101
45
#include <avahi-common/malloc.h>
102
46
#include <avahi-common/error.h>
105
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
108
init_gnutls_session(),
110
#include <gnutls/openpgp.h>
111
/* gnutls_certificate_set_openpgp_key_file(),
112
GNUTLS_OPENPGP_FMT_BASE64 */
115
#include <gpgme.h> /* All GPGME types, constants and
118
GPGME_PROTOCOL_OpenPGP,
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
63
#include <errno.h> /* perror() */
121
69
#define BUFFER_SIZE 256
123
#define PATHDIR "/conf/conf.d/mandos"
124
#define SECKEY "seckey.txt"
125
#define PUBKEY "pubkey.txt"
71
static int dh_bits = 1024;
73
static const char *keydir = "/conf/conf.d/mandos";
74
static const char *pubkeyfile = "pubkey.txt";
75
static const char *seckeyfile = "seckey.txt";
127
77
bool debug = false;
128
static const char mandos_protocol_version[] = "1";
129
const char *argp_program_version = "mandos-client " VERSION;
130
const char *argp_program_bug_address = "<mandos@recompile.se>";
131
static const char sys_class_net[] = "/sys/class/net";
132
char *connect_to = NULL;
134
/* Doubly linked list that need to be circularly linked when used */
135
typedef struct server{
138
AvahiIfIndex if_index;
140
struct timespec last_seen;
145
/* Used for passing in values through the Avahi callback functions */
147
AvahiSimplePoll *simple_poll;
81
gnutls_session_t session;
149
82
gnutls_certificate_credentials_t cred;
150
unsigned int dh_bits;
151
83
gnutls_dh_params_t dh_params;
152
const char *priority;
87
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
90
gpgme_data_t dh_crypto, dh_plain;
154
server *current_server;
157
/* global context so signal handler can reach it*/
158
mandos_context mc = { .simple_poll = NULL, .server = NULL,
159
.dh_bits = 1024, .priority = "SECURE256"
160
":!CTYPE-X.509:+CTYPE-OPENPGP",
161
.current_server = NULL };
163
sig_atomic_t quit_now = 0;
164
int signal_received = 0;
166
/* Function to use when printing errors */
167
void perror_plus(const char *print_text){
168
fprintf(stderr, "Mandos plugin %s: ",
169
program_invocation_short_name);
174
* Make additional room in "buffer" for at least BUFFER_SIZE more
175
* bytes. "buffer_capacity" is how much is currently allocated,
176
* "buffer_length" is how much is already used.
178
size_t incbuffer(char **buffer, size_t buffer_length,
179
size_t buffer_capacity){
180
if(buffer_length + BUFFER_SIZE > buffer_capacity){
181
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
185
buffer_capacity += BUFFER_SIZE;
187
return buffer_capacity;
190
/* Add server to set of servers to retry periodically */
191
int add_server(const char *ip, uint16_t port,
192
AvahiIfIndex if_index,
195
server *new_server = malloc(sizeof(server));
196
if(new_server == NULL){
197
perror_plus("malloc");
200
*new_server = (server){ .ip = strdup(ip),
202
.if_index = if_index,
204
if(new_server->ip == NULL){
205
perror_plus("strdup");
208
/* Special case of first server */
209
if (mc.current_server == NULL){
210
new_server->next = new_server;
211
new_server->prev = new_server;
212
mc.current_server = new_server;
213
/* Place the new server last in the list */
215
new_server->next = mc.current_server;
216
new_server->prev = mc.current_server->prev;
217
new_server->prev->next = new_server;
218
mc.current_server->prev = new_server;
220
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
222
perror_plus("clock_gettime");
231
static bool init_gpgme(const char *seckey,
232
const char *pubkey, const char *tempdir){
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
234
96
gpgme_engine_info_t engine_info;
238
* Helper function to insert pub and seckey to the engine keyring.
240
bool import_key(const char *filename){
243
gpgme_data_t pgp_data;
245
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
251
rc = gpgme_data_new_from_fd(&pgp_data, fd);
252
if(rc != GPG_ERR_NO_ERROR){
253
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
254
gpgme_strsource(rc), gpgme_strerror(rc));
258
rc = gpgme_op_import(mc.ctx, pgp_data);
259
if(rc != GPG_ERR_NO_ERROR){
260
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
261
gpgme_strsource(rc), gpgme_strerror(rc));
265
ret = (int)TEMP_FAILURE_RETRY(close(fd));
267
perror_plus("close");
269
gpgme_data_release(pgp_data);
274
fprintf(stderr, "Initializing GPGME\n");
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
278
103
gpgme_check_version(NULL);
279
104
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
280
if(rc != GPG_ERR_NO_ERROR){
105
if (rc != GPG_ERR_NO_ERROR){
281
106
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
282
107
gpgme_strsource(rc), gpgme_strerror(rc));
286
/* Set GPGME home directory for the OpenPGP engine only */
287
rc = gpgme_get_engine_info(&engine_info);
288
if(rc != GPG_ERR_NO_ERROR){
111
/* Set GPGME home directory */
112
rc = gpgme_get_engine_info (&engine_info);
113
if (rc != GPG_ERR_NO_ERROR){
289
114
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
290
115
gpgme_strsource(rc), gpgme_strerror(rc));
293
118
while(engine_info != NULL){
294
119
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
295
120
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
296
engine_info->file_name, tempdir);
121
engine_info->file_name, homedir);
299
124
engine_info = engine_info->next;
301
126
if(engine_info == NULL){
302
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
306
/* Create new GPGME "context" */
307
rc = gpgme_new(&(mc.ctx));
308
if(rc != GPG_ERR_NO_ERROR){
309
fprintf(stderr, "bad gpgme_new: %s: %s\n",
310
gpgme_strsource(rc), gpgme_strerror(rc));
314
if(not import_key(pubkey) or not import_key(seckey)){
322
* Decrypt OpenPGP data.
323
* Returns -1 on error
325
static ssize_t pgp_packet_decrypt(const char *cryptotext,
328
gpgme_data_t dh_crypto, dh_plain;
331
size_t plaintext_capacity = 0;
332
ssize_t plaintext_length = 0;
335
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
338
/* Create new GPGME data buffer from memory cryptotext */
339
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
341
if(rc != GPG_ERR_NO_ERROR){
127
fprintf(stderr, "Could not set home dir to %s\n", homedir);
131
/* Create new GPGME data buffer from packet buffer */
132
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
133
if (rc != GPG_ERR_NO_ERROR){
342
134
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
343
135
gpgme_strsource(rc), gpgme_strerror(rc));
393
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
197
/* Delete the GPGME FILE pointer cryptotext data buffer */
198
gpgme_data_release(dh_crypto);
396
200
/* Seek back to the beginning of the GPGME plaintext data buffer */
397
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
398
perror_plus("gpgme_data_seek");
399
plaintext_length = -1;
201
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
202
perror("pgpme_data_seek");
405
plaintext_capacity = incbuffer(plaintext,
406
(size_t)plaintext_length,
408
if(plaintext_capacity == 0){
409
perror_plus("incbuffer");
410
plaintext_length = -1;
207
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
208
*new_packet = realloc(*new_packet,
209
(unsigned int)new_packet_capacity
211
if (*new_packet == NULL){
215
new_packet_capacity += BUFFER_SIZE;
414
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
218
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
416
220
/* Print the data, if any */
422
perror_plus("gpgme_data_read");
423
plaintext_length = -1;
426
plaintext_length += ret;
430
fprintf(stderr, "Decrypted password is: ");
431
for(ssize_t i = 0; i < plaintext_length; i++){
432
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
434
fprintf(stderr, "\n");
439
/* Delete the GPGME cryptotext data buffer */
440
gpgme_data_release(dh_crypto);
225
perror("gpgme_data_read");
228
new_packet_length += ret;
231
/* FIXME: check characters before printing to screen so to not print
232
terminal control characters */
234
/* fprintf(stderr, "decrypted password is: "); */
235
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
236
/* fprintf(stderr, "\n"); */
442
239
/* Delete the GPGME plaintext data buffer */
443
240
gpgme_data_release(dh_plain);
444
return plaintext_length;
241
return new_packet_length;
447
static const char * safer_gnutls_strerror(int value){
448
const char *ret = gnutls_strerror(value); /* Spurious warning from
449
-Wunreachable-code */
244
static const char * safer_gnutls_strerror (int value) {
245
const char *ret = gnutls_strerror (value);
451
247
ret = "(unknown)";
455
/* GnuTLS log function callback */
456
251
static void debuggnutls(__attribute__((unused)) int level,
457
252
const char* string){
458
fprintf(stderr, "GnuTLS: %s", string);
253
fprintf(stderr, "%s", string);
461
static int init_gnutls_global(const char *pubkeyfilename,
462
const char *seckeyfilename){
256
static int initgnutls(encrypted_session *es){
466
261
fprintf(stderr, "Initializing GnuTLS\n");
469
ret = gnutls_global_init();
470
if(ret != GNUTLS_E_SUCCESS){
471
fprintf(stderr, "GnuTLS global_init: %s\n",
472
safer_gnutls_strerror(ret));
264
if ((ret = gnutls_global_init ())
265
!= GNUTLS_E_SUCCESS) {
266
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
477
/* "Use a log level over 10 to enable all debugging options."
480
271
gnutls_global_set_log_level(11);
481
272
gnutls_global_set_log_function(debuggnutls);
484
/* OpenPGP credentials */
485
ret = gnutls_certificate_allocate_credentials(&mc.cred);
486
if(ret != GNUTLS_E_SUCCESS){
487
fprintf(stderr, "GnuTLS memory error: %s\n",
488
safer_gnutls_strerror(ret));
489
gnutls_global_deinit();
275
/* openpgp credentials */
276
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
277
!= GNUTLS_E_SUCCESS) {
278
fprintf (stderr, "memory error: %s\n",
279
safer_gnutls_strerror(ret));
494
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
495
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
284
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
285
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
499
289
ret = gnutls_certificate_set_openpgp_key_file
500
(mc.cred, pubkeyfilename, seckeyfilename,
501
GNUTLS_OPENPGP_FMT_BASE64);
502
if(ret != GNUTLS_E_SUCCESS){
504
"Error[%d] while reading the OpenPGP key pair ('%s',"
505
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
506
fprintf(stderr, "The GnuTLS error is: %s\n",
507
safer_gnutls_strerror(ret));
511
/* GnuTLS server initialization */
512
ret = gnutls_dh_params_init(&mc.dh_params);
513
if(ret != GNUTLS_E_SUCCESS){
514
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
515
" %s\n", safer_gnutls_strerror(ret));
518
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
519
if(ret != GNUTLS_E_SUCCESS){
520
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
521
safer_gnutls_strerror(ret));
525
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
531
gnutls_certificate_free_credentials(mc.cred);
532
gnutls_global_deinit();
533
gnutls_dh_params_deinit(mc.dh_params);
537
static int init_gnutls_session(gnutls_session_t *session){
539
/* GnuTLS session creation */
541
ret = gnutls_init(session, GNUTLS_SERVER);
545
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
546
if(ret != GNUTLS_E_SUCCESS){
290
(es->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
291
if (ret != GNUTLS_E_SUCCESS) {
293
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
295
ret, pubkeyfile, seckeyfile);
296
fprintf(stdout, "The Error is: %s\n",
297
safer_gnutls_strerror(ret));
301
//GnuTLS server initialization
302
if ((ret = gnutls_dh_params_init (&es->dh_params))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in dh parameter initialization: %s\n",
305
safer_gnutls_strerror(ret));
309
if ((ret = gnutls_dh_params_generate2 (es->dh_params, dh_bits))
310
!= GNUTLS_E_SUCCESS) {
311
fprintf (stderr, "Error in prime generation: %s\n",
312
safer_gnutls_strerror(ret));
316
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
318
// GnuTLS session creation
319
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
320
!= GNUTLS_E_SUCCESS){
547
321
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
548
322
safer_gnutls_strerror(ret));
554
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
556
gnutls_deinit(*session);
559
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
560
if(ret != GNUTLS_E_SUCCESS){
561
fprintf(stderr, "Syntax error at: %s\n", err);
562
fprintf(stderr, "GnuTLS error: %s\n",
563
safer_gnutls_strerror(ret));
564
gnutls_deinit(*session);
325
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
326
!= GNUTLS_E_SUCCESS) {
327
fprintf(stderr, "Syntax error at: %s\n", err);
328
fprintf(stderr, "GnuTLS error: %s\n",
329
safer_gnutls_strerror(ret));
570
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
573
gnutls_deinit(*session);
576
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
577
if(ret != GNUTLS_E_SUCCESS){
578
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
333
if ((ret = gnutls_credentials_set
334
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
335
!= GNUTLS_E_SUCCESS) {
336
fprintf(stderr, "Error setting a credentials set: %s\n",
579
337
safer_gnutls_strerror(ret));
580
gnutls_deinit(*session);
584
341
/* ignore client certificate if any. */
585
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
342
gnutls_certificate_server_set_request (es->session,
587
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
345
gnutls_dh_set_prime_bits (es->session, dh_bits);
592
/* Avahi log function callback */
593
350
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
594
351
__attribute__((unused)) const char *txt){}
596
/* Called when a Mandos server is found */
597
353
static int start_mandos_communication(const char *ip, uint16_t port,
598
AvahiIfIndex if_index,
600
int ret, tcp_sd = -1;
603
struct sockaddr_in in;
604
struct sockaddr_in6 in6;
354
AvahiIfIndex if_index){
356
struct sockaddr_in6 to;
357
encrypted_session es;
606
358
char *buffer = NULL;
607
char *decrypted_buffer = NULL;
359
char *decrypted_buffer;
608
360
size_t buffer_length = 0;
609
361
size_t buffer_capacity = 0;
612
gnutls_session_t session;
613
int pf; /* Protocol family */
630
fprintf(stderr, "Bad address family: %d\n", af);
635
ret = init_gnutls_session(&session);
641
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
645
tcp_sd = socket(pf, SOCK_STREAM, 0);
648
perror_plus("socket");
658
memset(&to, 0, sizeof(to));
660
to.in6.sin6_family = (sa_family_t)af;
661
ret = inet_pton(af, ip, &to.in6.sin6_addr);
663
to.in.sin_family = (sa_family_t)af;
664
ret = inet_pton(af, ip, &to.in.sin_addr);
668
perror_plus("inet_pton");
362
ssize_t decrypted_buffer_size;
365
char interface[IF_NAMESIZE];
368
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
372
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
378
if(if_indextoname((unsigned int)if_index, interface) == NULL){
380
perror("if_indextoname");
386
fprintf(stderr, "Binding to interface %s\n", interface);
389
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
674
397
fprintf(stderr, "Bad address: %s\n", ip);
679
to.in6.sin6_port = htons(port); /* Spurious warnings from
681
-Wunreachable-code */
683
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
684
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
686
if(if_index == AVAHI_IF_UNSPEC){
687
fprintf(stderr, "An IPv6 link-local address is incomplete"
688
" without a network interface\n");
692
/* Set the network interface number as scope */
693
to.in6.sin6_scope_id = (uint32_t)if_index;
696
to.in.sin_port = htons(port); /* Spurious warnings from
698
-Wunreachable-code */
400
to.sin6_port = htons(port); /* Spurious warning */
402
to.sin6_scope_id = (uint32_t)if_index;
707
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
708
char interface[IF_NAMESIZE];
709
if(if_indextoname((unsigned int)if_index, interface) == NULL){
710
perror_plus("if_indextoname");
712
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
713
ip, interface, port);
716
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
719
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
720
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
723
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
726
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
730
perror_plus("inet_ntop");
405
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
406
char addrstr[INET6_ADDRSTRLEN] = "";
407
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
408
sizeof(addrstr)) == NULL){
732
411
if(strcmp(addrstr, ip) != 0){
733
fprintf(stderr, "Canonical address form: %s\n", addrstr);
744
ret = connect(tcp_sd, &to.in6, sizeof(to));
746
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
749
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
751
perror_plus("connect");
762
const char *out = mandos_protocol_version;
765
size_t out_size = strlen(out);
766
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
767
out_size - written));
770
perror_plus("write");
774
written += (size_t)ret;
775
if(written < out_size){
778
if(out == mandos_protocol_version){
412
fprintf(stderr, "Canonical address form: %s\n",
413
addrstr, ntohs(to.sin6_port));
418
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
424
ret = initgnutls (&es);
430
gnutls_transport_set_ptr (es.session,
431
(gnutls_transport_ptr_t) tcp_sd);
793
434
fprintf(stderr, "Establishing TLS session with %s\n", ip);
801
/* Spurious warning from -Wint-to-pointer-cast */
802
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
810
ret = gnutls_handshake(session);
815
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
817
if(ret != GNUTLS_E_SUCCESS){
437
ret = gnutls_handshake (es.session);
439
if (ret != GNUTLS_E_SUCCESS){
819
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
441
fprintf(stderr, "\n*** Handshake failed ***\n");
826
/* Read OpenPGP packet that contains the wanted password */
448
//Retrieve OpenPGP packet that contains the wanted password
829
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
451
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
840
buffer_capacity = incbuffer(&buffer, buffer_length,
842
if(buffer_capacity == 0){
844
perror_plus("incbuffer");
854
sret = gnutls_record_recv(session, buffer+buffer_length,
456
if (buffer_length + BUFFER_SIZE > buffer_capacity){
457
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
462
buffer_capacity += BUFFER_SIZE;
465
ret = gnutls_record_recv
466
(es.session, buffer+buffer_length, BUFFER_SIZE);
861
472
case GNUTLS_E_INTERRUPTED:
862
473
case GNUTLS_E_AGAIN:
864
475
case GNUTLS_E_REHANDSHAKE:
866
ret = gnutls_handshake(session);
872
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
874
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
476
ret = gnutls_handshake (es.session);
478
fprintf(stderr, "\n*** Handshake failed ***\n");
881
485
fprintf(stderr, "Unknown error while reading data from"
882
" encrypted session with Mandos server\n");
883
gnutls_bye(session, GNUTLS_SHUT_RDWR);
486
" encrypted session with mandos server\n");
488
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
888
buffer_length += (size_t) sret;
893
fprintf(stderr, "Closing TLS session\n");
902
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
907
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
909
if(buffer_length > 0){
910
ssize_t decrypted_buffer_size;
492
buffer_length += (size_t) ret;
496
if (buffer_length > 0){
911
497
decrypted_buffer_size = pgp_packet_decrypt(buffer,
914
if(decrypted_buffer_size >= 0){
501
if (decrypted_buffer_size >= 0){
917
502
while(written < (size_t) decrypted_buffer_size){
923
ret = (int)fwrite(decrypted_buffer + written, 1,
924
(size_t)decrypted_buffer_size - written,
503
ret = (int)fwrite (decrypted_buffer + written, 1,
504
(size_t)decrypted_buffer_size - written,
926
506
if(ret == 0 and ferror(stdout)){
929
508
fprintf(stderr, "Error writing encrypted data: %s\n",
930
509
strerror(errno));
935
514
written += (size_t)ret;
941
/* Shutdown procedure */
946
free(decrypted_buffer);
949
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
955
perror_plus("close");
957
gnutls_deinit(session);
516
free(decrypted_buffer);
525
fprintf(stderr, "Closing TLS session\n");
529
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
532
gnutls_deinit (es.session);
533
gnutls_certificate_free_credentials (es.cred);
534
gnutls_global_deinit ();
967
static void resolve_callback(AvahiSServiceResolver *r,
968
AvahiIfIndex interface,
970
AvahiResolverEvent event,
974
const char *host_name,
975
const AvahiAddress *address,
977
AVAHI_GCC_UNUSED AvahiStringList *txt,
978
AVAHI_GCC_UNUSED AvahiLookupResultFlags
980
AVAHI_GCC_UNUSED void* userdata){
538
static AvahiSimplePoll *simple_poll = NULL;
539
static AvahiServer *server = NULL;
541
static void resolve_callback(
542
AvahiSServiceResolver *r,
543
AvahiIfIndex interface,
544
AVAHI_GCC_UNUSED AvahiProtocol protocol,
545
AvahiResolverEvent event,
549
const char *host_name,
550
const AvahiAddress *address,
552
AVAHI_GCC_UNUSED AvahiStringList *txt,
553
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
554
AVAHI_GCC_UNUSED void* userdata) {
556
assert(r); /* Spurious warning */
983
558
/* Called whenever a service has been resolved successfully or
992
563
case AVAHI_RESOLVER_FAILURE:
993
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
994
" of type '%s' in domain '%s': %s\n", name, type, domain,
995
avahi_strerror(avahi_server_errno(mc.server)));
564
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
565
" type '%s' in domain '%s': %s\n", name, type, domain,
566
avahi_strerror(avahi_server_errno(server)));
998
569
case AVAHI_RESOLVER_FOUND:
1000
571
char ip[AVAHI_ADDRESS_STR_MAX];
1001
572
avahi_address_snprint(ip, sizeof(ip), address);
1003
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
1004
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
1005
ip, (intmax_t)interface, port);
574
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
575
" port %d\n", name, host_name, ip, port);
1007
int ret = start_mandos_communication(ip, port, interface,
1008
avahi_proto_to_af(proto));
1010
avahi_simple_poll_quit(mc.simple_poll);
1012
ret = add_server(ip, port, interface,
1013
avahi_proto_to_af(proto));
577
int ret = start_mandos_communication(ip, port, interface);
1017
583
avahi_s_service_resolver_free(r);
1020
static void browse_callback(AvahiSServiceBrowser *b,
1021
AvahiIfIndex interface,
1022
AvahiProtocol protocol,
1023
AvahiBrowserEvent event,
1027
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1029
AVAHI_GCC_UNUSED void* userdata){
1032
/* Called whenever a new services becomes available on the LAN or
1033
is removed from the LAN */
1041
case AVAHI_BROWSER_FAILURE:
1043
fprintf(stderr, "(Avahi browser) %s\n",
1044
avahi_strerror(avahi_server_errno(mc.server)));
1045
avahi_simple_poll_quit(mc.simple_poll);
1048
case AVAHI_BROWSER_NEW:
1049
/* We ignore the returned Avahi resolver object. In the callback
1050
function we free it. If the Avahi server is terminated before
1051
the callback function is called the Avahi server will free the
1054
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1055
name, type, domain, protocol, 0,
1056
resolve_callback, NULL) == NULL)
1057
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
1058
name, avahi_strerror(avahi_server_errno(mc.server)));
1061
case AVAHI_BROWSER_REMOVE:
1064
case AVAHI_BROWSER_ALL_FOR_NOW:
1065
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1067
fprintf(stderr, "No Mandos server found, still searching...\n");
1073
/* Signal handler that stops main loop after SIGTERM */
1074
static void handle_sigterm(int sig){
1079
signal_received = sig;
1080
int old_errno = errno;
1081
/* set main loop to exit */
1082
if(mc.simple_poll != NULL){
1083
avahi_simple_poll_quit(mc.simple_poll);
1089
* This function determines if a directory entry in /sys/class/net
1090
* corresponds to an acceptable network device.
1091
* (This function is passed to scandir(3) as a filter function.)
1093
int good_interface(const struct dirent *if_entry){
1095
char *flagname = NULL;
1096
if(if_entry->d_name[0] == '.'){
1099
int ret = asprintf(&flagname, "%s/%s/flags", sys_class_net,
1102
perror_plus("asprintf");
1105
int flags_fd = (int)TEMP_FAILURE_RETRY(open(flagname, O_RDONLY));
1107
perror_plus("open");
1112
typedef short ifreq_flags; /* ifreq.ifr_flags in netdevice(7) */
1113
/* read line from flags_fd */
1114
ssize_t to_read = 2+(sizeof(ifreq_flags)*2)+1; /* "0x1003\n" */
1115
char *flagstring = malloc((size_t)to_read+1); /* +1 for final \0 */
1116
flagstring[(size_t)to_read] = '\0';
1117
if(flagstring == NULL){
1118
perror_plus("malloc");
1123
ssret = (ssize_t)TEMP_FAILURE_RETRY(read(flags_fd, flagstring,
1126
perror_plus("read");
1140
tmpmax = strtoimax(flagstring, &tmp, 0);
1141
if(errno != 0 or tmp == flagstring or (*tmp != '\0'
1142
and not (isspace(*tmp)))
1143
or tmpmax != (ifreq_flags)tmpmax){
1145
fprintf(stderr, "Invalid flags \"%s\" for interface \"%s\"\n",
1146
flagstring, if_entry->d_name);
1152
ifreq_flags flags = (ifreq_flags)tmpmax;
1153
/* Reject the loopback device */
1154
if(flags & IFF_LOOPBACK){
1156
fprintf(stderr, "Rejecting loopback interface \"%s\"\n",
1161
/* Accept point-to-point devices only if connect_to is specified */
1162
if(connect_to != NULL and (flags & IFF_POINTOPOINT)){
1164
fprintf(stderr, "Accepting point-to-point interface \"%s\"\n",
1169
/* Otherwise, reject non-broadcast-capable devices */
1170
if(not (flags & IFF_BROADCAST)){
1172
fprintf(stderr, "Rejecting non-broadcast interface \"%s\"\n",
1177
/* Reject non-ARP interfaces (including dummy interfaces) */
1178
if(flags & IFF_NOARP){
1180
fprintf(stderr, "Rejecting non-ARP interface \"%s\"\n",
1185
/* Accept this device */
1187
fprintf(stderr, "Interface \"%s\" is acceptable\n",
1193
int notdotentries(const struct dirent *direntry){
1194
/* Skip "." and ".." */
1195
if(direntry->d_name[0] == '.'
1196
and (direntry->d_name[1] == '\0'
1197
or (direntry->d_name[1] == '.'
1198
and direntry->d_name[2] == '\0'))){
1204
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1206
struct timespec now;
1207
struct timespec waited_time;
1208
intmax_t block_time;
1211
if(mc.current_server == NULL){
1214
"Wait until first server is found. No timeout!\n");
1216
ret = avahi_simple_poll_iterate(s, -1);
1219
fprintf(stderr, "Check current_server if we should run it,"
1222
/* the current time */
1223
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1225
perror_plus("clock_gettime");
1228
/* Calculating in ms how long time between now and server
1229
who we visted longest time ago. Now - last seen. */
1230
waited_time.tv_sec = (now.tv_sec
1231
- mc.current_server->last_seen.tv_sec);
1232
waited_time.tv_nsec = (now.tv_nsec
1233
- mc.current_server->last_seen.tv_nsec);
1234
/* total time is 10s/10,000ms.
1235
Converting to s from ms by dividing by 1,000,
1236
and ns to ms by dividing by 1,000,000. */
1237
block_time = ((retry_interval
1238
- ((intmax_t)waited_time.tv_sec * 1000))
1239
- ((intmax_t)waited_time.tv_nsec / 1000000));
1242
fprintf(stderr, "Blocking for %" PRIdMAX " ms\n", block_time);
1245
if(block_time <= 0){
1246
ret = start_mandos_communication(mc.current_server->ip,
1247
mc.current_server->port,
1248
mc.current_server->if_index,
1249
mc.current_server->af);
1251
avahi_simple_poll_quit(mc.simple_poll);
1254
ret = clock_gettime(CLOCK_MONOTONIC,
1255
&mc.current_server->last_seen);
1257
perror_plus("clock_gettime");
1260
mc.current_server = mc.current_server->next;
1261
block_time = 0; /* Call avahi to find new Mandos
1262
servers, but don't block */
1265
ret = avahi_simple_poll_iterate(s, (int)block_time);
1268
if (ret > 0 or errno != EINTR) {
1269
return (ret != 1) ? ret : 0;
1275
int main(int argc, char *argv[]){
1276
AvahiSServiceBrowser *sb = NULL;
1281
int exitcode = EXIT_SUCCESS;
1282
const char *interface = "";
1283
struct ifreq network;
1285
bool take_down_interface = false;
1288
char tempdir[] = "/tmp/mandosXXXXXX";
1289
bool tempdir_created = false;
1290
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1291
const char *seckey = PATHDIR "/" SECKEY;
1292
const char *pubkey = PATHDIR "/" PUBKEY;
1294
bool gnutls_initialized = false;
1295
bool gpgme_initialized = false;
1297
double retry_interval = 10; /* 10s between trying a server and
1298
retrying the same server again */
1300
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1301
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1306
/* Lower any group privileges we might have, just to be safe */
1310
perror_plus("setgid");
1313
/* Lower user privileges (temporarily) */
1317
perror_plus("seteuid");
1325
struct argp_option options[] = {
1326
{ .name = "debug", .key = 128,
1327
.doc = "Debug mode", .group = 3 },
1328
{ .name = "connect", .key = 'c',
1329
.arg = "ADDRESS:PORT",
1330
.doc = "Connect directly to a specific Mandos server",
1332
{ .name = "interface", .key = 'i',
1334
.doc = "Network interface that will be used to search for"
1337
{ .name = "seckey", .key = 's',
1339
.doc = "OpenPGP secret key file base name",
1341
{ .name = "pubkey", .key = 'p',
1343
.doc = "OpenPGP public key file base name",
1345
{ .name = "dh-bits", .key = 129,
1347
.doc = "Bit length of the prime number used in the"
1348
" Diffie-Hellman key exchange",
1350
{ .name = "priority", .key = 130,
1352
.doc = "GnuTLS priority string for the TLS handshake",
1354
{ .name = "delay", .key = 131,
1356
.doc = "Maximum delay to wait for interface startup",
1358
{ .name = "retry", .key = 132,
1360
.doc = "Retry interval used when denied by the mandos server",
1363
* These reproduce what we would get without ARGP_NO_HELP
1365
{ .name = "help", .key = '?',
1366
.doc = "Give this help list", .group = -1 },
1367
{ .name = "usage", .key = -3,
1368
.doc = "Give a short usage message", .group = -1 },
1369
{ .name = "version", .key = 'V',
1370
.doc = "Print program version", .group = -1 },
1374
error_t parse_opt(int key, char *arg,
1375
struct argp_state *state){
1378
case 128: /* --debug */
1381
case 'c': /* --connect */
1384
case 'i': /* --interface */
1387
case 's': /* --seckey */
1390
case 'p': /* --pubkey */
1393
case 129: /* --dh-bits */
1395
tmpmax = strtoimax(arg, &tmp, 10);
1396
if(errno != 0 or tmp == arg or *tmp != '\0'
1397
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1398
argp_error(state, "Bad number of DH bits");
1400
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1402
case 130: /* --priority */
1405
case 131: /* --delay */
1407
delay = strtof(arg, &tmp);
1408
if(errno != 0 or tmp == arg or *tmp != '\0'){
1409
argp_error(state, "Bad delay");
1411
case 132: /* --retry */
1413
retry_interval = strtod(arg, &tmp);
1414
if(errno != 0 or tmp == arg or *tmp != '\0'
1415
or (retry_interval * 1000) > INT_MAX
1416
or retry_interval < 0){
1417
argp_error(state, "Bad retry interval");
1421
* These reproduce what we would get without ARGP_NO_HELP
1423
case '?': /* --help */
1424
argp_state_help(state, state->out_stream,
1425
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1426
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1427
case -3: /* --usage */
1428
argp_state_help(state, state->out_stream,
1429
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1430
case 'V': /* --version */
1431
fprintf(state->out_stream, "%s\n", argp_program_version);
1432
exit(argp_err_exit_status);
1435
return ARGP_ERR_UNKNOWN;
1440
struct argp argp = { .options = options, .parser = parse_opt,
1442
.doc = "Mandos client -- Get and decrypt"
1443
" passwords from a Mandos server" };
1444
ret = argp_parse(&argp, argc, argv,
1445
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
586
static void browse_callback(
587
AvahiSServiceBrowser *b,
588
AvahiIfIndex interface,
589
AvahiProtocol protocol,
590
AvahiBrowserEvent event,
594
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
597
AvahiServer *s = userdata;
598
assert(b); /* Spurious warning */
600
/* Called whenever a new services becomes available on the LAN or
601
is removed from the LAN */
1452
perror_plus("argp_parse");
1453
exitcode = EX_OSERR;
1456
exitcode = EX_USAGE;
1462
/* Work around Debian bug #633582:
1463
<http://bugs.debian.org/633582> */
1466
/* Re-raise priviliges */
1470
perror_plus("seteuid");
1473
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1474
int seckey_fd = open(seckey, O_RDONLY);
1475
if(seckey_fd == -1){
1476
perror_plus("open");
1478
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1480
perror_plus("fstat");
1482
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1483
ret = fchown(seckey_fd, uid, gid);
1485
perror_plus("fchown");
1489
TEMP_FAILURE_RETRY(close(seckey_fd));
1493
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1494
int pubkey_fd = open(pubkey, O_RDONLY);
1495
if(pubkey_fd == -1){
1496
perror_plus("open");
1498
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1500
perror_plus("fstat");
1502
if(S_ISREG(st.st_mode) and st.st_uid == 0 and st.st_gid == 0){
1503
ret = fchown(pubkey_fd, uid, gid);
1505
perror_plus("fchown");
1509
TEMP_FAILURE_RETRY(close(pubkey_fd));
1513
/* Lower privileges */
1517
perror_plus("seteuid");
1522
avahi_set_log_function(empty_log);
1525
if(interface[0] == '\0'){
1526
struct dirent **direntries;
1527
ret = scandir(sys_class_net, &direntries, good_interface,
1530
/* Pick the first good interface */
1531
interface = strdup(direntries[0]->d_name);
1533
fprintf(stderr, "Using interface \"%s\"\n", interface);
1535
if(interface == NULL){
1536
perror_plus("malloc");
1538
exitcode = EXIT_FAILURE;
1544
fprintf(stderr, "Could not find a network interface\n");
1545
exitcode = EXIT_FAILURE;
1550
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1551
from the signal handler */
1552
/* Initialize the pseudo-RNG for Avahi */
1553
srand((unsigned int) time(NULL));
1554
mc.simple_poll = avahi_simple_poll_new();
1555
if(mc.simple_poll == NULL){
1556
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1557
exitcode = EX_UNAVAILABLE;
1561
sigemptyset(&sigterm_action.sa_mask);
1562
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1564
perror_plus("sigaddset");
1565
exitcode = EX_OSERR;
1568
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1570
perror_plus("sigaddset");
1571
exitcode = EX_OSERR;
1574
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1576
perror_plus("sigaddset");
1577
exitcode = EX_OSERR;
1580
/* Need to check if the handler is SIG_IGN before handling:
1581
| [[info:libc:Initial Signal Actions]] |
1582
| [[info:libc:Basic Signal Handling]] |
1584
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1586
perror_plus("sigaction");
1589
if(old_sigterm_action.sa_handler != SIG_IGN){
1590
ret = sigaction(SIGINT, &sigterm_action, NULL);
1592
perror_plus("sigaction");
1593
exitcode = EX_OSERR;
1597
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1599
perror_plus("sigaction");
1602
if(old_sigterm_action.sa_handler != SIG_IGN){
1603
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1605
perror_plus("sigaction");
1606
exitcode = EX_OSERR;
1610
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1612
perror_plus("sigaction");
1615
if(old_sigterm_action.sa_handler != SIG_IGN){
1616
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1618
perror_plus("sigaction");
1619
exitcode = EX_OSERR;
1624
/* If the interface is down, bring it up */
1625
if(strcmp(interface, "none") != 0){
1626
if_index = (AvahiIfIndex) if_nametoindex(interface);
1628
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1629
exitcode = EX_UNAVAILABLE;
1637
/* Re-raise priviliges */
1641
perror_plus("seteuid");
1645
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1646
messages about the network interface to mess up the prompt */
1647
ret = klogctl(8, NULL, 5);
1648
bool restore_loglevel = true;
1650
restore_loglevel = false;
1651
perror_plus("klogctl");
1653
#endif /* __linux__ */
1655
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1657
perror_plus("socket");
1658
exitcode = EX_OSERR;
1660
if(restore_loglevel){
1661
ret = klogctl(7, NULL, 0);
1663
perror_plus("klogctl");
1666
#endif /* __linux__ */
1667
/* Lower privileges */
1671
perror_plus("seteuid");
1675
strcpy(network.ifr_name, interface);
1676
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1678
perror_plus("ioctl SIOCGIFFLAGS");
1680
if(restore_loglevel){
1681
ret = klogctl(7, NULL, 0);
1683
perror_plus("klogctl");
1686
#endif /* __linux__ */
1687
exitcode = EX_OSERR;
1688
/* Lower privileges */
1692
perror_plus("seteuid");
1696
if((network.ifr_flags & IFF_UP) == 0){
1697
network.ifr_flags |= IFF_UP;
1698
take_down_interface = true;
1699
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1701
take_down_interface = false;
1702
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1703
exitcode = EX_OSERR;
1705
if(restore_loglevel){
1706
ret = klogctl(7, NULL, 0);
1708
perror_plus("klogctl");
1711
#endif /* __linux__ */
1712
/* Lower privileges */
1716
perror_plus("seteuid");
1721
/* Sleep checking until interface is running.
1722
Check every 0.25s, up to total time of delay */
1723
for(int i=0; i < delay * 4; i++){
1724
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1726
perror_plus("ioctl SIOCGIFFLAGS");
1727
} else if(network.ifr_flags & IFF_RUNNING){
1730
struct timespec sleeptime = { .tv_nsec = 250000000 };
1731
ret = nanosleep(&sleeptime, NULL);
1732
if(ret == -1 and errno != EINTR){
1733
perror_plus("nanosleep");
1736
if(not take_down_interface){
1737
/* We won't need the socket anymore */
1738
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1740
perror_plus("close");
1744
if(restore_loglevel){
1745
/* Restores kernel loglevel to default */
1746
ret = klogctl(7, NULL, 0);
1748
perror_plus("klogctl");
1751
#endif /* __linux__ */
1752
/* Lower privileges */
1754
if(take_down_interface){
1755
/* Lower privileges */
1758
perror_plus("seteuid");
1761
/* Lower privileges permanently */
1764
perror_plus("setuid");
1773
ret = init_gnutls_global(pubkey, seckey);
1775
fprintf(stderr, "init_gnutls_global failed\n");
1776
exitcode = EX_UNAVAILABLE;
1779
gnutls_initialized = true;
1786
if(mkdtemp(tempdir) == NULL){
1787
perror_plus("mkdtemp");
1790
tempdir_created = true;
1796
if(not init_gpgme(pubkey, seckey, tempdir)){
1797
fprintf(stderr, "init_gpgme failed\n");
1798
exitcode = EX_UNAVAILABLE;
1801
gpgme_initialized = true;
1808
if(connect_to != NULL){
1809
/* Connect directly, do not use Zeroconf */
1810
/* (Mainly meant for debugging) */
1811
char *address = strrchr(connect_to, ':');
1812
if(address == NULL){
1813
fprintf(stderr, "No colon in address\n");
1814
exitcode = EX_USAGE;
1824
tmpmax = strtoimax(address+1, &tmp, 10);
1825
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1826
or tmpmax != (uint16_t)tmpmax){
1827
fprintf(stderr, "Bad port number\n");
1828
exitcode = EX_USAGE;
1836
port = (uint16_t)tmpmax;
1838
/* Colon in address indicates IPv6 */
1840
if(strchr(connect_to, ':') != NULL){
1842
/* Accept [] around IPv6 address - see RFC 5952 */
1843
if(connect_to[0] == '[' and address[-1] == ']')
1851
address = connect_to;
1857
while(not quit_now){
1858
ret = start_mandos_communication(address, port, if_index, af);
1859
if(quit_now or ret == 0){
1863
fprintf(stderr, "Retrying in %d seconds\n",
1864
(int)retry_interval);
1866
sleep((int)retry_interval);
1870
exitcode = EXIT_SUCCESS;
605
case AVAHI_BROWSER_FAILURE:
607
fprintf(stderr, "(Browser) %s\n",
608
avahi_strerror(avahi_server_errno(server)));
609
avahi_simple_poll_quit(simple_poll);
612
case AVAHI_BROWSER_NEW:
613
/* We ignore the returned resolver object. In the callback
614
function we free it. If the server is terminated before
615
the callback function is called the server will free
616
the resolver for us. */
618
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
620
AVAHI_PROTO_INET6, 0,
621
resolve_callback, s)))
622
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
623
avahi_strerror(avahi_server_errno(s)));
626
case AVAHI_BROWSER_REMOVE:
629
case AVAHI_BROWSER_ALL_FOR_NOW:
630
case AVAHI_BROWSER_CACHE_EXHAUSTED:
635
/* Combines file name and path and returns the malloced new
636
string. some sane checks could/should be added */
637
static const char *combinepath(const char *first, const char *second){
638
size_t f_len = strlen(first);
639
size_t s_len = strlen(second);
640
char *tmp = malloc(f_len + s_len + 2);
645
memcpy(tmp, first, f_len);
649
memcpy(tmp + f_len + 1, second, s_len);
651
tmp[f_len + 1 + s_len] = '\0';
656
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1881
657
AvahiServerConfig config;
1882
/* Do not publish any local Zeroconf records */
658
AvahiSServiceBrowser *sb = NULL;
662
int returncode = EXIT_SUCCESS;
663
const char *interface = NULL;
664
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
665
char *connect_to = NULL;
667
debug_int = debug ? 1 : 0;
669
static struct option long_options[] = {
670
{"debug", no_argument, &debug_int, 1},
671
{"connect", required_argument, NULL, 'C'},
672
{"interface", required_argument, NULL, 'i'},
673
{"keydir", required_argument, NULL, 'd'},
674
{"seckey", required_argument, NULL, 'c'},
675
{"pubkey", required_argument, NULL, 'k'},
676
{"dh-bits", required_argument, NULL, 'D'},
679
int option_index = 0;
680
ret = getopt_long (argc, argv, "i:", long_options,
706
dh_bits = atoi(optarg);
714
debug = debug_int ? true : false;
716
pubkeyfile = combinepath(keydir, pubkeyfile);
717
if (pubkeyfile == NULL){
718
perror("combinepath");
722
if(interface != NULL){
723
if_index = (AvahiIfIndex) if_nametoindex(interface);
725
fprintf(stderr, "No such interface: \"%s\"\n", interface);
730
if(connect_to != NULL){
731
/* Connect directly, do not use Zeroconf */
732
/* (Mainly meant for debugging) */
733
char *address = strrchr(connect_to, ':');
735
fprintf(stderr, "No colon in address\n");
739
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
741
perror("Bad port number");
745
address = connect_to;
746
ret = start_mandos_communication(address, port, if_index);
754
seckeyfile = combinepath(keydir, seckeyfile);
755
if (seckeyfile == NULL){
756
perror("combinepath");
761
avahi_set_log_function(empty_log);
764
/* Initialize the psuedo-RNG */
765
srand((unsigned int) time(NULL));
767
/* Allocate main loop object */
768
if (!(simple_poll = avahi_simple_poll_new())) {
769
fprintf(stderr, "Failed to create simple poll object.\n");
774
/* Do not publish any local records */
1883
775
avahi_server_config_init(&config);
1884
776
config.publish_hinfo = 0;
1885
777
config.publish_addresses = 0;
1886
778
config.publish_workstation = 0;
1887
779
config.publish_domain = 0;
1889
781
/* Allocate a new server */
1890
mc.server = avahi_server_new(avahi_simple_poll_get
1891
(mc.simple_poll), &config, NULL,
1894
/* Free the Avahi configuration data */
782
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
783
&config, NULL, NULL, &error);
785
/* Free the configuration data */
1895
786
avahi_server_config_free(&config);
1898
/* Check if creating the Avahi server object succeeded */
1899
if(mc.server == NULL){
1900
fprintf(stderr, "Failed to create Avahi server: %s\n",
1901
avahi_strerror(error));
1902
exitcode = EX_UNAVAILABLE;
1910
/* Create the Avahi service browser */
1911
sb = avahi_s_service_browser_new(mc.server, if_index,
1912
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1913
NULL, 0, browse_callback, NULL);
1915
fprintf(stderr, "Failed to create service browser: %s\n",
1916
avahi_strerror(avahi_server_errno(mc.server)));
1917
exitcode = EX_UNAVAILABLE;
1925
/* Run the main loop */
1928
fprintf(stderr, "Starting Avahi loop search\n");
1931
ret = avahi_loop_with_timeout(mc.simple_poll,
1932
(int)(retry_interval * 1000));
1934
fprintf(stderr, "avahi_loop_with_timeout exited %s\n",
1935
(ret == 0) ? "successfully" : "with error");
1941
fprintf(stderr, "%s exiting\n", argv[0]);
1944
/* Cleanup things */
1946
avahi_s_service_browser_free(sb);
1948
if(mc.server != NULL)
1949
avahi_server_free(mc.server);
1951
if(mc.simple_poll != NULL)
1952
avahi_simple_poll_free(mc.simple_poll);
1954
if(gnutls_initialized){
1955
gnutls_certificate_free_credentials(mc.cred);
1956
gnutls_global_deinit();
1957
gnutls_dh_params_deinit(mc.dh_params);
1960
if(gpgme_initialized){
1961
gpgme_release(mc.ctx);
1964
/* Cleans up the circular linked list of Mandos servers the client
1966
if(mc.current_server != NULL){
1967
mc.current_server->prev->next = NULL;
1968
while(mc.current_server != NULL){
1969
server *next = mc.current_server->next;
1970
free(mc.current_server);
1971
mc.current_server = next;
1975
/* Take down the network interface */
1976
if(take_down_interface){
1977
/* Re-raise priviliges */
1981
perror_plus("seteuid");
1984
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1986
perror_plus("ioctl SIOCGIFFLAGS");
1987
} else if(network.ifr_flags & IFF_UP) {
1988
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1989
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1991
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1994
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1996
perror_plus("close");
1998
/* Lower privileges permanently */
2002
perror_plus("setuid");
2007
/* Removes the GPGME temp directory and all files inside */
2008
if(tempdir_created){
2009
struct dirent **direntries = NULL;
2010
struct dirent *direntry = NULL;
2011
int numentries = scandir(tempdir, &direntries, notdotentries,
2013
if (numentries > 0){
2014
for(int i = 0; i < numentries; i++){
2015
direntry = direntries[i];
2016
char *fullname = NULL;
2017
ret = asprintf(&fullname, "%s/%s", tempdir,
2020
perror_plus("asprintf");
2023
ret = remove(fullname);
2025
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
2032
/* need to clean even if 0 because man page doesn't specify */
2034
if (numentries == -1){
2035
perror_plus("scandir");
2037
ret = rmdir(tempdir);
2038
if(ret == -1 and errno != ENOENT){
2039
perror_plus("rmdir");
2044
sigemptyset(&old_sigterm_action.sa_mask);
2045
old_sigterm_action.sa_handler = SIG_DFL;
2046
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2047
&old_sigterm_action,
2050
perror_plus("sigaction");
2053
ret = raise(signal_received);
2054
} while(ret != 0 and errno == EINTR);
2056
perror_plus("raise");
2059
TEMP_FAILURE_RETRY(pause());
788
/* Check if creating the server object succeeded */
790
fprintf(stderr, "Failed to create server: %s\n",
791
avahi_strerror(error));
792
returncode = EXIT_FAILURE;
796
/* Create the service browser */
797
sb = avahi_s_service_browser_new(server, if_index,
799
"_mandos._tcp", NULL, 0,
800
browse_callback, server);
802
fprintf(stderr, "Failed to create service browser: %s\n",
803
avahi_strerror(avahi_server_errno(server)));
804
returncode = EXIT_FAILURE;
808
/* Run the main loop */
811
fprintf(stderr, "Starting avahi loop search\n");
814
avahi_simple_poll_loop(simple_poll);
819
fprintf(stderr, "%s exiting\n", argv[0]);
824
avahi_s_service_browser_free(sb);
827
avahi_server_free(server);
830
avahi_simple_poll_free(simple_poll);