32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
33
#define _LARGEFILE_SOURCE
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
71
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
70
getuid(), getgid(), setuid(),
76
72
#include <arpa/inet.h> /* inet_pton(), htons */
77
73
#include <iso646.h> /* not, or, and */
80
76
argp_parse(), ARGP_KEY_ARG,
81
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
78
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
79
sigaction(), SIGTERM, sigaction,
87
83
#include <sys/klog.h> /* klogctl() */
310
306
gpgme_recipient_t recipient;
311
307
recipient = result->recipients;
312
while(recipient != NULL){
313
fprintf(stderr, "Public key algorithm: %s\n",
314
gpgme_pubkey_algo_name(recipient->pubkey_algo));
315
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
316
fprintf(stderr, "Secret key available: %s\n",
317
recipient->status == GPG_ERR_NO_SECKEY
319
recipient = recipient->next;
309
while(recipient != NULL){
310
fprintf(stderr, "Public key algorithm: %s\n",
311
gpgme_pubkey_algo_name(recipient->pubkey_algo));
312
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
313
fprintf(stderr, "Secret key available: %s\n",
314
recipient->status == GPG_ERR_NO_SECKEY
316
recipient = recipient->next;
514
512
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
515
513
__attribute__((unused)) const char *txt){}
517
sig_atomic_t quit_now = 0;
518
int signal_received = 0;
520
515
/* Called when a Mandos server is found */
521
516
static int start_mandos_communication(const char *ip, uint16_t port,
522
517
AvahiIfIndex if_index,
524
int ret, tcp_sd = -1;
527
522
struct sockaddr_in in;
531
526
char *decrypted_buffer;
532
527
size_t buffer_length = 0;
533
528
size_t buffer_capacity = 0;
529
ssize_t decrypted_buffer_size;
536
532
gnutls_session_t session;
537
533
int pf; /* Protocol family */
565
557
tcp_sd = socket(pf, SOCK_STREAM, 0);
567
559
perror("socket");
576
563
memset(&to, 0, sizeof(to));
577
564
if(af == AF_INET6){
578
to.in6.sin6_family = (sa_family_t)af;
565
to.in6.sin6_family = (uint16_t)af;
579
566
ret = inet_pton(af, ip, &to.in6.sin6_addr);
580
567
} else { /* IPv4 */
581
568
to.in.sin_family = (sa_family_t)af;
602
587
if(if_index == AVAHI_IF_UNSPEC){
603
588
fprintf(stderr, "An IPv6 link-local address is incomplete"
604
589
" without a network interface\n");
608
592
/* Set the network interface number as scope */
609
593
to.in6.sin6_scope_id = (uint32_t)if_index;
701
668
fprintf(stderr, "Establishing TLS session with %s\n", ip);
708
671
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
715
674
ret = gnutls_handshake(session);
719
675
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
721
677
if(ret != GNUTLS_E_SUCCESS){
763
710
case GNUTLS_E_AGAIN:
765
712
case GNUTLS_E_REHANDSHAKE:
767
714
ret = gnutls_handshake(session);
772
715
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
774
717
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
793
736
fprintf(stderr, "Closing TLS session\n");
800
739
gnutls_bye(session, GNUTLS_SHUT_RDWR);
806
741
if(buffer_length > 0){
807
ssize_t decrypted_buffer_size;
808
742
decrypted_buffer_size = pgp_packet_decrypt(buffer,
810
744
&decrypted_buffer);
811
745
if(decrypted_buffer_size >= 0){
814
747
while(written < (size_t) decrypted_buffer_size){
819
748
ret = (int)fwrite(decrypted_buffer + written, 1,
820
749
(size_t)decrypted_buffer_size - written,
876
sig_atomic_t quit_now = 0;
960
878
/* stop main loop after sigterm has been called */
961
static void handle_sigterm(int sig){
879
static void handle_sigterm(__attribute__((unused)) int sig){
966
signal_received = sig;
967
884
int old_errno = errno;
968
885
if(mc.simple_poll != NULL){
969
886
avahi_simple_poll_quit(mc.simple_poll);
1130
1046
exitcode = EXIT_FAILURE;
1133
/* Need to check if the handler is SIG_IGN before handling:
1134
| [[info:libc:Initial Signal Actions]] |
1135
| [[info:libc:Basic Signal Handling]] |
1137
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1139
perror("sigaction");
1140
return EXIT_FAILURE;
1142
if(old_sigterm_action.sa_handler != SIG_IGN){
1143
ret = sigaction(SIGINT, &sigterm_action, NULL);
1145
perror("sigaction");
1146
exitcode = EXIT_FAILURE;
1150
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1152
perror("sigaction");
1153
return EXIT_FAILURE;
1155
if(old_sigterm_action.sa_handler != SIG_IGN){
1156
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1158
perror("sigaction");
1159
exitcode = EXIT_FAILURE;
1163
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1165
perror("sigaction");
1166
return EXIT_FAILURE;
1168
if(old_sigterm_action.sa_handler != SIG_IGN){
1169
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1171
perror("sigaction");
1172
exitcode = EXIT_FAILURE;
1049
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1051
perror("sigaction");
1052
exitcode = EXIT_FAILURE;
1177
1056
/* If the interface is down, bring it up */
1178
1057
if(interface[0] != '\0'){
1179
if_index = (AvahiIfIndex) if_nametoindex(interface);
1181
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1182
exitcode = EXIT_FAILURE;
1190
1058
#ifdef __linux__
1191
1059
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1192
1060
messages to mess up the prompt */
1230
1098
if((network.ifr_flags & IFF_UP) == 0){
1231
1099
network.ifr_flags |= IFF_UP;
1232
take_down_interface = true;
1233
1100
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1235
take_down_interface = false;
1236
1102
perror("ioctl SIOCSIFFLAGS");
1237
1103
exitcode = EXIT_FAILURE;
1238
1104
#ifdef __linux__
1278
1141
#endif /* __linux__ */
1285
1144
uid = getuid();
1286
1145
gid = getgid();
1288
/* Drop any group privileges we might have, just to be safe */
1292
1150
perror("setgid");
1295
/* Drop user privileges */
1297
/* Will we need privileges later? */
1298
if(take_down_interface){
1299
/* Drop user privileges temporarily */
1305
/* Drop user privileges permanently */
1316
1158
ret = init_gnutls_global(pubkey, seckey);
1322
1164
gnutls_initialized = true;
1329
tempdir_created = true;
1330
1167
if(mkdtemp(tempdir) == NULL){
1331
tempdir_created = false;
1332
1168
perror("mkdtemp");
1171
tempdir_created = true;
1340
1173
if(not init_gpgme(pubkey, seckey, tempdir)){
1341
1174
fprintf(stderr, "init_gpgme failed\n");
1345
1178
gpgme_initialized = true;
1181
if(interface[0] != '\0'){
1182
if_index = (AvahiIfIndex) if_nametoindex(interface);
1184
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1185
exitcode = EXIT_FAILURE;
1352
1190
if(connect_to != NULL){
1438
1253
/* Create the Avahi service browser */
1439
1254
sb = avahi_s_service_browser_new(mc.server, if_index,
1440
1255
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1484
1295
gpgme_release(mc.ctx);
1487
/* Take down the network interface */
1488
if(take_down_interface){
1489
/* Re-raise priviliges */
1496
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1498
perror("ioctl SIOCGIFFLAGS");
1499
} else if(network.ifr_flags & IFF_UP) {
1500
network.ifr_flags &= ~IFF_UP; /* clear flag */
1501
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1503
perror("ioctl SIOCSIFFLAGS");
1506
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1510
/* Lower privileges, permanently this time */
1519
1298
/* Removes the temp directory used by GPGME */
1520
1299
if(tempdir_created){