To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 397
- compare with another revision
- download diff
- download tarball
- view history from revision 397
- Committer: Teddy Hogeborn
- Date: 2009-10-30 16:23:43 UTC
- Revision ID: teddy@fukt.bsnet.se-20091030162343-1p2a8bf3gc084kc9
* plugins.d/password-prompt.c: Use environment variables and prompt
text from cryptsetup 1.1.
* plugins.d/password-prompt.xml (ENVIRONMENT): Document change in
environment variables
used.
text from cryptsetup 1.1.
* plugins.d/password-prompt.xml (ENVIRONMENT): Document change in
environment variables
used.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
29
30
*/
30
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
32
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
33
37
#define _FILE_OFFSET_BITS 64
34
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
37
#include <stdio.h>
38
#include <assert.h>
39
#include <stdlib.h>
40
#include <time.h>
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
43
#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
44
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE */
86
87
#ifdef __linux__
88
#include <sys/klog.h> /* klogctl() */
89
#endif /* __linux__ */
90
91
/* Avahi */
92
/* All Avahi types, constants and functions
93
Avahi*, avahi_*,
94
AVAHI_* */
45
95
#include <avahi-core/core.h>
46
96
#include <avahi-core/lookup.h>
47
97
#include <avahi-core/log.h>
49
99
#include <avahi-common/malloc.h>
50
100
#include <avahi-common/error.h>
51
101
52
//mandos client part
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
58
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
65
66
// gpgme
67
#include <errno.h> /* perror() */
68
#include <gpgme.h>
69
70
// getopt long
71
#include <getopt.h>
102
/* GnuTLS */
103
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
104
functions:
105
gnutls_*
106
init_gnutls_session(),
107
GNUTLS_* */
108
#include <gnutls/openpgp.h>
109
/* gnutls_certificate_set_openpgp_key_file(),
110
GNUTLS_OPENPGP_FMT_BASE64 */
111
112
/* GPGME */
113
#include <gpgme.h> /* All GPGME types, constants and
114
functions:
115
gpgme_*
116
GPGME_PROTOCOL_OpenPGP,
117
GPG_ERR_NO_* */
72
118
73
119
#define BUFFER_SIZE 256
74
#define DH_BITS 1024
75
120
76
static const char *certdir = "/conf/conf.d/mandos";
77
static const char *certfile = "openpgp-client.txt";
78
static const char *certkey = "openpgp-client-key.txt";
121
#define PATHDIR "/conf/conf.d/mandos"
122
#define SECKEY "seckey.txt"
123
#define PUBKEY "pubkey.txt"
79
124
80
125
bool debug = false;
81
82
const char mandos_protocol_version[] = "1";
83
126
static const char mandos_protocol_version[] = "1";
127
const char *argp_program_version = "mandos-client " VERSION;
128
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
129
130
/* Used for passing in values through the Avahi callback functions */
84
131
typedef struct {
85
132
AvahiSimplePoll *simple_poll;
86
133
AvahiServer *server;
87
134
gnutls_certificate_credentials_t cred;
88
135
unsigned int dh_bits;
136
gnutls_dh_params_t dh_params;
89
137
const char *priority;
138
gpgme_ctx_t ctx;
90
139
} mandos_context;
91
140
92
size_t adjustbuffer(char *buffer, size_t buffer_length,
141
/* global context so signal handler can reach it*/
142
mandos_context mc = { .simple_poll = NULL, .server = NULL,
143
.dh_bits = 1024, .priority = "SECURE256"
144
":!CTYPE-X.509:+CTYPE-OPENPGP" };
145
146
sig_atomic_t quit_now = 0;
147
int signal_received = 0;
148
149
/*
150
* Make additional room in "buffer" for at least BUFFER_SIZE more
151
* bytes. "buffer_capacity" is how much is currently allocated,
152
* "buffer_length" is how much is already used.
153
*/
154
size_t incbuffer(char **buffer, size_t buffer_length,
93
155
size_t buffer_capacity){
94
if (buffer_length + BUFFER_SIZE > buffer_capacity){
95
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
96
if (buffer == NULL){
156
if(buffer_length + BUFFER_SIZE > buffer_capacity){
157
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
158
if(buffer == NULL){
97
159
return 0;
98
160
}
99
161
buffer_capacity += BUFFER_SIZE;
101
163
return buffer_capacity;
102
164
}
103
165
104
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
105
char **new_packet,
106
const char *homedir){
107
gpgme_data_t dh_crypto, dh_plain;
108
gpgme_ctx_t ctx;
166
/*
167
* Initialize GPGME.
168
*/
169
static bool init_gpgme(const char *seckey,
170
const char *pubkey, const char *tempdir){
109
171
gpgme_error_t rc;
110
ssize_t ret;
111
size_t new_packet_capacity = 0;
112
ssize_t new_packet_length = 0;
113
172
gpgme_engine_info_t engine_info;
114
115
if (debug){
116
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
173
174
175
/*
176
* Helper function to insert pub and seckey to the engine keyring.
177
*/
178
bool import_key(const char *filename){
179
int ret;
180
int fd;
181
gpgme_data_t pgp_data;
182
183
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
184
if(fd == -1){
185
perror("open");
186
return false;
187
}
188
189
rc = gpgme_data_new_from_fd(&pgp_data, fd);
190
if(rc != GPG_ERR_NO_ERROR){
191
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
192
gpgme_strsource(rc), gpgme_strerror(rc));
193
return false;
194
}
195
196
rc = gpgme_op_import(mc.ctx, pgp_data);
197
if(rc != GPG_ERR_NO_ERROR){
198
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
199
gpgme_strsource(rc), gpgme_strerror(rc));
200
return false;
201
}
202
203
ret = (int)TEMP_FAILURE_RETRY(close(fd));
204
if(ret == -1){
205
perror("close");
206
}
207
gpgme_data_release(pgp_data);
208
return true;
209
}
210
211
if(debug){
212
fprintf(stderr, "Initializing GPGME\n");
117
213
}
118
214
119
215
/* Init GPGME */
120
216
gpgme_check_version(NULL);
121
217
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
122
if (rc != GPG_ERR_NO_ERROR){
218
if(rc != GPG_ERR_NO_ERROR){
123
219
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
124
220
gpgme_strsource(rc), gpgme_strerror(rc));
125
return -1;
221
return false;
126
222
}
127
223
128
/* Set GPGME home directory */
129
rc = gpgme_get_engine_info (&engine_info);
130
if (rc != GPG_ERR_NO_ERROR){
224
/* Set GPGME home directory for the OpenPGP engine only */
225
rc = gpgme_get_engine_info(&engine_info);
226
if(rc != GPG_ERR_NO_ERROR){
131
227
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
132
228
gpgme_strsource(rc), gpgme_strerror(rc));
133
return -1;
229
return false;
134
230
}
135
231
while(engine_info != NULL){
136
232
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
137
233
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
138
engine_info->file_name, homedir);
234
engine_info->file_name, tempdir);
139
235
break;
140
236
}
141
237
engine_info = engine_info->next;
142
238
}
143
239
if(engine_info == NULL){
144
fprintf(stderr, "Could not set home dir to %s\n", homedir);
145
return -1;
146
}
147
148
/* Create new GPGME data buffer from packet buffer */
149
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
150
if (rc != GPG_ERR_NO_ERROR){
240
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
241
return false;
242
}
243
244
/* Create new GPGME "context" */
245
rc = gpgme_new(&(mc.ctx));
246
if(rc != GPG_ERR_NO_ERROR){
247
fprintf(stderr, "bad gpgme_new: %s: %s\n",
248
gpgme_strsource(rc), gpgme_strerror(rc));
249
return false;
250
}
251
252
if(not import_key(pubkey) or not import_key(seckey)){
253
return false;
254
}
255
256
return true;
257
}
258
259
/*
260
* Decrypt OpenPGP data.
261
* Returns -1 on error
262
*/
263
static ssize_t pgp_packet_decrypt(const char *cryptotext,
264
size_t crypto_size,
265
char **plaintext){
266
gpgme_data_t dh_crypto, dh_plain;
267
gpgme_error_t rc;
268
ssize_t ret;
269
size_t plaintext_capacity = 0;
270
ssize_t plaintext_length = 0;
271
272
if(debug){
273
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
274
}
275
276
/* Create new GPGME data buffer from memory cryptotext */
277
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
278
0);
279
if(rc != GPG_ERR_NO_ERROR){
151
280
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
152
281
gpgme_strsource(rc), gpgme_strerror(rc));
153
282
return -1;
155
284
156
285
/* Create new empty GPGME data buffer for the plaintext */
157
286
rc = gpgme_data_new(&dh_plain);
158
if (rc != GPG_ERR_NO_ERROR){
287
if(rc != GPG_ERR_NO_ERROR){
159
288
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
160
289
gpgme_strsource(rc), gpgme_strerror(rc));
161
return -1;
162
}
163
164
/* Create new GPGME "context" */
165
rc = gpgme_new(&ctx);
166
if (rc != GPG_ERR_NO_ERROR){
167
fprintf(stderr, "bad gpgme_new: %s: %s\n",
168
gpgme_strsource(rc), gpgme_strerror(rc));
169
return -1;
170
}
171
172
/* Decrypt data from the FILE pointer to the plaintext data
173
buffer */
174
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
175
if (rc != GPG_ERR_NO_ERROR){
290
gpgme_data_release(dh_crypto);
291
return -1;
292
}
293
294
/* Decrypt data from the cryptotext data buffer to the plaintext
295
data buffer */
296
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
297
if(rc != GPG_ERR_NO_ERROR){
176
298
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
177
299
gpgme_strsource(rc), gpgme_strerror(rc));
178
return -1;
179
}
180
181
if(debug){
182
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
183
}
184
185
if (debug){
186
gpgme_decrypt_result_t result;
187
result = gpgme_op_decrypt_result(ctx);
188
if (result == NULL){
189
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
190
} else {
191
fprintf(stderr, "Unsupported algorithm: %s\n",
192
result->unsupported_algorithm);
193
fprintf(stderr, "Wrong key usage: %d\n",
194
result->wrong_key_usage);
195
if(result->file_name != NULL){
196
fprintf(stderr, "File name: %s\n", result->file_name);
197
}
198
gpgme_recipient_t recipient;
199
recipient = result->recipients;
200
if(recipient){
300
plaintext_length = -1;
301
if(debug){
302
gpgme_decrypt_result_t result;
303
result = gpgme_op_decrypt_result(mc.ctx);
304
if(result == NULL){
305
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
306
} else {
307
fprintf(stderr, "Unsupported algorithm: %s\n",
308
result->unsupported_algorithm);
309
fprintf(stderr, "Wrong key usage: %u\n",
310
result->wrong_key_usage);
311
if(result->file_name != NULL){
312
fprintf(stderr, "File name: %s\n", result->file_name);
313
}
314
gpgme_recipient_t recipient;
315
recipient = result->recipients;
201
316
while(recipient != NULL){
202
317
fprintf(stderr, "Public key algorithm: %s\n",
203
318
gpgme_pubkey_algo_name(recipient->pubkey_algo));
209
324
}
210
325
}
211
326
}
327
goto decrypt_end;
212
328
}
213
329
214
/* Delete the GPGME FILE pointer cryptotext data buffer */
215
gpgme_data_release(dh_crypto);
330
if(debug){
331
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
332
}
216
333
217
334
/* Seek back to the beginning of the GPGME plaintext data buffer */
218
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
219
perror("pgpme_data_seek");
335
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
336
perror("gpgme_data_seek");
337
plaintext_length = -1;
338
goto decrypt_end;
220
339
}
221
340
222
*new_packet = 0;
341
*plaintext = NULL;
223
342
while(true){
224
new_packet_capacity = adjustbuffer(*new_packet, new_packet_length,
225
new_packet_capacity);
226
if (new_packet_capacity == 0){
227
perror("adjustbuffer");
228
return -1;
229
}
230
new_packet_capacity += BUFFER_SIZE;
343
plaintext_capacity = incbuffer(plaintext,
344
(size_t)plaintext_length,
345
plaintext_capacity);
346
if(plaintext_capacity == 0){
347
perror("incbuffer");
348
plaintext_length = -1;
349
goto decrypt_end;
231
350
}
232
351
233
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
352
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
234
353
BUFFER_SIZE);
235
354
/* Print the data, if any */
236
if (ret == 0){
355
if(ret == 0){
356
/* EOF */
237
357
break;
238
358
}
239
359
if(ret < 0){
240
360
perror("gpgme_data_read");
241
return -1;
242
}
243
new_packet_length += ret;
244
}
245
246
/* FIXME: check characters before printing to screen so to not print
247
terminal control characters */
248
/* if(debug){ */
249
/* fprintf(stderr, "decrypted password is: "); */
250
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
251
/* fprintf(stderr, "\n"); */
252
/* } */
361
plaintext_length = -1;
362
goto decrypt_end;
363
}
364
plaintext_length += ret;
365
}
366
367
if(debug){
368
fprintf(stderr, "Decrypted password is: ");
369
for(ssize_t i = 0; i < plaintext_length; i++){
370
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
371
}
372
fprintf(stderr, "\n");
373
}
374
375
decrypt_end:
376
377
/* Delete the GPGME cryptotext data buffer */
378
gpgme_data_release(dh_crypto);
253
379
254
380
/* Delete the GPGME plaintext data buffer */
255
381
gpgme_data_release(dh_plain);
256
return new_packet_length;
382
return plaintext_length;
257
383
}
258
384
259
static const char * safer_gnutls_strerror (int value) {
260
const char *ret = gnutls_strerror (value);
261
if (ret == NULL)
385
static const char * safer_gnutls_strerror(int value){
386
const char *ret = gnutls_strerror(value); /* Spurious warning from
387
-Wunreachable-code */
388
if(ret == NULL)
262
389
ret = "(unknown)";
263
390
return ret;
264
391
}
265
392
393
/* GnuTLS log function callback */
266
394
static void debuggnutls(__attribute__((unused)) int level,
267
395
const char* string){
268
fprintf(stderr, "%s", string);
396
fprintf(stderr, "GnuTLS: %s", string);
269
397
}
270
398
271
static int initgnutls(mandos_context *mc){
272
const char *err;
399
static int init_gnutls_global(const char *pubkeyfilename,
400
const char *seckeyfilename){
273
401
int ret;
274
402
275
403
if(debug){
276
404
fprintf(stderr, "Initializing GnuTLS\n");
277
405
}
278
279
if ((ret = gnutls_global_init ())
280
!= GNUTLS_E_SUCCESS) {
281
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
406
407
ret = gnutls_global_init();
408
if(ret != GNUTLS_E_SUCCESS){
409
fprintf(stderr, "GnuTLS global_init: %s\n",
410
safer_gnutls_strerror(ret));
282
411
return -1;
283
412
}
284
285
if (debug){
413
414
if(debug){
415
/* "Use a log level over 10 to enable all debugging options."
416
* - GnuTLS manual
417
*/
286
418
gnutls_global_set_log_level(11);
287
419
gnutls_global_set_log_function(debuggnutls);
288
420
}
289
421
290
/* openpgp credentials */
291
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
292
!= GNUTLS_E_SUCCESS) {
293
fprintf (stderr, "memory error: %s\n",
294
safer_gnutls_strerror(ret));
422
/* OpenPGP credentials */
423
gnutls_certificate_allocate_credentials(&mc.cred);
424
if(ret != GNUTLS_E_SUCCESS){
425
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
426
from
427
-Wunreachable-code
428
*/
429
safer_gnutls_strerror(ret));
430
gnutls_global_deinit();
295
431
return -1;
296
432
}
297
433
298
434
if(debug){
299
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
300
" and keyfile %s as GnuTLS credentials\n", certfile,
301
certkey);
435
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
436
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
437
seckeyfilename);
302
438
}
303
439
304
440
ret = gnutls_certificate_set_openpgp_key_file
305
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
306
if (ret != GNUTLS_E_SUCCESS) {
307
fprintf
308
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
309
" '%s')\n",
310
ret, certfile, certkey);
311
fprintf(stdout, "The Error is: %s\n",
312
safer_gnutls_strerror(ret));
313
return -1;
314
}
315
316
//GnuTLS server initialization
317
if ((ret = gnutls_dh_params_init (&es->dh_params))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf (stderr, "Error in dh parameter initialization: %s\n",
320
safer_gnutls_strerror(ret));
321
return -1;
322
}
323
324
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
325
!= GNUTLS_E_SUCCESS) {
326
fprintf (stderr, "Error in prime generation: %s\n",
327
safer_gnutls_strerror(ret));
328
return -1;
329
}
330
331
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
332
333
// GnuTLS session creation
334
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
335
!= GNUTLS_E_SUCCESS){
441
(mc.cred, pubkeyfilename, seckeyfilename,
442
GNUTLS_OPENPGP_FMT_BASE64);
443
if(ret != GNUTLS_E_SUCCESS){
444
fprintf(stderr,
445
"Error[%d] while reading the OpenPGP key pair ('%s',"
446
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
447
fprintf(stderr, "The GnuTLS error is: %s\n",
448
safer_gnutls_strerror(ret));
449
goto globalfail;
450
}
451
452
/* GnuTLS server initialization */
453
ret = gnutls_dh_params_init(&mc.dh_params);
454
if(ret != GNUTLS_E_SUCCESS){
455
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
456
" %s\n", safer_gnutls_strerror(ret));
457
goto globalfail;
458
}
459
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
460
if(ret != GNUTLS_E_SUCCESS){
461
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
462
safer_gnutls_strerror(ret));
463
goto globalfail;
464
}
465
466
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
467
468
return 0;
469
470
globalfail:
471
472
gnutls_certificate_free_credentials(mc.cred);
473
gnutls_global_deinit();
474
gnutls_dh_params_deinit(mc.dh_params);
475
return -1;
476
}
477
478
static int init_gnutls_session(gnutls_session_t *session){
479
int ret;
480
/* GnuTLS session creation */
481
do {
482
ret = gnutls_init(session, GNUTLS_SERVER);
483
if(quit_now){
484
return -1;
485
}
486
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
487
if(ret != GNUTLS_E_SUCCESS){
336
488
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
337
489
safer_gnutls_strerror(ret));
338
490
}
339
491
340
if ((ret = gnutls_priority_set_direct (es->session, mc->priority, &err))
341
!= GNUTLS_E_SUCCESS) {
342
fprintf(stderr, "Syntax error at: %s\n", err);
343
fprintf(stderr, "GnuTLS error: %s\n",
344
safer_gnutls_strerror(ret));
345
return -1;
492
{
493
const char *err;
494
do {
495
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
496
if(quit_now){
497
gnutls_deinit(*session);
498
return -1;
499
}
500
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
501
if(ret != GNUTLS_E_SUCCESS){
502
fprintf(stderr, "Syntax error at: %s\n", err);
503
fprintf(stderr, "GnuTLS error: %s\n",
504
safer_gnutls_strerror(ret));
505
gnutls_deinit(*session);
506
return -1;
507
}
346
508
}
347
509
348
if ((ret = gnutls_credentials_set
349
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
350
!= GNUTLS_E_SUCCESS) {
351
fprintf(stderr, "Error setting a credentials set: %s\n",
510
do {
511
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
512
mc.cred);
513
if(quit_now){
514
gnutls_deinit(*session);
515
return -1;
516
}
517
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
518
if(ret != GNUTLS_E_SUCCESS){
519
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
352
520
safer_gnutls_strerror(ret));
521
gnutls_deinit(*session);
353
522
return -1;
354
523
}
355
524
356
525
/* ignore client certificate if any. */
357
gnutls_certificate_server_set_request (es->session,
358
GNUTLS_CERT_IGNORE);
526
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
359
527
360
gnutls_dh_set_prime_bits (es->session, DH_BITS);
528
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
361
529
362
530
return 0;
363
531
}
364
532
533
/* Avahi log function callback */
365
534
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
366
535
__attribute__((unused)) const char *txt){}
367
536
537
/* Called when a Mandos server is found */
368
538
static int start_mandos_communication(const char *ip, uint16_t port,
369
539
AvahiIfIndex if_index,
370
mandos_context *mc){
371
int ret, tcp_sd;
372
struct sockaddr_in6 to;
373
encrypted_session es;
540
int af){
541
int ret, tcp_sd = -1;
542
ssize_t sret;
543
union {
544
struct sockaddr_in in;
545
struct sockaddr_in6 in6;
546
} to;
374
547
char *buffer = NULL;
375
char *decrypted_buffer;
548
char *decrypted_buffer = NULL;
376
549
size_t buffer_length = 0;
377
550
size_t buffer_capacity = 0;
378
ssize_t decrypted_buffer_size;
379
551
size_t written;
380
int retval = 0;
381
char interface[IF_NAMESIZE];
552
int retval = -1;
553
gnutls_session_t session;
554
int pf; /* Protocol family */
555
556
if(quit_now){
557
return -1;
558
}
559
560
switch(af){
561
case AF_INET6:
562
pf = PF_INET6;
563
break;
564
case AF_INET:
565
pf = PF_INET;
566
break;
567
default:
568
fprintf(stderr, "Bad address family: %d\n", af);
569
return -1;
570
}
571
572
ret = init_gnutls_session(&session);
573
if(ret != 0){
574
return -1;
575
}
382
576
383
577
if(debug){
384
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
385
ip, port);
578
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
579
"\n", ip, port);
386
580
}
387
581
388
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
389
if(tcp_sd < 0) {
582
tcp_sd = socket(pf, SOCK_STREAM, 0);
583
if(tcp_sd < 0){
390
584
perror("socket");
391
return -1;
392
}
393
394
if(debug){
395
if(if_indextoname((unsigned int)if_index, interface) == NULL){
396
if(debug){
397
perror("if_indextoname");
398
}
399
return -1;
400
}
401
402
fprintf(stderr, "Binding to interface %s\n", interface);
403
}
404
405
memset(&to,0,sizeof(to)); /* Spurious warning */
406
to.sin6_family = AF_INET6;
407
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
408
if (ret < 0 ){
585
goto mandos_end;
586
}
587
588
if(quit_now){
589
goto mandos_end;
590
}
591
592
memset(&to, 0, sizeof(to));
593
if(af == AF_INET6){
594
to.in6.sin6_family = (sa_family_t)af;
595
ret = inet_pton(af, ip, &to.in6.sin6_addr);
596
} else { /* IPv4 */
597
to.in.sin_family = (sa_family_t)af;
598
ret = inet_pton(af, ip, &to.in.sin_addr);
599
}
600
if(ret < 0 ){
409
601
perror("inet_pton");
410
return -1;
411
}
602
goto mandos_end;
603
}
412
604
if(ret == 0){
413
605
fprintf(stderr, "Bad address: %s\n", ip);
414
return -1;
415
}
416
to.sin6_port = htons(port); /* Spurious warning */
606
goto mandos_end;
607
}
608
if(af == AF_INET6){
609
to.in6.sin6_port = htons(port); /* Spurious warnings from
610
-Wconversion and
611
-Wunreachable-code */
612
613
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
614
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
615
-Wunreachable-code*/
616
if(if_index == AVAHI_IF_UNSPEC){
617
fprintf(stderr, "An IPv6 link-local address is incomplete"
618
" without a network interface\n");
619
goto mandos_end;
620
}
621
/* Set the network interface number as scope */
622
to.in6.sin6_scope_id = (uint32_t)if_index;
623
}
624
} else {
625
to.in.sin_port = htons(port); /* Spurious warnings from
626
-Wconversion and
627
-Wunreachable-code */
628
}
417
629
418
to.sin6_scope_id = (uint32_t)if_index;
630
if(quit_now){
631
goto mandos_end;
632
}
419
633
420
634
if(debug){
421
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
422
/* char addrstr[INET6_ADDRSTRLEN]; */
423
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
424
/* sizeof(addrstr)) == NULL){ */
425
/* perror("inet_ntop"); */
426
/* } else { */
427
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
428
/* addrstr, ntohs(to.sin6_port)); */
429
/* } */
430
}
431
432
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
433
if (ret < 0){
635
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
636
char interface[IF_NAMESIZE];
637
if(if_indextoname((unsigned int)if_index, interface) == NULL){
638
perror("if_indextoname");
639
} else {
640
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
641
ip, interface, port);
642
}
643
} else {
644
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
645
port);
646
}
647
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
648
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
649
const char *pcret;
650
if(af == AF_INET6){
651
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
652
sizeof(addrstr));
653
} else {
654
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
655
sizeof(addrstr));
656
}
657
if(pcret == NULL){
658
perror("inet_ntop");
659
} else {
660
if(strcmp(addrstr, ip) != 0){
661
fprintf(stderr, "Canonical address form: %s\n", addrstr);
662
}
663
}
664
}
665
666
if(quit_now){
667
goto mandos_end;
668
}
669
670
if(af == AF_INET6){
671
ret = connect(tcp_sd, &to.in6, sizeof(to));
672
} else {
673
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
674
}
675
if(ret < 0){
434
676
perror("connect");
435
return -1;
436
}
437
438
char *out = mandos_protocol_version;
677
goto mandos_end;
678
}
679
680
if(quit_now){
681
goto mandos_end;
682
}
683
684
const char *out = mandos_protocol_version;
439
685
written = 0;
440
while (true){
686
while(true){
441
687
size_t out_size = strlen(out);
442
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
688
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
443
689
out_size - written));
444
if (ret == -1){
690
if(ret == -1){
445
691
perror("write");
446
retval = -1;
447
goto end;
692
goto mandos_end;
448
693
}
449
written += ret;
694
written += (size_t)ret;
450
695
if(written < out_size){
451
696
continue;
452
697
} else {
453
if (out == mandos_protocol_version){
698
if(out == mandos_protocol_version){
454
699
written = 0;
455
700
out = "\r\n";
456
701
} else {
457
702
break;
458
703
}
459
704
}
460
}
461
462
ret = initgnutls (&es);
463
if (ret != 0){
464
retval = -1;
465
return -1;
466
}
467
705
468
gnutls_transport_set_ptr (es.session,
469
(gnutls_transport_ptr_t) tcp_sd);
706
if(quit_now){
707
goto mandos_end;
708
}
709
}
470
710
471
711
if(debug){
472
712
fprintf(stderr, "Establishing TLS session with %s\n", ip);
473
713
}
474
714
475
ret = gnutls_handshake (es.session);
476
477
if (ret != GNUTLS_E_SUCCESS){
715
if(quit_now){
716
goto mandos_end;
717
}
718
719
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
720
721
if(quit_now){
722
goto mandos_end;
723
}
724
725
do {
726
ret = gnutls_handshake(session);
727
if(quit_now){
728
goto mandos_end;
729
}
730
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
731
732
if(ret != GNUTLS_E_SUCCESS){
478
733
if(debug){
479
fprintf(stderr, "\n*** Handshake failed ***\n");
480
gnutls_perror (ret);
734
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
735
gnutls_perror(ret);
481
736
}
482
retval = -1;
483
goto exit;
737
goto mandos_end;
484
738
}
485
739
486
//Retrieve OpenPGP packet that contains the wanted password
740
/* Read OpenPGP packet that contains the wanted password */
487
741
488
742
if(debug){
489
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
743
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
490
744
ip);
491
745
}
492
746
493
747
while(true){
494
buffer_capacity = adjustbuffer(buffer, buffer_length, buffer_capacity);
495
if (buffer_capacity == 0){
496
perror("adjustbuffer");
497
retval = -1;
498
goto exit;
499
}
500
501
ret = gnutls_record_recv
502
(es.session, buffer+buffer_length, BUFFER_SIZE);
503
if (ret == 0){
748
749
if(quit_now){
750
goto mandos_end;
751
}
752
753
buffer_capacity = incbuffer(&buffer, buffer_length,
754
buffer_capacity);
755
if(buffer_capacity == 0){
756
perror("incbuffer");
757
goto mandos_end;
758
}
759
760
if(quit_now){
761
goto mandos_end;
762
}
763
764
sret = gnutls_record_recv(session, buffer+buffer_length,
765
BUFFER_SIZE);
766
if(sret == 0){
504
767
break;
505
768
}
506
if (ret < 0){
507
switch(ret){
769
if(sret < 0){
770
switch(sret){
508
771
case GNUTLS_E_INTERRUPTED:
509
772
case GNUTLS_E_AGAIN:
510
773
break;
511
774
case GNUTLS_E_REHANDSHAKE:
512
ret = gnutls_handshake (es.session);
513
if (ret < 0){
514
fprintf(stderr, "\n*** Handshake failed ***\n");
515
gnutls_perror (ret);
516
retval = -1;
517
goto exit;
775
do {
776
ret = gnutls_handshake(session);
777
778
if(quit_now){
779
goto mandos_end;
780
}
781
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
782
if(ret < 0){
783
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
784
gnutls_perror(ret);
785
goto mandos_end;
518
786
}
519
787
break;
520
788
default:
521
789
fprintf(stderr, "Unknown error while reading data from"
522
" encrypted session with mandos server\n");
523
retval = -1;
524
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
525
goto exit;
790
" encrypted session with Mandos server\n");
791
gnutls_bye(session, GNUTLS_SHUT_RDWR);
792
goto mandos_end;
526
793
}
527
794
} else {
528
buffer_length += (size_t) ret;
529
}
530
}
531
532
if (buffer_length > 0){
795
buffer_length += (size_t) sret;
796
}
797
}
798
799
if(debug){
800
fprintf(stderr, "Closing TLS session\n");
801
}
802
803
if(quit_now){
804
goto mandos_end;
805
}
806
807
do {
808
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
809
if(quit_now){
810
goto mandos_end;
811
}
812
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
813
814
if(buffer_length > 0){
815
ssize_t decrypted_buffer_size;
533
816
decrypted_buffer_size = pgp_packet_decrypt(buffer,
534
817
buffer_length,
535
&decrypted_buffer,
536
certdir);
537
if (decrypted_buffer_size >= 0){
818
&decrypted_buffer);
819
if(decrypted_buffer_size >= 0){
820
538
821
written = 0;
539
822
while(written < (size_t) decrypted_buffer_size){
540
ret = (int)fwrite (decrypted_buffer + written, 1,
541
(size_t)decrypted_buffer_size - written,
542
stdout);
823
if(quit_now){
824
goto mandos_end;
825
}
826
827
ret = (int)fwrite(decrypted_buffer + written, 1,
828
(size_t)decrypted_buffer_size - written,
829
stdout);
543
830
if(ret == 0 and ferror(stdout)){
544
831
if(debug){
545
832
fprintf(stderr, "Error writing encrypted data: %s\n",
546
833
strerror(errno));
547
834
}
548
retval = -1;
549
break;
835
goto mandos_end;
550
836
}
551
837
written += (size_t)ret;
552
838
}
553
free(decrypted_buffer);
554
} else {
555
retval = -1;
839
retval = 0;
556
840
}
557
841
}
558
559
//shutdown procedure
560
561
if(debug){
562
fprintf(stderr, "Closing TLS session\n");
563
}
564
842
843
/* Shutdown procedure */
844
845
mandos_end:
846
free(decrypted_buffer);
565
847
free(buffer);
566
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
567
exit:
568
close(tcp_sd);
569
gnutls_deinit (es.session);
570
gnutls_certificate_free_credentials (es.cred);
571
gnutls_global_deinit ();
848
if(tcp_sd >= 0){
849
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
850
}
851
if(ret == -1){
852
perror("close");
853
}
854
gnutls_deinit(session);
855
if(quit_now){
856
retval = -1;
857
}
572
858
return retval;
573
859
}
574
860
575
static void resolve_callback( AvahiSServiceResolver *r,
576
AvahiIfIndex interface,
577
AVAHI_GCC_UNUSED AvahiProtocol protocol,
578
AvahiResolverEvent event,
579
const char *name,
580
const char *type,
581
const char *domain,
582
const char *host_name,
583
const AvahiAddress *address,
584
uint16_t port,
585
AVAHI_GCC_UNUSED AvahiStringList *txt,
586
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
587
AVAHI_GCC_UNUSED void* userdata) {
588
mandos_context *mc = userdata;
589
assert(r); /* Spurious warning */
861
static void resolve_callback(AvahiSServiceResolver *r,
862
AvahiIfIndex interface,
863
AvahiProtocol proto,
864
AvahiResolverEvent event,
865
const char *name,
866
const char *type,
867
const char *domain,
868
const char *host_name,
869
const AvahiAddress *address,
870
uint16_t port,
871
AVAHI_GCC_UNUSED AvahiStringList *txt,
872
AVAHI_GCC_UNUSED AvahiLookupResultFlags
873
flags,
874
AVAHI_GCC_UNUSED void* userdata){
875
assert(r);
590
876
591
877
/* Called whenever a service has been resolved successfully or
592
878
timed out */
593
879
594
switch (event) {
880
if(quit_now){
881
return;
882
}
883
884
switch(event){
595
885
default:
596
886
case AVAHI_RESOLVER_FAILURE:
597
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
598
" type '%s' in domain '%s': %s\n", name, type, domain,
599
avahi_strerror(avahi_server_errno(mc->server)));
887
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
888
" of type '%s' in domain '%s': %s\n", name, type, domain,
889
avahi_strerror(avahi_server_errno(mc.server)));
600
890
break;
601
891
602
892
case AVAHI_RESOLVER_FOUND:
604
894
char ip[AVAHI_ADDRESS_STR_MAX];
605
895
avahi_address_snprint(ip, sizeof(ip), address);
606
896
if(debug){
607
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
608
" port %d\n", name, host_name, ip, port);
897
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
898
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
899
ip, (intmax_t)interface, port);
609
900
}
610
int ret = start_mandos_communication(ip, port, interface, mc);
611
if (ret == 0){
612
exit(EXIT_SUCCESS);
901
int ret = start_mandos_communication(ip, port, interface,
902
avahi_proto_to_af(proto));
903
if(ret == 0){
904
avahi_simple_poll_quit(mc.simple_poll);
613
905
}
614
906
}
615
907
}
616
908
avahi_s_service_resolver_free(r);
617
909
}
618
910
619
static void browse_callback( AvahiSServiceBrowser *b,
620
AvahiIfIndex interface,
621
AvahiProtocol protocol,
622
AvahiBrowserEvent event,
623
const char *name,
624
const char *type,
625
const char *domain,
626
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
627
void* userdata) {
628
mandos_context *mc = userdata;
629
assert(b); /* Spurious warning */
911
static void browse_callback(AvahiSServiceBrowser *b,
912
AvahiIfIndex interface,
913
AvahiProtocol protocol,
914
AvahiBrowserEvent event,
915
const char *name,
916
const char *type,
917
const char *domain,
918
AVAHI_GCC_UNUSED AvahiLookupResultFlags
919
flags,
920
AVAHI_GCC_UNUSED void* userdata){
921
assert(b);
630
922
631
923
/* Called whenever a new services becomes available on the LAN or
632
924
is removed from the LAN */
633
925
634
switch (event) {
926
if(quit_now){
927
return;
928
}
929
930
switch(event){
635
931
default:
636
932
case AVAHI_BROWSER_FAILURE:
637
638
fprintf(stderr, "(Browser) %s\n",
639
avahi_strerror(avahi_server_errno(mc->server)));
640
avahi_simple_poll_quit(mc->simple_poll);
933
934
fprintf(stderr, "(Avahi browser) %s\n",
935
avahi_strerror(avahi_server_errno(mc.server)));
936
avahi_simple_poll_quit(mc.simple_poll);
641
937
return;
642
938
643
939
case AVAHI_BROWSER_NEW:
644
/* We ignore the returned resolver object. In the callback
645
function we free it. If the server is terminated before
646
the callback function is called the server will free
647
the resolver for us. */
648
649
if (!(avahi_s_service_resolver_new(mc->server, interface, protocol, name,
650
type, domain,
651
AVAHI_PROTO_INET6, 0,
652
resolve_callback, mc)))
653
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
654
avahi_strerror(avahi_server_errno(s)));
940
/* We ignore the returned Avahi resolver object. In the callback
941
function we free it. If the Avahi server is terminated before
942
the callback function is called the Avahi server will free the
943
resolver for us. */
944
945
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
946
name, type, domain, protocol, 0,
947
resolve_callback, NULL) == NULL)
948
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
949
name, avahi_strerror(avahi_server_errno(mc.server)));
655
950
break;
656
951
657
952
case AVAHI_BROWSER_REMOVE:
658
953
break;
659
954
660
955
case AVAHI_BROWSER_ALL_FOR_NOW:
661
956
case AVAHI_BROWSER_CACHE_EXHAUSTED:
957
if(debug){
958
fprintf(stderr, "No Mandos server found, still searching...\n");
959
}
662
960
break;
663
961
}
664
962
}
665
963
666
/* Combines file name and path and returns the malloced new
667
string. some sane checks could/should be added */
668
static const char *combinepath(const char *first, const char *second){
669
size_t f_len = strlen(first);
670
size_t s_len = strlen(second);
671
char *tmp = malloc(f_len + s_len + 2);
672
if (tmp == NULL){
673
return NULL;
674
}
675
if(f_len > 0){
676
memcpy(tmp, first, f_len);
677
}
678
tmp[f_len] = '/';
679
if(s_len > 0){
680
memcpy(tmp + f_len + 1, second, s_len);
681
}
682
tmp[f_len + 1 + s_len] = '\0';
683
return tmp;
964
/* stop main loop after sigterm has been called */
965
static void handle_sigterm(int sig){
966
if(quit_now){
967
return;
968
}
969
quit_now = 1;
970
signal_received = sig;
971
int old_errno = errno;
972
if(mc.simple_poll != NULL){
973
avahi_simple_poll_quit(mc.simple_poll);
974
}
975
errno = old_errno;
684
976
}
685
977
686
687
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
688
AvahiServerConfig config;
689
AvahiSServiceBrowser *sb = NULL;
690
int error;
691
int ret;
692
int returncode = EXIT_SUCCESS;
693
const char *interface = "eth0";
694
struct ifreq network;
695
int sd;
696
char *connect_to = NULL;
697
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
698
mandos_context mc = { .simple_poll = NULL, .server = NULL,
699
.dh_bits = 2048, .priority = "SECURE256"};
978
int main(int argc, char *argv[]){
979
AvahiSServiceBrowser *sb = NULL;
980
int error;
981
int ret;
982
intmax_t tmpmax;
983
char *tmp;
984
int exitcode = EXIT_SUCCESS;
985
const char *interface = "eth0";
986
struct ifreq network;
987
int sd = -1;
988
bool take_down_interface = false;
989
uid_t uid;
990
gid_t gid;
991
char *connect_to = NULL;
992
char tempdir[] = "/tmp/mandosXXXXXX";
993
bool tempdir_created = false;
994
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
995
const char *seckey = PATHDIR "/" SECKEY;
996
const char *pubkey = PATHDIR "/" PUBKEY;
997
998
bool gnutls_initialized = false;
999
bool gpgme_initialized = false;
1000
float delay = 2.5f;
1001
1002
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1003
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1004
1005
uid = getuid();
1006
gid = getgid();
1007
1008
/* Lower any group privileges we might have, just to be safe */
1009
errno = 0;
1010
ret = setgid(gid);
1011
if(ret == -1){
1012
perror("setgid");
1013
}
1014
1015
/* Lower user privileges (temporarily) */
1016
errno = 0;
1017
ret = seteuid(uid);
1018
if(ret == -1){
1019
perror("seteuid");
1020
}
1021
1022
if(quit_now){
1023
goto end;
1024
}
1025
1026
{
1027
struct argp_option options[] = {
1028
{ .name = "debug", .key = 128,
1029
.doc = "Debug mode", .group = 3 },
1030
{ .name = "connect", .key = 'c',
1031
.arg = "ADDRESS:PORT",
1032
.doc = "Connect directly to a specific Mandos server",
1033
.group = 1 },
1034
{ .name = "interface", .key = 'i',
1035
.arg = "NAME",
1036
.doc = "Network interface that will be used to search for"
1037
" Mandos servers",
1038
.group = 1 },
1039
{ .name = "seckey", .key = 's',
1040
.arg = "FILE",
1041
.doc = "OpenPGP secret key file base name",
1042
.group = 1 },
1043
{ .name = "pubkey", .key = 'p',
1044
.arg = "FILE",
1045
.doc = "OpenPGP public key file base name",
1046
.group = 2 },
1047
{ .name = "dh-bits", .key = 129,
1048
.arg = "BITS",
1049
.doc = "Bit length of the prime number used in the"
1050
" Diffie-Hellman key exchange",
1051
.group = 2 },
1052
{ .name = "priority", .key = 130,
1053
.arg = "STRING",
1054
.doc = "GnuTLS priority string for the TLS handshake",
1055
.group = 1 },
1056
{ .name = "delay", .key = 131,
1057
.arg = "SECONDS",
1058
.doc = "Maximum delay to wait for interface startup",
1059
.group = 2 },
1060
/*
1061
* These reproduce what we would get without ARGP_NO_HELP
1062
*/
1063
{ .name = "help", .key = '?',
1064
.doc = "Give this help list", .group = -1 },
1065
{ .name = "usage", .key = -3,
1066
.doc = "Give a short usage message", .group = -1 },
1067
{ .name = "version", .key = 'V',
1068
.doc = "Print program version", .group = -1 },
1069
{ .name = NULL }
1070
};
700
1071
701
while (true){
702
static struct option long_options[] = {
703
{"debug", no_argument, (int *)&debug, 1},
704
{"connect", required_argument, 0, 'C'},
705
{"interface", required_argument, 0, 'i'},
706
{"certdir", required_argument, 0, 'd'},
707
{"certkey", required_argument, 0, 'c'},
708
{"certfile", required_argument, 0, 'k'},
709
{"dh_bits", required_argument, 0, 'D'},
710
{"priority", required_argument, 0, 'p'},
711
{0, 0, 0, 0} };
712
713
int option_index = 0;
714
ret = getopt_long (argc, argv, "i:", long_options,
715
&option_index);
716
717
if (ret == -1){
718
break;
719
}
720
721
switch(ret){
722
case 0:
723
break;
724
case 'i':
725
interface = optarg;
726
break;
727
case 'C':
728
connect_to = optarg;
729
break;
730
case 'd':
731
certdir = optarg;
732
break;
733
case 'c':
734
certfile = optarg;
735
break;
736
case 'k':
737
certkey = optarg;
738
break;
739
case 'D':
740
{
741
long int tmp;
742
errno = 0;
743
tmp = strtol(optarg, NULL, 10);
744
if (errno == ERANGE){
745
perror("strtol");
746
exit(EXIT_FAILURE);
747
}
748
mc.dh_bits = tmp;
749
}
750
break;
751
case 'p':
752
mc.priority = optarg;
1072
error_t parse_opt(int key, char *arg,
1073
struct argp_state *state){
1074
errno = 0;
1075
switch(key){
1076
case 128: /* --debug */
1077
debug = true;
1078
break;
1079
case 'c': /* --connect */
1080
connect_to = arg;
1081
break;
1082
case 'i': /* --interface */
1083
interface = arg;
1084
break;
1085
case 's': /* --seckey */
1086
seckey = arg;
1087
break;
1088
case 'p': /* --pubkey */
1089
pubkey = arg;
1090
break;
1091
case 129: /* --dh-bits */
1092
errno = 0;
1093
tmpmax = strtoimax(arg, &tmp, 10);
1094
if(errno != 0 or tmp == arg or *tmp != '\0'
1095
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1096
argp_error(state, "Bad number of DH bits");
1097
}
1098
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1099
break;
1100
case 130: /* --priority */
1101
mc.priority = arg;
1102
break;
1103
case 131: /* --delay */
1104
errno = 0;
1105
delay = strtof(arg, &tmp);
1106
if(errno != 0 or tmp == arg or *tmp != '\0'){
1107
argp_error(state, "Bad delay");
1108
}
1109
break;
1110
/*
1111
* These reproduce what we would get without ARGP_NO_HELP
1112
*/
1113
case '?': /* --help */
1114
argp_state_help(state, state->out_stream,
1115
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1116
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1117
case -3: /* --usage */
1118
argp_state_help(state, state->out_stream,
1119
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1120
case 'V': /* --version */
1121
fprintf(state->out_stream, "%s\n", argp_program_version);
1122
exit(argp_err_exit_status);
753
1123
break;
754
1124
default:
755
exit(EXIT_FAILURE);
1125
return ARGP_ERR_UNKNOWN;
756
1126
}
757
}
758
759
certfile = combinepath(certdir, certfile);
760
if (certfile == NULL){
761
perror("combinepath");
762
returncode = EXIT_FAILURE;
763
goto exit;
764
}
765
766
certkey = combinepath(certdir, certkey);
767
if (certkey == NULL){
768
perror("combinepath");
769
returncode = EXIT_FAILURE;
770
goto exit;
771
}
772
1127
return errno;
1128
}
1129
1130
struct argp argp = { .options = options, .parser = parse_opt,
1131
.args_doc = "",
1132
.doc = "Mandos client -- Get and decrypt"
1133
" passwords from a Mandos server" };
1134
ret = argp_parse(&argp, argc, argv,
1135
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1136
switch(ret){
1137
case 0:
1138
break;
1139
case ENOMEM:
1140
default:
1141
errno = ret;
1142
perror("argp_parse");
1143
exitcode = EX_OSERR;
1144
goto end;
1145
case EINVAL:
1146
exitcode = EX_USAGE;
1147
goto end;
1148
}
1149
}
1150
1151
if(not debug){
1152
avahi_set_log_function(empty_log);
1153
}
1154
1155
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1156
from the signal handler */
1157
/* Initialize the pseudo-RNG for Avahi */
1158
srand((unsigned int) time(NULL));
1159
mc.simple_poll = avahi_simple_poll_new();
1160
if(mc.simple_poll == NULL){
1161
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1162
exitcode = EXIT_FAILURE;
1163
goto end;
1164
}
1165
1166
sigemptyset(&sigterm_action.sa_mask);
1167
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1168
if(ret == -1){
1169
perror("sigaddset");
1170
exitcode = EXIT_FAILURE;
1171
goto end;
1172
}
1173
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1174
if(ret == -1){
1175
perror("sigaddset");
1176
exitcode = EXIT_FAILURE;
1177
goto end;
1178
}
1179
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1180
if(ret == -1){
1181
perror("sigaddset");
1182
exitcode = EXIT_FAILURE;
1183
goto end;
1184
}
1185
/* Need to check if the handler is SIG_IGN before handling:
1186
| [[info:libc:Initial Signal Actions]] |
1187
| [[info:libc:Basic Signal Handling]] |
1188
*/
1189
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1190
if(ret == -1){
1191
perror("sigaction");
1192
return EXIT_FAILURE;
1193
}
1194
if(old_sigterm_action.sa_handler != SIG_IGN){
1195
ret = sigaction(SIGINT, &sigterm_action, NULL);
1196
if(ret == -1){
1197
perror("sigaction");
1198
exitcode = EXIT_FAILURE;
1199
goto end;
1200
}
1201
}
1202
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1203
if(ret == -1){
1204
perror("sigaction");
1205
return EXIT_FAILURE;
1206
}
1207
if(old_sigterm_action.sa_handler != SIG_IGN){
1208
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1209
if(ret == -1){
1210
perror("sigaction");
1211
exitcode = EXIT_FAILURE;
1212
goto end;
1213
}
1214
}
1215
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1216
if(ret == -1){
1217
perror("sigaction");
1218
return EXIT_FAILURE;
1219
}
1220
if(old_sigterm_action.sa_handler != SIG_IGN){
1221
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1222
if(ret == -1){
1223
perror("sigaction");
1224
exitcode = EXIT_FAILURE;
1225
goto end;
1226
}
1227
}
1228
1229
/* If the interface is down, bring it up */
1230
if(interface[0] != '\0'){
773
1231
if_index = (AvahiIfIndex) if_nametoindex(interface);
774
1232
if(if_index == 0){
775
1233
fprintf(stderr, "No such interface: \"%s\"\n", interface);
776
exit(EXIT_FAILURE);
777
}
778
779
if(connect_to != NULL){
780
/* Connect directly, do not use Zeroconf */
781
/* (Mainly meant for debugging) */
782
char *address = strrchr(connect_to, ':');
783
if(address == NULL){
784
fprintf(stderr, "No colon in address\n");
785
exit(EXIT_FAILURE);
786
}
787
errno = 0;
788
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
789
if(errno){
790
perror("Bad port number");
791
exit(EXIT_FAILURE);
792
}
793
*address = '\0';
794
address = connect_to;
795
ret = start_mandos_communication(address, port, if_index);
796
if(ret < 0){
797
exit(EXIT_FAILURE);
798
} else {
799
exit(EXIT_SUCCESS);
800
}
801
}
1234
exitcode = EXIT_FAILURE;
1235
goto end;
1236
}
1237
1238
if(quit_now){
1239
goto end;
1240
}
1241
1242
/* Re-raise priviliges */
1243
errno = 0;
1244
ret = seteuid(0);
1245
if(ret == -1){
1246
perror("seteuid");
1247
}
1248
1249
#ifdef __linux__
1250
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1251
messages about the network interface to mess up the prompt */
1252
ret = klogctl(8, NULL, 5);
1253
bool restore_loglevel = true;
1254
if(ret == -1){
1255
restore_loglevel = false;
1256
perror("klogctl");
1257
}
1258
#endif /* __linux__ */
802
1259
803
1260
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
804
if(sd < 0) {
1261
if(sd < 0){
805
1262
perror("socket");
806
returncode = EXIT_FAILURE;
807
goto exit;
1263
exitcode = EXIT_FAILURE;
1264
#ifdef __linux__
1265
if(restore_loglevel){
1266
ret = klogctl(7, NULL, 0);
1267
if(ret == -1){
1268
perror("klogctl");
1269
}
1270
}
1271
#endif /* __linux__ */
1272
/* Lower privileges */
1273
errno = 0;
1274
ret = seteuid(uid);
1275
if(ret == -1){
1276
perror("seteuid");
1277
}
1278
goto end;
808
1279
}
809
strcpy(network.ifr_name, interface);
1280
strcpy(network.ifr_name, interface);
810
1281
ret = ioctl(sd, SIOCGIFFLAGS, &network);
811
1282
if(ret == -1){
812
813
1283
perror("ioctl SIOCGIFFLAGS");
814
returncode = EXIT_FAILURE;
815
goto exit;
1284
#ifdef __linux__
1285
if(restore_loglevel){
1286
ret = klogctl(7, NULL, 0);
1287
if(ret == -1){
1288
perror("klogctl");
1289
}
1290
}
1291
#endif /* __linux__ */
1292
exitcode = EXIT_FAILURE;
1293
/* Lower privileges */
1294
errno = 0;
1295
ret = seteuid(uid);
1296
if(ret == -1){
1297
perror("seteuid");
1298
}
1299
goto end;
816
1300
}
817
1301
if((network.ifr_flags & IFF_UP) == 0){
818
1302
network.ifr_flags |= IFF_UP;
1303
take_down_interface = true;
819
1304
ret = ioctl(sd, SIOCSIFFLAGS, &network);
820
1305
if(ret == -1){
1306
take_down_interface = false;
821
1307
perror("ioctl SIOCSIFFLAGS");
822
returncode = EXIT_FAILURE;
823
goto exit;
824
}
825
}
826
close(sd);
827
828
if (not debug){
829
avahi_set_log_function(empty_log);
830
}
831
832
/* Initialize the psuedo-RNG */
833
srand((unsigned int) time(NULL));
834
835
/* Allocate main loop object */
836
if (!(mc.simple_poll = avahi_simple_poll_new())) {
837
fprintf(stderr, "Failed to create simple poll object.\n");
838
returncode = EXIT_FAILURE;
839
goto exit;
840
}
841
842
/* Do not publish any local records */
1308
exitcode = EXIT_FAILURE;
1309
#ifdef __linux__
1310
if(restore_loglevel){
1311
ret = klogctl(7, NULL, 0);
1312
if(ret == -1){
1313
perror("klogctl");
1314
}
1315
}
1316
#endif /* __linux__ */
1317
/* Lower privileges */
1318
errno = 0;
1319
ret = seteuid(uid);
1320
if(ret == -1){
1321
perror("seteuid");
1322
}
1323
goto end;
1324
}
1325
}
1326
/* sleep checking until interface is running */
1327
for(int i=0; i < delay * 4; i++){
1328
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1329
if(ret == -1){
1330
perror("ioctl SIOCGIFFLAGS");
1331
} else if(network.ifr_flags & IFF_RUNNING){
1332
break;
1333
}
1334
struct timespec sleeptime = { .tv_nsec = 250000000 };
1335
ret = nanosleep(&sleeptime, NULL);
1336
if(ret == -1 and errno != EINTR){
1337
perror("nanosleep");
1338
}
1339
}
1340
if(not take_down_interface){
1341
/* We won't need the socket anymore */
1342
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1343
if(ret == -1){
1344
perror("close");
1345
}
1346
}
1347
#ifdef __linux__
1348
if(restore_loglevel){
1349
/* Restores kernel loglevel to default */
1350
ret = klogctl(7, NULL, 0);
1351
if(ret == -1){
1352
perror("klogctl");
1353
}
1354
}
1355
#endif /* __linux__ */
1356
/* Lower privileges */
1357
errno = 0;
1358
if(take_down_interface){
1359
/* Lower privileges */
1360
ret = seteuid(uid);
1361
if(ret == -1){
1362
perror("seteuid");
1363
}
1364
} else {
1365
/* Lower privileges permanently */
1366
ret = setuid(uid);
1367
if(ret == -1){
1368
perror("setuid");
1369
}
1370
}
1371
}
1372
1373
if(quit_now){
1374
goto end;
1375
}
1376
1377
ret = init_gnutls_global(pubkey, seckey);
1378
if(ret == -1){
1379
fprintf(stderr, "init_gnutls_global failed\n");
1380
exitcode = EXIT_FAILURE;
1381
goto end;
1382
} else {
1383
gnutls_initialized = true;
1384
}
1385
1386
if(quit_now){
1387
goto end;
1388
}
1389
1390
tempdir_created = true;
1391
if(mkdtemp(tempdir) == NULL){
1392
tempdir_created = false;
1393
perror("mkdtemp");
1394
goto end;
1395
}
1396
1397
if(quit_now){
1398
goto end;
1399
}
1400
1401
if(not init_gpgme(pubkey, seckey, tempdir)){
1402
fprintf(stderr, "init_gpgme failed\n");
1403
exitcode = EXIT_FAILURE;
1404
goto end;
1405
} else {
1406
gpgme_initialized = true;
1407
}
1408
1409
if(quit_now){
1410
goto end;
1411
}
1412
1413
if(connect_to != NULL){
1414
/* Connect directly, do not use Zeroconf */
1415
/* (Mainly meant for debugging) */
1416
char *address = strrchr(connect_to, ':');
1417
if(address == NULL){
1418
fprintf(stderr, "No colon in address\n");
1419
exitcode = EXIT_FAILURE;
1420
goto end;
1421
}
1422
1423
if(quit_now){
1424
goto end;
1425
}
1426
1427
uint16_t port;
1428
errno = 0;
1429
tmpmax = strtoimax(address+1, &tmp, 10);
1430
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1431
or tmpmax != (uint16_t)tmpmax){
1432
fprintf(stderr, "Bad port number\n");
1433
exitcode = EXIT_FAILURE;
1434
goto end;
1435
}
1436
1437
if(quit_now){
1438
goto end;
1439
}
1440
1441
port = (uint16_t)tmpmax;
1442
*address = '\0';
1443
address = connect_to;
1444
/* Colon in address indicates IPv6 */
1445
int af;
1446
if(strchr(address, ':') != NULL){
1447
af = AF_INET6;
1448
} else {
1449
af = AF_INET;
1450
}
1451
1452
if(quit_now){
1453
goto end;
1454
}
1455
1456
ret = start_mandos_communication(address, port, if_index, af);
1457
if(ret < 0){
1458
exitcode = EXIT_FAILURE;
1459
} else {
1460
exitcode = EXIT_SUCCESS;
1461
}
1462
goto end;
1463
}
1464
1465
if(quit_now){
1466
goto end;
1467
}
1468
1469
{
1470
AvahiServerConfig config;
1471
/* Do not publish any local Zeroconf records */
843
1472
avahi_server_config_init(&config);
844
1473
config.publish_hinfo = 0;
845
1474
config.publish_addresses = 0;
846
1475
config.publish_workstation = 0;
847
1476
config.publish_domain = 0;
848
1477
849
1478
/* Allocate a new server */
850
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
851
&config, NULL, NULL, &error);
852
853
/* Free the configuration data */
1479
mc.server = avahi_server_new(avahi_simple_poll_get
1480
(mc.simple_poll), &config, NULL,
1481
NULL, &error);
1482
1483
/* Free the Avahi configuration data */
854
1484
avahi_server_config_free(&config);
855
856
/* Check if creating the server object succeeded */
857
if (!mc.server) {
858
fprintf(stderr, "Failed to create server: %s\n",
859
avahi_strerror(error));
860
returncode = EXIT_FAILURE;
861
goto exit;
862
}
863
864
/* Create the service browser */
865
sb = avahi_s_service_browser_new(mc.server, if_index,
866
AVAHI_PROTO_INET6,
867
"_mandos._tcp", NULL, 0,
868
browse_callback, &mc);
869
if (!sb) {
870
fprintf(stderr, "Failed to create service browser: %s\n",
871
avahi_strerror(avahi_server_errno(mc.server)));
872
returncode = EXIT_FAILURE;
873
goto exit;
874
}
875
876
/* Run the main loop */
877
878
if (debug){
879
fprintf(stderr, "Starting avahi loop search\n");
880
}
881
882
avahi_simple_poll_loop(simple_poll);
883
884
exit:
885
886
if (debug){
887
fprintf(stderr, "%s exiting\n", argv[0]);
888
}
889
890
/* Cleanup things */
891
if (sb)
892
avahi_s_service_browser_free(sb);
893
894
if (mc.server)
895
avahi_server_free(mc.server);
896
897
if (simple_poll)
898
avahi_simple_poll_free(simple_poll);
899
free(certfile);
900
free(certkey);
901
902
return returncode;
1485
}
1486
1487
/* Check if creating the Avahi server object succeeded */
1488
if(mc.server == NULL){
1489
fprintf(stderr, "Failed to create Avahi server: %s\n",
1490
avahi_strerror(error));
1491
exitcode = EXIT_FAILURE;
1492
goto end;
1493
}
1494
1495
if(quit_now){
1496
goto end;
1497
}
1498
1499
/* Create the Avahi service browser */
1500
sb = avahi_s_service_browser_new(mc.server, if_index,
1501
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1502
NULL, 0, browse_callback, NULL);
1503
if(sb == NULL){
1504
fprintf(stderr, "Failed to create service browser: %s\n",
1505
avahi_strerror(avahi_server_errno(mc.server)));
1506
exitcode = EXIT_FAILURE;
1507
goto end;
1508
}
1509
1510
if(quit_now){
1511
goto end;
1512
}
1513
1514
/* Run the main loop */
1515
1516
if(debug){
1517
fprintf(stderr, "Starting Avahi loop search\n");
1518
}
1519
1520
avahi_simple_poll_loop(mc.simple_poll);
1521
1522
end:
1523
1524
if(debug){
1525
fprintf(stderr, "%s exiting\n", argv[0]);
1526
}
1527
1528
/* Cleanup things */
1529
if(sb != NULL)
1530
avahi_s_service_browser_free(sb);
1531
1532
if(mc.server != NULL)
1533
avahi_server_free(mc.server);
1534
1535
if(mc.simple_poll != NULL)
1536
avahi_simple_poll_free(mc.simple_poll);
1537
1538
if(gnutls_initialized){
1539
gnutls_certificate_free_credentials(mc.cred);
1540
gnutls_global_deinit();
1541
gnutls_dh_params_deinit(mc.dh_params);
1542
}
1543
1544
if(gpgme_initialized){
1545
gpgme_release(mc.ctx);
1546
}
1547
1548
/* Take down the network interface */
1549
if(take_down_interface){
1550
/* Re-raise priviliges */
1551
errno = 0;
1552
ret = seteuid(0);
1553
if(ret == -1){
1554
perror("seteuid");
1555
}
1556
if(geteuid() == 0){
1557
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1558
if(ret == -1){
1559
perror("ioctl SIOCGIFFLAGS");
1560
} else if(network.ifr_flags & IFF_UP) {
1561
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1562
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1563
if(ret == -1){
1564
perror("ioctl SIOCSIFFLAGS");
1565
}
1566
}
1567
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1568
if(ret == -1){
1569
perror("close");
1570
}
1571
/* Lower privileges permanently */
1572
errno = 0;
1573
ret = setuid(uid);
1574
if(ret == -1){
1575
perror("setuid");
1576
}
1577
}
1578
}
1579
1580
/* Removes the temp directory used by GPGME */
1581
if(tempdir_created){
1582
DIR *d;
1583
struct dirent *direntry;
1584
d = opendir(tempdir);
1585
if(d == NULL){
1586
if(errno != ENOENT){
1587
perror("opendir");
1588
}
1589
} else {
1590
while(true){
1591
direntry = readdir(d);
1592
if(direntry == NULL){
1593
break;
1594
}
1595
/* Skip "." and ".." */
1596
if(direntry->d_name[0] == '.'
1597
and (direntry->d_name[1] == '\0'
1598
or (direntry->d_name[1] == '.'
1599
and direntry->d_name[2] == '\0'))){
1600
continue;
1601
}
1602
char *fullname = NULL;
1603
ret = asprintf(&fullname, "%s/%s", tempdir,
1604
direntry->d_name);
1605
if(ret < 0){
1606
perror("asprintf");
1607
continue;
1608
}
1609
ret = remove(fullname);
1610
if(ret == -1){
1611
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1612
strerror(errno));
1613
}
1614
free(fullname);
1615
}
1616
closedir(d);
1617
}
1618
ret = rmdir(tempdir);
1619
if(ret == -1 and errno != ENOENT){
1620
perror("rmdir");
1621
}
1622
}
1623
1624
if(quit_now){
1625
sigemptyset(&old_sigterm_action.sa_mask);
1626
old_sigterm_action.sa_handler = SIG_DFL;
1627
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1628
&old_sigterm_action,
1629
NULL));
1630
if(ret == -1){
1631
perror("sigaction");
1632
}
1633
do {
1634
ret = raise(signal_received);
1635
} while(ret != 0 and errno == EINTR);
1636
if(ret != 0){
1637
perror("raise");
1638
abort();
1639
}
1640
TEMP_FAILURE_RETRY(pause());
1641
}
1642
1643
return exitcode;
903
1644
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0