc));
274
rc = gpgme_op_import(mc.ctx, pgp_data);
275
if(rc != GPG_ERR_NO_ERROR){
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
281
ret = (int)TEMP_FAILURE_RETRY(close(fd));
283
perror_plus("close");
285
gpgme_data_release(pgp_data);
290
fprintf_plus(stderr, "Initializing GPGME\n");
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
294
102
gpgme_check_version(NULL);
295
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
296
if(rc != GPG_ERR_NO_ERROR){
297
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
302
/* Set GPGME home directory for the OpenPGP engine only */
303
rc = gpgme_get_engine_info(&engine_info);
304
if(rc != GPG_ERR_NO_ERROR){
305
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
gpgme_strsource(rc), gpgme_strerror(rc));
105
/* Set GPGME home directory */
106
rc = gpgme_get_engine_info (&engine_info);
107
if (rc != GPG_ERR_NO_ERROR){
108
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
109
gpgme_strsource(rc), gpgme_strerror(rc));
309
112
while(engine_info != NULL){
310
113
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
311
114
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
312
engine_info->file_name, tempdir);
115
engine_info->file_name, homedir);
315
118
engine_info = engine_info->next;
317
120
if(engine_info == NULL){
318
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
323
/* Create new GPGME "context" */
324
rc = gpgme_new(&(mc.ctx));
325
if(rc != GPG_ERR_NO_ERROR){
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
332
if(not import_key(pubkey) or not import_key(seckey)){
340
* Decrypt OpenPGP data.
341
* Returns -1 on error
343
static ssize_t pgp_packet_decrypt(const char *cryptotext,
346
gpgme_data_t dh_crypto, dh_plain;
349
size_t plaintext_capacity = 0;
350
ssize_t plaintext_length = 0;
353
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
356
/* Create new GPGME data buffer from memory cryptotext */
357
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
359
if(rc != GPG_ERR_NO_ERROR){
360
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
121
fprintf(stderr, "Could not set home dir to %s\n", homedir);
125
/* Create new GPGME data buffer from packet buffer */
126
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
127
if (rc != GPG_ERR_NO_ERROR){
128
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
129
gpgme_strsource(rc), gpgme_strerror(rc));
365
133
/* Create new empty GPGME data buffer for the plaintext */
366
134
rc = gpgme_data_new(&dh_plain);
367
if(rc != GPG_ERR_NO_ERROR){
368
fprintf_plus(stderr, "Mandos plugin mandos-client: "
369
"bad gpgme_data_new: %s: %s\n",
370
gpgme_strsource(rc), gpgme_strerror(rc));
371
gpgme_data_release(dh_crypto);
375
/* Decrypt data from the cryptotext data buffer to the plaintext
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
378
if(rc != GPG_ERR_NO_ERROR){
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
381
plaintext_length = -1;
383
gpgme_decrypt_result_t result;
384
result = gpgme_op_decrypt_result(mc.ctx);
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
388
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
389
result->unsupported_algorithm);
390
fprintf_plus(stderr, "Wrong key usage: %u\n",
391
result->wrong_key_usage);
392
if(result->file_name != NULL){
393
fprintf_plus(stderr, "File name: %s\n", result->file_name);
395
gpgme_recipient_t recipient;
396
recipient = result->recipients;
135
if (rc != GPG_ERR_NO_ERROR){
136
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
137
gpgme_strsource(rc), gpgme_strerror(rc));
141
/* Create new GPGME "context" */
142
rc = gpgme_new(&ctx);
143
if (rc != GPG_ERR_NO_ERROR){
144
fprintf(stderr, "bad gpgme_new: %s: %s\n",
145
gpgme_strsource(rc), gpgme_strerror(rc));
149
/* Decrypt data from the FILE pointer to the plaintext data
151
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
152
if (rc != GPG_ERR_NO_ERROR){
153
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
154
gpgme_strsource(rc), gpgme_strerror(rc));
159
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
163
gpgme_decrypt_result_t result;
164
result = gpgme_op_decrypt_result(ctx);
166
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
168
fprintf(stderr, "Unsupported algorithm: %s\n",
169
result->unsupported_algorithm);
170
fprintf(stderr, "Wrong key usage: %d\n",
171
result->wrong_key_usage);
172
if(result->file_name != NULL){
173
fprintf(stderr, "File name: %s\n", result->file_name);
175
gpgme_recipient_t recipient;
176
recipient = result->recipients;
397
178
while(recipient != NULL){
398
fprintf_plus(stderr, "Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name
400
(recipient->pubkey_algo));
401
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
402
fprintf_plus(stderr, "Secret key available: %s\n",
403
recipient->status == GPG_ERR_NO_SECKEY
179
fprintf(stderr, "Public key algorithm: %s\n",
180
gpgme_pubkey_algo_name(recipient->pubkey_algo));
181
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
182
fprintf(stderr, "Secret key available: %s\n",
183
recipient->status == GPG_ERR_NO_SECKEY
405
185
recipient = recipient->next;
413
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
416
194
/* Seek back to the beginning of the GPGME plaintext data buffer */
417
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
418
perror_plus("gpgme_data_seek");
419
plaintext_length = -1;
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
425
plaintext_capacity = incbuffer(plaintext,
426
(size_t)plaintext_length,
428
if(plaintext_capacity == 0){
429
perror_plus("incbuffer");
430
plaintext_length = -1;
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
203
if (*new_packet == NULL){
207
new_packet_capacity += BUFFER_SIZE;
434
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
436
212
/* Print the data, if any */
442
perror_plus("gpgme_data_read");
443
plaintext_length = -1;
446
plaintext_length += ret;
450
fprintf_plus(stderr, "Decrypted password is: ");
451
for(ssize_t i = 0; i < plaintext_length; i++){
452
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
454
fprintf(stderr, "\n");
459
/* Delete the GPGME cryptotext data buffer */
460
gpgme_data_release(dh_crypto);
217
perror("gpgme_data_read");
220
new_packet_length += ret;
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
462
231
/* Delete the GPGME plaintext data buffer */
463
232
gpgme_data_release(dh_plain);
464
return plaintext_length;
233
return new_packet_length;
467
static const char * safer_gnutls_strerror(int value){
468
const char *ret = gnutls_strerror(value); /* Spurious warning from
469
-Wunreachable-code */
236
static const char * safer_gnutls_strerror (int value) {
237
const char *ret = gnutls_strerror (value);
471
239
ret = "(unknown)";
475
/* GnuTLS log function callback */
476
static void debuggnutls(__attribute__((unused)) int level,
478
fprintf_plus(stderr, "GnuTLS: %s", string);
243
void debuggnutls(__attribute__((unused)) int level,
245
fprintf(stderr, "%s", string);
481
static int init_gnutls_global(const char *pubkeyfilename,
482
const char *seckeyfilename){
248
int initgnutls(encrypted_session *es){
486
fprintf_plus(stderr, "Initializing GnuTLS\n");
253
fprintf(stderr, "Initializing GnuTLS\n");
489
ret = gnutls_global_init();
490
if(ret != GNUTLS_E_SUCCESS){
491
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
492
safer_gnutls_strerror(ret));
256
if ((ret = gnutls_global_init ())
257
!= GNUTLS_E_SUCCESS) {
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
497
/* "Use a log level over 10 to enable all debugging options."
500
263
gnutls_global_set_log_level(11);
501
264
gnutls_global_set_log_function(debuggnutls);
504
/* OpenPGP credentials */
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
506
if(ret != GNUTLS_E_SUCCESS){
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
508
safer_gnutls_strerror(ret));
509
gnutls_global_deinit();
267
/* openpgp credentials */
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
269
!= GNUTLS_E_SUCCESS) {
270
fprintf (stderr, "memory error: %s\n",
271
safer_gnutls_strerror(ret));
514
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
515
" secret key %s as GnuTLS credentials\n",
276
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
520
281
ret = gnutls_certificate_set_openpgp_key_file
521
(mc.cred, pubkeyfilename, seckeyfilename,
522
GNUTLS_OPENPGP_FMT_BASE64);
523
if(ret != GNUTLS_E_SUCCESS){
525
"Error[%d] while reading the OpenPGP key pair ('%s',"
526
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
527
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
528
safer_gnutls_strerror(ret));
532
/* GnuTLS server initialization */
533
ret = gnutls_dh_params_init(&mc.dh_params);
534
if(ret != GNUTLS_E_SUCCESS){
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
" initialization: %s\n",
537
safer_gnutls_strerror(ret));
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
541
if(ret != GNUTLS_E_SUCCESS){
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
safer_gnutls_strerror(ret));
547
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
553
gnutls_certificate_free_credentials(mc.cred);
554
gnutls_global_deinit();
555
gnutls_dh_params_deinit(mc.dh_params);
559
static int init_gnutls_session(gnutls_session_t *session){
561
/* GnuTLS session creation */
563
ret = gnutls_init(session, GNUTLS_SERVER);
567
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
568
if(ret != GNUTLS_E_SUCCESS){
570
"Error in GnuTLS session initialization: %s\n",
571
safer_gnutls_strerror(ret));
577
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
579
gnutls_deinit(*session);
582
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
583
if(ret != GNUTLS_E_SUCCESS){
584
fprintf_plus(stderr, "Syntax error at: %s\n", err);
585
fprintf_plus(stderr, "GnuTLS error: %s\n",
586
safer_gnutls_strerror(ret));
587
gnutls_deinit(*session);
593
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
596
gnutls_deinit(*session);
599
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
600
if(ret != GNUTLS_E_SUCCESS){
601
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
602
safer_gnutls_strerror(ret));
603
gnutls_deinit(*session);
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
283
if (ret != GNUTLS_E_SUCCESS) {
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
287
ret, CERTFILE, KEYFILE);
288
fprintf(stdout, "The Error is: %s\n",
289
safer_gnutls_strerror(ret));
293
//GnuTLS server initialization
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
295
!= GNUTLS_E_SUCCESS) {
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
297
safer_gnutls_strerror(ret));
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in prime generation: %s\n",
304
safer_gnutls_strerror(ret));
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
310
// GnuTLS session creation
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
312
!= GNUTLS_E_SUCCESS){
313
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
314
safer_gnutls_strerror(ret));
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf(stderr, "Syntax error at: %s\n", err);
320
fprintf(stderr, "GnuTLS error: %s\n",
321
safer_gnutls_strerror(ret));
325
if ((ret = gnutls_credentials_set
326
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Error setting a credentials set: %s\n",
329
safer_gnutls_strerror(ret));
607
333
/* ignore client certificate if any. */
608
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
334
gnutls_certificate_server_set_request (es->session,
610
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
337
gnutls_dh_set_prime_bits (es->session, DH_BITS);
615
/* Avahi log function callback */
616
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
617
__attribute__((unused)) const char *txt){}
342
void empty_log(__attribute__((unused)) AvahiLogLevel level,
343
__attribute__((unused)) const char *txt){}
619
/* Called when a Mandos server is found */
620
static int start_mandos_communication(const char *ip, uint16_t port,
621
AvahiIfIndex if_index,
623
int ret, tcp_sd = -1;
626
struct sockaddr_in in;
627
struct sockaddr_in6 in6;
345
int start_mandos_communication(const char *ip, uint16_t port,
346
AvahiIfIndex if_index){
348
struct sockaddr_in6 to;
349
encrypted_session es;
629
350
char *buffer = NULL;
630
char *decrypted_buffer = NULL;
351
char *decrypted_buffer;
631
352
size_t buffer_length = 0;
632
353
size_t buffer_capacity = 0;
635
gnutls_session_t session;
636
int pf; /* Protocol family */
653
fprintf_plus(stderr, "Bad address family: %d\n", af);
658
ret = init_gnutls_session(&session);
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
671
perror_plus("socket");
681
memset(&to, 0, sizeof(to));
683
to.in6.sin6_family = (sa_family_t)af;
684
ret = inet_pton(af, ip, &to.in6.sin6_addr);
686
to.in.sin_family = (sa_family_t)af;
687
ret = inet_pton(af, ip, &to.in.sin_addr);
691
perror_plus("inet_pton");
354
ssize_t decrypted_buffer_size;
357
char interface[IF_NAMESIZE];
360
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
364
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
370
if(if_indextoname((unsigned int)if_index, interface) == NULL){
372
perror("if_indextoname");
378
fprintf(stderr, "Binding to interface %s\n", interface);
381
memset(&to,0,sizeof(to)); /* Spurious warning */
382
to.sin6_family = AF_INET6;
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
697
fprintf_plus(stderr, "Bad address: %s\n", ip);
702
to.in6.sin6_port = htons(port); /* Spurious warnings from
704
-Wunreachable-code */
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
709
if(if_index == AVAHI_IF_UNSPEC){
710
fprintf_plus(stderr, "An IPv6 link-local address is"
711
" incomplete without a network interface\n");
715
/* Set the network interface number as scope */
716
to.in6.sin6_scope_id = (uint32_t)if_index;
719
to.in.sin_port = htons(port); /* Spurious warnings from
721
-Wunreachable-code */
730
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
731
char interface[IF_NAMESIZE];
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
733
perror_plus("if_indextoname");
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
746
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
749
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
753
perror_plus("inet_ntop");
755
if(strcmp(addrstr, ip) != 0){
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
767
ret = connect(tcp_sd, &to.in6, sizeof(to));
769
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
774
perror_plus("connect");
785
const char *out = mandos_protocol_version;
788
size_t out_size = strlen(out);
789
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
790
out_size - written));
793
perror_plus("write");
797
written += (size_t)ret;
798
if(written < out_size){
801
if(out == mandos_protocol_version){
816
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
824
/* This casting via intptr_t is to eliminate warning about casting
825
an int to a pointer type. This is exactly how the GnuTLS Guile
826
function "set-session-transport-fd!" does it. */
827
gnutls_transport_set_ptr(session,
828
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
836
ret = gnutls_handshake(session);
841
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
843
if(ret != GNUTLS_E_SUCCESS){
389
fprintf(stderr, "Bad address: %s\n", ip);
392
to.sin6_port = htons(port); /* Spurious warning */
394
to.sin6_scope_id = (uint32_t)if_index;
397
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
414
ret = initgnutls (&es);
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
424
fprintf(stderr, "Establishing TLS session with %s\n", ip);
427
ret = gnutls_handshake (es.session);
429
if (ret != GNUTLS_E_SUCCESS){
845
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
431
fprintf(stderr, "\n*** Handshake failed ***\n");
852
/* Read OpenPGP packet that contains the wanted password */
438
//Retrieve OpenPGP packet that contains the wanted password
855
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
441
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
866
buffer_capacity = incbuffer(&buffer, buffer_length,
868
if(buffer_capacity == 0){
870
perror_plus("incbuffer");
880
sret = gnutls_record_recv(session, buffer+buffer_length,
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
452
buffer_capacity += BUFFER_SIZE;
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
887
462
case GNUTLS_E_INTERRUPTED:
888
463
case GNUTLS_E_AGAIN:
890
465
case GNUTLS_E_REHANDSHAKE:
892
ret = gnutls_handshake(session);
898
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
900
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
466
ret = gnutls_handshake (es.session);
468
fprintf(stderr, "\n*** Handshake failed ***\n");
908
fprintf_plus(stderr, "Unknown error while reading data from"
909
" encrypted session with Mandos server\n");
910
gnutls_bye(session, GNUTLS_SHUT_RDWR);
475
fprintf(stderr, "Unknown error while reading data from"
476
" encrypted session with mandos server\n");
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
915
buffer_length += (size_t) sret;
920
fprintf_plus(stderr, "Closing TLS session\n");
929
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
934
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
936
if(buffer_length > 0){
937
ssize_t decrypted_buffer_size;
938
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
940
if(decrypted_buffer_size >= 0){
482
buffer_length += (size_t) ret;
486
if (buffer_length > 0){
487
decrypted_buffer_size = pgp_packet_decrypt(buffer,
491
if (decrypted_buffer_size >= 0){
943
492
while(written < (size_t) decrypted_buffer_size){
949
ret = (int)fwrite(decrypted_buffer + written, 1,
950
(size_t)decrypted_buffer_size - written,
493
ret = (int)fwrite (decrypted_buffer + written, 1,
494
(size_t)decrypted_buffer_size - written,
952
496
if(ret == 0 and ferror(stdout)){
955
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
498
fprintf(stderr, "Error writing encrypted data: %s\n",
961
504
written += (size_t)ret;
967
/* Shutdown procedure */
972
free(decrypted_buffer);
975
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
981
perror_plus("close");
983
gnutls_deinit(session);
506
free(decrypted_buffer);
515
fprintf(stderr, "Closing TLS session\n");
519
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
522
gnutls_deinit (es.session);
523
gnutls_certificate_free_credentials (es.cred);
524
gnutls_global_deinit ();
993
static void resolve_callback(AvahiSServiceResolver *r,
994
AvahiIfIndex interface,
996
AvahiResolverEvent event,
1000
const char *host_name,
1001
const AvahiAddress *address,
1003
AVAHI_GCC_UNUSED AvahiStringList *txt,
1004
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1006
AVAHI_GCC_UNUSED void* userdata){
528
static AvahiSimplePoll *simple_poll = NULL;
529
static AvahiServer *server = NULL;
531
static void resolve_callback(
532
AvahiSServiceResolver *r,
533
AvahiIfIndex interface,
534
AVAHI_GCC_UNUSED AvahiProtocol protocol,
535
AvahiResolverEvent event,
539
const char *host_name,
540
const AvahiAddress *address,
542
AVAHI_GCC_UNUSED AvahiStringList *txt,
543
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
544
AVAHI_GCC_UNUSED void* userdata) {
546
assert(r); /* Spurious warning */
1009
548
/* Called whenever a service has been resolved successfully or
1018
553
case AVAHI_RESOLVER_FAILURE:
1019
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1020
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1022
avahi_strerror(avahi_server_errno(mc.server)));
554
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
555
" type '%s' in domain '%s': %s\n", name, type, domain,
556
avahi_strerror(avahi_server_errno(server)));
1025
559
case AVAHI_RESOLVER_FOUND:
1027
561
char ip[AVAHI_ADDRESS_STR_MAX];
1028
562
avahi_address_snprint(ip, sizeof(ip), address);
1030
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1031
PRIdMAX ") on port %" PRIu16 "\n", name,
1032
host_name, ip, (intmax_t)interface, port);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
1034
int ret = start_mandos_communication(ip, port, interface,
1035
avahi_proto_to_af(proto));
1037
avahi_simple_poll_quit(mc.simple_poll);
1039
if(not add_server(ip, port, interface,
1040
avahi_proto_to_af(proto))){
1041
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
567
int ret = start_mandos_communication(ip, port, interface);
1047
573
avahi_s_service_resolver_free(r);
1050
static void browse_callback(AvahiSServiceBrowser *b,
1051
AvahiIfIndex interface,
1052
AvahiProtocol protocol,
1053
AvahiBrowserEvent event,
1057
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1059
AVAHI_GCC_UNUSED void* userdata){
1062
/* Called whenever a new services becomes available on the LAN or
1063
is removed from the LAN */
1071
case AVAHI_BROWSER_FAILURE:
1073
fprintf_plus(stderr, "(Avahi browser) %s\n",
1074
avahi_strerror(avahi_server_errno(mc.server)));
1075
avahi_simple_poll_quit(mc.simple_poll);
1078
case AVAHI_BROWSER_NEW:
1079
/* We ignore the returned Avahi resolver object. In the callback
1080
function we free it. If the Avahi server is terminated before
1081
the callback function is called the Avahi server will free the
1084
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1085
name, type, domain, protocol, 0,
1086
resolve_callback, NULL) == NULL)
1087
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1089
avahi_strerror(avahi_server_errno(mc.server)));
1092
case AVAHI_BROWSER_REMOVE:
1095
case AVAHI_BROWSER_ALL_FOR_NOW:
1096
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1098
fprintf_plus(stderr, "No Mandos server found, still"
1105
/* Signal handler that stops main loop after SIGTERM */
1106
static void handle_sigterm(int sig){
1111
signal_received = sig;
1112
int old_errno = errno;
1113
/* set main loop to exit */
1114
if(mc.simple_poll != NULL){
1115
avahi_simple_poll_quit(mc.simple_poll);
1120
bool get_flags(const char *ifname, struct ifreq *ifr){
1123
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1125
perror_plus("socket");
1128
strcpy(ifr->ifr_name, ifname);
1129
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1132
perror_plus("ioctl SIOCGIFFLAGS");
1139
bool good_flags(const char *ifname, const struct ifreq *ifr){
1141
/* Reject the loopback device */
1142
if(ifr->ifr_flags & IFF_LOOPBACK){
1144
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1149
/* Accept point-to-point devices only if connect_to is specified */
1150
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1152
fprintf_plus(stderr, "Accepting point-to-point interface"
1153
" \"%s\"\n", ifname);
1157
/* Otherwise, reject non-broadcast-capable devices */
1158
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1160
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1161
" \"%s\"\n", ifname);
1165
/* Reject non-ARP interfaces (including dummy interfaces) */
1166
if(ifr->ifr_flags & IFF_NOARP){
1168
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1174
/* Accept this device */
1176
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1182
* This function determines if a directory entry in /sys/class/net
1183
* corresponds to an acceptable network device.
1184
* (This function is passed to scandir(3) as a filter function.)
1186
int good_interface(const struct dirent *if_entry){
1187
if(if_entry->d_name[0] == '.'){
1192
if(not get_flags(if_entry->d_name, &ifr)){
1194
fprintf_plus(stderr, "Failed to get flags for interface "
1195
"\"%s\"\n", if_entry->d_name);
1200
if(not good_flags(if_entry->d_name, &ifr)){
1207
* This function determines if a directory entry in /sys/class/net
1208
* corresponds to an acceptable network device which is up.
1209
* (This function is passed to scandir(3) as a filter function.)
1211
int up_interface(const struct dirent *if_entry){
1212
if(if_entry->d_name[0] == '.'){
1217
if(not get_flags(if_entry->d_name, &ifr)){
1219
fprintf_plus(stderr, "Failed to get flags for interface "
1220
"\"%s\"\n", if_entry->d_name);
1225
/* Reject down interfaces */
1226
if(not (ifr.ifr_flags & IFF_UP)){
1228
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1234
/* Reject non-running interfaces */
1235
if(not (ifr.ifr_flags & IFF_RUNNING)){
1237
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1243
if(not good_flags(if_entry->d_name, &ifr)){
1249
int notdotentries(const struct dirent *direntry){
1250
/* Skip "." and ".." */
1251
if(direntry->d_name[0] == '.'
1252
and (direntry->d_name[1] == '\0'
1253
or (direntry->d_name[1] == '.'
1254
and direntry->d_name[2] == '\0'))){
1260
/* Is this directory entry a runnable program? */
1261
int runnable_hook(const struct dirent *direntry){
1266
if((direntry->d_name)[0] == '\0'){
1271
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1272
"abcdefghijklmnopqrstuvwxyz"
1275
if((direntry->d_name)[sret] != '\0'){
1276
/* Contains non-allowed characters */
1278
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1284
char *fullname = NULL;
1285
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1287
perror_plus("asprintf");
1291
ret = stat(fullname, &st);
1294
perror_plus("Could not stat hook");
1298
if(not (S_ISREG(st.st_mode))){
1299
/* Not a regular file */
1301
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1306
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1307
/* Not executable */
1309
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1315
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1321
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1323
struct timespec now;
1324
struct timespec waited_time;
1325
intmax_t block_time;
1328
if(mc.current_server == NULL){
1330
fprintf_plus(stderr, "Wait until first server is found."
1333
ret = avahi_simple_poll_iterate(s, -1);
1336
fprintf_plus(stderr, "Check current_server if we should run"
1339
/* the current time */
1340
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1342
perror_plus("clock_gettime");
1345
/* Calculating in ms how long time between now and server
1346
who we visted longest time ago. Now - last seen. */
1347
waited_time.tv_sec = (now.tv_sec
1348
- mc.current_server->last_seen.tv_sec);
1349
waited_time.tv_nsec = (now.tv_nsec
1350
- mc.current_server->last_seen.tv_nsec);
1351
/* total time is 10s/10,000ms.
1352
Converting to s from ms by dividing by 1,000,
1353
and ns to ms by dividing by 1,000,000. */
1354
block_time = ((retry_interval
1355
- ((intmax_t)waited_time.tv_sec * 1000))
1356
- ((intmax_t)waited_time.tv_nsec / 1000000));
1359
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1363
if(block_time <= 0){
1364
ret = start_mandos_communication(mc.current_server->ip,
1365
mc.current_server->port,
1366
mc.current_server->if_index,
1367
mc.current_server->af);
1369
avahi_simple_poll_quit(mc.simple_poll);
1372
ret = clock_gettime(CLOCK_MONOTONIC,
1373
&mc.current_server->last_seen);
1375
perror_plus("clock_gettime");
1378
mc.current_server = mc.current_server->next;
1379
block_time = 0; /* Call avahi to find new Mandos
1380
servers, but don't block */
1383
ret = avahi_simple_poll_iterate(s, (int)block_time);
1386
if (ret > 0 or errno != EINTR){
1387
return (ret != 1) ? ret : 0;
1393
bool run_network_hooks(const char *mode, const char *interface,
1395
struct dirent **direntries;
1396
struct dirent *direntry;
1398
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1401
perror_plus("scandir");
1403
int devnull = open("/dev/null", O_RDONLY);
1404
for(int i = 0; i < numhooks; i++){
1405
direntry = direntries[i];
1406
char *fullname = NULL;
1407
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1409
perror_plus("asprintf");
1413
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1416
pid_t hook_pid = fork();
1419
/* Raise privileges */
1423
perror_plus("seteuid");
1425
/* Raise privileges even more */
1429
perror_plus("setuid");
1435
perror_plus("setgid");
1437
/* Reset supplementary groups */
1439
ret = setgroups(0, NULL);
1441
perror_plus("setgroups");
1443
dup2(devnull, STDIN_FILENO);
1445
dup2(STDERR_FILENO, STDOUT_FILENO);
1446
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1448
perror_plus("setenv");
1451
ret = setenv("DEVICE", interface, 1);
1453
perror_plus("setenv");
1456
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1458
perror_plus("setenv");
1461
ret = setenv("MODE", mode, 1);
1463
perror_plus("setenv");
1467
ret = asprintf(&delaystring, "%f", delay);
1469
perror_plus("asprintf");
1472
ret = setenv("DELAY", delaystring, 1);
1475
perror_plus("setenv");
1479
if(connect_to != NULL){
1480
ret = setenv("CONNECT", connect_to, 1);
1482
perror_plus("setenv");
1486
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1487
perror_plus("execl");
1488
_exit(EXIT_FAILURE);
1492
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1493
perror_plus("waitpid");
1497
if(WIFEXITED(status)){
1498
if(WEXITSTATUS(status) != 0){
1499
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1500
" with status %d\n", direntry->d_name,
1501
WEXITSTATUS(status));
1505
} else if(WIFSIGNALED(status)){
1506
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1507
" signal %d\n", direntry->d_name,
1512
fprintf_plus(stderr, "Warning: network hook \"%s\""
1513
" crashed\n", direntry->d_name);
1520
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1529
int main(int argc, char *argv[]){
1530
AvahiSServiceBrowser *sb = NULL;
1535
int exitcode = EXIT_SUCCESS;
1536
const char *interface = "";
1537
struct ifreq network;
1539
bool take_down_interface = false;
1542
char tempdir[] = "/tmp/mandosXXXXXX";
1543
bool tempdir_created = false;
1544
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1545
const char *seckey = PATHDIR "/" SECKEY;
1546
const char *pubkey = PATHDIR "/" PUBKEY;
1548
bool gnutls_initialized = false;
1549
bool gpgme_initialized = false;
1551
double retry_interval = 10; /* 10s between trying a server and
1552
retrying the same server again */
1554
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1555
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1560
/* Lower any group privileges we might have, just to be safe */
1564
perror_plus("setgid");
1567
/* Lower user privileges (temporarily) */
1571
perror_plus("seteuid");
1579
struct argp_option options[] = {
1580
{ .name = "debug", .key = 128,
1581
.doc = "Debug mode", .group = 3 },
1582
{ .name = "connect", .key = 'c',
1583
.arg = "ADDRESS:PORT",
1584
.doc = "Connect directly to a specific Mandos server",
1586
{ .name = "interface", .key = 'i',
1588
.doc = "Network interface that will be used to search for"
1591
{ .name = "seckey", .key = 's',
1593
.doc = "OpenPGP secret key file base name",
1595
{ .name = "pubkey", .key = 'p',
1597
.doc = "OpenPGP public key file base name",
1599
{ .name = "dh-bits", .key = 129,
1601
.doc = "Bit length of the prime number used in the"
1602
" Diffie-Hellman key exchange",
1604
{ .name = "priority", .key = 130,
1606
.doc = "GnuTLS priority string for the TLS handshake",
1608
{ .name = "delay", .key = 131,
1610
.doc = "Maximum delay to wait for interface startup",
1612
{ .name = "retry", .key = 132,
1614
.doc = "Retry interval used when denied by the Mandos server",
1616
{ .name = "network-hook-dir", .key = 133,
1618
.doc = "Directory where network hooks are located",
1621
* These reproduce what we would get without ARGP_NO_HELP
1623
{ .name = "help", .key = '?',
1624
.doc = "Give this help list", .group = -1 },
1625
{ .name = "usage", .key = -3,
1626
.doc = "Give a short usage message", .group = -1 },
1627
{ .name = "version", .key = 'V',
1628
.doc = "Print program version", .group = -1 },
1632
error_t parse_opt(int key, char *arg,
1633
struct argp_state *state){
1636
case 128: /* --debug */
1639
case 'c': /* --connect */
1642
case 'i': /* --interface */
1645
case 's': /* --seckey */
1648
case 'p': /* --pubkey */
1651
case 129: /* --dh-bits */
1653
tmpmax = strtoimax(arg, &tmp, 10);
1654
if(errno != 0 or tmp == arg or *tmp != '\0'
1655
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1656
argp_error(state, "Bad number of DH bits");
1658
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1660
case 130: /* --priority */
1663
case 131: /* --delay */
1665
delay = strtof(arg, &tmp);
1666
if(errno != 0 or tmp == arg or *tmp != '\0'){
1667
argp_error(state, "Bad delay");
1669
case 132: /* --retry */
1671
retry_interval = strtod(arg, &tmp);
1672
if(errno != 0 or tmp == arg or *tmp != '\0'
1673
or (retry_interval * 1000) > INT_MAX
1674
or retry_interval < 0){
1675
argp_error(state, "Bad retry interval");
1678
case 133: /* --network-hook-dir */
1682
* These reproduce what we would get without ARGP_NO_HELP
1684
case '?': /* --help */
1685
argp_state_help(state, state->out_stream,
1686
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1687
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1688
case -3: /* --usage */
1689
argp_state_help(state, state->out_stream,
1690
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1691
case 'V': /* --version */
1692
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1693
exit(argp_err_exit_status);
1696
return ARGP_ERR_UNKNOWN;
1701
struct argp argp = { .options = options, .parser = parse_opt,
1703
.doc = "Mandos client -- Get and decrypt"
1704
" passwords from a Mandos server" };
1705
ret = argp_parse(&argp, argc, argv,
1706
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
576
static void browse_callback(
577
AvahiSServiceBrowser *b,
578
AvahiIfIndex interface,
579
AvahiProtocol protocol,
580
AvahiBrowserEvent event,
584
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
587
AvahiServer *s = userdata;
588
assert(b); /* Spurious warning */
590
/* Called whenever a new services becomes available on the LAN or
591
is removed from the LAN */
1713
perror_plus("argp_parse");
1714
exitcode = EX_OSERR;
1717
exitcode = EX_USAGE;
1723
/* Work around Debian bug #633582:
1724
<http://bugs.debian.org/633582> */
1726
/* Re-raise priviliges */
1730
perror_plus("seteuid");
1734
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1735
int seckey_fd = open(seckey, O_RDONLY);
1736
if(seckey_fd == -1){
1737
perror_plus("open");
1739
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1741
perror_plus("fstat");
1743
if(S_ISREG(st.st_mode)
1744
and st.st_uid == 0 and st.st_gid == 0){
1745
ret = fchown(seckey_fd, uid, gid);
1747
perror_plus("fchown");
1751
TEMP_FAILURE_RETRY(close(seckey_fd));
1755
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1756
int pubkey_fd = open(pubkey, O_RDONLY);
1757
if(pubkey_fd == -1){
1758
perror_plus("open");
1760
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1762
perror_plus("fstat");
1764
if(S_ISREG(st.st_mode)
1765
and st.st_uid == 0 and st.st_gid == 0){
1766
ret = fchown(pubkey_fd, uid, gid);
1768
perror_plus("fchown");
1772
TEMP_FAILURE_RETRY(close(pubkey_fd));
1776
/* Lower privileges */
1780
perror_plus("seteuid");
1785
/* Run network hooks */
1786
if(not run_network_hooks("start", interface, delay)){
1791
avahi_set_log_function(empty_log);
1794
if(interface[0] == '\0'){
1795
struct dirent **direntries;
1796
/* First look for interfaces that are up */
1797
ret = scandir(sys_class_net, &direntries, up_interface,
1800
/* No up interfaces, look for any good interfaces */
1802
ret = scandir(sys_class_net, &direntries, good_interface,
1806
/* Pick the first interface returned */
1807
interface = strdup(direntries[0]->d_name);
1809
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1811
if(interface == NULL){
1812
perror_plus("malloc");
1814
exitcode = EXIT_FAILURE;
1820
fprintf_plus(stderr, "Could not find a network interface\n");
1821
exitcode = EXIT_FAILURE;
1826
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1827
from the signal handler */
1828
/* Initialize the pseudo-RNG for Avahi */
1829
srand((unsigned int) time(NULL));
1830
mc.simple_poll = avahi_simple_poll_new();
1831
if(mc.simple_poll == NULL){
1832
fprintf_plus(stderr,
1833
"Avahi: Failed to create simple poll object.\n");
1834
exitcode = EX_UNAVAILABLE;
1838
sigemptyset(&sigterm_action.sa_mask);
1839
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1841
perror_plus("sigaddset");
1842
exitcode = EX_OSERR;
1845
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1847
perror_plus("sigaddset");
1848
exitcode = EX_OSERR;
1851
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1853
perror_plus("sigaddset");
1854
exitcode = EX_OSERR;
1857
/* Need to check if the handler is SIG_IGN before handling:
1858
| [[info:libc:Initial Signal Actions]] |
1859
| [[info:libc:Basic Signal Handling]] |
1861
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1863
perror_plus("sigaction");
1866
if(old_sigterm_action.sa_handler != SIG_IGN){
1867
ret = sigaction(SIGINT, &sigterm_action, NULL);
1869
perror_plus("sigaction");
1870
exitcode = EX_OSERR;
1874
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1876
perror_plus("sigaction");
1879
if(old_sigterm_action.sa_handler != SIG_IGN){
1880
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1882
perror_plus("sigaction");
1883
exitcode = EX_OSERR;
1887
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1889
perror_plus("sigaction");
1892
if(old_sigterm_action.sa_handler != SIG_IGN){
1893
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1895
perror_plus("sigaction");
1896
exitcode = EX_OSERR;
1901
/* If the interface is down, bring it up */
1902
if(strcmp(interface, "none") != 0){
1903
if_index = (AvahiIfIndex) if_nametoindex(interface);
1905
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1906
exitcode = EX_UNAVAILABLE;
1914
/* Re-raise priviliges */
1918
perror_plus("seteuid");
1922
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1923
messages about the network interface to mess up the prompt */
1924
ret = klogctl(8, NULL, 5);
1925
bool restore_loglevel = true;
1927
restore_loglevel = false;
1928
perror_plus("klogctl");
1930
#endif /* __linux__ */
1932
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1934
perror_plus("socket");
1935
exitcode = EX_OSERR;
1937
if(restore_loglevel){
1938
ret = klogctl(7, NULL, 0);
1940
perror_plus("klogctl");
1943
#endif /* __linux__ */
1944
/* Lower privileges */
1948
perror_plus("seteuid");
1952
strcpy(network.ifr_name, interface);
1953
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1955
perror_plus("ioctl SIOCGIFFLAGS");
1957
if(restore_loglevel){
1958
ret = klogctl(7, NULL, 0);
1960
perror_plus("klogctl");
1963
#endif /* __linux__ */
1964
exitcode = EX_OSERR;
1965
/* Lower privileges */
1969
perror_plus("seteuid");
1973
if((network.ifr_flags & IFF_UP) == 0){
1974
network.ifr_flags |= IFF_UP;
1975
take_down_interface = true;
1976
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1978
take_down_interface = false;
1979
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1980
exitcode = EX_OSERR;
1982
if(restore_loglevel){
1983
ret = klogctl(7, NULL, 0);
1985
perror_plus("klogctl");
1988
#endif /* __linux__ */
1989
/* Lower privileges */
1993
perror_plus("seteuid");
1998
/* Sleep checking until interface is running.
1999
Check every 0.25s, up to total time of delay */
2000
for(int i=0; i < delay * 4; i++){
2001
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2003
perror_plus("ioctl SIOCGIFFLAGS");
2004
} else if(network.ifr_flags & IFF_RUNNING){
2007
struct timespec sleeptime = { .tv_nsec = 250000000 };
2008
ret = nanosleep(&sleeptime, NULL);
2009
if(ret == -1 and errno != EINTR){
2010
perror_plus("nanosleep");
2013
if(not take_down_interface){
2014
/* We won't need the socket anymore */
2015
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2017
perror_plus("close");
2021
if(restore_loglevel){
2022
/* Restores kernel loglevel to default */
2023
ret = klogctl(7, NULL, 0);
2025
perror_plus("klogctl");
2028
#endif /* __linux__ */
2029
/* Lower privileges */
2031
/* Lower privileges */
2034
perror_plus("seteuid");
2042
ret = init_gnutls_global(pubkey, seckey);
2044
fprintf_plus(stderr, "init_gnutls_global failed\n");
2045
exitcode = EX_UNAVAILABLE;
2048
gnutls_initialized = true;
2055
if(mkdtemp(tempdir) == NULL){
2056
perror_plus("mkdtemp");
2059
tempdir_created = true;
2065
if(not init_gpgme(pubkey, seckey, tempdir)){
2066
fprintf_plus(stderr, "init_gpgme failed\n");
2067
exitcode = EX_UNAVAILABLE;
2070
gpgme_initialized = true;
2077
if(connect_to != NULL){
2078
/* Connect directly, do not use Zeroconf */
2079
/* (Mainly meant for debugging) */
2080
char *address = strrchr(connect_to, ':');
2081
if(address == NULL){
2082
fprintf_plus(stderr, "No colon in address\n");
2083
exitcode = EX_USAGE;
2093
tmpmax = strtoimax(address+1, &tmp, 10);
2094
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2095
or tmpmax != (uint16_t)tmpmax){
2096
fprintf_plus(stderr, "Bad port number\n");
2097
exitcode = EX_USAGE;
2105
port = (uint16_t)tmpmax;
2107
/* Colon in address indicates IPv6 */
2109
if(strchr(connect_to, ':') != NULL){
2111
/* Accept [] around IPv6 address - see RFC 5952 */
2112
if(connect_to[0] == '[' and address[-1] == ']')
2120
address = connect_to;
2126
while(not quit_now){
2127
ret = start_mandos_communication(address, port, if_index, af);
2128
if(quit_now or ret == 0){
2132
fprintf_plus(stderr, "Retrying in %d seconds\n",
2133
(int)retry_interval);
2135
sleep((int)retry_interval);
2139
exitcode = EXIT_SUCCESS;
595
case AVAHI_BROWSER_FAILURE:
597
fprintf(stderr, "(Browser) %s\n",
598
avahi_strerror(avahi_server_errno(server)));
599
avahi_simple_poll_quit(simple_poll);
602
case AVAHI_BROWSER_NEW:
603
/* We ignore the returned resolver object. In the callback
604
function we free it. If the server is terminated before
605
the callback function is called the server will free
606
the resolver for us. */
608
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
610
AVAHI_PROTO_INET6, 0,
611
resolve_callback, s)))
612
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
613
avahi_strerror(avahi_server_errno(s)));
616
case AVAHI_BROWSER_REMOVE:
619
case AVAHI_BROWSER_ALL_FOR_NOW:
620
case AVAHI_BROWSER_CACHE_EXHAUSTED:
625
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
2150
626
AvahiServerConfig config;
2151
/* Do not publish any local Zeroconf records */
627
AvahiSServiceBrowser *sb = NULL;
630
int returncode = EXIT_SUCCESS;
631
const char *interface = NULL;
632
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
633
char *connect_to = NULL;
636
static struct option long_options[] = {
637
{"debug", no_argument, (int *)&debug, 1},
638
{"connect", required_argument, 0, 'c'},
639
{"interface", required_argument, 0, 'i'},
642
int option_index = 0;
643
ret = getopt_long (argc, argv, "i:", long_options,
664
if(interface != NULL){
665
if_index = (AvahiIfIndex) if_nametoindex(interface);
667
fprintf(stderr, "No such interface: \"%s\"\n", interface);
672
if(connect_to != NULL){
673
/* Connect directly, do not use Zeroconf */
674
/* (Mainly meant for debugging) */
675
char *address = strrchr(connect_to, ':');
677
fprintf(stderr, "No colon in address\n");
681
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
683
perror("Bad port number");
687
address = connect_to;
688
ret = start_mandos_communication(address, port, if_index);
697
avahi_set_log_function(empty_log);
700
/* Initialize the psuedo-RNG */
701
srand((unsigned int) time(NULL));
703
/* Allocate main loop object */
704
if (!(simple_poll = avahi_simple_poll_new())) {
705
fprintf(stderr, "Failed to create simple poll object.\n");
710
/* Do not publish any local records */
2152
711
avahi_server_config_init(&config);
2153
712
config.publish_hinfo = 0;
2154
713
config.publish_addresses = 0;
2155
714
config.publish_workstation = 0;
2156
715
config.publish_domain = 0;
2158
717
/* Allocate a new server */
2159
mc.server = avahi_server_new(avahi_simple_poll_get
2160
(mc.simple_poll), &config, NULL,
2163
/* Free the Avahi configuration data */
718
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
719
&config, NULL, NULL, &error);
721
/* Free the configuration data */
2164
722
avahi_server_config_free(&config);
2167
/* Check if creating the Avahi server object succeeded */
2168
if(mc.server == NULL){
2169
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2170
avahi_strerror(error));
2171
exitcode = EX_UNAVAILABLE;
2179
/* Create the Avahi service browser */
2180
sb = avahi_s_service_browser_new(mc.server, if_index,
2181
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2182
NULL, 0, browse_callback, NULL);
2184
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2185
avahi_strerror(avahi_server_errno(mc.server)));
2186
exitcode = EX_UNAVAILABLE;
2194
/* Run the main loop */
2197
fprintf_plus(stderr, "Starting Avahi loop search\n");
2200
ret = avahi_loop_with_timeout(mc.simple_poll,
2201
(int)(retry_interval * 1000));
2203
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2204
(ret == 0) ? "successfully" : "with error");
2210
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2213
/* Cleanup things */
2215
avahi_s_service_browser_free(sb);
2217
if(mc.server != NULL)
2218
avahi_server_free(mc.server);
2220
if(mc.simple_poll != NULL)
2221
avahi_simple_poll_free(mc.simple_poll);
2223
if(gnutls_initialized){
2224
gnutls_certificate_free_credentials(mc.cred);
2225
gnutls_global_deinit();
2226
gnutls_dh_params_deinit(mc.dh_params);
2229
if(gpgme_initialized){
2230
gpgme_release(mc.ctx);
2233
/* Cleans up the circular linked list of Mandos servers the client
2235
if(mc.current_server != NULL){
2236
mc.current_server->prev->next = NULL;
2237
while(mc.current_server != NULL){
2238
server *next = mc.current_server->next;
2239
free(mc.current_server);
2240
mc.current_server = next;
2244
/* Run network hooks */
2245
run_network_hooks("stop", interface, delay);
2247
/* Re-raise priviliges */
2252
perror_plus("seteuid");
2255
/* Take down the network interface */
2256
if(take_down_interface and geteuid() == 0){
2257
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2259
perror_plus("ioctl SIOCGIFFLAGS");
2260
} else if(network.ifr_flags & IFF_UP){
2261
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2262
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2264
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2267
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2269
perror_plus("close");
2273
/* Lower privileges permanently */
2277
perror_plus("setuid");
2280
/* Removes the GPGME temp directory and all files inside */
2281
if(tempdir_created){
2282
struct dirent **direntries = NULL;
2283
struct dirent *direntry = NULL;
2284
int numentries = scandir(tempdir, &direntries, notdotentries,
2286
if (numentries > 0){
2287
for(int i = 0; i < numentries; i++){
2288
direntry = direntries[i];
2289
char *fullname = NULL;
2290
ret = asprintf(&fullname, "%s/%s", tempdir,
2293
perror_plus("asprintf");
2296
ret = remove(fullname);
2298
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2305
/* need to clean even if 0 because man page doesn't specify */
2307
if (numentries == -1){
2308
perror_plus("scandir");
2310
ret = rmdir(tempdir);
2311
if(ret == -1 and errno != ENOENT){
2312
perror_plus("rmdir");
2317
sigemptyset(&old_sigterm_action.sa_mask);
2318
old_sigterm_action.sa_handler = SIG_DFL;
2319
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2320
&old_sigterm_action,
2323
perror_plus("sigaction");
2326
ret = raise(signal_received);
2327
} while(ret != 0 and errno == EINTR);
2329
perror_plus("raise");
2332
TEMP_FAILURE_RETRY(pause());
724
/* Check if creating the server object succeeded */
726
fprintf(stderr, "Failed to create server: %s\n",
727
avahi_strerror(error));
728
returncode = EXIT_FAILURE;
732
/* Create the service browser */
733
sb = avahi_s_service_browser_new(server, if_index,
735
"_mandos._tcp", NULL, 0,
736
browse_callback, server);
738
fprintf(stderr, "Failed to create service browser: %s\n",
739
avahi_strerror(avahi_server_errno(server)));
740
returncode = EXIT_FAILURE;
744
/* Run the main loop */
747
fprintf(stderr, "Starting avahi loop search\n");
750
avahi_simple_poll_loop(simple_poll);
755
fprintf(stderr, "%s exiting\n", argv[0]);
760
avahi_s_service_browser_free(sb);
763
avahi_server_free(server);
766
avahi_simple_poll_free(simple_poll);