To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 589
- compare with another revision
- download diff
- download tarball
- view history from revision 589
- Committer: Teddy Hogeborn
- Date: 2012-05-25 15:59:39 UTC
- Revision ID: teddy@recompile.se-20120525155939-bg6ricuff86zsjgx
* network-hooks.d/wireless: Read from config file, so don't run "env".
- files added:
- .bzr-builddeb
- debian
- debian/po
- debian/source
- network-hooks.d
- files removed:
- ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- server.py => mandos
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
/* $Id$ */
2
3
/* PLEASE NOTE *
4
* This file demonstrates how to use Avahi's core API, this is
5
* the embeddable mDNS stack for embedded applications.
1
/* -*- coding: utf-8 -*- */
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
6
4
*
7
* End user applications should *not* use this API and should use
8
* the D-Bus or C APIs, please see
9
* client-browse-services.c and glib-integration.c
10
*
11
* I repeat, you probably do *not* want to use this example.
5
* This program is partly derived from an example program for an Avahi
6
* service browser, downloaded from
7
* <http://avahi.org/browser/examples/core-browse-services.c>. This
8
* includes the following functions: "resolve_callback",
9
* "browse_callback", and parts of "main".
10
*
11
* Everything else is
12
* Copyright © 2008-2012 Teddy Hogeborn
13
* Copyright © 2008-2012 Björn Påhlsson
14
*
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
19
*
20
* This program is distributed in the hope that it will be useful, but
21
* WITHOUT ANY WARRANTY; without even the implied warranty of
22
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23
* General Public License for more details.
24
*
25
* You should have received a copy of the GNU General Public License
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
28
*
29
* Contact the authors at <mandos@recompile.se>.
12
30
*/
13
31
14
/***
15
This file is part of avahi.
16
17
avahi is free software; you can redistribute it and/or modify it
18
under the terms of the GNU Lesser General Public License as
19
published by the Free Software Foundation; either version 2.1 of the
20
License, or (at your option) any later version.
21
22
avahi is distributed in the hope that it will be useful, but WITHOUT
23
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
24
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
25
Public License for more details.
26
27
You should have received a copy of the GNU Lesser General Public
28
License along with avahi; if not, write to the Free Software
29
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
30
USA.
31
***/
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
33
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
34
37
#define _FILE_OFFSET_BITS 64
35
36
#include <stdio.h>
37
#include <assert.h>
38
#include <stdlib.h>
39
#include <time.h>
40
#include <net/if.h> /* if_nametoindex */
41
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open(), S_ISREG */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno,
66
program_invocation_short_name */
67
#include <time.h> /* nanosleep(), time(), sleep() */
68
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
69
SIOCSIFFLAGS, if_indextoname(),
70
if_nametoindex(), IF_NAMESIZE */
71
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
72
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
*/
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
getuid(), getgid(), seteuid(),
76
setgid(), pause(), _exit() */
77
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
78
#include <iso646.h> /* not, or, and */
79
#include <argp.h> /* struct argp_option, error_t, struct
80
argp_state, struct argp,
81
argp_parse(), ARGP_KEY_ARG,
82
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
83
#include <signal.h> /* sigemptyset(), sigaddset(),
84
sigaction(), SIGTERM, sig_atomic_t,
85
raise() */
86
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
87
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
88
#include <sys/wait.h> /* waitpid(), WIFEXITED(),
89
WEXITSTATUS(), WTERMSIG() */
90
#include <grp.h> /* setgroups() */
91
92
#ifdef __linux__
93
#include <sys/klog.h> /* klogctl() */
94
#endif /* __linux__ */
95
96
/* Avahi */
97
/* All Avahi types, constants and functions
98
Avahi*, avahi_*,
99
AVAHI_* */
42
100
#include <avahi-core/core.h>
43
101
#include <avahi-core/lookup.h>
44
102
#include <avahi-core/log.h>
46
104
#include <avahi-common/malloc.h>
47
105
#include <avahi-common/error.h>
48
106
49
//mandos client part
50
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
51
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
53
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
67
#ifndef CERT_ROOT
68
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
69
#endif
70
#define CERTFILE CERT_ROOT "openpgp-client.txt"
71
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
107
/* GnuTLS */
108
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
109
functions:
110
gnutls_*
111
init_gnutls_session(),
112
GNUTLS_* */
113
#include <gnutls/openpgp.h>
114
/* gnutls_certificate_set_openpgp_key_file(),
115
GNUTLS_OPENPGP_FMT_BASE64 */
116
117
/* GPGME */
118
#include <gpgme.h> /* All GPGME types, constants and
119
functions:
120
gpgme_*
121
GPGME_PROTOCOL_OpenPGP,
122
GPG_ERR_NO_* */
123
72
124
#define BUFFER_SIZE 256
73
#define DH_BITS 1024
74
125
126
#define PATHDIR "/conf/conf.d/mandos"
127
#define SECKEY "seckey.txt"
128
#define PUBKEY "pubkey.txt"
129
#define HOOKDIR "/lib/mandos/network-hooks.d"
130
131
bool debug = false;
132
static const char mandos_protocol_version[] = "1";
133
const char *argp_program_version = "mandos-client " VERSION;
134
const char *argp_program_bug_address = "<mandos@recompile.se>";
135
static const char sys_class_net[] = "/sys/class/net";
136
char *connect_to = NULL;
137
const char *hookdir = HOOKDIR;
138
139
/* Doubly linked list that need to be circularly linked when used */
140
typedef struct server{
141
const char *ip;
142
uint16_t port;
143
AvahiIfIndex if_index;
144
int af;
145
struct timespec last_seen;
146
struct server *next;
147
struct server *prev;
148
} server;
149
150
/* Used for passing in values through the Avahi callback functions */
75
151
typedef struct {
76
gnutls_session_t session;
152
AvahiSimplePoll *simple_poll;
153
AvahiServer *server;
77
154
gnutls_certificate_credentials_t cred;
155
unsigned int dh_bits;
78
156
gnutls_dh_params_t dh_params;
79
} encrypted_session;
80
81
82
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
83
gpgme_data_t dh_crypto, dh_plain;
157
const char *priority;
84
158
gpgme_ctx_t ctx;
159
server *current_server;
160
} mandos_context;
161
162
/* global context so signal handler can reach it*/
163
mandos_context mc = { .simple_poll = NULL, .server = NULL,
164
.dh_bits = 1024, .priority = "SECURE256"
165
":!CTYPE-X.509:+CTYPE-OPENPGP",
166
.current_server = NULL };
167
168
sig_atomic_t quit_now = 0;
169
int signal_received = 0;
170
171
/* Function to use when printing errors */
172
void perror_plus(const char *print_text){
173
int e = errno;
174
fprintf(stderr, "Mandos plugin %s: ",
175
program_invocation_short_name);
176
errno = e;
177
perror(print_text);
178
}
179
180
__attribute__((format (gnu_printf, 2, 3)))
181
int fprintf_plus(FILE *stream, const char *format, ...){
182
va_list ap;
183
va_start (ap, format);
184
185
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
186
program_invocation_short_name));
187
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
188
}
189
190
/*
191
* Make additional room in "buffer" for at least BUFFER_SIZE more
192
* bytes. "buffer_capacity" is how much is currently allocated,
193
* "buffer_length" is how much is already used.
194
*/
195
size_t incbuffer(char **buffer, size_t buffer_length,
196
size_t buffer_capacity){
197
if(buffer_length + BUFFER_SIZE > buffer_capacity){
198
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
199
if(buffer == NULL){
200
return 0;
201
}
202
buffer_capacity += BUFFER_SIZE;
203
}
204
return buffer_capacity;
205
}
206
207
/* Add server to set of servers to retry periodically */
208
bool add_server(const char *ip, uint16_t port, AvahiIfIndex if_index,
209
int af){
210
int ret;
211
server *new_server = malloc(sizeof(server));
212
if(new_server == NULL){
213
perror_plus("malloc");
214
return false;
215
}
216
*new_server = (server){ .ip = strdup(ip),
217
.port = port,
218
.if_index = if_index,
219
.af = af };
220
if(new_server->ip == NULL){
221
perror_plus("strdup");
222
return false;
223
}
224
/* Special case of first server */
225
if (mc.current_server == NULL){
226
new_server->next = new_server;
227
new_server->prev = new_server;
228
mc.current_server = new_server;
229
/* Place the new server last in the list */
230
} else {
231
new_server->next = mc.current_server;
232
new_server->prev = mc.current_server->prev;
233
new_server->prev->next = new_server;
234
mc.current_server->prev = new_server;
235
}
236
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
237
if(ret == -1){
238
perror_plus("clock_gettime");
239
return false;
240
}
241
return true;
242
}
243
244
/*
245
* Initialize GPGME.
246
*/
247
static bool init_gpgme(const char *seckey, const char *pubkey,
248
const char *tempdir){
85
249
gpgme_error_t rc;
86
ssize_t ret;
87
size_t new_packet_capacity = 0;
88
size_t new_packet_length = 0;
89
250
gpgme_engine_info_t engine_info;
90
251
252
253
/*
254
* Helper function to insert pub and seckey to the engine keyring.
255
*/
256
bool import_key(const char *filename){
257
int ret;
258
int fd;
259
gpgme_data_t pgp_data;
260
261
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
262
if(fd == -1){
263
perror_plus("open");
264
return false;
265
}
266
267
rc = gpgme_data_new_from_fd(&pgp_data, fd);
268
if(rc != GPG_ERR_NO_ERROR){
269
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
270
gpgme_strsource(rc), gpgme_strerror(rc));
271
return false;
272
}
273
274
rc = gpgme_op_import(mc.ctx, pgp_data);
275
if(rc != GPG_ERR_NO_ERROR){
276
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
277
gpgme_strsource(rc), gpgme_strerror(rc));
278
return false;
279
}
280
281
ret = (int)TEMP_FAILURE_RETRY(close(fd));
282
if(ret == -1){
283
perror_plus("close");
284
}
285
gpgme_data_release(pgp_data);
286
return true;
287
}
288
289
if(debug){
290
fprintf_plus(stderr, "Initializing GPGME\n");
291
}
292
91
293
/* Init GPGME */
92
294
gpgme_check_version(NULL);
93
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
295
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
296
if(rc != GPG_ERR_NO_ERROR){
297
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
298
gpgme_strsource(rc), gpgme_strerror(rc));
299
return false;
300
}
94
301
95
/* Set GPGME home directory */
96
rc = gpgme_get_engine_info (&engine_info);
97
if (rc != GPG_ERR_NO_ERROR){
98
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
99
gpgme_strsource(rc), gpgme_strerror(rc));
100
return -1;
302
/* Set GPGME home directory for the OpenPGP engine only */
303
rc = gpgme_get_engine_info(&engine_info);
304
if(rc != GPG_ERR_NO_ERROR){
305
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
306
gpgme_strsource(rc), gpgme_strerror(rc));
307
return false;
101
308
}
102
309
while(engine_info != NULL){
103
310
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
104
311
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
105
engine_info->file_name, homedir);
312
engine_info->file_name, tempdir);
106
313
break;
107
314
}
108
315
engine_info = engine_info->next;
109
316
}
110
317
if(engine_info == NULL){
111
fprintf(stderr, "Could not set home dir to %s\n", homedir);
112
return -1;
113
}
114
115
/* Create new GPGME data buffer from packet buffer */
116
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
117
if (rc != GPG_ERR_NO_ERROR){
118
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
119
gpgme_strsource(rc), gpgme_strerror(rc));
318
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
319
tempdir);
320
return false;
321
}
322
323
/* Create new GPGME "context" */
324
rc = gpgme_new(&(mc.ctx));
325
if(rc != GPG_ERR_NO_ERROR){
326
fprintf_plus(stderr, "Mandos plugin mandos-client: "
327
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
328
gpgme_strerror(rc));
329
return false;
330
}
331
332
if(not import_key(pubkey) or not import_key(seckey)){
333
return false;
334
}
335
336
return true;
337
}
338
339
/*
340
* Decrypt OpenPGP data.
341
* Returns -1 on error
342
*/
343
static ssize_t pgp_packet_decrypt(const char *cryptotext,
344
size_t crypto_size,
345
char **plaintext){
346
gpgme_data_t dh_crypto, dh_plain;
347
gpgme_error_t rc;
348
ssize_t ret;
349
size_t plaintext_capacity = 0;
350
ssize_t plaintext_length = 0;
351
352
if(debug){
353
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
354
}
355
356
/* Create new GPGME data buffer from memory cryptotext */
357
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
358
0);
359
if(rc != GPG_ERR_NO_ERROR){
360
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
361
gpgme_strsource(rc), gpgme_strerror(rc));
120
362
return -1;
121
363
}
122
364
123
365
/* Create new empty GPGME data buffer for the plaintext */
124
366
rc = gpgme_data_new(&dh_plain);
125
if (rc != GPG_ERR_NO_ERROR){
126
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
127
gpgme_strsource(rc), gpgme_strerror(rc));
128
return -1;
129
}
130
131
/* Create new GPGME "context" */
132
rc = gpgme_new(&ctx);
133
if (rc != GPG_ERR_NO_ERROR){
134
fprintf(stderr, "bad gpgme_new: %s: %s\n",
135
gpgme_strsource(rc), gpgme_strerror(rc));
136
return -1;
137
}
138
139
/* Decrypt data from the FILE pointer to the plaintext data buffer */
140
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
141
if (rc != GPG_ERR_NO_ERROR){
142
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
143
gpgme_strsource(rc), gpgme_strerror(rc));
144
return -1;
145
}
146
147
/* gpgme_decrypt_result_t result; */
148
/* result = gpgme_op_decrypt_result(ctx); */
149
/* fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm); */
150
/* fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage); */
151
/* if(result->file_name != NULL){ */
152
/* fprintf(stderr, "File name: %s\n", result->file_name); */
153
/* } */
154
/* gpgme_recipient_t recipient; */
155
/* recipient = result->recipients; */
156
/* if(recipient){ */
157
/* while(recipient != NULL){ */
158
/* fprintf(stderr, "Public key algorithm: %s\n", */
159
/* gpgme_pubkey_algo_name(recipient->pubkey_algo)); */
160
/* fprintf(stderr, "Key ID: %s\n", recipient->keyid); */
161
/* fprintf(stderr, "Secret key available: %s\n", */
162
/* recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes"); */
163
/* recipient = recipient->next; */
164
/* } */
165
/* } */
166
167
/* Delete the GPGME FILE pointer cryptotext data buffer */
168
gpgme_data_release(dh_crypto);
367
if(rc != GPG_ERR_NO_ERROR){
368
fprintf_plus(stderr, "Mandos plugin mandos-client: "
369
"bad gpgme_data_new: %s: %s\n",
370
gpgme_strsource(rc), gpgme_strerror(rc));
371
gpgme_data_release(dh_crypto);
372
return -1;
373
}
374
375
/* Decrypt data from the cryptotext data buffer to the plaintext
376
data buffer */
377
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
378
if(rc != GPG_ERR_NO_ERROR){
379
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
380
gpgme_strsource(rc), gpgme_strerror(rc));
381
plaintext_length = -1;
382
if(debug){
383
gpgme_decrypt_result_t result;
384
result = gpgme_op_decrypt_result(mc.ctx);
385
if(result == NULL){
386
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
387
} else {
388
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
389
result->unsupported_algorithm);
390
fprintf_plus(stderr, "Wrong key usage: %u\n",
391
result->wrong_key_usage);
392
if(result->file_name != NULL){
393
fprintf_plus(stderr, "File name: %s\n", result->file_name);
394
}
395
gpgme_recipient_t recipient;
396
recipient = result->recipients;
397
while(recipient != NULL){
398
fprintf_plus(stderr, "Public key algorithm: %s\n",
399
gpgme_pubkey_algo_name
400
(recipient->pubkey_algo));
401
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
402
fprintf_plus(stderr, "Secret key available: %s\n",
403
recipient->status == GPG_ERR_NO_SECKEY
404
? "No" : "Yes");
405
recipient = recipient->next;
406
}
407
}
408
}
409
goto decrypt_end;
410
}
411
412
if(debug){
413
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
414
}
169
415
170
416
/* Seek back to the beginning of the GPGME plaintext data buffer */
171
gpgme_data_seek(dh_plain, 0, SEEK_SET);
172
173
*new_packet = 0;
417
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
418
perror_plus("gpgme_data_seek");
419
plaintext_length = -1;
420
goto decrypt_end;
421
}
422
423
*plaintext = NULL;
174
424
while(true){
175
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
176
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
177
if (*new_packet == NULL){
178
perror("realloc");
179
return -1;
180
}
181
new_packet_capacity += BUFFER_SIZE;
425
plaintext_capacity = incbuffer(plaintext,
426
(size_t)plaintext_length,
427
plaintext_capacity);
428
if(plaintext_capacity == 0){
429
perror_plus("incbuffer");
430
plaintext_length = -1;
431
goto decrypt_end;
182
432
}
183
433
184
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
434
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
435
BUFFER_SIZE);
185
436
/* Print the data, if any */
186
if (ret == 0){
187
/* If password is empty, then a incorrect error will be printed */
437
if(ret == 0){
438
/* EOF */
188
439
break;
189
440
}
190
441
if(ret < 0){
191
perror("gpgme_data_read");
192
return -1;
193
}
194
new_packet_length += ret;
195
}
196
197
/* Delete the GPGME plaintext data buffer */
442
perror_plus("gpgme_data_read");
443
plaintext_length = -1;
444
goto decrypt_end;
445
}
446
plaintext_length += ret;
447
}
448
449
if(debug){
450
fprintf_plus(stderr, "Decrypted password is: ");
451
for(ssize_t i = 0; i < plaintext_length; i++){
452
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
453
}
454
fprintf(stderr, "\n");
455
}
456
457
decrypt_end:
458
459
/* Delete the GPGME cryptotext data buffer */
460
gpgme_data_release(dh_crypto);
461
462
/* Delete the GPGME plaintext data buffer */
198
463
gpgme_data_release(dh_plain);
199
return new_packet_length;
464
return plaintext_length;
200
465
}
201
466
202
static const char * safer_gnutls_strerror (int value) {
203
const char *ret = gnutls_strerror (value);
204
if (ret == NULL)
467
static const char * safer_gnutls_strerror(int value){
468
const char *ret = gnutls_strerror(value); /* Spurious warning from
469
-Wunreachable-code */
470
if(ret == NULL)
205
471
ret = "(unknown)";
206
472
return ret;
207
473
}
208
474
209
void debuggnutls(int level, const char* string){
210
fprintf(stderr, "%s", string);
475
/* GnuTLS log function callback */
476
static void debuggnutls(__attribute__((unused)) int level,
477
const char* string){
478
fprintf_plus(stderr, "GnuTLS: %s", string);
211
479
}
212
480
213
int initgnutls(encrypted_session *es){
214
const char *err;
481
static int init_gnutls_global(const char *pubkeyfilename,
482
const char *seckeyfilename){
215
483
int ret;
216
484
217
if ((ret = gnutls_global_init ())
218
!= GNUTLS_E_SUCCESS) {
219
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
220
return -1;
221
}
222
223
/* Uncomment to enable full debuggin on the gnutls library */
224
/* gnutls_global_set_log_level(11); */
225
/* gnutls_global_set_log_function(debuggnutls); */
226
227
228
/* openpgp credentials */
229
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
230
!= GNUTLS_E_SUCCESS) {
231
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
232
return -1;
233
}
234
485
if(debug){
486
fprintf_plus(stderr, "Initializing GnuTLS\n");
487
}
488
489
ret = gnutls_global_init();
490
if(ret != GNUTLS_E_SUCCESS){
491
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
492
safer_gnutls_strerror(ret));
493
return -1;
494
}
495
496
if(debug){
497
/* "Use a log level over 10 to enable all debugging options."
498
* - GnuTLS manual
499
*/
500
gnutls_global_set_log_level(11);
501
gnutls_global_set_log_function(debuggnutls);
502
}
503
504
/* OpenPGP credentials */
505
ret = gnutls_certificate_allocate_credentials(&mc.cred);
506
if(ret != GNUTLS_E_SUCCESS){
507
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
508
safer_gnutls_strerror(ret));
509
gnutls_global_deinit();
510
return -1;
511
}
512
513
if(debug){
514
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
515
" secret key %s as GnuTLS credentials\n",
516
pubkeyfilename,
517
seckeyfilename);
518
}
519
235
520
ret = gnutls_certificate_set_openpgp_key_file
236
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
237
if (ret != GNUTLS_E_SUCCESS) {
238
fprintf
239
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
240
ret, CERTFILE, KEYFILE);
241
fprintf(stdout, "The Error is: %s\n",
242
safer_gnutls_strerror(ret));
243
return -1;
244
}
245
246
//Gnutls server initialization
247
if ((ret = gnutls_dh_params_init (&es->dh_params))
248
!= GNUTLS_E_SUCCESS) {
249
fprintf (stderr, "Error in dh parameter initialization: %s\n",
250
safer_gnutls_strerror(ret));
251
return -1;
252
}
253
254
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
255
!= GNUTLS_E_SUCCESS) {
256
fprintf (stderr, "Error in prime generation: %s\n",
257
safer_gnutls_strerror(ret));
258
return -1;
259
}
260
261
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
262
263
// Gnutls session creation
264
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
265
!= GNUTLS_E_SUCCESS){
266
fprintf(stderr, "Error in gnutls session initialization: %s\n",
267
safer_gnutls_strerror(ret));
268
}
269
270
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
271
!= GNUTLS_E_SUCCESS) {
272
fprintf(stderr, "Syntax error at: %s\n", err);
273
fprintf(stderr, "Gnutls error: %s\n",
274
safer_gnutls_strerror(ret));
275
return -1;
276
}
277
278
if ((ret = gnutls_credentials_set
279
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
280
!= GNUTLS_E_SUCCESS) {
281
fprintf(stderr, "Error setting a credentials set: %s\n",
282
safer_gnutls_strerror(ret));
283
return -1;
284
}
285
521
(mc.cred, pubkeyfilename, seckeyfilename,
522
GNUTLS_OPENPGP_FMT_BASE64);
523
if(ret != GNUTLS_E_SUCCESS){
524
fprintf_plus(stderr,
525
"Error[%d] while reading the OpenPGP key pair ('%s',"
526
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
527
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
528
safer_gnutls_strerror(ret));
529
goto globalfail;
530
}
531
532
/* GnuTLS server initialization */
533
ret = gnutls_dh_params_init(&mc.dh_params);
534
if(ret != GNUTLS_E_SUCCESS){
535
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
536
" initialization: %s\n",
537
safer_gnutls_strerror(ret));
538
goto globalfail;
539
}
540
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
541
if(ret != GNUTLS_E_SUCCESS){
542
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
543
safer_gnutls_strerror(ret));
544
goto globalfail;
545
}
546
547
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
548
549
return 0;
550
551
globalfail:
552
553
gnutls_certificate_free_credentials(mc.cred);
554
gnutls_global_deinit();
555
gnutls_dh_params_deinit(mc.dh_params);
556
return -1;
557
}
558
559
static int init_gnutls_session(gnutls_session_t *session){
560
int ret;
561
/* GnuTLS session creation */
562
do {
563
ret = gnutls_init(session, GNUTLS_SERVER);
564
if(quit_now){
565
return -1;
566
}
567
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
568
if(ret != GNUTLS_E_SUCCESS){
569
fprintf_plus(stderr,
570
"Error in GnuTLS session initialization: %s\n",
571
safer_gnutls_strerror(ret));
572
}
573
574
{
575
const char *err;
576
do {
577
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
578
if(quit_now){
579
gnutls_deinit(*session);
580
return -1;
581
}
582
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
583
if(ret != GNUTLS_E_SUCCESS){
584
fprintf_plus(stderr, "Syntax error at: %s\n", err);
585
fprintf_plus(stderr, "GnuTLS error: %s\n",
586
safer_gnutls_strerror(ret));
587
gnutls_deinit(*session);
588
return -1;
589
}
590
}
591
592
do {
593
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
594
mc.cred);
595
if(quit_now){
596
gnutls_deinit(*session);
597
return -1;
598
}
599
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
600
if(ret != GNUTLS_E_SUCCESS){
601
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
602
safer_gnutls_strerror(ret));
603
gnutls_deinit(*session);
604
return -1;
605
}
606
286
607
/* ignore client certificate if any. */
287
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
608
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
288
609
289
gnutls_dh_set_prime_bits (es->session, DH_BITS);
610
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
290
611
291
612
return 0;
292
613
}
293
614
294
void empty_log(AvahiLogLevel level, const char *txt){}
615
/* Avahi log function callback */
616
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
617
__attribute__((unused)) const char *txt){}
295
618
296
int start_mandos_communcation(char *ip, uint16_t port){
297
int ret, tcp_sd;
298
struct sockaddr_in6 to;
299
struct in6_addr ip_addr;
300
encrypted_session es;
619
/* Called when a Mandos server is found */
620
static int start_mandos_communication(const char *ip, uint16_t port,
621
AvahiIfIndex if_index,
622
int af){
623
int ret, tcp_sd = -1;
624
ssize_t sret;
625
union {
626
struct sockaddr_in in;
627
struct sockaddr_in6 in6;
628
} to;
301
629
char *buffer = NULL;
302
char *decrypted_buffer;
630
char *decrypted_buffer = NULL;
303
631
size_t buffer_length = 0;
304
632
size_t buffer_capacity = 0;
305
ssize_t decrypted_buffer_size;
306
int retval = 0;
307
308
309
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
310
if(tcp_sd < 0) {
311
perror("socket");
312
return -1;
313
}
314
315
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, "eth0", 5);
316
if(tcp_sd < 0) {
317
perror("setsockopt bindtodevice");
318
return -1;
319
}
320
321
memset(&to,0,sizeof(to));
322
to.sin6_family = AF_INET6;
323
ret = inet_pton(AF_INET6, ip, &ip_addr);
324
if (ret < 0 ){
325
perror("inet_pton");
326
return -1;
327
}
633
size_t written;
634
int retval = -1;
635
gnutls_session_t session;
636
int pf; /* Protocol family */
637
638
errno = 0;
639
640
if(quit_now){
641
errno = EINTR;
642
return -1;
643
}
644
645
switch(af){
646
case AF_INET6:
647
pf = PF_INET6;
648
break;
649
case AF_INET:
650
pf = PF_INET;
651
break;
652
default:
653
fprintf_plus(stderr, "Bad address family: %d\n", af);
654
errno = EINVAL;
655
return -1;
656
}
657
658
ret = init_gnutls_session(&session);
659
if(ret != 0){
660
return -1;
661
}
662
663
if(debug){
664
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
665
PRIu16 "\n", ip, port);
666
}
667
668
tcp_sd = socket(pf, SOCK_STREAM, 0);
669
if(tcp_sd < 0){
670
int e = errno;
671
perror_plus("socket");
672
errno = e;
673
goto mandos_end;
674
}
675
676
if(quit_now){
677
errno = EINTR;
678
goto mandos_end;
679
}
680
681
memset(&to, 0, sizeof(to));
682
if(af == AF_INET6){
683
to.in6.sin6_family = (sa_family_t)af;
684
ret = inet_pton(af, ip, &to.in6.sin6_addr);
685
} else { /* IPv4 */
686
to.in.sin_family = (sa_family_t)af;
687
ret = inet_pton(af, ip, &to.in.sin_addr);
688
}
689
if(ret < 0 ){
690
int e = errno;
691
perror_plus("inet_pton");
692
errno = e;
693
goto mandos_end;
694
}
328
695
if(ret == 0){
329
fprintf(stderr, "Bad address: %s\n", ip);
330
return -1;
331
}
332
to.sin6_port = htons(port);
333
to.sin6_scope_id = if_nametoindex("eth0");
334
335
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
336
if (ret < 0){
337
perror("connect");
338
return -1;
339
}
340
341
ret = initgnutls (&es);
342
if (ret != 0){
343
retval = -1;
344
return -1;
345
}
346
347
348
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
349
350
ret = gnutls_handshake (es.session);
351
352
if (ret != GNUTLS_E_SUCCESS){
353
fprintf(stderr, "\n*** Handshake failed ***\n");
354
gnutls_perror (ret);
355
retval = -1;
356
goto exit;
357
}
358
359
//retrive password
360
while(true){
361
if (buffer_length + BUFFER_SIZE > buffer_capacity){
362
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
363
if (buffer == NULL){
364
perror("realloc");
365
goto exit;
366
}
367
buffer_capacity += BUFFER_SIZE;
368
}
369
370
ret = gnutls_record_recv
371
(es.session, buffer+buffer_length, BUFFER_SIZE);
372
if (ret == 0){
696
int e = errno;
697
fprintf_plus(stderr, "Bad address: %s\n", ip);
698
errno = e;
699
goto mandos_end;
700
}
701
if(af == AF_INET6){
702
to.in6.sin6_port = htons(port); /* Spurious warnings from
703
-Wconversion and
704
-Wunreachable-code */
705
706
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
707
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
708
-Wunreachable-code*/
709
if(if_index == AVAHI_IF_UNSPEC){
710
fprintf_plus(stderr, "An IPv6 link-local address is"
711
" incomplete without a network interface\n");
712
errno = EINVAL;
713
goto mandos_end;
714
}
715
/* Set the network interface number as scope */
716
to.in6.sin6_scope_id = (uint32_t)if_index;
717
}
718
} else {
719
to.in.sin_port = htons(port); /* Spurious warnings from
720
-Wconversion and
721
-Wunreachable-code */
722
}
723
724
if(quit_now){
725
errno = EINTR;
726
goto mandos_end;
727
}
728
729
if(debug){
730
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
731
char interface[IF_NAMESIZE];
732
if(if_indextoname((unsigned int)if_index, interface) == NULL){
733
perror_plus("if_indextoname");
734
} else {
735
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
736
"\n", ip, interface, port);
737
}
738
} else {
739
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
740
ip, port);
741
}
742
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
743
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
744
const char *pcret;
745
if(af == AF_INET6){
746
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
747
sizeof(addrstr));
748
} else {
749
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
750
sizeof(addrstr));
751
}
752
if(pcret == NULL){
753
perror_plus("inet_ntop");
754
} else {
755
if(strcmp(addrstr, ip) != 0){
756
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
757
}
758
}
759
}
760
761
if(quit_now){
762
errno = EINTR;
763
goto mandos_end;
764
}
765
766
if(af == AF_INET6){
767
ret = connect(tcp_sd, &to.in6, sizeof(to));
768
} else {
769
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
770
}
771
if(ret < 0){
772
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
773
int e = errno;
774
perror_plus("connect");
775
errno = e;
776
}
777
goto mandos_end;
778
}
779
780
if(quit_now){
781
errno = EINTR;
782
goto mandos_end;
783
}
784
785
const char *out = mandos_protocol_version;
786
written = 0;
787
while(true){
788
size_t out_size = strlen(out);
789
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
790
out_size - written));
791
if(ret == -1){
792
int e = errno;
793
perror_plus("write");
794
errno = e;
795
goto mandos_end;
796
}
797
written += (size_t)ret;
798
if(written < out_size){
799
continue;
800
} else {
801
if(out == mandos_protocol_version){
802
written = 0;
803
out = "\r\n";
804
} else {
805
break;
806
}
807
}
808
809
if(quit_now){
810
errno = EINTR;
811
goto mandos_end;
812
}
813
}
814
815
if(debug){
816
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
817
}
818
819
if(quit_now){
820
errno = EINTR;
821
goto mandos_end;
822
}
823
824
/* This casting via intptr_t is to eliminate warning about casting
825
an int to a pointer type. This is exactly how the GnuTLS Guile
826
function "set-session-transport-fd!" does it. */
827
gnutls_transport_set_ptr(session,
828
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
829
830
if(quit_now){
831
errno = EINTR;
832
goto mandos_end;
833
}
834
835
do {
836
ret = gnutls_handshake(session);
837
if(quit_now){
838
errno = EINTR;
839
goto mandos_end;
840
}
841
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
842
843
if(ret != GNUTLS_E_SUCCESS){
844
if(debug){
845
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
846
gnutls_perror(ret);
847
}
848
errno = EPROTO;
849
goto mandos_end;
850
}
851
852
/* Read OpenPGP packet that contains the wanted password */
853
854
if(debug){
855
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
856
" %s\n", ip);
857
}
858
859
while(true){
860
861
if(quit_now){
862
errno = EINTR;
863
goto mandos_end;
864
}
865
866
buffer_capacity = incbuffer(&buffer, buffer_length,
867
buffer_capacity);
868
if(buffer_capacity == 0){
869
int e = errno;
870
perror_plus("incbuffer");
871
errno = e;
872
goto mandos_end;
873
}
874
875
if(quit_now){
876
errno = EINTR;
877
goto mandos_end;
878
}
879
880
sret = gnutls_record_recv(session, buffer+buffer_length,
881
BUFFER_SIZE);
882
if(sret == 0){
373
883
break;
374
884
}
375
if (ret < 0){
376
switch(ret){
885
if(sret < 0){
886
switch(sret){
377
887
case GNUTLS_E_INTERRUPTED:
378
888
case GNUTLS_E_AGAIN:
379
889
break;
380
890
case GNUTLS_E_REHANDSHAKE:
381
ret = gnutls_handshake (es.session);
382
if (ret < 0){
383
fprintf(stderr, "\n*** Handshake failed ***\n");
384
gnutls_perror (ret);
385
retval = -1;
386
goto exit;
891
do {
892
ret = gnutls_handshake(session);
893
894
if(quit_now){
895
errno = EINTR;
896
goto mandos_end;
897
}
898
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
899
if(ret < 0){
900
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
901
"***\n");
902
gnutls_perror(ret);
903
errno = EPROTO;
904
goto mandos_end;
387
905
}
388
906
break;
389
907
default:
390
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
391
retval = -1;
392
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
393
goto exit;
908
fprintf_plus(stderr, "Unknown error while reading data from"
909
" encrypted session with Mandos server\n");
910
gnutls_bye(session, GNUTLS_SHUT_RDWR);
911
errno = EIO;
912
goto mandos_end;
394
913
}
395
914
} else {
396
buffer_length += ret;
397
}
398
}
399
400
if (buffer_length > 0){
401
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) == 0){
915
buffer_length += (size_t) sret;
916
}
917
}
918
919
if(debug){
920
fprintf_plus(stderr, "Closing TLS session\n");
921
}
922
923
if(quit_now){
924
errno = EINTR;
925
goto mandos_end;
926
}
927
928
do {
929
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
930
if(quit_now){
931
errno = EINTR;
932
goto mandos_end;
933
}
934
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
935
936
if(buffer_length > 0){
937
ssize_t decrypted_buffer_size;
938
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
939
&decrypted_buffer);
940
if(decrypted_buffer_size >= 0){
941
942
written = 0;
943
while(written < (size_t) decrypted_buffer_size){
944
if(quit_now){
945
errno = EINTR;
946
goto mandos_end;
947
}
948
949
ret = (int)fwrite(decrypted_buffer + written, 1,
950
(size_t)decrypted_buffer_size - written,
951
stdout);
952
if(ret == 0 and ferror(stdout)){
953
int e = errno;
954
if(debug){
955
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
956
strerror(errno));
957
}
958
errno = e;
959
goto mandos_end;
960
}
961
written += (size_t)ret;
962
}
963
retval = 0;
964
}
965
}
966
967
/* Shutdown procedure */
968
969
mandos_end:
970
{
971
int e = errno;
972
free(decrypted_buffer);
973
free(buffer);
974
if(tcp_sd >= 0){
975
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
976
}
977
if(ret == -1){
978
if(e == 0){
979
e = errno;
980
}
981
perror_plus("close");
982
}
983
gnutls_deinit(session);
984
errno = e;
985
if(quit_now){
986
errno = EINTR;
402
987
retval = -1;
403
} else {
404
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
405
free(decrypted_buffer);
406
988
}
407
989
}
408
409
free(buffer);
410
411
//shutdown procedure
412
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
413
exit:
414
close(tcp_sd);
415
gnutls_deinit (es.session);
416
gnutls_certificate_free_credentials (es.cred);
417
gnutls_global_deinit ();
418
990
return retval;
419
991
}
420
992
421
static AvahiSimplePoll *simple_poll = NULL;
422
static AvahiServer *server = NULL;
423
424
static void resolve_callback(
425
AvahiSServiceResolver *r,
426
AVAHI_GCC_UNUSED AvahiIfIndex interface,
427
AVAHI_GCC_UNUSED AvahiProtocol protocol,
428
AvahiResolverEvent event,
429
const char *name,
430
const char *type,
431
const char *domain,
432
const char *host_name,
433
const AvahiAddress *address,
434
uint16_t port,
435
AvahiStringList *txt,
436
AvahiLookupResultFlags flags,
437
AVAHI_GCC_UNUSED void* userdata) {
438
439
assert(r);
440
441
/* Called whenever a service has been resolved successfully or timed out */
442
443
switch (event) {
444
case AVAHI_RESOLVER_FAILURE:
445
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
446
break;
447
448
case AVAHI_RESOLVER_FOUND: {
449
char ip[AVAHI_ADDRESS_STR_MAX];
450
avahi_address_snprint(ip, sizeof(ip), address);
451
int ret = start_mandos_communcation(ip, port);
452
if (ret == 0){
453
exit(EXIT_SUCCESS);
454
} else {
455
exit(EXIT_FAILURE);
456
}
457
}
458
}
459
avahi_s_service_resolver_free(r);
460
}
461
462
static void browse_callback(
463
AvahiSServiceBrowser *b,
464
AvahiIfIndex interface,
465
AvahiProtocol protocol,
466
AvahiBrowserEvent event,
467
const char *name,
468
const char *type,
469
const char *domain,
470
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
471
void* userdata) {
472
473
AvahiServer *s = userdata;
474
assert(b);
475
476
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
477
478
switch (event) {
479
480
case AVAHI_BROWSER_FAILURE:
481
482
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
483
avahi_simple_poll_quit(simple_poll);
484
return;
485
486
case AVAHI_BROWSER_NEW:
487
/* We ignore the returned resolver object. In the callback
488
function we free it. If the server is terminated before
489
the callback function is called the server will free
490
the resolver for us. */
491
492
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
493
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
494
495
break;
496
497
case AVAHI_BROWSER_REMOVE:
498
break;
499
500
case AVAHI_BROWSER_ALL_FOR_NOW:
501
case AVAHI_BROWSER_CACHE_EXHAUSTED:
502
break;
503
}
504
}
505
506
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
993
static void resolve_callback(AvahiSServiceResolver *r,
994
AvahiIfIndex interface,
995
AvahiProtocol proto,
996
AvahiResolverEvent event,
997
const char *name,
998
const char *type,
999
const char *domain,
1000
const char *host_name,
1001
const AvahiAddress *address,
1002
uint16_t port,
1003
AVAHI_GCC_UNUSED AvahiStringList *txt,
1004
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1005
flags,
1006
AVAHI_GCC_UNUSED void* userdata){
1007
assert(r);
1008
1009
/* Called whenever a service has been resolved successfully or
1010
timed out */
1011
1012
if(quit_now){
1013
return;
1014
}
1015
1016
switch(event){
1017
default:
1018
case AVAHI_RESOLVER_FAILURE:
1019
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1020
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1021
domain,
1022
avahi_strerror(avahi_server_errno(mc.server)));
1023
break;
1024
1025
case AVAHI_RESOLVER_FOUND:
1026
{
1027
char ip[AVAHI_ADDRESS_STR_MAX];
1028
avahi_address_snprint(ip, sizeof(ip), address);
1029
if(debug){
1030
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1031
PRIdMAX ") on port %" PRIu16 "\n", name,
1032
host_name, ip, (intmax_t)interface, port);
1033
}
1034
int ret = start_mandos_communication(ip, port, interface,
1035
avahi_proto_to_af(proto));
1036
if(ret == 0){
1037
avahi_simple_poll_quit(mc.simple_poll);
1038
} else {
1039
if(not add_server(ip, port, interface,
1040
avahi_proto_to_af(proto))){
1041
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1042
" list\n", name);
1043
}
1044
}
1045
}
1046
}
1047
avahi_s_service_resolver_free(r);
1048
}
1049
1050
static void browse_callback(AvahiSServiceBrowser *b,
1051
AvahiIfIndex interface,
1052
AvahiProtocol protocol,
1053
AvahiBrowserEvent event,
1054
const char *name,
1055
const char *type,
1056
const char *domain,
1057
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1058
flags,
1059
AVAHI_GCC_UNUSED void* userdata){
1060
assert(b);
1061
1062
/* Called whenever a new services becomes available on the LAN or
1063
is removed from the LAN */
1064
1065
if(quit_now){
1066
return;
1067
}
1068
1069
switch(event){
1070
default:
1071
case AVAHI_BROWSER_FAILURE:
1072
1073
fprintf_plus(stderr, "(Avahi browser) %s\n",
1074
avahi_strerror(avahi_server_errno(mc.server)));
1075
avahi_simple_poll_quit(mc.simple_poll);
1076
return;
1077
1078
case AVAHI_BROWSER_NEW:
1079
/* We ignore the returned Avahi resolver object. In the callback
1080
function we free it. If the Avahi server is terminated before
1081
the callback function is called the Avahi server will free the
1082
resolver for us. */
1083
1084
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1085
name, type, domain, protocol, 0,
1086
resolve_callback, NULL) == NULL)
1087
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1088
" %s\n", name,
1089
avahi_strerror(avahi_server_errno(mc.server)));
1090
break;
1091
1092
case AVAHI_BROWSER_REMOVE:
1093
break;
1094
1095
case AVAHI_BROWSER_ALL_FOR_NOW:
1096
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1097
if(debug){
1098
fprintf_plus(stderr, "No Mandos server found, still"
1099
" searching...\n");
1100
}
1101
break;
1102
}
1103
}
1104
1105
/* Signal handler that stops main loop after SIGTERM */
1106
static void handle_sigterm(int sig){
1107
if(quit_now){
1108
return;
1109
}
1110
quit_now = 1;
1111
signal_received = sig;
1112
int old_errno = errno;
1113
/* set main loop to exit */
1114
if(mc.simple_poll != NULL){
1115
avahi_simple_poll_quit(mc.simple_poll);
1116
}
1117
errno = old_errno;
1118
}
1119
1120
bool get_flags(const char *ifname, struct ifreq *ifr){
1121
int ret;
1122
1123
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1124
if(s < 0){
1125
perror_plus("socket");
1126
return false;
1127
}
1128
strcpy(ifr->ifr_name, ifname);
1129
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1130
if(ret == -1){
1131
if(debug){
1132
perror_plus("ioctl SIOCGIFFLAGS");
1133
}
1134
return false;
1135
}
1136
return true;
1137
}
1138
1139
bool good_flags(const char *ifname, const struct ifreq *ifr){
1140
1141
/* Reject the loopback device */
1142
if(ifr->ifr_flags & IFF_LOOPBACK){
1143
if(debug){
1144
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1145
ifname);
1146
}
1147
return false;
1148
}
1149
/* Accept point-to-point devices only if connect_to is specified */
1150
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1151
if(debug){
1152
fprintf_plus(stderr, "Accepting point-to-point interface"
1153
" \"%s\"\n", ifname);
1154
}
1155
return true;
1156
}
1157
/* Otherwise, reject non-broadcast-capable devices */
1158
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1159
if(debug){
1160
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1161
" \"%s\"\n", ifname);
1162
}
1163
return false;
1164
}
1165
/* Reject non-ARP interfaces (including dummy interfaces) */
1166
if(ifr->ifr_flags & IFF_NOARP){
1167
if(debug){
1168
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1169
ifname);
1170
}
1171
return false;
1172
}
1173
1174
/* Accept this device */
1175
if(debug){
1176
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1177
}
1178
return true;
1179
}
1180
1181
/*
1182
* This function determines if a directory entry in /sys/class/net
1183
* corresponds to an acceptable network device.
1184
* (This function is passed to scandir(3) as a filter function.)
1185
*/
1186
int good_interface(const struct dirent *if_entry){
1187
if(if_entry->d_name[0] == '.'){
1188
return 0;
1189
}
1190
1191
struct ifreq ifr;
1192
if(not get_flags(if_entry->d_name, &ifr)){
1193
if(debug){
1194
fprintf_plus(stderr, "Failed to get flags for interface "
1195
"\"%s\"\n", if_entry->d_name);
1196
}
1197
return 0;
1198
}
1199
1200
if(not good_flags(if_entry->d_name, &ifr)){
1201
return 0;
1202
}
1203
return 1;
1204
}
1205
1206
/*
1207
* This function determines if a directory entry in /sys/class/net
1208
* corresponds to an acceptable network device which is up.
1209
* (This function is passed to scandir(3) as a filter function.)
1210
*/
1211
int up_interface(const struct dirent *if_entry){
1212
if(if_entry->d_name[0] == '.'){
1213
return 0;
1214
}
1215
1216
struct ifreq ifr;
1217
if(not get_flags(if_entry->d_name, &ifr)){
1218
if(debug){
1219
fprintf_plus(stderr, "Failed to get flags for interface "
1220
"\"%s\"\n", if_entry->d_name);
1221
}
1222
return 0;
1223
}
1224
1225
/* Reject down interfaces */
1226
if(not (ifr.ifr_flags & IFF_UP)){
1227
if(debug){
1228
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1229
if_entry->d_name);
1230
}
1231
return 0;
1232
}
1233
1234
/* Reject non-running interfaces */
1235
if(not (ifr.ifr_flags & IFF_RUNNING)){
1236
if(debug){
1237
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1238
if_entry->d_name);
1239
}
1240
return 0;
1241
}
1242
1243
if(not good_flags(if_entry->d_name, &ifr)){
1244
return 0;
1245
}
1246
return 1;
1247
}
1248
1249
int notdotentries(const struct dirent *direntry){
1250
/* Skip "." and ".." */
1251
if(direntry->d_name[0] == '.'
1252
and (direntry->d_name[1] == '\0'
1253
or (direntry->d_name[1] == '.'
1254
and direntry->d_name[2] == '\0'))){
1255
return 0;
1256
}
1257
return 1;
1258
}
1259
1260
/* Is this directory entry a runnable program? */
1261
int runnable_hook(const struct dirent *direntry){
1262
int ret;
1263
size_t sret;
1264
struct stat st;
1265
1266
if((direntry->d_name)[0] == '\0'){
1267
/* Empty name? */
1268
return 0;
1269
}
1270
1271
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1272
"abcdefghijklmnopqrstuvwxyz"
1273
"0123456789"
1274
"_-");
1275
if((direntry->d_name)[sret] != '\0'){
1276
/* Contains non-allowed characters */
1277
if(debug){
1278
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1279
direntry->d_name);
1280
}
1281
return 0;
1282
}
1283
1284
char *fullname = NULL;
1285
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1286
if(ret < 0){
1287
perror_plus("asprintf");
1288
return 0;
1289
}
1290
1291
ret = stat(fullname, &st);
1292
if(ret == -1){
1293
if(debug){
1294
perror_plus("Could not stat hook");
1295
}
1296
return 0;
1297
}
1298
if(not (S_ISREG(st.st_mode))){
1299
/* Not a regular file */
1300
if(debug){
1301
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1302
direntry->d_name);
1303
}
1304
return 0;
1305
}
1306
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1307
/* Not executable */
1308
if(debug){
1309
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1310
direntry->d_name);
1311
}
1312
return 0;
1313
}
1314
if(debug){
1315
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1316
direntry->d_name);
1317
}
1318
return 1;
1319
}
1320
1321
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1322
int ret;
1323
struct timespec now;
1324
struct timespec waited_time;
1325
intmax_t block_time;
1326
1327
while(true){
1328
if(mc.current_server == NULL){
1329
if (debug){
1330
fprintf_plus(stderr, "Wait until first server is found."
1331
" No timeout!\n");
1332
}
1333
ret = avahi_simple_poll_iterate(s, -1);
1334
} else {
1335
if (debug){
1336
fprintf_plus(stderr, "Check current_server if we should run"
1337
" it, or wait\n");
1338
}
1339
/* the current time */
1340
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1341
if(ret == -1){
1342
perror_plus("clock_gettime");
1343
return -1;
1344
}
1345
/* Calculating in ms how long time between now and server
1346
who we visted longest time ago. Now - last seen. */
1347
waited_time.tv_sec = (now.tv_sec
1348
- mc.current_server->last_seen.tv_sec);
1349
waited_time.tv_nsec = (now.tv_nsec
1350
- mc.current_server->last_seen.tv_nsec);
1351
/* total time is 10s/10,000ms.
1352
Converting to s from ms by dividing by 1,000,
1353
and ns to ms by dividing by 1,000,000. */
1354
block_time = ((retry_interval
1355
- ((intmax_t)waited_time.tv_sec * 1000))
1356
- ((intmax_t)waited_time.tv_nsec / 1000000));
1357
1358
if (debug){
1359
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1360
block_time);
1361
}
1362
1363
if(block_time <= 0){
1364
ret = start_mandos_communication(mc.current_server->ip,
1365
mc.current_server->port,
1366
mc.current_server->if_index,
1367
mc.current_server->af);
1368
if(ret == 0){
1369
avahi_simple_poll_quit(mc.simple_poll);
1370
return 0;
1371
}
1372
ret = clock_gettime(CLOCK_MONOTONIC,
1373
&mc.current_server->last_seen);
1374
if(ret == -1){
1375
perror_plus("clock_gettime");
1376
return -1;
1377
}
1378
mc.current_server = mc.current_server->next;
1379
block_time = 0; /* Call avahi to find new Mandos
1380
servers, but don't block */
1381
}
1382
1383
ret = avahi_simple_poll_iterate(s, (int)block_time);
1384
}
1385
if(ret != 0){
1386
if (ret > 0 or errno != EINTR){
1387
return (ret != 1) ? ret : 0;
1388
}
1389
}
1390
}
1391
}
1392
1393
bool run_network_hooks(const char *mode, const char *interface,
1394
const float delay){
1395
struct dirent **direntries;
1396
struct dirent *direntry;
1397
int ret;
1398
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1399
alphasort);
1400
if(numhooks == -1){
1401
perror_plus("scandir");
1402
} else {
1403
int devnull = open("/dev/null", O_RDONLY);
1404
for(int i = 0; i < numhooks; i++){
1405
direntry = direntries[i];
1406
char *fullname = NULL;
1407
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1408
if(ret < 0){
1409
perror_plus("asprintf");
1410
continue;
1411
}
1412
if(debug){
1413
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1414
direntry->d_name);
1415
}
1416
pid_t hook_pid = fork();
1417
if(hook_pid == 0){
1418
/* Child */
1419
/* Raise privileges */
1420
errno = 0;
1421
ret = seteuid(0);
1422
if(ret == -1){
1423
perror_plus("seteuid");
1424
}
1425
/* Raise privileges even more */
1426
errno = 0;
1427
ret = setuid(0);
1428
if(ret == -1){
1429
perror_plus("setuid");
1430
}
1431
/* Set group */
1432
errno = 0;
1433
ret = setgid(0);
1434
if(ret == -1){
1435
perror_plus("setgid");
1436
}
1437
/* Reset supplementary groups */
1438
errno = 0;
1439
ret = setgroups(0, NULL);
1440
if(ret == -1){
1441
perror_plus("setgroups");
1442
}
1443
dup2(devnull, STDIN_FILENO);
1444
close(devnull);
1445
dup2(STDERR_FILENO, STDOUT_FILENO);
1446
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1447
if(ret == -1){
1448
perror_plus("setenv");
1449
_exit(EX_OSERR);
1450
}
1451
ret = setenv("DEVICE", interface, 1);
1452
if(ret == -1){
1453
perror_plus("setenv");
1454
_exit(EX_OSERR);
1455
}
1456
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1457
if(ret == -1){
1458
perror_plus("setenv");
1459
_exit(EX_OSERR);
1460
}
1461
ret = setenv("MODE", mode, 1);
1462
if(ret == -1){
1463
perror_plus("setenv");
1464
_exit(EX_OSERR);
1465
}
1466
char *delaystring;
1467
ret = asprintf(&delaystring, "%f", delay);
1468
if(ret == -1){
1469
perror_plus("asprintf");
1470
_exit(EX_OSERR);
1471
}
1472
ret = setenv("DELAY", delaystring, 1);
1473
if(ret == -1){
1474
free(delaystring);
1475
perror_plus("setenv");
1476
_exit(EX_OSERR);
1477
}
1478
free(delaystring);
1479
if(connect_to != NULL){
1480
ret = setenv("CONNECT", connect_to, 1);
1481
if(ret == -1){
1482
perror_plus("setenv");
1483
_exit(EX_OSERR);
1484
}
1485
}
1486
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1487
perror_plus("execl");
1488
_exit(EXIT_FAILURE);
1489
}
1490
} else {
1491
int status;
1492
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1493
perror_plus("waitpid");
1494
free(fullname);
1495
continue;
1496
}
1497
if(WIFEXITED(status)){
1498
if(WEXITSTATUS(status) != 0){
1499
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1500
" with status %d\n", direntry->d_name,
1501
WEXITSTATUS(status));
1502
free(fullname);
1503
continue;
1504
}
1505
} else if(WIFSIGNALED(status)){
1506
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1507
" signal %d\n", direntry->d_name,
1508
WTERMSIG(status));
1509
free(fullname);
1510
continue;
1511
} else {
1512
fprintf_plus(stderr, "Warning: network hook \"%s\""
1513
" crashed\n", direntry->d_name);
1514
free(fullname);
1515
continue;
1516
}
1517
}
1518
free(fullname);
1519
if(debug){
1520
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1521
direntry->d_name);
1522
}
1523
}
1524
close(devnull);
1525
}
1526
return true;
1527
}
1528
1529
int main(int argc, char *argv[]){
1530
AvahiSServiceBrowser *sb = NULL;
1531
int error;
1532
int ret;
1533
intmax_t tmpmax;
1534
char *tmp;
1535
int exitcode = EXIT_SUCCESS;
1536
const char *interface = "";
1537
struct ifreq network;
1538
int sd = -1;
1539
bool take_down_interface = false;
1540
uid_t uid;
1541
gid_t gid;
1542
char tempdir[] = "/tmp/mandosXXXXXX";
1543
bool tempdir_created = false;
1544
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1545
const char *seckey = PATHDIR "/" SECKEY;
1546
const char *pubkey = PATHDIR "/" PUBKEY;
1547
1548
bool gnutls_initialized = false;
1549
bool gpgme_initialized = false;
1550
float delay = 2.5f;
1551
double retry_interval = 10; /* 10s between trying a server and
1552
retrying the same server again */
1553
1554
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1555
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1556
1557
uid = getuid();
1558
gid = getgid();
1559
1560
/* Lower any group privileges we might have, just to be safe */
1561
errno = 0;
1562
ret = setgid(gid);
1563
if(ret == -1){
1564
perror_plus("setgid");
1565
}
1566
1567
/* Lower user privileges (temporarily) */
1568
errno = 0;
1569
ret = seteuid(uid);
1570
if(ret == -1){
1571
perror_plus("seteuid");
1572
}
1573
1574
if(quit_now){
1575
goto end;
1576
}
1577
1578
{
1579
struct argp_option options[] = {
1580
{ .name = "debug", .key = 128,
1581
.doc = "Debug mode", .group = 3 },
1582
{ .name = "connect", .key = 'c',
1583
.arg = "ADDRESS:PORT",
1584
.doc = "Connect directly to a specific Mandos server",
1585
.group = 1 },
1586
{ .name = "interface", .key = 'i',
1587
.arg = "NAME",
1588
.doc = "Network interface that will be used to search for"
1589
" Mandos servers",
1590
.group = 1 },
1591
{ .name = "seckey", .key = 's',
1592
.arg = "FILE",
1593
.doc = "OpenPGP secret key file base name",
1594
.group = 1 },
1595
{ .name = "pubkey", .key = 'p',
1596
.arg = "FILE",
1597
.doc = "OpenPGP public key file base name",
1598
.group = 2 },
1599
{ .name = "dh-bits", .key = 129,
1600
.arg = "BITS",
1601
.doc = "Bit length of the prime number used in the"
1602
" Diffie-Hellman key exchange",
1603
.group = 2 },
1604
{ .name = "priority", .key = 130,
1605
.arg = "STRING",
1606
.doc = "GnuTLS priority string for the TLS handshake",
1607
.group = 1 },
1608
{ .name = "delay", .key = 131,
1609
.arg = "SECONDS",
1610
.doc = "Maximum delay to wait for interface startup",
1611
.group = 2 },
1612
{ .name = "retry", .key = 132,
1613
.arg = "SECONDS",
1614
.doc = "Retry interval used when denied by the Mandos server",
1615
.group = 2 },
1616
{ .name = "network-hook-dir", .key = 133,
1617
.arg = "DIR",
1618
.doc = "Directory where network hooks are located",
1619
.group = 2 },
1620
/*
1621
* These reproduce what we would get without ARGP_NO_HELP
1622
*/
1623
{ .name = "help", .key = '?',
1624
.doc = "Give this help list", .group = -1 },
1625
{ .name = "usage", .key = -3,
1626
.doc = "Give a short usage message", .group = -1 },
1627
{ .name = "version", .key = 'V',
1628
.doc = "Print program version", .group = -1 },
1629
{ .name = NULL }
1630
};
1631
1632
error_t parse_opt(int key, char *arg,
1633
struct argp_state *state){
1634
errno = 0;
1635
switch(key){
1636
case 128: /* --debug */
1637
debug = true;
1638
break;
1639
case 'c': /* --connect */
1640
connect_to = arg;
1641
break;
1642
case 'i': /* --interface */
1643
interface = arg;
1644
break;
1645
case 's': /* --seckey */
1646
seckey = arg;
1647
break;
1648
case 'p': /* --pubkey */
1649
pubkey = arg;
1650
break;
1651
case 129: /* --dh-bits */
1652
errno = 0;
1653
tmpmax = strtoimax(arg, &tmp, 10);
1654
if(errno != 0 or tmp == arg or *tmp != '\0'
1655
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1656
argp_error(state, "Bad number of DH bits");
1657
}
1658
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1659
break;
1660
case 130: /* --priority */
1661
mc.priority = arg;
1662
break;
1663
case 131: /* --delay */
1664
errno = 0;
1665
delay = strtof(arg, &tmp);
1666
if(errno != 0 or tmp == arg or *tmp != '\0'){
1667
argp_error(state, "Bad delay");
1668
}
1669
case 132: /* --retry */
1670
errno = 0;
1671
retry_interval = strtod(arg, &tmp);
1672
if(errno != 0 or tmp == arg or *tmp != '\0'
1673
or (retry_interval * 1000) > INT_MAX
1674
or retry_interval < 0){
1675
argp_error(state, "Bad retry interval");
1676
}
1677
break;
1678
case 133: /* --network-hook-dir */
1679
hookdir = arg;
1680
break;
1681
/*
1682
* These reproduce what we would get without ARGP_NO_HELP
1683
*/
1684
case '?': /* --help */
1685
argp_state_help(state, state->out_stream,
1686
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1687
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1688
case -3: /* --usage */
1689
argp_state_help(state, state->out_stream,
1690
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1691
case 'V': /* --version */
1692
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
1693
exit(argp_err_exit_status);
1694
break;
1695
default:
1696
return ARGP_ERR_UNKNOWN;
1697
}
1698
return errno;
1699
}
1700
1701
struct argp argp = { .options = options, .parser = parse_opt,
1702
.args_doc = "",
1703
.doc = "Mandos client -- Get and decrypt"
1704
" passwords from a Mandos server" };
1705
ret = argp_parse(&argp, argc, argv,
1706
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1707
switch(ret){
1708
case 0:
1709
break;
1710
case ENOMEM:
1711
default:
1712
errno = ret;
1713
perror_plus("argp_parse");
1714
exitcode = EX_OSERR;
1715
goto end;
1716
case EINVAL:
1717
exitcode = EX_USAGE;
1718
goto end;
1719
}
1720
}
1721
1722
{
1723
/* Work around Debian bug #633582:
1724
<http://bugs.debian.org/633582> */
1725
1726
/* Re-raise priviliges */
1727
errno = 0;
1728
ret = seteuid(0);
1729
if(ret == -1){
1730
perror_plus("seteuid");
1731
} else {
1732
struct stat st;
1733
1734
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
1735
int seckey_fd = open(seckey, O_RDONLY);
1736
if(seckey_fd == -1){
1737
perror_plus("open");
1738
} else {
1739
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
1740
if(ret == -1){
1741
perror_plus("fstat");
1742
} else {
1743
if(S_ISREG(st.st_mode)
1744
and st.st_uid == 0 and st.st_gid == 0){
1745
ret = fchown(seckey_fd, uid, gid);
1746
if(ret == -1){
1747
perror_plus("fchown");
1748
}
1749
}
1750
}
1751
TEMP_FAILURE_RETRY(close(seckey_fd));
1752
}
1753
}
1754
1755
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
1756
int pubkey_fd = open(pubkey, O_RDONLY);
1757
if(pubkey_fd == -1){
1758
perror_plus("open");
1759
} else {
1760
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
1761
if(ret == -1){
1762
perror_plus("fstat");
1763
} else {
1764
if(S_ISREG(st.st_mode)
1765
and st.st_uid == 0 and st.st_gid == 0){
1766
ret = fchown(pubkey_fd, uid, gid);
1767
if(ret == -1){
1768
perror_plus("fchown");
1769
}
1770
}
1771
}
1772
TEMP_FAILURE_RETRY(close(pubkey_fd));
1773
}
1774
}
1775
1776
/* Lower privileges */
1777
errno = 0;
1778
ret = seteuid(uid);
1779
if(ret == -1){
1780
perror_plus("seteuid");
1781
}
1782
}
1783
}
1784
1785
/* Run network hooks */
1786
if(not run_network_hooks("start", interface, delay)){
1787
goto end;
1788
}
1789
1790
if(not debug){
1791
avahi_set_log_function(empty_log);
1792
}
1793
1794
if(interface[0] == '\0'){
1795
struct dirent **direntries;
1796
/* First look for interfaces that are up */
1797
ret = scandir(sys_class_net, &direntries, up_interface,
1798
alphasort);
1799
if(ret == 0){
1800
/* No up interfaces, look for any good interfaces */
1801
free(direntries);
1802
ret = scandir(sys_class_net, &direntries, good_interface,
1803
alphasort);
1804
}
1805
if(ret >= 1){
1806
/* Pick the first interface returned */
1807
interface = strdup(direntries[0]->d_name);
1808
if(debug){
1809
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1810
}
1811
if(interface == NULL){
1812
perror_plus("malloc");
1813
free(direntries);
1814
exitcode = EXIT_FAILURE;
1815
goto end;
1816
}
1817
free(direntries);
1818
} else {
1819
free(direntries);
1820
fprintf_plus(stderr, "Could not find a network interface\n");
1821
exitcode = EXIT_FAILURE;
1822
goto end;
1823
}
1824
}
1825
1826
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1827
from the signal handler */
1828
/* Initialize the pseudo-RNG for Avahi */
1829
srand((unsigned int) time(NULL));
1830
mc.simple_poll = avahi_simple_poll_new();
1831
if(mc.simple_poll == NULL){
1832
fprintf_plus(stderr,
1833
"Avahi: Failed to create simple poll object.\n");
1834
exitcode = EX_UNAVAILABLE;
1835
goto end;
1836
}
1837
1838
sigemptyset(&sigterm_action.sa_mask);
1839
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1840
if(ret == -1){
1841
perror_plus("sigaddset");
1842
exitcode = EX_OSERR;
1843
goto end;
1844
}
1845
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1846
if(ret == -1){
1847
perror_plus("sigaddset");
1848
exitcode = EX_OSERR;
1849
goto end;
1850
}
1851
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1852
if(ret == -1){
1853
perror_plus("sigaddset");
1854
exitcode = EX_OSERR;
1855
goto end;
1856
}
1857
/* Need to check if the handler is SIG_IGN before handling:
1858
| [[info:libc:Initial Signal Actions]] |
1859
| [[info:libc:Basic Signal Handling]] |
1860
*/
1861
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1862
if(ret == -1){
1863
perror_plus("sigaction");
1864
return EX_OSERR;
1865
}
1866
if(old_sigterm_action.sa_handler != SIG_IGN){
1867
ret = sigaction(SIGINT, &sigterm_action, NULL);
1868
if(ret == -1){
1869
perror_plus("sigaction");
1870
exitcode = EX_OSERR;
1871
goto end;
1872
}
1873
}
1874
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1875
if(ret == -1){
1876
perror_plus("sigaction");
1877
return EX_OSERR;
1878
}
1879
if(old_sigterm_action.sa_handler != SIG_IGN){
1880
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1881
if(ret == -1){
1882
perror_plus("sigaction");
1883
exitcode = EX_OSERR;
1884
goto end;
1885
}
1886
}
1887
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1888
if(ret == -1){
1889
perror_plus("sigaction");
1890
return EX_OSERR;
1891
}
1892
if(old_sigterm_action.sa_handler != SIG_IGN){
1893
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1894
if(ret == -1){
1895
perror_plus("sigaction");
1896
exitcode = EX_OSERR;
1897
goto end;
1898
}
1899
}
1900
1901
/* If the interface is down, bring it up */
1902
if(strcmp(interface, "none") != 0){
1903
if_index = (AvahiIfIndex) if_nametoindex(interface);
1904
if(if_index == 0){
1905
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1906
exitcode = EX_UNAVAILABLE;
1907
goto end;
1908
}
1909
1910
if(quit_now){
1911
goto end;
1912
}
1913
1914
/* Re-raise priviliges */
1915
errno = 0;
1916
ret = seteuid(0);
1917
if(ret == -1){
1918
perror_plus("seteuid");
1919
}
1920
1921
#ifdef __linux__
1922
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1923
messages about the network interface to mess up the prompt */
1924
ret = klogctl(8, NULL, 5);
1925
bool restore_loglevel = true;
1926
if(ret == -1){
1927
restore_loglevel = false;
1928
perror_plus("klogctl");
1929
}
1930
#endif /* __linux__ */
1931
1932
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1933
if(sd < 0){
1934
perror_plus("socket");
1935
exitcode = EX_OSERR;
1936
#ifdef __linux__
1937
if(restore_loglevel){
1938
ret = klogctl(7, NULL, 0);
1939
if(ret == -1){
1940
perror_plus("klogctl");
1941
}
1942
}
1943
#endif /* __linux__ */
1944
/* Lower privileges */
1945
errno = 0;
1946
ret = seteuid(uid);
1947
if(ret == -1){
1948
perror_plus("seteuid");
1949
}
1950
goto end;
1951
}
1952
strcpy(network.ifr_name, interface);
1953
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1954
if(ret == -1){
1955
perror_plus("ioctl SIOCGIFFLAGS");
1956
#ifdef __linux__
1957
if(restore_loglevel){
1958
ret = klogctl(7, NULL, 0);
1959
if(ret == -1){
1960
perror_plus("klogctl");
1961
}
1962
}
1963
#endif /* __linux__ */
1964
exitcode = EX_OSERR;
1965
/* Lower privileges */
1966
errno = 0;
1967
ret = seteuid(uid);
1968
if(ret == -1){
1969
perror_plus("seteuid");
1970
}
1971
goto end;
1972
}
1973
if((network.ifr_flags & IFF_UP) == 0){
1974
network.ifr_flags |= IFF_UP;
1975
take_down_interface = true;
1976
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1977
if(ret == -1){
1978
take_down_interface = false;
1979
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1980
exitcode = EX_OSERR;
1981
#ifdef __linux__
1982
if(restore_loglevel){
1983
ret = klogctl(7, NULL, 0);
1984
if(ret == -1){
1985
perror_plus("klogctl");
1986
}
1987
}
1988
#endif /* __linux__ */
1989
/* Lower privileges */
1990
errno = 0;
1991
ret = seteuid(uid);
1992
if(ret == -1){
1993
perror_plus("seteuid");
1994
}
1995
goto end;
1996
}
1997
}
1998
/* Sleep checking until interface is running.
1999
Check every 0.25s, up to total time of delay */
2000
for(int i=0; i < delay * 4; i++){
2001
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2002
if(ret == -1){
2003
perror_plus("ioctl SIOCGIFFLAGS");
2004
} else if(network.ifr_flags & IFF_RUNNING){
2005
break;
2006
}
2007
struct timespec sleeptime = { .tv_nsec = 250000000 };
2008
ret = nanosleep(&sleeptime, NULL);
2009
if(ret == -1 and errno != EINTR){
2010
perror_plus("nanosleep");
2011
}
2012
}
2013
if(not take_down_interface){
2014
/* We won't need the socket anymore */
2015
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2016
if(ret == -1){
2017
perror_plus("close");
2018
}
2019
}
2020
#ifdef __linux__
2021
if(restore_loglevel){
2022
/* Restores kernel loglevel to default */
2023
ret = klogctl(7, NULL, 0);
2024
if(ret == -1){
2025
perror_plus("klogctl");
2026
}
2027
}
2028
#endif /* __linux__ */
2029
/* Lower privileges */
2030
errno = 0;
2031
/* Lower privileges */
2032
ret = seteuid(uid);
2033
if(ret == -1){
2034
perror_plus("seteuid");
2035
}
2036
}
2037
2038
if(quit_now){
2039
goto end;
2040
}
2041
2042
ret = init_gnutls_global(pubkey, seckey);
2043
if(ret == -1){
2044
fprintf_plus(stderr, "init_gnutls_global failed\n");
2045
exitcode = EX_UNAVAILABLE;
2046
goto end;
2047
} else {
2048
gnutls_initialized = true;
2049
}
2050
2051
if(quit_now){
2052
goto end;
2053
}
2054
2055
if(mkdtemp(tempdir) == NULL){
2056
perror_plus("mkdtemp");
2057
goto end;
2058
}
2059
tempdir_created = true;
2060
2061
if(quit_now){
2062
goto end;
2063
}
2064
2065
if(not init_gpgme(pubkey, seckey, tempdir)){
2066
fprintf_plus(stderr, "init_gpgme failed\n");
2067
exitcode = EX_UNAVAILABLE;
2068
goto end;
2069
} else {
2070
gpgme_initialized = true;
2071
}
2072
2073
if(quit_now){
2074
goto end;
2075
}
2076
2077
if(connect_to != NULL){
2078
/* Connect directly, do not use Zeroconf */
2079
/* (Mainly meant for debugging) */
2080
char *address = strrchr(connect_to, ':');
2081
if(address == NULL){
2082
fprintf_plus(stderr, "No colon in address\n");
2083
exitcode = EX_USAGE;
2084
goto end;
2085
}
2086
2087
if(quit_now){
2088
goto end;
2089
}
2090
2091
uint16_t port;
2092
errno = 0;
2093
tmpmax = strtoimax(address+1, &tmp, 10);
2094
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2095
or tmpmax != (uint16_t)tmpmax){
2096
fprintf_plus(stderr, "Bad port number\n");
2097
exitcode = EX_USAGE;
2098
goto end;
2099
}
2100
2101
if(quit_now){
2102
goto end;
2103
}
2104
2105
port = (uint16_t)tmpmax;
2106
*address = '\0';
2107
/* Colon in address indicates IPv6 */
2108
int af;
2109
if(strchr(connect_to, ':') != NULL){
2110
af = AF_INET6;
2111
/* Accept [] around IPv6 address - see RFC 5952 */
2112
if(connect_to[0] == '[' and address[-1] == ']')
2113
{
2114
connect_to++;
2115
address[-1] = '\0';
2116
}
2117
} else {
2118
af = AF_INET;
2119
}
2120
address = connect_to;
2121
2122
if(quit_now){
2123
goto end;
2124
}
2125
2126
while(not quit_now){
2127
ret = start_mandos_communication(address, port, if_index, af);
2128
if(quit_now or ret == 0){
2129
break;
2130
}
2131
if(debug){
2132
fprintf_plus(stderr, "Retrying in %d seconds\n",
2133
(int)retry_interval);
2134
}
2135
sleep((int)retry_interval);
2136
}
2137
2138
if (not quit_now){
2139
exitcode = EXIT_SUCCESS;
2140
}
2141
2142
goto end;
2143
}
2144
2145
if(quit_now){
2146
goto end;
2147
}
2148
2149
{
507
2150
AvahiServerConfig config;
508
AvahiSServiceBrowser *sb = NULL;
509
int error;
510
int ret = 1;
511
512
avahi_set_log_function(empty_log);
513
514
/* Initialize the psuedo-RNG */
515
srand(time(NULL));
516
517
/* Allocate main loop object */
518
if (!(simple_poll = avahi_simple_poll_new())) {
519
fprintf(stderr, "Failed to create simple poll object.\n");
520
goto fail;
521
}
522
523
/* Do not publish any local records */
2151
/* Do not publish any local Zeroconf records */
524
2152
avahi_server_config_init(&config);
525
2153
config.publish_hinfo = 0;
526
2154
config.publish_addresses = 0;
527
2155
config.publish_workstation = 0;
528
2156
config.publish_domain = 0;
529
530
/* /\* Set a unicast DNS server for wide area DNS-SD *\/ */
531
/* avahi_address_parse("193.11.177.11", AVAHI_PROTO_UNSPEC, &config.wide_area_servers[0]); */
532
/* config.n_wide_area_servers = 1; */
533
/* config.enable_wide_area = 1; */
534
2157
535
2158
/* Allocate a new server */
536
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
537
538
/* Free the configuration data */
2159
mc.server = avahi_server_new(avahi_simple_poll_get
2160
(mc.simple_poll), &config, NULL,
2161
NULL, &error);
2162
2163
/* Free the Avahi configuration data */
539
2164
avahi_server_config_free(&config);
540
541
/* Check wether creating the server object succeeded */
542
if (!server) {
543
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
544
goto fail;
545
}
546
547
/* Create the service browser */
548
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
549
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
550
goto fail;
551
}
552
553
/* Run the main loop */
554
avahi_simple_poll_loop(simple_poll);
555
556
ret = 0;
557
558
fail:
559
560
/* Cleanup things */
561
if (sb)
562
avahi_s_service_browser_free(sb);
563
564
if (server)
565
avahi_server_free(server);
566
567
if (simple_poll)
568
avahi_simple_poll_free(simple_poll);
569
570
return ret;
2165
}
2166
2167
/* Check if creating the Avahi server object succeeded */
2168
if(mc.server == NULL){
2169
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2170
avahi_strerror(error));
2171
exitcode = EX_UNAVAILABLE;
2172
goto end;
2173
}
2174
2175
if(quit_now){
2176
goto end;
2177
}
2178
2179
/* Create the Avahi service browser */
2180
sb = avahi_s_service_browser_new(mc.server, if_index,
2181
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2182
NULL, 0, browse_callback, NULL);
2183
if(sb == NULL){
2184
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2185
avahi_strerror(avahi_server_errno(mc.server)));
2186
exitcode = EX_UNAVAILABLE;
2187
goto end;
2188
}
2189
2190
if(quit_now){
2191
goto end;
2192
}
2193
2194
/* Run the main loop */
2195
2196
if(debug){
2197
fprintf_plus(stderr, "Starting Avahi loop search\n");
2198
}
2199
2200
ret = avahi_loop_with_timeout(mc.simple_poll,
2201
(int)(retry_interval * 1000));
2202
if(debug){
2203
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2204
(ret == 0) ? "successfully" : "with error");
2205
}
2206
2207
end:
2208
2209
if(debug){
2210
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2211
}
2212
2213
/* Cleanup things */
2214
if(sb != NULL)
2215
avahi_s_service_browser_free(sb);
2216
2217
if(mc.server != NULL)
2218
avahi_server_free(mc.server);
2219
2220
if(mc.simple_poll != NULL)
2221
avahi_simple_poll_free(mc.simple_poll);
2222
2223
if(gnutls_initialized){
2224
gnutls_certificate_free_credentials(mc.cred);
2225
gnutls_global_deinit();
2226
gnutls_dh_params_deinit(mc.dh_params);
2227
}
2228
2229
if(gpgme_initialized){
2230
gpgme_release(mc.ctx);
2231
}
2232
2233
/* Cleans up the circular linked list of Mandos servers the client
2234
has seen */
2235
if(mc.current_server != NULL){
2236
mc.current_server->prev->next = NULL;
2237
while(mc.current_server != NULL){
2238
server *next = mc.current_server->next;
2239
free(mc.current_server);
2240
mc.current_server = next;
2241
}
2242
}
2243
2244
/* Run network hooks */
2245
run_network_hooks("stop", interface, delay);
2246
2247
/* Re-raise priviliges */
2248
{
2249
errno = 0;
2250
ret = seteuid(0);
2251
if(ret == -1){
2252
perror_plus("seteuid");
2253
}
2254
2255
/* Take down the network interface */
2256
if(take_down_interface and geteuid() == 0){
2257
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2258
if(ret == -1){
2259
perror_plus("ioctl SIOCGIFFLAGS");
2260
} else if(network.ifr_flags & IFF_UP){
2261
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2262
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2263
if(ret == -1){
2264
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2265
}
2266
}
2267
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2268
if(ret == -1){
2269
perror_plus("close");
2270
}
2271
}
2272
}
2273
/* Lower privileges permanently */
2274
errno = 0;
2275
ret = setuid(uid);
2276
if(ret == -1){
2277
perror_plus("setuid");
2278
}
2279
2280
/* Removes the GPGME temp directory and all files inside */
2281
if(tempdir_created){
2282
struct dirent **direntries = NULL;
2283
struct dirent *direntry = NULL;
2284
int numentries = scandir(tempdir, &direntries, notdotentries,
2285
alphasort);
2286
if (numentries > 0){
2287
for(int i = 0; i < numentries; i++){
2288
direntry = direntries[i];
2289
char *fullname = NULL;
2290
ret = asprintf(&fullname, "%s/%s", tempdir,
2291
direntry->d_name);
2292
if(ret < 0){
2293
perror_plus("asprintf");
2294
continue;
2295
}
2296
ret = remove(fullname);
2297
if(ret == -1){
2298
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2299
strerror(errno));
2300
}
2301
free(fullname);
2302
}
2303
}
2304
2305
/* need to clean even if 0 because man page doesn't specify */
2306
free(direntries);
2307
if (numentries == -1){
2308
perror_plus("scandir");
2309
}
2310
ret = rmdir(tempdir);
2311
if(ret == -1 and errno != ENOENT){
2312
perror_plus("rmdir");
2313
}
2314
}
2315
2316
if(quit_now){
2317
sigemptyset(&old_sigterm_action.sa_mask);
2318
old_sigterm_action.sa_handler = SIG_DFL;
2319
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
2320
&old_sigterm_action,
2321
NULL));
2322
if(ret == -1){
2323
perror_plus("sigaction");
2324
}
2325
do {
2326
ret = raise(signal_received);
2327
} while(ret != 0 and errno == EINTR);
2328
if(ret != 0){
2329
perror_plus("raise");
2330
abort();
2331
}
2332
TEMP_FAILURE_RETRY(pause());
2333
}
2334
2335
return exitcode;
571
2336
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0