/mandos/trunk : revision 355

30

*/

31

32

/* Needed by GPGME, specifically gpgme_data_seek() */

33

#ifndef _LARGEFILE_SOURCE

33

34

#define _LARGEFILE_SOURCE

35

#endif

36

#ifndef _FILE_OFFSET_BITS

34

37

#define _FILE_OFFSET_BITS 64

38

#endif

35

39

36

40

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */

37

41

38

42

#include <stdio.h> /* fprintf(), stderr, fwrite(),

39

stdout, ferror(), sscanf(),

40

remove() */

43

stdout, ferror(), remove() */

41

44

#include <stdint.h> /* uint16_t, uint32_t */

42

45

#include <stddef.h> /* NULL, size_t, ssize_t */

43

46

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

44

srand() */

47

srand(), strtof() */

45

48

#include <stdbool.h> /* bool, false, true */

46

49

#include <string.h> /* memset(), strcmp(), strlen(),

47

50

strerror(), asprintf(), strcpy() */

56

59

#include <fcntl.h> /* open() */

57

60

#include <dirent.h> /* opendir(), struct dirent, readdir()

58

61

*/

59

#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */

62

#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,

63

strtoimax() */

60

64

#include <assert.h> /* assert() */

61

65

#include <errno.h> /* perror(), errno */

62

66

#include <time.h> /* nanosleep(), time() */

76

80

argp_parse(), ARGP_KEY_ARG,

77

81

ARGP_KEY_END, ARGP_ERR_UNKNOWN */

78

82

#include <signal.h> /* sigemptyset(), sigaddset(),

79

sigaction(), SIGTERM, sigaction,

80

sig_atomic_t */

83

sigaction(), SIGTERM, sig_atomic_t,

84

raise() */

81

85

82

86

#ifdef __linux__

83

87

#include <sys/klog.h> /* klogctl() */

134

138

} mandos_context;

135

139

136

140

/* global context so signal handler can reach it*/

137

mandos_context mc;

141

mandos_context mc = { .simple_poll = NULL, .server = NULL,

142

.dh_bits = 1024, .priority = "SECURE256"

143

":!CTYPE-X.509:+CTYPE-OPENPGP" };

138

144

139

145

/*

140

146

* Make additional room in "buffer" for at least BUFFER_SIZE more

243

249

return false;

244

250

}

245

251

246

return true;

252

return true;

247

253

}

248

254

249

255

/*

303

309

}

304

310

gpgme_recipient_t recipient;

305

311

recipient = result->recipients;

306

if(recipient){

307

while(recipient != NULL){

308

fprintf(stderr, "Public key algorithm: %s\n",

309

gpgme_pubkey_algo_name(recipient->pubkey_algo));

310

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

311

fprintf(stderr, "Secret key available: %s\n",

312

recipient->status == GPG_ERR_NO_SECKEY

313

? "No" : "Yes");

314

recipient = recipient->next;

315

}

312

while(recipient != NULL){

313

fprintf(stderr, "Public key algorithm: %s\n",

314

gpgme_pubkey_algo_name(recipient->pubkey_algo));

315

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

316

fprintf(stderr, "Secret key available: %s\n",

317

recipient->status == GPG_ERR_NO_SECKEY

318

? "No" : "Yes");

319

recipient = recipient->next;

316

320

}

317

321

}

318

322

}

510

514

static void empty_log(__attribute__((unused)) AvahiLogLevel level,

511

515

__attribute__((unused)) const char *txt){}

512

516

517

sig_atomic_t quit_now = 0;

518

int signal_received = 0;

519

513

520

/* Called when a Mandos server is found */

514

521

static int start_mandos_communication(const char *ip, uint16_t port,

515

522

AvahiIfIndex if_index,

560

567

561

568

memset(&to, 0, sizeof(to));

562

569

if(af == AF_INET6){

563

to.in6.sin6_family = (uint16_t)af;

570

to.in6.sin6_family = (sa_family_t)af;

564

571

ret = inet_pton(af, ip, &to.in6.sin6_addr);

565

572

} else { /* IPv4 */

566

573

to.in.sin_family = (sa_family_t)af;

795

802

/* Called whenever a service has been resolved successfully or

796

803

timed out */

797

804

805

if(quit_now){

806

return;

807

}

808

798

809

switch(event){

799

810

default:

800

811

case AVAHI_RESOLVER_FAILURE:

852

863

the callback function is called the Avahi server will free the

853

864

resolver for us. */

854

865

855

if(!(avahi_s_service_resolver_new(mc.server, interface,

856

protocol, name, type, domain,

857

AVAHI_PROTO_INET6, 0,

858

resolve_callback, NULL)))

866

if(avahi_s_service_resolver_new(mc.server, interface, protocol,

867

name, type, domain, protocol, 0,

868

resolve_callback, NULL) == NULL)

859

869

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

860

870

name, avahi_strerror(avahi_server_errno(mc.server)));

861

871

break;

872

882

}

873

883

}

874

884

875

sig_atomic_t quit_now = 0;

876

877

static void handle_sigterm(__attribute__((unused)) int sig){

885

/* stop main loop after sigterm has been called */

886

static void handle_sigterm(int sig){

878

887

if(quit_now){

879

888

return;

880

889

}

881

890

quit_now = 1;

891

signal_received = sig;

882

892

int old_errno = errno;

883

893

if(mc.simple_poll != NULL){

884

894

avahi_simple_poll_quit(mc.simple_poll);

891

901

int error;

892

902

int ret;

893

903

intmax_t tmpmax;

894

int numchars;

904

char *tmp;

895

905

int exitcode = EXIT_SUCCESS;

896

906

const char *interface = "eth0";

897

907

struct ifreq network;

898

int sd;

908

int sd = -1;

909

bool take_down_interface = false;

899

910

uid_t uid;

900

911

gid_t gid;

901

912

char *connect_to = NULL;

905

916

const char *seckey = PATHDIR "/" SECKEY;

906

917

const char *pubkey = PATHDIR "/" PUBKEY;

907

918

908

/* Initialize Mandos context */

909

mc = (mandos_context){ .simple_poll = NULL, .server = NULL,

910

.dh_bits = 1024, .priority = "SECURE256"

911

":!CTYPE-X.509:+CTYPE-OPENPGP" };

912

919

bool gnutls_initialized = false;

913

920

bool gpgme_initialized = false;

914

double delay = 2.5;

915

921

float delay = 2.5f;

922

916

923

struct sigaction old_sigterm_action;

917

924

struct sigaction sigterm_action = { .sa_handler = handle_sigterm };

918

925

972

979

pubkey = arg;

973

980

break;

974

981

case 129: /* --dh-bits */

975

ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);

976

if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax

977

or arg[numchars] != '\0'){

982

errno = 0;

983

tmpmax = strtoimax(arg, &tmp, 10);

984

if(errno != 0 or tmp == arg or *tmp != '\0'

985

or tmpmax != (typeof(mc.dh_bits))tmpmax){

978

986

fprintf(stderr, "Bad number of DH bits\n");

979

987

exit(EXIT_FAILURE);

980

988

}

984

992

mc.priority = arg;

985

993

break;

986

994

case 131: /* --delay */

987

ret = sscanf(arg, "%lf%n", &delay, &numchars);

988

if(ret < 1 or arg[numchars] != '\0'){

995

errno = 0;

996

delay = strtof(arg, &tmp);

997

if(errno != 0 or tmp == arg or *tmp != '\0'){

989

998

fprintf(stderr, "Bad delay\n");

990

999

exit(EXIT_FAILURE);

991

1000

}

1012

1021

}

1013

1022

}

1014

1023

1024

if(not debug){

1025

avahi_set_log_function(empty_log);

1026

}

1027

1028

/* Initialize Avahi early so avahi_simple_poll_quit() can be called

1029

from the signal handler */

1030

/* Initialize the pseudo-RNG for Avahi */

1031

srand((unsigned int) time(NULL));

1032

mc.simple_poll = avahi_simple_poll_new();

1033

if(mc.simple_poll == NULL){

1034

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1035

exitcode = EXIT_FAILURE;

1036

goto end;

1037

}

1038

1039

sigemptyset(&sigterm_action.sa_mask);

1040

ret = sigaddset(&sigterm_action.sa_mask, SIGINT);

1041

if(ret == -1){

1042

perror("sigaddset");

1043

exitcode = EXIT_FAILURE;

1044

goto end;

1045

}

1046

ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);

1047

if(ret == -1){

1048

perror("sigaddset");

1049

exitcode = EXIT_FAILURE;

1050

goto end;

1051

}

1052

ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);

1053

if(ret == -1){

1054

perror("sigaddset");

1055

exitcode = EXIT_FAILURE;

1056

goto end;

1057

}

1058

ret = sigaction(SIGINT, &sigterm_action, &old_sigterm_action);

1059

if(ret == -1){

1060

perror("sigaction");

1061

exitcode = EXIT_FAILURE;

1062

goto end;

1063

}

1064

ret = sigaction(SIGHUP, &sigterm_action, NULL);

1065

if(ret == -1){

1066

perror("sigaction");

1067

exitcode = EXIT_FAILURE;

1068

goto end;

1069

}

1070

ret = sigaction(SIGTERM, &sigterm_action, NULL);

1071

if(ret == -1){

1072

perror("sigaction");

1073

exitcode = EXIT_FAILURE;

1074

goto end;

1075

}

1076

1015

1077

/* If the interface is down, bring it up */

1016

1078

if(interface[0] != '\0'){

1079

if_index = (AvahiIfIndex) if_nametoindex(interface);

1080

if(if_index == 0){

1081

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1082

exitcode = EXIT_FAILURE;

1083

goto end;

1084

}

1085

1086

if(quit_now){

1087

goto end;

1088

}

1089

1017

1090

#ifdef __linux__

1018

1091

/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO

1019

1092

messages to mess up the prompt */

1056

1129

}

1057

1130

if((network.ifr_flags & IFF_UP) == 0){

1058

1131

network.ifr_flags |= IFF_UP;

1132

take_down_interface = true;

1059

1133

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1060

1134

if(ret == -1){

1135

take_down_interface = false;

1061

1136

perror("ioctl SIOCSIFFLAGS");

1062

1137

exitcode = EXIT_FAILURE;

1063

1138

#ifdef __linux__

1085

1160

perror("nanosleep");

1086

1161

}

1087

1162

}

1088

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1089

if(ret == -1){

1090

perror("close");

1163

if(not take_down_interface){

1164

/* We won't need the socket anymore */

1165

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1166

if(ret == -1){

1167

perror("close");

1168

}

1091

1169

}

1092

1170

#ifdef __linux__

1093

1171

if(restore_loglevel){

1100

1178

#endif /* __linux__ */

1101

1179

}

1102

1180

1181

if(quit_now){

1182

goto end;

1183

}

1184

1103

1185

uid = getuid();

1104

1186

gid = getgid();

1105

1187

1114

1196

perror("setuid");

1115

1197

}

1116

1198

1199

if(quit_now){

1200

goto end;

1201

}

1202

1117

1203

ret = init_gnutls_global(pubkey, seckey);

1118

1204

if(ret == -1){

1119

1205

fprintf(stderr, "init_gnutls_global failed\n");

1123

1209

gnutls_initialized = true;

1124

1210

}

1125

1211

1212

if(quit_now){

1213

goto end;

1214

}

1215

1216

tempdir_created = true;

1126

1217

if(mkdtemp(tempdir) == NULL){

1218

tempdir_created = false;

1127

1219

perror("mkdtemp");

1128

1220

goto end;

1129

1221

}

1130

tempdir_created = true;

1222

1223

if(quit_now){

1224

goto end;

1225

}

1131

1226

1132

1227

if(not init_gpgme(pubkey, seckey, tempdir)){

1133

1228

fprintf(stderr, "init_gpgme failed\n");

1137

1232

gpgme_initialized = true;

1138

1233

}

1139

1234

1140

if(interface[0] != '\0'){

1141

if_index = (AvahiIfIndex) if_nametoindex(interface);

1142

if(if_index == 0){

1143

fprintf(stderr, "No such interface: \"%s\"\n", interface);

1144

exitcode = EXIT_FAILURE;

1145

goto end;

1146

}

1235

if(quit_now){

1236

goto end;

1147

1237

}

1148

1238

1149

1239

if(connect_to != NULL){

1155

1245

exitcode = EXIT_FAILURE;

1156

1246

goto end;

1157

1247

}

1248

1249

if(quit_now){

1250

goto end;

1251

}

1252

1158

1253

uint16_t port;

1159

ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);

1160

if(ret < 1 or tmpmax != (uint16_t)tmpmax

1161

or address[numchars+1] != '\0'){

1254

errno = 0;

1255

tmpmax = strtoimax(address+1, &tmp, 10);

1256

if(errno != 0 or tmp == address+1 or *tmp != '\0'

1257

or tmpmax != (uint16_t)tmpmax){

1162

1258

fprintf(stderr, "Bad port number\n");

1163

1259

exitcode = EXIT_FAILURE;

1164

1260

goto end;

1165

1261

}

1262

1263

if(quit_now){

1264

goto end;

1265

}

1266

1166

1267

port = (uint16_t)tmpmax;

1167

1268

*address = '\0';

1168

1269

address = connect_to;

1173

1274

} else {

1174

1275

af = AF_INET;

1175

1276

}

1277

1278

if(quit_now){

1279

goto end;

1280

}

1281

1176

1282

ret = start_mandos_communication(address, port, if_index, af);

1177

1283

if(ret < 0){

1178

1284

exitcode = EXIT_FAILURE;

1182

1288

goto end;

1183

1289

}

1184

1290

1185

if(not debug){

1186

avahi_set_log_function(empty_log);

1187

}

1188

1189

/* Initialize the pseudo-RNG for Avahi */

1190

srand((unsigned int) time(NULL));

1191

1192

/* Allocate main Avahi loop object */

1193

mc.simple_poll = avahi_simple_poll_new();

1194

if(mc.simple_poll == NULL){

1195

fprintf(stderr, "Avahi: Failed to create simple poll object.\n");

1196

exitcode = EXIT_FAILURE;

1291

if(quit_now){

1197

1292

goto end;

1198

1293

}

1199

1294

1223

1318

goto end;

1224

1319

}

1225

1320

1321

if(quit_now){

1322

goto end;

1323

}

1324

1226

1325

/* Create the Avahi service browser */

1227

1326

sb = avahi_s_service_browser_new(mc.server, if_index,

1228

AVAHI_PROTO_INET6, "_mandos._tcp",

1327

AVAHI_PROTO_UNSPEC, "_mandos._tcp",

1229

1328

NULL, 0, browse_callback, NULL);

1230

1329

if(sb == NULL){

1231

1330

fprintf(stderr, "Failed to create service browser: %s\n",

1234

1333

goto end;

1235

1334

}

1236

1335

1237

sigemptyset(&sigterm_action.sa_mask);

1238

ret = sigaddset(&sigterm_action.sa_mask, SIGINT);

1239

if(ret == -1){

1240

perror("sigaddset");

1241

exitcode = EXIT_FAILURE;

1242

goto end;

1243

}

1244

ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);

1245

if(ret == -1){

1246

perror("sigaddset");

1247

exitcode = EXIT_FAILURE;

1248

goto end;

1249

}

1250

ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);

1251

if(ret == -1){

1252

perror("sigaddset");

1253

exitcode = EXIT_FAILURE;

1254

goto end;

1255

}

1256

ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);

1257

if(ret == -1){

1258

perror("sigaction");

1259

exitcode = EXIT_FAILURE;

1260

goto end;

1261

}

1336

if(quit_now){

1337

goto end;

1338

}

1262

1339

1263

1340

/* Run the main loop */

1264

1341

1294

1371

gpgme_release(mc.ctx);

1295

1372

}

1296

1373

1374

/* Take down the network interface */

1375

if(take_down_interface){

1376

ret = ioctl(sd, SIOCGIFFLAGS, &network);

1377

if(ret == -1){

1378

perror("ioctl SIOCGIFFLAGS");

1379

} else if(network.ifr_flags & IFF_UP) {

1380

network.ifr_flags &= ~IFF_UP; /* clear flag */

1381

ret = ioctl(sd, SIOCSIFFLAGS, &network);

1382

if(ret == -1){

1383

perror("ioctl SIOCSIFFLAGS");

1384

}

1385

}

1386

ret = (int)TEMP_FAILURE_RETRY(close(sd));

1387

if(ret == -1){

1388

perror("close");

1389

}

1390

}

1391

1297

1392

/* Removes the temp directory used by GPGME */

1298

1393

if(tempdir_created){

1299

1394

DIR *d;

1338

1433

}

1339

1434

}

1340

1435

1436

if(quit_now){

1437

ret = sigaction(signal_received, &old_sigterm_action, NULL);

1438

if(ret == -1){

1439

perror("sigaction");

1440

}

1441

raise(signal_received);

1442

}

1443

1341

1444

return exitcode;

1342

1445

}