44
44
#include <stdint.h> /* uint16_t, uint32_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof(), abort() */
48
48
#include <stdbool.h> /* bool, false, true */
49
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
50
strerror(), asprintf(), strcpy() */
73
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
74
getuid(), getgid(), seteuid(),
76
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
77
#include <iso646.h> /* not, or, and */
78
78
#include <argp.h> /* struct argp_option, error_t, struct
125
125
static const char mandos_protocol_version[] = "1";
126
126
const char *argp_program_version = "mandos-client " VERSION;
127
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
128
static const char sys_class_net[] = "/sys/class/net";
129
char *connect_to = NULL;
131
129
/* Used for passing in values through the Avahi callback functions */
144
142
.dh_bits = 1024, .priority = "SECURE256"
145
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
147
sig_atomic_t quit_now = 0;
148
int signal_received = 0;
151
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
152
147
* bytes. "buffer_capacity" is how much is currently allocated,
481
476
/* GnuTLS session creation */
483
478
ret = gnutls_init(session, GNUTLS_SERVER);
487
479
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
488
480
if(ret != GNUTLS_E_SUCCESS){
489
481
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
496
488
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
498
gnutls_deinit(*session);
501
489
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
502
490
if(ret != GNUTLS_E_SUCCESS){
503
491
fprintf(stderr, "Syntax error at: %s\n", err);
512
500
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
515
gnutls_deinit(*session);
518
502
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
519
503
if(ret != GNUTLS_E_SUCCESS){
520
504
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
535
519
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
536
520
__attribute__((unused)) const char *txt){}
522
sig_atomic_t quit_now = 0;
523
int signal_received = 0;
538
525
/* Called when a Mandos server is found */
539
526
static int start_mandos_communication(const char *ip, uint16_t port,
540
527
AvahiIfIndex if_index,
784
779
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
785
780
gnutls_perror(ret);
790
786
fprintf(stderr, "Unknown error while reading data from"
791
787
" encrypted session with Mandos server\n");
792
789
gnutls_bye(session, GNUTLS_SHUT_RDWR);
809
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
813
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
805
gnutls_bye(session, GNUTLS_SHUT_RDWR);
815
811
if(buffer_length > 0){
816
812
ssize_t decrypted_buffer_size;
976
976
errno = old_errno;
980
* This function determines if a directory entry in /sys/class/net
981
* corresponds to an acceptable network device.
982
* (This function is passed to scandir(3) as a filter function.)
984
int good_interface(const struct dirent *if_entry){
986
char *flagname = NULL;
987
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
993
if(if_entry->d_name[0] == '.'){
996
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1001
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1002
/* read line from flags_fd */
1003
ssize_t to_read = (sizeof(ifreq_flags)*2)+3; /* "0x1003\n" */
1004
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1005
flagstring[(size_t)to_read] = '\0';
1006
if(flagstring == NULL){
1012
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1029
tmpmax = strtoimax(flagstring, &tmp, 0);
1030
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1031
and not (isspace(*tmp)))
1032
or tmpmax != (ifreq_flags)tmpmax){
1034
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1035
flagstring, if_entry->d_name);
1041
ifreq_flags flags = (ifreq_flags)tmpmax;
1042
/* Reject the loopback device */
1043
if(flags & IFF_LOOPBACK){
1045
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1050
/* Accept point-to-point devices only if connect_to is specified */
1051
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1053
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1058
/* Otherwise, reject non-broadcast-capable devices */
1059
if(not (flags & IFF_BROADCAST)){
1061
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1066
/* Accept this device */
1068
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1074
979
int main(int argc, char *argv[]){
1075
980
AvahiSServiceBrowser *sb = NULL;
1078
983
intmax_t tmpmax;
1080
985
int exitcode = EXIT_SUCCESS;
1081
const char *interface = "";
986
const char *interface = "eth0";
1082
987
struct ifreq network;
1084
989
bool take_down_interface = false;
992
char *connect_to = NULL;
1087
993
char tempdir[] = "/tmp/mandosXXXXXX";
1088
994
bool tempdir_created = false;
1089
995
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1220
1126
avahi_set_log_function(empty_log);
1223
if(interface[0] == '\0'){
1224
struct dirent **direntries;
1225
ret = scandir(sys_class_net, &direntries, good_interface,
1228
/* Pick the first good interface */
1229
interface = strdup(direntries[0]->d_name);
1231
fprintf(stderr, "Using interface \"%s\"\n", interface);
1233
if(interface == NULL){
1236
exitcode = EXIT_FAILURE;
1242
fprintf(stderr, "Could not find a network interface\n");
1243
exitcode = EXIT_FAILURE;
1248
1129
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1249
1130
from the signal handler */
1322
1203
/* If the interface is down, bring it up */
1323
if(strcmp(interface, "none") != 0){
1204
if(interface[0] != '\0'){
1324
1205
if_index = (AvahiIfIndex) if_nametoindex(interface);
1325
1206
if(if_index == 0){
1326
1207
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1654
1535
network.ifr_flags &= ~IFF_UP; /* clear flag */
1655
1536
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1657
perror("ioctl SIOCSIFFLAGS -IFF_UP");
1538
perror("ioctl SIOCSIFFLAGS");
1660
1541
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1718
1599
sigemptyset(&old_sigterm_action.sa_mask);
1719
1600
old_sigterm_action.sa_handler = SIG_DFL;
1720
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1721
&old_sigterm_action,
1601
ret = sigaction(signal_received, &old_sigterm_action, NULL);
1724
1603
perror("sigaction");
1727
ret = raise(signal_received);
1728
} while(ret != 0 and errno == EINTR);
1733
TEMP_FAILURE_RETRY(pause());
1605
raise(signal_received);
1736
1608
return exitcode;