104
45
#include <avahi-common/malloc.h>
105
46
#include <avahi-common/error.h>
108
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
111
init_gnutls_session(),
113
#include <gnutls/openpgp.h>
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
118
#include <gpgme.h> /* All GPGME types, constants and
121
GPGME_PROTOCOL_OpenPGP,
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
63
#include <errno.h> /* perror() */
124
69
#define BUFFER_SIZE 256
126
#define PATHDIR "/conf/conf.d/mandos"
127
#define SECKEY "seckey.txt"
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
72
const char *certdir = "/conf/conf.d/cryptkeyreq/";
73
const char *certfile = "openpgp-client.txt";
74
const char *certkey = "openpgp-client-key.txt";
131
76
bool debug = false;
132
static const char mandos_protocol_version[] = "1";
133
const char *argp_program_version = "mandos-client " VERSION;
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
135
static const char sys_class_net[] = "/sys/class/net";
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
139
/* Doubly linked list that need to be circularly linked when used */
140
typedef struct server{
143
AvahiIfIndex if_index;
145
struct timespec last_seen;
150
/* Used for passing in values through the Avahi callback functions */
152
AvahiSimplePoll *simple_poll;
79
gnutls_session_t session;
154
80
gnutls_certificate_credentials_t cred;
155
unsigned int dh_bits;
156
81
gnutls_dh_params_t dh_params;
157
const char *priority;
85
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
86
char **new_packet, const char *homedir){
87
gpgme_data_t dh_crypto, dh_plain;
159
server *current_server;
162
/* global context so signal handler can reach it*/
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
164
.dh_bits = 1024, .priority = "SECURE256"
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
168
sig_atomic_t quit_now = 0;
169
int signal_received = 0;
171
/* Function to use when printing errors */
172
void perror_plus(const char *print_text){
174
fprintf(stderr, "Mandos plugin %s: ",
175
program_invocation_short_name);
180
__attribute__((format (gnu_printf, 2, 3)))
181
int fprintf_plus(FILE *stream, const char *format, ...){
183
va_start (ap, format);
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
186
program_invocation_short_name));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
191
* Make additional room in "buffer" for at least BUFFER_SIZE more
192
* bytes. "buffer_capacity" is how much is currently allocated,
193
* "buffer_length" is how much is already used.
195
size_t incbuffer(char **buffer, size_t buffer_length,
196
size_t buffer_capacity){
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
202
buffer_capacity += BUFFER_SIZE;
204
return buffer_capacity;
207
/* Add server to set of servers to retry periodically */
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
211
server *new_server = malloc(sizeof(server));
212
if(new_server == NULL){
213
perror_plus("malloc");
216
*new_server = (server){ .ip = strdup(ip),
218
.if_index = if_index,
220
if(new_server->ip == NULL){
221
perror_plus("strdup");
224
/* Special case of first server */
225
if (mc.current_server == NULL){
226
new_server->next = new_server;
227
new_server->prev = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
233
new_server->prev->next = new_server;
234
mc.current_server->prev = new_server;
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
238
perror_plus("clock_gettime");
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
91
ssize_t new_packet_capacity = 0;
92
ssize_t new_packet_length = 0;
250
93
gpgme_engine_info_t engine_info;
254
* Helper function to insert pub and seckey to the engine keyring.
256
bool import_key(const char *filename){
259
gpgme_data_t pgp_data;
261
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
267
rc = gpgme_data_new_from_fd(&pgp_data, fd);
268
if(rc != GPG_ERR_NO_ERROR){
269
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
270
gpgme_strsource(rc), gpgme_strerror(rc));
274
rc = gpgme_op_import(mc.ctx, pgp_data);
275
if(rc != GPG_ERR_NO_ERROR){
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
281
ret = (int)TEMP_FAILURE_RETRY(close(fd));
283
perror_plus("close");
285
gpgme_data_release(pgp_data);
290
fprintf_plus(stderr, "Initializing GPGME\n");
96
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
294
100
gpgme_check_version(NULL);
295
101
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
296
if(rc != GPG_ERR_NO_ERROR){
297
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
102
if (rc != GPG_ERR_NO_ERROR){
103
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
104
gpgme_strsource(rc), gpgme_strerror(rc));
302
/* Set GPGME home directory for the OpenPGP engine only */
303
rc = gpgme_get_engine_info(&engine_info);
304
if(rc != GPG_ERR_NO_ERROR){
305
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
gpgme_strsource(rc), gpgme_strerror(rc));
108
/* Set GPGME home directory */
109
rc = gpgme_get_engine_info (&engine_info);
110
if (rc != GPG_ERR_NO_ERROR){
111
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
112
gpgme_strsource(rc), gpgme_strerror(rc));
309
115
while(engine_info != NULL){
310
116
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
311
117
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
312
engine_info->file_name, tempdir);
118
engine_info->file_name, homedir);
315
121
engine_info = engine_info->next;
317
123
if(engine_info == NULL){
318
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
323
/* Create new GPGME "context" */
324
rc = gpgme_new(&(mc.ctx));
325
if(rc != GPG_ERR_NO_ERROR){
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
332
if(not import_key(pubkey) or not import_key(seckey)){
340
* Decrypt OpenPGP data.
341
* Returns -1 on error
343
static ssize_t pgp_packet_decrypt(const char *cryptotext,
346
gpgme_data_t dh_crypto, dh_plain;
349
size_t plaintext_capacity = 0;
350
ssize_t plaintext_length = 0;
353
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
356
/* Create new GPGME data buffer from memory cryptotext */
357
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
359
if(rc != GPG_ERR_NO_ERROR){
360
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
124
fprintf(stderr, "Could not set home dir to %s\n", homedir);
128
/* Create new GPGME data buffer from packet buffer */
129
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
130
if (rc != GPG_ERR_NO_ERROR){
131
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
132
gpgme_strsource(rc), gpgme_strerror(rc));
365
136
/* Create new empty GPGME data buffer for the plaintext */
366
137
rc = gpgme_data_new(&dh_plain);
367
if(rc != GPG_ERR_NO_ERROR){
368
fprintf_plus(stderr, "Mandos plugin mandos-client: "
369
"bad gpgme_data_new: %s: %s\n",
370
gpgme_strsource(rc), gpgme_strerror(rc));
371
gpgme_data_release(dh_crypto);
375
/* Decrypt data from the cryptotext data buffer to the plaintext
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
378
if(rc != GPG_ERR_NO_ERROR){
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
381
plaintext_length = -1;
383
gpgme_decrypt_result_t result;
384
result = gpgme_op_decrypt_result(mc.ctx);
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
388
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
389
result->unsupported_algorithm);
390
fprintf_plus(stderr, "Wrong key usage: %u\n",
391
result->wrong_key_usage);
392
if(result->file_name != NULL){
393
fprintf_plus(stderr, "File name: %s\n", result->file_name);
395
gpgme_recipient_t recipient;
396
recipient = result->recipients;
138
if (rc != GPG_ERR_NO_ERROR){
139
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
140
gpgme_strsource(rc), gpgme_strerror(rc));
144
/* Create new GPGME "context" */
145
rc = gpgme_new(&ctx);
146
if (rc != GPG_ERR_NO_ERROR){
147
fprintf(stderr, "bad gpgme_new: %s: %s\n",
148
gpgme_strsource(rc), gpgme_strerror(rc));
152
/* Decrypt data from the FILE pointer to the plaintext data
154
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
155
if (rc != GPG_ERR_NO_ERROR){
156
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
157
gpgme_strsource(rc), gpgme_strerror(rc));
162
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
166
gpgme_decrypt_result_t result;
167
result = gpgme_op_decrypt_result(ctx);
169
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
171
fprintf(stderr, "Unsupported algorithm: %s\n",
172
result->unsupported_algorithm);
173
fprintf(stderr, "Wrong key usage: %d\n",
174
result->wrong_key_usage);
175
if(result->file_name != NULL){
176
fprintf(stderr, "File name: %s\n", result->file_name);
178
gpgme_recipient_t recipient;
179
recipient = result->recipients;
397
181
while(recipient != NULL){
398
fprintf_plus(stderr, "Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name
400
(recipient->pubkey_algo));
401
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
402
fprintf_plus(stderr, "Secret key available: %s\n",
403
recipient->status == GPG_ERR_NO_SECKEY
182
fprintf(stderr, "Public key algorithm: %s\n",
183
gpgme_pubkey_algo_name(recipient->pubkey_algo));
184
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
185
fprintf(stderr, "Secret key available: %s\n",
186
recipient->status == GPG_ERR_NO_SECKEY
405
188
recipient = recipient->next;
413
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
194
/* Delete the GPGME FILE pointer cryptotext data buffer */
195
gpgme_data_release(dh_crypto);
416
197
/* Seek back to the beginning of the GPGME plaintext data buffer */
417
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
418
perror_plus("gpgme_data_seek");
419
plaintext_length = -1;
198
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
199
perror("pgpme_data_seek");
425
plaintext_capacity = incbuffer(plaintext,
426
(size_t)plaintext_length,
428
if(plaintext_capacity == 0){
429
perror_plus("incbuffer");
430
plaintext_length = -1;
204
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
205
*new_packet = realloc(*new_packet,
206
(unsigned int)new_packet_capacity
208
if (*new_packet == NULL){
212
new_packet_capacity += BUFFER_SIZE;
434
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
215
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
436
217
/* Print the data, if any */
442
perror_plus("gpgme_data_read");
443
plaintext_length = -1;
446
plaintext_length += ret;
450
fprintf_plus(stderr, "Decrypted password is: ");
451
for(ssize_t i = 0; i < plaintext_length; i++){
452
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
454
fprintf(stderr, "\n");
459
/* Delete the GPGME cryptotext data buffer */
460
gpgme_data_release(dh_crypto);
222
perror("gpgme_data_read");
225
new_packet_length += ret;
228
/* FIXME: check characters before printing to screen so to not print
229
terminal control characters */
231
/* fprintf(stderr, "decrypted password is: "); */
232
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
233
/* fprintf(stderr, "\n"); */
462
236
/* Delete the GPGME plaintext data buffer */
463
237
gpgme_data_release(dh_plain);
464
return plaintext_length;
238
return new_packet_length;
467
static const char * safer_gnutls_strerror(int value){
468
const char *ret = gnutls_strerror(value); /* Spurious warning from
469
-Wunreachable-code */
241
static const char * safer_gnutls_strerror (int value) {
242
const char *ret = gnutls_strerror (value);
471
244
ret = "(unknown)";
475
/* GnuTLS log function callback */
476
static void debuggnutls(__attribute__((unused)) int level,
478
fprintf_plus(stderr, "GnuTLS: %s", string);
248
void debuggnutls(__attribute__((unused)) int level,
250
fprintf(stderr, "%s", string);
481
static int init_gnutls_global(const char *pubkeyfilename,
482
const char *seckeyfilename){
253
int initgnutls(encrypted_session *es){
486
fprintf_plus(stderr, "Initializing GnuTLS\n");
258
fprintf(stderr, "Initializing GnuTLS\n");
489
ret = gnutls_global_init();
490
if(ret != GNUTLS_E_SUCCESS){
491
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
492
safer_gnutls_strerror(ret));
261
if ((ret = gnutls_global_init ())
262
!= GNUTLS_E_SUCCESS) {
263
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
497
/* "Use a log level over 10 to enable all debugging options."
500
268
gnutls_global_set_log_level(11);
501
269
gnutls_global_set_log_function(debuggnutls);
504
/* OpenPGP credentials */
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
506
if(ret != GNUTLS_E_SUCCESS){
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
508
safer_gnutls_strerror(ret));
509
gnutls_global_deinit();
272
/* openpgp credentials */
273
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
274
!= GNUTLS_E_SUCCESS) {
275
fprintf (stderr, "memory error: %s\n",
276
safer_gnutls_strerror(ret));
514
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
515
" secret key %s as GnuTLS credentials\n",
281
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
282
" and keyfile %s as GnuTLS credentials\n", certfile,
520
286
ret = gnutls_certificate_set_openpgp_key_file
521
(mc.cred, pubkeyfilename, seckeyfilename,
522
GNUTLS_OPENPGP_FMT_BASE64);
523
if(ret != GNUTLS_E_SUCCESS){
525
"Error[%d] while reading the OpenPGP key pair ('%s',"
526
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
527
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
528
safer_gnutls_strerror(ret));
532
/* GnuTLS server initialization */
533
ret = gnutls_dh_params_init(&mc.dh_params);
534
if(ret != GNUTLS_E_SUCCESS){
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
" initialization: %s\n",
537
safer_gnutls_strerror(ret));
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
541
if(ret != GNUTLS_E_SUCCESS){
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
safer_gnutls_strerror(ret));
547
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
553
gnutls_certificate_free_credentials(mc.cred);
554
gnutls_global_deinit();
555
gnutls_dh_params_deinit(mc.dh_params);
559
static int init_gnutls_session(gnutls_session_t *session){
561
/* GnuTLS session creation */
563
ret = gnutls_init(session, GNUTLS_SERVER);
567
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
568
if(ret != GNUTLS_E_SUCCESS){
570
"Error in GnuTLS session initialization: %s\n",
571
safer_gnutls_strerror(ret));
577
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
579
gnutls_deinit(*session);
582
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
583
if(ret != GNUTLS_E_SUCCESS){
584
fprintf_plus(stderr, "Syntax error at: %s\n", err);
585
fprintf_plus(stderr, "GnuTLS error: %s\n",
586
safer_gnutls_strerror(ret));
587
gnutls_deinit(*session);
593
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
596
gnutls_deinit(*session);
599
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
600
if(ret != GNUTLS_E_SUCCESS){
601
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
602
safer_gnutls_strerror(ret));
603
gnutls_deinit(*session);
287
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
288
if (ret != GNUTLS_E_SUCCESS) {
290
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
292
ret, certfile, certkey);
293
fprintf(stdout, "The Error is: %s\n",
294
safer_gnutls_strerror(ret));
298
//GnuTLS server initialization
299
if ((ret = gnutls_dh_params_init (&es->dh_params))
300
!= GNUTLS_E_SUCCESS) {
301
fprintf (stderr, "Error in dh parameter initialization: %s\n",
302
safer_gnutls_strerror(ret));
306
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
307
!= GNUTLS_E_SUCCESS) {
308
fprintf (stderr, "Error in prime generation: %s\n",
309
safer_gnutls_strerror(ret));
313
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
315
// GnuTLS session creation
316
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
317
!= GNUTLS_E_SUCCESS){
318
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
319
safer_gnutls_strerror(ret));
322
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf(stderr, "Syntax error at: %s\n", err);
325
fprintf(stderr, "GnuTLS error: %s\n",
326
safer_gnutls_strerror(ret));
330
if ((ret = gnutls_credentials_set
331
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
332
!= GNUTLS_E_SUCCESS) {
333
fprintf(stderr, "Error setting a credentials set: %s\n",
334
safer_gnutls_strerror(ret));
607
338
/* ignore client certificate if any. */
608
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
339
gnutls_certificate_server_set_request (es->session,
610
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
342
gnutls_dh_set_prime_bits (es->session, DH_BITS);
615
/* Avahi log function callback */
616
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
617
__attribute__((unused)) const char *txt){}
347
void empty_log(__attribute__((unused)) AvahiLogLevel level,
348
__attribute__((unused)) const char *txt){}
619
/* Called when a Mandos server is found */
620
static int start_mandos_communication(const char *ip, uint16_t port,
621
AvahiIfIndex if_index,
623
int ret, tcp_sd = -1;
626
struct sockaddr_in in;
627
struct sockaddr_in6 in6;
350
int start_mandos_communication(const char *ip, uint16_t port,
351
AvahiIfIndex if_index){
353
struct sockaddr_in6 to;
354
encrypted_session es;
629
355
char *buffer = NULL;
630
char *decrypted_buffer = NULL;
356
char *decrypted_buffer;
631
357
size_t buffer_length = 0;
632
358
size_t buffer_capacity = 0;
635
gnutls_session_t session;
636
int pf; /* Protocol family */
653
fprintf_plus(stderr, "Bad address family: %d\n", af);
658
ret = init_gnutls_session(&session);
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
671
perror_plus("socket");
681
memset(&to, 0, sizeof(to));
683
to.in6.sin6_family = (sa_family_t)af;
684
ret = inet_pton(af, ip, &to.in6.sin6_addr);
686
to.in.sin_family = (sa_family_t)af;
687
ret = inet_pton(af, ip, &to.in.sin_addr);
691
perror_plus("inet_pton");
359
ssize_t decrypted_buffer_size;
362
char interface[IF_NAMESIZE];
365
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
369
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
375
if(if_indextoname((unsigned int)if_index, interface) == NULL){
377
perror("if_indextoname");
383
fprintf(stderr, "Binding to interface %s\n", interface);
386
memset(&to,0,sizeof(to)); /* Spurious warning */
387
to.sin6_family = AF_INET6;
388
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
697
fprintf_plus(stderr, "Bad address: %s\n", ip);
702
to.in6.sin6_port = htons(port); /* Spurious warnings from
704
-Wunreachable-code */
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
709
if(if_index == AVAHI_IF_UNSPEC){
710
fprintf_plus(stderr, "An IPv6 link-local address is"
711
" incomplete without a network interface\n");
715
/* Set the network interface number as scope */
716
to.in6.sin6_scope_id = (uint32_t)if_index;
719
to.in.sin_port = htons(port); /* Spurious warnings from
721
-Wunreachable-code */
730
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
731
char interface[IF_NAMESIZE];
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
733
perror_plus("if_indextoname");
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
746
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
749
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
753
perror_plus("inet_ntop");
755
if(strcmp(addrstr, ip) != 0){
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
767
ret = connect(tcp_sd, &to.in6, sizeof(to));
769
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
774
perror_plus("connect");
785
const char *out = mandos_protocol_version;
788
size_t out_size = strlen(out);
789
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
790
out_size - written));
793
perror_plus("write");
797
written += (size_t)ret;
798
if(written < out_size){
801
if(out == mandos_protocol_version){
816
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
824
/* Spurious warning from -Wint-to-pointer-cast */
825
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
833
ret = gnutls_handshake(session);
838
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
840
if(ret != GNUTLS_E_SUCCESS){
394
fprintf(stderr, "Bad address: %s\n", ip);
397
to.sin6_port = htons(port); /* Spurious warning */
399
to.sin6_scope_id = (uint32_t)if_index;
402
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
403
/* char addrstr[INET6_ADDRSTRLEN]; */
404
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
405
/* sizeof(addrstr)) == NULL){ */
406
/* perror("inet_ntop"); */
408
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
409
/* addrstr, ntohs(to.sin6_port)); */
413
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
419
ret = initgnutls (&es);
425
gnutls_transport_set_ptr (es.session,
426
(gnutls_transport_ptr_t) tcp_sd);
429
fprintf(stderr, "Establishing TLS session with %s\n", ip);
432
ret = gnutls_handshake (es.session);
434
if (ret != GNUTLS_E_SUCCESS){
842
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
436
fprintf(stderr, "\n*** Handshake failed ***\n");
849
/* Read OpenPGP packet that contains the wanted password */
443
//Retrieve OpenPGP packet that contains the wanted password
852
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
446
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
863
buffer_capacity = incbuffer(&buffer, buffer_length,
865
if(buffer_capacity == 0){
867
perror_plus("incbuffer");
877
sret = gnutls_record_recv(session, buffer+buffer_length,
451
if (buffer_length + BUFFER_SIZE > buffer_capacity){
452
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
457
buffer_capacity += BUFFER_SIZE;
460
ret = gnutls_record_recv
461
(es.session, buffer+buffer_length, BUFFER_SIZE);
884
467
case GNUTLS_E_INTERRUPTED:
885
468
case GNUTLS_E_AGAIN:
887
470
case GNUTLS_E_REHANDSHAKE:
889
ret = gnutls_handshake(session);
895
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
897
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
471
ret = gnutls_handshake (es.session);
473
fprintf(stderr, "\n*** Handshake failed ***\n");
905
fprintf_plus(stderr, "Unknown error while reading data from"
906
" encrypted session with Mandos server\n");
907
gnutls_bye(session, GNUTLS_SHUT_RDWR);
480
fprintf(stderr, "Unknown error while reading data from"
481
" encrypted session with mandos server\n");
483
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
912
buffer_length += (size_t) sret;
917
fprintf_plus(stderr, "Closing TLS session\n");
926
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
931
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
933
if(buffer_length > 0){
934
ssize_t decrypted_buffer_size;
935
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
937
if(decrypted_buffer_size >= 0){
487
buffer_length += (size_t) ret;
491
if (buffer_length > 0){
492
decrypted_buffer_size = pgp_packet_decrypt(buffer,
496
if (decrypted_buffer_size >= 0){
940
497
while(written < (size_t) decrypted_buffer_size){
946
ret = (int)fwrite(decrypted_buffer + written, 1,
947
(size_t)decrypted_buffer_size - written,
498
ret = (int)fwrite (decrypted_buffer + written, 1,
499
(size_t)decrypted_buffer_size - written,
949
501
if(ret == 0 and ferror(stdout)){
952
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
503
fprintf(stderr, "Error writing encrypted data: %s\n",
958
509
written += (size_t)ret;
964
/* Shutdown procedure */
969
free(decrypted_buffer);
972
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
978
perror_plus("close");
980
gnutls_deinit(session);
511
free(decrypted_buffer);
520
fprintf(stderr, "Closing TLS session\n");
524
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
527
gnutls_deinit (es.session);
528
gnutls_certificate_free_credentials (es.cred);
529
gnutls_global_deinit ();
990
static void resolve_callback(AvahiSServiceResolver *r,
991
AvahiIfIndex interface,
993
AvahiResolverEvent event,
997
const char *host_name,
998
const AvahiAddress *address,
1000
AVAHI_GCC_UNUSED AvahiStringList *txt,
1001
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1003
AVAHI_GCC_UNUSED void* userdata){
533
static AvahiSimplePoll *simple_poll = NULL;
534
static AvahiServer *server = NULL;
536
static void resolve_callback(
537
AvahiSServiceResolver *r,
538
AvahiIfIndex interface,
539
AVAHI_GCC_UNUSED AvahiProtocol protocol,
540
AvahiResolverEvent event,
544
const char *host_name,
545
const AvahiAddress *address,
547
AVAHI_GCC_UNUSED AvahiStringList *txt,
548
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
549
AVAHI_GCC_UNUSED void* userdata) {
551
assert(r); /* Spurious warning */
1006
553
/* Called whenever a service has been resolved successfully or
1015
558
case AVAHI_RESOLVER_FAILURE:
1016
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1017
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1019
avahi_strerror(avahi_server_errno(mc.server)));
559
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
560
" type '%s' in domain '%s': %s\n", name, type, domain,
561
avahi_strerror(avahi_server_errno(server)));
1022
564
case AVAHI_RESOLVER_FOUND:
1024
566
char ip[AVAHI_ADDRESS_STR_MAX];
1025
567
avahi_address_snprint(ip, sizeof(ip), address);
1027
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1028
PRIdMAX ") on port %" PRIu16 "\n", name,
1029
host_name, ip, (intmax_t)interface, port);
569
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
570
" port %d\n", name, host_name, ip, port);
1031
int ret = start_mandos_communication(ip, port, interface,
1032
avahi_proto_to_af(proto));
1034
avahi_simple_poll_quit(mc.simple_poll);
1036
if(not add_server(ip, port, interface,
1037
avahi_proto_to_af(proto))){
1038
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
572
int ret = start_mandos_communication(ip, port, interface);
1044
578
avahi_s_service_resolver_free(r);
1047
static void browse_callback(AvahiSServiceBrowser *b,
1048
AvahiIfIndex interface,
1049
AvahiProtocol protocol,
1050
AvahiBrowserEvent event,
1054
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1056
AVAHI_GCC_UNUSED void* userdata){
1059
/* Called whenever a new services becomes available on the LAN or
1060
is removed from the LAN */
1068
case AVAHI_BROWSER_FAILURE:
1070
fprintf_plus(stderr, "(Avahi browser) %s\n",
1071
avahi_strerror(avahi_server_errno(mc.server)));
1072
avahi_simple_poll_quit(mc.simple_poll);
1075
case AVAHI_BROWSER_NEW:
1076
/* We ignore the returned Avahi resolver object. In the callback
1077
function we free it. If the Avahi server is terminated before
1078
the callback function is called the Avahi server will free the
1081
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1082
name, type, domain, protocol, 0,
1083
resolve_callback, NULL) == NULL)
1084
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1086
avahi_strerror(avahi_server_errno(mc.server)));
1089
case AVAHI_BROWSER_REMOVE:
1092
case AVAHI_BROWSER_ALL_FOR_NOW:
1093
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1095
fprintf_plus(stderr, "No Mandos server found, still"
1102
/* Signal handler that stops main loop after SIGTERM */
1103
static void handle_sigterm(int sig){
1108
signal_received = sig;
1109
int old_errno = errno;
1110
/* set main loop to exit */
1111
if(mc.simple_poll != NULL){
1112
avahi_simple_poll_quit(mc.simple_poll);
1117
bool get_flags(const char *ifname, struct ifreq *ifr){
1120
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1122
perror_plus("socket");
1125
strcpy(ifr->ifr_name, ifname);
1126
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1129
perror_plus("ioctl SIOCGIFFLAGS");
1136
bool good_flags(const char *ifname, const struct ifreq *ifr){
1138
/* Reject the loopback device */
1139
if(ifr->ifr_flags & IFF_LOOPBACK){
1141
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1146
/* Accept point-to-point devices only if connect_to is specified */
1147
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1149
fprintf_plus(stderr, "Accepting point-to-point interface"
1150
" \"%s\"\n", ifname);
1154
/* Otherwise, reject non-broadcast-capable devices */
1155
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1157
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1158
" \"%s\"\n", ifname);
1162
/* Reject non-ARP interfaces (including dummy interfaces) */
1163
if(ifr->ifr_flags & IFF_NOARP){
1165
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1171
/* Accept this device */
1173
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1179
* This function determines if a directory entry in /sys/class/net
1180
* corresponds to an acceptable network device.
1181
* (This function is passed to scandir(3) as a filter function.)
1183
int good_interface(const struct dirent *if_entry){
1184
if(if_entry->d_name[0] == '.'){
1189
if(not get_flags(if_entry->d_name, &ifr)){
1191
fprintf_plus(stderr, "Failed to get flags for interface "
1192
"\"%s\"\n", if_entry->d_name);
1197
if(not good_flags(if_entry->d_name, &ifr)){
1204
* This function determines if a directory entry in /sys/class/net
1205
* corresponds to an acceptable network device which is up.
1206
* (This function is passed to scandir(3) as a filter function.)
1208
int up_interface(const struct dirent *if_entry){
1209
if(if_entry->d_name[0] == '.'){
1214
if(not get_flags(if_entry->d_name, &ifr)){
1216
fprintf_plus(stderr, "Failed to get flags for interface "
1217
"\"%s\"\n", if_entry->d_name);
1222
/* Reject down interfaces */
1223
if(not (ifr.ifr_flags & IFF_UP)){
1225
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1231
/* Reject non-running interfaces */
1232
if(not (ifr.ifr_flags & IFF_RUNNING)){
1234
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1240
if(not good_flags(if_entry->d_name, &ifr)){
1246
int notdotentries(const struct dirent *direntry){
1247
/* Skip "." and ".." */
1248
if(direntry->d_name[0] == '.'
1249
and (direntry->d_name[1] == '\0'
1250
or (direntry->d_name[1] == '.'
1251
and direntry->d_name[2] == '\0'))){
1257
/* Is this directory entry a runnable program? */
1258
int runnable_hook(const struct dirent *direntry){
1263
if((direntry->d_name)[0] == '\0'){
1268
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1269
"abcdefghijklmnopqrstuvwxyz"
1272
if((direntry->d_name)[sret] != '\0'){
1273
/* Contains non-allowed characters */
1275
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1281
char *fullname = NULL;
1282
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1284
perror_plus("asprintf");
1288
ret = stat(fullname, &st);
1291
perror_plus("Could not stat hook");
1295
if(not (S_ISREG(st.st_mode))){
1296
/* Not a regular file */
1298
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1303
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1304
/* Not executable */
1306
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1312
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1318
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1320
struct timespec now;
1321
struct timespec waited_time;
1322
intmax_t block_time;
1325
if(mc.current_server == NULL){
1327
fprintf_plus(stderr, "Wait until first server is found."
1330
ret = avahi_simple_poll_iterate(s, -1);
1333
fprintf_plus(stderr, "Check current_server if we should run"
1336
/* the current time */
1337
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1339
perror_plus("clock_gettime");
1342
/* Calculating in ms how long time between now and server
1343
who we visted longest time ago. Now - last seen. */
1344
waited_time.tv_sec = (now.tv_sec
1345
- mc.current_server->last_seen.tv_sec);
1346
waited_time.tv_nsec = (now.tv_nsec
1347
- mc.current_server->last_seen.tv_nsec);
1348
/* total time is 10s/10,000ms.
1349
Converting to s from ms by dividing by 1,000,
1350
and ns to ms by dividing by 1,000,000. */
1351
block_time = ((retry_interval
1352
- ((intmax_t)waited_time.tv_sec * 1000))
1353
- ((intmax_t)waited_time.tv_nsec / 1000000));
1356
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1360
if(block_time <= 0){
1361
ret = start_mandos_communication(mc.current_server->ip,
1362
mc.current_server->port,
1363
mc.current_server->if_index,
1364
mc.current_server->af);
1366
avahi_simple_poll_quit(mc.simple_poll);
1369
ret = clock_gettime(CLOCK_MONOTONIC,
1370
&mc.current_server->last_seen);
1372
perror_plus("clock_gettime");
1375
mc.current_server = mc.current_server->next;
1376
block_time = 0; /* Call avahi to find new Mandos
1377
servers, but don't block */
1380
ret = avahi_simple_poll_iterate(s, (int)block_time);
1383
if (ret > 0 or errno != EINTR){
1384
return (ret != 1) ? ret : 0;
1390
bool run_network_hooks(const char *mode, const char *interface,
1392
struct dirent **direntries;
1393
struct dirent *direntry;
1395
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1398
perror_plus("scandir");
1400
int devnull = open("/dev/null", O_RDONLY);
1401
for(int i = 0; i < numhooks; i++){
1402
direntry = direntries[i];
1403
char *fullname = NULL;
1404
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1406
perror_plus("asprintf");
1410
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1413
pid_t hook_pid = fork();
1416
/* Raise privileges */
1420
perror_plus("seteuid");
1422
/* Raise privileges even more */
1426
perror_plus("setuid");
1432
perror_plus("setgid");
1434
/* Reset supplementary groups */
1436
ret = setgroups(0, NULL);
1438
perror_plus("setgroups");
1440
dup2(devnull, STDIN_FILENO);
1442
dup2(STDERR_FILENO, STDOUT_FILENO);
1443
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1445
perror_plus("setenv");
1448
ret = setenv("DEVICE", interface, 1);
1450
perror_plus("setenv");
1453
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1455
perror_plus("setenv");
1458
ret = setenv("MODE", mode, 1);
1460
perror_plus("setenv");
1464
ret = asprintf(&delaystring, "%f", delay);
1466
perror_plus("asprintf");
1469
ret = setenv("DELAY", delaystring, 1);
1472
perror_plus("setenv");
1476
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1477
perror_plus("execl");
1478
_exit(EXIT_FAILURE);
1482
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1483
perror_plus("waitpid");
1487
if(WIFEXITED(status)){
1488
if(WEXITSTATUS(status) != 0){
1489
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1490
" with status %d\n", direntry->d_name,
1491
WEXITSTATUS(status));
1495
} else if(WIFSIGNALED(status)){
1496
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1497
" signal %d\n", direntry->d_name,
1502
fprintf_plus(stderr, "Warning: network hook \"%s\""
1503
" crashed\n", direntry->d_name);
1510
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1519
int main(int argc, char *argv[]){
1520
AvahiSServiceBrowser *sb = NULL;
581
static void browse_callback(
582
AvahiSServiceBrowser *b,
583
AvahiIfIndex interface,
584
AvahiProtocol protocol,
585
AvahiBrowserEvent event,
589
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
592
AvahiServer *s = userdata;
593
assert(b); /* Spurious warning */
595
/* Called whenever a new services becomes available on the LAN or
596
is removed from the LAN */
600
case AVAHI_BROWSER_FAILURE:
602
fprintf(stderr, "(Browser) %s\n",
603
avahi_strerror(avahi_server_errno(server)));
604
avahi_simple_poll_quit(simple_poll);
607
case AVAHI_BROWSER_NEW:
608
/* We ignore the returned resolver object. In the callback
609
function we free it. If the server is terminated before
610
the callback function is called the server will free
611
the resolver for us. */
613
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
615
AVAHI_PROTO_INET6, 0,
616
resolve_callback, s)))
617
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
618
avahi_strerror(avahi_server_errno(s)));
621
case AVAHI_BROWSER_REMOVE:
624
case AVAHI_BROWSER_ALL_FOR_NOW:
625
case AVAHI_BROWSER_CACHE_EXHAUSTED:
630
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
631
const char *combinepath(const char *first, const char *second){
1525
int exitcode = EXIT_SUCCESS;
1526
const char *interface = "";
1527
struct ifreq network;
1529
bool take_down_interface = false;
1532
char tempdir[] = "/tmp/mandosXXXXXX";
1533
bool tempdir_created = false;
1534
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1535
const char *seckey = PATHDIR "/" SECKEY;
1536
const char *pubkey = PATHDIR "/" PUBKEY;
1538
bool gnutls_initialized = false;
1539
bool gpgme_initialized = false;
1541
double retry_interval = 10; /* 10s between trying a server and
1542
retrying the same server again */
1544
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1545
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1550
/* Lower any group privileges we might have, just to be safe */
1554
perror_plus("setgid");
1557
/* Lower user privileges (temporarily) */
1561
perror_plus("seteuid");
1569
struct argp_option options[] = {
1570
{ .name = "debug", .key = 128,
1571
.doc = "Debug mode", .group = 3 },
1572
{ .name = "connect", .key = 'c',
1573
.arg = "ADDRESS:PORT",
1574
.doc = "Connect directly to a specific Mandos server",
1576
{ .name = "interface", .key = 'i',
1578
.doc = "Network interface that will be used to search for"
1581
{ .name = "seckey", .key = 's',
1583
.doc = "OpenPGP secret key file base name",
1585
{ .name = "pubkey", .key = 'p',
1587
.doc = "OpenPGP public key file base name",
1589
{ .name = "dh-bits", .key = 129,
1591
.doc = "Bit length of the prime number used in the"
1592
" Diffie-Hellman key exchange",
1594
{ .name = "priority", .key = 130,
1596
.doc = "GnuTLS priority string for the TLS handshake",
1598
{ .name = "delay", .key = 131,
1600
.doc = "Maximum delay to wait for interface startup",
1602
{ .name = "retry", .key = 132,
1604
.doc = "Retry interval used when denied by the mandos server",
1606
{ .name = "network-hook-dir", .key = 133,
1608
.doc = "Directory where network hooks are located",
1611
* These reproduce what we would get without ARGP_NO_HELP
1613
{ .name = "help", .key = '?',
1614
.doc = "Give this help list", .group = -1 },
1615
{ .name = "usage", .key = -3,
1616
.doc = "Give a short usage message", .group = -1 },
1617
{ .name = "version", .key = 'V',
1618
.doc = "Print program version", .group = -1 },
1622
error_t parse_opt(int key, char *arg,
1623
struct argp_state *state){
1626
case 128: /* --debug */
1629
case 'c': /* --connect */
1632
case 'i': /* --interface */
1635
case 's': /* --seckey */
1638
case 'p': /* --pubkey */
1641
case 129: /* --dh-bits */
1643
tmpmax = strtoimax(arg, &tmp, 10);
1644
if(errno != 0 or tmp == arg or *tmp != '\0'
1645
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1646
argp_error(state, "Bad number of DH bits");
1648
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1650
case 130: /* --priority */
1653
case 131: /* --delay */
1655
delay = strtof(arg, &tmp);
1656
if(errno != 0 or tmp == arg or *tmp != '\0'){
1657
argp_error(state, "Bad delay");
1659
case 132: /* --retry */
1661
retry_interval = strtod(arg, &tmp);
1662
if(errno != 0 or tmp == arg or *tmp != '\0'
1663
or (retry_interval * 1000) > INT_MAX
1664
or retry_interval < 0){
1665
argp_error(state, "Bad retry interval");
1668
case 133: /* --network-hook-dir */
1672
* These reproduce what we would get without ARGP_NO_HELP
1674
case '?': /* --help */
1675
argp_state_help(state, state->out_stream,
1676
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1677
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1678
case -3: /* --usage */
1679
argp_state_help(state, state->out_stream,
1680
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1681
case 'V': /* --version */
1682
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1683
exit(argp_err_exit_status);
1686
return ARGP_ERR_UNKNOWN;
1691
struct argp argp = { .options = options, .parser = parse_opt,
1693
.doc = "Mandos client -- Get and decrypt"
1694
" passwords from a Mandos server" };
1695
ret = argp_parse(&argp, argc, argv,
1696
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1703
perror_plus("argp_parse");
1704
exitcode = EX_OSERR;
1707
exitcode = EX_USAGE;
1713
/* Work around Debian bug #633582:
1714
<http://bugs.debian.org/633582> */
1716
/* Re-raise priviliges */
1720
perror_plus("seteuid");
1724
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1725
int seckey_fd = open(seckey, O_RDONLY);
1726
if(seckey_fd == -1){
1727
perror_plus("open");
1729
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1731
perror_plus("fstat");
1733
if(S_ISREG(st.st_mode)
1734
and st.st_uid == 0 and st.st_gid == 0){
1735
ret = fchown(seckey_fd, uid, gid);
1737
perror_plus("fchown");
1741
TEMP_FAILURE_RETRY(close(seckey_fd));
1745
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1746
int pubkey_fd = open(pubkey, O_RDONLY);
1747
if(pubkey_fd == -1){
1748
perror_plus("open");
1750
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1752
perror_plus("fstat");
1754
if(S_ISREG(st.st_mode)
1755
and st.st_uid == 0 and st.st_gid == 0){
1756
ret = fchown(pubkey_fd, uid, gid);
1758
perror_plus("fchown");
1762
TEMP_FAILURE_RETRY(close(pubkey_fd));
1766
/* Lower privileges */
1770
perror_plus("seteuid");
1775
/* Run network hooks */
1776
if(not run_network_hooks("start", interface, delay)){
1781
avahi_set_log_function(empty_log);
1784
if(interface[0] == '\0'){
1785
struct dirent **direntries;
1786
/* First look for interfaces that are up */
1787
ret = scandir(sys_class_net, &direntries, up_interface,
1790
/* No up interfaces, look for any good interfaces */
1792
ret = scandir(sys_class_net, &direntries, good_interface,
1796
/* Pick the first interface returned */
1797
interface = strdup(direntries[0]->d_name);
1799
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1801
if(interface == NULL){
1802
perror_plus("malloc");
1804
exitcode = EXIT_FAILURE;
1810
fprintf_plus(stderr, "Could not find a network interface\n");
1811
exitcode = EXIT_FAILURE;
1816
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1817
from the signal handler */
1818
/* Initialize the pseudo-RNG for Avahi */
1819
srand((unsigned int) time(NULL));
1820
mc.simple_poll = avahi_simple_poll_new();
1821
if(mc.simple_poll == NULL){
1822
fprintf_plus(stderr,
1823
"Avahi: Failed to create simple poll object.\n");
1824
exitcode = EX_UNAVAILABLE;
1828
sigemptyset(&sigterm_action.sa_mask);
1829
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1831
perror_plus("sigaddset");
1832
exitcode = EX_OSERR;
1835
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1837
perror_plus("sigaddset");
1838
exitcode = EX_OSERR;
1841
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1843
perror_plus("sigaddset");
1844
exitcode = EX_OSERR;
1847
/* Need to check if the handler is SIG_IGN before handling:
1848
| [[info:libc:Initial Signal Actions]] |
1849
| [[info:libc:Basic Signal Handling]] |
1851
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1853
perror_plus("sigaction");
1856
if(old_sigterm_action.sa_handler != SIG_IGN){
1857
ret = sigaction(SIGINT, &sigterm_action, NULL);
1859
perror_plus("sigaction");
1860
exitcode = EX_OSERR;
1864
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1866
perror_plus("sigaction");
1869
if(old_sigterm_action.sa_handler != SIG_IGN){
1870
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1872
perror_plus("sigaction");
1873
exitcode = EX_OSERR;
1877
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1879
perror_plus("sigaction");
1882
if(old_sigterm_action.sa_handler != SIG_IGN){
1883
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1885
perror_plus("sigaction");
1886
exitcode = EX_OSERR;
1891
/* If the interface is down, bring it up */
1892
if(strcmp(interface, "none") != 0){
1893
if_index = (AvahiIfIndex) if_nametoindex(interface);
1895
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1896
exitcode = EX_UNAVAILABLE;
1904
/* Re-raise priviliges */
1908
perror_plus("seteuid");
1912
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1913
messages about the network interface to mess up the prompt */
1914
ret = klogctl(8, NULL, 5);
1915
bool restore_loglevel = true;
1917
restore_loglevel = false;
1918
perror_plus("klogctl");
1920
#endif /* __linux__ */
1922
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1924
perror_plus("socket");
1925
exitcode = EX_OSERR;
1927
if(restore_loglevel){
1928
ret = klogctl(7, NULL, 0);
1930
perror_plus("klogctl");
1933
#endif /* __linux__ */
1934
/* Lower privileges */
1938
perror_plus("seteuid");
1942
strcpy(network.ifr_name, interface);
1943
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1945
perror_plus("ioctl SIOCGIFFLAGS");
1947
if(restore_loglevel){
1948
ret = klogctl(7, NULL, 0);
1950
perror_plus("klogctl");
1953
#endif /* __linux__ */
1954
exitcode = EX_OSERR;
1955
/* Lower privileges */
1959
perror_plus("seteuid");
1963
if((network.ifr_flags & IFF_UP) == 0){
1964
network.ifr_flags |= IFF_UP;
1965
take_down_interface = true;
1966
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1968
take_down_interface = false;
1969
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1970
exitcode = EX_OSERR;
1972
if(restore_loglevel){
1973
ret = klogctl(7, NULL, 0);
1975
perror_plus("klogctl");
1978
#endif /* __linux__ */
1979
/* Lower privileges */
1983
perror_plus("seteuid");
1988
/* Sleep checking until interface is running.
1989
Check every 0.25s, up to total time of delay */
1990
for(int i=0; i < delay * 4; i++){
1991
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1993
perror_plus("ioctl SIOCGIFFLAGS");
1994
} else if(network.ifr_flags & IFF_RUNNING){
1997
struct timespec sleeptime = { .tv_nsec = 250000000 };
1998
ret = nanosleep(&sleeptime, NULL);
1999
if(ret == -1 and errno != EINTR){
2000
perror_plus("nanosleep");
2003
if(not take_down_interface){
2004
/* We won't need the socket anymore */
2005
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2007
perror_plus("close");
2011
if(restore_loglevel){
2012
/* Restores kernel loglevel to default */
2013
ret = klogctl(7, NULL, 0);
2015
perror_plus("klogctl");
2018
#endif /* __linux__ */
2019
/* Lower privileges */
2021
/* Lower privileges */
2024
perror_plus("seteuid");
2032
ret = init_gnutls_global(pubkey, seckey);
2034
fprintf_plus(stderr, "init_gnutls_global failed\n");
2035
exitcode = EX_UNAVAILABLE;
2038
gnutls_initialized = true;
2045
if(mkdtemp(tempdir) == NULL){
2046
perror_plus("mkdtemp");
2049
tempdir_created = true;
2055
if(not init_gpgme(pubkey, seckey, tempdir)){
2056
fprintf_plus(stderr, "init_gpgme failed\n");
2057
exitcode = EX_UNAVAILABLE;
2060
gpgme_initialized = true;
2067
if(connect_to != NULL){
2068
/* Connect directly, do not use Zeroconf */
2069
/* (Mainly meant for debugging) */
2070
char *address = strrchr(connect_to, ':');
2071
if(address == NULL){
2072
fprintf_plus(stderr, "No colon in address\n");
2073
exitcode = EX_USAGE;
2083
tmpmax = strtoimax(address+1, &tmp, 10);
2084
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2085
or tmpmax != (uint16_t)tmpmax){
2086
fprintf_plus(stderr, "Bad port number\n");
2087
exitcode = EX_USAGE;
2095
port = (uint16_t)tmpmax;
2097
/* Colon in address indicates IPv6 */
2099
if(strchr(connect_to, ':') != NULL){
2101
/* Accept [] around IPv6 address - see RFC 5952 */
2102
if(connect_to[0] == '[' and address[-1] == ']')
2110
address = connect_to;
2116
while(not quit_now){
2117
ret = start_mandos_communication(address, port, if_index, af);
2118
if(quit_now or ret == 0){
2122
fprintf_plus(stderr, "Retrying in %d seconds\n",
2123
(int)retry_interval);
2125
sleep((int)retry_interval);
2129
exitcode = EXIT_SUCCESS;
633
tmp = malloc(strlen(first) + strlen(second) + 2);
639
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
647
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
2140
648
AvahiServerConfig config;
2141
/* Do not publish any local Zeroconf records */
649
AvahiSServiceBrowser *sb = NULL;
652
int returncode = EXIT_SUCCESS;
653
const char *interface = NULL;
654
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
655
char *connect_to = NULL;
658
static struct option long_options[] = {
659
{"debug", no_argument, (int *)&debug, 1},
660
{"connect", required_argument, 0, 'C'},
661
{"interface", required_argument, 0, 'i'},
662
{"certdir", required_argument, 0, 'd'},
663
{"certkey", required_argument, 0, 'c'},
664
{"certfile", required_argument, 0, 'k'},
667
int option_index = 0;
668
ret = getopt_long (argc, argv, "i:", long_options,
698
certfile = combinepath(certdir, certfile);
699
if (certfile == NULL){
703
if(interface != NULL){
704
if_index = (AvahiIfIndex) if_nametoindex(interface);
706
fprintf(stderr, "No such interface: \"%s\"\n", interface);
711
if(connect_to != NULL){
712
/* Connect directly, do not use Zeroconf */
713
/* (Mainly meant for debugging) */
714
char *address = strrchr(connect_to, ':');
716
fprintf(stderr, "No colon in address\n");
720
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
722
perror("Bad port number");
726
address = connect_to;
727
ret = start_mandos_communication(address, port, if_index);
735
certkey = combinepath(certdir, certkey);
736
if (certkey == NULL){
741
avahi_set_log_function(empty_log);
744
/* Initialize the psuedo-RNG */
745
srand((unsigned int) time(NULL));
747
/* Allocate main loop object */
748
if (!(simple_poll = avahi_simple_poll_new())) {
749
fprintf(stderr, "Failed to create simple poll object.\n");
754
/* Do not publish any local records */
2142
755
avahi_server_config_init(&config);
2143
756
config.publish_hinfo = 0;
2144
757
config.publish_addresses = 0;
2145
758
config.publish_workstation = 0;
2146
759
config.publish_domain = 0;
2148
761
/* Allocate a new server */
2149
mc.server = avahi_server_new(avahi_simple_poll_get
2150
(mc.simple_poll), &config, NULL,
2153
/* Free the Avahi configuration data */
762
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
763
&config, NULL, NULL, &error);
765
/* Free the configuration data */
2154
766
avahi_server_config_free(&config);
2157
/* Check if creating the Avahi server object succeeded */
2158
if(mc.server == NULL){
2159
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2160
avahi_strerror(error));
2161
exitcode = EX_UNAVAILABLE;
2169
/* Create the Avahi service browser */
2170
sb = avahi_s_service_browser_new(mc.server, if_index,
2171
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2172
NULL, 0, browse_callback, NULL);
2174
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2175
avahi_strerror(avahi_server_errno(mc.server)));
2176
exitcode = EX_UNAVAILABLE;
2184
/* Run the main loop */
2187
fprintf_plus(stderr, "Starting Avahi loop search\n");
2190
ret = avahi_loop_with_timeout(mc.simple_poll,
2191
(int)(retry_interval * 1000));
2193
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2194
(ret == 0) ? "successfully" : "with error");
2200
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2203
/* Cleanup things */
2205
avahi_s_service_browser_free(sb);
2207
if(mc.server != NULL)
2208
avahi_server_free(mc.server);
2210
if(mc.simple_poll != NULL)
2211
avahi_simple_poll_free(mc.simple_poll);
2213
if(gnutls_initialized){
2214
gnutls_certificate_free_credentials(mc.cred);
2215
gnutls_global_deinit();
2216
gnutls_dh_params_deinit(mc.dh_params);
2219
if(gpgme_initialized){
2220
gpgme_release(mc.ctx);
2223
/* Cleans up the circular linked list of Mandos servers the client
2225
if(mc.current_server != NULL){
2226
mc.current_server->prev->next = NULL;
2227
while(mc.current_server != NULL){
2228
server *next = mc.current_server->next;
2229
free(mc.current_server);
2230
mc.current_server = next;
2234
/* Run network hooks */
2235
run_network_hooks("stop", interface, delay);
2237
/* Re-raise priviliges */
2242
perror_plus("seteuid");
2245
/* Take down the network interface */
2246
if(take_down_interface and geteuid() == 0){
2247
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2249
perror_plus("ioctl SIOCGIFFLAGS");
2250
} else if(network.ifr_flags & IFF_UP){
2251
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2252
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2254
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2257
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2259
perror_plus("close");
2263
/* Lower privileges permanently */
2267
perror_plus("setuid");
2270
/* Removes the GPGME temp directory and all files inside */
2271
if(tempdir_created){
2272
struct dirent **direntries = NULL;
2273
struct dirent *direntry = NULL;
2274
int numentries = scandir(tempdir, &direntries, notdotentries,
2276
if (numentries > 0){
2277
for(int i = 0; i < numentries; i++){
2278
direntry = direntries[i];
2279
char *fullname = NULL;
2280
ret = asprintf(&fullname, "%s/%s", tempdir,
2283
perror_plus("asprintf");
2286
ret = remove(fullname);
2288
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2295
/* need to clean even if 0 because man page doesn't specify */
2297
if (numentries == -1){
2298
perror_plus("scandir");
2300
ret = rmdir(tempdir);
2301
if(ret == -1 and errno != ENOENT){
2302
perror_plus("rmdir");
2307
sigemptyset(&old_sigterm_action.sa_mask);
2308
old_sigterm_action.sa_handler = SIG_DFL;
2309
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2310
&old_sigterm_action,
2313
perror_plus("sigaction");
2316
ret = raise(signal_received);
2317
} while(ret != 0 and errno == EINTR);
2319
perror_plus("raise");
2322
TEMP_FAILURE_RETRY(pause());
768
/* Check if creating the server object succeeded */
770
fprintf(stderr, "Failed to create server: %s\n",
771
avahi_strerror(error));
772
returncode = EXIT_FAILURE;
776
/* Create the service browser */
777
sb = avahi_s_service_browser_new(server, if_index,
779
"_mandos._tcp", NULL, 0,
780
browse_callback, server);
782
fprintf(stderr, "Failed to create service browser: %s\n",
783
avahi_strerror(avahi_server_errno(server)));
784
returncode = EXIT_FAILURE;
788
/* Run the main loop */
791
fprintf(stderr, "Starting avahi loop search\n");
794
avahi_simple_poll_loop(simple_poll);
799
fprintf(stderr, "%s exiting\n", argv[0]);
804
avahi_s_service_browser_free(sb);
807
avahi_server_free(server);
810
avahi_simple_poll_free(simple_poll);