/mandos/trunk : revision 351

30

*/

31

32

/* Needed by GPGME, specifically gpgme_data_seek() */

33

#ifndef _LARGEFILE_SOURCE

33

34

#define _LARGEFILE_SOURCE

35

#endif

36

#ifndef _FILE_OFFSET_BITS

34

37

#define _FILE_OFFSET_BITS 64

38

#endif

35

39

36

40

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */

37

41

38

42

#include <stdio.h> /* fprintf(), stderr, fwrite(),

39

stdout, ferror(), sscanf(),

40

remove() */

43

stdout, ferror(), remove() */

41

44

#include <stdint.h> /* uint16_t, uint32_t */

42

45

#include <stddef.h> /* NULL, size_t, ssize_t */

43

46

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

44

srand() */

47

srand(), strtof() */

45

48

#include <stdbool.h> /* bool, false, true */

46

49

#include <string.h> /* memset(), strcmp(), strlen(),

47

50

strerror(), asprintf(), strcpy() */

56

59

#include <fcntl.h> /* open() */

57

60

#include <dirent.h> /* opendir(), struct dirent, readdir()

58

61

*/

59

#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */

62

#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,

63

strtoimax() */

60

64

#include <assert.h> /* assert() */

61

65

#include <errno.h> /* perror(), errno */

62

66

#include <time.h> /* nanosleep(), time() */

134

138

} mandos_context;

135

139

136

140

/* global context so signal handler can reach it*/

137

mandos_context mc;

141

mandos_context mc = { .simple_poll = NULL, .server = NULL,

142

.dh_bits = 1024, .priority = "SECURE256"

143

":!CTYPE-X.509:+CTYPE-OPENPGP" };

138

144

139

145

/*

140

146

* Make additional room in "buffer" for at least BUFFER_SIZE more

303

309

}

304

310

gpgme_recipient_t recipient;

305

311

recipient = result->recipients;

306

if(recipient){

307

while(recipient != NULL){

308

fprintf(stderr, "Public key algorithm: %s\n",

309

gpgme_pubkey_algo_name(recipient->pubkey_algo));

310

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

311

fprintf(stderr, "Secret key available: %s\n",

312

recipient->status == GPG_ERR_NO_SECKEY

313

? "No" : "Yes");

314

recipient = recipient->next;

315

}

312

while(recipient != NULL){

313

fprintf(stderr, "Public key algorithm: %s\n",

314

gpgme_pubkey_algo_name(recipient->pubkey_algo));

315

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

316

fprintf(stderr, "Secret key available: %s\n",

317

recipient->status == GPG_ERR_NO_SECKEY

318

? "No" : "Yes");

319

recipient = recipient->next;

316

320

}

317

321

}

318

322

}

560

564

561

565

memset(&to, 0, sizeof(to));

562

566

if(af == AF_INET6){

563

to.in6.sin6_family = (uint16_t)af;

567

to.in6.sin6_family = (sa_family_t)af;

564

568

ret = inet_pton(af, ip, &to.in6.sin6_addr);

565

569

} else { /* IPv4 */

566

570

to.in.sin_family = (sa_family_t)af;

852

856

the callback function is called the Avahi server will free the

853

857

resolver for us. */

854

858

855

if(!(avahi_s_service_resolver_new(mc.server, interface,

856

protocol, name, type, domain,

857

AVAHI_PROTO_INET6, 0,

858

resolve_callback, NULL)))

859

if(avahi_s_service_resolver_new(mc.server, interface, protocol,

860

name, type, domain, protocol, 0,

861

resolve_callback, NULL) == NULL)

859

862

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

860

863

name, avahi_strerror(avahi_server_errno(mc.server)));

861

864

break;

874

877

875

878

sig_atomic_t quit_now = 0;

876

879

880

/* stop main loop after sigterm has been called */

877

881

static void handle_sigterm(__attribute__((unused)) int sig){

878

882

if(quit_now){

879

883

return;

891

895

int error;

892

896

int ret;

893

897

intmax_t tmpmax;

894

int numchars;

898

char *tmp;

895

899

int exitcode = EXIT_SUCCESS;

896

900

const char *interface = "eth0";

897

901

struct ifreq network;

898

int sd;

902

int sd = -1;

903

bool interface_taken_up = false;

899

904

uid_t uid;

900

905

gid_t gid;

901

906

char *connect_to = NULL;

905

910

const char *seckey = PATHDIR "/" SECKEY;

906

911

const char *pubkey = PATHDIR "/" PUBKEY;

907

912

908

/* Initialize Mandos context */

909

mc = (mandos_context){ .simple_poll = NULL, .server = NULL,

910

.dh_bits = 1024, .priority = "SECURE256"

911

":!CTYPE-X.509:+CTYPE-OPENPGP" };

912

913

bool gnutls_initialized = false;

913

914

bool gpgme_initialized = false;

914

double delay = 2.5;

915

float delay = 2.5f;

916

917

struct sigaction old_sigterm_action;

917

918

struct sigaction sigterm_action = { .sa_handler = handle_sigterm };

918

919

972

973

pubkey = arg;

973

974

break;

974

975

case 129: /* --dh-bits */

975

ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);

976

if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax

977

or arg[numchars] != '\0'){

976

errno = 0;

977

tmpmax = strtoimax(arg, &tmp, 10);

978

if(errno != 0 or tmp == arg or *tmp != '\0'

979

or tmpmax != (typeof(mc.dh_bits))tmpmax){

978

980

fprintf(stderr, "Bad number of DH bits\n");

979

981

exit(EXIT_FAILURE);

980

982

}

984

986

mc.priority = arg;

985

987

break;

986

988

case 131: /* --delay */

987

ret = sscanf(arg, "%lf%n", &delay, &numchars);

988

if(ret < 1 or arg[numchars] != '\0'){

989

errno = 0;

990

delay = strtof(arg, &tmp);

991

if(errno != 0 or tmp == arg or *tmp != '\0'){

989

992

fprintf(stderr, "Bad delay\n");

990

993

exit(EXIT_FAILURE);

991

994

}

1012

1015

}

1013

1016

}

1014

1017

1018

if(not debug){

1019

avahi_set_log_function(empty_log);

1020

}

1021

1022

/* Initialize Avahi early so avahi_simple_poll_quit() can be called

1023

from the signal handler */

1024

/* Initialize the pseudo-RNG for Avahi */

1025

srand((unsigned int) time(NULL));

1026

mc.simple_poll = avahi_simple_poll_new();

1027

if(mc.simple_poll == NULL){

1028

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1029

exitcode = EXIT_FAILURE;

1030

goto end;

1031

}

1032

1033

sigemptyset(&sigterm_action.sa_mask);

1034

ret = sigaddset(&sigterm_action.sa_mask, SIGINT);

1035

if(ret == -1){

1036

perror("sigaddset");

1037

exitcode = EXIT_FAILURE;

1038

goto end;

1039

}

1040

ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);

1041

if(ret == -1){

1042

perror("sigaddset");

1043

exitcode = EXIT_FAILURE;

1044

goto end;

1045

}

1046

ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);

1047

if(ret == -1){

1048

perror("sigaddset");

1049

exitcode = EXIT_FAILURE;

1050

goto end;

1051

}

1052

ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);

1053

if(ret == -1){

1054

perror("sigaction");

1055

exitcode = EXIT_FAILURE;

1056

goto end;

1057

}

1058

1015

1059

/* If the interface is down, bring it up */

1016

1060

if(interface[0] != '\0'){

1017

1061

#ifdef __linux__

1070

1114

#endif /* __linux__ */

1071

1115

goto end;

1072

1116

}

1117

interface_taken_up = true;

1073

1118

}

1074

1119

/* sleep checking until interface is running */

1075

1120

for(int i=0; i < delay * 4; i++){

1085

1130

perror("nanosleep");

1086

1131

}

1087

1132

}

1088

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1089

if(ret == -1){

1090

perror("close");

1133

if(not interface_taken_up){

1134

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1135

if(ret == -1){

1136

perror("close");

1137

}

1091

1138

}

1092

1139

#ifdef __linux__

1093

1140

if(restore_loglevel){

1156

1203

goto end;

1157

1204

}

1158

1205

uint16_t port;

1159

ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);

1160

if(ret < 1 or tmpmax != (uint16_t)tmpmax

1161

or address[numchars+1] != '\0'){

1206

errno = 0;

1207

tmpmax = strtoimax(address+1, &tmp, 10);

1208

if(errno != 0 or tmp == address+1 or *tmp != '\0'

1209

or tmpmax != (uint16_t)tmpmax){

1162

1210

fprintf(stderr, "Bad port number\n");

1163

1211

exitcode = EXIT_FAILURE;

1164

1212

goto end;

1181

1229

}

1182

1230

goto end;

1183

1231

}

1184

1185

if(not debug){

1186

avahi_set_log_function(empty_log);

1187

}

1188

1189

/* Initialize the pseudo-RNG for Avahi */

1190

srand((unsigned int) time(NULL));

1191

1192

/* Allocate main Avahi loop object */

1193

mc.simple_poll = avahi_simple_poll_new();

1194

if(mc.simple_poll == NULL){

1195

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1196

exitcode = EXIT_FAILURE;

1197

goto end;

1198

}

1199

1232

1200

1233

{

1201

1234

AvahiServerConfig config;

1202

1235

/* Do not publish any local Zeroconf records */

1225

1258

1226

1259

/* Create the Avahi service browser */

1227

1260

sb = avahi_s_service_browser_new(mc.server, if_index,

1228

AVAHI_PROTO_INET6, "_mandos._tcp",

1261

AVAHI_PROTO_UNSPEC, "_mandos._tcp",

1229

1262

NULL, 0, browse_callback, NULL);

1230

1263

if(sb == NULL){

1231

1264

fprintf(stderr, "Failed to create service browser: %s\n",

1234

1267

goto end;

1235

1268

}

1236

1269

1237

sigemptyset(&sigterm_action.sa_mask);

1238

ret = sigaddset(&sigterm_action.sa_mask, SIGINT);

1239

if(ret == -1){

1240

perror("sigaddset");

1241

exitcode = EXIT_FAILURE;

1242

goto end;

1243

}

1244

ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);

1245

if(ret == -1){

1246

perror("sigaddset");

1247

exitcode = EXIT_FAILURE;

1248

goto end;

1249

}

1250

ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);

1251

if(ret == -1){

1252

perror("sigaddset");

1253

exitcode = EXIT_FAILURE;

1254

goto end;

1255

}

1256

ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);

1257

if(ret == -1){

1258

perror("sigaction");

1259

exitcode = EXIT_FAILURE;

1260

goto end;

1261

}

1262

1263

1270

/* Run the main loop */

1264

1271

1265

1272

if(debug){

1294

1301

gpgme_release(mc.ctx);

1295

1302

}

1296

1303

1304

/* Take down the network interface */

1305

if(interface_taken_up){

1306

ret = ioctl(sd, SIOCGIFFLAGS, &network);

1307

if(ret == -1){

1308

perror("ioctl SIOCGIFFLAGS");

1309

} else if(network.ifr_flags & IFF_UP) {

1310

network.ifr_flags &= ~IFF_UP; /* clear flag */

1311

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1312

if(ret == -1){

1313

perror("ioctl SIOCSIFFLAGS");

1314

}

1315

}

1316

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1317

if(ret == -1){

1318

perror("close");

1319

}

1320

}

1321

1297

1322

/* Removes the temp directory used by GPGME */

1298

1323

if(tempdir_created){

1299

1324

DIR *d;