1
/* -*- coding: utf-8 -*- */
3
* Mandos-client - get and decrypt data from a Mandos server
5
* This program is partly derived from an example program for an Avahi
6
* service browser, downloaded from
7
* <http://avahi.org/browser/examples/core-browse-services.c>. This
8
* includes the following functions: "resolve_callback",
9
* "browse_callback", and parts of "main".
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
20
* This program is distributed in the hope that it will be useful, but
21
* WITHOUT ANY WARRANTY; without even the implied warranty of
22
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23
* General Public License for more details.
25
* You should have received a copy of the GNU General Public License
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
29
* Contact the authors at <mandos@fukt.bsnet.se>.
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
#define _LARGEFILE_SOURCE
36
#ifndef _FILE_OFFSET_BITS
37
#define _FILE_OFFSET_BITS 64
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), setuid(),
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sigaction,
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
91
/* All Avahi types, constants and functions
94
#include <avahi-core/core.h>
95
#include <avahi-core/lookup.h>
96
#include <avahi-core/log.h>
97
#include <avahi-common/simple-watch.h>
98
#include <avahi-common/malloc.h>
99
#include <avahi-common/error.h>
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
105
init_gnutls_session(),
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
112
#include <gpgme.h> /* All GPGME types, constants and
115
GPGME_PROTOCOL_OpenPGP,
118
#define BUFFER_SIZE 256
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
129
/* Used for passing in values through the Avahi callback functions */
131
AvahiSimplePoll *simple_poll;
133
gnutls_certificate_credentials_t cred;
134
unsigned int dh_bits;
135
gnutls_dh_params_t dh_params;
136
const char *priority;
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
* bytes. "buffer_capacity" is how much is currently allocated,
148
* "buffer_length" is how much is already used.
150
size_t incbuffer(char **buffer, size_t buffer_length,
151
size_t buffer_capacity){
152
if(buffer_length + BUFFER_SIZE > buffer_capacity){
153
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
157
buffer_capacity += BUFFER_SIZE;
159
return buffer_capacity;
165
static bool init_gpgme(const char *seckey,
166
const char *pubkey, const char *tempdir){
169
gpgme_engine_info_t engine_info;
173
* Helper function to insert pub and seckey to the engine keyring.
175
bool import_key(const char *filename){
177
gpgme_data_t pgp_data;
179
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
185
rc = gpgme_data_new_from_fd(&pgp_data, fd);
186
if(rc != GPG_ERR_NO_ERROR){
187
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
188
gpgme_strsource(rc), gpgme_strerror(rc));
192
rc = gpgme_op_import(mc.ctx, pgp_data);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
199
ret = (int)TEMP_FAILURE_RETRY(close(fd));
203
gpgme_data_release(pgp_data);
208
fprintf(stderr, "Initializing GPGME\n");
212
gpgme_check_version(NULL);
213
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
214
if(rc != GPG_ERR_NO_ERROR){
215
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
216
gpgme_strsource(rc), gpgme_strerror(rc));
220
/* Set GPGME home directory for the OpenPGP engine only */
221
rc = gpgme_get_engine_info(&engine_info);
222
if(rc != GPG_ERR_NO_ERROR){
223
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
224
gpgme_strsource(rc), gpgme_strerror(rc));
227
while(engine_info != NULL){
228
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
229
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
230
engine_info->file_name, tempdir);
233
engine_info = engine_info->next;
235
if(engine_info == NULL){
236
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
240
/* Create new GPGME "context" */
241
rc = gpgme_new(&(mc.ctx));
242
if(rc != GPG_ERR_NO_ERROR){
243
fprintf(stderr, "bad gpgme_new: %s: %s\n",
244
gpgme_strsource(rc), gpgme_strerror(rc));
248
if(not import_key(pubkey) or not import_key(seckey)){
256
* Decrypt OpenPGP data.
257
* Returns -1 on error
259
static ssize_t pgp_packet_decrypt(const char *cryptotext,
262
gpgme_data_t dh_crypto, dh_plain;
265
size_t plaintext_capacity = 0;
266
ssize_t plaintext_length = 0;
269
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
272
/* Create new GPGME data buffer from memory cryptotext */
273
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
275
if(rc != GPG_ERR_NO_ERROR){
276
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
281
/* Create new empty GPGME data buffer for the plaintext */
282
rc = gpgme_data_new(&dh_plain);
283
if(rc != GPG_ERR_NO_ERROR){
284
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
285
gpgme_strsource(rc), gpgme_strerror(rc));
286
gpgme_data_release(dh_crypto);
290
/* Decrypt data from the cryptotext data buffer to the plaintext
292
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
293
if(rc != GPG_ERR_NO_ERROR){
294
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
295
gpgme_strsource(rc), gpgme_strerror(rc));
296
plaintext_length = -1;
298
gpgme_decrypt_result_t result;
299
result = gpgme_op_decrypt_result(mc.ctx);
301
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
303
fprintf(stderr, "Unsupported algorithm: %s\n",
304
result->unsupported_algorithm);
305
fprintf(stderr, "Wrong key usage: %u\n",
306
result->wrong_key_usage);
307
if(result->file_name != NULL){
308
fprintf(stderr, "File name: %s\n", result->file_name);
310
gpgme_recipient_t recipient;
311
recipient = result->recipients;
312
while(recipient != NULL){
313
fprintf(stderr, "Public key algorithm: %s\n",
314
gpgme_pubkey_algo_name(recipient->pubkey_algo));
315
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
316
fprintf(stderr, "Secret key available: %s\n",
317
recipient->status == GPG_ERR_NO_SECKEY
319
recipient = recipient->next;
327
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
330
/* Seek back to the beginning of the GPGME plaintext data buffer */
331
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
332
perror("gpgme_data_seek");
333
plaintext_length = -1;
339
plaintext_capacity = incbuffer(plaintext,
340
(size_t)plaintext_length,
342
if(plaintext_capacity == 0){
344
plaintext_length = -1;
348
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
350
/* Print the data, if any */
356
perror("gpgme_data_read");
357
plaintext_length = -1;
360
plaintext_length += ret;
364
fprintf(stderr, "Decrypted password is: ");
365
for(ssize_t i = 0; i < plaintext_length; i++){
366
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
368
fprintf(stderr, "\n");
373
/* Delete the GPGME cryptotext data buffer */
374
gpgme_data_release(dh_crypto);
376
/* Delete the GPGME plaintext data buffer */
377
gpgme_data_release(dh_plain);
378
return plaintext_length;
381
static const char * safer_gnutls_strerror(int value){
382
const char *ret = gnutls_strerror(value); /* Spurious warning from
383
-Wunreachable-code */
389
/* GnuTLS log function callback */
390
static void debuggnutls(__attribute__((unused)) int level,
392
fprintf(stderr, "GnuTLS: %s", string);
395
static int init_gnutls_global(const char *pubkeyfilename,
396
const char *seckeyfilename){
400
fprintf(stderr, "Initializing GnuTLS\n");
403
ret = gnutls_global_init();
404
if(ret != GNUTLS_E_SUCCESS){
405
fprintf(stderr, "GnuTLS global_init: %s\n",
406
safer_gnutls_strerror(ret));
411
/* "Use a log level over 10 to enable all debugging options."
414
gnutls_global_set_log_level(11);
415
gnutls_global_set_log_function(debuggnutls);
418
/* OpenPGP credentials */
419
gnutls_certificate_allocate_credentials(&mc.cred);
420
if(ret != GNUTLS_E_SUCCESS){
421
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
425
safer_gnutls_strerror(ret));
426
gnutls_global_deinit();
431
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
432
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
436
ret = gnutls_certificate_set_openpgp_key_file
437
(mc.cred, pubkeyfilename, seckeyfilename,
438
GNUTLS_OPENPGP_FMT_BASE64);
439
if(ret != GNUTLS_E_SUCCESS){
441
"Error[%d] while reading the OpenPGP key pair ('%s',"
442
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
443
fprintf(stderr, "The GnuTLS error is: %s\n",
444
safer_gnutls_strerror(ret));
448
/* GnuTLS server initialization */
449
ret = gnutls_dh_params_init(&mc.dh_params);
450
if(ret != GNUTLS_E_SUCCESS){
451
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
452
" %s\n", safer_gnutls_strerror(ret));
455
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
456
if(ret != GNUTLS_E_SUCCESS){
457
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
458
safer_gnutls_strerror(ret));
462
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
468
gnutls_certificate_free_credentials(mc.cred);
469
gnutls_global_deinit();
470
gnutls_dh_params_deinit(mc.dh_params);
474
static int init_gnutls_session(gnutls_session_t *session){
476
/* GnuTLS session creation */
477
ret = gnutls_init(session, GNUTLS_SERVER);
478
if(ret != GNUTLS_E_SUCCESS){
479
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
480
safer_gnutls_strerror(ret));
485
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
486
if(ret != GNUTLS_E_SUCCESS){
487
fprintf(stderr, "Syntax error at: %s\n", err);
488
fprintf(stderr, "GnuTLS error: %s\n",
489
safer_gnutls_strerror(ret));
490
gnutls_deinit(*session);
495
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
497
if(ret != GNUTLS_E_SUCCESS){
498
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
499
safer_gnutls_strerror(ret));
500
gnutls_deinit(*session);
504
/* ignore client certificate if any. */
505
gnutls_certificate_server_set_request(*session,
508
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
513
/* Avahi log function callback */
514
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
515
__attribute__((unused)) const char *txt){}
517
/* Called when a Mandos server is found */
518
static int start_mandos_communication(const char *ip, uint16_t port,
519
AvahiIfIndex if_index,
524
struct sockaddr_in in;
525
struct sockaddr_in6 in6;
528
char *decrypted_buffer;
529
size_t buffer_length = 0;
530
size_t buffer_capacity = 0;
531
ssize_t decrypted_buffer_size;
534
gnutls_session_t session;
535
int pf; /* Protocol family */
545
fprintf(stderr, "Bad address family: %d\n", af);
549
ret = init_gnutls_session(&session);
555
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
559
tcp_sd = socket(pf, SOCK_STREAM, 0);
565
memset(&to, 0, sizeof(to));
567
to.in6.sin6_family = (sa_family_t)af;
568
ret = inet_pton(af, ip, &to.in6.sin6_addr);
570
to.in.sin_family = (sa_family_t)af;
571
ret = inet_pton(af, ip, &to.in.sin_addr);
578
fprintf(stderr, "Bad address: %s\n", ip);
582
to.in6.sin6_port = htons(port); /* Spurious warnings from
584
-Wunreachable-code */
586
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
587
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
589
if(if_index == AVAHI_IF_UNSPEC){
590
fprintf(stderr, "An IPv6 link-local address is incomplete"
591
" without a network interface\n");
594
/* Set the network interface number as scope */
595
to.in6.sin6_scope_id = (uint32_t)if_index;
598
to.in.sin_port = htons(port); /* Spurious warnings from
600
-Wunreachable-code */
604
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
605
char interface[IF_NAMESIZE];
606
if(if_indextoname((unsigned int)if_index, interface) == NULL){
607
perror("if_indextoname");
609
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
610
ip, interface, port);
613
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
616
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
617
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
620
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
623
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
629
if(strcmp(addrstr, ip) != 0){
630
fprintf(stderr, "Canonical address form: %s\n", addrstr);
636
ret = connect(tcp_sd, &to.in6, sizeof(to));
638
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
645
const char *out = mandos_protocol_version;
648
size_t out_size = strlen(out);
649
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
650
out_size - written));
656
written += (size_t)ret;
657
if(written < out_size){
660
if(out == mandos_protocol_version){
670
fprintf(stderr, "Establishing TLS session with %s\n", ip);
673
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
676
ret = gnutls_handshake(session);
677
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
679
if(ret != GNUTLS_E_SUCCESS){
681
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
688
/* Read OpenPGP packet that contains the wanted password */
691
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
696
buffer_capacity = incbuffer(&buffer, buffer_length,
698
if(buffer_capacity == 0){
704
sret = gnutls_record_recv(session, buffer+buffer_length,
711
case GNUTLS_E_INTERRUPTED:
714
case GNUTLS_E_REHANDSHAKE:
716
ret = gnutls_handshake(session);
717
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
719
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
726
fprintf(stderr, "Unknown error while reading data from"
727
" encrypted session with Mandos server\n");
729
gnutls_bye(session, GNUTLS_SHUT_RDWR);
733
buffer_length += (size_t) sret;
738
fprintf(stderr, "Closing TLS session\n");
741
gnutls_bye(session, GNUTLS_SHUT_RDWR);
743
if(buffer_length > 0){
744
decrypted_buffer_size = pgp_packet_decrypt(buffer,
747
if(decrypted_buffer_size >= 0){
749
while(written < (size_t) decrypted_buffer_size){
750
ret = (int)fwrite(decrypted_buffer + written, 1,
751
(size_t)decrypted_buffer_size - written,
753
if(ret == 0 and ferror(stdout)){
755
fprintf(stderr, "Error writing encrypted data: %s\n",
761
written += (size_t)ret;
763
free(decrypted_buffer);
771
/* Shutdown procedure */
775
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
779
gnutls_deinit(session);
783
static void resolve_callback(AvahiSServiceResolver *r,
784
AvahiIfIndex interface,
786
AvahiResolverEvent event,
790
const char *host_name,
791
const AvahiAddress *address,
793
AVAHI_GCC_UNUSED AvahiStringList *txt,
794
AVAHI_GCC_UNUSED AvahiLookupResultFlags
796
AVAHI_GCC_UNUSED void* userdata){
799
/* Called whenever a service has been resolved successfully or
804
case AVAHI_RESOLVER_FAILURE:
805
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
806
" of type '%s' in domain '%s': %s\n", name, type, domain,
807
avahi_strerror(avahi_server_errno(mc.server)));
810
case AVAHI_RESOLVER_FOUND:
812
char ip[AVAHI_ADDRESS_STR_MAX];
813
avahi_address_snprint(ip, sizeof(ip), address);
815
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
816
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
817
ip, (intmax_t)interface, port);
819
int ret = start_mandos_communication(ip, port, interface,
820
avahi_proto_to_af(proto));
822
avahi_simple_poll_quit(mc.simple_poll);
826
avahi_s_service_resolver_free(r);
829
static void browse_callback(AvahiSServiceBrowser *b,
830
AvahiIfIndex interface,
831
AvahiProtocol protocol,
832
AvahiBrowserEvent event,
836
AVAHI_GCC_UNUSED AvahiLookupResultFlags
838
AVAHI_GCC_UNUSED void* userdata){
841
/* Called whenever a new services becomes available on the LAN or
842
is removed from the LAN */
846
case AVAHI_BROWSER_FAILURE:
848
fprintf(stderr, "(Avahi browser) %s\n",
849
avahi_strerror(avahi_server_errno(mc.server)));
850
avahi_simple_poll_quit(mc.simple_poll);
853
case AVAHI_BROWSER_NEW:
854
/* We ignore the returned Avahi resolver object. In the callback
855
function we free it. If the Avahi server is terminated before
856
the callback function is called the Avahi server will free the
859
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
860
name, type, domain, protocol, 0,
861
resolve_callback, NULL) == NULL)
862
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
863
name, avahi_strerror(avahi_server_errno(mc.server)));
866
case AVAHI_BROWSER_REMOVE:
869
case AVAHI_BROWSER_ALL_FOR_NOW:
870
case AVAHI_BROWSER_CACHE_EXHAUSTED:
872
fprintf(stderr, "No Mandos server found, still searching...\n");
878
sig_atomic_t quit_now = 0;
880
/* stop main loop after sigterm has been called */
881
static void handle_sigterm(__attribute__((unused)) int sig){
886
int old_errno = errno;
887
if(mc.simple_poll != NULL){
888
avahi_simple_poll_quit(mc.simple_poll);
893
int main(int argc, char *argv[]){
894
AvahiSServiceBrowser *sb = NULL;
899
int exitcode = EXIT_SUCCESS;
900
const char *interface = "eth0";
901
struct ifreq network;
905
char *connect_to = NULL;
906
char tempdir[] = "/tmp/mandosXXXXXX";
907
bool tempdir_created = false;
908
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
909
const char *seckey = PATHDIR "/" SECKEY;
910
const char *pubkey = PATHDIR "/" PUBKEY;
912
bool gnutls_initialized = false;
913
bool gpgme_initialized = false;
916
struct sigaction old_sigterm_action;
917
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
920
struct argp_option options[] = {
921
{ .name = "debug", .key = 128,
922
.doc = "Debug mode", .group = 3 },
923
{ .name = "connect", .key = 'c',
924
.arg = "ADDRESS:PORT",
925
.doc = "Connect directly to a specific Mandos server",
927
{ .name = "interface", .key = 'i',
929
.doc = "Network interface that will be used to search for"
932
{ .name = "seckey", .key = 's',
934
.doc = "OpenPGP secret key file base name",
936
{ .name = "pubkey", .key = 'p',
938
.doc = "OpenPGP public key file base name",
940
{ .name = "dh-bits", .key = 129,
942
.doc = "Bit length of the prime number used in the"
943
" Diffie-Hellman key exchange",
945
{ .name = "priority", .key = 130,
947
.doc = "GnuTLS priority string for the TLS handshake",
949
{ .name = "delay", .key = 131,
951
.doc = "Maximum delay to wait for interface startup",
956
error_t parse_opt(int key, char *arg,
957
struct argp_state *state){
959
case 128: /* --debug */
962
case 'c': /* --connect */
965
case 'i': /* --interface */
968
case 's': /* --seckey */
971
case 'p': /* --pubkey */
974
case 129: /* --dh-bits */
976
tmpmax = strtoimax(arg, &tmp, 10);
977
if(errno != 0 or tmp == arg or *tmp != '\0'
978
or tmpmax != (typeof(mc.dh_bits))tmpmax){
979
fprintf(stderr, "Bad number of DH bits\n");
982
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
984
case 130: /* --priority */
987
case 131: /* --delay */
989
delay = strtof(arg, &tmp);
990
if(errno != 0 or tmp == arg or *tmp != '\0'){
991
fprintf(stderr, "Bad delay\n");
1000
return ARGP_ERR_UNKNOWN;
1005
struct argp argp = { .options = options, .parser = parse_opt,
1007
.doc = "Mandos client -- Get and decrypt"
1008
" passwords from a Mandos server" };
1009
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1010
if(ret == ARGP_ERR_UNKNOWN){
1011
fprintf(stderr, "Unknown error while parsing arguments\n");
1012
exitcode = EXIT_FAILURE;
1018
avahi_set_log_function(empty_log);
1021
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1022
from the signal handler */
1023
/* Initialize the pseudo-RNG for Avahi */
1024
srand((unsigned int) time(NULL));
1025
mc.simple_poll = avahi_simple_poll_new();
1026
if(mc.simple_poll == NULL){
1027
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1028
exitcode = EXIT_FAILURE;
1032
sigemptyset(&sigterm_action.sa_mask);
1033
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1035
perror("sigaddset");
1036
exitcode = EXIT_FAILURE;
1039
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1041
perror("sigaddset");
1042
exitcode = EXIT_FAILURE;
1045
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1047
perror("sigaddset");
1048
exitcode = EXIT_FAILURE;
1051
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1053
perror("sigaction");
1054
exitcode = EXIT_FAILURE;
1058
/* If the interface is down, bring it up */
1059
if(interface[0] != '\0'){
1061
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1062
messages to mess up the prompt */
1063
ret = klogctl(8, NULL, 5);
1064
bool restore_loglevel = true;
1066
restore_loglevel = false;
1069
#endif /* __linux__ */
1071
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1074
exitcode = EXIT_FAILURE;
1076
if(restore_loglevel){
1077
ret = klogctl(7, NULL, 0);
1082
#endif /* __linux__ */
1085
strcpy(network.ifr_name, interface);
1086
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1088
perror("ioctl SIOCGIFFLAGS");
1090
if(restore_loglevel){
1091
ret = klogctl(7, NULL, 0);
1096
#endif /* __linux__ */
1097
exitcode = EXIT_FAILURE;
1100
if((network.ifr_flags & IFF_UP) == 0){
1101
network.ifr_flags |= IFF_UP;
1102
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1104
perror("ioctl SIOCSIFFLAGS");
1105
exitcode = EXIT_FAILURE;
1107
if(restore_loglevel){
1108
ret = klogctl(7, NULL, 0);
1113
#endif /* __linux__ */
1117
/* sleep checking until interface is running */
1118
for(int i=0; i < delay * 4; i++){
1119
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1121
perror("ioctl SIOCGIFFLAGS");
1122
} else if(network.ifr_flags & IFF_RUNNING){
1125
struct timespec sleeptime = { .tv_nsec = 250000000 };
1126
ret = nanosleep(&sleeptime, NULL);
1127
if(ret == -1 and errno != EINTR){
1128
perror("nanosleep");
1131
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1136
if(restore_loglevel){
1137
/* Restores kernel loglevel to default */
1138
ret = klogctl(7, NULL, 0);
1143
#endif /* __linux__ */
1160
ret = init_gnutls_global(pubkey, seckey);
1162
fprintf(stderr, "init_gnutls_global failed\n");
1163
exitcode = EXIT_FAILURE;
1166
gnutls_initialized = true;
1169
if(mkdtemp(tempdir) == NULL){
1173
tempdir_created = true;
1175
if(not init_gpgme(pubkey, seckey, tempdir)){
1176
fprintf(stderr, "init_gpgme failed\n");
1177
exitcode = EXIT_FAILURE;
1180
gpgme_initialized = true;
1183
if(interface[0] != '\0'){
1184
if_index = (AvahiIfIndex) if_nametoindex(interface);
1186
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1187
exitcode = EXIT_FAILURE;
1192
if(connect_to != NULL){
1193
/* Connect directly, do not use Zeroconf */
1194
/* (Mainly meant for debugging) */
1195
char *address = strrchr(connect_to, ':');
1196
if(address == NULL){
1197
fprintf(stderr, "No colon in address\n");
1198
exitcode = EXIT_FAILURE;
1203
tmpmax = strtoimax(address+1, &tmp, 10);
1204
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1205
or tmpmax != (uint16_t)tmpmax){
1206
fprintf(stderr, "Bad port number\n");
1207
exitcode = EXIT_FAILURE;
1210
port = (uint16_t)tmpmax;
1212
address = connect_to;
1213
/* Colon in address indicates IPv6 */
1215
if(strchr(address, ':') != NULL){
1220
ret = start_mandos_communication(address, port, if_index, af);
1222
exitcode = EXIT_FAILURE;
1224
exitcode = EXIT_SUCCESS;
1230
AvahiServerConfig config;
1231
/* Do not publish any local Zeroconf records */
1232
avahi_server_config_init(&config);
1233
config.publish_hinfo = 0;
1234
config.publish_addresses = 0;
1235
config.publish_workstation = 0;
1236
config.publish_domain = 0;
1238
/* Allocate a new server */
1239
mc.server = avahi_server_new(avahi_simple_poll_get
1240
(mc.simple_poll), &config, NULL,
1243
/* Free the Avahi configuration data */
1244
avahi_server_config_free(&config);
1247
/* Check if creating the Avahi server object succeeded */
1248
if(mc.server == NULL){
1249
fprintf(stderr, "Failed to create Avahi server: %s\n",
1250
avahi_strerror(error));
1251
exitcode = EXIT_FAILURE;
1255
/* Create the Avahi service browser */
1256
sb = avahi_s_service_browser_new(mc.server, if_index,
1257
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1258
NULL, 0, browse_callback, NULL);
1260
fprintf(stderr, "Failed to create service browser: %s\n",
1261
avahi_strerror(avahi_server_errno(mc.server)));
1262
exitcode = EXIT_FAILURE;
1266
/* Run the main loop */
1269
fprintf(stderr, "Starting Avahi loop search\n");
1272
avahi_simple_poll_loop(mc.simple_poll);
1277
fprintf(stderr, "%s exiting\n", argv[0]);
1280
/* Cleanup things */
1282
avahi_s_service_browser_free(sb);
1284
if(mc.server != NULL)
1285
avahi_server_free(mc.server);
1287
if(mc.simple_poll != NULL)
1288
avahi_simple_poll_free(mc.simple_poll);
1290
if(gnutls_initialized){
1291
gnutls_certificate_free_credentials(mc.cred);
1292
gnutls_global_deinit();
1293
gnutls_dh_params_deinit(mc.dh_params);
1296
if(gpgme_initialized){
1297
gpgme_release(mc.ctx);
1300
/* Removes the temp directory used by GPGME */
1301
if(tempdir_created){
1303
struct dirent *direntry;
1304
d = opendir(tempdir);
1306
if(errno != ENOENT){
1311
direntry = readdir(d);
1312
if(direntry == NULL){
1315
/* Skip "." and ".." */
1316
if(direntry->d_name[0] == '.'
1317
and (direntry->d_name[1] == '\0'
1318
or (direntry->d_name[1] == '.'
1319
and direntry->d_name[2] == '\0'))){
1322
char *fullname = NULL;
1323
ret = asprintf(&fullname, "%s/%s", tempdir,
1329
ret = remove(fullname);
1331
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1338
ret = rmdir(tempdir);
1339
if(ret == -1 and errno != ENOENT){