44
44
#include <stdint.h> /* uint16_t, uint32_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof(), abort() */
48
48
#include <stdbool.h> /* bool, false, true */
49
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
50
strerror(), asprintf(), strcpy() */
73
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
74
getuid(), getgid(), seteuid(),
76
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
77
#include <iso646.h> /* not, or, and */
78
78
#include <argp.h> /* struct argp_option, error_t, struct
125
125
static const char mandos_protocol_version[] = "1";
126
126
const char *argp_program_version = "mandos-client " VERSION;
127
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
128
static const char sys_class_net[] = "/sys/class/net";
129
char *connect_to = NULL;
131
129
/* Used for passing in values through the Avahi callback functions */
144
142
.dh_bits = 1024, .priority = "SECURE256"
145
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
147
sig_atomic_t quit_now = 0;
148
int signal_received = 0;
151
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
152
147
* bytes. "buffer_capacity" is how much is currently allocated,
479
474
static int init_gnutls_session(gnutls_session_t *session){
481
476
/* GnuTLS session creation */
483
ret = gnutls_init(session, GNUTLS_SERVER);
487
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
477
ret = gnutls_init(session, GNUTLS_SERVER);
488
478
if(ret != GNUTLS_E_SUCCESS){
489
479
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
490
480
safer_gnutls_strerror(ret));
496
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
498
gnutls_deinit(*session);
501
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
485
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
502
486
if(ret != GNUTLS_E_SUCCESS){
503
487
fprintf(stderr, "Syntax error at: %s\n", err);
504
488
fprintf(stderr, "GnuTLS error: %s\n",
512
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
515
gnutls_deinit(*session);
518
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
495
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
519
497
if(ret != GNUTLS_E_SUCCESS){
520
498
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
521
499
safer_gnutls_strerror(ret));
526
504
/* ignore client certificate if any. */
527
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
505
gnutls_certificate_server_set_request(*session,
529
508
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
535
514
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
536
515
__attribute__((unused)) const char *txt){}
517
sig_atomic_t quit_now = 0;
518
int signal_received = 0;
538
520
/* Called when a Mandos server is found */
539
521
static int start_mandos_communication(const char *ip, uint16_t port,
540
522
AvahiIfIndex if_index,
784
774
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
785
775
gnutls_perror(ret);
790
781
fprintf(stderr, "Unknown error while reading data from"
791
782
" encrypted session with Mandos server\n");
792
784
gnutls_bye(session, GNUTLS_SHUT_RDWR);
809
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
813
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
800
gnutls_bye(session, GNUTLS_SHUT_RDWR);
815
806
if(buffer_length > 0){
816
807
ssize_t decrypted_buffer_size;
976
971
errno = old_errno;
980
* This function determines if a directory entry in /sys/class/net
981
* corresponds to an acceptable network device.
982
* (This function is passed to scandir(3) as a filter function.)
984
int good_interface(const struct dirent *if_entry){
986
char *flagname = NULL;
987
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
993
if(if_entry->d_name[0] == '.'){
996
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1001
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1002
/* read line from flags_fd */
1003
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1004
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1005
flagstring[(size_t)to_read] = '\0';
1006
if(flagstring == NULL){
1012
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1029
tmpmax = strtoimax(flagstring, &tmp, 0);
1030
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1031
and not (isspace(*tmp)))
1032
or tmpmax != (ifreq_flags)tmpmax){
1034
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1035
flagstring, if_entry->d_name);
1041
ifreq_flags flags = (ifreq_flags)tmpmax;
1042
/* Reject the loopback device */
1043
if(flags & IFF_LOOPBACK){
1045
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1050
/* Accept point-to-point devices only if connect_to is specified */
1051
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1053
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1058
/* Otherwise, reject non-broadcast-capable devices */
1059
if(not (flags & IFF_BROADCAST)){
1061
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1066
/* Accept this device */
1068
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1074
974
int main(int argc, char *argv[]){
1075
975
AvahiSServiceBrowser *sb = NULL;
1078
978
intmax_t tmpmax;
1080
980
int exitcode = EXIT_SUCCESS;
1081
const char *interface = "";
981
const char *interface = "eth0";
1082
982
struct ifreq network;
1084
984
bool take_down_interface = false;
987
char *connect_to = NULL;
1087
988
char tempdir[] = "/tmp/mandosXXXXXX";
1088
989
bool tempdir_created = false;
1089
990
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1094
995
bool gpgme_initialized = false;
1095
996
float delay = 2.5f;
1097
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
998
struct sigaction old_sigterm_action;
1098
999
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1103
/* Lower any group privileges we might have, just to be safe */
1110
/* Lower user privileges (temporarily) */
1122
1002
struct argp_option options[] = {
1123
1003
{ .name = "debug", .key = 128,
1220
1100
avahi_set_log_function(empty_log);
1223
if(interface[0] == '\0'){
1224
struct dirent **direntries;
1225
ret = scandir(sys_class_net, &direntries, good_interface,
1228
/* Pick the first good interface */
1229
interface = strdup(direntries[0]->d_name);
1231
fprintf(stderr, "Using interface \"%s\"\n", interface);
1233
if(interface == NULL){
1236
exitcode = EXIT_FAILURE;
1242
fprintf(stderr, "Could not find a network interface\n");
1243
exitcode = EXIT_FAILURE;
1248
1103
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1249
1104
from the signal handler */
1322
1177
/* If the interface is down, bring it up */
1323
if(strcmp(interface, "none") != 0){
1178
if(interface[0] != '\0'){
1324
1179
if_index = (AvahiIfIndex) if_nametoindex(interface);
1325
1180
if(if_index == 0){
1326
1181
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1448
1278
#endif /* __linux__ */
1449
/* Lower privileges */
1451
if(take_down_interface){
1452
/* Lower privileges */
1458
/* Lower privileges permanently */
1288
/* Drop any group privileges we might have, just to be safe */
1295
/* Drop user privileges */
1297
/* Will we need privileges later? */
1298
if(take_down_interface){
1299
/* Drop user privileges temporarily */
1305
/* Drop user privileges permanently */
1654
1500
network.ifr_flags &= ~IFF_UP; /* clear flag */
1655
1501
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1657
perror("ioctl SIOCSIFFLAGS -IFF_UP");
1503
perror("ioctl SIOCSIFFLAGS");
1660
1506
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1662
1508
perror("close");
1664
/* Lower privileges permanently */
1510
/* Lower privileges, permanently this time */
1666
1512
ret = setuid(uid);
1718
1564
sigemptyset(&old_sigterm_action.sa_mask);
1719
1565
old_sigterm_action.sa_handler = SIG_DFL;
1720
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1721
&old_sigterm_action,
1566
ret = sigaction(signal_received, &old_sigterm_action, NULL);
1724
1568
perror("sigaction");
1727
ret = raise(signal_received);
1728
} while(ret != 0 and errno == EINTR);
1733
TEMP_FAILURE_RETRY(pause());
1570
raise(signal_received);
1736
1573
return exitcode;