161
161
const char *priority;
163
163
server *current_server;
165
size_t interfaces_size;
166
164
} mandos_context;
168
166
/* global so signal handler can reach it*/
169
167
AvahiSimplePoll *simple_poll;
168
mandos_context mc = { .server = NULL, .dh_bits = 1024,
169
.priority = "SECURE256:!CTYPE-X.509:"
170
"+CTYPE-OPENPGP", .current_server = NULL };
171
172
sig_atomic_t quit_now = 0;
172
173
int signal_received = 0;
210
211
/* Add server to set of servers to retry periodically */
211
212
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
212
int af, server **current_server){
214
215
server *new_server = malloc(sizeof(server));
215
216
if(new_server == NULL){
227
228
/* Special case of first server */
228
if(*current_server == NULL){
229
if (mc.current_server == NULL){
229
230
new_server->next = new_server;
230
231
new_server->prev = new_server;
231
*current_server = new_server;
232
mc.current_server = new_server;
232
233
/* Place the new server last in the list */
234
new_server->next = *current_server;
235
new_server->prev = (*current_server)->prev;
235
new_server->next = mc.current_server;
236
new_server->prev = mc.current_server->prev;
236
237
new_server->prev->next = new_server;
237
(*current_server)->prev = new_server;
238
mc.current_server->prev = new_server;
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
240
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
241
242
perror_plus("clock_gettime");
248
249
* Initialize GPGME.
250
251
static bool init_gpgme(const char *seckey, const char *pubkey,
251
const char *tempdir, mandos_context *mc){
252
const char *tempdir){
252
253
gpgme_error_t rc;
253
254
gpgme_engine_info_t engine_info;
276
rc = gpgme_op_import(mc->ctx, pgp_data);
277
rc = gpgme_op_import(mc.ctx, pgp_data);
277
278
if(rc != GPG_ERR_NO_ERROR){
278
279
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
279
280
gpgme_strsource(rc), gpgme_strerror(rc));
325
326
/* Create new GPGME "context" */
326
rc = gpgme_new(&(mc->ctx));
327
rc = gpgme_new(&(mc.ctx));
327
328
if(rc != GPG_ERR_NO_ERROR){
328
329
fprintf_plus(stderr, "Mandos plugin mandos-client: "
329
330
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
378
378
/* Decrypt data from the cryptotext data buffer to the plaintext
380
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
380
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
381
381
if(rc != GPG_ERR_NO_ERROR){
382
382
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
383
383
gpgme_strsource(rc), gpgme_strerror(rc));
384
384
plaintext_length = -1;
386
386
gpgme_decrypt_result_t result;
387
result = gpgme_op_decrypt_result(mc->ctx);
387
result = gpgme_op_decrypt_result(mc.ctx);
388
388
if(result == NULL){
389
389
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
507
506
/* OpenPGP credentials */
508
ret = gnutls_certificate_allocate_credentials(&mc->cred);
507
ret = gnutls_certificate_allocate_credentials(&mc.cred);
509
508
if(ret != GNUTLS_E_SUCCESS){
510
509
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
511
510
safer_gnutls_strerror(ret));
523
522
ret = gnutls_certificate_set_openpgp_key_file
524
(mc->cred, pubkeyfilename, seckeyfilename,
523
(mc.cred, pubkeyfilename, seckeyfilename,
525
524
GNUTLS_OPENPGP_FMT_BASE64);
526
525
if(ret != GNUTLS_E_SUCCESS){
527
526
fprintf_plus(stderr,
535
534
/* GnuTLS server initialization */
536
ret = gnutls_dh_params_init(&mc->dh_params);
535
ret = gnutls_dh_params_init(&mc.dh_params);
537
536
if(ret != GNUTLS_E_SUCCESS){
538
537
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
539
538
" initialization: %s\n",
540
539
safer_gnutls_strerror(ret));
543
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
542
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
544
543
if(ret != GNUTLS_E_SUCCESS){
545
544
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
546
545
safer_gnutls_strerror(ret));
550
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
549
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
556
gnutls_certificate_free_credentials(mc->cred);
555
gnutls_certificate_free_credentials(mc.cred);
557
556
gnutls_global_deinit();
558
gnutls_dh_params_deinit(mc->dh_params);
557
gnutls_dh_params_deinit(mc.dh_params);
562
static int init_gnutls_session(gnutls_session_t *session,
561
static int init_gnutls_session(gnutls_session_t *session){
565
563
/* GnuTLS session creation */
611
609
/* ignore client certificate if any. */
612
610
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
614
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
612
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
623
621
/* Called when a Mandos server is found */
624
622
static int start_mandos_communication(const char *ip, in_port_t port,
625
623
AvahiIfIndex if_index,
626
int af, mandos_context *mc){
627
625
int ret, tcp_sd = -1;
662
/* If the interface is specified and we have a list of interfaces */
663
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
664
/* Check if the interface is one of the interfaces we are using */
667
char *interface = NULL;
668
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
670
if(if_nametoindex(interface) == (unsigned int)if_index){
677
/* This interface does not match any in the list, so we don't
678
connect to the server */
680
char interface[IF_NAMESIZE];
681
if(if_indextoname((unsigned int)if_index, interface) == NULL){
682
perror_plus("if_indextoname");
684
fprintf_plus(stderr, "Skipping server on non-used interface"
686
if_indextoname((unsigned int)if_index,
694
ret = init_gnutls_session(&session, mc);
660
ret = init_gnutls_session(&session);
1054
1020
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1055
1021
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1057
avahi_strerror(avahi_server_errno
1058
(((mandos_context*)mc)->server)));
1023
avahi_strerror(avahi_server_errno(mc.server)));
1061
1026
case AVAHI_RESOLVER_FOUND:
1070
1035
int ret = start_mandos_communication(ip, (in_port_t)port,
1072
avahi_proto_to_af(proto),
1037
avahi_proto_to_af(proto));
1075
1039
avahi_simple_poll_quit(simple_poll);
1077
1041
if(not add_server(ip, (in_port_t)port, interface,
1078
avahi_proto_to_af(proto),
1079
&((mandos_context*)mc)->current_server)){
1042
avahi_proto_to_af(proto))){
1080
1043
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1081
1044
" list\n", name);
1112
1075
case AVAHI_BROWSER_FAILURE:
1114
1077
fprintf_plus(stderr, "(Avahi browser) %s\n",
1115
avahi_strerror(avahi_server_errno
1116
(((mandos_context*)mc)->server)));
1078
avahi_strerror(avahi_server_errno(mc.server)));
1117
1079
avahi_simple_poll_quit(simple_poll);
1123
1085
the callback function is called the Avahi server will free the
1124
1086
resolver for us. */
1126
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1127
interface, protocol, name, type,
1128
domain, protocol, 0,
1129
resolve_callback, mc) == NULL)
1088
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1089
name, type, domain, protocol, 0,
1090
resolve_callback, NULL) == NULL)
1130
1091
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1132
avahi_strerror(avahi_server_errno
1133
(((mandos_context*)mc)->server)));
1093
avahi_strerror(avahi_server_errno(mc.server)));
1136
1096
case AVAHI_BROWSER_REMOVE:
1359
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1360
mandos_context *mc){
1319
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1362
1321
struct timespec now;
1363
1322
struct timespec waited_time;
1364
1323
intmax_t block_time;
1367
if(mc->current_server == NULL){
1326
if(mc.current_server == NULL){
1369
1328
fprintf_plus(stderr, "Wait until first server is found."
1370
1329
" No timeout!\n");
1384
1343
/* Calculating in ms how long time between now and server
1385
1344
who we visted longest time ago. Now - last seen. */
1386
1345
waited_time.tv_sec = (now.tv_sec
1387
- mc->current_server->last_seen.tv_sec);
1346
- mc.current_server->last_seen.tv_sec);
1388
1347
waited_time.tv_nsec = (now.tv_nsec
1389
- mc->current_server->last_seen.tv_nsec);
1348
- mc.current_server->last_seen.tv_nsec);
1390
1349
/* total time is 10s/10,000ms.
1391
1350
Converting to s from ms by dividing by 1,000,
1392
1351
and ns to ms by dividing by 1,000,000. */
1402
1361
if(block_time <= 0){
1403
ret = start_mandos_communication(mc->current_server->ip,
1404
mc->current_server->port,
1405
mc->current_server->if_index,
1406
mc->current_server->af, mc);
1362
ret = start_mandos_communication(mc.current_server->ip,
1363
mc.current_server->port,
1364
mc.current_server->if_index,
1365
mc.current_server->af);
1408
avahi_simple_poll_quit(s);
1367
avahi_simple_poll_quit(simple_poll);
1411
1370
ret = clock_gettime(CLOCK_MONOTONIC,
1412
&mc->current_server->last_seen);
1371
&mc.current_server->last_seen);
1414
1373
perror_plus("clock_gettime");
1417
mc->current_server = mc->current_server->next;
1376
mc.current_server = mc.current_server->next;
1418
1377
block_time = 0; /* Call avahi to find new Mandos
1419
1378
servers, but don't block */
1789
1748
int main(int argc, char *argv[]){
1790
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1791
.priority = "SECURE256:!CTYPE-X.509:"
1792
"+CTYPE-OPENPGP", .current_server = NULL,
1793
.interfaces = NULL, .interfaces_size = 0 };
1794
1749
AvahiSServiceBrowser *sb = NULL;
1795
1750
error_t ret_errno;
1797
1752
intmax_t tmpmax;
1799
1754
int exitcode = EXIT_SUCCESS;
1755
char *interfaces = NULL;
1756
size_t interfaces_size = 0;
1800
1757
char *interfaces_to_take_down = NULL;
1801
1758
size_t interfaces_to_take_down_size = 0;
1802
1759
char tempdir[] = "/tmp/mandosXXXXXX";
1902
1859
connect_to = arg;
1904
1861
case 'i': /* --interface */
1905
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
1862
ret_errno = argz_add_sep(&interfaces, &interfaces_size, arg,
1907
1864
if(ret_errno != 0){
1908
1865
argp_error(state, "%s", strerror(ret_errno));
2038
1995
/* Lower privileges */
1999
perror_plus("seteuid");
2043
/* Remove invalid interface names (except "none") */
2004
/* Remove empty interface names */
2045
2006
char *interface = NULL;
2046
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2007
while((interface = argz_next(interfaces, interfaces_size,
2048
if(strcmp(interface, "none") != 0
2049
and if_nametoindex(interface) == 0){
2050
if(interface[0] != '\0'){
2009
if(if_nametoindex(interface) == 0){
2010
if(interface[0] != '\0' and strcmp(interface, "none") != 0){
2051
2011
fprintf_plus(stderr, "Not using nonexisting interface"
2052
2012
" \"%s\"\n", interface);
2054
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2014
argz_delete(&interfaces, &interfaces_size, interface);
2055
2015
interface = NULL;
2060
2020
/* Run network hooks */
2062
if(mc.interfaces != NULL){
2063
interfaces_hooks = malloc(mc.interfaces_size);
2023
if(interfaces != NULL){
2024
interfaces_hooks = malloc(interfaces_size);
2064
2025
if(interfaces_hooks == NULL){
2065
2026
perror_plus("malloc");
2068
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2069
interfaces_hooks_size = mc.interfaces_size;
2029
memcpy(interfaces_hooks, interfaces, interfaces_size);
2030
interfaces_hooks_size = interfaces_size;
2070
2031
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2158
2119
/* If no interfaces were specified, make a list */
2159
if(mc.interfaces == NULL){
2120
if(interfaces == NULL){
2160
2121
struct dirent **direntries;
2161
2122
/* Look for any good interfaces */
2162
2123
ret = scandir(sys_class_net, &direntries, good_interface,
2165
2126
/* Add all found interfaces to interfaces list */
2166
2127
for(int i = 0; i < ret; ++i){
2167
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2128
ret_errno = argz_add(&interfaces, &interfaces_size,
2168
2129
direntries[i]->d_name);
2169
2130
if(ret_errno != 0){
2170
2131
perror_plus("argz_add");
2187
/* Bring up interfaces which are down, and remove any "none"s */
2148
/* If we only got one interface, explicitly use only that one */
2149
if(argz_count(interfaces, interfaces_size) == 1){
2151
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2154
if_index = (AvahiIfIndex)if_nametoindex(interfaces);
2157
/* Bring up interfaces which are down */
2158
if(not (argz_count(interfaces, interfaces_size) == 1
2159
and strcmp(interfaces, "none") == 0)){
2189
2160
char *interface = NULL;
2190
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2161
while((interface = argz_next(interfaces, interfaces_size,
2192
/* If interface name is "none", stop bringing up interfaces.
2193
Also remove all instances of "none" from the list */
2194
if(strcmp(interface, "none") == 0){
2195
argz_delete(&mc.interfaces, &mc.interfaces_size,
2198
while((interface = argz_next(mc.interfaces,
2199
mc.interfaces_size, interface))){
2200
if(strcmp(interface, "none") == 0){
2201
argz_delete(&mc.interfaces, &mc.interfaces_size,
2208
2163
bool interface_was_up = interface_is_up(interface);
2209
2164
ret = bring_up_interface(interface, delay);
2210
2165
if(not interface_was_up){
2178
interfaces_size = 0;
2221
2179
if(debug and (interfaces_to_take_down == NULL)){
2222
2180
fprintf_plus(stderr, "No interfaces were brought up\n");
2226
/* If we only got one interface, explicitly use only that one */
2227
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2229
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2232
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2239
ret = init_gnutls_global(pubkey, seckey, &mc);
2188
ret = init_gnutls_global(pubkey, seckey);
2241
2190
fprintf_plus(stderr, "init_gnutls_global failed\n");
2242
2191
exitcode = EX_UNAVAILABLE;
2262
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2211
if(not init_gpgme(pubkey, seckey, tempdir)){
2263
2212
fprintf_plus(stderr, "init_gpgme failed\n");
2264
2213
exitcode = EX_UNAVAILABLE;
2324
2273
while(not quit_now){
2325
ret = start_mandos_communication(address, port, if_index, af,
2274
ret = start_mandos_communication(address, port, if_index, af);
2327
2275
if(quit_now or ret == 0){
2377
2325
/* Create the Avahi service browser */
2378
2326
sb = avahi_s_service_browser_new(mc.server, if_index,
2379
2327
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2380
NULL, 0, browse_callback,
2328
NULL, 0, browse_callback, NULL);
2382
2329
if(sb == NULL){
2383
2330
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2384
2331
avahi_strerror(avahi_server_errno(mc.server)));
2399
2346
ret = avahi_loop_with_timeout(simple_poll,
2400
(int)(retry_interval * 1000), &mc);
2347
(int)(retry_interval * 1000));
2402
2349
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2403
2350
(ret == 0) ? "successfully" : "with error");