75
75
argp_state, struct argp,
76
76
argp_parse(), ARGP_KEY_ARG,
77
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
#include <signal.h> /* sigemptyset(), sigaddset(),
79
sigaction(), SIGTERM, sigaction,
79
83
#include <sys/klog.h> /* klogctl() */
84
#endif /* __linux__ */
83
87
/* All Avahi types, constants and functions
130
134
} mandos_context;
136
/* global context so signal handler can reach it*/
133
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
134
* "buffer_capacity" is how much is currently allocated,
140
* Make additional room in "buffer" for at least BUFFER_SIZE more
141
* bytes. "buffer_capacity" is how much is currently allocated,
135
142
* "buffer_length" is how much is already used.
137
size_t adjustbuffer(char **buffer, size_t buffer_length,
144
size_t incbuffer(char **buffer, size_t buffer_length,
138
145
size_t buffer_capacity){
139
146
if(buffer_length + BUFFER_SIZE > buffer_capacity){
140
147
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
150
157
* Initialize GPGME.
152
static bool init_gpgme(mandos_context *mc, const char *seckey,
159
static bool init_gpgme(const char *seckey,
153
160
const char *pubkey, const char *tempdir){
155
162
gpgme_error_t rc;
179
rc = gpgme_op_import(mc->ctx, pgp_data);
186
rc = gpgme_op_import(mc.ctx, pgp_data);
180
187
if(rc != GPG_ERR_NO_ERROR){
181
188
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
182
189
gpgme_strsource(rc), gpgme_strerror(rc));
227
234
/* Create new GPGME "context" */
228
rc = gpgme_new(&(mc->ctx));
235
rc = gpgme_new(&(mc.ctx));
229
236
if(rc != GPG_ERR_NO_ERROR){
230
237
fprintf(stderr, "bad gpgme_new: %s: %s\n",
231
238
gpgme_strsource(rc), gpgme_strerror(rc));
243
250
* Decrypt OpenPGP data.
244
251
* Returns -1 on error
246
static ssize_t pgp_packet_decrypt(const mandos_context *mc,
247
const char *cryptotext,
253
static ssize_t pgp_packet_decrypt(const char *cryptotext,
248
254
size_t crypto_size,
249
255
char **plaintext){
250
256
gpgme_data_t dh_crypto, dh_plain;
278
284
/* Decrypt data from the cryptotext data buffer to the plaintext
280
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
286
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
281
287
if(rc != GPG_ERR_NO_ERROR){
282
288
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
283
289
gpgme_strsource(rc), gpgme_strerror(rc));
284
290
plaintext_length = -1;
286
292
gpgme_decrypt_result_t result;
287
result = gpgme_op_decrypt_result(mc->ctx);
293
result = gpgme_op_decrypt_result(mc.ctx);
288
294
if(result == NULL){
289
295
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
327
333
*plaintext = NULL;
329
plaintext_capacity = adjustbuffer(plaintext,
335
plaintext_capacity = incbuffer(plaintext,
330
336
(size_t)plaintext_length,
331
337
plaintext_capacity);
332
338
if(plaintext_capacity == 0){
333
perror("adjustbuffer");
334
340
plaintext_length = -1;
335
341
goto decrypt_end;
382
388
fprintf(stderr, "GnuTLS: %s", string);
385
static int init_gnutls_global(mandos_context *mc,
386
const char *pubkeyfilename,
391
static int init_gnutls_global(const char *pubkeyfilename,
387
392
const char *seckeyfilename){
409
414
/* OpenPGP credentials */
410
gnutls_certificate_allocate_credentials(&mc->cred);
415
gnutls_certificate_allocate_credentials(&mc.cred);
411
416
if(ret != GNUTLS_E_SUCCESS){
412
417
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
427
432
ret = gnutls_certificate_set_openpgp_key_file
428
(mc->cred, pubkeyfilename, seckeyfilename,
433
(mc.cred, pubkeyfilename, seckeyfilename,
429
434
GNUTLS_OPENPGP_FMT_BASE64);
430
435
if(ret != GNUTLS_E_SUCCESS){
439
444
/* GnuTLS server initialization */
440
ret = gnutls_dh_params_init(&mc->dh_params);
445
ret = gnutls_dh_params_init(&mc.dh_params);
441
446
if(ret != GNUTLS_E_SUCCESS){
442
447
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
443
448
" %s\n", safer_gnutls_strerror(ret));
446
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
451
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
447
452
if(ret != GNUTLS_E_SUCCESS){
448
453
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
449
454
safer_gnutls_strerror(ret));
453
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
458
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
459
gnutls_certificate_free_credentials(mc->cred);
464
gnutls_certificate_free_credentials(mc.cred);
460
465
gnutls_global_deinit();
461
gnutls_dh_params_deinit(mc->dh_params);
466
gnutls_dh_params_deinit(mc.dh_params);
465
static int init_gnutls_session(mandos_context *mc,
466
gnutls_session_t *session){
470
static int init_gnutls_session(gnutls_session_t *session){
468
472
/* GnuTLS session creation */
469
473
ret = gnutls_init(session, GNUTLS_SERVER);
477
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
481
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
478
482
if(ret != GNUTLS_E_SUCCESS){
479
483
fprintf(stderr, "Syntax error at: %s\n", err);
480
484
fprintf(stderr, "GnuTLS error: %s\n",
487
491
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
489
493
if(ret != GNUTLS_E_SUCCESS){
490
494
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
491
495
safer_gnutls_strerror(ret));
497
501
gnutls_certificate_server_set_request(*session,
498
502
GNUTLS_CERT_IGNORE);
500
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
504
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
509
513
/* Called when a Mandos server is found */
510
514
static int start_mandos_communication(const char *ip, uint16_t port,
511
515
AvahiIfIndex if_index,
512
mandos_context *mc, int af){
688
buffer_capacity = adjustbuffer(&buffer, buffer_length,
692
buffer_capacity = incbuffer(&buffer, buffer_length,
689
693
buffer_capacity);
690
694
if(buffer_capacity == 0){
691
perror("adjustbuffer");
733
737
gnutls_bye(session, GNUTLS_SHUT_RDWR);
735
739
if(buffer_length > 0){
736
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
740
decrypted_buffer_size = pgp_packet_decrypt(buffer,
738
742
&decrypted_buffer);
739
743
if(decrypted_buffer_size >= 0){
785
789
AVAHI_GCC_UNUSED AvahiStringList *txt,
786
790
AVAHI_GCC_UNUSED AvahiLookupResultFlags
789
mandos_context *mc = userdata;
792
AVAHI_GCC_UNUSED void* userdata){
792
795
/* Called whenever a service has been resolved successfully or
797
800
case AVAHI_RESOLVER_FAILURE:
798
801
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
799
802
" of type '%s' in domain '%s': %s\n", name, type, domain,
800
avahi_strerror(avahi_server_errno(mc->server)));
803
avahi_strerror(avahi_server_errno(mc.server)));
803
806
case AVAHI_RESOLVER_FOUND:
809
812
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
810
813
ip, (intmax_t)interface, port);
812
int ret = start_mandos_communication(ip, port, interface, mc,
815
int ret = start_mandos_communication(ip, port, interface,
813
816
avahi_proto_to_af(proto));
815
avahi_simple_poll_quit(mc->simple_poll);
818
avahi_simple_poll_quit(mc.simple_poll);
840
842
case AVAHI_BROWSER_FAILURE:
842
844
fprintf(stderr, "(Avahi browser) %s\n",
843
avahi_strerror(avahi_server_errno(mc->server)));
844
avahi_simple_poll_quit(mc->simple_poll);
845
avahi_strerror(avahi_server_errno(mc.server)));
846
avahi_simple_poll_quit(mc.simple_poll);
847
849
case AVAHI_BROWSER_NEW:
850
852
the callback function is called the Avahi server will free the
851
853
resolver for us. */
853
if(!(avahi_s_service_resolver_new(mc->server, interface,
855
if(!(avahi_s_service_resolver_new(mc.server, interface,
854
856
protocol, name, type, domain,
855
857
AVAHI_PROTO_INET6, 0,
856
resolve_callback, mc)))
858
resolve_callback, NULL)))
857
859
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
858
name, avahi_strerror(avahi_server_errno(mc->server)));
860
name, avahi_strerror(avahi_server_errno(mc.server)));
861
863
case AVAHI_BROWSER_REMOVE:
875
sig_atomic_t quit_now = 0;
877
static void handle_sigterm(__attribute__((unused)) int sig){
882
int old_errno = errno;
883
if(mc.simple_poll != NULL){
884
avahi_simple_poll_quit(mc.simple_poll);
873
889
int main(int argc, char *argv[]){
874
890
AvahiSServiceBrowser *sb = NULL;
889
905
const char *seckey = PATHDIR "/" SECKEY;
890
906
const char *pubkey = PATHDIR "/" PUBKEY;
892
mandos_context mc = { .simple_poll = NULL, .server = NULL,
893
.dh_bits = 1024, .priority = "SECURE256"
894
":!CTYPE-X.509:+CTYPE-OPENPGP" };
908
/* Initialize Mandos context */
909
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
910
.dh_bits = 1024, .priority = "SECURE256"
911
":!CTYPE-X.509:+CTYPE-OPENPGP" };
895
912
bool gnutls_initialized = false;
896
913
bool gpgme_initialized = false;
897
914
double delay = 2.5;
916
struct sigaction old_sigterm_action;
917
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
900
920
struct argp_option options[] = {
1094
1114
perror("setuid");
1097
ret = init_gnutls_global(&mc, pubkey, seckey);
1117
ret = init_gnutls_global(pubkey, seckey);
1099
1119
fprintf(stderr, "init_gnutls_global failed\n");
1100
1120
exitcode = EXIT_FAILURE;
1110
1130
tempdir_created = true;
1112
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
1132
if(not init_gpgme(pubkey, seckey, tempdir)){
1113
1133
fprintf(stderr, "init_gpgme failed\n");
1114
1134
exitcode = EXIT_FAILURE;
1156
ret = start_mandos_communication(address, port, if_index, &mc,
1176
ret = start_mandos_communication(address, port, if_index, af);
1159
1178
exitcode = EXIT_FAILURE;
1207
1226
/* Create the Avahi service browser */
1208
1227
sb = avahi_s_service_browser_new(mc.server, if_index,
1209
1228
AVAHI_PROTO_INET6, "_mandos._tcp",
1210
NULL, 0, browse_callback, &mc);
1229
NULL, 0, browse_callback, NULL);
1211
1230
if(sb == NULL){
1212
1231
fprintf(stderr, "Failed to create service browser: %s\n",
1213
1232
avahi_strerror(avahi_server_errno(mc.server)));
1237
sigemptyset(&sigterm_action.sa_mask);
1238
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1240
perror("sigaddset");
1241
exitcode = EXIT_FAILURE;
1244
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1246
perror("sigaddset");
1247
exitcode = EXIT_FAILURE;
1250
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1252
perror("sigaddset");
1253
exitcode = EXIT_FAILURE;
1256
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1258
perror("sigaction");
1259
exitcode = EXIT_FAILURE;
1218
1263
/* Run the main loop */