46
103
#include <avahi-common/malloc.h>
47
104
#include <avahi-common/error.h>
50
#include <sys/types.h> /* socket(), inet_pton() */
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
52
struct in6_addr, inet_pton() */
53
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
54
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
#include <unistd.h> /* close() */
57
#include <netinet/in.h>
58
#include <stdbool.h> /* true */
59
#include <string.h> /* memset */
60
#include <arpa/inet.h> /* inet_pton() */
61
#include <iso646.h> /* not */
64
#include <errno.h> /* perror() */
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
107
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
110
init_gnutls_session(),
112
#include <gnutls/openpgp.h>
113
/* gnutls_certificate_set_openpgp_key_file(),
114
GNUTLS_OPENPGP_FMT_BASE64 */
117
#include <gpgme.h> /* All GPGME types, constants and
120
GPGME_PROTOCOL_OpenPGP,
75
123
#define BUFFER_SIZE 256
125
#define PATHDIR "/conf/conf.d/mandos"
126
#define SECKEY "seckey.txt"
127
#define PUBKEY "pubkey.txt"
128
#define HOOKDIR "/lib/mandos/network-hooks.d"
78
130
bool debug = false;
131
static const char mandos_protocol_version[] = "1";
132
const char *argp_program_version = "mandos-client " VERSION;
133
const char *argp_program_bug_address = "<mandos@recompile.se>";
134
static const char sys_class_net[] = "/sys/class/net";
135
char *connect_to = NULL;
136
const char *hookdir = HOOKDIR;
138
/* Doubly linked list that need to be circularly linked when used */
139
typedef struct server{
142
AvahiIfIndex if_index;
144
struct timespec last_seen;
149
/* Used for passing in values through the Avahi callback functions */
81
gnutls_session_t session;
151
AvahiSimplePoll *simple_poll;
82
153
gnutls_certificate_credentials_t cred;
154
unsigned int dh_bits;
83
155
gnutls_dh_params_t dh_params;
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
89
gpgme_data_t dh_crypto, dh_plain;
156
const char *priority;
158
server *current_server;
161
/* global context so signal handler can reach it*/
162
mandos_context mc = { .simple_poll = NULL, .server = NULL,
163
.dh_bits = 1024, .priority = "SECURE256"
164
":!CTYPE-X.509:+CTYPE-OPENPGP",
165
.current_server = NULL };
167
sig_atomic_t quit_now = 0;
168
int signal_received = 0;
170
/* Function to use when printing errors */
171
void perror_plus(const char *print_text){
172
fprintf(stderr, "Mandos plugin %s: ",
173
program_invocation_short_name);
177
int fprintf_plus(FILE *stream, const char *format, ...){
179
va_start (ap, format);
181
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
182
program_invocation_short_name));
183
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
187
* Make additional room in "buffer" for at least BUFFER_SIZE more
188
* bytes. "buffer_capacity" is how much is currently allocated,
189
* "buffer_length" is how much is already used.
191
size_t incbuffer(char **buffer, size_t buffer_length,
192
size_t buffer_capacity){
193
if(buffer_length + BUFFER_SIZE > buffer_capacity){
194
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
198
buffer_capacity += BUFFER_SIZE;
200
return buffer_capacity;
203
/* Add server to set of servers to retry periodically */
204
int add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
207
server *new_server = malloc(sizeof(server));
208
if(new_server == NULL){
209
perror_plus("malloc");
212
*new_server = (server){ .ip = strdup(ip),
214
.if_index = if_index,
216
if(new_server->ip == NULL){
217
perror_plus("strdup");
220
/* Special case of first server */
221
if (mc.current_server == NULL){
222
new_server->next = new_server;
223
new_server->prev = new_server;
224
mc.current_server = new_server;
225
/* Place the new server last in the list */
227
new_server->next = mc.current_server;
228
new_server->prev = mc.current_server->prev;
229
new_server->prev->next = new_server;
230
mc.current_server->prev = new_server;
232
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
234
perror_plus("clock_gettime");
243
static bool init_gpgme(const char *seckey, const char *pubkey,
244
const char *tempdir){
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
95
246
gpgme_engine_info_t engine_info;
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
250
* Helper function to insert pub and seckey to the engine keyring.
252
bool import_key(const char *filename){
255
gpgme_data_t pgp_data;
257
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
263
rc = gpgme_data_new_from_fd(&pgp_data, fd);
264
if(rc != GPG_ERR_NO_ERROR){
265
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
266
gpgme_strsource(rc), gpgme_strerror(rc));
270
rc = gpgme_op_import(mc.ctx, pgp_data);
271
if(rc != GPG_ERR_NO_ERROR){
272
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
273
gpgme_strsource(rc), gpgme_strerror(rc));
277
ret = (int)TEMP_FAILURE_RETRY(close(fd));
279
perror_plus("close");
281
gpgme_data_release(pgp_data);
286
fprintf_plus(stderr, "Initializing GPGME\n");
102
290
gpgme_check_version(NULL);
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
291
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
292
if(rc != GPG_ERR_NO_ERROR){
293
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
294
gpgme_strsource(rc), gpgme_strerror(rc));
105
/* Set GPGME home directory */
106
rc = gpgme_get_engine_info (&engine_info);
107
if (rc != GPG_ERR_NO_ERROR){
108
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
109
gpgme_strsource(rc), gpgme_strerror(rc));
298
/* Set GPGME home directory for the OpenPGP engine only */
299
rc = gpgme_get_engine_info(&engine_info);
300
if(rc != GPG_ERR_NO_ERROR){
301
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
302
gpgme_strsource(rc), gpgme_strerror(rc));
112
305
while(engine_info != NULL){
113
306
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
114
307
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
115
engine_info->file_name, homedir);
308
engine_info->file_name, tempdir);
118
311
engine_info = engine_info->next;
120
313
if(engine_info == NULL){
121
fprintf(stderr, "Could not set home dir to %s\n", homedir);
125
/* Create new GPGME data buffer from packet buffer */
126
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
127
if (rc != GPG_ERR_NO_ERROR){
128
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
129
gpgme_strsource(rc), gpgme_strerror(rc));
314
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
319
/* Create new GPGME "context" */
320
rc = gpgme_new(&(mc.ctx));
321
if(rc != GPG_ERR_NO_ERROR){
322
fprintf_plus(stderr, "Mandos plugin mandos-client: "
323
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
328
if(not import_key(pubkey) or not import_key(seckey)){
336
* Decrypt OpenPGP data.
337
* Returns -1 on error
339
static ssize_t pgp_packet_decrypt(const char *cryptotext,
342
gpgme_data_t dh_crypto, dh_plain;
345
size_t plaintext_capacity = 0;
346
ssize_t plaintext_length = 0;
349
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
352
/* Create new GPGME data buffer from memory cryptotext */
353
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
355
if(rc != GPG_ERR_NO_ERROR){
356
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
357
gpgme_strsource(rc), gpgme_strerror(rc));
133
361
/* Create new empty GPGME data buffer for the plaintext */
134
362
rc = gpgme_data_new(&dh_plain);
135
if (rc != GPG_ERR_NO_ERROR){
136
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
137
gpgme_strsource(rc), gpgme_strerror(rc));
141
/* Create new GPGME "context" */
142
rc = gpgme_new(&ctx);
143
if (rc != GPG_ERR_NO_ERROR){
144
fprintf(stderr, "bad gpgme_new: %s: %s\n",
145
gpgme_strsource(rc), gpgme_strerror(rc));
149
/* Decrypt data from the FILE pointer to the plaintext data
151
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
152
if (rc != GPG_ERR_NO_ERROR){
153
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
154
gpgme_strsource(rc), gpgme_strerror(rc));
159
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
163
gpgme_decrypt_result_t result;
164
result = gpgme_op_decrypt_result(ctx);
166
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
168
fprintf(stderr, "Unsupported algorithm: %s\n",
169
result->unsupported_algorithm);
170
fprintf(stderr, "Wrong key usage: %d\n",
171
result->wrong_key_usage);
172
if(result->file_name != NULL){
173
fprintf(stderr, "File name: %s\n", result->file_name);
175
gpgme_recipient_t recipient;
176
recipient = result->recipients;
363
if(rc != GPG_ERR_NO_ERROR){
364
fprintf_plus(stderr, "Mandos plugin mandos-client: "
365
"bad gpgme_data_new: %s: %s\n",
366
gpgme_strsource(rc), gpgme_strerror(rc));
367
gpgme_data_release(dh_crypto);
371
/* Decrypt data from the cryptotext data buffer to the plaintext
373
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
374
if(rc != GPG_ERR_NO_ERROR){
375
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
376
gpgme_strsource(rc), gpgme_strerror(rc));
377
plaintext_length = -1;
379
gpgme_decrypt_result_t result;
380
result = gpgme_op_decrypt_result(mc.ctx);
382
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
384
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
385
result->unsupported_algorithm);
386
fprintf_plus(stderr, "Wrong key usage: %u\n",
387
result->wrong_key_usage);
388
if(result->file_name != NULL){
389
fprintf_plus(stderr, "File name: %s\n", result->file_name);
391
gpgme_recipient_t recipient;
392
recipient = result->recipients;
178
393
while(recipient != NULL){
179
fprintf(stderr, "Public key algorithm: %s\n",
180
gpgme_pubkey_algo_name(recipient->pubkey_algo));
181
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
182
fprintf(stderr, "Secret key available: %s\n",
183
recipient->status == GPG_ERR_NO_SECKEY
394
fprintf_plus(stderr, "Public key algorithm: %s\n",
395
gpgme_pubkey_algo_name
396
(recipient->pubkey_algo));
397
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
398
fprintf_plus(stderr, "Secret key available: %s\n",
399
recipient->status == GPG_ERR_NO_SECKEY
185
401
recipient = recipient->next;
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
409
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
194
412
/* Seek back to the beginning of the GPGME plaintext data buffer */
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
413
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
414
perror_plus("gpgme_data_seek");
415
plaintext_length = -1;
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
203
if (*new_packet == NULL){
207
new_packet_capacity += BUFFER_SIZE;
421
plaintext_capacity = incbuffer(plaintext,
422
(size_t)plaintext_length,
424
if(plaintext_capacity == 0){
425
perror_plus("incbuffer");
426
plaintext_length = -1;
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
430
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
212
432
/* Print the data, if any */
217
perror("gpgme_data_read");
220
new_packet_length += ret;
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
438
perror_plus("gpgme_data_read");
439
plaintext_length = -1;
442
plaintext_length += ret;
446
fprintf_plus(stderr, "Decrypted password is: ");
447
for(ssize_t i = 0; i < plaintext_length; i++){
448
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
450
fprintf(stderr, "\n");
455
/* Delete the GPGME cryptotext data buffer */
456
gpgme_data_release(dh_crypto);
231
458
/* Delete the GPGME plaintext data buffer */
232
459
gpgme_data_release(dh_plain);
233
return new_packet_length;
460
return plaintext_length;
236
static const char * safer_gnutls_strerror (int value) {
237
const char *ret = gnutls_strerror (value);
463
static const char * safer_gnutls_strerror(int value){
464
const char *ret = gnutls_strerror(value); /* Spurious warning from
465
-Wunreachable-code */
239
467
ret = "(unknown)";
243
void debuggnutls(__attribute__((unused)) int level,
245
fprintf(stderr, "%s", string);
471
/* GnuTLS log function callback */
472
static void debuggnutls(__attribute__((unused)) int level,
474
fprintf_plus(stderr, "GnuTLS: %s", string);
248
int initgnutls(encrypted_session *es){
477
static int init_gnutls_global(const char *pubkeyfilename,
478
const char *seckeyfilename){
253
fprintf(stderr, "Initializing GnuTLS\n");
482
fprintf_plus(stderr, "Initializing GnuTLS\n");
256
if ((ret = gnutls_global_init ())
257
!= GNUTLS_E_SUCCESS) {
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
485
ret = gnutls_global_init();
486
if(ret != GNUTLS_E_SUCCESS){
487
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
488
safer_gnutls_strerror(ret));
493
/* "Use a log level over 10 to enable all debugging options."
263
496
gnutls_global_set_log_level(11);
264
497
gnutls_global_set_log_function(debuggnutls);
267
/* openpgp credentials */
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
269
!= GNUTLS_E_SUCCESS) {
270
fprintf (stderr, "memory error: %s\n",
271
safer_gnutls_strerror(ret));
500
/* OpenPGP credentials */
501
ret = gnutls_certificate_allocate_credentials(&mc.cred);
502
if(ret != GNUTLS_E_SUCCESS){
503
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
504
safer_gnutls_strerror(ret));
505
gnutls_global_deinit();
276
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
510
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
511
" secret key %s as GnuTLS credentials\n",
281
516
ret = gnutls_certificate_set_openpgp_key_file
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
283
if (ret != GNUTLS_E_SUCCESS) {
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
287
ret, CERTFILE, KEYFILE);
288
fprintf(stdout, "The Error is: %s\n",
289
safer_gnutls_strerror(ret));
293
//GnuTLS server initialization
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
295
!= GNUTLS_E_SUCCESS) {
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
297
safer_gnutls_strerror(ret));
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in prime generation: %s\n",
304
safer_gnutls_strerror(ret));
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
310
// GnuTLS session creation
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
312
!= GNUTLS_E_SUCCESS){
313
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
314
safer_gnutls_strerror(ret));
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf(stderr, "Syntax error at: %s\n", err);
320
fprintf(stderr, "GnuTLS error: %s\n",
321
safer_gnutls_strerror(ret));
325
if ((ret = gnutls_credentials_set
326
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Error setting a credentials set: %s\n",
329
safer_gnutls_strerror(ret));
517
(mc.cred, pubkeyfilename, seckeyfilename,
518
GNUTLS_OPENPGP_FMT_BASE64);
519
if(ret != GNUTLS_E_SUCCESS){
521
"Error[%d] while reading the OpenPGP key pair ('%s',"
522
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
523
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
524
safer_gnutls_strerror(ret));
528
/* GnuTLS server initialization */
529
ret = gnutls_dh_params_init(&mc.dh_params);
530
if(ret != GNUTLS_E_SUCCESS){
531
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
532
" initialization: %s\n",
533
safer_gnutls_strerror(ret));
536
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
537
if(ret != GNUTLS_E_SUCCESS){
538
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
539
safer_gnutls_strerror(ret));
543
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
549
gnutls_certificate_free_credentials(mc.cred);
550
gnutls_global_deinit();
551
gnutls_dh_params_deinit(mc.dh_params);
555
static int init_gnutls_session(gnutls_session_t *session){
557
/* GnuTLS session creation */
559
ret = gnutls_init(session, GNUTLS_SERVER);
563
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
564
if(ret != GNUTLS_E_SUCCESS){
566
"Error in GnuTLS session initialization: %s\n",
567
safer_gnutls_strerror(ret));
573
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
575
gnutls_deinit(*session);
578
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
579
if(ret != GNUTLS_E_SUCCESS){
580
fprintf_plus(stderr, "Syntax error at: %s\n", err);
581
fprintf_plus(stderr, "GnuTLS error: %s\n",
582
safer_gnutls_strerror(ret));
583
gnutls_deinit(*session);
589
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
592
gnutls_deinit(*session);
595
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
596
if(ret != GNUTLS_E_SUCCESS){
597
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
598
safer_gnutls_strerror(ret));
599
gnutls_deinit(*session);
333
603
/* ignore client certificate if any. */
334
gnutls_certificate_server_set_request (es->session,
604
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
337
gnutls_dh_set_prime_bits (es->session, DH_BITS);
606
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
342
void empty_log(__attribute__((unused)) AvahiLogLevel level,
343
__attribute__((unused)) const char *txt){}
611
/* Avahi log function callback */
612
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
613
__attribute__((unused)) const char *txt){}
345
int start_mandos_communication(const char *ip, uint16_t port,
346
AvahiIfIndex if_index){
348
struct sockaddr_in6 to;
349
encrypted_session es;
615
/* Called when a Mandos server is found */
616
static int start_mandos_communication(const char *ip, uint16_t port,
617
AvahiIfIndex if_index,
619
int ret, tcp_sd = -1;
622
struct sockaddr_in in;
623
struct sockaddr_in6 in6;
350
625
char *buffer = NULL;
351
char *decrypted_buffer;
626
char *decrypted_buffer = NULL;
352
627
size_t buffer_length = 0;
353
628
size_t buffer_capacity = 0;
354
ssize_t decrypted_buffer_size;
357
char interface[IF_NAMESIZE];
360
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
364
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
370
if(if_indextoname((unsigned int)if_index, interface) == NULL){
372
perror("if_indextoname");
378
fprintf(stderr, "Binding to interface %s\n", interface);
381
memset(&to,0,sizeof(to)); /* Spurious warning */
382
to.sin6_family = AF_INET6;
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
631
gnutls_session_t session;
632
int pf; /* Protocol family */
649
fprintf_plus(stderr, "Bad address family: %d\n", af);
654
ret = init_gnutls_session(&session);
660
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
661
PRIu16 "\n", ip, port);
664
tcp_sd = socket(pf, SOCK_STREAM, 0);
667
perror_plus("socket");
677
memset(&to, 0, sizeof(to));
679
to.in6.sin6_family = (sa_family_t)af;
680
ret = inet_pton(af, ip, &to.in6.sin6_addr);
682
to.in.sin_family = (sa_family_t)af;
683
ret = inet_pton(af, ip, &to.in.sin_addr);
687
perror_plus("inet_pton");
389
fprintf(stderr, "Bad address: %s\n", ip);
392
to.sin6_port = htons(port); /* Spurious warning */
394
to.sin6_scope_id = (uint32_t)if_index;
397
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
414
ret = initgnutls (&es);
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
424
fprintf(stderr, "Establishing TLS session with %s\n", ip);
427
ret = gnutls_handshake (es.session);
429
if (ret != GNUTLS_E_SUCCESS){
693
fprintf_plus(stderr, "Bad address: %s\n", ip);
698
to.in6.sin6_port = htons(port); /* Spurious warnings from
700
-Wunreachable-code */
702
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
703
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
705
if(if_index == AVAHI_IF_UNSPEC){
706
fprintf_plus(stderr, "An IPv6 link-local address is"
707
" incomplete without a network interface\n");
711
/* Set the network interface number as scope */
712
to.in6.sin6_scope_id = (uint32_t)if_index;
715
to.in.sin_port = htons(port); /* Spurious warnings from
717
-Wunreachable-code */
726
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
727
char interface[IF_NAMESIZE];
728
if(if_indextoname((unsigned int)if_index, interface) == NULL){
729
perror_plus("if_indextoname");
731
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
732
"\n", ip, interface, port);
735
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
738
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
739
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
742
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
745
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
749
perror_plus("inet_ntop");
751
if(strcmp(addrstr, ip) != 0){
752
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
763
ret = connect(tcp_sd, &to.in6, sizeof(to));
765
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
768
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
770
perror_plus("connect");
781
const char *out = mandos_protocol_version;
784
size_t out_size = strlen(out);
785
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
786
out_size - written));
789
perror_plus("write");
793
written += (size_t)ret;
794
if(written < out_size){
797
if(out == mandos_protocol_version){
812
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
820
/* Spurious warning from -Wint-to-pointer-cast */
821
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
829
ret = gnutls_handshake(session);
834
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
836
if(ret != GNUTLS_E_SUCCESS){
431
fprintf(stderr, "\n*** Handshake failed ***\n");
838
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
438
//Retrieve OpenPGP packet that contains the wanted password
845
/* Read OpenPGP packet that contains the wanted password */
441
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
848
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
452
buffer_capacity += BUFFER_SIZE;
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
859
buffer_capacity = incbuffer(&buffer, buffer_length,
861
if(buffer_capacity == 0){
863
perror_plus("incbuffer");
873
sret = gnutls_record_recv(session, buffer+buffer_length,
462
880
case GNUTLS_E_INTERRUPTED:
463
881
case GNUTLS_E_AGAIN:
465
883
case GNUTLS_E_REHANDSHAKE:
466
ret = gnutls_handshake (es.session);
468
fprintf(stderr, "\n*** Handshake failed ***\n");
885
ret = gnutls_handshake(session);
891
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
893
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
475
fprintf(stderr, "Unknown error while reading data from"
476
" encrypted session with mandos server\n");
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
901
fprintf_plus(stderr, "Unknown error while reading data from"
902
" encrypted session with Mandos server\n");
903
gnutls_bye(session, GNUTLS_SHUT_RDWR);
482
buffer_length += (size_t) ret;
486
if (buffer_length > 0){
487
decrypted_buffer_size = pgp_packet_decrypt(buffer,
491
if (decrypted_buffer_size >= 0){
908
buffer_length += (size_t) sret;
913
fprintf_plus(stderr, "Closing TLS session\n");
922
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
927
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
929
if(buffer_length > 0){
930
ssize_t decrypted_buffer_size;
931
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
933
if(decrypted_buffer_size >= 0){
492
936
while(written < (size_t) decrypted_buffer_size){
493
ret = (int)fwrite (decrypted_buffer + written, 1,
494
(size_t)decrypted_buffer_size - written,
942
ret = (int)fwrite(decrypted_buffer + written, 1,
943
(size_t)decrypted_buffer_size - written,
496
945
if(ret == 0 and ferror(stdout)){
498
fprintf(stderr, "Error writing encrypted data: %s\n",
948
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
504
954
written += (size_t)ret;
506
free(decrypted_buffer);
960
/* Shutdown procedure */
965
free(decrypted_buffer);
968
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
974
perror_plus("close");
976
gnutls_deinit(session);
515
fprintf(stderr, "Closing TLS session\n");
519
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
522
gnutls_deinit (es.session);
523
gnutls_certificate_free_credentials (es.cred);
524
gnutls_global_deinit ();
528
static AvahiSimplePoll *simple_poll = NULL;
529
static AvahiServer *server = NULL;
531
static void resolve_callback(
532
AvahiSServiceResolver *r,
533
AvahiIfIndex interface,
534
AVAHI_GCC_UNUSED AvahiProtocol protocol,
535
AvahiResolverEvent event,
539
const char *host_name,
540
const AvahiAddress *address,
542
AVAHI_GCC_UNUSED AvahiStringList *txt,
543
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
544
AVAHI_GCC_UNUSED void* userdata) {
546
assert(r); /* Spurious warning */
986
static void resolve_callback(AvahiSServiceResolver *r,
987
AvahiIfIndex interface,
989
AvahiResolverEvent event,
993
const char *host_name,
994
const AvahiAddress *address,
996
AVAHI_GCC_UNUSED AvahiStringList *txt,
997
AVAHI_GCC_UNUSED AvahiLookupResultFlags
999
AVAHI_GCC_UNUSED void* userdata){
548
1002
/* Called whenever a service has been resolved successfully or
553
1011
case AVAHI_RESOLVER_FAILURE:
554
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
555
" type '%s' in domain '%s': %s\n", name, type, domain,
556
avahi_strerror(avahi_server_errno(server)));
1012
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1013
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1015
avahi_strerror(avahi_server_errno(mc.server)));
559
1018
case AVAHI_RESOLVER_FOUND:
561
1020
char ip[AVAHI_ADDRESS_STR_MAX];
562
1021
avahi_address_snprint(ip, sizeof(ip), address);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
1023
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1024
PRIdMAX ") on port %" PRIu16 "\n", name,
1025
host_name, ip, (intmax_t)interface, port);
567
int ret = start_mandos_communication(ip, port, interface);
1027
int ret = start_mandos_communication(ip, port, interface,
1028
avahi_proto_to_af(proto));
1030
avahi_simple_poll_quit(mc.simple_poll);
1032
ret = add_server(ip, port, interface,
1033
avahi_proto_to_af(proto));
573
1037
avahi_s_service_resolver_free(r);
576
static void browse_callback(
577
AvahiSServiceBrowser *b,
578
AvahiIfIndex interface,
579
AvahiProtocol protocol,
580
AvahiBrowserEvent event,
584
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
587
AvahiServer *s = userdata;
588
assert(b); /* Spurious warning */
590
/* Called whenever a new services becomes available on the LAN or
591
is removed from the LAN */
1040
static void browse_callback(AvahiSServiceBrowser *b,
1041
AvahiIfIndex interface,
1042
AvahiProtocol protocol,
1043
AvahiBrowserEvent event,
1047
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1049
AVAHI_GCC_UNUSED void* userdata){
1052
/* Called whenever a new services becomes available on the LAN or
1053
is removed from the LAN */
1061
case AVAHI_BROWSER_FAILURE:
1063
fprintf_plus(stderr, "(Avahi browser) %s\n",
1064
avahi_strerror(avahi_server_errno(mc.server)));
1065
avahi_simple_poll_quit(mc.simple_poll);
1068
case AVAHI_BROWSER_NEW:
1069
/* We ignore the returned Avahi resolver object. In the callback
1070
function we free it. If the Avahi server is terminated before
1071
the callback function is called the Avahi server will free the
1074
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1075
name, type, domain, protocol, 0,
1076
resolve_callback, NULL) == NULL)
1077
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1079
avahi_strerror(avahi_server_errno(mc.server)));
1082
case AVAHI_BROWSER_REMOVE:
1085
case AVAHI_BROWSER_ALL_FOR_NOW:
1086
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1088
fprintf_plus(stderr, "No Mandos server found, still"
1095
/* Signal handler that stops main loop after SIGTERM */
1096
static void handle_sigterm(int sig){
1101
signal_received = sig;
1102
int old_errno = errno;
1103
/* set main loop to exit */
1104
if(mc.simple_poll != NULL){
1105
avahi_simple_poll_quit(mc.simple_poll);
1110
bool get_flags(const char *ifname, struct ifreq *ifr){
1113
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1115
perror_plus("socket");
1118
strcpy(ifr->ifr_name, ifname);
1119
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1122
perror_plus("ioctl SIOCGIFFLAGS");
1129
bool good_flags(const char *ifname, const struct ifreq *ifr){
1131
/* Reject the loopback device */
1132
if(ifr->ifr_flags & IFF_LOOPBACK){
1134
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1139
/* Accept point-to-point devices only if connect_to is specified */
1140
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1142
fprintf_plus(stderr, "Accepting point-to-point interface"
1143
" \"%s\"\n", ifname);
1147
/* Otherwise, reject non-broadcast-capable devices */
1148
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1150
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1151
" \"%s\"\n", ifname);
1155
/* Reject non-ARP interfaces (including dummy interfaces) */
1156
if(ifr->ifr_flags & IFF_NOARP){
1158
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1164
/* Accept this device */
1166
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1172
* This function determines if a directory entry in /sys/class/net
1173
* corresponds to an acceptable network device.
1174
* (This function is passed to scandir(3) as a filter function.)
1176
int good_interface(const struct dirent *if_entry){
1177
if(if_entry->d_name[0] == '.'){
1182
if(not get_flags(if_entry->d_name, &ifr)){
1184
fprintf_plus(stderr, "Failed to get flags for interface "
1185
"\"%s\"\n", if_entry->d_name);
1190
if(not good_flags(if_entry->d_name, &ifr)){
1197
* This function determines if a directory entry in /sys/class/net
1198
* corresponds to an acceptable network device which is up.
1199
* (This function is passed to scandir(3) as a filter function.)
1201
int up_interface(const struct dirent *if_entry){
1202
if(if_entry->d_name[0] == '.'){
1207
if(not get_flags(if_entry->d_name, &ifr)){
1209
fprintf_plus(stderr, "Failed to get flags for interface "
1210
"\"%s\"\n", if_entry->d_name);
1215
/* Reject down interfaces */
1216
if(not (ifr.ifr_flags & IFF_UP)){
1218
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1224
/* Reject non-running interfaces */
1225
if(not (ifr.ifr_flags & IFF_RUNNING)){
1227
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1233
if(not good_flags(if_entry->d_name, &ifr)){
1239
int notdotentries(const struct dirent *direntry){
1240
/* Skip "." and ".." */
1241
if(direntry->d_name[0] == '.'
1242
and (direntry->d_name[1] == '\0'
1243
or (direntry->d_name[1] == '.'
1244
and direntry->d_name[2] == '\0'))){
1250
/* Is this directory entry a runnable program? */
1251
int runnable_hook(const struct dirent *direntry){
1256
if((direntry->d_name)[0] == '\0'){
1261
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1262
"abcdefghijklmnopqrstuvwxyz"
1265
if((direntry->d_name)[sret] != '\0'){
1266
/* Contains non-allowed characters */
1268
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1274
char *fullname = NULL;
1275
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1277
perror_plus("asprintf");
1281
ret = stat(fullname, &st);
1284
perror_plus("Could not stat hook");
1288
if(not (S_ISREG(st.st_mode))){
1289
/* Not a regular file */
1291
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1296
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1297
/* Not executable */
1299
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1307
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1309
struct timespec now;
1310
struct timespec waited_time;
1311
intmax_t block_time;
1314
if(mc.current_server == NULL){
1316
fprintf_plus(stderr, "Wait until first server is found."
1319
ret = avahi_simple_poll_iterate(s, -1);
1322
fprintf_plus(stderr, "Check current_server if we should run"
1325
/* the current time */
1326
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1328
perror_plus("clock_gettime");
1331
/* Calculating in ms how long time between now and server
1332
who we visted longest time ago. Now - last seen. */
1333
waited_time.tv_sec = (now.tv_sec
1334
- mc.current_server->last_seen.tv_sec);
1335
waited_time.tv_nsec = (now.tv_nsec
1336
- mc.current_server->last_seen.tv_nsec);
1337
/* total time is 10s/10,000ms.
1338
Converting to s from ms by dividing by 1,000,
1339
and ns to ms by dividing by 1,000,000. */
1340
block_time = ((retry_interval
1341
- ((intmax_t)waited_time.tv_sec * 1000))
1342
- ((intmax_t)waited_time.tv_nsec / 1000000));
1345
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1349
if(block_time <= 0){
1350
ret = start_mandos_communication(mc.current_server->ip,
1351
mc.current_server->port,
1352
mc.current_server->if_index,
1353
mc.current_server->af);
1355
avahi_simple_poll_quit(mc.simple_poll);
1358
ret = clock_gettime(CLOCK_MONOTONIC,
1359
&mc.current_server->last_seen);
1361
perror_plus("clock_gettime");
1364
mc.current_server = mc.current_server->next;
1365
block_time = 0; /* Call avahi to find new Mandos
1366
servers, but don't block */
1369
ret = avahi_simple_poll_iterate(s, (int)block_time);
1372
if (ret > 0 or errno != EINTR){
1373
return (ret != 1) ? ret : 0;
1379
bool run_network_hooks(const char *mode, const char *interface,
1381
struct dirent **direntries;
1382
struct dirent *direntry;
1384
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1387
perror_plus("scandir");
1389
int devnull = open("/dev/null", O_RDONLY);
1390
for(int i = 0; i < numhooks; i++){
1391
direntry = direntries[0];
1392
char *fullname = NULL;
1393
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1395
perror_plus("asprintf");
1398
pid_t hook_pid = fork();
1401
dup2(devnull, STDIN_FILENO);
1403
dup2(STDERR_FILENO, STDOUT_FILENO);
1404
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1406
perror_plus("setenv");
1409
ret = setenv("DEVICE", interface, 1);
1411
perror_plus("setenv");
1414
ret = setenv("VERBOSE", debug ? "1" : "0", 1);
1416
perror_plus("setenv");
1419
ret = setenv("MODE", mode, 1);
1421
perror_plus("setenv");
1425
ret = asprintf(&delaystring, "%f", delay);
1427
perror_plus("asprintf");
1430
ret = setenv("DELAY", delaystring, 1);
1433
perror_plus("setenv");
1437
ret = execl(fullname, direntry->d_name, mode, NULL);
1438
perror_plus("execl");
1441
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1442
perror_plus("waitpid");
1446
if(WIFEXITED(status)){
1447
if(WEXITSTATUS(status) != 0){
1448
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1449
" with status %d\n", direntry->d_name,
1450
WEXITSTATUS(status));
1454
} else if(WIFSIGNALED(status)){
1455
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1456
" signal %d\n", direntry->d_name,
1461
fprintf_plus(stderr, "Warning: network hook \"%s\""
1462
" crashed\n", direntry->d_name);
1477
int main(int argc, char *argv[]){
1478
AvahiSServiceBrowser *sb = NULL;
1483
int exitcode = EXIT_SUCCESS;
1484
const char *interface = "";
1485
struct ifreq network;
1487
bool take_down_interface = false;
1490
char tempdir[] = "/tmp/mandosXXXXXX";
1491
bool tempdir_created = false;
1492
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1493
const char *seckey = PATHDIR "/" SECKEY;
1494
const char *pubkey = PATHDIR "/" PUBKEY;
1496
bool gnutls_initialized = false;
1497
bool gpgme_initialized = false;
1499
double retry_interval = 10; /* 10s between trying a server and
1500
retrying the same server again */
1502
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1503
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1508
/* Lower any group privileges we might have, just to be safe */
1512
perror_plus("setgid");
1515
/* Lower user privileges (temporarily) */
1519
perror_plus("seteuid");
1527
struct argp_option options[] = {
1528
{ .name = "debug", .key = 128,
1529
.doc = "Debug mode", .group = 3 },
1530
{ .name = "connect", .key = 'c',
1531
.arg = "ADDRESS:PORT",
1532
.doc = "Connect directly to a specific Mandos server",
1534
{ .name = "interface", .key = 'i',
1536
.doc = "Network interface that will be used to search for"
1539
{ .name = "seckey", .key = 's',
1541
.doc = "OpenPGP secret key file base name",
1543
{ .name = "pubkey", .key = 'p',
1545
.doc = "OpenPGP public key file base name",
1547
{ .name = "dh-bits", .key = 129,
1549
.doc = "Bit length of the prime number used in the"
1550
" Diffie-Hellman key exchange",
1552
{ .name = "priority", .key = 130,
1554
.doc = "GnuTLS priority string for the TLS handshake",
1556
{ .name = "delay", .key = 131,
1558
.doc = "Maximum delay to wait for interface startup",
1560
{ .name = "retry", .key = 132,
1562
.doc = "Retry interval used when denied by the mandos server",
1564
{ .name = "network-hook-dir", .key = 133,
1566
.doc = "Directory where network hooks are located",
1569
* These reproduce what we would get without ARGP_NO_HELP
1571
{ .name = "help", .key = '?',
1572
.doc = "Give this help list", .group = -1 },
1573
{ .name = "usage", .key = -3,
1574
.doc = "Give a short usage message", .group = -1 },
1575
{ .name = "version", .key = 'V',
1576
.doc = "Print program version", .group = -1 },
1580
error_t parse_opt(int key, char *arg,
1581
struct argp_state *state){
1584
case 128: /* --debug */
1587
case 'c': /* --connect */
1590
case 'i': /* --interface */
1593
case 's': /* --seckey */
1596
case 'p': /* --pubkey */
1599
case 129: /* --dh-bits */
1601
tmpmax = strtoimax(arg, &tmp, 10);
1602
if(errno != 0 or tmp == arg or *tmp != '\0'
1603
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1604
argp_error(state, "Bad number of DH bits");
1606
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1608
case 130: /* --priority */
1611
case 131: /* --delay */
1613
delay = strtof(arg, &tmp);
1614
if(errno != 0 or tmp == arg or *tmp != '\0'){
1615
argp_error(state, "Bad delay");
1617
case 132: /* --retry */
1619
retry_interval = strtod(arg, &tmp);
1620
if(errno != 0 or tmp == arg or *tmp != '\0'
1621
or (retry_interval * 1000) > INT_MAX
1622
or retry_interval < 0){
1623
argp_error(state, "Bad retry interval");
1626
case 133: /* --network-hook-dir */
1630
* These reproduce what we would get without ARGP_NO_HELP
1632
case '?': /* --help */
1633
argp_state_help(state, state->out_stream,
1634
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1635
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1636
case -3: /* --usage */
1637
argp_state_help(state, state->out_stream,
1638
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1639
case 'V': /* --version */
1640
fprintf_plus(state->out_stream,
1641
"Mandos plugin mandos-client: ");
1642
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1643
exit(argp_err_exit_status);
1646
return ARGP_ERR_UNKNOWN;
1651
struct argp argp = { .options = options, .parser = parse_opt,
1653
.doc = "Mandos client -- Get and decrypt"
1654
" passwords from a Mandos server" };
1655
ret = argp_parse(&argp, argc, argv,
1656
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
595
case AVAHI_BROWSER_FAILURE:
597
fprintf(stderr, "(Browser) %s\n",
598
avahi_strerror(avahi_server_errno(server)));
599
avahi_simple_poll_quit(simple_poll);
602
case AVAHI_BROWSER_NEW:
603
/* We ignore the returned resolver object. In the callback
604
function we free it. If the server is terminated before
605
the callback function is called the server will free
606
the resolver for us. */
608
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
610
AVAHI_PROTO_INET6, 0,
611
resolve_callback, s)))
612
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
613
avahi_strerror(avahi_server_errno(s)));
616
case AVAHI_BROWSER_REMOVE:
619
case AVAHI_BROWSER_ALL_FOR_NOW:
620
case AVAHI_BROWSER_CACHE_EXHAUSTED:
625
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1663
perror_plus("argp_parse");
1664
exitcode = EX_OSERR;
1667
exitcode = EX_USAGE;
1673
/* Work around Debian bug #633582:
1674
<http://bugs.debian.org/633582> */
1677
/* Re-raise priviliges */
1681
perror_plus("seteuid");
1684
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1685
int seckey_fd = open(seckey, O_RDONLY);
1686
if(seckey_fd == -1){
1687
perror_plus("open");
1689
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1691
perror_plus("fstat");
1693
if(S_ISREG(st.st_mode)
1694
and st.st_uid == 0 and st.st_gid == 0){
1695
ret = fchown(seckey_fd, uid, gid);
1697
perror_plus("fchown");
1701
TEMP_FAILURE_RETRY(close(seckey_fd));
1705
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1706
int pubkey_fd = open(pubkey, O_RDONLY);
1707
if(pubkey_fd == -1){
1708
perror_plus("open");
1710
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1712
perror_plus("fstat");
1714
if(S_ISREG(st.st_mode)
1715
and st.st_uid == 0 and st.st_gid == 0){
1716
ret = fchown(pubkey_fd, uid, gid);
1718
perror_plus("fchown");
1722
TEMP_FAILURE_RETRY(close(pubkey_fd));
1726
/* Lower privileges */
1730
perror_plus("seteuid");
1734
/* Run network hooks */
1736
/* Re-raise priviliges */
1740
perror_plus("seteuid");
1742
if(not run_network_hooks("start", interface, delay)){
1745
/* Lower privileges */
1749
perror_plus("seteuid");
1754
avahi_set_log_function(empty_log);
1757
if(interface[0] == '\0'){
1758
struct dirent **direntries;
1759
/* First look for interfaces that are up */
1760
ret = scandir(sys_class_net, &direntries, up_interface,
1763
/* No up interfaces, look for any good interfaces */
1765
ret = scandir(sys_class_net, &direntries, good_interface,
1769
/* Pick the first interface returned */
1770
interface = strdup(direntries[0]->d_name);
1772
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1774
if(interface == NULL){
1775
perror_plus("malloc");
1777
exitcode = EXIT_FAILURE;
1783
fprintf_plus(stderr, "Could not find a network interface\n");
1784
exitcode = EXIT_FAILURE;
1789
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1790
from the signal handler */
1791
/* Initialize the pseudo-RNG for Avahi */
1792
srand((unsigned int) time(NULL));
1793
mc.simple_poll = avahi_simple_poll_new();
1794
if(mc.simple_poll == NULL){
1795
fprintf_plus(stderr,
1796
"Avahi: Failed to create simple poll object.\n");
1797
exitcode = EX_UNAVAILABLE;
1801
sigemptyset(&sigterm_action.sa_mask);
1802
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1804
perror_plus("sigaddset");
1805
exitcode = EX_OSERR;
1808
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1810
perror_plus("sigaddset");
1811
exitcode = EX_OSERR;
1814
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1816
perror_plus("sigaddset");
1817
exitcode = EX_OSERR;
1820
/* Need to check if the handler is SIG_IGN before handling:
1821
| [[info:libc:Initial Signal Actions]] |
1822
| [[info:libc:Basic Signal Handling]] |
1824
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1826
perror_plus("sigaction");
1829
if(old_sigterm_action.sa_handler != SIG_IGN){
1830
ret = sigaction(SIGINT, &sigterm_action, NULL);
1832
perror_plus("sigaction");
1833
exitcode = EX_OSERR;
1837
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1839
perror_plus("sigaction");
1842
if(old_sigterm_action.sa_handler != SIG_IGN){
1843
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1845
perror_plus("sigaction");
1846
exitcode = EX_OSERR;
1850
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1852
perror_plus("sigaction");
1855
if(old_sigterm_action.sa_handler != SIG_IGN){
1856
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1858
perror_plus("sigaction");
1859
exitcode = EX_OSERR;
1864
/* If the interface is down, bring it up */
1865
if(strcmp(interface, "none") != 0){
1866
if_index = (AvahiIfIndex) if_nametoindex(interface);
1868
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1869
exitcode = EX_UNAVAILABLE;
1877
/* Re-raise priviliges */
1881
perror_plus("seteuid");
1885
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1886
messages about the network interface to mess up the prompt */
1887
ret = klogctl(8, NULL, 5);
1888
bool restore_loglevel = true;
1890
restore_loglevel = false;
1891
perror_plus("klogctl");
1893
#endif /* __linux__ */
1895
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1897
perror_plus("socket");
1898
exitcode = EX_OSERR;
1900
if(restore_loglevel){
1901
ret = klogctl(7, NULL, 0);
1903
perror_plus("klogctl");
1906
#endif /* __linux__ */
1907
/* Lower privileges */
1911
perror_plus("seteuid");
1915
strcpy(network.ifr_name, interface);
1916
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1918
perror_plus("ioctl SIOCGIFFLAGS");
1920
if(restore_loglevel){
1921
ret = klogctl(7, NULL, 0);
1923
perror_plus("klogctl");
1926
#endif /* __linux__ */
1927
exitcode = EX_OSERR;
1928
/* Lower privileges */
1932
perror_plus("seteuid");
1936
if((network.ifr_flags & IFF_UP) == 0){
1937
network.ifr_flags |= IFF_UP;
1938
take_down_interface = true;
1939
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1941
take_down_interface = false;
1942
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1943
exitcode = EX_OSERR;
1945
if(restore_loglevel){
1946
ret = klogctl(7, NULL, 0);
1948
perror_plus("klogctl");
1951
#endif /* __linux__ */
1952
/* Lower privileges */
1956
perror_plus("seteuid");
1961
/* Sleep checking until interface is running.
1962
Check every 0.25s, up to total time of delay */
1963
for(int i=0; i < delay * 4; i++){
1964
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1966
perror_plus("ioctl SIOCGIFFLAGS");
1967
} else if(network.ifr_flags & IFF_RUNNING){
1970
struct timespec sleeptime = { .tv_nsec = 250000000 };
1971
ret = nanosleep(&sleeptime, NULL);
1972
if(ret == -1 and errno != EINTR){
1973
perror_plus("nanosleep");
1976
if(not take_down_interface){
1977
/* We won't need the socket anymore */
1978
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1980
perror_plus("close");
1984
if(restore_loglevel){
1985
/* Restores kernel loglevel to default */
1986
ret = klogctl(7, NULL, 0);
1988
perror_plus("klogctl");
1991
#endif /* __linux__ */
1992
/* Lower privileges */
1994
/* Lower privileges */
1997
perror_plus("seteuid");
2005
ret = init_gnutls_global(pubkey, seckey);
2007
fprintf_plus(stderr, "init_gnutls_global failed\n");
2008
exitcode = EX_UNAVAILABLE;
2011
gnutls_initialized = true;
2018
if(mkdtemp(tempdir) == NULL){
2019
perror_plus("mkdtemp");
2022
tempdir_created = true;
2028
if(not init_gpgme(pubkey, seckey, tempdir)){
2029
fprintf_plus(stderr, "init_gpgme failed\n");
2030
exitcode = EX_UNAVAILABLE;
2033
gpgme_initialized = true;
2040
if(connect_to != NULL){
2041
/* Connect directly, do not use Zeroconf */
2042
/* (Mainly meant for debugging) */
2043
char *address = strrchr(connect_to, ':');
2044
if(address == NULL){
2045
fprintf_plus(stderr, "No colon in address\n");
2046
exitcode = EX_USAGE;
2056
tmpmax = strtoimax(address+1, &tmp, 10);
2057
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2058
or tmpmax != (uint16_t)tmpmax){
2059
fprintf_plus(stderr, "Bad port number\n");
2060
exitcode = EX_USAGE;
2068
port = (uint16_t)tmpmax;
2070
/* Colon in address indicates IPv6 */
2072
if(strchr(connect_to, ':') != NULL){
2074
/* Accept [] around IPv6 address - see RFC 5952 */
2075
if(connect_to[0] == '[' and address[-1] == ']')
2083
address = connect_to;
2089
while(not quit_now){
2090
ret = start_mandos_communication(address, port, if_index, af);
2091
if(quit_now or ret == 0){
2095
fprintf_plus(stderr, "Retrying in %d seconds\n",
2096
(int)retry_interval);
2098
sleep((int)retry_interval);
2102
exitcode = EXIT_SUCCESS;
626
2113
AvahiServerConfig config;
627
AvahiSServiceBrowser *sb = NULL;
630
int returncode = EXIT_SUCCESS;
631
const char *interface = NULL;
632
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
633
char *connect_to = NULL;
636
static struct option long_options[] = {
637
{"debug", no_argument, (int *)&debug, 1},
638
{"connect", required_argument, 0, 'c'},
639
{"interface", required_argument, 0, 'i'},
642
int option_index = 0;
643
ret = getopt_long (argc, argv, "i:", long_options,
664
if(interface != NULL){
665
if_index = (AvahiIfIndex) if_nametoindex(interface);
667
fprintf(stderr, "No such interface: \"%s\"\n", interface);
672
if(connect_to != NULL){
673
/* Connect directly, do not use Zeroconf */
674
/* (Mainly meant for debugging) */
675
char *address = strrchr(connect_to, ':');
677
fprintf(stderr, "No colon in address\n");
681
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
683
perror("Bad port number");
687
address = connect_to;
688
ret = start_mandos_communication(address, port, if_index);
697
avahi_set_log_function(empty_log);
700
/* Initialize the psuedo-RNG */
701
srand((unsigned int) time(NULL));
703
/* Allocate main loop object */
704
if (!(simple_poll = avahi_simple_poll_new())) {
705
fprintf(stderr, "Failed to create simple poll object.\n");
710
/* Do not publish any local records */
2114
/* Do not publish any local Zeroconf records */
711
2115
avahi_server_config_init(&config);
712
2116
config.publish_hinfo = 0;
713
2117
config.publish_addresses = 0;
714
2118
config.publish_workstation = 0;
715
2119
config.publish_domain = 0;
717
2121
/* Allocate a new server */
718
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
719
&config, NULL, NULL, &error);
721
/* Free the configuration data */
2122
mc.server = avahi_server_new(avahi_simple_poll_get
2123
(mc.simple_poll), &config, NULL,
2126
/* Free the Avahi configuration data */
722
2127
avahi_server_config_free(&config);
724
/* Check if creating the server object succeeded */
726
fprintf(stderr, "Failed to create server: %s\n",
727
avahi_strerror(error));
728
returncode = EXIT_FAILURE;
732
/* Create the service browser */
733
sb = avahi_s_service_browser_new(server, if_index,
735
"_mandos._tcp", NULL, 0,
736
browse_callback, server);
738
fprintf(stderr, "Failed to create service browser: %s\n",
739
avahi_strerror(avahi_server_errno(server)));
740
returncode = EXIT_FAILURE;
744
/* Run the main loop */
747
fprintf(stderr, "Starting avahi loop search\n");
750
avahi_simple_poll_loop(simple_poll);
755
fprintf(stderr, "%s exiting\n", argv[0]);
760
avahi_s_service_browser_free(sb);
763
avahi_server_free(server);
766
avahi_simple_poll_free(simple_poll);
2130
/* Check if creating the Avahi server object succeeded */
2131
if(mc.server == NULL){
2132
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2133
avahi_strerror(error));
2134
exitcode = EX_UNAVAILABLE;
2142
/* Create the Avahi service browser */
2143
sb = avahi_s_service_browser_new(mc.server, if_index,
2144
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2145
NULL, 0, browse_callback, NULL);
2147
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2148
avahi_strerror(avahi_server_errno(mc.server)));
2149
exitcode = EX_UNAVAILABLE;
2157
/* Run the main loop */
2160
fprintf_plus(stderr, "Starting Avahi loop search\n");
2163
ret = avahi_loop_with_timeout(mc.simple_poll,
2164
(int)(retry_interval * 1000));
2166
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2167
(ret == 0) ? "successfully" : "with error");
2173
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2176
/* Cleanup things */
2178
avahi_s_service_browser_free(sb);
2180
if(mc.server != NULL)
2181
avahi_server_free(mc.server);
2183
if(mc.simple_poll != NULL)
2184
avahi_simple_poll_free(mc.simple_poll);
2186
if(gnutls_initialized){
2187
gnutls_certificate_free_credentials(mc.cred);
2188
gnutls_global_deinit();
2189
gnutls_dh_params_deinit(mc.dh_params);
2192
if(gpgme_initialized){
2193
gpgme_release(mc.ctx);
2196
/* Cleans up the circular linked list of Mandos servers the client
2198
if(mc.current_server != NULL){
2199
mc.current_server->prev->next = NULL;
2200
while(mc.current_server != NULL){
2201
server *next = mc.current_server->next;
2202
free(mc.current_server);
2203
mc.current_server = next;
2207
/* Re-raise priviliges */
2212
perror_plus("seteuid");
2214
/* Run network hooks */
2215
if(not run_network_hooks("stop", interface, delay)){
2219
/* Take down the network interface */
2220
if(take_down_interface and geteuid() == 0){
2221
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2223
perror_plus("ioctl SIOCGIFFLAGS");
2224
} else if(network.ifr_flags & IFF_UP){
2225
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2226
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2228
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2231
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2233
perror_plus("close");
2237
/* Lower privileges permanently */
2241
perror_plus("setuid");
2244
/* Removes the GPGME temp directory and all files inside */
2245
if(tempdir_created){
2246
struct dirent **direntries = NULL;
2247
struct dirent *direntry = NULL;
2248
int numentries = scandir(tempdir, &direntries, notdotentries,
2250
if (numentries > 0){
2251
for(int i = 0; i < numentries; i++){
2252
direntry = direntries[i];
2253
char *fullname = NULL;
2254
ret = asprintf(&fullname, "%s/%s", tempdir,
2257
perror_plus("asprintf");
2260
ret = remove(fullname);
2262
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2269
/* need to clean even if 0 because man page doesn't specify */
2271
if (numentries == -1){
2272
perror_plus("scandir");
2274
ret = rmdir(tempdir);
2275
if(ret == -1 and errno != ENOENT){
2276
perror_plus("rmdir");
2281
sigemptyset(&old_sigterm_action.sa_mask);
2282
old_sigterm_action.sa_handler = SIG_DFL;
2283
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2284
&old_sigterm_action,
2287
perror_plus("sigaction");
2290
ret = raise(signal_received);
2291
} while(ret != 0 and errno == EINTR);
2293
perror_plus("raise");
2296
TEMP_FAILURE_RETRY(pause());