32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
33
34
#define _LARGEFILE_SOURCE
36
#ifndef _FILE_OFFSET_BITS
34
37
#define _FILE_OFFSET_BITS 64
36
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
76
80
argp_parse(), ARGP_KEY_ARG,
77
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
82
#include <signal.h> /* sigemptyset(), sigaddset(),
79
sigaction(), SIGTERM, sigaction,
83
sigaction(), SIGTERM, sig_atomic_t,
83
87
#include <sys/klog.h> /* klogctl() */
306
310
gpgme_recipient_t recipient;
307
311
recipient = result->recipients;
309
while(recipient != NULL){
310
fprintf(stderr, "Public key algorithm: %s\n",
311
gpgme_pubkey_algo_name(recipient->pubkey_algo));
312
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
313
fprintf(stderr, "Secret key available: %s\n",
314
recipient->status == GPG_ERR_NO_SECKEY
316
recipient = recipient->next;
312
while(recipient != NULL){
313
fprintf(stderr, "Public key algorithm: %s\n",
314
gpgme_pubkey_algo_name(recipient->pubkey_algo));
315
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
316
fprintf(stderr, "Secret key available: %s\n",
317
recipient->status == GPG_ERR_NO_SECKEY
319
recipient = recipient->next;
512
514
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
513
515
__attribute__((unused)) const char *txt){}
517
sig_atomic_t quit_now = 0;
518
int signal_received = 0;
515
520
/* Called when a Mandos server is found */
516
521
static int start_mandos_communication(const char *ip, uint16_t port,
517
522
AvahiIfIndex if_index,
524
int ret, tcp_sd = -1;
522
527
struct sockaddr_in in;
557
566
tcp_sd = socket(pf, SOCK_STREAM, 0);
559
568
perror("socket");
563
577
memset(&to, 0, sizeof(to));
564
578
if(af == AF_INET6){
565
to.in6.sin6_family = (uint16_t)af;
579
to.in6.sin6_family = (sa_family_t)af;
566
580
ret = inet_pton(af, ip, &to.in6.sin6_addr);
567
581
} else { /* IPv4 */
568
582
to.in.sin_family = (sa_family_t)af;
587
603
if(if_index == AVAHI_IF_UNSPEC){
588
604
fprintf(stderr, "An IPv6 link-local address is incomplete"
589
605
" without a network interface\n");
592
609
/* Set the network interface number as scope */
593
610
to.in6.sin6_scope_id = (uint32_t)if_index;
668
702
fprintf(stderr, "Establishing TLS session with %s\n", ip);
671
709
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
674
716
ret = gnutls_handshake(session);
675
720
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
677
722
if(ret != GNUTLS_E_SUCCESS){
712
766
case GNUTLS_E_REHANDSHAKE:
714
768
ret = gnutls_handshake(session);
715
773
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
717
775
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
736
794
fprintf(stderr, "Closing TLS session\n");
739
801
gnutls_bye(session, GNUTLS_SHUT_RDWR);
741
807
if(buffer_length > 0){
742
808
decrypted_buffer_size = pgp_packet_decrypt(buffer,
745
811
if(decrypted_buffer_size >= 0){
747
813
while(written < (size_t) decrypted_buffer_size){
748
818
ret = (int)fwrite(decrypted_buffer + written, 1,
749
819
(size_t)decrypted_buffer_size - written,
854
937
the callback function is called the Avahi server will free the
855
938
resolver for us. */
857
if(!(avahi_s_service_resolver_new(mc.server, interface,
858
protocol, name, type, domain,
859
AVAHI_PROTO_INET6, 0,
860
resolve_callback, NULL)))
940
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
941
name, type, domain, protocol, 0,
942
resolve_callback, NULL) == NULL)
861
943
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
862
944
name, avahi_strerror(avahi_server_errno(mc.server)));
877
sig_atomic_t quit_now = 0;
879
959
/* stop main loop after sigterm has been called */
880
static void handle_sigterm(__attribute__((unused)) int sig){
960
static void handle_sigterm(int sig){
965
signal_received = sig;
885
966
int old_errno = errno;
886
967
if(mc.simple_poll != NULL){
887
968
avahi_simple_poll_quit(mc.simple_poll);
908
990
const char *seckey = PATHDIR "/" SECKEY;
909
991
const char *pubkey = PATHDIR "/" PUBKEY;
911
/* Initialize Mandos context */
912
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
913
.dh_bits = 1024, .priority = "SECURE256"
914
":!CTYPE-X.509:+CTYPE-OPENPGP" };
915
993
bool gnutls_initialized = false;
916
994
bool gpgme_initialized = false;
917
995
float delay = 2.5f;
1051
1129
exitcode = EXIT_FAILURE;
1054
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1056
perror("sigaction");
1057
exitcode = EXIT_FAILURE;
1132
/* Need to check if the handler is SIG_IGN before handling:
1133
| [[info:libc:Initial Signal Actions]] |
1134
| [[info:libc:Basic Signal Handling]] |
1136
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1138
perror("sigaction");
1139
return EXIT_FAILURE;
1141
if(old_sigterm_action.sa_handler != SIG_IGN){
1142
ret = sigaction(SIGINT, &sigterm_action, NULL);
1144
perror("sigaction");
1145
exitcode = EXIT_FAILURE;
1149
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1151
perror("sigaction");
1152
return EXIT_FAILURE;
1154
if(old_sigterm_action.sa_handler != SIG_IGN){
1155
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1157
perror("sigaction");
1158
exitcode = EXIT_FAILURE;
1162
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1164
perror("sigaction");
1165
return EXIT_FAILURE;
1167
if(old_sigterm_action.sa_handler != SIG_IGN){
1168
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1170
perror("sigaction");
1171
exitcode = EXIT_FAILURE;
1061
1176
/* If the interface is down, bring it up */
1062
1177
if(interface[0] != '\0'){
1178
if_index = (AvahiIfIndex) if_nametoindex(interface);
1180
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1181
exitcode = EXIT_FAILURE;
1063
1189
#ifdef __linux__
1064
1190
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1065
1191
messages to mess up the prompt */
1103
1229
if((network.ifr_flags & IFF_UP) == 0){
1104
1230
network.ifr_flags |= IFF_UP;
1231
take_down_interface = true;
1105
1232
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1234
take_down_interface = false;
1107
1235
perror("ioctl SIOCSIFFLAGS");
1108
1236
exitcode = EXIT_FAILURE;
1109
1237
#ifdef __linux__
1169
1308
gnutls_initialized = true;
1315
tempdir_created = true;
1172
1316
if(mkdtemp(tempdir) == NULL){
1317
tempdir_created = false;
1173
1318
perror("mkdtemp");
1176
tempdir_created = true;
1178
1326
if(not init_gpgme(pubkey, seckey, tempdir)){
1179
1327
fprintf(stderr, "init_gpgme failed\n");
1183
1331
gpgme_initialized = true;
1186
if(interface[0] != '\0'){
1187
if_index = (AvahiIfIndex) if_nametoindex(interface);
1189
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1190
exitcode = EXIT_FAILURE;
1195
1338
if(connect_to != NULL){
1258
1424
/* Create the Avahi service browser */
1259
1425
sb = avahi_s_service_browser_new(mc.server, if_index,
1260
AVAHI_PROTO_INET6, "_mandos._tcp",
1426
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1261
1427
NULL, 0, browse_callback, NULL);
1262
1428
if(sb == NULL){
1263
1429
fprintf(stderr, "Failed to create service browser: %s\n",
1300
1470
gpgme_release(mc.ctx);
1473
/* Take down the network interface */
1474
if(take_down_interface){
1475
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1477
perror("ioctl SIOCGIFFLAGS");
1478
} else if(network.ifr_flags & IFF_UP) {
1479
network.ifr_flags &= ~IFF_UP; /* clear flag */
1480
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1482
perror("ioctl SIOCSIFFLAGS");
1485
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1303
1491
/* Removes the temp directory used by GPGME */
1304
1492
if(tempdir_created){