/mandos/trunk : revision 309

30

*/

31

32

/* Needed by GPGME, specifically gpgme_data_seek() */

33

#ifndef _LARGEFILE_SOURCE

34

33

#define _LARGEFILE_SOURCE

35

#endif

36

#ifndef _FILE_OFFSET_BITS

37

34

#define _FILE_OFFSET_BITS 64

38

#endif

39

35

40

36

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */

41

37

42

38

#include <stdio.h> /* fprintf(), stderr, fwrite(),

43

stdout, ferror(), remove() */

39

stdout, ferror(), sscanf(),

40

remove() */

44

41

#include <stdint.h> /* uint16_t, uint32_t */

45

42

#include <stddef.h> /* NULL, size_t, ssize_t */

46

43

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

47

srand(), strtof() */

44

srand() */

48

45

#include <stdbool.h> /* bool, false, true */

49

46

#include <string.h> /* memset(), strcmp(), strlen(),

50

47

strerror(), asprintf(), strcpy() */

59

56

#include <fcntl.h> /* open() */

60

57

#include <dirent.h> /* opendir(), struct dirent, readdir()

61

58

*/

62

#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,

63

strtoimax() */

59

#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */

64

60

#include <assert.h> /* assert() */

65

61

#include <errno.h> /* perror(), errno */

66

62

#include <time.h> /* nanosleep(), time() */

309

305

}

310

306

gpgme_recipient_t recipient;

311

307

recipient = result->recipients;

312

while(recipient != NULL){

313

fprintf(stderr, "Public key algorithm: %s\n",

314

gpgme_pubkey_algo_name(recipient->pubkey_algo));

315

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

316

fprintf(stderr, "Secret key available: %s\n",

317

recipient->status == GPG_ERR_NO_SECKEY

318

? "No" : "Yes");

319

recipient = recipient->next;

308

if(recipient){

309

while(recipient != NULL){

310

fprintf(stderr, "Public key algorithm: %s\n",

311

gpgme_pubkey_algo_name(recipient->pubkey_algo));

312

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

313

fprintf(stderr, "Secret key available: %s\n",

314

recipient->status == GPG_ERR_NO_SECKEY

315

? "No" : "Yes");

316

recipient = recipient->next;

317

}

320

318

}

321

319

}

322

320

}

564

562

565

563

memset(&to, 0, sizeof(to));

566

564

if(af == AF_INET6){

567

to.in6.sin6_family = (sa_family_t)af;

565

to.in6.sin6_family = (uint16_t)af;

568

566

ret = inet_pton(af, ip, &to.in6.sin6_addr);

569

567

} else { /* IPv4 */

570

568

to.in.sin_family = (sa_family_t)af;

780

778

return retval;

781

779

}

782

780

783

sig_atomic_t quit_now = 0;

784

785

781

static void resolve_callback(AvahiSServiceResolver *r,

786

782

AvahiIfIndex interface,

787

783

AvahiProtocol proto,

801

797

/* Called whenever a service has been resolved successfully or

802

798

timed out */

803

799

804

if(quit_now){

805

return;

806

}

807

808

800

switch(event){

809

801

default:

810

802

case AVAHI_RESOLVER_FAILURE:

862

854

the callback function is called the Avahi server will free the

863

855

resolver for us. */

864

856

865

if(avahi_s_service_resolver_new(mc.server, interface, protocol,

866

name, type, domain, protocol, 0,

867

resolve_callback, NULL) == NULL)

857

if(!(avahi_s_service_resolver_new(mc.server, interface,

858

protocol, name, type, domain,

859

AVAHI_PROTO_INET6, 0,

860

resolve_callback, NULL)))

868

861

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

869

862

name, avahi_strerror(avahi_server_errno(mc.server)));

870

863

break;

881

874

}

882

875

}

883

876

877

sig_atomic_t quit_now = 0;

878

884

879

/* stop main loop after sigterm has been called */

885

880

static void handle_sigterm(__attribute__((unused)) int sig){

886

881

if(quit_now){

899

894

int error;

900

895

int ret;

901

896

intmax_t tmpmax;

902

char *tmp;

897

int numchars;

903

898

int exitcode = EXIT_SUCCESS;

904

899

const char *interface = "eth0";

905

900

struct ifreq network;

906

int sd = -1;

907

bool take_down_interface = false;

901

int sd;

908

902

uid_t uid;

909

903

gid_t gid;

910

904

char *connect_to = NULL;

914

908

const char *seckey = PATHDIR "/" SECKEY;

915

909

const char *pubkey = PATHDIR "/" PUBKEY;

916

910

911

/* Initialize Mandos context */

912

mc = (mandos_context){ .simple_poll = NULL, .server = NULL,

913

.dh_bits = 1024, .priority = "SECURE256"

914

":!CTYPE-X.509:+CTYPE-OPENPGP" };

917

915

bool gnutls_initialized = false;

918

916

bool gpgme_initialized = false;

919

float delay = 2.5f;

920

917

double delay = 2.5;

918

921

919

struct sigaction old_sigterm_action;

922

920

struct sigaction sigterm_action = { .sa_handler = handle_sigterm };

923

921

977

975

pubkey = arg;

978

976

break;

979

977

case 129: /* --dh-bits */

980

errno = 0;

981

tmpmax = strtoimax(arg, &tmp, 10);

982

if(errno != 0 or tmp == arg or *tmp != '\0'

983

or tmpmax != (typeof(mc.dh_bits))tmpmax){

978

ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);

979

if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax

980

or arg[numchars] != '\0'){

984

981

fprintf(stderr, "Bad number of DH bits\n");

985

982

exit(EXIT_FAILURE);

986

983

}

990

987

mc.priority = arg;

991

988

break;

992

989

case 131: /* --delay */

993

errno = 0;

994

delay = strtof(arg, &tmp);

995

if(errno != 0 or tmp == arg or *tmp != '\0'){

990

ret = sscanf(arg, "%lf%n", &delay, &numchars);

991

if(ret < 1 or arg[numchars] != '\0'){

996

992

fprintf(stderr, "Bad delay\n");

997

993

exit(EXIT_FAILURE);

998

994

}

1062

1058

1063

1059

/* If the interface is down, bring it up */

1064

1060

if(interface[0] != '\0'){

1065

if_index = (AvahiIfIndex) if_nametoindex(interface);

1066

if(if_index == 0){

1067

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1068

exitcode = EXIT_FAILURE;

1069

goto end;

1070

}

1071

1072

if(quit_now){

1073

goto end;

1074

}

1075

1076

1061

#ifdef __linux__

1077

1062

/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO

1078

1063

messages to mess up the prompt */

1115

1100

}

1116

1101

if((network.ifr_flags & IFF_UP) == 0){

1117

1102

network.ifr_flags |= IFF_UP;

1118

take_down_interface = true;

1119

1103

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1120

1104

if(ret == -1){

1121

take_down_interface = false;

1122

1105

perror("ioctl SIOCSIFFLAGS");

1123

1106

exitcode = EXIT_FAILURE;

1124

1107

#ifdef __linux__

1146

1129

perror("nanosleep");

1147

1130

}

1148

1131

}

1149

if(not take_down_interface){

1150

/* We won't need the socket anymore */

1151

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1152

if(ret == -1){

1153

perror("close");

1154

}

1132

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1133

if(ret == -1){

1134

perror("close");

1155

1135

}

1156

1136

#ifdef __linux__

1157

1137

if(restore_loglevel){

1164

1144

#endif /* __linux__ */

1165

1145

}

1166

1146

1167

if(quit_now){

1168

goto end;

1169

}

1170

1171

1147

uid = getuid();

1172

1148

gid = getgid();

1173

1149

1182

1158

perror("setuid");

1183

1159

}

1184

1160

1185

if(quit_now){

1186

goto end;

1187

}

1188

1189

1161

ret = init_gnutls_global(pubkey, seckey);

1190

1162

if(ret == -1){

1191

1163

fprintf(stderr, "init_gnutls_global failed\n");

1195

1167

gnutls_initialized = true;

1196

1168

}

1197

1169

1198

if(quit_now){

1199

goto end;

1200

}

1201

1202

tempdir_created = true;

1203

1170

if(mkdtemp(tempdir) == NULL){

1204

tempdir_created = false;

1205

1171

perror("mkdtemp");

1206

1172

goto end;

1207

1173

}

1208

1209

if(quit_now){

1210

goto end;

1211

}

1174

tempdir_created = true;

1212

1175

1213

1176

if(not init_gpgme(pubkey, seckey, tempdir)){

1214

1177

fprintf(stderr, "init_gpgme failed\n");

1218

1181

gpgme_initialized = true;

1219

1182

}

1220

1183

1221

if(quit_now){

1222

goto end;

1184

if(interface[0] != '\0'){

1185

if_index = (AvahiIfIndex) if_nametoindex(interface);

1186

if(if_index == 0){

1187

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1188

exitcode = EXIT_FAILURE;

1189

goto end;

1190

}

1223

1191

}

1224

1192

1225

1193

if(connect_to != NULL){

1231

1199

exitcode = EXIT_FAILURE;

1232

1200

goto end;

1233

1201

}

1234

1235

if(quit_now){

1236

goto end;

1237

}

1238

1239

1202

uint16_t port;

1240

errno = 0;

1241

tmpmax = strtoimax(address+1, &tmp, 10);

1242

if(errno != 0 or tmp == address+1 or *tmp != '\0'

1243

or tmpmax != (uint16_t)tmpmax){

1203

ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);

1204

if(ret < 1 or tmpmax != (uint16_t)tmpmax

1205

or address[numchars+1] != '\0'){

1244

1206

fprintf(stderr, "Bad port number\n");

1245

1207

exitcode = EXIT_FAILURE;

1246

1208

goto end;

1247

1209

}

1248

1249

if(quit_now){

1250

goto end;

1251

}

1252

1253

1210

port = (uint16_t)tmpmax;

1254

1211

*address = '\0';

1255

1212

address = connect_to;

1260

1217

} else {

1261

1218

af = AF_INET;

1262

1219

}

1263

1264

if(quit_now){

1265

goto end;

1266

}

1267

1268

1220

ret = start_mandos_communication(address, port, if_index, af);

1269

1221

if(ret < 0){

1270

1222

exitcode = EXIT_FAILURE;

1273

1225

}

1274

1226

goto end;

1275

1227

}

1276

1277

if(quit_now){

1278

goto end;

1279

}

1280

1228

1281

1229

{

1282

1230

AvahiServerConfig config;

1283

1231

/* Do not publish any local Zeroconf records */

1304

1252

goto end;

1305

1253

}

1306

1254

1307

if(quit_now){

1308

goto end;

1309

}

1310

1311

1255

/* Create the Avahi service browser */

1312

1256

sb = avahi_s_service_browser_new(mc.server, if_index,

1313

AVAHI_PROTO_UNSPEC, "_mandos._tcp",

1257

AVAHI_PROTO_INET6, "_mandos._tcp",

1314

1258

NULL, 0, browse_callback, NULL);

1315

1259

if(sb == NULL){

1316

1260

fprintf(stderr, "Failed to create service browser: %s\n",

1319

1263

goto end;

1320

1264

}

1321

1265

1322

if(quit_now){

1323

goto end;

1324

}

1325

1326

1266

/* Run the main loop */

1327

1267

1328

1268

if(debug){

1357

1297

gpgme_release(mc.ctx);

1358

1298

}

1359

1299

1360

/* Take down the network interface */

1361

if(take_down_interface){

1362

ret = ioctl(sd, SIOCGIFFLAGS, &network);

1363

if(ret == -1){

1364

perror("ioctl SIOCGIFFLAGS");

1365

} else if(network.ifr_flags & IFF_UP) {

1366

network.ifr_flags &= ~IFF_UP; /* clear flag */

1367

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1368

if(ret == -1){

1369

perror("ioctl SIOCSIFFLAGS");

1370

}

1371

}

1372

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1373

if(ret == -1){

1374

perror("close");

1375

}

1376

}

1377

1378

1300

/* Removes the temp directory used by GPGME */

1379

1301

if(tempdir_created){

1380

1302

DIR *d;