/mandos/trunk : revision 305

42

#include <stddef.h> /* NULL, size_t, ssize_t */

43

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

44

srand() */

45

#include <stdbool.h> /* bool, true */

45

#include <stdbool.h> /* bool, false, true */

46

#include <string.h> /* memset(), strcmp(), strlen(),

47

strerror(), asprintf(), strcpy() */

48

#include <sys/ioctl.h> /* ioctl */

48

#include <sys/ioctl.h> /* ioctl */

49

#include <sys/types.h> /* socket(), inet_pton(), sockaddr,

50

sockaddr_in6, PF_INET6,

51

SOCK_STREAM, INET6_ADDRSTRLEN,

52

uid_t, gid_t, open(), opendir(),

53

DIR */

51

SOCK_STREAM, uid_t, gid_t, open(),

52

opendir(), DIR */

54

53

#include <sys/stat.h> /* open() */

55

54

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

56

struct in6_addr, inet_pton(),

57

connect() */

55

inet_pton(), connect() */

58

56

#include <fcntl.h> /* open() */

59

57

#include <dirent.h> /* opendir(), struct dirent, readdir()

60

58

*/

65

63

#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

66

64

SIOCSIFFLAGS, if_indextoname(),

67

65

if_nametoindex(), IF_NAMESIZE */

68

#include <netinet/in.h>

66

#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,

67

INET_ADDRSTRLEN, INET6_ADDRSTRLEN

68

*/

69

#include <unistd.h> /* close(), SEEK_SET, off_t, write(),

70

getuid(), getgid(), setuid(),

71

setgid() */

72

#include <arpa/inet.h> /* inet_pton(), htons */

73

#include <iso646.h> /* not, and, or */

73

#include <iso646.h> /* not, or, and */

74

#include <argp.h> /* struct argp_option, error_t, struct

75

argp_state, struct argp,

76

argp_parse(), ARGP_KEY_ARG,

410

gnutls_certificate_allocate_credentials(&mc->cred);

411

if(ret != GNUTLS_E_SUCCESS){

412

fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning

413

* from

414

* -Wunreachable-code

415

*/

413

from

414

-Wunreachable-code

415

*/

416

safer_gnutls_strerror(ret));

417

gnutls_global_deinit();

418

return -1;

509

/* Called when a Mandos server is found */

510

static int start_mandos_communication(const char *ip, uint16_t port,

511

AvahiIfIndex if_index,

512

mandos_context *mc){

512

mandos_context *mc, int af){

513

int ret, tcp_sd;

514

ssize_t sret;

515

union { struct sockaddr in; struct sockaddr_in6 in6; } to;

515

union {

516

struct sockaddr_in in;

517

struct sockaddr_in6 in6;

518

} to;

516

519

char *buffer = NULL;

517

520

char *decrypted_buffer;

518

521

size_t buffer_length = 0;

520

523

ssize_t decrypted_buffer_size;

521

524

size_t written;

522

525

int retval = 0;

523

char interface[IF_NAMESIZE];

524

526

gnutls_session_t session;

527

int pf; /* Protocol family */

528

529

switch(af){

530

case AF_INET6:

531

pf = PF_INET6;

532

break;

533

case AF_INET:

534

pf = PF_INET;

535

break;

536

default:

537

fprintf(stderr, "Bad address family: %d\n", af);

538

return -1;

539

}

525

540

526

541

ret = init_gnutls_session(mc, &session);

527

542

if(ret != 0){

529

544

}

530

545

531

546

if(debug){

532

fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16

547

fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16

533

548

"\n", ip, port);

534

549

}

535

550

536

tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);

551

tcp_sd = socket(pf, SOCK_STREAM, 0);

537

552

if(tcp_sd < 0){

538

553

perror("socket");

539

554

return -1;

540

555

}

541

556

542

if(debug){

543

if(if_indextoname((unsigned int)if_index, interface) == NULL){

544

perror("if_indextoname");

545

return -1;

546

}

547

fprintf(stderr, "Binding to interface %s\n", interface);

548

}

549

550

557

memset(&to, 0, sizeof(to));

551

to.in6.sin6_family = AF_INET6;

552

/* It would be nice to have a way to detect if we were passed an

553

IPv4 address here. Now we assume an IPv6 address. */

554

ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);

558

if(af == AF_INET6){

559

to.in6.sin6_family = (uint16_t)af;

560

ret = inet_pton(af, ip, &to.in6.sin6_addr);

561

} else { /* IPv4 */

562

to.in.sin_family = (sa_family_t)af;

563

ret = inet_pton(af, ip, &to.in.sin_addr);

564

}

555

565

if(ret < 0 ){

556

566

perror("inet_pton");

557

567

return -1;

560

570

fprintf(stderr, "Bad address: %s\n", ip);

561

571

return -1;

562

572

}

563

to.in6.sin6_port = htons(port); /* Spurious warnings from

573

if(af == AF_INET6){

574

to.in6.sin6_port = htons(port); /* Spurious warnings from

575

-Wconversion and

576

-Wunreachable-code */

577

578

if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */

579

(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and

580

-Wunreachable-code*/

581

if(if_index == AVAHI_IF_UNSPEC){

582

fprintf(stderr, "An IPv6 link-local address is incomplete"

583

" without a network interface\n");

584

return -1;

585

}

586

/* Set the network interface number as scope */

587

to.in6.sin6_scope_id = (uint32_t)if_index;

588

}

589

} else {

590

to.in.sin_port = htons(port); /* Spurious warnings from

564

591

-Wconversion and

565

592

-Wunreachable-code */

566

567

to.in6.sin6_scope_id = (uint32_t)if_index;

593

}

568

594

569

595

if(debug){

570

fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,

571

port);

572

char addrstr[INET6_ADDRSTRLEN] = "";

573

if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,

574

sizeof(addrstr)) == NULL){

596

if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){

597

char interface[IF_NAMESIZE];

598

if(if_indextoname((unsigned int)if_index, interface) == NULL){

599

perror("if_indextoname");

600

} else {

601

fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",

602

ip, interface, port);

603

}

604

} else {

605

fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,

606

port);

607

}

608

char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?

609

INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";

610

const char *pcret;

611

if(af == AF_INET6){

612

pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,

613

sizeof(addrstr));

614

} else {

615

pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,

616

sizeof(addrstr));

617

}

618

if(pcret == NULL){

575

619

perror("inet_ntop");

576

620

} else {

577

621

if(strcmp(addrstr, ip) != 0){

580

624

}

581

625

}

582

626

583

ret = connect(tcp_sd, &to.in, sizeof(to));

627

if(af == AF_INET6){

628

ret = connect(tcp_sd, &to.in6, sizeof(to));

629

} else {

630

ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */

631

}

584

632

if(ret < 0){

585

633

perror("connect");

586

634

return -1;

632

680

/* Read OpenPGP packet that contains the wanted password */

633

681

634

682

if(debug){

635

fprintf(stderr, "Retrieving pgp encrypted password from %s\n",

683

fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",

636

684

ip);

637

685

}

638

686

726

774

727

775

static void resolve_callback(AvahiSServiceResolver *r,

728

776

AvahiIfIndex interface,

729

AVAHI_GCC_UNUSED AvahiProtocol protocol,

777

AvahiProtocol proto,

730

778

AvahiResolverEvent event,

731

779

const char *name,

732

780

const char *type,

761

809

PRIdMAX ") on port %" PRIu16 "\n", name, host_name,

762

810

ip, (intmax_t)interface, port);

763

811

}

764

int ret = start_mandos_communication(ip, port, interface, mc);

812

int ret = start_mandos_communication(ip, port, interface, mc,

813

avahi_proto_to_af(proto));

765

814

if(ret == 0){

766

815

avahi_simple_poll_quit(mc->simple_poll);

767

816

}

857

906

.group = 1 },

858

907

{ .name = "interface", .key = 'i',

859

908

.arg = "NAME",

860

.doc = "Interface that will be used to search for Mandos"

861

" servers",

909

.doc = "Network interface that will be used to search for"

910

" Mandos servers",

862

911

.group = 1 },

863

912

{ .name = "seckey", .key = 's',

864

913

.arg = "FILE",

944

993

}

945

994

946

995

/* If the interface is down, bring it up */

947

{

996

if(interface[0] != '\0'){

948

997

#ifdef __linux__

949

998

/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO

950

999

messages to mess up the prompt */

951

1000

ret = klogctl(8, NULL, 5);

1001

bool restore_loglevel = true;

952

1002

if(ret == -1){

1003

restore_loglevel = false;

953

1004

perror("klogctl");

954

1005

}

955

1006

#endif

959

1010

perror("socket");

960

1011

exitcode = EXIT_FAILURE;

961

1012

#ifdef __linux__

962

ret = klogctl(7, NULL, 0);

963

if(ret == -1){

964

perror("klogctl");

1013

if(restore_loglevel){

1014

ret = klogctl(7, NULL, 0);

1015

if(ret == -1){

1016

perror("klogctl");

1017

}

965

1018

}

966

1019

#endif

967

1020

goto end;

971

1024

if(ret == -1){

972

1025

perror("ioctl SIOCGIFFLAGS");

973

1026

#ifdef __linux__

974

ret = klogctl(7, NULL, 0);

975

if(ret == -1){

976

perror("klogctl");

1027

if(restore_loglevel){

1028

ret = klogctl(7, NULL, 0);

1029

if(ret == -1){

1030

perror("klogctl");

1031

}

977

1032

}

978

1033

#endif

979

1034

exitcode = EXIT_FAILURE;

986

1041

perror("ioctl SIOCSIFFLAGS");

987

1042

exitcode = EXIT_FAILURE;

988

1043

#ifdef __linux__

989

ret = klogctl(7, NULL, 0);

990

if(ret == -1){

991

perror("klogctl");

1044

if(restore_loglevel){

1045

ret = klogctl(7, NULL, 0);

1046

if(ret == -1){

1047

perror("klogctl");

1048

}

992

1049

}

993

1050

#endif

994

1051

goto end;

1013

1070

perror("close");

1014

1071

}

1015

1072

#ifdef __linux__

1016

/* Restores kernel loglevel to default */

1017

ret = klogctl(7, NULL, 0);

1018

if(ret == -1){

1019

perror("klogctl");

1073

if(restore_loglevel){

1074

/* Restores kernel loglevel to default */

1075

ret = klogctl(7, NULL, 0);

1076

if(ret == -1){

1077

perror("klogctl");

1078

}

1020

1079

}

1021

1080

#endif

1022

1081

}

1024

1083

uid = getuid();

1025

1084

gid = getgid();

1026

1085

1086

errno = 0;

1027

1087

setgid(gid);

1028

1088

if(ret == -1){

1029

1089

perror("setgid");

1057

1117

gpgme_initialized = true;

1058

1118

}

1059

1119

1060

if_index = (AvahiIfIndex) if_nametoindex(interface);

1061

if(if_index == 0){

1062

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1063

exitcode = EXIT_FAILURE;

1064

goto end;

1120

if(interface[0] != '\0'){

1121

if_index = (AvahiIfIndex) if_nametoindex(interface);

1122

if(if_index == 0){

1123

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1124

exitcode = EXIT_FAILURE;

1125

goto end;

1126

}

1065

1127

}

1066

1128

1067

1129

if(connect_to != NULL){

1084

1146

port = (uint16_t)tmpmax;

1085

1147

*address = '\0';

1086

1148

address = connect_to;

1087

ret = start_mandos_communication(address, port, if_index, &mc);

1149

/* Colon in address indicates IPv6 */

1150

int af;

1151

if(strchr(address, ':') != NULL){

1152

af = AF_INET6;

1153

} else {

1154

af = AF_INET;

1155

}

1156

ret = start_mandos_communication(address, port, if_index, &mc,

1157

af);

1088

1158

if(ret < 0){

1089

1159

exitcode = EXIT_FAILURE;

1090

1160

} else {