9
9
* "browse_callback", and parts of "main".
11
11
* Everything else is
12
* Copyright © 2008-2012 Teddy Hogeborn
13
* Copyright © 2008-2012 Björn Påhlsson
12
* Copyright © 2008-2013 Teddy Hogeborn
13
* Copyright © 2008-2013 Björn Påhlsson
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
162
161
const char *priority;
164
163
server *current_server;
165
size_t interfaces_size;
165
166
} mandos_context;
167
/* global context so signal handler can reach it*/
168
mandos_context mc = { .simple_poll = NULL, .server = NULL,
169
.dh_bits = 1024, .priority = "SECURE256"
170
":!CTYPE-X.509:+CTYPE-OPENPGP",
171
.current_server = NULL };
168
/* global so signal handler can reach it*/
169
AvahiSimplePoll *simple_poll;
173
171
sig_atomic_t quit_now = 0;
174
172
int signal_received = 0;
190
188
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
191
189
program_invocation_short_name));
192
return TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
190
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
200
198
size_t incbuffer(char **buffer, size_t buffer_length,
201
199
size_t buffer_capacity){
202
200
if(buffer_length + BUFFER_SIZE > buffer_capacity){
203
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
201
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
203
int old_errno = errno;
207
210
buffer_capacity += BUFFER_SIZE;
209
212
return buffer_capacity;
212
215
/* Add server to set of servers to retry periodically */
213
216
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
217
int af, server **current_server){
216
219
server *new_server = malloc(sizeof(server));
217
220
if(new_server == NULL){
229
232
/* Special case of first server */
230
if (mc.current_server == NULL){
233
if(*current_server == NULL){
231
234
new_server->next = new_server;
232
235
new_server->prev = new_server;
233
mc.current_server = new_server;
236
*current_server = new_server;
234
237
/* Place the new server last in the list */
236
new_server->next = mc.current_server;
237
new_server->prev = mc.current_server->prev;
239
new_server->next = *current_server;
240
new_server->prev = (*current_server)->prev;
238
241
new_server->prev->next = new_server;
239
mc.current_server->prev = new_server;
242
(*current_server)->prev = new_server;
241
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
244
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
243
246
perror_plus("clock_gettime");
250
253
* Initialize GPGME.
252
255
static bool init_gpgme(const char *seckey, const char *pubkey,
253
const char *tempdir){
256
const char *tempdir, mandos_context *mc){
254
257
gpgme_error_t rc;
255
258
gpgme_engine_info_t engine_info;
259
261
* Helper function to insert pub and seckey to the engine keyring.
279
rc = gpgme_op_import(mc.ctx, pgp_data);
281
rc = gpgme_op_import(mc->ctx, pgp_data);
280
282
if(rc != GPG_ERR_NO_ERROR){
281
283
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
282
284
gpgme_strsource(rc), gpgme_strerror(rc));
328
330
/* Create new GPGME "context" */
329
rc = gpgme_new(&(mc.ctx));
331
rc = gpgme_new(&(mc->ctx));
330
332
if(rc != GPG_ERR_NO_ERROR){
331
333
fprintf_plus(stderr, "Mandos plugin mandos-client: "
332
334
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
380
383
/* Decrypt data from the cryptotext data buffer to the plaintext
382
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
385
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
383
386
if(rc != GPG_ERR_NO_ERROR){
384
387
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
385
388
gpgme_strsource(rc), gpgme_strerror(rc));
386
389
plaintext_length = -1;
388
391
gpgme_decrypt_result_t result;
389
result = gpgme_op_decrypt_result(mc.ctx);
392
result = gpgme_op_decrypt_result(mc->ctx);
390
393
if(result == NULL){
391
394
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
508
512
/* OpenPGP credentials */
509
ret = gnutls_certificate_allocate_credentials(&mc.cred);
513
ret = gnutls_certificate_allocate_credentials(&mc->cred);
510
514
if(ret != GNUTLS_E_SUCCESS){
511
515
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
512
516
safer_gnutls_strerror(ret));
524
528
ret = gnutls_certificate_set_openpgp_key_file
525
(mc.cred, pubkeyfilename, seckeyfilename,
529
(mc->cred, pubkeyfilename, seckeyfilename,
526
530
GNUTLS_OPENPGP_FMT_BASE64);
527
531
if(ret != GNUTLS_E_SUCCESS){
528
532
fprintf_plus(stderr,
536
540
/* GnuTLS server initialization */
537
ret = gnutls_dh_params_init(&mc.dh_params);
541
ret = gnutls_dh_params_init(&mc->dh_params);
538
542
if(ret != GNUTLS_E_SUCCESS){
539
543
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
540
544
" initialization: %s\n",
541
545
safer_gnutls_strerror(ret));
544
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
548
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
545
549
if(ret != GNUTLS_E_SUCCESS){
546
550
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
547
551
safer_gnutls_strerror(ret));
551
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
555
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
557
gnutls_certificate_free_credentials(mc.cred);
561
gnutls_certificate_free_credentials(mc->cred);
558
562
gnutls_global_deinit();
559
gnutls_dh_params_deinit(mc.dh_params);
563
gnutls_dh_params_deinit(mc->dh_params);
563
static int init_gnutls_session(gnutls_session_t *session){
567
static int init_gnutls_session(gnutls_session_t *session,
565
570
/* GnuTLS session creation */
611
616
/* ignore client certificate if any. */
612
617
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
614
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
619
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
623
628
/* Called when a Mandos server is found */
624
629
static int start_mandos_communication(const char *ip, in_port_t port,
625
630
AvahiIfIndex if_index,
631
int af, mandos_context *mc){
627
632
int ret, tcp_sd = -1;
662
ret = init_gnutls_session(&session);
667
/* If the interface is specified and we have a list of interfaces */
668
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
669
/* Check if the interface is one of the interfaces we are using */
672
char *interface = NULL;
673
while((interface=argz_next(mc->interfaces, mc->interfaces_size,
675
if(if_nametoindex(interface) == (unsigned int)if_index){
682
/* This interface does not match any in the list, so we don't
683
connect to the server */
685
char interface[IF_NAMESIZE];
686
if(if_indextoname((unsigned int)if_index, interface) == NULL){
687
perror_plus("if_indextoname");
689
fprintf_plus(stderr, "Skipping server on non-used interface"
691
if_indextoname((unsigned int)if_index,
699
ret = init_gnutls_session(&session, mc);
705
742
if(af == AF_INET6){
706
743
to.in6.sin6_port = htons(port);
745
#pragma GCC diagnostic push
746
#pragma GCC diagnostic ignored "-Wstrict-aliasing"
707
748
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
708
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
749
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower */
751
#pragma GCC diagnostic pop
710
753
if(if_index == AVAHI_IF_UNSPEC){
711
754
fprintf_plus(stderr, "An IPv6 link-local address is"
712
755
" incomplete without a network interface\n");
1022
1063
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1023
1064
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1025
avahi_strerror(avahi_server_errno(mc.server)));
1066
avahi_strerror(avahi_server_errno
1067
(((mandos_context*)mc)->server)));
1028
1070
case AVAHI_RESOLVER_FOUND:
1037
1079
int ret = start_mandos_communication(ip, (in_port_t)port,
1039
avahi_proto_to_af(proto));
1081
avahi_proto_to_af(proto),
1041
avahi_simple_poll_quit(mc.simple_poll);
1084
avahi_simple_poll_quit(simple_poll);
1043
1086
if(not add_server(ip, (in_port_t)port, interface,
1044
avahi_proto_to_af(proto))){
1087
avahi_proto_to_af(proto),
1088
&((mandos_context*)mc)->current_server)){
1045
1089
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
1046
1090
" list\n", name);
1077
1121
case AVAHI_BROWSER_FAILURE:
1079
1123
fprintf_plus(stderr, "(Avahi browser) %s\n",
1080
avahi_strerror(avahi_server_errno(mc.server)));
1081
avahi_simple_poll_quit(mc.simple_poll);
1124
avahi_strerror(avahi_server_errno
1125
(((mandos_context*)mc)->server)));
1126
avahi_simple_poll_quit(simple_poll);
1084
1129
case AVAHI_BROWSER_NEW:
1087
1132
the callback function is called the Avahi server will free the
1088
1133
resolver for us. */
1090
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
1091
name, type, domain, protocol, 0,
1092
resolve_callback, NULL) == NULL)
1135
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1136
interface, protocol, name, type,
1137
domain, protocol, 0,
1138
resolve_callback, mc) == NULL)
1093
1139
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1095
avahi_strerror(avahi_server_errno(mc.server)));
1141
avahi_strerror(avahi_server_errno
1142
(((mandos_context*)mc)->server)));
1098
1145
case AVAHI_BROWSER_REMOVE:
1321
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval){
1368
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1369
mandos_context *mc){
1323
1371
struct timespec now;
1324
1372
struct timespec waited_time;
1325
1373
intmax_t block_time;
1328
if(mc.current_server == NULL){
1376
if(mc->current_server == NULL){
1330
1378
fprintf_plus(stderr, "Wait until first server is found."
1331
1379
" No timeout!\n");
1345
1393
/* Calculating in ms how long time between now and server
1346
1394
who we visted longest time ago. Now - last seen. */
1347
1395
waited_time.tv_sec = (now.tv_sec
1348
- mc.current_server->last_seen.tv_sec);
1396
- mc->current_server->last_seen.tv_sec);
1349
1397
waited_time.tv_nsec = (now.tv_nsec
1350
- mc.current_server->last_seen.tv_nsec);
1398
- mc->current_server->last_seen.tv_nsec);
1351
1399
/* total time is 10s/10,000ms.
1352
1400
Converting to s from ms by dividing by 1,000,
1353
1401
and ns to ms by dividing by 1,000,000. */
1363
1411
if(block_time <= 0){
1364
ret = start_mandos_communication(mc.current_server->ip,
1365
mc.current_server->port,
1366
mc.current_server->if_index,
1367
mc.current_server->af);
1412
ret = start_mandos_communication(mc->current_server->ip,
1413
mc->current_server->port,
1414
mc->current_server->if_index,
1415
mc->current_server->af, mc);
1369
avahi_simple_poll_quit(mc.simple_poll);
1417
avahi_simple_poll_quit(s);
1372
1420
ret = clock_gettime(CLOCK_MONOTONIC,
1373
&mc.current_server->last_seen);
1421
&mc->current_server->last_seen);
1375
1423
perror_plus("clock_gettime");
1378
mc.current_server = mc.current_server->next;
1426
mc->current_server = mc->current_server->next;
1379
1427
block_time = 0; /* Call avahi to find new Mandos
1380
1428
servers, but don't block */
1445
1493
bool run_network_hooks(const char *mode, const char *interface,
1446
1494
const float delay){
1447
1495
struct dirent **direntries;
1448
struct dirent *direntry;
1450
1496
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1452
1498
if(numhooks == -1){
1705
1751
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1707
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1753
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1709
1755
ret_errno = errno;
1710
1756
perror_plus("socket");
1720
1766
/* Raise priviliges */
1721
1767
raise_privileges();
1723
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1769
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1724
1770
ret_errno = errno;
1726
1772
/* Lower privileges */
1727
1773
lower_privileges();
1729
1775
/* Close the socket */
1730
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1776
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1732
1778
perror_plus("close");
1750
1796
int main(int argc, char *argv[]){
1797
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1798
.priority = "SECURE256:!CTYPE-X.509:"
1799
"+CTYPE-OPENPGP", .current_server = NULL,
1800
.interfaces = NULL, .interfaces_size = 0 };
1751
1801
AvahiSServiceBrowser *sb = NULL;
1752
1802
error_t ret_errno;
1754
1804
intmax_t tmpmax;
1756
1806
int exitcode = EXIT_SUCCESS;
1757
char *interfaces = NULL;
1758
size_t interfaces_size = 0;
1759
1807
char *interfaces_to_take_down = NULL;
1760
1808
size_t interfaces_to_take_down_size = 0;
1761
1809
char tempdir[] = "/tmp/mandosXXXXXX";
1764
1812
const char *seckey = PATHDIR "/" SECKEY;
1765
1813
const char *pubkey = PATHDIR "/" PUBKEY;
1766
1814
char *interfaces_hooks = NULL;
1767
size_t interfaces_hooks_size = 0;
1769
1816
bool gnutls_initialized = false;
1770
1817
bool gpgme_initialized = false;
1861
1908
connect_to = arg;
1863
1910
case 'i': /* --interface */
1864
ret_errno = argz_add_sep(&interfaces, &interfaces_size, arg,
1911
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
1866
1913
if(ret_errno != 0){
1867
1914
argp_error(state, "%s", strerror(ret_errno));
1997
2044
/* Lower privileges */
2001
perror_plus("seteuid");
2006
/* Remove empty interface names */
2049
/* Remove invalid interface names (except "none") */
2008
2051
char *interface = NULL;
2009
while((interface = argz_next(interfaces, interfaces_size,
2052
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2011
if(if_nametoindex(interface) == 0){
2012
if(interface[0] != '\0' and strcmp(interface, "none") != 0){
2054
if(strcmp(interface, "none") != 0
2055
and if_nametoindex(interface) == 0){
2056
if(interface[0] != '\0'){
2013
2057
fprintf_plus(stderr, "Not using nonexisting interface"
2014
2058
" \"%s\"\n", interface);
2016
argz_delete(&interfaces, &interfaces_size, interface);
2060
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2017
2061
interface = NULL;
2022
2066
/* Run network hooks */
2025
if(interfaces != NULL){
2026
interfaces_hooks = malloc(interfaces_size);
2068
if(mc.interfaces != NULL){
2069
interfaces_hooks = malloc(mc.interfaces_size);
2027
2070
if(interfaces_hooks == NULL){
2028
2071
perror_plus("malloc");
2031
memcpy(interfaces_hooks, interfaces, interfaces_size);
2032
interfaces_hooks_size = interfaces_size;
2033
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2074
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2075
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2036
2077
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2037
2078
interfaces_hooks : "", delay)){
2047
2088
from the signal handler */
2048
2089
/* Initialize the pseudo-RNG for Avahi */
2049
2090
srand((unsigned int) time(NULL));
2050
mc.simple_poll = avahi_simple_poll_new();
2051
if(mc.simple_poll == NULL){
2091
simple_poll = avahi_simple_poll_new();
2092
if(simple_poll == NULL){
2052
2093
fprintf_plus(stderr,
2053
2094
"Avahi: Failed to create simple poll object.\n");
2054
2095
exitcode = EX_UNAVAILABLE;
2121
2162
/* If no interfaces were specified, make a list */
2122
if(interfaces == NULL){
2163
if(mc.interfaces == NULL){
2123
2164
struct dirent **direntries;
2124
2165
/* Look for any good interfaces */
2125
2166
ret = scandir(sys_class_net, &direntries, good_interface,
2128
2169
/* Add all found interfaces to interfaces list */
2129
2170
for(int i = 0; i < ret; ++i){
2130
ret_errno = argz_add(&interfaces, &interfaces_size,
2171
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2131
2172
direntries[i]->d_name);
2132
2173
if(ret_errno != 0){
2133
2175
perror_plus("argz_add");
2150
/* If we only got one interface, explicitly use only that one */
2151
if(argz_count(interfaces, interfaces_size) == 1){
2153
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2156
if_index = (AvahiIfIndex)if_nametoindex(interfaces);
2159
/* Bring up interfaces which are down */
2160
if(not (argz_count(interfaces, interfaces_size) == 1
2161
and strcmp(interfaces, "none") == 0)){
2192
/* Bring up interfaces which are down, and remove any "none"s */
2162
2194
char *interface = NULL;
2163
while((interface = argz_next(interfaces, interfaces_size,
2195
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2197
/* If interface name is "none", stop bringing up interfaces.
2198
Also remove all instances of "none" from the list */
2199
if(strcmp(interface, "none") == 0){
2200
argz_delete(&mc.interfaces, &mc.interfaces_size,
2203
while((interface = argz_next(mc.interfaces,
2204
mc.interfaces_size, interface))){
2205
if(strcmp(interface, "none") == 0){
2206
argz_delete(&mc.interfaces, &mc.interfaces_size,
2165
2213
bool interface_was_up = interface_is_up(interface);
2166
2214
ret = bring_up_interface(interface, delay);
2167
2215
if(not interface_was_up){
2172
2220
ret_errno = argz_add(&interfaces_to_take_down,
2173
2221
&interfaces_to_take_down_size,
2225
perror_plus("argz_add");
2180
interfaces_size = 0;
2181
2230
if(debug and (interfaces_to_take_down == NULL)){
2182
2231
fprintf_plus(stderr, "No interfaces were brought up\n");
2235
/* If we only got one interface, explicitly use only that one */
2236
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2238
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2241
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2190
ret = init_gnutls_global(pubkey, seckey);
2248
ret = init_gnutls_global(pubkey, seckey, &mc);
2192
2250
fprintf_plus(stderr, "init_gnutls_global failed\n");
2193
2251
exitcode = EX_UNAVAILABLE;
2213
if(not init_gpgme(pubkey, seckey, tempdir)){
2271
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2214
2272
fprintf_plus(stderr, "init_gpgme failed\n");
2215
2273
exitcode = EX_UNAVAILABLE;
2275
2333
while(not quit_now){
2276
ret = start_mandos_communication(address, port, if_index, af);
2334
ret = start_mandos_communication(address, port, if_index, af,
2277
2336
if(quit_now or ret == 0){
2305
2364
config.publish_domain = 0;
2307
2366
/* Allocate a new server */
2308
mc.server = avahi_server_new(avahi_simple_poll_get
2309
(mc.simple_poll), &config, NULL,
2367
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2368
&config, NULL, NULL, &ret_errno);
2312
2370
/* Free the Avahi configuration data */
2313
2371
avahi_server_config_free(&config);
2328
2386
/* Create the Avahi service browser */
2329
2387
sb = avahi_s_service_browser_new(mc.server, if_index,
2330
2388
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2331
NULL, 0, browse_callback, NULL);
2389
NULL, 0, browse_callback,
2332
2391
if(sb == NULL){
2333
2392
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2334
2393
avahi_strerror(avahi_server_errno(mc.server)));
2346
2405
fprintf_plus(stderr, "Starting Avahi loop search\n");
2349
ret = avahi_loop_with_timeout(mc.simple_poll,
2350
(int)(retry_interval * 1000));
2408
ret = avahi_loop_with_timeout(simple_poll,
2409
(int)(retry_interval * 1000), &mc);
2352
2411
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2353
2412
(ret == 0) ? "successfully" : "with error");
2362
2421
/* Cleanup things */
2422
free(mc.interfaces);
2364
2425
avahi_s_service_browser_free(sb);
2366
2427
if(mc.server != NULL)
2367
2428
avahi_server_free(mc.server);
2369
if(mc.simple_poll != NULL)
2370
avahi_simple_poll_free(mc.simple_poll);
2430
if(simple_poll != NULL)
2431
avahi_simple_poll_free(simple_poll);
2372
2433
if(gnutls_initialized){
2373
2434
gnutls_certificate_free_credentials(mc.cred);