/mandos/trunk : revision 308

30

*/

31

32

/* Needed by GPGME, specifically gpgme_data_seek() */

33

#ifndef _LARGEFILE_SOURCE

34

33

#define _LARGEFILE_SOURCE

35

#endif

36

#ifndef _FILE_OFFSET_BITS

37

34

#define _FILE_OFFSET_BITS 64

38

#endif

39

35

40

36

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */

41

37

42

38

#include <stdio.h> /* fprintf(), stderr, fwrite(),

43

stdout, ferror(), remove() */

39

stdout, ferror(), sscanf(),

40

remove() */

44

41

#include <stdint.h> /* uint16_t, uint32_t */

45

42

#include <stddef.h> /* NULL, size_t, ssize_t */

46

43

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

47

srand(), strtof() */

44

srand() */

48

45

#include <stdbool.h> /* bool, false, true */

49

46

#include <string.h> /* memset(), strcmp(), strlen(),

50

47

strerror(), asprintf(), strcpy() */

59

56

#include <fcntl.h> /* open() */

60

57

#include <dirent.h> /* opendir(), struct dirent, readdir()

61

58

*/

62

#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,

63

strtoimax() */

59

#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */

64

60

#include <assert.h> /* assert() */

65

61

#include <errno.h> /* perror(), errno */

66

62

#include <time.h> /* nanosleep(), time() */

80

76

argp_parse(), ARGP_KEY_ARG,

81

77

ARGP_KEY_END, ARGP_ERR_UNKNOWN */

82

78

#include <signal.h> /* sigemptyset(), sigaddset(),

83

sigaction(), SIGTERM, sig_atomic_t,

84

raise() */

79

sigaction(), SIGTERM, sigaction,

80

sig_atomic_t */

85

81

86

82

#ifdef __linux__

87

83

#include <sys/klog.h> /* klogctl() */

138

134

} mandos_context;

139

135

140

136

/* global context so signal handler can reach it*/

141

mandos_context mc = { .simple_poll = NULL, .server = NULL,

142

.dh_bits = 1024, .priority = "SECURE256"

143

":!CTYPE-X.509:+CTYPE-OPENPGP" };

137

mandos_context mc;

144

138

145

139

/*

146

140

* Make additional room in "buffer" for at least BUFFER_SIZE more

249

243

return false;

250

244

}

251

245

252

return true;

246

return true;

253

247

}

254

248

255

249

/*

309

303

}

310

304

gpgme_recipient_t recipient;

311

305

recipient = result->recipients;

312

while(recipient != NULL){

313

fprintf(stderr, "Public key algorithm: %s\n",

314

gpgme_pubkey_algo_name(recipient->pubkey_algo));

315

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

316

fprintf(stderr, "Secret key available: %s\n",

317

recipient->status == GPG_ERR_NO_SECKEY

318

? "No" : "Yes");

319

recipient = recipient->next;

306

if(recipient){

307

while(recipient != NULL){

308

fprintf(stderr, "Public key algorithm: %s\n",

309

gpgme_pubkey_algo_name(recipient->pubkey_algo));

310

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

311

fprintf(stderr, "Secret key available: %s\n",

312

recipient->status == GPG_ERR_NO_SECKEY

313

? "No" : "Yes");

314

recipient = recipient->next;

315

}

320

316

}

321

317

}

322

318

}

514

510

static void empty_log(__attribute__((unused)) AvahiLogLevel level,

515

511

__attribute__((unused)) const char *txt){}

516

512

517

sig_atomic_t quit_now = 0;

518

int signal_received = 0;

519

520

513

/* Called when a Mandos server is found */

521

514

static int start_mandos_communication(const char *ip, uint16_t port,

522

515

AvahiIfIndex if_index,

567

560

568

561

memset(&to, 0, sizeof(to));

569

562

if(af == AF_INET6){

570

to.in6.sin6_family = (sa_family_t)af;

563

to.in6.sin6_family = (uint16_t)af;

571

564

ret = inet_pton(af, ip, &to.in6.sin6_addr);

572

565

} else { /* IPv4 */

573

566

to.in.sin_family = (sa_family_t)af;

802

795

/* Called whenever a service has been resolved successfully or

803

796

timed out */

804

797

805

if(quit_now){

806

return;

807

}

808

809

798

switch(event){

810

799

default:

811

800

case AVAHI_RESOLVER_FAILURE:

863

852

the callback function is called the Avahi server will free the

864

853

resolver for us. */

865

854

866

if(avahi_s_service_resolver_new(mc.server, interface, protocol,

867

name, type, domain, protocol, 0,

868

resolve_callback, NULL) == NULL)

855

if(!(avahi_s_service_resolver_new(mc.server, interface,

856

protocol, name, type, domain,

857

AVAHI_PROTO_INET6, 0,

858

resolve_callback, NULL)))

869

859

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

870

860

name, avahi_strerror(avahi_server_errno(mc.server)));

871

861

break;

882

872

}

883

873

}

884

874

885

/* stop main loop after sigterm has been called */

886

static void handle_sigterm(int sig){

875

sig_atomic_t quit_now = 0;

876

877

static void handle_sigterm(__attribute__((unused)) int sig){

887

878

if(quit_now){

888

879

return;

889

880

}

890

881

quit_now = 1;

891

signal_received = sig;

892

882

int old_errno = errno;

893

883

if(mc.simple_poll != NULL){

894

884

avahi_simple_poll_quit(mc.simple_poll);

901

891

int error;

902

892

int ret;

903

893

intmax_t tmpmax;

904

char *tmp;

894

int numchars;

905

895

int exitcode = EXIT_SUCCESS;

906

896

const char *interface = "eth0";

907

897

struct ifreq network;

908

int sd = -1;

909

bool take_down_interface = false;

898

int sd;

910

899

uid_t uid;

911

900

gid_t gid;

912

901

char *connect_to = NULL;

916

905

const char *seckey = PATHDIR "/" SECKEY;

917

906

const char *pubkey = PATHDIR "/" PUBKEY;

918

907

908

/* Initialize Mandos context */

909

mc = (mandos_context){ .simple_poll = NULL, .server = NULL,

910

.dh_bits = 1024, .priority = "SECURE256"

911

":!CTYPE-X.509:+CTYPE-OPENPGP" };

919

912

bool gnutls_initialized = false;

920

913

bool gpgme_initialized = false;

921

float delay = 2.5f;

922

914

double delay = 2.5;

915

923

916

struct sigaction old_sigterm_action;

924

917

struct sigaction sigterm_action = { .sa_handler = handle_sigterm };

925

918

979

972

pubkey = arg;

980

973

break;

981

974

case 129: /* --dh-bits */

982

errno = 0;

983

tmpmax = strtoimax(arg, &tmp, 10);

984

if(errno != 0 or tmp == arg or *tmp != '\0'

985

or tmpmax != (typeof(mc.dh_bits))tmpmax){

975

ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);

976

if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax

977

or arg[numchars] != '\0'){

986

978

fprintf(stderr, "Bad number of DH bits\n");

987

979

exit(EXIT_FAILURE);

988

980

}

992

984

mc.priority = arg;

993

985

break;

994

986

case 131: /* --delay */

995

errno = 0;

996

delay = strtof(arg, &tmp);

997

if(errno != 0 or tmp == arg or *tmp != '\0'){

987

ret = sscanf(arg, "%lf%n", &delay, &numchars);

988

if(ret < 1 or arg[numchars] != '\0'){

998

989

fprintf(stderr, "Bad delay\n");

999

990

exit(EXIT_FAILURE);

1000

991

}

1021

1012

}

1022

1013

}

1023

1014

1024

if(not debug){

1025

avahi_set_log_function(empty_log);

1026

}

1027

1028

/* Initialize Avahi early so avahi_simple_poll_quit() can be called

1029

from the signal handler */

1030

/* Initialize the pseudo-RNG for Avahi */

1031

srand((unsigned int) time(NULL));

1032

mc.simple_poll = avahi_simple_poll_new();

1033

if(mc.simple_poll == NULL){

1034

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1035

exitcode = EXIT_FAILURE;

1036

goto end;

1037

}

1038

1039

sigemptyset(&sigterm_action.sa_mask);

1040

ret = sigaddset(&sigterm_action.sa_mask, SIGINT);

1041

if(ret == -1){

1042

perror("sigaddset");

1043

exitcode = EXIT_FAILURE;

1044

goto end;

1045

}

1046

ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);

1047

if(ret == -1){

1048

perror("sigaddset");

1049

exitcode = EXIT_FAILURE;

1050

goto end;

1051

}

1052

ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);

1053

if(ret == -1){

1054

perror("sigaddset");

1055

exitcode = EXIT_FAILURE;

1056

goto end;

1057

}

1058

ret = sigaction(SIGINT, &sigterm_action, &old_sigterm_action);

1059

if(ret == -1){

1060

perror("sigaction");

1061

exitcode = EXIT_FAILURE;

1062

goto end;

1063

}

1064

ret = sigaction(SIGHUP, &sigterm_action, NULL);

1065

if(ret == -1){

1066

perror("sigaction");

1067

exitcode = EXIT_FAILURE;

1068

goto end;

1069

}

1070

ret = sigaction(SIGTERM, &sigterm_action, NULL);

1071

if(ret == -1){

1072

perror("sigaction");

1073

exitcode = EXIT_FAILURE;

1074

goto end;

1075

}

1076

1077

1015

/* If the interface is down, bring it up */

1078

1016

if(interface[0] != '\0'){

1079

if_index = (AvahiIfIndex) if_nametoindex(interface);

1080

if(if_index == 0){

1081

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1082

exitcode = EXIT_FAILURE;

1083

goto end;

1084

}

1085

1086

if(quit_now){

1087

goto end;

1088

}

1089

1090

1017

#ifdef __linux__

1091

1018

/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO

1092

1019

messages to mess up the prompt */

1129

1056

}

1130

1057

if((network.ifr_flags & IFF_UP) == 0){

1131

1058

network.ifr_flags |= IFF_UP;

1132

take_down_interface = true;

1133

1059

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1134

1060

if(ret == -1){

1135

take_down_interface = false;

1136

1061

perror("ioctl SIOCSIFFLAGS");

1137

1062

exitcode = EXIT_FAILURE;

1138

1063

#ifdef __linux__

1160

1085

perror("nanosleep");

1161

1086

}

1162

1087

}

1163

if(not take_down_interface){

1164

/* We won't need the socket anymore */

1165

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1166

if(ret == -1){

1167

perror("close");

1168

}

1088

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1089

if(ret == -1){

1090

perror("close");

1169

1091

}

1170

1092

#ifdef __linux__

1171

1093

if(restore_loglevel){

1178

1100

#endif /* __linux__ */

1179

1101

}

1180

1102

1181

if(quit_now){

1182

goto end;

1183

}

1184

1185

1103

uid = getuid();

1186

1104

gid = getgid();

1187

1105

1196

1114

perror("setuid");

1197

1115

}

1198

1116

1199

if(quit_now){

1200

goto end;

1201

}

1202

1203

1117

ret = init_gnutls_global(pubkey, seckey);

1204

1118

if(ret == -1){

1205

1119

fprintf(stderr, "init_gnutls_global failed\n");

1209

1123

gnutls_initialized = true;

1210

1124

}

1211

1125

1212

if(quit_now){

1213

goto end;

1214

}

1215

1216

tempdir_created = true;

1217

1126

if(mkdtemp(tempdir) == NULL){

1218

tempdir_created = false;

1219

1127

perror("mkdtemp");

1220

1128

goto end;

1221

1129

}

1222

1223

if(quit_now){

1224

goto end;

1225

}

1130

tempdir_created = true;

1226

1131

1227

1132

if(not init_gpgme(pubkey, seckey, tempdir)){

1228

1133

fprintf(stderr, "init_gpgme failed\n");

1232

1137

gpgme_initialized = true;

1233

1138

}

1234

1139

1235

if(quit_now){

1236

goto end;

1140

if(interface[0] != '\0'){

1141

if_index = (AvahiIfIndex) if_nametoindex(interface);

1142

if(if_index == 0){

1143

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1144

exitcode = EXIT_FAILURE;

1145

goto end;

1146

}

1237

1147

}

1238

1148

1239

1149

if(connect_to != NULL){

1245

1155

exitcode = EXIT_FAILURE;

1246

1156

goto end;

1247

1157

}

1248

1249

if(quit_now){

1250

goto end;

1251

}

1252

1253

1158

uint16_t port;

1254

errno = 0;

1255

tmpmax = strtoimax(address+1, &tmp, 10);

1256

if(errno != 0 or tmp == address+1 or *tmp != '\0'

1257

or tmpmax != (uint16_t)tmpmax){

1159

ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);

1160

if(ret < 1 or tmpmax != (uint16_t)tmpmax

1161

or address[numchars+1] != '\0'){

1258

1162

fprintf(stderr, "Bad port number\n");

1259

1163

exitcode = EXIT_FAILURE;

1260

1164

goto end;

1261

1165

}

1262

1263

if(quit_now){

1264

goto end;

1265

}

1266

1267

1166

port = (uint16_t)tmpmax;

1268

1167

*address = '\0';

1269

1168

address = connect_to;

1274

1173

} else {

1275

1174

af = AF_INET;

1276

1175

}

1277

1278

if(quit_now){

1279

goto end;

1280

}

1281

1282

1176

ret = start_mandos_communication(address, port, if_index, af);

1283

1177

if(ret < 0){

1284

1178

exitcode = EXIT_FAILURE;

1288

1182

goto end;

1289

1183

}

1290

1184

1291

if(quit_now){

1185

if(not debug){

1186

avahi_set_log_function(empty_log);

1187

}

1188

1189

/* Initialize the pseudo-RNG for Avahi */

1190

srand((unsigned int) time(NULL));

1191

1192

/* Allocate main Avahi loop object */

1193

mc.simple_poll = avahi_simple_poll_new();

1194

if(mc.simple_poll == NULL){

1195

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1196

exitcode = EXIT_FAILURE;

1292

1197

goto end;

1293

1198

}

1294

1199

1318

1223

goto end;

1319

1224

}

1320

1225

1321

if(quit_now){

1322

goto end;

1323

}

1324

1325

1226

/* Create the Avahi service browser */

1326

1227

sb = avahi_s_service_browser_new(mc.server, if_index,

1327

AVAHI_PROTO_UNSPEC, "_mandos._tcp",

1228

AVAHI_PROTO_INET6, "_mandos._tcp",

1328

1229

NULL, 0, browse_callback, NULL);

1329

1230

if(sb == NULL){

1330

1231

fprintf(stderr, "Failed to create service browser: %s\n",

1333

1234

goto end;

1334

1235

}

1335

1236

1336

if(quit_now){

1337

goto end;

1338

}

1237

sigemptyset(&sigterm_action.sa_mask);

1238

ret = sigaddset(&sigterm_action.sa_mask, SIGINT);

1239

if(ret == -1){

1240

perror("sigaddset");

1241

exitcode = EXIT_FAILURE;

1242

goto end;

1243

}

1244

ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);

1245

if(ret == -1){

1246

perror("sigaddset");

1247

exitcode = EXIT_FAILURE;

1248

goto end;

1249

}

1250

ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);

1251

if(ret == -1){

1252

perror("sigaddset");

1253

exitcode = EXIT_FAILURE;

1254

goto end;

1255

}

1256

ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);

1257

if(ret == -1){

1258

perror("sigaction");

1259

exitcode = EXIT_FAILURE;

1260

goto end;

1261

}

1339

1262

1340

1263

/* Run the main loop */

1341

1264

1371

1294

gpgme_release(mc.ctx);

1372

1295

}

1373

1296

1374

/* Take down the network interface */

1375

if(take_down_interface){

1376

ret = ioctl(sd, SIOCGIFFLAGS, &network);

1377

if(ret == -1){

1378

perror("ioctl SIOCGIFFLAGS");

1379

} else if(network.ifr_flags & IFF_UP) {

1380

network.ifr_flags &= ~IFF_UP; /* clear flag */

1381

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1382

if(ret == -1){

1383

perror("ioctl SIOCSIFFLAGS");

1384

}

1385

}

1386

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1387

if(ret == -1){

1388

perror("close");

1389

}

1390

}

1391

1392

1297

/* Removes the temp directory used by GPGME */

1393

1298

if(tempdir_created){

1394

1299

DIR *d;

1433

1338

}

1434

1339

}

1435

1340

1436

if(quit_now){

1437

ret = sigaction(signal_received, &old_sigterm_action, NULL);

1438

if(ret == -1){

1439

perror("sigaction");

1440

}

1441

raise(signal_received);

1442

}

1443

1444

1341

return exitcode;

1445

1342

}