To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 37
- compare with another revision
- download diff
- download tarball
- view history from revision 37
- Committer: Teddy Hogeborn
- Date: 2008-08-02 21:06:12 UTC
- Revision ID: teddy@fukt.bsnet.se-20080802210612-4c1waup4z0f66ya7
Non-tested commit for merge purposes.
* plugbasedclient.c (getplugin, addargument, set_cloexec): Made static.
* plugins.d/passprompt.c (termination_handler): Made static.
* plugbasedclient.c (getplugin, addargument, set_cloexec): Made static.
* plugins.d/passprompt.c (termination_handler): Made static.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
30
29
*/
31
30
32
31
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
32
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
33
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE */
86
87
#ifdef __linux__
88
#include <sys/klog.h> /* klogctl() */
89
#endif /* __linux__ */
90
91
/* Avahi */
92
/* All Avahi types, constants and functions
93
Avahi*, avahi_*,
94
AVAHI_* */
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
95
41
#include <avahi-core/core.h>
96
42
#include <avahi-core/lookup.h>
97
43
#include <avahi-core/log.h>
99
45
#include <avahi-common/malloc.h>
100
46
#include <avahi-common/error.h>
101
47
102
/* GnuTLS */
103
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
104
functions:
105
gnutls_*
106
init_gnutls_session(),
107
GNUTLS_* */
108
#include <gnutls/openpgp.h>
109
/* gnutls_certificate_set_openpgp_key_file(),
110
GNUTLS_OPENPGP_FMT_BASE64 */
111
112
/* GPGME */
113
#include <gpgme.h> /* All GPGME types, constants and
114
functions:
115
gpgme_*
116
GPGME_PROTOCOL_OpenPGP,
117
GPG_ERR_NO_* */
48
//mandos client part
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
// getopt_long
67
#include <getopt.h>
118
68
119
69
#define BUFFER_SIZE 256
120
70
121
#define PATHDIR "/conf/conf.d/mandos"
122
#define SECKEY "seckey.txt"
123
#define PUBKEY "pubkey.txt"
71
static int dh_bits = 1024;
72
73
static const char *keydir = "/conf/conf.d/mandos";
74
static const char *pubkeyfile = "pubkey.txt";
75
static const char *seckeyfile = "seckey.txt";
124
76
125
77
bool debug = false;
126
static const char mandos_protocol_version[] = "1";
127
const char *argp_program_version = "mandos-client " VERSION;
128
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
129
78
130
/* Used for passing in values through the Avahi callback functions */
79
/* Used for */
131
80
typedef struct {
132
AvahiSimplePoll *simple_poll;
133
AvahiServer *server;
81
gnutls_session_t session;
134
82
gnutls_certificate_credentials_t cred;
135
unsigned int dh_bits;
136
83
gnutls_dh_params_t dh_params;
137
const char *priority;
84
} encrypted_session;
85
86
87
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet,
89
const char *homedir){
90
gpgme_data_t dh_crypto, dh_plain;
138
91
gpgme_ctx_t ctx;
139
} mandos_context;
140
141
/* global context so signal handler can reach it*/
142
mandos_context mc = { .simple_poll = NULL, .server = NULL,
143
.dh_bits = 1024, .priority = "SECURE256"
144
":!CTYPE-X.509:+CTYPE-OPENPGP" };
145
146
sig_atomic_t quit_now = 0;
147
int signal_received = 0;
148
149
/*
150
* Make additional room in "buffer" for at least BUFFER_SIZE more
151
* bytes. "buffer_capacity" is how much is currently allocated,
152
* "buffer_length" is how much is already used.
153
*/
154
size_t incbuffer(char **buffer, size_t buffer_length,
155
size_t buffer_capacity){
156
if(buffer_length + BUFFER_SIZE > buffer_capacity){
157
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
158
if(buffer == NULL){
159
return 0;
160
}
161
buffer_capacity += BUFFER_SIZE;
162
}
163
return buffer_capacity;
164
}
165
166
/*
167
* Initialize GPGME.
168
*/
169
static bool init_gpgme(const char *seckey,
170
const char *pubkey, const char *tempdir){
171
92
gpgme_error_t rc;
93
ssize_t ret;
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
172
96
gpgme_engine_info_t engine_info;
173
174
175
/*
176
* Helper function to insert pub and seckey to the engine keyring.
177
*/
178
bool import_key(const char *filename){
179
int ret;
180
int fd;
181
gpgme_data_t pgp_data;
182
183
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
184
if(fd == -1){
185
perror("open");
186
return false;
187
}
188
189
rc = gpgme_data_new_from_fd(&pgp_data, fd);
190
if(rc != GPG_ERR_NO_ERROR){
191
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
192
gpgme_strsource(rc), gpgme_strerror(rc));
193
return false;
194
}
195
196
rc = gpgme_op_import(mc.ctx, pgp_data);
197
if(rc != GPG_ERR_NO_ERROR){
198
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
199
gpgme_strsource(rc), gpgme_strerror(rc));
200
return false;
201
}
202
203
ret = (int)TEMP_FAILURE_RETRY(close(fd));
204
if(ret == -1){
205
perror("close");
206
}
207
gpgme_data_release(pgp_data);
208
return true;
209
}
210
211
if(debug){
212
fprintf(stderr, "Initializing GPGME\n");
97
98
if (debug){
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
213
100
}
214
101
215
102
/* Init GPGME */
216
103
gpgme_check_version(NULL);
217
104
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
218
if(rc != GPG_ERR_NO_ERROR){
105
if (rc != GPG_ERR_NO_ERROR){
219
106
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
220
107
gpgme_strsource(rc), gpgme_strerror(rc));
221
return false;
108
return -1;
222
109
}
223
110
224
/* Set GPGME home directory for the OpenPGP engine only */
225
rc = gpgme_get_engine_info(&engine_info);
226
if(rc != GPG_ERR_NO_ERROR){
111
/* Set GPGME home directory */
112
rc = gpgme_get_engine_info (&engine_info);
113
if (rc != GPG_ERR_NO_ERROR){
227
114
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
228
115
gpgme_strsource(rc), gpgme_strerror(rc));
229
return false;
116
return -1;
230
117
}
231
118
while(engine_info != NULL){
232
119
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
233
120
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
234
engine_info->file_name, tempdir);
121
engine_info->file_name, homedir);
235
122
break;
236
123
}
237
124
engine_info = engine_info->next;
238
125
}
239
126
if(engine_info == NULL){
240
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
241
return false;
242
}
243
244
/* Create new GPGME "context" */
245
rc = gpgme_new(&(mc.ctx));
246
if(rc != GPG_ERR_NO_ERROR){
247
fprintf(stderr, "bad gpgme_new: %s: %s\n",
248
gpgme_strsource(rc), gpgme_strerror(rc));
249
return false;
250
}
251
252
if(not import_key(pubkey) or not import_key(seckey)){
253
return false;
254
}
255
256
return true;
257
}
258
259
/*
260
* Decrypt OpenPGP data.
261
* Returns -1 on error
262
*/
263
static ssize_t pgp_packet_decrypt(const char *cryptotext,
264
size_t crypto_size,
265
char **plaintext){
266
gpgme_data_t dh_crypto, dh_plain;
267
gpgme_error_t rc;
268
ssize_t ret;
269
size_t plaintext_capacity = 0;
270
ssize_t plaintext_length = 0;
271
272
if(debug){
273
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
274
}
275
276
/* Create new GPGME data buffer from memory cryptotext */
277
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
278
0);
279
if(rc != GPG_ERR_NO_ERROR){
127
fprintf(stderr, "Could not set home dir to %s\n", homedir);
128
return -1;
129
}
130
131
/* Create new GPGME data buffer from packet buffer */
132
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
133
if (rc != GPG_ERR_NO_ERROR){
280
134
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
281
135
gpgme_strsource(rc), gpgme_strerror(rc));
282
136
return -1;
284
138
285
139
/* Create new empty GPGME data buffer for the plaintext */
286
140
rc = gpgme_data_new(&dh_plain);
287
if(rc != GPG_ERR_NO_ERROR){
141
if (rc != GPG_ERR_NO_ERROR){
288
142
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
289
143
gpgme_strsource(rc), gpgme_strerror(rc));
290
gpgme_data_release(dh_crypto);
291
return -1;
292
}
293
294
/* Decrypt data from the cryptotext data buffer to the plaintext
295
data buffer */
296
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
297
if(rc != GPG_ERR_NO_ERROR){
144
return -1;
145
}
146
147
/* Create new GPGME "context" */
148
rc = gpgme_new(&ctx);
149
if (rc != GPG_ERR_NO_ERROR){
150
fprintf(stderr, "bad gpgme_new: %s: %s\n",
151
gpgme_strsource(rc), gpgme_strerror(rc));
152
return -1;
153
}
154
155
/* Decrypt data from the FILE pointer to the plaintext data
156
buffer */
157
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
158
if (rc != GPG_ERR_NO_ERROR){
298
159
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
299
160
gpgme_strsource(rc), gpgme_strerror(rc));
300
plaintext_length = -1;
301
if(debug){
302
gpgme_decrypt_result_t result;
303
result = gpgme_op_decrypt_result(mc.ctx);
304
if(result == NULL){
305
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
306
} else {
307
fprintf(stderr, "Unsupported algorithm: %s\n",
308
result->unsupported_algorithm);
309
fprintf(stderr, "Wrong key usage: %u\n",
310
result->wrong_key_usage);
311
if(result->file_name != NULL){
312
fprintf(stderr, "File name: %s\n", result->file_name);
313
}
314
gpgme_recipient_t recipient;
315
recipient = result->recipients;
161
return -1;
162
}
163
164
if(debug){
165
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
166
}
167
168
if (debug){
169
gpgme_decrypt_result_t result;
170
result = gpgme_op_decrypt_result(ctx);
171
if (result == NULL){
172
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
173
} else {
174
fprintf(stderr, "Unsupported algorithm: %s\n",
175
result->unsupported_algorithm);
176
fprintf(stderr, "Wrong key usage: %d\n",
177
result->wrong_key_usage);
178
if(result->file_name != NULL){
179
fprintf(stderr, "File name: %s\n", result->file_name);
180
}
181
gpgme_recipient_t recipient;
182
recipient = result->recipients;
183
if(recipient){
316
184
while(recipient != NULL){
317
185
fprintf(stderr, "Public key algorithm: %s\n",
318
186
gpgme_pubkey_algo_name(recipient->pubkey_algo));
324
192
}
325
193
}
326
194
}
327
goto decrypt_end;
328
195
}
329
196
330
if(debug){
331
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
332
}
197
/* Delete the GPGME FILE pointer cryptotext data buffer */
198
gpgme_data_release(dh_crypto);
333
199
334
200
/* Seek back to the beginning of the GPGME plaintext data buffer */
335
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
336
perror("gpgme_data_seek");
337
plaintext_length = -1;
338
goto decrypt_end;
201
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
202
perror("pgpme_data_seek");
339
203
}
340
204
341
*plaintext = NULL;
205
*new_packet = 0;
342
206
while(true){
343
plaintext_capacity = incbuffer(plaintext,
344
(size_t)plaintext_length,
345
plaintext_capacity);
346
if(plaintext_capacity == 0){
347
perror("incbuffer");
348
plaintext_length = -1;
349
goto decrypt_end;
207
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
208
*new_packet = realloc(*new_packet,
209
(unsigned int)new_packet_capacity
210
+ BUFFER_SIZE);
211
if (*new_packet == NULL){
212
perror("realloc");
213
return -1;
214
}
215
new_packet_capacity += BUFFER_SIZE;
350
216
}
351
217
352
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
218
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
353
219
BUFFER_SIZE);
354
220
/* Print the data, if any */
355
if(ret == 0){
356
/* EOF */
221
if (ret == 0){
357
222
break;
358
223
}
359
224
if(ret < 0){
360
225
perror("gpgme_data_read");
361
plaintext_length = -1;
362
goto decrypt_end;
363
}
364
plaintext_length += ret;
365
}
366
367
if(debug){
368
fprintf(stderr, "Decrypted password is: ");
369
for(ssize_t i = 0; i < plaintext_length; i++){
370
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
371
}
372
fprintf(stderr, "\n");
373
}
374
375
decrypt_end:
376
377
/* Delete the GPGME cryptotext data buffer */
378
gpgme_data_release(dh_crypto);
226
return -1;
227
}
228
new_packet_length += ret;
229
}
230
231
/* FIXME: check characters before printing to screen so to not print
232
terminal control characters */
233
/* if(debug){ */
234
/* fprintf(stderr, "decrypted password is: "); */
235
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
236
/* fprintf(stderr, "\n"); */
237
/* } */
379
238
380
239
/* Delete the GPGME plaintext data buffer */
381
240
gpgme_data_release(dh_plain);
382
return plaintext_length;
241
return new_packet_length;
383
242
}
384
243
385
static const char * safer_gnutls_strerror(int value){
386
const char *ret = gnutls_strerror(value); /* Spurious warning from
387
-Wunreachable-code */
388
if(ret == NULL)
244
static const char * safer_gnutls_strerror (int value) {
245
const char *ret = gnutls_strerror (value);
246
if (ret == NULL)
389
247
ret = "(unknown)";
390
248
return ret;
391
249
}
392
250
393
/* GnuTLS log function callback */
394
251
static void debuggnutls(__attribute__((unused)) int level,
395
252
const char* string){
396
fprintf(stderr, "GnuTLS: %s", string);
253
fprintf(stderr, "%s", string);
397
254
}
398
255
399
static int init_gnutls_global(const char *pubkeyfilename,
400
const char *seckeyfilename){
256
static int initgnutls(encrypted_session *es){
257
const char *err;
401
258
int ret;
402
259
403
260
if(debug){
404
261
fprintf(stderr, "Initializing GnuTLS\n");
405
262
}
406
407
ret = gnutls_global_init();
408
if(ret != GNUTLS_E_SUCCESS){
409
fprintf(stderr, "GnuTLS global_init: %s\n",
410
safer_gnutls_strerror(ret));
263
264
if ((ret = gnutls_global_init ())
265
!= GNUTLS_E_SUCCESS) {
266
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
411
267
return -1;
412
268
}
413
414
if(debug){
415
/* "Use a log level over 10 to enable all debugging options."
416
* - GnuTLS manual
417
*/
269
270
if (debug){
418
271
gnutls_global_set_log_level(11);
419
272
gnutls_global_set_log_function(debuggnutls);
420
273
}
421
274
422
/* OpenPGP credentials */
423
gnutls_certificate_allocate_credentials(&mc.cred);
424
if(ret != GNUTLS_E_SUCCESS){
425
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
426
from
427
-Wunreachable-code
428
*/
429
safer_gnutls_strerror(ret));
430
gnutls_global_deinit();
275
/* openpgp credentials */
276
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
277
!= GNUTLS_E_SUCCESS) {
278
fprintf (stderr, "memory error: %s\n",
279
safer_gnutls_strerror(ret));
431
280
return -1;
432
281
}
433
282
434
283
if(debug){
435
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
436
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
437
seckeyfilename);
284
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
285
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
286
seckeyfile);
438
287
}
439
288
440
289
ret = gnutls_certificate_set_openpgp_key_file
441
(mc.cred, pubkeyfilename, seckeyfilename,
442
GNUTLS_OPENPGP_FMT_BASE64);
443
if(ret != GNUTLS_E_SUCCESS){
444
fprintf(stderr,
445
"Error[%d] while reading the OpenPGP key pair ('%s',"
446
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
447
fprintf(stderr, "The GnuTLS error is: %s\n",
448
safer_gnutls_strerror(ret));
449
goto globalfail;
450
}
451
452
/* GnuTLS server initialization */
453
ret = gnutls_dh_params_init(&mc.dh_params);
454
if(ret != GNUTLS_E_SUCCESS){
455
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
456
" %s\n", safer_gnutls_strerror(ret));
457
goto globalfail;
458
}
459
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
460
if(ret != GNUTLS_E_SUCCESS){
461
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
462
safer_gnutls_strerror(ret));
463
goto globalfail;
464
}
465
466
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
467
468
return 0;
469
470
globalfail:
471
472
gnutls_certificate_free_credentials(mc.cred);
473
gnutls_global_deinit();
474
gnutls_dh_params_deinit(mc.dh_params);
475
return -1;
476
}
477
478
static int init_gnutls_session(gnutls_session_t *session){
479
int ret;
480
/* GnuTLS session creation */
481
do {
482
ret = gnutls_init(session, GNUTLS_SERVER);
483
if(quit_now){
484
return -1;
485
}
486
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
487
if(ret != GNUTLS_E_SUCCESS){
290
(es->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
291
if (ret != GNUTLS_E_SUCCESS) {
292
fprintf
293
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
294
" '%s')\n",
295
ret, pubkeyfile, seckeyfile);
296
fprintf(stdout, "The Error is: %s\n",
297
safer_gnutls_strerror(ret));
298
return -1;
299
}
300
301
//GnuTLS server initialization
302
if ((ret = gnutls_dh_params_init (&es->dh_params))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in dh parameter initialization: %s\n",
305
safer_gnutls_strerror(ret));
306
return -1;
307
}
308
309
if ((ret = gnutls_dh_params_generate2 (es->dh_params, dh_bits))
310
!= GNUTLS_E_SUCCESS) {
311
fprintf (stderr, "Error in prime generation: %s\n",
312
safer_gnutls_strerror(ret));
313
return -1;
314
}
315
316
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
317
318
// GnuTLS session creation
319
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
320
!= GNUTLS_E_SUCCESS){
488
321
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
489
322
safer_gnutls_strerror(ret));
490
323
}
491
324
492
{
493
const char *err;
494
do {
495
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
496
if(quit_now){
497
gnutls_deinit(*session);
498
return -1;
499
}
500
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
501
if(ret != GNUTLS_E_SUCCESS){
502
fprintf(stderr, "Syntax error at: %s\n", err);
503
fprintf(stderr, "GnuTLS error: %s\n",
504
safer_gnutls_strerror(ret));
505
gnutls_deinit(*session);
506
return -1;
507
}
325
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
326
!= GNUTLS_E_SUCCESS) {
327
fprintf(stderr, "Syntax error at: %s\n", err);
328
fprintf(stderr, "GnuTLS error: %s\n",
329
safer_gnutls_strerror(ret));
330
return -1;
508
331
}
509
332
510
do {
511
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
512
mc.cred);
513
if(quit_now){
514
gnutls_deinit(*session);
515
return -1;
516
}
517
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
518
if(ret != GNUTLS_E_SUCCESS){
519
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
333
if ((ret = gnutls_credentials_set
334
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
335
!= GNUTLS_E_SUCCESS) {
336
fprintf(stderr, "Error setting a credentials set: %s\n",
520
337
safer_gnutls_strerror(ret));
521
gnutls_deinit(*session);
522
338
return -1;
523
339
}
524
340
525
341
/* ignore client certificate if any. */
526
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
342
gnutls_certificate_server_set_request (es->session,
343
GNUTLS_CERT_IGNORE);
527
344
528
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
345
gnutls_dh_set_prime_bits (es->session, dh_bits);
529
346
530
347
return 0;
531
348
}
532
349
533
/* Avahi log function callback */
534
350
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
535
351
__attribute__((unused)) const char *txt){}
536
352
537
/* Called when a Mandos server is found */
538
353
static int start_mandos_communication(const char *ip, uint16_t port,
539
AvahiIfIndex if_index,
540
int af){
541
int ret, tcp_sd = -1;
542
ssize_t sret;
543
union {
544
struct sockaddr_in in;
545
struct sockaddr_in6 in6;
546
} to;
354
AvahiIfIndex if_index){
355
int ret, tcp_sd;
356
struct sockaddr_in6 to;
357
encrypted_session es;
547
358
char *buffer = NULL;
548
char *decrypted_buffer = NULL;
359
char *decrypted_buffer;
549
360
size_t buffer_length = 0;
550
361
size_t buffer_capacity = 0;
551
size_t written;
552
int retval = -1;
553
gnutls_session_t session;
554
int pf; /* Protocol family */
555
556
if(quit_now){
557
return -1;
558
}
559
560
switch(af){
561
case AF_INET6:
562
pf = PF_INET6;
563
break;
564
case AF_INET:
565
pf = PF_INET;
566
break;
567
default:
568
fprintf(stderr, "Bad address family: %d\n", af);
569
return -1;
570
}
571
572
ret = init_gnutls_session(&session);
573
if(ret != 0){
574
return -1;
575
}
362
ssize_t decrypted_buffer_size;
363
size_t written = 0;
364
int retval = 0;
365
char interface[IF_NAMESIZE];
576
366
577
367
if(debug){
578
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
579
"\n", ip, port);
368
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
369
ip, port);
580
370
}
581
371
582
tcp_sd = socket(pf, SOCK_STREAM, 0);
583
if(tcp_sd < 0){
372
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
373
if(tcp_sd < 0) {
584
374
perror("socket");
585
goto mandos_end;
586
}
587
588
if(quit_now){
589
goto mandos_end;
590
}
591
592
memset(&to, 0, sizeof(to));
593
if(af == AF_INET6){
594
to.in6.sin6_family = (sa_family_t)af;
595
ret = inet_pton(af, ip, &to.in6.sin6_addr);
596
} else { /* IPv4 */
597
to.in.sin_family = (sa_family_t)af;
598
ret = inet_pton(af, ip, &to.in.sin_addr);
599
}
600
if(ret < 0 ){
375
return -1;
376
}
377
378
if(if_indextoname((unsigned int)if_index, interface) == NULL){
379
if(debug){
380
perror("if_indextoname");
381
}
382
return -1;
383
}
384
385
if(debug){
386
fprintf(stderr, "Binding to interface %s\n", interface);
387
}
388
389
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
392
if (ret < 0 ){
601
393
perror("inet_pton");
602
goto mandos_end;
603
}
394
return -1;
395
}
604
396
if(ret == 0){
605
397
fprintf(stderr, "Bad address: %s\n", ip);
606
goto mandos_end;
607
}
608
if(af == AF_INET6){
609
to.in6.sin6_port = htons(port); /* Spurious warnings from
610
-Wconversion and
611
-Wunreachable-code */
612
613
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
614
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
615
-Wunreachable-code*/
616
if(if_index == AVAHI_IF_UNSPEC){
617
fprintf(stderr, "An IPv6 link-local address is incomplete"
618
" without a network interface\n");
619
goto mandos_end;
620
}
621
/* Set the network interface number as scope */
622
to.in6.sin6_scope_id = (uint32_t)if_index;
623
}
624
} else {
625
to.in.sin_port = htons(port); /* Spurious warnings from
626
-Wconversion and
627
-Wunreachable-code */
628
}
398
return -1;
399
}
400
to.sin6_port = htons(port); /* Spurious warning */
629
401
630
if(quit_now){
631
goto mandos_end;
632
}
402
to.sin6_scope_id = (uint32_t)if_index;
633
403
634
404
if(debug){
635
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
636
char interface[IF_NAMESIZE];
637
if(if_indextoname((unsigned int)if_index, interface) == NULL){
638
perror("if_indextoname");
639
} else {
640
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
641
ip, interface, port);
642
}
643
} else {
644
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
645
port);
646
}
647
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
648
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
649
const char *pcret;
650
if(af == AF_INET6){
651
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
652
sizeof(addrstr));
653
} else {
654
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
655
sizeof(addrstr));
656
}
657
if(pcret == NULL){
405
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
406
char addrstr[INET6_ADDRSTRLEN] = "";
407
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
408
sizeof(addrstr)) == NULL){
658
409
perror("inet_ntop");
659
410
} else {
660
411
if(strcmp(addrstr, ip) != 0){
661
fprintf(stderr, "Canonical address form: %s\n", addrstr);
412
fprintf(stderr, "Canonical address form: %s\n",
413
addrstr, ntohs(to.sin6_port));
662
414
}
663
415
}
664
416
}
665
417
666
if(quit_now){
667
goto mandos_end;
668
}
669
670
if(af == AF_INET6){
671
ret = connect(tcp_sd, &to.in6, sizeof(to));
672
} else {
673
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
674
}
675
if(ret < 0){
418
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
419
if (ret < 0){
676
420
perror("connect");
677
goto mandos_end;
678
}
679
680
if(quit_now){
681
goto mandos_end;
682
}
683
684
const char *out = mandos_protocol_version;
685
written = 0;
686
while(true){
687
size_t out_size = strlen(out);
688
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
689
out_size - written));
690
if(ret == -1){
691
perror("write");
692
goto mandos_end;
693
}
694
written += (size_t)ret;
695
if(written < out_size){
696
continue;
697
} else {
698
if(out == mandos_protocol_version){
699
written = 0;
700
out = "\r\n";
701
} else {
702
break;
703
}
704
}
705
706
if(quit_now){
707
goto mandos_end;
708
}
709
}
421
return -1;
422
}
423
424
ret = initgnutls (&es);
425
if (ret != 0){
426
retval = -1;
427
return -1;
428
}
429
430
gnutls_transport_set_ptr (es.session,
431
(gnutls_transport_ptr_t) tcp_sd);
710
432
711
433
if(debug){
712
434
fprintf(stderr, "Establishing TLS session with %s\n", ip);
713
435
}
714
436
715
if(quit_now){
716
goto mandos_end;
717
}
718
719
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
720
721
if(quit_now){
722
goto mandos_end;
723
}
724
725
do {
726
ret = gnutls_handshake(session);
727
if(quit_now){
728
goto mandos_end;
729
}
730
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
731
732
if(ret != GNUTLS_E_SUCCESS){
437
ret = gnutls_handshake (es.session);
438
439
if (ret != GNUTLS_E_SUCCESS){
733
440
if(debug){
734
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
735
gnutls_perror(ret);
441
fprintf(stderr, "\n*** Handshake failed ***\n");
442
gnutls_perror (ret);
736
443
}
737
goto mandos_end;
444
retval = -1;
445
goto exit;
738
446
}
739
447
740
/* Read OpenPGP packet that contains the wanted password */
448
//Retrieve OpenPGP packet that contains the wanted password
741
449
742
450
if(debug){
743
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
451
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
744
452
ip);
745
453
}
746
454
747
455
while(true){
748
749
if(quit_now){
750
goto mandos_end;
751
}
752
753
buffer_capacity = incbuffer(&buffer, buffer_length,
754
buffer_capacity);
755
if(buffer_capacity == 0){
756
perror("incbuffer");
757
goto mandos_end;
758
}
759
760
if(quit_now){
761
goto mandos_end;
762
}
763
764
sret = gnutls_record_recv(session, buffer+buffer_length,
765
BUFFER_SIZE);
766
if(sret == 0){
456
if (buffer_length + BUFFER_SIZE > buffer_capacity){
457
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
458
if (buffer == NULL){
459
perror("realloc");
460
goto exit;
461
}
462
buffer_capacity += BUFFER_SIZE;
463
}
464
465
ret = gnutls_record_recv
466
(es.session, buffer+buffer_length, BUFFER_SIZE);
467
if (ret == 0){
767
468
break;
768
469
}
769
if(sret < 0){
770
switch(sret){
470
if (ret < 0){
471
switch(ret){
771
472
case GNUTLS_E_INTERRUPTED:
772
473
case GNUTLS_E_AGAIN:
773
474
break;
774
475
case GNUTLS_E_REHANDSHAKE:
775
do {
776
ret = gnutls_handshake(session);
777
778
if(quit_now){
779
goto mandos_end;
780
}
781
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
782
if(ret < 0){
783
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
784
gnutls_perror(ret);
785
goto mandos_end;
476
ret = gnutls_handshake (es.session);
477
if (ret < 0){
478
fprintf(stderr, "\n*** Handshake failed ***\n");
479
gnutls_perror (ret);
480
retval = -1;
481
goto exit;
786
482
}
787
483
break;
788
484
default:
789
485
fprintf(stderr, "Unknown error while reading data from"
790
" encrypted session with Mandos server\n");
791
gnutls_bye(session, GNUTLS_SHUT_RDWR);
792
goto mandos_end;
486
" encrypted session with mandos server\n");
487
retval = -1;
488
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
489
goto exit;
793
490
}
794
491
} else {
795
buffer_length += (size_t) sret;
796
}
797
}
798
799
if(debug){
800
fprintf(stderr, "Closing TLS session\n");
801
}
802
803
if(quit_now){
804
goto mandos_end;
805
}
806
807
do {
808
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
809
if(quit_now){
810
goto mandos_end;
811
}
812
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
813
814
if(buffer_length > 0){
815
ssize_t decrypted_buffer_size;
492
buffer_length += (size_t) ret;
493
}
494
}
495
496
if (buffer_length > 0){
816
497
decrypted_buffer_size = pgp_packet_decrypt(buffer,
817
498
buffer_length,
818
&decrypted_buffer);
819
if(decrypted_buffer_size >= 0){
820
821
written = 0;
499
&decrypted_buffer,
500
keydir);
501
if (decrypted_buffer_size >= 0){
822
502
while(written < (size_t) decrypted_buffer_size){
823
if(quit_now){
824
goto mandos_end;
825
}
826
827
ret = (int)fwrite(decrypted_buffer + written, 1,
828
(size_t)decrypted_buffer_size - written,
829
stdout);
503
ret = (int)fwrite (decrypted_buffer + written, 1,
504
(size_t)decrypted_buffer_size - written,
505
stdout);
830
506
if(ret == 0 and ferror(stdout)){
831
507
if(debug){
832
508
fprintf(stderr, "Error writing encrypted data: %s\n",
833
509
strerror(errno));
834
510
}
835
goto mandos_end;
511
retval = -1;
512
break;
836
513
}
837
514
written += (size_t)ret;
838
515
}
839
retval = 0;
516
free(decrypted_buffer);
517
} else {
518
retval = -1;
840
519
}
841
520
}
842
843
/* Shutdown procedure */
844
845
mandos_end:
846
free(decrypted_buffer);
521
522
//shutdown procedure
523
524
if(debug){
525
fprintf(stderr, "Closing TLS session\n");
526
}
527
847
528
free(buffer);
848
if(tcp_sd >= 0){
849
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
850
}
851
if(ret == -1){
852
perror("close");
853
}
854
gnutls_deinit(session);
855
if(quit_now){
856
retval = -1;
857
}
529
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
530
exit:
531
close(tcp_sd);
532
gnutls_deinit (es.session);
533
gnutls_certificate_free_credentials (es.cred);
534
gnutls_global_deinit ();
858
535
return retval;
859
536
}
860
537
861
static void resolve_callback(AvahiSServiceResolver *r,
862
AvahiIfIndex interface,
863
AvahiProtocol proto,
864
AvahiResolverEvent event,
865
const char *name,
866
const char *type,
867
const char *domain,
868
const char *host_name,
869
const AvahiAddress *address,
870
uint16_t port,
871
AVAHI_GCC_UNUSED AvahiStringList *txt,
872
AVAHI_GCC_UNUSED AvahiLookupResultFlags
873
flags,
874
AVAHI_GCC_UNUSED void* userdata){
875
assert(r);
538
static AvahiSimplePoll *simple_poll = NULL;
539
static AvahiServer *server = NULL;
540
541
static void resolve_callback(
542
AvahiSServiceResolver *r,
543
AvahiIfIndex interface,
544
AVAHI_GCC_UNUSED AvahiProtocol protocol,
545
AvahiResolverEvent event,
546
const char *name,
547
const char *type,
548
const char *domain,
549
const char *host_name,
550
const AvahiAddress *address,
551
uint16_t port,
552
AVAHI_GCC_UNUSED AvahiStringList *txt,
553
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
554
AVAHI_GCC_UNUSED void* userdata) {
555
556
assert(r); /* Spurious warning */
876
557
877
558
/* Called whenever a service has been resolved successfully or
878
559
timed out */
879
560
880
if(quit_now){
881
return;
882
}
883
884
switch(event){
561
switch (event) {
885
562
default:
886
563
case AVAHI_RESOLVER_FAILURE:
887
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
888
" of type '%s' in domain '%s': %s\n", name, type, domain,
889
avahi_strerror(avahi_server_errno(mc.server)));
564
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
565
" type '%s' in domain '%s': %s\n", name, type, domain,
566
avahi_strerror(avahi_server_errno(server)));
890
567
break;
891
568
892
569
case AVAHI_RESOLVER_FOUND:
894
571
char ip[AVAHI_ADDRESS_STR_MAX];
895
572
avahi_address_snprint(ip, sizeof(ip), address);
896
573
if(debug){
897
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
898
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
899
ip, (intmax_t)interface, port);
574
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
575
" port %d\n", name, host_name, ip, port);
900
576
}
901
int ret = start_mandos_communication(ip, port, interface,
902
avahi_proto_to_af(proto));
903
if(ret == 0){
904
avahi_simple_poll_quit(mc.simple_poll);
577
int ret = start_mandos_communication(ip, port, interface);
578
if (ret == 0){
579
exit(EXIT_SUCCESS);
905
580
}
906
581
}
907
582
}
908
583
avahi_s_service_resolver_free(r);
909
584
}
910
585
911
static void browse_callback(AvahiSServiceBrowser *b,
912
AvahiIfIndex interface,
913
AvahiProtocol protocol,
914
AvahiBrowserEvent event,
915
const char *name,
916
const char *type,
917
const char *domain,
918
AVAHI_GCC_UNUSED AvahiLookupResultFlags
919
flags,
920
AVAHI_GCC_UNUSED void* userdata){
921
assert(b);
922
923
/* Called whenever a new services becomes available on the LAN or
924
is removed from the LAN */
925
926
if(quit_now){
927
return;
928
}
929
930
switch(event){
931
default:
932
case AVAHI_BROWSER_FAILURE:
933
934
fprintf(stderr, "(Avahi browser) %s\n",
935
avahi_strerror(avahi_server_errno(mc.server)));
936
avahi_simple_poll_quit(mc.simple_poll);
937
return;
938
939
case AVAHI_BROWSER_NEW:
940
/* We ignore the returned Avahi resolver object. In the callback
941
function we free it. If the Avahi server is terminated before
942
the callback function is called the Avahi server will free the
943
resolver for us. */
944
945
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
946
name, type, domain, protocol, 0,
947
resolve_callback, NULL) == NULL)
948
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
949
name, avahi_strerror(avahi_server_errno(mc.server)));
950
break;
951
952
case AVAHI_BROWSER_REMOVE:
953
break;
954
955
case AVAHI_BROWSER_ALL_FOR_NOW:
956
case AVAHI_BROWSER_CACHE_EXHAUSTED:
957
if(debug){
958
fprintf(stderr, "No Mandos server found, still searching...\n");
959
}
960
break;
961
}
962
}
963
964
/* stop main loop after sigterm has been called */
965
static void handle_sigterm(int sig){
966
if(quit_now){
967
return;
968
}
969
quit_now = 1;
970
signal_received = sig;
971
int old_errno = errno;
972
if(mc.simple_poll != NULL){
973
avahi_simple_poll_quit(mc.simple_poll);
974
}
975
errno = old_errno;
976
}
977
978
int main(int argc, char *argv[]){
979
AvahiSServiceBrowser *sb = NULL;
980
int error;
981
int ret;
982
intmax_t tmpmax;
983
char *tmp;
984
int exitcode = EXIT_SUCCESS;
985
const char *interface = "eth0";
986
struct ifreq network;
987
int sd = -1;
988
bool take_down_interface = false;
989
uid_t uid;
990
gid_t gid;
991
char *connect_to = NULL;
992
char tempdir[] = "/tmp/mandosXXXXXX";
993
bool tempdir_created = false;
994
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
995
const char *seckey = PATHDIR "/" SECKEY;
996
const char *pubkey = PATHDIR "/" PUBKEY;
997
998
bool gnutls_initialized = false;
999
bool gpgme_initialized = false;
1000
float delay = 2.5f;
1001
1002
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1003
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1004
1005
uid = getuid();
1006
gid = getgid();
1007
1008
/* Lower any group privileges we might have, just to be safe */
1009
errno = 0;
1010
ret = setgid(gid);
1011
if(ret == -1){
1012
perror("setgid");
1013
}
1014
1015
/* Lower user privileges (temporarily) */
1016
errno = 0;
1017
ret = seteuid(uid);
1018
if(ret == -1){
1019
perror("seteuid");
1020
}
1021
1022
if(quit_now){
1023
goto end;
1024
}
1025
1026
{
1027
struct argp_option options[] = {
1028
{ .name = "debug", .key = 128,
1029
.doc = "Debug mode", .group = 3 },
1030
{ .name = "connect", .key = 'c',
1031
.arg = "ADDRESS:PORT",
1032
.doc = "Connect directly to a specific Mandos server",
1033
.group = 1 },
1034
{ .name = "interface", .key = 'i',
1035
.arg = "NAME",
1036
.doc = "Network interface that will be used to search for"
1037
" Mandos servers",
1038
.group = 1 },
1039
{ .name = "seckey", .key = 's',
1040
.arg = "FILE",
1041
.doc = "OpenPGP secret key file base name",
1042
.group = 1 },
1043
{ .name = "pubkey", .key = 'p',
1044
.arg = "FILE",
1045
.doc = "OpenPGP public key file base name",
1046
.group = 2 },
1047
{ .name = "dh-bits", .key = 129,
1048
.arg = "BITS",
1049
.doc = "Bit length of the prime number used in the"
1050
" Diffie-Hellman key exchange",
1051
.group = 2 },
1052
{ .name = "priority", .key = 130,
1053
.arg = "STRING",
1054
.doc = "GnuTLS priority string for the TLS handshake",
1055
.group = 1 },
1056
{ .name = "delay", .key = 131,
1057
.arg = "SECONDS",
1058
.doc = "Maximum delay to wait for interface startup",
1059
.group = 2 },
1060
/*
1061
* These reproduce what we would get without ARGP_NO_HELP
1062
*/
1063
{ .name = "help", .key = '?',
1064
.doc = "Give this help list", .group = -1 },
1065
{ .name = "usage", .key = -3,
1066
.doc = "Give a short usage message", .group = -1 },
1067
{ .name = "version", .key = 'V',
1068
.doc = "Print program version", .group = -1 },
1069
{ .name = NULL }
1070
};
1071
1072
error_t parse_opt(int key, char *arg,
1073
struct argp_state *state){
1074
errno = 0;
1075
switch(key){
1076
case 128: /* --debug */
1077
debug = true;
1078
break;
1079
case 'c': /* --connect */
1080
connect_to = arg;
1081
break;
1082
case 'i': /* --interface */
1083
interface = arg;
1084
break;
1085
case 's': /* --seckey */
1086
seckey = arg;
1087
break;
1088
case 'p': /* --pubkey */
1089
pubkey = arg;
1090
break;
1091
case 129: /* --dh-bits */
1092
errno = 0;
1093
tmpmax = strtoimax(arg, &tmp, 10);
1094
if(errno != 0 or tmp == arg or *tmp != '\0'
1095
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1096
argp_error(state, "Bad number of DH bits");
1097
}
1098
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1099
break;
1100
case 130: /* --priority */
1101
mc.priority = arg;
1102
break;
1103
case 131: /* --delay */
1104
errno = 0;
1105
delay = strtof(arg, &tmp);
1106
if(errno != 0 or tmp == arg or *tmp != '\0'){
1107
argp_error(state, "Bad delay");
1108
}
1109
break;
1110
/*
1111
* These reproduce what we would get without ARGP_NO_HELP
1112
*/
1113
case '?': /* --help */
1114
argp_state_help(state, state->out_stream,
1115
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1116
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1117
case -3: /* --usage */
1118
argp_state_help(state, state->out_stream,
1119
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1120
case 'V': /* --version */
1121
fprintf(state->out_stream, "%s\n", argp_program_version);
1122
exit(argp_err_exit_status);
1123
break;
1124
default:
1125
return ARGP_ERR_UNKNOWN;
1126
}
1127
return errno;
1128
}
1129
1130
struct argp argp = { .options = options, .parser = parse_opt,
1131
.args_doc = "",
1132
.doc = "Mandos client -- Get and decrypt"
1133
" passwords from a Mandos server" };
1134
ret = argp_parse(&argp, argc, argv,
1135
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1136
switch(ret){
1137
case 0:
1138
break;
1139
case ENOMEM:
586
static void browse_callback(
587
AvahiSServiceBrowser *b,
588
AvahiIfIndex interface,
589
AvahiProtocol protocol,
590
AvahiBrowserEvent event,
591
const char *name,
592
const char *type,
593
const char *domain,
594
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
595
void* userdata) {
596
597
AvahiServer *s = userdata;
598
assert(b); /* Spurious warning */
599
600
/* Called whenever a new services becomes available on the LAN or
601
is removed from the LAN */
602
603
switch (event) {
1140
604
default:
1141
errno = ret;
1142
perror("argp_parse");
1143
exitcode = EX_OSERR;
1144
goto end;
1145
case EINVAL:
1146
exitcode = EX_USAGE;
1147
goto end;
1148
}
1149
}
1150
1151
if(not debug){
1152
avahi_set_log_function(empty_log);
1153
}
1154
1155
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1156
from the signal handler */
1157
/* Initialize the pseudo-RNG for Avahi */
1158
srand((unsigned int) time(NULL));
1159
mc.simple_poll = avahi_simple_poll_new();
1160
if(mc.simple_poll == NULL){
1161
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1162
exitcode = EXIT_FAILURE;
1163
goto end;
1164
}
1165
1166
sigemptyset(&sigterm_action.sa_mask);
1167
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1168
if(ret == -1){
1169
perror("sigaddset");
1170
exitcode = EXIT_FAILURE;
1171
goto end;
1172
}
1173
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1174
if(ret == -1){
1175
perror("sigaddset");
1176
exitcode = EXIT_FAILURE;
1177
goto end;
1178
}
1179
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1180
if(ret == -1){
1181
perror("sigaddset");
1182
exitcode = EXIT_FAILURE;
1183
goto end;
1184
}
1185
/* Need to check if the handler is SIG_IGN before handling:
1186
| [[info:libc:Initial Signal Actions]] |
1187
| [[info:libc:Basic Signal Handling]] |
1188
*/
1189
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1190
if(ret == -1){
1191
perror("sigaction");
1192
return EXIT_FAILURE;
1193
}
1194
if(old_sigterm_action.sa_handler != SIG_IGN){
1195
ret = sigaction(SIGINT, &sigterm_action, NULL);
1196
if(ret == -1){
1197
perror("sigaction");
1198
exitcode = EXIT_FAILURE;
1199
goto end;
1200
}
1201
}
1202
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1203
if(ret == -1){
1204
perror("sigaction");
1205
return EXIT_FAILURE;
1206
}
1207
if(old_sigterm_action.sa_handler != SIG_IGN){
1208
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1209
if(ret == -1){
1210
perror("sigaction");
1211
exitcode = EXIT_FAILURE;
1212
goto end;
1213
}
1214
}
1215
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1216
if(ret == -1){
1217
perror("sigaction");
1218
return EXIT_FAILURE;
1219
}
1220
if(old_sigterm_action.sa_handler != SIG_IGN){
1221
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1222
if(ret == -1){
1223
perror("sigaction");
1224
exitcode = EXIT_FAILURE;
1225
goto end;
1226
}
1227
}
1228
1229
/* If the interface is down, bring it up */
1230
if(interface[0] != '\0'){
1231
if_index = (AvahiIfIndex) if_nametoindex(interface);
1232
if(if_index == 0){
1233
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1234
exitcode = EXIT_FAILURE;
1235
goto end;
1236
}
1237
1238
if(quit_now){
1239
goto end;
1240
}
1241
1242
/* Re-raise priviliges */
1243
errno = 0;
1244
ret = seteuid(0);
1245
if(ret == -1){
1246
perror("seteuid");
1247
}
1248
1249
#ifdef __linux__
1250
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1251
messages about the network interface to mess up the prompt */
1252
ret = klogctl(8, NULL, 5);
1253
bool restore_loglevel = true;
1254
if(ret == -1){
1255
restore_loglevel = false;
1256
perror("klogctl");
1257
}
1258
#endif /* __linux__ */
1259
1260
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1261
if(sd < 0){
1262
perror("socket");
1263
exitcode = EXIT_FAILURE;
1264
#ifdef __linux__
1265
if(restore_loglevel){
1266
ret = klogctl(7, NULL, 0);
1267
if(ret == -1){
1268
perror("klogctl");
1269
}
1270
}
1271
#endif /* __linux__ */
1272
/* Lower privileges */
1273
errno = 0;
1274
ret = seteuid(uid);
1275
if(ret == -1){
1276
perror("seteuid");
1277
}
1278
goto end;
1279
}
1280
strcpy(network.ifr_name, interface);
1281
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1282
if(ret == -1){
1283
perror("ioctl SIOCGIFFLAGS");
1284
#ifdef __linux__
1285
if(restore_loglevel){
1286
ret = klogctl(7, NULL, 0);
1287
if(ret == -1){
1288
perror("klogctl");
1289
}
1290
}
1291
#endif /* __linux__ */
1292
exitcode = EXIT_FAILURE;
1293
/* Lower privileges */
1294
errno = 0;
1295
ret = seteuid(uid);
1296
if(ret == -1){
1297
perror("seteuid");
1298
}
1299
goto end;
1300
}
1301
if((network.ifr_flags & IFF_UP) == 0){
1302
network.ifr_flags |= IFF_UP;
1303
take_down_interface = true;
1304
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1305
if(ret == -1){
1306
take_down_interface = false;
1307
perror("ioctl SIOCSIFFLAGS");
1308
exitcode = EXIT_FAILURE;
1309
#ifdef __linux__
1310
if(restore_loglevel){
1311
ret = klogctl(7, NULL, 0);
1312
if(ret == -1){
1313
perror("klogctl");
1314
}
1315
}
1316
#endif /* __linux__ */
1317
/* Lower privileges */
1318
errno = 0;
1319
ret = seteuid(uid);
1320
if(ret == -1){
1321
perror("seteuid");
1322
}
1323
goto end;
1324
}
1325
}
1326
/* sleep checking until interface is running */
1327
for(int i=0; i < delay * 4; i++){
1328
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1329
if(ret == -1){
1330
perror("ioctl SIOCGIFFLAGS");
1331
} else if(network.ifr_flags & IFF_RUNNING){
1332
break;
1333
}
1334
struct timespec sleeptime = { .tv_nsec = 250000000 };
1335
ret = nanosleep(&sleeptime, NULL);
1336
if(ret == -1 and errno != EINTR){
1337
perror("nanosleep");
1338
}
1339
}
1340
if(not take_down_interface){
1341
/* We won't need the socket anymore */
1342
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1343
if(ret == -1){
1344
perror("close");
1345
}
1346
}
1347
#ifdef __linux__
1348
if(restore_loglevel){
1349
/* Restores kernel loglevel to default */
1350
ret = klogctl(7, NULL, 0);
1351
if(ret == -1){
1352
perror("klogctl");
1353
}
1354
}
1355
#endif /* __linux__ */
1356
/* Lower privileges */
1357
errno = 0;
1358
if(take_down_interface){
1359
/* Lower privileges */
1360
ret = seteuid(uid);
1361
if(ret == -1){
1362
perror("seteuid");
1363
}
1364
} else {
1365
/* Lower privileges permanently */
1366
ret = setuid(uid);
1367
if(ret == -1){
1368
perror("setuid");
1369
}
1370
}
1371
}
1372
1373
if(quit_now){
1374
goto end;
1375
}
1376
1377
ret = init_gnutls_global(pubkey, seckey);
1378
if(ret == -1){
1379
fprintf(stderr, "init_gnutls_global failed\n");
1380
exitcode = EXIT_FAILURE;
1381
goto end;
1382
} else {
1383
gnutls_initialized = true;
1384
}
1385
1386
if(quit_now){
1387
goto end;
1388
}
1389
1390
tempdir_created = true;
1391
if(mkdtemp(tempdir) == NULL){
1392
tempdir_created = false;
1393
perror("mkdtemp");
1394
goto end;
1395
}
1396
1397
if(quit_now){
1398
goto end;
1399
}
1400
1401
if(not init_gpgme(pubkey, seckey, tempdir)){
1402
fprintf(stderr, "init_gpgme failed\n");
1403
exitcode = EXIT_FAILURE;
1404
goto end;
1405
} else {
1406
gpgme_initialized = true;
1407
}
1408
1409
if(quit_now){
1410
goto end;
1411
}
1412
1413
if(connect_to != NULL){
1414
/* Connect directly, do not use Zeroconf */
1415
/* (Mainly meant for debugging) */
1416
char *address = strrchr(connect_to, ':');
1417
if(address == NULL){
1418
fprintf(stderr, "No colon in address\n");
1419
exitcode = EXIT_FAILURE;
1420
goto end;
1421
}
1422
1423
if(quit_now){
1424
goto end;
1425
}
1426
1427
uint16_t port;
1428
errno = 0;
1429
tmpmax = strtoimax(address+1, &tmp, 10);
1430
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1431
or tmpmax != (uint16_t)tmpmax){
1432
fprintf(stderr, "Bad port number\n");
1433
exitcode = EXIT_FAILURE;
1434
goto end;
1435
}
1436
1437
if(quit_now){
1438
goto end;
1439
}
1440
1441
port = (uint16_t)tmpmax;
1442
*address = '\0';
1443
address = connect_to;
1444
/* Colon in address indicates IPv6 */
1445
int af;
1446
if(strchr(address, ':') != NULL){
1447
af = AF_INET6;
1448
} else {
1449
af = AF_INET;
1450
}
1451
1452
if(quit_now){
1453
goto end;
1454
}
1455
1456
ret = start_mandos_communication(address, port, if_index, af);
1457
if(ret < 0){
1458
exitcode = EXIT_FAILURE;
1459
} else {
1460
exitcode = EXIT_SUCCESS;
1461
}
1462
goto end;
1463
}
1464
1465
if(quit_now){
1466
goto end;
1467
}
1468
1469
{
605
case AVAHI_BROWSER_FAILURE:
606
607
fprintf(stderr, "(Browser) %s\n",
608
avahi_strerror(avahi_server_errno(server)));
609
avahi_simple_poll_quit(simple_poll);
610
return;
611
612
case AVAHI_BROWSER_NEW:
613
/* We ignore the returned resolver object. In the callback
614
function we free it. If the server is terminated before
615
the callback function is called the server will free
616
the resolver for us. */
617
618
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
619
type, domain,
620
AVAHI_PROTO_INET6, 0,
621
resolve_callback, s)))
622
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
623
avahi_strerror(avahi_server_errno(s)));
624
break;
625
626
case AVAHI_BROWSER_REMOVE:
627
break;
628
629
case AVAHI_BROWSER_ALL_FOR_NOW:
630
case AVAHI_BROWSER_CACHE_EXHAUSTED:
631
break;
632
}
633
}
634
635
/* Combines file name and path and returns the malloced new
636
string. some sane checks could/should be added */
637
static const char *combinepath(const char *first, const char *second){
638
size_t f_len = strlen(first);
639
size_t s_len = strlen(second);
640
char *tmp = malloc(f_len + s_len + 2);
641
if (tmp == NULL){
642
return NULL;
643
}
644
if(f_len > 0){
645
memcpy(tmp, first, f_len);
646
}
647
tmp[f_len] = '/';
648
if(s_len > 0){
649
memcpy(tmp + f_len + 1, second, s_len);
650
}
651
tmp[f_len + 1 + s_len] = '\0';
652
return tmp;
653
}
654
655
656
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1470
657
AvahiServerConfig config;
1471
/* Do not publish any local Zeroconf records */
658
AvahiSServiceBrowser *sb = NULL;
659
int error;
660
int ret;
661
int debug_int = 0;
662
int returncode = EXIT_SUCCESS;
663
const char *interface = NULL;
664
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
665
char *connect_to = NULL;
666
667
debug_int = debug ? 1 : 0;
668
while (true){
669
static struct option long_options[] = {
670
{"debug", no_argument, &debug_int, 1},
671
{"connect", required_argument, NULL, 'C'},
672
{"interface", required_argument, NULL, 'i'},
673
{"keydir", required_argument, NULL, 'd'},
674
{"seckey", required_argument, NULL, 'c'},
675
{"pubkey", required_argument, NULL, 'k'},
676
{"dh-bits", required_argument, NULL, 'D'},
677
{0, 0, 0, 0} };
678
679
int option_index = 0;
680
ret = getopt_long (argc, argv, "i:", long_options,
681
&option_index);
682
683
if (ret == -1){
684
break;
685
}
686
687
switch(ret){
688
case 0:
689
break;
690
case 'i':
691
interface = optarg;
692
break;
693
case 'C':
694
connect_to = optarg;
695
break;
696
case 'd':
697
keydir = optarg;
698
break;
699
case 'c':
700
pubkeyfile = optarg;
701
break;
702
case 'k':
703
seckeyfile = optarg;
704
break;
705
case 'D':
706
dh_bits = atoi(optarg);
707
break;
708
case '?':
709
break
710
default:
711
exit(EXIT_FAILURE);
712
}
713
}
714
debug = debug_int ? true : false;
715
716
pubkeyfile = combinepath(keydir, pubkeyfile);
717
if (pubkeyfile == NULL){
718
perror("combinepath");
719
goto exit;
720
}
721
722
if(interface != NULL){
723
if_index = (AvahiIfIndex) if_nametoindex(interface);
724
if(if_index == 0){
725
fprintf(stderr, "No such interface: \"%s\"\n", interface);
726
exit(EXIT_FAILURE);
727
}
728
}
729
730
if(connect_to != NULL){
731
/* Connect directly, do not use Zeroconf */
732
/* (Mainly meant for debugging) */
733
char *address = strrchr(connect_to, ':');
734
if(address == NULL){
735
fprintf(stderr, "No colon in address\n");
736
exit(EXIT_FAILURE);
737
}
738
errno = 0;
739
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
740
if(errno){
741
perror("Bad port number");
742
exit(EXIT_FAILURE);
743
}
744
*address = '\0';
745
address = connect_to;
746
ret = start_mandos_communication(address, port, if_index);
747
if(ret < 0){
748
exit(EXIT_FAILURE);
749
} else {
750
exit(EXIT_SUCCESS);
751
}
752
}
753
754
seckeyfile = combinepath(keydir, seckeyfile);
755
if (seckeyfile == NULL){
756
perror("combinepath");
757
goto exit;
758
}
759
760
if (not debug){
761
avahi_set_log_function(empty_log);
762
}
763
764
/* Initialize the psuedo-RNG */
765
srand((unsigned int) time(NULL));
766
767
/* Allocate main loop object */
768
if (!(simple_poll = avahi_simple_poll_new())) {
769
fprintf(stderr, "Failed to create simple poll object.\n");
770
771
goto exit;
772
}
773
774
/* Do not publish any local records */
1472
775
avahi_server_config_init(&config);
1473
776
config.publish_hinfo = 0;
1474
777
config.publish_addresses = 0;
1475
778
config.publish_workstation = 0;
1476
779
config.publish_domain = 0;
1477
780
1478
781
/* Allocate a new server */
1479
mc.server = avahi_server_new(avahi_simple_poll_get
1480
(mc.simple_poll), &config, NULL,
1481
NULL, &error);
1482
1483
/* Free the Avahi configuration data */
782
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
783
&config, NULL, NULL, &error);
784
785
/* Free the configuration data */
1484
786
avahi_server_config_free(&config);
1485
}
1486
1487
/* Check if creating the Avahi server object succeeded */
1488
if(mc.server == NULL){
1489
fprintf(stderr, "Failed to create Avahi server: %s\n",
1490
avahi_strerror(error));
1491
exitcode = EXIT_FAILURE;
1492
goto end;
1493
}
1494
1495
if(quit_now){
1496
goto end;
1497
}
1498
1499
/* Create the Avahi service browser */
1500
sb = avahi_s_service_browser_new(mc.server, if_index,
1501
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1502
NULL, 0, browse_callback, NULL);
1503
if(sb == NULL){
1504
fprintf(stderr, "Failed to create service browser: %s\n",
1505
avahi_strerror(avahi_server_errno(mc.server)));
1506
exitcode = EXIT_FAILURE;
1507
goto end;
1508
}
1509
1510
if(quit_now){
1511
goto end;
1512
}
1513
1514
/* Run the main loop */
1515
1516
if(debug){
1517
fprintf(stderr, "Starting Avahi loop search\n");
1518
}
1519
1520
avahi_simple_poll_loop(mc.simple_poll);
1521
1522
end:
1523
1524
if(debug){
1525
fprintf(stderr, "%s exiting\n", argv[0]);
1526
}
1527
1528
/* Cleanup things */
1529
if(sb != NULL)
1530
avahi_s_service_browser_free(sb);
1531
1532
if(mc.server != NULL)
1533
avahi_server_free(mc.server);
1534
1535
if(mc.simple_poll != NULL)
1536
avahi_simple_poll_free(mc.simple_poll);
1537
1538
if(gnutls_initialized){
1539
gnutls_certificate_free_credentials(mc.cred);
1540
gnutls_global_deinit();
1541
gnutls_dh_params_deinit(mc.dh_params);
1542
}
1543
1544
if(gpgme_initialized){
1545
gpgme_release(mc.ctx);
1546
}
1547
1548
/* Take down the network interface */
1549
if(take_down_interface){
1550
/* Re-raise priviliges */
1551
errno = 0;
1552
ret = seteuid(0);
1553
if(ret == -1){
1554
perror("seteuid");
1555
}
1556
if(geteuid() == 0){
1557
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1558
if(ret == -1){
1559
perror("ioctl SIOCGIFFLAGS");
1560
} else if(network.ifr_flags & IFF_UP) {
1561
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1562
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1563
if(ret == -1){
1564
perror("ioctl SIOCSIFFLAGS");
1565
}
1566
}
1567
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1568
if(ret == -1){
1569
perror("close");
1570
}
1571
/* Lower privileges permanently */
1572
errno = 0;
1573
ret = setuid(uid);
1574
if(ret == -1){
1575
perror("setuid");
1576
}
1577
}
1578
}
1579
1580
/* Removes the temp directory used by GPGME */
1581
if(tempdir_created){
1582
DIR *d;
1583
struct dirent *direntry;
1584
d = opendir(tempdir);
1585
if(d == NULL){
1586
if(errno != ENOENT){
1587
perror("opendir");
1588
}
1589
} else {
1590
while(true){
1591
direntry = readdir(d);
1592
if(direntry == NULL){
1593
break;
1594
}
1595
/* Skip "." and ".." */
1596
if(direntry->d_name[0] == '.'
1597
and (direntry->d_name[1] == '\0'
1598
or (direntry->d_name[1] == '.'
1599
and direntry->d_name[2] == '\0'))){
1600
continue;
1601
}
1602
char *fullname = NULL;
1603
ret = asprintf(&fullname, "%s/%s", tempdir,
1604
direntry->d_name);
1605
if(ret < 0){
1606
perror("asprintf");
1607
continue;
1608
}
1609
ret = remove(fullname);
1610
if(ret == -1){
1611
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1612
strerror(errno));
1613
}
1614
free(fullname);
1615
}
1616
closedir(d);
1617
}
1618
ret = rmdir(tempdir);
1619
if(ret == -1 and errno != ENOENT){
1620
perror("rmdir");
1621
}
1622
}
1623
1624
if(quit_now){
1625
sigemptyset(&old_sigterm_action.sa_mask);
1626
old_sigterm_action.sa_handler = SIG_DFL;
1627
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1628
&old_sigterm_action,
1629
NULL));
1630
if(ret == -1){
1631
perror("sigaction");
1632
}
1633
do {
1634
ret = raise(signal_received);
1635
} while(ret != 0 and errno == EINTR);
1636
if(ret != 0){
1637
perror("raise");
1638
abort();
1639
}
1640
TEMP_FAILURE_RETRY(pause());
1641
}
1642
1643
return exitcode;
787
788
/* Check if creating the server object succeeded */
789
if (!server) {
790
fprintf(stderr, "Failed to create server: %s\n",
791
avahi_strerror(error));
792
returncode = EXIT_FAILURE;
793
goto exit;
794
}
795
796
/* Create the service browser */
797
sb = avahi_s_service_browser_new(server, if_index,
798
AVAHI_PROTO_INET6,
799
"_mandos._tcp", NULL, 0,
800
browse_callback, server);
801
if (!sb) {
802
fprintf(stderr, "Failed to create service browser: %s\n",
803
avahi_strerror(avahi_server_errno(server)));
804
returncode = EXIT_FAILURE;
805
goto exit;
806
}
807
808
/* Run the main loop */
809
810
if (debug){
811
fprintf(stderr, "Starting avahi loop search\n");
812
}
813
814
avahi_simple_poll_loop(simple_poll);
815
816
exit:
817
818
if (debug){
819
fprintf(stderr, "%s exiting\n", argv[0]);
820
}
821
822
/* Cleanup things */
823
if (sb)
824
avahi_s_service_browser_free(sb);
825
826
if (server)
827
avahi_server_free(server);
828
829
if (simple_poll)
830
avahi_simple_poll_free(simple_poll);
831
free(pubkeyfile);
832
free(seckeyfile);
833
834
return returncode;
1644
835
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0