/mandos/trunk : revision 312

30

*/

31

32

/* Needed by GPGME, specifically gpgme_data_seek() */

33

#ifndef _LARGEFILE_SOURCE

34

33

#define _LARGEFILE_SOURCE

35

#endif

36

#ifndef _FILE_OFFSET_BITS

37

34

#define _FILE_OFFSET_BITS 64

38

#endif

39

35

40

36

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */

41

37

80

76

argp_parse(), ARGP_KEY_ARG,

81

77

ARGP_KEY_END, ARGP_ERR_UNKNOWN */

82

78

#include <signal.h> /* sigemptyset(), sigaddset(),

83

sigaction(), SIGTERM, sig_atomic_t,

84

raise() */

79

sigaction(), SIGTERM, sigaction,

80

sig_atomic_t */

85

81

86

82

#ifdef __linux__

87

83

#include <sys/klog.h> /* klogctl() */

249

245

return false;

250

246

}

251

247

252

return true;

248

return true;

253

249

}

254

250

255

251

/*

309

305

}

310

306

gpgme_recipient_t recipient;

311

307

recipient = result->recipients;

312

while(recipient != NULL){

313

fprintf(stderr, "Public key algorithm: %s\n",

314

gpgme_pubkey_algo_name(recipient->pubkey_algo));

315

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

316

fprintf(stderr, "Secret key available: %s\n",

317

recipient->status == GPG_ERR_NO_SECKEY

318

? "No" : "Yes");

319

recipient = recipient->next;

308

if(recipient){

309

while(recipient != NULL){

310

fprintf(stderr, "Public key algorithm: %s\n",

311

gpgme_pubkey_algo_name(recipient->pubkey_algo));

312

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

313

fprintf(stderr, "Secret key available: %s\n",

314

recipient->status == GPG_ERR_NO_SECKEY

315

? "No" : "Yes");

316

recipient = recipient->next;

317

}

320

318

}

321

319

}

322

320

}

514

512

static void empty_log(__attribute__((unused)) AvahiLogLevel level,

515

513

__attribute__((unused)) const char *txt){}

516

514

517

sig_atomic_t quit_now = 0;

518

int signal_received = 0;

519

520

515

/* Called when a Mandos server is found */

521

516

static int start_mandos_communication(const char *ip, uint16_t port,

522

517

AvahiIfIndex if_index,

567

562

568

563

memset(&to, 0, sizeof(to));

569

564

if(af == AF_INET6){

570

to.in6.sin6_family = (sa_family_t)af;

565

to.in6.sin6_family = (uint16_t)af;

571

566

ret = inet_pton(af, ip, &to.in6.sin6_addr);

572

567

} else { /* IPv4 */

573

568

to.in.sin_family = (sa_family_t)af;

802

797

/* Called whenever a service has been resolved successfully or

803

798

timed out */

804

799

805

if(quit_now){

806

return;

807

}

808

809

800

switch(event){

810

801

default:

811

802

case AVAHI_RESOLVER_FAILURE:

863

854

the callback function is called the Avahi server will free the

864

855

resolver for us. */

865

856

866

if(avahi_s_service_resolver_new(mc.server, interface, protocol,

867

name, type, domain, protocol, 0,

868

resolve_callback, NULL) == NULL)

857

if(!(avahi_s_service_resolver_new(mc.server, interface,

858

protocol, name, type, domain,

859

AVAHI_PROTO_INET6, 0,

860

resolve_callback, NULL)))

869

861

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

870

862

name, avahi_strerror(avahi_server_errno(mc.server)));

871

863

break;

882

874

}

883

875

}

884

876

877

sig_atomic_t quit_now = 0;

878

885

879

/* stop main loop after sigterm has been called */

886

static void handle_sigterm(int sig){

880

static void handle_sigterm(__attribute__((unused)) int sig){

887

881

if(quit_now){

888

882

return;

889

883

}

890

884

quit_now = 1;

891

signal_received = sig;

892

885

int old_errno = errno;

893

886

if(mc.simple_poll != NULL){

894

887

avahi_simple_poll_quit(mc.simple_poll);

905

898

int exitcode = EXIT_SUCCESS;

906

899

const char *interface = "eth0";

907

900

struct ifreq network;

908

int sd = -1;

909

bool take_down_interface = false;

901

int sd;

910

902

uid_t uid;

911

903

gid_t gid;

912

904

char *connect_to = NULL;

916

908

const char *seckey = PATHDIR "/" SECKEY;

917

909

const char *pubkey = PATHDIR "/" PUBKEY;

918

910

911

/* Initialize Mandos context */

912

mc = (mandos_context){ .simple_poll = NULL, .server = NULL,

913

.dh_bits = 1024, .priority = "SECURE256"

914

":!CTYPE-X.509:+CTYPE-OPENPGP" };

919

915

bool gnutls_initialized = false;

920

916

bool gpgme_initialized = false;

921

917

float delay = 2.5f;

1055

1051

exitcode = EXIT_FAILURE;

1056

1052

goto end;

1057

1053

}

1058

/* Need to check if the handler is SIG_IGN before handling:

1059

| [[info:libc:Initial Signal Actions]] |

1060

| [[info:libc:Basic Signal Handling]] |

1061

*/

1062

ret = sigaction(SIGINT, NULL, &old_sigterm_action);

1063

if(ret == -1){

1064

perror("sigaction");

1065

return EXIT_FAILURE;

1066

}

1067

if(old_sigterm_action.sa_handler != SIG_IGN){

1068

ret = sigaction(SIGINT, &sigterm_action, NULL);

1069

if(ret == -1){

1070

perror("sigaction");

1071

exitcode = EXIT_FAILURE;

1072

goto end;

1073

}

1074

}

1075

ret = sigaction(SIGHUP, NULL, &old_sigterm_action);

1076

if(ret == -1){

1077

perror("sigaction");

1078

return EXIT_FAILURE;

1079

}

1080

if(old_sigterm_action.sa_handler != SIG_IGN){

1081

ret = sigaction(SIGHUP, &sigterm_action, NULL);

1082

if(ret == -1){

1083

perror("sigaction");

1084

exitcode = EXIT_FAILURE;

1085

goto end;

1086

}

1087

}

1088

ret = sigaction(SIGTERM, NULL, &old_sigterm_action);

1089

if(ret == -1){

1090

perror("sigaction");

1091

return EXIT_FAILURE;

1092

}

1093

if(old_sigterm_action.sa_handler != SIG_IGN){

1094

ret = sigaction(SIGTERM, &sigterm_action, NULL);

1095

if(ret == -1){

1096

perror("sigaction");

1097

exitcode = EXIT_FAILURE;

1098

goto end;

1099

}

1100

}

1054

ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);

1055

if(ret == -1){

1056

perror("sigaction");

1057

exitcode = EXIT_FAILURE;

1058

goto end;

1059

}

1101

1060

1102

1061

/* If the interface is down, bring it up */

1103

1062

if(interface[0] != '\0'){

1104

if_index = (AvahiIfIndex) if_nametoindex(interface);

1105

if(if_index == 0){

1106

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1107

exitcode = EXIT_FAILURE;

1108

goto end;

1109

}

1110

1111

if(quit_now){

1112

goto end;

1113

}

1114

1115

1063

#ifdef __linux__

1116

1064

/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO

1117

1065

messages to mess up the prompt */

1154

1102

}

1155

1103

if((network.ifr_flags & IFF_UP) == 0){

1156

1104

network.ifr_flags |= IFF_UP;

1157

take_down_interface = true;

1158

1105

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1159

1106

if(ret == -1){

1160

take_down_interface = false;

1161

1107

perror("ioctl SIOCSIFFLAGS");

1162

1108

exitcode = EXIT_FAILURE;

1163

1109

#ifdef __linux__

1185

1131

perror("nanosleep");

1186

1132

}

1187

1133

}

1188

if(not take_down_interface){

1189

/* We won't need the socket anymore */

1190

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1191

if(ret == -1){

1192

perror("close");

1193

}

1134

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1135

if(ret == -1){

1136

perror("close");

1194

1137

}

1195

1138

#ifdef __linux__

1196

1139

if(restore_loglevel){

1203

1146

#endif /* __linux__ */

1204

1147

}

1205

1148

1206

if(quit_now){

1207

goto end;

1208

}

1209

1210

1149

uid = getuid();

1211

1150

gid = getgid();

1212

1151

1221

1160

perror("setuid");

1222

1161

}

1223

1162

1224

if(quit_now){

1225

goto end;

1226

}

1227

1228

1163

ret = init_gnutls_global(pubkey, seckey);

1229

1164

if(ret == -1){

1230

1165

fprintf(stderr, "init_gnutls_global failed\n");

1234

1169

gnutls_initialized = true;

1235

1170

}

1236

1171

1237

if(quit_now){

1238

goto end;

1239

}

1240

1241

tempdir_created = true;

1242

1172

if(mkdtemp(tempdir) == NULL){

1243

tempdir_created = false;

1244

1173

perror("mkdtemp");

1245

1174

goto end;

1246

1175

}

1247

1248

if(quit_now){

1249

goto end;

1250

}

1176

tempdir_created = true;

1251

1177

1252

1178

if(not init_gpgme(pubkey, seckey, tempdir)){

1253

1179

fprintf(stderr, "init_gpgme failed\n");

1257

1183

gpgme_initialized = true;

1258

1184

}

1259

1185

1260

if(quit_now){

1261

goto end;

1186

if(interface[0] != '\0'){

1187

if_index = (AvahiIfIndex) if_nametoindex(interface);

1188

if(if_index == 0){

1189

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1190

exitcode = EXIT_FAILURE;

1191

goto end;

1192

}

1262

1193

}

1263

1194

1264

1195

if(connect_to != NULL){

1270

1201

exitcode = EXIT_FAILURE;

1271

1202

goto end;

1272

1203

}

1273

1274

if(quit_now){

1275

goto end;

1276

}

1277

1278

1204

uint16_t port;

1279

1205

errno = 0;

1280

1206

tmpmax = strtoimax(address+1, &tmp, 10);

1284

1210

exitcode = EXIT_FAILURE;

1285

1211

goto end;

1286

1212

}

1287

1288

if(quit_now){

1289

goto end;

1290

}

1291

1292

1213

port = (uint16_t)tmpmax;

1293

1214

*address = '\0';

1294

1215

address = connect_to;

1299

1220

} else {

1300

1221

af = AF_INET;

1301

1222

}

1302

1303

if(quit_now){

1304

goto end;

1305

}

1306

1307

1223

ret = start_mandos_communication(address, port, if_index, af);

1308

1224

if(ret < 0){

1309

1225

exitcode = EXIT_FAILURE;

1312

1228

}

1313

1229

goto end;

1314

1230

}

1315

1316

if(quit_now){

1317

goto end;

1318

}

1319

1231

1320

1232

{

1321

1233

AvahiServerConfig config;

1322

1234

/* Do not publish any local Zeroconf records */

1343

1255

goto end;

1344

1256

}

1345

1257

1346

if(quit_now){

1347

goto end;

1348

}

1349

1350

1258

/* Create the Avahi service browser */

1351

1259

sb = avahi_s_service_browser_new(mc.server, if_index,

1352

AVAHI_PROTO_UNSPEC, "_mandos._tcp",

1260

AVAHI_PROTO_INET6, "_mandos._tcp",

1353

1261

NULL, 0, browse_callback, NULL);

1354

1262

if(sb == NULL){

1355

1263

fprintf(stderr, "Failed to create service browser: %s\n",

1358

1266

goto end;

1359

1267

}

1360

1268

1361

if(quit_now){

1362

goto end;

1363

}

1364

1365

1269

/* Run the main loop */

1366

1270

1367

1271

if(debug){

1396

1300

gpgme_release(mc.ctx);

1397

1301

}

1398

1302

1399

/* Take down the network interface */

1400

if(take_down_interface){

1401

ret = ioctl(sd, SIOCGIFFLAGS, &network);

1402

if(ret == -1){

1403

perror("ioctl SIOCGIFFLAGS");

1404

} else if(network.ifr_flags & IFF_UP) {

1405

network.ifr_flags &= ~IFF_UP; /* clear flag */

1406

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1407

if(ret == -1){

1408

perror("ioctl SIOCSIFFLAGS");

1409

}

1410

}

1411

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1412

if(ret == -1){

1413

perror("close");

1414

}

1415

}

1416

1417

1303

/* Removes the temp directory used by GPGME */

1418

1304

if(tempdir_created){

1419

1305

DIR *d;

1458

1344

}

1459

1345

}

1460

1346

1461

if(quit_now){

1462

sigemptyset(&old_sigterm_action.sa_mask);

1463

old_sigterm_action.sa_handler = SIG_DFL;

1464

ret = sigaction(signal_received, &old_sigterm_action, NULL);

1465

if(ret == -1){

1466

perror("sigaction");

1467

}

1468

raise(signal_received);

1469

}

1470

1471

1347

return exitcode;

1472

1348

}