To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 36
- compare with another revision
- download diff
- download tarball
- view history from revision 36
- Committer: Teddy Hogeborn
- Date: 2008-08-02 14:33:47 UTC
- Revision ID: teddy@fukt.bsnet.se-20080802143347-u1m4zs1q0feu72ei
* TODO: Converted to org-mode style
* plugins.d/mandosclient.c (certdir): Changed to "/conf/conf.d/mandos/".
(certdir, certfile, certkey, pgp_packet_decrypt, debuggnutls,
initgnutls, empty_log, combinepath): Made static.
(combinepath): Rewritten to only get the argument string lengths
once. Do not print error message; leave that to
caller. All callers changed.
* plugins.d/mandosclient.c (certdir): Changed to "/conf/conf.d/mandos/".
(certdir, certfile, certkey, pgp_packet_decrypt, debuggnutls,
initgnutls, empty_log, combinepath): Made static.
(combinepath): Rewritten to only get the argument string lengths
once. Do not print error message; leave that to
caller. All callers changed.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
30
29
*/
31
30
32
31
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
32
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
33
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
90
/* Avahi */
91
/* All Avahi types, constants and functions
92
Avahi*, avahi_*,
93
AVAHI_* */
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
94
41
#include <avahi-core/core.h>
95
42
#include <avahi-core/lookup.h>
96
43
#include <avahi-core/log.h>
98
45
#include <avahi-common/malloc.h>
99
46
#include <avahi-common/error.h>
100
47
101
/* GnuTLS */
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
103
functions:
104
gnutls_*
105
init_gnutls_session(),
106
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
110
111
/* GPGME */
112
#include <gpgme.h> /* All GPGME types, constants and
113
functions:
114
gpgme_*
115
GPGME_PROTOCOL_OpenPGP,
116
GPG_ERR_NO_* */
48
//mandos client part
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
// getopt long
67
#include <getopt.h>
117
68
118
69
#define BUFFER_SIZE 256
70
#define DH_BITS 1024
119
71
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
72
static const char *certdir = "/conf/conf.d/mandos";
73
static const char *certfile = "openpgp-client.txt";
74
static const char *certkey = "openpgp-client-key.txt";
123
75
124
76
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
128
77
129
/* Used for passing in values through the Avahi callback functions */
130
78
typedef struct {
131
AvahiSimplePoll *simple_poll;
132
AvahiServer *server;
79
gnutls_session_t session;
133
80
gnutls_certificate_credentials_t cred;
134
unsigned int dh_bits;
135
81
gnutls_dh_params_t dh_params;
136
const char *priority;
82
} encrypted_session;
83
84
85
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
86
char **new_packet,
87
const char *homedir){
88
gpgme_data_t dh_crypto, dh_plain;
137
89
gpgme_ctx_t ctx;
138
} mandos_context;
139
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
sig_atomic_t quit_now = 0;
146
int signal_received = 0;
147
148
/*
149
* Make additional room in "buffer" for at least BUFFER_SIZE more
150
* bytes. "buffer_capacity" is how much is currently allocated,
151
* "buffer_length" is how much is already used.
152
*/
153
size_t incbuffer(char **buffer, size_t buffer_length,
154
size_t buffer_capacity){
155
if(buffer_length + BUFFER_SIZE > buffer_capacity){
156
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
157
if(buffer == NULL){
158
return 0;
159
}
160
buffer_capacity += BUFFER_SIZE;
161
}
162
return buffer_capacity;
163
}
164
165
/*
166
* Initialize GPGME.
167
*/
168
static bool init_gpgme(const char *seckey,
169
const char *pubkey, const char *tempdir){
170
90
gpgme_error_t rc;
91
ssize_t ret;
92
ssize_t new_packet_capacity = 0;
93
ssize_t new_packet_length = 0;
171
94
gpgme_engine_info_t engine_info;
172
173
174
/*
175
* Helper function to insert pub and seckey to the engine keyring.
176
*/
177
bool import_key(const char *filename){
178
int ret;
179
int fd;
180
gpgme_data_t pgp_data;
181
182
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
183
if(fd == -1){
184
perror("open");
185
return false;
186
}
187
188
rc = gpgme_data_new_from_fd(&pgp_data, fd);
189
if(rc != GPG_ERR_NO_ERROR){
190
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
191
gpgme_strsource(rc), gpgme_strerror(rc));
192
return false;
193
}
194
195
rc = gpgme_op_import(mc.ctx, pgp_data);
196
if(rc != GPG_ERR_NO_ERROR){
197
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
198
gpgme_strsource(rc), gpgme_strerror(rc));
199
return false;
200
}
201
202
ret = (int)TEMP_FAILURE_RETRY(close(fd));
203
if(ret == -1){
204
perror("close");
205
}
206
gpgme_data_release(pgp_data);
207
return true;
208
}
209
210
if(debug){
211
fprintf(stderr, "Initializing GPGME\n");
95
96
if (debug){
97
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
212
98
}
213
99
214
100
/* Init GPGME */
215
101
gpgme_check_version(NULL);
216
102
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
217
if(rc != GPG_ERR_NO_ERROR){
103
if (rc != GPG_ERR_NO_ERROR){
218
104
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
219
105
gpgme_strsource(rc), gpgme_strerror(rc));
220
return false;
106
return -1;
221
107
}
222
108
223
/* Set GPGME home directory for the OpenPGP engine only */
224
rc = gpgme_get_engine_info(&engine_info);
225
if(rc != GPG_ERR_NO_ERROR){
109
/* Set GPGME home directory */
110
rc = gpgme_get_engine_info (&engine_info);
111
if (rc != GPG_ERR_NO_ERROR){
226
112
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
227
113
gpgme_strsource(rc), gpgme_strerror(rc));
228
return false;
114
return -1;
229
115
}
230
116
while(engine_info != NULL){
231
117
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
232
118
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
233
engine_info->file_name, tempdir);
119
engine_info->file_name, homedir);
234
120
break;
235
121
}
236
122
engine_info = engine_info->next;
237
123
}
238
124
if(engine_info == NULL){
239
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
240
return false;
241
}
242
243
/* Create new GPGME "context" */
244
rc = gpgme_new(&(mc.ctx));
245
if(rc != GPG_ERR_NO_ERROR){
246
fprintf(stderr, "bad gpgme_new: %s: %s\n",
247
gpgme_strsource(rc), gpgme_strerror(rc));
248
return false;
249
}
250
251
if(not import_key(pubkey) or not import_key(seckey)){
252
return false;
253
}
254
255
return true;
256
}
257
258
/*
259
* Decrypt OpenPGP data.
260
* Returns -1 on error
261
*/
262
static ssize_t pgp_packet_decrypt(const char *cryptotext,
263
size_t crypto_size,
264
char **plaintext){
265
gpgme_data_t dh_crypto, dh_plain;
266
gpgme_error_t rc;
267
ssize_t ret;
268
size_t plaintext_capacity = 0;
269
ssize_t plaintext_length = 0;
270
271
if(debug){
272
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
273
}
274
275
/* Create new GPGME data buffer from memory cryptotext */
276
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
277
0);
278
if(rc != GPG_ERR_NO_ERROR){
125
fprintf(stderr, "Could not set home dir to %s\n", homedir);
126
return -1;
127
}
128
129
/* Create new GPGME data buffer from packet buffer */
130
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
131
if (rc != GPG_ERR_NO_ERROR){
279
132
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
280
133
gpgme_strsource(rc), gpgme_strerror(rc));
281
134
return -1;
283
136
284
137
/* Create new empty GPGME data buffer for the plaintext */
285
138
rc = gpgme_data_new(&dh_plain);
286
if(rc != GPG_ERR_NO_ERROR){
139
if (rc != GPG_ERR_NO_ERROR){
287
140
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
288
141
gpgme_strsource(rc), gpgme_strerror(rc));
289
gpgme_data_release(dh_crypto);
290
return -1;
291
}
292
293
/* Decrypt data from the cryptotext data buffer to the plaintext
294
data buffer */
295
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
296
if(rc != GPG_ERR_NO_ERROR){
142
return -1;
143
}
144
145
/* Create new GPGME "context" */
146
rc = gpgme_new(&ctx);
147
if (rc != GPG_ERR_NO_ERROR){
148
fprintf(stderr, "bad gpgme_new: %s: %s\n",
149
gpgme_strsource(rc), gpgme_strerror(rc));
150
return -1;
151
}
152
153
/* Decrypt data from the FILE pointer to the plaintext data
154
buffer */
155
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
156
if (rc != GPG_ERR_NO_ERROR){
297
157
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
298
158
gpgme_strsource(rc), gpgme_strerror(rc));
299
plaintext_length = -1;
300
if(debug){
301
gpgme_decrypt_result_t result;
302
result = gpgme_op_decrypt_result(mc.ctx);
303
if(result == NULL){
304
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
305
} else {
306
fprintf(stderr, "Unsupported algorithm: %s\n",
307
result->unsupported_algorithm);
308
fprintf(stderr, "Wrong key usage: %u\n",
309
result->wrong_key_usage);
310
if(result->file_name != NULL){
311
fprintf(stderr, "File name: %s\n", result->file_name);
312
}
313
gpgme_recipient_t recipient;
314
recipient = result->recipients;
159
return -1;
160
}
161
162
if(debug){
163
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
164
}
165
166
if (debug){
167
gpgme_decrypt_result_t result;
168
result = gpgme_op_decrypt_result(ctx);
169
if (result == NULL){
170
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
171
} else {
172
fprintf(stderr, "Unsupported algorithm: %s\n",
173
result->unsupported_algorithm);
174
fprintf(stderr, "Wrong key usage: %d\n",
175
result->wrong_key_usage);
176
if(result->file_name != NULL){
177
fprintf(stderr, "File name: %s\n", result->file_name);
178
}
179
gpgme_recipient_t recipient;
180
recipient = result->recipients;
181
if(recipient){
315
182
while(recipient != NULL){
316
183
fprintf(stderr, "Public key algorithm: %s\n",
317
184
gpgme_pubkey_algo_name(recipient->pubkey_algo));
323
190
}
324
191
}
325
192
}
326
goto decrypt_end;
327
193
}
328
194
329
if(debug){
330
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
331
}
195
/* Delete the GPGME FILE pointer cryptotext data buffer */
196
gpgme_data_release(dh_crypto);
332
197
333
198
/* Seek back to the beginning of the GPGME plaintext data buffer */
334
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
335
perror("gpgme_data_seek");
336
plaintext_length = -1;
337
goto decrypt_end;
199
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
200
perror("pgpme_data_seek");
338
201
}
339
202
340
*plaintext = NULL;
203
*new_packet = 0;
341
204
while(true){
342
plaintext_capacity = incbuffer(plaintext,
343
(size_t)plaintext_length,
344
plaintext_capacity);
345
if(plaintext_capacity == 0){
346
perror("incbuffer");
347
plaintext_length = -1;
348
goto decrypt_end;
205
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
206
*new_packet = realloc(*new_packet,
207
(unsigned int)new_packet_capacity
208
+ BUFFER_SIZE);
209
if (*new_packet == NULL){
210
perror("realloc");
211
return -1;
212
}
213
new_packet_capacity += BUFFER_SIZE;
349
214
}
350
215
351
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
216
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
352
217
BUFFER_SIZE);
353
218
/* Print the data, if any */
354
if(ret == 0){
355
/* EOF */
219
if (ret == 0){
356
220
break;
357
221
}
358
222
if(ret < 0){
359
223
perror("gpgme_data_read");
360
plaintext_length = -1;
361
goto decrypt_end;
362
}
363
plaintext_length += ret;
364
}
365
366
if(debug){
367
fprintf(stderr, "Decrypted password is: ");
368
for(ssize_t i = 0; i < plaintext_length; i++){
369
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
370
}
371
fprintf(stderr, "\n");
372
}
373
374
decrypt_end:
375
376
/* Delete the GPGME cryptotext data buffer */
377
gpgme_data_release(dh_crypto);
224
return -1;
225
}
226
new_packet_length += ret;
227
}
228
229
/* FIXME: check characters before printing to screen so to not print
230
terminal control characters */
231
/* if(debug){ */
232
/* fprintf(stderr, "decrypted password is: "); */
233
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
234
/* fprintf(stderr, "\n"); */
235
/* } */
378
236
379
237
/* Delete the GPGME plaintext data buffer */
380
238
gpgme_data_release(dh_plain);
381
return plaintext_length;
239
return new_packet_length;
382
240
}
383
241
384
static const char * safer_gnutls_strerror(int value){
385
const char *ret = gnutls_strerror(value); /* Spurious warning from
386
-Wunreachable-code */
387
if(ret == NULL)
242
static const char * safer_gnutls_strerror (int value) {
243
const char *ret = gnutls_strerror (value);
244
if (ret == NULL)
388
245
ret = "(unknown)";
389
246
return ret;
390
247
}
391
248
392
/* GnuTLS log function callback */
393
249
static void debuggnutls(__attribute__((unused)) int level,
394
250
const char* string){
395
fprintf(stderr, "GnuTLS: %s", string);
251
fprintf(stderr, "%s", string);
396
252
}
397
253
398
static int init_gnutls_global(const char *pubkeyfilename,
399
const char *seckeyfilename){
254
static int initgnutls(encrypted_session *es){
255
const char *err;
400
256
int ret;
401
257
402
258
if(debug){
403
259
fprintf(stderr, "Initializing GnuTLS\n");
404
260
}
405
406
ret = gnutls_global_init();
407
if(ret != GNUTLS_E_SUCCESS){
408
fprintf(stderr, "GnuTLS global_init: %s\n",
409
safer_gnutls_strerror(ret));
261
262
if ((ret = gnutls_global_init ())
263
!= GNUTLS_E_SUCCESS) {
264
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
410
265
return -1;
411
266
}
412
413
if(debug){
414
/* "Use a log level over 10 to enable all debugging options."
415
* - GnuTLS manual
416
*/
267
268
if (debug){
417
269
gnutls_global_set_log_level(11);
418
270
gnutls_global_set_log_function(debuggnutls);
419
271
}
420
272
421
/* OpenPGP credentials */
422
gnutls_certificate_allocate_credentials(&mc.cred);
423
if(ret != GNUTLS_E_SUCCESS){
424
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
425
from
426
-Wunreachable-code
427
*/
428
safer_gnutls_strerror(ret));
429
gnutls_global_deinit();
273
/* openpgp credentials */
274
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
275
!= GNUTLS_E_SUCCESS) {
276
fprintf (stderr, "memory error: %s\n",
277
safer_gnutls_strerror(ret));
430
278
return -1;
431
279
}
432
280
433
281
if(debug){
434
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
435
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
436
seckeyfilename);
282
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
283
" and keyfile %s as GnuTLS credentials\n", certfile,
284
certkey);
437
285
}
438
286
439
287
ret = gnutls_certificate_set_openpgp_key_file
440
(mc.cred, pubkeyfilename, seckeyfilename,
441
GNUTLS_OPENPGP_FMT_BASE64);
442
if(ret != GNUTLS_E_SUCCESS){
443
fprintf(stderr,
444
"Error[%d] while reading the OpenPGP key pair ('%s',"
445
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
446
fprintf(stderr, "The GnuTLS error is: %s\n",
447
safer_gnutls_strerror(ret));
448
goto globalfail;
449
}
450
451
/* GnuTLS server initialization */
452
ret = gnutls_dh_params_init(&mc.dh_params);
453
if(ret != GNUTLS_E_SUCCESS){
454
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
455
" %s\n", safer_gnutls_strerror(ret));
456
goto globalfail;
457
}
458
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
459
if(ret != GNUTLS_E_SUCCESS){
460
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
461
safer_gnutls_strerror(ret));
462
goto globalfail;
463
}
464
465
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
466
467
return 0;
468
469
globalfail:
470
471
gnutls_certificate_free_credentials(mc.cred);
472
gnutls_global_deinit();
473
gnutls_dh_params_deinit(mc.dh_params);
474
return -1;
475
}
476
477
static int init_gnutls_session(gnutls_session_t *session){
478
int ret;
479
/* GnuTLS session creation */
480
do {
481
ret = gnutls_init(session, GNUTLS_SERVER);
482
if(quit_now){
483
return -1;
484
}
485
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
486
if(ret != GNUTLS_E_SUCCESS){
288
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
289
if (ret != GNUTLS_E_SUCCESS) {
290
fprintf
291
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
292
" '%s')\n",
293
ret, certfile, certkey);
294
fprintf(stdout, "The Error is: %s\n",
295
safer_gnutls_strerror(ret));
296
return -1;
297
}
298
299
//GnuTLS server initialization
300
if ((ret = gnutls_dh_params_init (&es->dh_params))
301
!= GNUTLS_E_SUCCESS) {
302
fprintf (stderr, "Error in dh parameter initialization: %s\n",
303
safer_gnutls_strerror(ret));
304
return -1;
305
}
306
307
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
308
!= GNUTLS_E_SUCCESS) {
309
fprintf (stderr, "Error in prime generation: %s\n",
310
safer_gnutls_strerror(ret));
311
return -1;
312
}
313
314
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
315
316
// GnuTLS session creation
317
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
318
!= GNUTLS_E_SUCCESS){
487
319
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
488
320
safer_gnutls_strerror(ret));
489
321
}
490
322
491
{
492
const char *err;
493
do {
494
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
495
if(quit_now){
496
gnutls_deinit(*session);
497
return -1;
498
}
499
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
500
if(ret != GNUTLS_E_SUCCESS){
501
fprintf(stderr, "Syntax error at: %s\n", err);
502
fprintf(stderr, "GnuTLS error: %s\n",
503
safer_gnutls_strerror(ret));
504
gnutls_deinit(*session);
505
return -1;
506
}
323
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
324
!= GNUTLS_E_SUCCESS) {
325
fprintf(stderr, "Syntax error at: %s\n", err);
326
fprintf(stderr, "GnuTLS error: %s\n",
327
safer_gnutls_strerror(ret));
328
return -1;
507
329
}
508
330
509
do {
510
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
511
mc.cred);
512
if(quit_now){
513
gnutls_deinit(*session);
514
return -1;
515
}
516
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
517
if(ret != GNUTLS_E_SUCCESS){
518
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
331
if ((ret = gnutls_credentials_set
332
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
333
!= GNUTLS_E_SUCCESS) {
334
fprintf(stderr, "Error setting a credentials set: %s\n",
519
335
safer_gnutls_strerror(ret));
520
gnutls_deinit(*session);
521
336
return -1;
522
337
}
523
338
524
339
/* ignore client certificate if any. */
525
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
340
gnutls_certificate_server_set_request (es->session,
341
GNUTLS_CERT_IGNORE);
526
342
527
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
343
gnutls_dh_set_prime_bits (es->session, DH_BITS);
528
344
529
345
return 0;
530
346
}
531
347
532
/* Avahi log function callback */
533
348
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
534
349
__attribute__((unused)) const char *txt){}
535
350
536
/* Called when a Mandos server is found */
537
351
static int start_mandos_communication(const char *ip, uint16_t port,
538
AvahiIfIndex if_index,
539
int af){
540
int ret, tcp_sd = -1;
541
ssize_t sret;
542
union {
543
struct sockaddr_in in;
544
struct sockaddr_in6 in6;
545
} to;
352
AvahiIfIndex if_index){
353
int ret, tcp_sd;
354
struct sockaddr_in6 to;
355
encrypted_session es;
546
356
char *buffer = NULL;
547
char *decrypted_buffer = NULL;
357
char *decrypted_buffer;
548
358
size_t buffer_length = 0;
549
359
size_t buffer_capacity = 0;
550
size_t written;
551
int retval = -1;
552
gnutls_session_t session;
553
int pf; /* Protocol family */
554
555
if(quit_now){
556
return -1;
557
}
558
559
switch(af){
560
case AF_INET6:
561
pf = PF_INET6;
562
break;
563
case AF_INET:
564
pf = PF_INET;
565
break;
566
default:
567
fprintf(stderr, "Bad address family: %d\n", af);
568
return -1;
569
}
570
571
ret = init_gnutls_session(&session);
572
if(ret != 0){
573
return -1;
574
}
360
ssize_t decrypted_buffer_size;
361
size_t written = 0;
362
int retval = 0;
363
char interface[IF_NAMESIZE];
575
364
576
365
if(debug){
577
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
578
"\n", ip, port);
366
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
367
ip, port);
579
368
}
580
369
581
tcp_sd = socket(pf, SOCK_STREAM, 0);
582
if(tcp_sd < 0){
370
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
371
if(tcp_sd < 0) {
583
372
perror("socket");
584
goto mandos_end;
585
}
586
587
if(quit_now){
588
goto mandos_end;
589
}
590
591
memset(&to, 0, sizeof(to));
592
if(af == AF_INET6){
593
to.in6.sin6_family = (sa_family_t)af;
594
ret = inet_pton(af, ip, &to.in6.sin6_addr);
595
} else { /* IPv4 */
596
to.in.sin_family = (sa_family_t)af;
597
ret = inet_pton(af, ip, &to.in.sin_addr);
598
}
599
if(ret < 0 ){
373
return -1;
374
}
375
376
if(if_indextoname((unsigned int)if_index, interface) == NULL){
377
if(debug){
378
perror("if_indextoname");
379
}
380
return -1;
381
}
382
383
if(debug){
384
fprintf(stderr, "Binding to interface %s\n", interface);
385
}
386
387
memset(&to,0,sizeof(to)); /* Spurious warning */
388
to.sin6_family = AF_INET6;
389
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
390
if (ret < 0 ){
600
391
perror("inet_pton");
601
goto mandos_end;
602
}
392
return -1;
393
}
603
394
if(ret == 0){
604
395
fprintf(stderr, "Bad address: %s\n", ip);
605
goto mandos_end;
606
}
607
if(af == AF_INET6){
608
to.in6.sin6_port = htons(port); /* Spurious warnings from
609
-Wconversion and
610
-Wunreachable-code */
611
612
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
613
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
614
-Wunreachable-code*/
615
if(if_index == AVAHI_IF_UNSPEC){
616
fprintf(stderr, "An IPv6 link-local address is incomplete"
617
" without a network interface\n");
618
goto mandos_end;
619
}
620
/* Set the network interface number as scope */
621
to.in6.sin6_scope_id = (uint32_t)if_index;
622
}
623
} else {
624
to.in.sin_port = htons(port); /* Spurious warnings from
625
-Wconversion and
626
-Wunreachable-code */
627
}
396
return -1;
397
}
398
to.sin6_port = htons(port); /* Spurious warning */
628
399
629
if(quit_now){
630
goto mandos_end;
631
}
400
to.sin6_scope_id = (uint32_t)if_index;
632
401
633
402
if(debug){
634
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
635
char interface[IF_NAMESIZE];
636
if(if_indextoname((unsigned int)if_index, interface) == NULL){
637
perror("if_indextoname");
638
} else {
639
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
640
ip, interface, port);
641
}
642
} else {
643
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
644
port);
645
}
646
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
647
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
648
const char *pcret;
649
if(af == AF_INET6){
650
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
651
sizeof(addrstr));
652
} else {
653
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
654
sizeof(addrstr));
655
}
656
if(pcret == NULL){
657
perror("inet_ntop");
658
} else {
659
if(strcmp(addrstr, ip) != 0){
660
fprintf(stderr, "Canonical address form: %s\n", addrstr);
661
}
662
}
663
}
664
665
if(quit_now){
666
goto mandos_end;
667
}
668
669
if(af == AF_INET6){
670
ret = connect(tcp_sd, &to.in6, sizeof(to));
671
} else {
672
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
673
}
674
if(ret < 0){
403
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
404
/* char addrstr[INET6_ADDRSTRLEN]; */
405
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
406
/* sizeof(addrstr)) == NULL){ */
407
/* perror("inet_ntop"); */
408
/* } else { */
409
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
410
/* addrstr, ntohs(to.sin6_port)); */
411
/* } */
412
}
413
414
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
415
if (ret < 0){
675
416
perror("connect");
676
goto mandos_end;
677
}
678
679
if(quit_now){
680
goto mandos_end;
681
}
682
683
const char *out = mandos_protocol_version;
684
written = 0;
685
while(true){
686
size_t out_size = strlen(out);
687
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
688
out_size - written));
689
if(ret == -1){
690
perror("write");
691
goto mandos_end;
692
}
693
written += (size_t)ret;
694
if(written < out_size){
695
continue;
696
} else {
697
if(out == mandos_protocol_version){
698
written = 0;
699
out = "\r\n";
700
} else {
701
break;
702
}
703
}
704
705
if(quit_now){
706
goto mandos_end;
707
}
708
}
417
return -1;
418
}
419
420
ret = initgnutls (&es);
421
if (ret != 0){
422
retval = -1;
423
return -1;
424
}
425
426
gnutls_transport_set_ptr (es.session,
427
(gnutls_transport_ptr_t) tcp_sd);
709
428
710
429
if(debug){
711
430
fprintf(stderr, "Establishing TLS session with %s\n", ip);
712
431
}
713
432
714
if(quit_now){
715
goto mandos_end;
716
}
717
718
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
719
720
if(quit_now){
721
goto mandos_end;
722
}
723
724
do {
725
ret = gnutls_handshake(session);
726
if(quit_now){
727
goto mandos_end;
728
}
729
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
730
731
if(ret != GNUTLS_E_SUCCESS){
433
ret = gnutls_handshake (es.session);
434
435
if (ret != GNUTLS_E_SUCCESS){
732
436
if(debug){
733
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
734
gnutls_perror(ret);
437
fprintf(stderr, "\n*** Handshake failed ***\n");
438
gnutls_perror (ret);
735
439
}
736
goto mandos_end;
440
retval = -1;
441
goto exit;
737
442
}
738
443
739
/* Read OpenPGP packet that contains the wanted password */
444
//Retrieve OpenPGP packet that contains the wanted password
740
445
741
446
if(debug){
742
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
447
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
743
448
ip);
744
449
}
745
450
746
451
while(true){
747
748
if(quit_now){
749
goto mandos_end;
750
}
751
752
buffer_capacity = incbuffer(&buffer, buffer_length,
753
buffer_capacity);
754
if(buffer_capacity == 0){
755
perror("incbuffer");
756
goto mandos_end;
757
}
758
759
if(quit_now){
760
goto mandos_end;
761
}
762
763
sret = gnutls_record_recv(session, buffer+buffer_length,
764
BUFFER_SIZE);
765
if(sret == 0){
452
if (buffer_length + BUFFER_SIZE > buffer_capacity){
453
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
454
if (buffer == NULL){
455
perror("realloc");
456
goto exit;
457
}
458
buffer_capacity += BUFFER_SIZE;
459
}
460
461
ret = gnutls_record_recv
462
(es.session, buffer+buffer_length, BUFFER_SIZE);
463
if (ret == 0){
766
464
break;
767
465
}
768
if(sret < 0){
769
switch(sret){
466
if (ret < 0){
467
switch(ret){
770
468
case GNUTLS_E_INTERRUPTED:
771
469
case GNUTLS_E_AGAIN:
772
470
break;
773
471
case GNUTLS_E_REHANDSHAKE:
774
do {
775
ret = gnutls_handshake(session);
776
777
if(quit_now){
778
goto mandos_end;
779
}
780
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
781
if(ret < 0){
782
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
783
gnutls_perror(ret);
784
goto mandos_end;
472
ret = gnutls_handshake (es.session);
473
if (ret < 0){
474
fprintf(stderr, "\n*** Handshake failed ***\n");
475
gnutls_perror (ret);
476
retval = -1;
477
goto exit;
785
478
}
786
479
break;
787
480
default:
788
481
fprintf(stderr, "Unknown error while reading data from"
789
" encrypted session with Mandos server\n");
790
gnutls_bye(session, GNUTLS_SHUT_RDWR);
791
goto mandos_end;
482
" encrypted session with mandos server\n");
483
retval = -1;
484
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
485
goto exit;
792
486
}
793
487
} else {
794
buffer_length += (size_t) sret;
795
}
796
}
797
798
if(debug){
799
fprintf(stderr, "Closing TLS session\n");
800
}
801
802
if(quit_now){
803
goto mandos_end;
804
}
805
806
do {
807
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
808
if(quit_now){
809
goto mandos_end;
810
}
811
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
812
813
if(buffer_length > 0){
814
ssize_t decrypted_buffer_size;
488
buffer_length += (size_t) ret;
489
}
490
}
491
492
if (buffer_length > 0){
815
493
decrypted_buffer_size = pgp_packet_decrypt(buffer,
816
494
buffer_length,
817
&decrypted_buffer);
818
if(decrypted_buffer_size >= 0){
819
820
written = 0;
495
&decrypted_buffer,
496
certdir);
497
if (decrypted_buffer_size >= 0){
821
498
while(written < (size_t) decrypted_buffer_size){
822
if(quit_now){
823
goto mandos_end;
824
}
825
826
ret = (int)fwrite(decrypted_buffer + written, 1,
827
(size_t)decrypted_buffer_size - written,
828
stdout);
499
ret = (int)fwrite (decrypted_buffer + written, 1,
500
(size_t)decrypted_buffer_size - written,
501
stdout);
829
502
if(ret == 0 and ferror(stdout)){
830
503
if(debug){
831
504
fprintf(stderr, "Error writing encrypted data: %s\n",
832
505
strerror(errno));
833
506
}
834
goto mandos_end;
507
retval = -1;
508
break;
835
509
}
836
510
written += (size_t)ret;
837
511
}
838
retval = 0;
512
free(decrypted_buffer);
513
} else {
514
retval = -1;
839
515
}
840
516
}
841
842
/* Shutdown procedure */
843
844
mandos_end:
845
free(decrypted_buffer);
517
518
//shutdown procedure
519
520
if(debug){
521
fprintf(stderr, "Closing TLS session\n");
522
}
523
846
524
free(buffer);
847
if(tcp_sd >= 0){
848
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
849
}
850
if(ret == -1){
851
perror("close");
852
}
853
gnutls_deinit(session);
854
if(quit_now){
855
retval = -1;
856
}
525
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
526
exit:
527
close(tcp_sd);
528
gnutls_deinit (es.session);
529
gnutls_certificate_free_credentials (es.cred);
530
gnutls_global_deinit ();
857
531
return retval;
858
532
}
859
533
860
static void resolve_callback(AvahiSServiceResolver *r,
861
AvahiIfIndex interface,
862
AvahiProtocol proto,
863
AvahiResolverEvent event,
864
const char *name,
865
const char *type,
866
const char *domain,
867
const char *host_name,
868
const AvahiAddress *address,
869
uint16_t port,
870
AVAHI_GCC_UNUSED AvahiStringList *txt,
871
AVAHI_GCC_UNUSED AvahiLookupResultFlags
872
flags,
873
AVAHI_GCC_UNUSED void* userdata){
874
assert(r);
534
static AvahiSimplePoll *simple_poll = NULL;
535
static AvahiServer *server = NULL;
536
537
static void resolve_callback(
538
AvahiSServiceResolver *r,
539
AvahiIfIndex interface,
540
AVAHI_GCC_UNUSED AvahiProtocol protocol,
541
AvahiResolverEvent event,
542
const char *name,
543
const char *type,
544
const char *domain,
545
const char *host_name,
546
const AvahiAddress *address,
547
uint16_t port,
548
AVAHI_GCC_UNUSED AvahiStringList *txt,
549
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
550
AVAHI_GCC_UNUSED void* userdata) {
551
552
assert(r); /* Spurious warning */
875
553
876
554
/* Called whenever a service has been resolved successfully or
877
555
timed out */
878
556
879
if(quit_now){
880
return;
881
}
882
883
switch(event){
557
switch (event) {
884
558
default:
885
559
case AVAHI_RESOLVER_FAILURE:
886
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
887
" of type '%s' in domain '%s': %s\n", name, type, domain,
888
avahi_strerror(avahi_server_errno(mc.server)));
560
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
561
" type '%s' in domain '%s': %s\n", name, type, domain,
562
avahi_strerror(avahi_server_errno(server)));
889
563
break;
890
564
891
565
case AVAHI_RESOLVER_FOUND:
893
567
char ip[AVAHI_ADDRESS_STR_MAX];
894
568
avahi_address_snprint(ip, sizeof(ip), address);
895
569
if(debug){
896
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
897
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
898
ip, (intmax_t)interface, port);
570
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
571
" port %d\n", name, host_name, ip, port);
899
572
}
900
int ret = start_mandos_communication(ip, port, interface,
901
avahi_proto_to_af(proto));
902
if(ret == 0){
903
avahi_simple_poll_quit(mc.simple_poll);
573
int ret = start_mandos_communication(ip, port, interface);
574
if (ret == 0){
575
exit(EXIT_SUCCESS);
904
576
}
905
577
}
906
578
}
907
579
avahi_s_service_resolver_free(r);
908
580
}
909
581
910
static void browse_callback(AvahiSServiceBrowser *b,
911
AvahiIfIndex interface,
912
AvahiProtocol protocol,
913
AvahiBrowserEvent event,
914
const char *name,
915
const char *type,
916
const char *domain,
917
AVAHI_GCC_UNUSED AvahiLookupResultFlags
918
flags,
919
AVAHI_GCC_UNUSED void* userdata){
920
assert(b);
921
922
/* Called whenever a new services becomes available on the LAN or
923
is removed from the LAN */
924
925
if(quit_now){
926
return;
927
}
928
929
switch(event){
930
default:
931
case AVAHI_BROWSER_FAILURE:
932
933
fprintf(stderr, "(Avahi browser) %s\n",
934
avahi_strerror(avahi_server_errno(mc.server)));
935
avahi_simple_poll_quit(mc.simple_poll);
936
return;
937
938
case AVAHI_BROWSER_NEW:
939
/* We ignore the returned Avahi resolver object. In the callback
940
function we free it. If the Avahi server is terminated before
941
the callback function is called the Avahi server will free the
942
resolver for us. */
943
944
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
945
name, type, domain, protocol, 0,
946
resolve_callback, NULL) == NULL)
947
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
948
name, avahi_strerror(avahi_server_errno(mc.server)));
949
break;
950
951
case AVAHI_BROWSER_REMOVE:
952
break;
953
954
case AVAHI_BROWSER_ALL_FOR_NOW:
955
case AVAHI_BROWSER_CACHE_EXHAUSTED:
956
if(debug){
957
fprintf(stderr, "No Mandos server found, still searching...\n");
958
}
959
break;
960
}
961
}
962
963
/* stop main loop after sigterm has been called */
964
static void handle_sigterm(int sig){
965
if(quit_now){
966
return;
967
}
968
quit_now = 1;
969
signal_received = sig;
970
int old_errno = errno;
971
if(mc.simple_poll != NULL){
972
avahi_simple_poll_quit(mc.simple_poll);
973
}
974
errno = old_errno;
975
}
976
977
int main(int argc, char *argv[]){
978
AvahiSServiceBrowser *sb = NULL;
979
int error;
980
int ret;
981
intmax_t tmpmax;
982
char *tmp;
983
int exitcode = EXIT_SUCCESS;
984
const char *interface = "eth0";
985
struct ifreq network;
986
int sd = -1;
987
bool take_down_interface = false;
988
uid_t uid;
989
gid_t gid;
990
char *connect_to = NULL;
991
char tempdir[] = "/tmp/mandosXXXXXX";
992
bool tempdir_created = false;
993
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
994
const char *seckey = PATHDIR "/" SECKEY;
995
const char *pubkey = PATHDIR "/" PUBKEY;
996
997
bool gnutls_initialized = false;
998
bool gpgme_initialized = false;
999
float delay = 2.5f;
1000
1001
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1002
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1003
1004
uid = getuid();
1005
gid = getgid();
1006
1007
/* Lower any group privileges we might have, just to be safe */
1008
errno = 0;
1009
ret = setgid(gid);
1010
if(ret == -1){
1011
perror("setgid");
1012
}
1013
1014
/* Lower user privileges (temporarily) */
1015
errno = 0;
1016
ret = seteuid(uid);
1017
if(ret == -1){
1018
perror("seteuid");
1019
}
1020
1021
if(quit_now){
1022
goto end;
1023
}
1024
1025
{
1026
struct argp_option options[] = {
1027
{ .name = "debug", .key = 128,
1028
.doc = "Debug mode", .group = 3 },
1029
{ .name = "connect", .key = 'c',
1030
.arg = "ADDRESS:PORT",
1031
.doc = "Connect directly to a specific Mandos server",
1032
.group = 1 },
1033
{ .name = "interface", .key = 'i',
1034
.arg = "NAME",
1035
.doc = "Network interface that will be used to search for"
1036
" Mandos servers",
1037
.group = 1 },
1038
{ .name = "seckey", .key = 's',
1039
.arg = "FILE",
1040
.doc = "OpenPGP secret key file base name",
1041
.group = 1 },
1042
{ .name = "pubkey", .key = 'p',
1043
.arg = "FILE",
1044
.doc = "OpenPGP public key file base name",
1045
.group = 2 },
1046
{ .name = "dh-bits", .key = 129,
1047
.arg = "BITS",
1048
.doc = "Bit length of the prime number used in the"
1049
" Diffie-Hellman key exchange",
1050
.group = 2 },
1051
{ .name = "priority", .key = 130,
1052
.arg = "STRING",
1053
.doc = "GnuTLS priority string for the TLS handshake",
1054
.group = 1 },
1055
{ .name = "delay", .key = 131,
1056
.arg = "SECONDS",
1057
.doc = "Maximum delay to wait for interface startup",
1058
.group = 2 },
1059
{ .name = NULL }
1060
};
1061
1062
error_t parse_opt(int key, char *arg,
1063
struct argp_state *state){
1064
switch(key){
1065
case 128: /* --debug */
1066
debug = true;
1067
break;
1068
case 'c': /* --connect */
1069
connect_to = arg;
1070
break;
1071
case 'i': /* --interface */
1072
interface = arg;
1073
break;
1074
case 's': /* --seckey */
1075
seckey = arg;
1076
break;
1077
case 'p': /* --pubkey */
1078
pubkey = arg;
1079
break;
1080
case 129: /* --dh-bits */
1081
errno = 0;
1082
tmpmax = strtoimax(arg, &tmp, 10);
1083
if(errno != 0 or tmp == arg or *tmp != '\0'
1084
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1085
fprintf(stderr, "Bad number of DH bits\n");
1086
exit(EXIT_FAILURE);
1087
}
1088
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1089
break;
1090
case 130: /* --priority */
1091
mc.priority = arg;
1092
break;
1093
case 131: /* --delay */
1094
errno = 0;
1095
delay = strtof(arg, &tmp);
1096
if(errno != 0 or tmp == arg or *tmp != '\0'){
1097
fprintf(stderr, "Bad delay\n");
1098
exit(EXIT_FAILURE);
1099
}
1100
break;
1101
case ARGP_KEY_ARG:
1102
argp_usage(state);
1103
case ARGP_KEY_END:
1104
break;
1105
default:
1106
return ARGP_ERR_UNKNOWN;
1107
}
1108
return 0;
1109
}
1110
1111
struct argp argp = { .options = options, .parser = parse_opt,
1112
.args_doc = "",
1113
.doc = "Mandos client -- Get and decrypt"
1114
" passwords from a Mandos server" };
1115
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1116
if(ret == ARGP_ERR_UNKNOWN){
1117
fprintf(stderr, "Unknown error while parsing arguments\n");
1118
exitcode = EXIT_FAILURE;
1119
goto end;
1120
}
1121
}
1122
1123
if(not debug){
1124
avahi_set_log_function(empty_log);
1125
}
1126
1127
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1128
from the signal handler */
1129
/* Initialize the pseudo-RNG for Avahi */
1130
srand((unsigned int) time(NULL));
1131
mc.simple_poll = avahi_simple_poll_new();
1132
if(mc.simple_poll == NULL){
1133
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1134
exitcode = EXIT_FAILURE;
1135
goto end;
1136
}
1137
1138
sigemptyset(&sigterm_action.sa_mask);
1139
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1140
if(ret == -1){
1141
perror("sigaddset");
1142
exitcode = EXIT_FAILURE;
1143
goto end;
1144
}
1145
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1146
if(ret == -1){
1147
perror("sigaddset");
1148
exitcode = EXIT_FAILURE;
1149
goto end;
1150
}
1151
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1152
if(ret == -1){
1153
perror("sigaddset");
1154
exitcode = EXIT_FAILURE;
1155
goto end;
1156
}
1157
/* Need to check if the handler is SIG_IGN before handling:
1158
| [[info:libc:Initial Signal Actions]] |
1159
| [[info:libc:Basic Signal Handling]] |
1160
*/
1161
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1162
if(ret == -1){
1163
perror("sigaction");
1164
return EXIT_FAILURE;
1165
}
1166
if(old_sigterm_action.sa_handler != SIG_IGN){
1167
ret = sigaction(SIGINT, &sigterm_action, NULL);
1168
if(ret == -1){
1169
perror("sigaction");
1170
exitcode = EXIT_FAILURE;
1171
goto end;
1172
}
1173
}
1174
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1175
if(ret == -1){
1176
perror("sigaction");
1177
return EXIT_FAILURE;
1178
}
1179
if(old_sigterm_action.sa_handler != SIG_IGN){
1180
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1181
if(ret == -1){
1182
perror("sigaction");
1183
exitcode = EXIT_FAILURE;
1184
goto end;
1185
}
1186
}
1187
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1188
if(ret == -1){
1189
perror("sigaction");
1190
return EXIT_FAILURE;
1191
}
1192
if(old_sigterm_action.sa_handler != SIG_IGN){
1193
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1194
if(ret == -1){
1195
perror("sigaction");
1196
exitcode = EXIT_FAILURE;
1197
goto end;
1198
}
1199
}
1200
1201
/* If the interface is down, bring it up */
1202
if(interface[0] != '\0'){
1203
if_index = (AvahiIfIndex) if_nametoindex(interface);
1204
if(if_index == 0){
1205
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1206
exitcode = EXIT_FAILURE;
1207
goto end;
1208
}
1209
1210
if(quit_now){
1211
goto end;
1212
}
1213
1214
/* Re-raise priviliges */
1215
errno = 0;
1216
ret = seteuid(0);
1217
if(ret == -1){
1218
perror("seteuid");
1219
}
1220
1221
#ifdef __linux__
1222
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1223
messages to mess up the prompt */
1224
ret = klogctl(8, NULL, 5);
1225
bool restore_loglevel = true;
1226
if(ret == -1){
1227
restore_loglevel = false;
1228
perror("klogctl");
1229
}
1230
#endif /* __linux__ */
1231
1232
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1233
if(sd < 0){
1234
perror("socket");
1235
exitcode = EXIT_FAILURE;
1236
#ifdef __linux__
1237
if(restore_loglevel){
1238
ret = klogctl(7, NULL, 0);
1239
if(ret == -1){
1240
perror("klogctl");
1241
}
1242
}
1243
#endif /* __linux__ */
1244
/* Lower privileges */
1245
errno = 0;
1246
ret = seteuid(uid);
1247
if(ret == -1){
1248
perror("seteuid");
1249
}
1250
goto end;
1251
}
1252
strcpy(network.ifr_name, interface);
1253
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1254
if(ret == -1){
1255
perror("ioctl SIOCGIFFLAGS");
1256
#ifdef __linux__
1257
if(restore_loglevel){
1258
ret = klogctl(7, NULL, 0);
1259
if(ret == -1){
1260
perror("klogctl");
1261
}
1262
}
1263
#endif /* __linux__ */
1264
exitcode = EXIT_FAILURE;
1265
/* Lower privileges */
1266
errno = 0;
1267
ret = seteuid(uid);
1268
if(ret == -1){
1269
perror("seteuid");
1270
}
1271
goto end;
1272
}
1273
if((network.ifr_flags & IFF_UP) == 0){
1274
network.ifr_flags |= IFF_UP;
1275
take_down_interface = true;
1276
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1277
if(ret == -1){
1278
take_down_interface = false;
1279
perror("ioctl SIOCSIFFLAGS");
1280
exitcode = EXIT_FAILURE;
1281
#ifdef __linux__
1282
if(restore_loglevel){
1283
ret = klogctl(7, NULL, 0);
1284
if(ret == -1){
1285
perror("klogctl");
1286
}
1287
}
1288
#endif /* __linux__ */
1289
/* Lower privileges */
1290
errno = 0;
1291
ret = seteuid(uid);
1292
if(ret == -1){
1293
perror("seteuid");
1294
}
1295
goto end;
1296
}
1297
}
1298
/* sleep checking until interface is running */
1299
for(int i=0; i < delay * 4; i++){
1300
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1301
if(ret == -1){
1302
perror("ioctl SIOCGIFFLAGS");
1303
} else if(network.ifr_flags & IFF_RUNNING){
1304
break;
1305
}
1306
struct timespec sleeptime = { .tv_nsec = 250000000 };
1307
ret = nanosleep(&sleeptime, NULL);
1308
if(ret == -1 and errno != EINTR){
1309
perror("nanosleep");
1310
}
1311
}
1312
if(not take_down_interface){
1313
/* We won't need the socket anymore */
1314
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1315
if(ret == -1){
1316
perror("close");
1317
}
1318
}
1319
#ifdef __linux__
1320
if(restore_loglevel){
1321
/* Restores kernel loglevel to default */
1322
ret = klogctl(7, NULL, 0);
1323
if(ret == -1){
1324
perror("klogctl");
1325
}
1326
}
1327
#endif /* __linux__ */
1328
/* Lower privileges */
1329
errno = 0;
1330
if(take_down_interface){
1331
/* Lower privileges */
1332
ret = seteuid(uid);
1333
if(ret == -1){
1334
perror("seteuid");
1335
}
1336
} else {
1337
/* Lower privileges permanently */
1338
ret = setuid(uid);
1339
if(ret == -1){
1340
perror("setuid");
1341
}
1342
}
1343
}
1344
1345
if(quit_now){
1346
goto end;
1347
}
1348
1349
ret = init_gnutls_global(pubkey, seckey);
1350
if(ret == -1){
1351
fprintf(stderr, "init_gnutls_global failed\n");
1352
exitcode = EXIT_FAILURE;
1353
goto end;
1354
} else {
1355
gnutls_initialized = true;
1356
}
1357
1358
if(quit_now){
1359
goto end;
1360
}
1361
1362
tempdir_created = true;
1363
if(mkdtemp(tempdir) == NULL){
1364
tempdir_created = false;
1365
perror("mkdtemp");
1366
goto end;
1367
}
1368
1369
if(quit_now){
1370
goto end;
1371
}
1372
1373
if(not init_gpgme(pubkey, seckey, tempdir)){
1374
fprintf(stderr, "init_gpgme failed\n");
1375
exitcode = EXIT_FAILURE;
1376
goto end;
1377
} else {
1378
gpgme_initialized = true;
1379
}
1380
1381
if(quit_now){
1382
goto end;
1383
}
1384
1385
if(connect_to != NULL){
1386
/* Connect directly, do not use Zeroconf */
1387
/* (Mainly meant for debugging) */
1388
char *address = strrchr(connect_to, ':');
1389
if(address == NULL){
1390
fprintf(stderr, "No colon in address\n");
1391
exitcode = EXIT_FAILURE;
1392
goto end;
1393
}
1394
1395
if(quit_now){
1396
goto end;
1397
}
1398
1399
uint16_t port;
1400
errno = 0;
1401
tmpmax = strtoimax(address+1, &tmp, 10);
1402
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1403
or tmpmax != (uint16_t)tmpmax){
1404
fprintf(stderr, "Bad port number\n");
1405
exitcode = EXIT_FAILURE;
1406
goto end;
1407
}
1408
1409
if(quit_now){
1410
goto end;
1411
}
1412
1413
port = (uint16_t)tmpmax;
1414
*address = '\0';
1415
address = connect_to;
1416
/* Colon in address indicates IPv6 */
1417
int af;
1418
if(strchr(address, ':') != NULL){
1419
af = AF_INET6;
1420
} else {
1421
af = AF_INET;
1422
}
1423
1424
if(quit_now){
1425
goto end;
1426
}
1427
1428
ret = start_mandos_communication(address, port, if_index, af);
1429
if(ret < 0){
1430
exitcode = EXIT_FAILURE;
1431
} else {
1432
exitcode = EXIT_SUCCESS;
1433
}
1434
goto end;
1435
}
1436
1437
if(quit_now){
1438
goto end;
1439
}
1440
1441
{
582
static void browse_callback(
583
AvahiSServiceBrowser *b,
584
AvahiIfIndex interface,
585
AvahiProtocol protocol,
586
AvahiBrowserEvent event,
587
const char *name,
588
const char *type,
589
const char *domain,
590
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
591
void* userdata) {
592
593
AvahiServer *s = userdata;
594
assert(b); /* Spurious warning */
595
596
/* Called whenever a new services becomes available on the LAN or
597
is removed from the LAN */
598
599
switch (event) {
600
default:
601
case AVAHI_BROWSER_FAILURE:
602
603
fprintf(stderr, "(Browser) %s\n",
604
avahi_strerror(avahi_server_errno(server)));
605
avahi_simple_poll_quit(simple_poll);
606
return;
607
608
case AVAHI_BROWSER_NEW:
609
/* We ignore the returned resolver object. In the callback
610
function we free it. If the server is terminated before
611
the callback function is called the server will free
612
the resolver for us. */
613
614
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
615
type, domain,
616
AVAHI_PROTO_INET6, 0,
617
resolve_callback, s)))
618
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
619
avahi_strerror(avahi_server_errno(s)));
620
break;
621
622
case AVAHI_BROWSER_REMOVE:
623
break;
624
625
case AVAHI_BROWSER_ALL_FOR_NOW:
626
case AVAHI_BROWSER_CACHE_EXHAUSTED:
627
break;
628
}
629
}
630
631
/* Combines file name and path and returns the malloced new
632
string. some sane checks could/should be added */
633
static const char *combinepath(const char *first, const char *second){
634
size_t f_len = strlen(first);
635
size_t s_len = strlen(second);
636
char *tmp = malloc(f_len + s_len + 2);
637
if (tmp == NULL){
638
return NULL;
639
}
640
if(f_len > 0){
641
memcpy(tmp, first, f_len);
642
}
643
tmp[f_len] = '/';
644
if(s_len > 0){
645
memcpy(tmp + f_len + 1, second, s_len);
646
}
647
tmp[f_len + 1 + s_len] = '\0';
648
return tmp;
649
}
650
651
652
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1442
653
AvahiServerConfig config;
1443
/* Do not publish any local Zeroconf records */
654
AvahiSServiceBrowser *sb = NULL;
655
int error;
656
int ret;
657
int returncode = EXIT_SUCCESS;
658
const char *interface = NULL;
659
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
660
char *connect_to = NULL;
661
662
while (true){
663
static struct option long_options[] = {
664
{"debug", no_argument, (int *)&debug, 1},
665
{"connect", required_argument, 0, 'C'},
666
{"interface", required_argument, 0, 'i'},
667
{"certdir", required_argument, 0, 'd'},
668
{"certkey", required_argument, 0, 'c'},
669
{"certfile", required_argument, 0, 'k'},
670
{0, 0, 0, 0} };
671
672
int option_index = 0;
673
ret = getopt_long (argc, argv, "i:", long_options,
674
&option_index);
675
676
if (ret == -1){
677
break;
678
}
679
680
switch(ret){
681
case 0:
682
break;
683
case 'i':
684
interface = optarg;
685
break;
686
case 'C':
687
connect_to = optarg;
688
break;
689
case 'd':
690
certdir = optarg;
691
break;
692
case 'c':
693
certfile = optarg;
694
break;
695
case 'k':
696
certkey = optarg;
697
break;
698
default:
699
exit(EXIT_FAILURE);
700
}
701
}
702
703
certfile = combinepath(certdir, certfile);
704
if (certfile == NULL){
705
perror("combinepath");
706
goto exit;
707
}
708
709
if(interface != NULL){
710
if_index = (AvahiIfIndex) if_nametoindex(interface);
711
if(if_index == 0){
712
fprintf(stderr, "No such interface: \"%s\"\n", interface);
713
exit(EXIT_FAILURE);
714
}
715
}
716
717
if(connect_to != NULL){
718
/* Connect directly, do not use Zeroconf */
719
/* (Mainly meant for debugging) */
720
char *address = strrchr(connect_to, ':');
721
if(address == NULL){
722
fprintf(stderr, "No colon in address\n");
723
exit(EXIT_FAILURE);
724
}
725
errno = 0;
726
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
727
if(errno){
728
perror("Bad port number");
729
exit(EXIT_FAILURE);
730
}
731
*address = '\0';
732
address = connect_to;
733
ret = start_mandos_communication(address, port, if_index);
734
if(ret < 0){
735
exit(EXIT_FAILURE);
736
} else {
737
exit(EXIT_SUCCESS);
738
}
739
}
740
741
certkey = combinepath(certdir, certkey);
742
if (certkey == NULL){
743
perror("combinepath");
744
goto exit;
745
}
746
747
if (not debug){
748
avahi_set_log_function(empty_log);
749
}
750
751
/* Initialize the psuedo-RNG */
752
srand((unsigned int) time(NULL));
753
754
/* Allocate main loop object */
755
if (!(simple_poll = avahi_simple_poll_new())) {
756
fprintf(stderr, "Failed to create simple poll object.\n");
757
758
goto exit;
759
}
760
761
/* Do not publish any local records */
1444
762
avahi_server_config_init(&config);
1445
763
config.publish_hinfo = 0;
1446
764
config.publish_addresses = 0;
1447
765
config.publish_workstation = 0;
1448
766
config.publish_domain = 0;
1449
767
1450
768
/* Allocate a new server */
1451
mc.server = avahi_server_new(avahi_simple_poll_get
1452
(mc.simple_poll), &config, NULL,
1453
NULL, &error);
1454
1455
/* Free the Avahi configuration data */
769
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
770
&config, NULL, NULL, &error);
771
772
/* Free the configuration data */
1456
773
avahi_server_config_free(&config);
1457
}
1458
1459
/* Check if creating the Avahi server object succeeded */
1460
if(mc.server == NULL){
1461
fprintf(stderr, "Failed to create Avahi server: %s\n",
1462
avahi_strerror(error));
1463
exitcode = EXIT_FAILURE;
1464
goto end;
1465
}
1466
1467
if(quit_now){
1468
goto end;
1469
}
1470
1471
/* Create the Avahi service browser */
1472
sb = avahi_s_service_browser_new(mc.server, if_index,
1473
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1474
NULL, 0, browse_callback, NULL);
1475
if(sb == NULL){
1476
fprintf(stderr, "Failed to create service browser: %s\n",
1477
avahi_strerror(avahi_server_errno(mc.server)));
1478
exitcode = EXIT_FAILURE;
1479
goto end;
1480
}
1481
1482
if(quit_now){
1483
goto end;
1484
}
1485
1486
/* Run the main loop */
1487
1488
if(debug){
1489
fprintf(stderr, "Starting Avahi loop search\n");
1490
}
1491
1492
avahi_simple_poll_loop(mc.simple_poll);
1493
1494
end:
1495
1496
if(debug){
1497
fprintf(stderr, "%s exiting\n", argv[0]);
1498
}
1499
1500
/* Cleanup things */
1501
if(sb != NULL)
1502
avahi_s_service_browser_free(sb);
1503
1504
if(mc.server != NULL)
1505
avahi_server_free(mc.server);
1506
1507
if(mc.simple_poll != NULL)
1508
avahi_simple_poll_free(mc.simple_poll);
1509
1510
if(gnutls_initialized){
1511
gnutls_certificate_free_credentials(mc.cred);
1512
gnutls_global_deinit();
1513
gnutls_dh_params_deinit(mc.dh_params);
1514
}
1515
1516
if(gpgme_initialized){
1517
gpgme_release(mc.ctx);
1518
}
1519
1520
/* Take down the network interface */
1521
if(take_down_interface){
1522
/* Re-raise priviliges */
1523
errno = 0;
1524
ret = seteuid(0);
1525
if(ret == -1){
1526
perror("seteuid");
1527
}
1528
if(geteuid() == 0){
1529
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1530
if(ret == -1){
1531
perror("ioctl SIOCGIFFLAGS");
1532
} else if(network.ifr_flags & IFF_UP) {
1533
network.ifr_flags &= ~IFF_UP; /* clear flag */
1534
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1535
if(ret == -1){
1536
perror("ioctl SIOCSIFFLAGS");
1537
}
1538
}
1539
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1540
if(ret == -1){
1541
perror("close");
1542
}
1543
/* Lower privileges permanently */
1544
errno = 0;
1545
ret = setuid(uid);
1546
if(ret == -1){
1547
perror("setuid");
1548
}
1549
}
1550
}
1551
1552
/* Removes the temp directory used by GPGME */
1553
if(tempdir_created){
1554
DIR *d;
1555
struct dirent *direntry;
1556
d = opendir(tempdir);
1557
if(d == NULL){
1558
if(errno != ENOENT){
1559
perror("opendir");
1560
}
1561
} else {
1562
while(true){
1563
direntry = readdir(d);
1564
if(direntry == NULL){
1565
break;
1566
}
1567
/* Skip "." and ".." */
1568
if(direntry->d_name[0] == '.'
1569
and (direntry->d_name[1] == '\0'
1570
or (direntry->d_name[1] == '.'
1571
and direntry->d_name[2] == '\0'))){
1572
continue;
1573
}
1574
char *fullname = NULL;
1575
ret = asprintf(&fullname, "%s/%s", tempdir,
1576
direntry->d_name);
1577
if(ret < 0){
1578
perror("asprintf");
1579
continue;
1580
}
1581
ret = remove(fullname);
1582
if(ret == -1){
1583
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1584
strerror(errno));
1585
}
1586
free(fullname);
1587
}
1588
closedir(d);
1589
}
1590
ret = rmdir(tempdir);
1591
if(ret == -1 and errno != ENOENT){
1592
perror("rmdir");
1593
}
1594
}
1595
1596
if(quit_now){
1597
sigemptyset(&old_sigterm_action.sa_mask);
1598
old_sigterm_action.sa_handler = SIG_DFL;
1599
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1600
&old_sigterm_action,
1601
NULL));
1602
if(ret == -1){
1603
perror("sigaction");
1604
}
1605
do {
1606
ret = raise(signal_received);
1607
} while(ret != 0 and errno == EINTR);
1608
if(ret != 0){
1609
perror("raise");
1610
abort();
1611
}
1612
TEMP_FAILURE_RETRY(pause());
1613
}
1614
1615
return exitcode;
774
775
/* Check if creating the server object succeeded */
776
if (!server) {
777
fprintf(stderr, "Failed to create server: %s\n",
778
avahi_strerror(error));
779
returncode = EXIT_FAILURE;
780
goto exit;
781
}
782
783
/* Create the service browser */
784
sb = avahi_s_service_browser_new(server, if_index,
785
AVAHI_PROTO_INET6,
786
"_mandos._tcp", NULL, 0,
787
browse_callback, server);
788
if (!sb) {
789
fprintf(stderr, "Failed to create service browser: %s\n",
790
avahi_strerror(avahi_server_errno(server)));
791
returncode = EXIT_FAILURE;
792
goto exit;
793
}
794
795
/* Run the main loop */
796
797
if (debug){
798
fprintf(stderr, "Starting avahi loop search\n");
799
}
800
801
avahi_simple_poll_loop(simple_poll);
802
803
exit:
804
805
if (debug){
806
fprintf(stderr, "%s exiting\n", argv[0]);
807
}
808
809
/* Cleanup things */
810
if (sb)
811
avahi_s_service_browser_free(sb);
812
813
if (server)
814
avahi_server_free(server);
815
816
if (simple_poll)
817
avahi_simple_poll_free(simple_poll);
818
free(certfile);
819
free(certkey);
820
821
return returncode;
1616
822
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0