To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/password-request.c
- browse files at revision 78
- compare with another revision
- download diff
- download tarball
- view history from revision 78
- Committer: Teddy Hogeborn
- Date: 2008-08-16 03:29:08 UTC
- Revision ID: teddy@fukt.bsnet.se-20080816032908-ihw7c05r2mnyk389
Add feature to specify custom environment variables for plugins.
* plugin-runner.c (plugin): New members "environ" and "envc" to
contain possible custom environment.
(getplugin): Return NULL on failure instead of doing exit(); all
callers changed.
(add_to_char_array): New helper function for "add_argument" and
"add_environment".
(addargument): Renamed to "add_argument". Return bool. Call
"add_to_char_array" to actually do things.
(add_environment): New; analogous to "add_argument".
(addcustomargument): Renamed to "add_to_argv" to avoid confusion
with "add_argument".
(main): New options "--global-envs" and "--envs-for" to specify
custom environment for plugins. Print environment for
plugins in debug mode. Use asprintf instead of strcpy and
strcat. Use execve() for plugins with custom environments.
Free environment for plugin when freeing plugin list.
* plugin-runner.c (plugin): New members "environ" and "envc" to
contain possible custom environment.
(getplugin): Return NULL on failure instead of doing exit(); all
callers changed.
(add_to_char_array): New helper function for "add_argument" and
"add_environment".
(addargument): Renamed to "add_argument". Return bool. Call
"add_to_char_array" to actually do things.
(add_environment): New; analogous to "add_argument".
(addcustomargument): Renamed to "add_to_argv" to avoid confusion
with "add_argument".
(main): New options "--global-envs" and "--envs-for" to specify
custom environment for plugins. Print environment for
plugins in debug mode. Use asprintf instead of strcpy and
strcat. Use execve() for plugins with custom environments.
Free environment for plugin when freeing plugin list.
- files added:
- network-protocol.txt
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugins.d/mandos-client.c => plugins.d/password-request.c
- plugins.d/mandos-client.xml => plugins.d/password-request.xml
- files modified:
- Makefile
added
removed
plugins.d/password-request.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
30
29
*/
31
30
32
31
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
32
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
33
#define _FILE_OFFSET_BITS 64
38
#endif
39
34
40
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
36
42
37
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
38
stdout, ferror() */
44
39
#include <stdint.h> /* uint16_t, uint32_t */
45
40
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
47
strtof(), abort() */
48
#include <stdbool.h> /* bool, false, true */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
42
srand() */
43
#include <stdbool.h> /* bool, true */
49
44
#include <string.h> /* memset(), strcmp(), strlen(),
50
45
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
46
#include <sys/ioctl.h> /* ioctl */
52
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
48
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
49
SOCK_STREAM, INET6_ADDRSTRLEN,
50
uid_t, gid_t */
51
#include <inttypes.h> /* PRIu16 */
57
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
53
struct in6_addr, inet_pton(),
54
connect() */
64
55
#include <assert.h> /* assert() */
65
56
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
57
#include <time.h> /* time() */
67
58
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
59
SIOCSIFFLAGS, if_indextoname(),
69
60
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
61
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
62
getuid(), getgid(), setuid(),
63
setgid() */
64
#include <netinet/in.h>
76
65
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
66
#include <iso646.h> /* not, and */
78
67
#include <argp.h> /* struct argp_option, error_t, struct
79
68
argp_state, struct argp,
80
69
argp_parse(), ARGP_KEY_ARG,
81
70
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
87
88
#ifdef __linux__
89
#include <sys/klog.h> /* klogctl() */
90
#endif /* __linux__ */
91
71
92
72
/* Avahi */
93
73
/* All Avahi types, constants and functions
106
86
gnutls_*
107
87
init_gnutls_session(),
108
88
GNUTLS_* */
109
#include <gnutls/openpgp.h>
110
/* gnutls_certificate_set_openpgp_key_file(),
89
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
111
90
GNUTLS_OPENPGP_FMT_BASE64 */
112
91
113
92
/* GPGME */
119
98
120
99
#define BUFFER_SIZE 256
121
100
122
#define PATHDIR "/conf/conf.d/mandos"
123
#define SECKEY "seckey.txt"
124
#define PUBKEY "pubkey.txt"
125
126
101
bool debug = false;
102
static const char *keydir = "/conf/conf.d/mandos";
127
103
static const char mandos_protocol_version[] = "1";
128
const char *argp_program_version = "mandos-client " VERSION;
104
const char *argp_program_version = "password-request 1.0";
129
105
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
130
106
131
107
/* Used for passing in values through the Avahi callback functions */
136
112
unsigned int dh_bits;
137
113
gnutls_dh_params_t dh_params;
138
114
const char *priority;
139
gpgme_ctx_t ctx;
140
115
} mandos_context;
141
116
142
/* global context so signal handler can reach it*/
143
mandos_context mc = { .simple_poll = NULL, .server = NULL,
144
.dh_bits = 1024, .priority = "SECURE256"
145
":!CTYPE-X.509:+CTYPE-OPENPGP" };
146
147
sig_atomic_t quit_now = 0;
148
int signal_received = 0;
149
150
117
/*
151
* Make additional room in "buffer" for at least BUFFER_SIZE more
152
* bytes. "buffer_capacity" is how much is currently allocated,
118
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
119
* "buffer_capacity" is how much is currently allocated,
153
120
* "buffer_length" is how much is already used.
154
121
*/
155
size_t incbuffer(char **buffer, size_t buffer_length,
122
size_t adjustbuffer(char **buffer, size_t buffer_length,
156
123
size_t buffer_capacity){
157
if(buffer_length + BUFFER_SIZE > buffer_capacity){
124
if (buffer_length + BUFFER_SIZE > buffer_capacity){
158
125
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
159
if(buffer == NULL){
126
if (buffer == NULL){
160
127
return 0;
161
128
}
162
129
buffer_capacity += BUFFER_SIZE;
165
132
}
166
133
167
134
/*
168
* Initialize GPGME.
135
* Decrypt OpenPGP data using keyrings in HOMEDIR.
136
* Returns -1 on error
169
137
*/
170
static bool init_gpgme(const char *seckey,
171
const char *pubkey, const char *tempdir){
138
static ssize_t pgp_packet_decrypt (const char *cryptotext,
139
size_t crypto_size,
140
char **plaintext,
141
const char *homedir){
142
gpgme_data_t dh_crypto, dh_plain;
143
gpgme_ctx_t ctx;
172
144
gpgme_error_t rc;
145
ssize_t ret;
146
size_t plaintext_capacity = 0;
147
ssize_t plaintext_length = 0;
173
148
gpgme_engine_info_t engine_info;
174
149
175
176
/*
177
* Helper function to insert pub and seckey to the engine keyring.
178
*/
179
bool import_key(const char *filename){
180
int ret;
181
int fd;
182
gpgme_data_t pgp_data;
183
184
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
185
if(fd == -1){
186
perror("open");
187
return false;
188
}
189
190
rc = gpgme_data_new_from_fd(&pgp_data, fd);
191
if(rc != GPG_ERR_NO_ERROR){
192
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
193
gpgme_strsource(rc), gpgme_strerror(rc));
194
return false;
195
}
196
197
rc = gpgme_op_import(mc.ctx, pgp_data);
198
if(rc != GPG_ERR_NO_ERROR){
199
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
200
gpgme_strsource(rc), gpgme_strerror(rc));
201
return false;
202
}
203
204
ret = (int)TEMP_FAILURE_RETRY(close(fd));
205
if(ret == -1){
206
perror("close");
207
}
208
gpgme_data_release(pgp_data);
209
return true;
210
}
211
212
if(debug){
213
fprintf(stderr, "Initializing GPGME\n");
150
if (debug){
151
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
214
152
}
215
153
216
154
/* Init GPGME */
217
155
gpgme_check_version(NULL);
218
156
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
219
if(rc != GPG_ERR_NO_ERROR){
157
if (rc != GPG_ERR_NO_ERROR){
220
158
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
221
159
gpgme_strsource(rc), gpgme_strerror(rc));
222
return false;
160
return -1;
223
161
}
224
162
225
/* Set GPGME home directory for the OpenPGP engine only */
226
rc = gpgme_get_engine_info(&engine_info);
227
if(rc != GPG_ERR_NO_ERROR){
163
/* Set GPGME home directory for the OpenPGP engine only */
164
rc = gpgme_get_engine_info (&engine_info);
165
if (rc != GPG_ERR_NO_ERROR){
228
166
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
229
167
gpgme_strsource(rc), gpgme_strerror(rc));
230
return false;
168
return -1;
231
169
}
232
170
while(engine_info != NULL){
233
171
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
234
172
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
235
engine_info->file_name, tempdir);
173
engine_info->file_name, homedir);
236
174
break;
237
175
}
238
176
engine_info = engine_info->next;
239
177
}
240
178
if(engine_info == NULL){
241
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
242
return false;
243
}
244
245
/* Create new GPGME "context" */
246
rc = gpgme_new(&(mc.ctx));
247
if(rc != GPG_ERR_NO_ERROR){
248
fprintf(stderr, "bad gpgme_new: %s: %s\n",
249
gpgme_strsource(rc), gpgme_strerror(rc));
250
return false;
251
}
252
253
if(not import_key(pubkey) or not import_key(seckey)){
254
return false;
255
}
256
257
return true;
258
}
259
260
/*
261
* Decrypt OpenPGP data.
262
* Returns -1 on error
263
*/
264
static ssize_t pgp_packet_decrypt(const char *cryptotext,
265
size_t crypto_size,
266
char **plaintext){
267
gpgme_data_t dh_crypto, dh_plain;
268
gpgme_error_t rc;
269
ssize_t ret;
270
size_t plaintext_capacity = 0;
271
ssize_t plaintext_length = 0;
272
273
if(debug){
274
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
179
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
180
return -1;
275
181
}
276
182
277
183
/* Create new GPGME data buffer from memory cryptotext */
278
184
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
279
185
0);
280
if(rc != GPG_ERR_NO_ERROR){
186
if (rc != GPG_ERR_NO_ERROR){
281
187
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
282
188
gpgme_strsource(rc), gpgme_strerror(rc));
283
189
return -1;
285
191
286
192
/* Create new empty GPGME data buffer for the plaintext */
287
193
rc = gpgme_data_new(&dh_plain);
288
if(rc != GPG_ERR_NO_ERROR){
194
if (rc != GPG_ERR_NO_ERROR){
289
195
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
290
196
gpgme_strsource(rc), gpgme_strerror(rc));
291
197
gpgme_data_release(dh_crypto);
292
198
return -1;
293
199
}
294
200
201
/* Create new GPGME "context" */
202
rc = gpgme_new(&ctx);
203
if (rc != GPG_ERR_NO_ERROR){
204
fprintf(stderr, "bad gpgme_new: %s: %s\n",
205
gpgme_strsource(rc), gpgme_strerror(rc));
206
plaintext_length = -1;
207
goto decrypt_end;
208
}
209
295
210
/* Decrypt data from the cryptotext data buffer to the plaintext
296
211
data buffer */
297
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
298
if(rc != GPG_ERR_NO_ERROR){
212
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
213
if (rc != GPG_ERR_NO_ERROR){
299
214
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
300
215
gpgme_strsource(rc), gpgme_strerror(rc));
301
216
plaintext_length = -1;
302
if(debug){
303
gpgme_decrypt_result_t result;
304
result = gpgme_op_decrypt_result(mc.ctx);
305
if(result == NULL){
306
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
307
} else {
308
fprintf(stderr, "Unsupported algorithm: %s\n",
309
result->unsupported_algorithm);
310
fprintf(stderr, "Wrong key usage: %u\n",
311
result->wrong_key_usage);
312
if(result->file_name != NULL){
313
fprintf(stderr, "File name: %s\n", result->file_name);
314
}
315
gpgme_recipient_t recipient;
316
recipient = result->recipients;
217
goto decrypt_end;
218
}
219
220
if(debug){
221
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
222
}
223
224
if (debug){
225
gpgme_decrypt_result_t result;
226
result = gpgme_op_decrypt_result(ctx);
227
if (result == NULL){
228
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
229
} else {
230
fprintf(stderr, "Unsupported algorithm: %s\n",
231
result->unsupported_algorithm);
232
fprintf(stderr, "Wrong key usage: %u\n",
233
result->wrong_key_usage);
234
if(result->file_name != NULL){
235
fprintf(stderr, "File name: %s\n", result->file_name);
236
}
237
gpgme_recipient_t recipient;
238
recipient = result->recipients;
239
if(recipient){
317
240
while(recipient != NULL){
318
241
fprintf(stderr, "Public key algorithm: %s\n",
319
242
gpgme_pubkey_algo_name(recipient->pubkey_algo));
325
248
}
326
249
}
327
250
}
328
goto decrypt_end;
329
}
330
331
if(debug){
332
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
333
251
}
334
252
335
253
/* Seek back to the beginning of the GPGME plaintext data buffer */
336
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
337
perror("gpgme_data_seek");
254
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
255
perror("pgpme_data_seek");
338
256
plaintext_length = -1;
339
257
goto decrypt_end;
340
258
}
341
259
342
260
*plaintext = NULL;
343
261
while(true){
344
plaintext_capacity = incbuffer(plaintext,
262
plaintext_capacity = adjustbuffer(plaintext,
345
263
(size_t)plaintext_length,
346
264
plaintext_capacity);
347
if(plaintext_capacity == 0){
348
perror("incbuffer");
265
if (plaintext_capacity == 0){
266
perror("adjustbuffer");
349
267
plaintext_length = -1;
350
268
goto decrypt_end;
351
269
}
353
271
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
354
272
BUFFER_SIZE);
355
273
/* Print the data, if any */
356
if(ret == 0){
274
if (ret == 0){
357
275
/* EOF */
358
276
break;
359
277
}
364
282
}
365
283
plaintext_length += ret;
366
284
}
367
285
368
286
if(debug){
369
287
fprintf(stderr, "Decrypted password is: ");
370
288
for(ssize_t i = 0; i < plaintext_length; i++){
383
301
return plaintext_length;
384
302
}
385
303
386
static const char * safer_gnutls_strerror(int value){
387
const char *ret = gnutls_strerror(value); /* Spurious warning from
388
-Wunreachable-code */
389
if(ret == NULL)
304
static const char * safer_gnutls_strerror (int value) {
305
const char *ret = gnutls_strerror (value);
306
if (ret == NULL)
390
307
ret = "(unknown)";
391
308
return ret;
392
309
}
397
314
fprintf(stderr, "GnuTLS: %s", string);
398
315
}
399
316
400
static int init_gnutls_global(const char *pubkeyfilename,
317
static int init_gnutls_global(mandos_context *mc,
318
const char *pubkeyfilename,
401
319
const char *seckeyfilename){
402
320
int ret;
403
321
406
324
}
407
325
408
326
ret = gnutls_global_init();
409
if(ret != GNUTLS_E_SUCCESS){
410
fprintf(stderr, "GnuTLS global_init: %s\n",
411
safer_gnutls_strerror(ret));
327
if (ret != GNUTLS_E_SUCCESS) {
328
fprintf (stderr, "GnuTLS global_init: %s\n",
329
safer_gnutls_strerror(ret));
412
330
return -1;
413
331
}
414
332
415
if(debug){
333
if (debug){
416
334
/* "Use a log level over 10 to enable all debugging options."
417
335
* - GnuTLS manual
418
336
*/
421
339
}
422
340
423
341
/* OpenPGP credentials */
424
gnutls_certificate_allocate_credentials(&mc.cred);
425
if(ret != GNUTLS_E_SUCCESS){
426
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
427
from
428
-Wunreachable-code
429
*/
430
safer_gnutls_strerror(ret));
431
gnutls_global_deinit();
342
gnutls_certificate_allocate_credentials(&mc->cred);
343
if (ret != GNUTLS_E_SUCCESS){
344
fprintf (stderr, "GnuTLS memory error: %s\n",
345
safer_gnutls_strerror(ret));
346
gnutls_global_deinit ();
432
347
return -1;
433
348
}
434
349
435
350
if(debug){
436
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
437
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
351
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
352
" and keyfile %s as GnuTLS credentials\n", pubkeyfilename,
438
353
seckeyfilename);
439
354
}
440
355
441
356
ret = gnutls_certificate_set_openpgp_key_file
442
(mc.cred, pubkeyfilename, seckeyfilename,
357
(mc->cred, pubkeyfilename, seckeyfilename,
443
358
GNUTLS_OPENPGP_FMT_BASE64);
444
if(ret != GNUTLS_E_SUCCESS){
359
if (ret != GNUTLS_E_SUCCESS) {
445
360
fprintf(stderr,
446
361
"Error[%d] while reading the OpenPGP key pair ('%s',"
447
362
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
448
fprintf(stderr, "The GnuTLS error is: %s\n",
363
fprintf(stdout, "The GnuTLS error is: %s\n",
449
364
safer_gnutls_strerror(ret));
450
365
goto globalfail;
451
366
}
452
367
453
368
/* GnuTLS server initialization */
454
ret = gnutls_dh_params_init(&mc.dh_params);
455
if(ret != GNUTLS_E_SUCCESS){
456
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
457
" %s\n", safer_gnutls_strerror(ret));
458
goto globalfail;
459
}
460
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
461
if(ret != GNUTLS_E_SUCCESS){
462
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
463
safer_gnutls_strerror(ret));
464
goto globalfail;
465
}
466
467
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
468
369
ret = gnutls_dh_params_init(&mc->dh_params);
370
if (ret != GNUTLS_E_SUCCESS) {
371
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
372
" %s\n", safer_gnutls_strerror(ret));
373
goto globalfail;
374
}
375
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
376
if (ret != GNUTLS_E_SUCCESS) {
377
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
378
safer_gnutls_strerror(ret));
379
goto globalfail;
380
}
381
382
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
383
469
384
return 0;
470
385
471
386
globalfail:
472
473
gnutls_certificate_free_credentials(mc.cred);
387
388
gnutls_certificate_free_credentials(mc->cred);
474
389
gnutls_global_deinit();
475
gnutls_dh_params_deinit(mc.dh_params);
476
390
return -1;
391
477
392
}
478
393
479
static int init_gnutls_session(gnutls_session_t *session){
394
static int init_gnutls_session(mandos_context *mc,
395
gnutls_session_t *session){
480
396
int ret;
481
397
/* GnuTLS session creation */
482
do {
483
ret = gnutls_init(session, GNUTLS_SERVER);
484
if(quit_now){
485
return -1;
486
}
487
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
488
if(ret != GNUTLS_E_SUCCESS){
398
ret = gnutls_init(session, GNUTLS_SERVER);
399
if (ret != GNUTLS_E_SUCCESS){
489
400
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
490
401
safer_gnutls_strerror(ret));
491
402
}
492
403
493
404
{
494
405
const char *err;
495
do {
496
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
497
if(quit_now){
498
gnutls_deinit(*session);
499
return -1;
500
}
501
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
502
if(ret != GNUTLS_E_SUCCESS){
406
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
407
if (ret != GNUTLS_E_SUCCESS) {
503
408
fprintf(stderr, "Syntax error at: %s\n", err);
504
409
fprintf(stderr, "GnuTLS error: %s\n",
505
410
safer_gnutls_strerror(ret));
506
gnutls_deinit(*session);
411
gnutls_deinit (*session);
507
412
return -1;
508
413
}
509
414
}
510
415
511
do {
512
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
513
mc.cred);
514
if(quit_now){
515
gnutls_deinit(*session);
516
return -1;
517
}
518
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
519
if(ret != GNUTLS_E_SUCCESS){
416
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
417
mc->cred);
418
if (ret != GNUTLS_E_SUCCESS) {
520
419
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
521
420
safer_gnutls_strerror(ret));
522
gnutls_deinit(*session);
421
gnutls_deinit (*session);
523
422
return -1;
524
423
}
525
424
526
425
/* ignore client certificate if any. */
527
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
426
gnutls_certificate_server_set_request (*session,
427
GNUTLS_CERT_IGNORE);
528
428
529
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
429
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
530
430
531
431
return 0;
532
432
}
538
438
/* Called when a Mandos server is found */
539
439
static int start_mandos_communication(const char *ip, uint16_t port,
540
440
AvahiIfIndex if_index,
541
int af){
542
int ret, tcp_sd = -1;
543
ssize_t sret;
544
union {
545
struct sockaddr_in in;
546
struct sockaddr_in6 in6;
547
} to;
441
mandos_context *mc){
442
int ret, tcp_sd;
443
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
548
444
char *buffer = NULL;
549
char *decrypted_buffer = NULL;
445
char *decrypted_buffer;
550
446
size_t buffer_length = 0;
551
447
size_t buffer_capacity = 0;
448
ssize_t decrypted_buffer_size;
552
449
size_t written;
553
int retval = -1;
450
int retval = 0;
451
char interface[IF_NAMESIZE];
554
452
gnutls_session_t session;
555
int pf; /* Protocol family */
556
557
errno = 0;
558
559
if(quit_now){
560
errno = EINTR;
561
return -1;
562
}
563
564
switch(af){
565
case AF_INET6:
566
pf = PF_INET6;
567
break;
568
case AF_INET:
569
pf = PF_INET;
570
break;
571
default:
572
fprintf(stderr, "Bad address family: %d\n", af);
573
errno = EINVAL;
574
return -1;
575
}
576
577
ret = init_gnutls_session(&session);
578
if(ret != 0){
453
454
ret = init_gnutls_session (mc, &session);
455
if (ret != 0){
579
456
return -1;
580
457
}
581
458
582
459
if(debug){
583
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
460
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
584
461
"\n", ip, port);
585
462
}
586
463
587
tcp_sd = socket(pf, SOCK_STREAM, 0);
588
if(tcp_sd < 0){
589
int e = errno;
464
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
465
if(tcp_sd < 0) {
590
466
perror("socket");
591
errno = e;
592
goto mandos_end;
593
}
594
595
if(quit_now){
596
errno = EINTR;
597
goto mandos_end;
598
}
599
600
memset(&to, 0, sizeof(to));
601
if(af == AF_INET6){
602
to.in6.sin6_family = (sa_family_t)af;
603
ret = inet_pton(af, ip, &to.in6.sin6_addr);
604
} else { /* IPv4 */
605
to.in.sin_family = (sa_family_t)af;
606
ret = inet_pton(af, ip, &to.in.sin_addr);
607
}
608
if(ret < 0 ){
609
int e = errno;
467
return -1;
468
}
469
470
if(debug){
471
if(if_indextoname((unsigned int)if_index, interface) == NULL){
472
perror("if_indextoname");
473
return -1;
474
}
475
fprintf(stderr, "Binding to interface %s\n", interface);
476
}
477
478
memset(&to, 0, sizeof(to)); /* Spurious warning */
479
to.in6.sin6_family = AF_INET6;
480
/* It would be nice to have a way to detect if we were passed an
481
IPv4 address here. Now we assume an IPv6 address. */
482
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
483
if (ret < 0 ){
610
484
perror("inet_pton");
611
errno = e;
612
goto mandos_end;
485
return -1;
613
486
}
614
487
if(ret == 0){
615
int e = errno;
616
488
fprintf(stderr, "Bad address: %s\n", ip);
617
errno = e;
618
goto mandos_end;
619
}
620
if(af == AF_INET6){
621
to.in6.sin6_port = htons(port); /* Spurious warnings from
622
-Wconversion and
623
-Wunreachable-code */
624
625
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
626
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
627
-Wunreachable-code*/
628
if(if_index == AVAHI_IF_UNSPEC){
629
fprintf(stderr, "An IPv6 link-local address is incomplete"
630
" without a network interface\n");
631
errno = EINVAL;
632
goto mandos_end;
633
}
634
/* Set the network interface number as scope */
635
to.in6.sin6_scope_id = (uint32_t)if_index;
636
}
637
} else {
638
to.in.sin_port = htons(port); /* Spurious warnings from
639
-Wconversion and
640
-Wunreachable-code */
641
}
489
return -1;
490
}
491
to.in6.sin6_port = htons(port); /* Spurious warning */
642
492
643
if(quit_now){
644
errno = EINTR;
645
goto mandos_end;
646
}
493
to.in6.sin6_scope_id = (uint32_t)if_index;
647
494
648
495
if(debug){
649
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
650
char interface[IF_NAMESIZE];
651
if(if_indextoname((unsigned int)if_index, interface) == NULL){
652
perror("if_indextoname");
653
} else {
654
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
655
ip, interface, port);
656
}
657
} else {
658
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
659
port);
660
}
661
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
662
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
663
const char *pcret;
664
if(af == AF_INET6){
665
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
666
sizeof(addrstr));
667
} else {
668
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
669
sizeof(addrstr));
670
}
671
if(pcret == NULL){
496
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
497
port);
498
char addrstr[INET6_ADDRSTRLEN] = "";
499
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
500
sizeof(addrstr)) == NULL){
672
501
perror("inet_ntop");
673
502
} else {
674
503
if(strcmp(addrstr, ip) != 0){
677
506
}
678
507
}
679
508
680
if(quit_now){
681
errno = EINTR;
682
goto mandos_end;
683
}
684
685
if(af == AF_INET6){
686
ret = connect(tcp_sd, &to.in6, sizeof(to));
687
} else {
688
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
689
}
690
if(ret < 0){
691
int e = errno;
509
ret = connect(tcp_sd, &to.in, sizeof(to));
510
if (ret < 0){
692
511
perror("connect");
693
errno = e;
694
goto mandos_end;
695
}
696
697
if(quit_now){
698
errno = EINTR;
699
goto mandos_end;
700
}
701
512
return -1;
513
}
514
702
515
const char *out = mandos_protocol_version;
703
516
written = 0;
704
while(true){
517
while (true){
705
518
size_t out_size = strlen(out);
706
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
519
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
707
520
out_size - written));
708
if(ret == -1){
709
int e = errno;
521
if (ret == -1){
710
522
perror("write");
711
errno = e;
523
retval = -1;
712
524
goto mandos_end;
713
525
}
714
526
written += (size_t)ret;
715
527
if(written < out_size){
716
528
continue;
717
529
} else {
718
if(out == mandos_protocol_version){
530
if (out == mandos_protocol_version){
719
531
written = 0;
720
532
out = "\r\n";
721
533
} else {
722
534
break;
723
535
}
724
536
}
725
726
if(quit_now){
727
errno = EINTR;
728
goto mandos_end;
729
}
730
537
}
731
538
732
539
if(debug){
733
540
fprintf(stderr, "Establishing TLS session with %s\n", ip);
734
541
}
735
542
736
if(quit_now){
737
errno = EINTR;
738
goto mandos_end;
739
}
740
741
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
742
743
if(quit_now){
744
errno = EINTR;
745
goto mandos_end;
746
}
747
748
do {
749
ret = gnutls_handshake(session);
750
if(quit_now){
751
errno = EINTR;
752
goto mandos_end;
753
}
543
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
544
545
do{
546
ret = gnutls_handshake (session);
754
547
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
755
548
756
if(ret != GNUTLS_E_SUCCESS){
549
if (ret != GNUTLS_E_SUCCESS){
757
550
if(debug){
758
551
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
759
gnutls_perror(ret);
552
gnutls_perror (ret);
760
553
}
761
errno = EPROTO;
554
retval = -1;
762
555
goto mandos_end;
763
556
}
764
557
765
558
/* Read OpenPGP packet that contains the wanted password */
766
559
767
560
if(debug){
768
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
561
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
769
562
ip);
770
563
}
771
564
772
565
while(true){
773
774
if(quit_now){
775
errno = EINTR;
776
goto mandos_end;
777
}
778
779
buffer_capacity = incbuffer(&buffer, buffer_length,
566
buffer_capacity = adjustbuffer(&buffer, buffer_length,
780
567
buffer_capacity);
781
if(buffer_capacity == 0){
782
int e = errno;
783
perror("incbuffer");
784
errno = e;
785
goto mandos_end;
786
}
787
788
if(quit_now){
789
errno = EINTR;
790
goto mandos_end;
791
}
792
793
sret = gnutls_record_recv(session, buffer+buffer_length,
794
BUFFER_SIZE);
795
if(sret == 0){
568
if (buffer_capacity == 0){
569
perror("adjustbuffer");
570
retval = -1;
571
goto mandos_end;
572
}
573
574
ret = gnutls_record_recv(session, buffer+buffer_length,
575
BUFFER_SIZE);
576
if (ret == 0){
796
577
break;
797
578
}
798
if(sret < 0){
799
switch(sret){
579
if (ret < 0){
580
switch(ret){
800
581
case GNUTLS_E_INTERRUPTED:
801
582
case GNUTLS_E_AGAIN:
802
583
break;
803
584
case GNUTLS_E_REHANDSHAKE:
804
do {
805
ret = gnutls_handshake(session);
806
807
if(quit_now){
808
errno = EINTR;
809
goto mandos_end;
810
}
585
do{
586
ret = gnutls_handshake (session);
811
587
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
812
if(ret < 0){
588
if (ret < 0){
813
589
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
814
gnutls_perror(ret);
815
errno = EPROTO;
590
gnutls_perror (ret);
591
retval = -1;
816
592
goto mandos_end;
817
593
}
818
594
break;
819
595
default:
820
596
fprintf(stderr, "Unknown error while reading data from"
821
597
" encrypted session with Mandos server\n");
822
gnutls_bye(session, GNUTLS_SHUT_RDWR);
823
errno = EIO;
598
retval = -1;
599
gnutls_bye (session, GNUTLS_SHUT_RDWR);
824
600
goto mandos_end;
825
601
}
826
602
} else {
827
buffer_length += (size_t) sret;
603
buffer_length += (size_t) ret;
828
604
}
829
605
}
830
606
832
608
fprintf(stderr, "Closing TLS session\n");
833
609
}
834
610
835
if(quit_now){
836
errno = EINTR;
837
goto mandos_end;
838
}
839
840
do {
841
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
842
if(quit_now){
843
errno = EINTR;
844
goto mandos_end;
845
}
846
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
847
848
if(buffer_length > 0){
849
ssize_t decrypted_buffer_size;
611
gnutls_bye (session, GNUTLS_SHUT_RDWR);
612
613
if (buffer_length > 0){
850
614
decrypted_buffer_size = pgp_packet_decrypt(buffer,
851
615
buffer_length,
852
&decrypted_buffer);
853
if(decrypted_buffer_size >= 0){
854
616
&decrypted_buffer,
617
keydir);
618
if (decrypted_buffer_size >= 0){
855
619
written = 0;
856
620
while(written < (size_t) decrypted_buffer_size){
857
if(quit_now){
858
errno = EINTR;
859
goto mandos_end;
860
}
861
862
ret = (int)fwrite(decrypted_buffer + written, 1,
863
(size_t)decrypted_buffer_size - written,
864
stdout);
621
ret = (int)fwrite (decrypted_buffer + written, 1,
622
(size_t)decrypted_buffer_size - written,
623
stdout);
865
624
if(ret == 0 and ferror(stdout)){
866
int e = errno;
867
625
if(debug){
868
626
fprintf(stderr, "Error writing encrypted data: %s\n",
869
627
strerror(errno));
870
628
}
871
errno = e;
872
goto mandos_end;
629
retval = -1;
630
break;
873
631
}
874
632
written += (size_t)ret;
875
633
}
876
retval = 0;
634
free(decrypted_buffer);
635
} else {
636
retval = -1;
877
637
}
878
638
}
879
639
880
640
/* Shutdown procedure */
881
641
882
642
mandos_end:
883
{
884
int e = errno;
885
free(decrypted_buffer);
886
free(buffer);
887
if(tcp_sd >= 0){
888
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
889
}
890
if(ret == -1){
891
if(e == 0){
892
e = errno;
893
}
894
perror("close");
895
}
896
gnutls_deinit(session);
897
if(quit_now){
898
e = EINTR;
899
retval = -1;
900
}
901
errno = e;
902
}
643
free(buffer);
644
close(tcp_sd);
645
gnutls_deinit (session);
903
646
return retval;
904
647
}
905
648
906
649
static void resolve_callback(AvahiSServiceResolver *r,
907
650
AvahiIfIndex interface,
908
AvahiProtocol proto,
651
AVAHI_GCC_UNUSED AvahiProtocol protocol,
909
652
AvahiResolverEvent event,
910
653
const char *name,
911
654
const char *type,
916
659
AVAHI_GCC_UNUSED AvahiStringList *txt,
917
660
AVAHI_GCC_UNUSED AvahiLookupResultFlags
918
661
flags,
919
AVAHI_GCC_UNUSED void* userdata){
920
assert(r);
662
void* userdata) {
663
mandos_context *mc = userdata;
664
assert(r); /* Spurious warning */
921
665
922
666
/* Called whenever a service has been resolved successfully or
923
667
timed out */
924
668
925
if(quit_now){
926
return;
927
}
928
929
switch(event){
669
switch (event) {
930
670
default:
931
671
case AVAHI_RESOLVER_FAILURE:
932
672
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
933
673
" of type '%s' in domain '%s': %s\n", name, type, domain,
934
avahi_strerror(avahi_server_errno(mc.server)));
674
avahi_strerror(avahi_server_errno(mc->server)));
935
675
break;
936
676
937
677
case AVAHI_RESOLVER_FOUND:
940
680
avahi_address_snprint(ip, sizeof(ip), address);
941
681
if(debug){
942
682
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
943
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
944
ip, (intmax_t)interface, port);
683
PRIu16 ") on port %d\n", name, host_name, ip,
684
interface, port);
945
685
}
946
int ret = start_mandos_communication(ip, port, interface,
947
avahi_proto_to_af(proto));
948
if(ret == 0){
949
avahi_simple_poll_quit(mc.simple_poll);
686
int ret = start_mandos_communication(ip, port, interface, mc);
687
if (ret == 0){
688
avahi_simple_poll_quit(mc->simple_poll);
950
689
}
951
690
}
952
691
}
953
692
avahi_s_service_resolver_free(r);
954
693
}
955
694
956
static void browse_callback(AvahiSServiceBrowser *b,
957
AvahiIfIndex interface,
958
AvahiProtocol protocol,
959
AvahiBrowserEvent event,
960
const char *name,
961
const char *type,
962
const char *domain,
963
AVAHI_GCC_UNUSED AvahiLookupResultFlags
964
flags,
965
AVAHI_GCC_UNUSED void* userdata){
966
assert(b);
695
static void browse_callback( AvahiSServiceBrowser *b,
696
AvahiIfIndex interface,
697
AvahiProtocol protocol,
698
AvahiBrowserEvent event,
699
const char *name,
700
const char *type,
701
const char *domain,
702
AVAHI_GCC_UNUSED AvahiLookupResultFlags
703
flags,
704
void* userdata) {
705
mandos_context *mc = userdata;
706
assert(b); /* Spurious warning */
967
707
968
708
/* Called whenever a new services becomes available on the LAN or
969
709
is removed from the LAN */
970
710
971
if(quit_now){
972
return;
973
}
974
975
switch(event){
711
switch (event) {
976
712
default:
977
713
case AVAHI_BROWSER_FAILURE:
978
714
979
715
fprintf(stderr, "(Avahi browser) %s\n",
980
avahi_strerror(avahi_server_errno(mc.server)));
981
avahi_simple_poll_quit(mc.simple_poll);
716
avahi_strerror(avahi_server_errno(mc->server)));
717
avahi_simple_poll_quit(mc->simple_poll);
982
718
return;
983
719
984
720
case AVAHI_BROWSER_NEW:
987
723
the callback function is called the Avahi server will free the
988
724
resolver for us. */
989
725
990
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
991
name, type, domain, protocol, 0,
992
resolve_callback, NULL) == NULL)
726
if (!(avahi_s_service_resolver_new(mc->server, interface,
727
protocol, name, type, domain,
728
AVAHI_PROTO_INET6, 0,
729
resolve_callback, mc)))
993
730
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
994
name, avahi_strerror(avahi_server_errno(mc.server)));
731
name, avahi_strerror(avahi_server_errno(mc->server)));
995
732
break;
996
733
997
734
case AVAHI_BROWSER_REMOVE:
1006
743
}
1007
744
}
1008
745
1009
/* stop main loop after sigterm has been called */
1010
static void handle_sigterm(int sig){
1011
if(quit_now){
1012
return;
1013
}
1014
quit_now = 1;
1015
signal_received = sig;
1016
int old_errno = errno;
1017
if(mc.simple_poll != NULL){
1018
avahi_simple_poll_quit(mc.simple_poll);
1019
}
1020
errno = old_errno;
746
/* Combines file name and path and returns the malloced new
747
string. some sane checks could/should be added */
748
static char *combinepath(const char *first, const char *second){
749
char *tmp;
750
int ret = asprintf(&tmp, "%s/%s", first, second);
751
if(ret < 0){
752
return NULL;
753
}
754
return tmp;
1021
755
}
1022
756
757
1023
758
int main(int argc, char *argv[]){
1024
AvahiSServiceBrowser *sb = NULL;
1025
int error;
1026
int ret;
1027
intmax_t tmpmax;
1028
char *tmp;
1029
int exitcode = EXIT_SUCCESS;
1030
const char *interface = "eth0";
1031
struct ifreq network;
1032
int sd = -1;
1033
bool take_down_interface = false;
1034
uid_t uid;
1035
gid_t gid;
1036
char *connect_to = NULL;
1037
char tempdir[] = "/tmp/mandosXXXXXX";
1038
bool tempdir_created = false;
1039
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1040
const char *seckey = PATHDIR "/" SECKEY;
1041
const char *pubkey = PATHDIR "/" PUBKEY;
1042
1043
bool gnutls_initialized = false;
1044
bool gpgme_initialized = false;
1045
float delay = 2.5f;
1046
1047
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1048
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1049
1050
uid = getuid();
1051
gid = getgid();
1052
1053
/* Lower any group privileges we might have, just to be safe */
1054
errno = 0;
1055
ret = setgid(gid);
1056
if(ret == -1){
1057
perror("setgid");
1058
}
1059
1060
/* Lower user privileges (temporarily) */
1061
errno = 0;
1062
ret = seteuid(uid);
1063
if(ret == -1){
1064
perror("seteuid");
1065
}
1066
1067
if(quit_now){
1068
goto end;
1069
}
1070
1071
{
1072
struct argp_option options[] = {
1073
{ .name = "debug", .key = 128,
1074
.doc = "Debug mode", .group = 3 },
1075
{ .name = "connect", .key = 'c',
1076
.arg = "ADDRESS:PORT",
1077
.doc = "Connect directly to a specific Mandos server",
1078
.group = 1 },
1079
{ .name = "interface", .key = 'i',
1080
.arg = "NAME",
1081
.doc = "Network interface that will be used to search for"
1082
" Mandos servers",
1083
.group = 1 },
1084
{ .name = "seckey", .key = 's',
1085
.arg = "FILE",
1086
.doc = "OpenPGP secret key file base name",
1087
.group = 1 },
1088
{ .name = "pubkey", .key = 'p',
1089
.arg = "FILE",
1090
.doc = "OpenPGP public key file base name",
1091
.group = 2 },
1092
{ .name = "dh-bits", .key = 129,
1093
.arg = "BITS",
1094
.doc = "Bit length of the prime number used in the"
1095
" Diffie-Hellman key exchange",
1096
.group = 2 },
1097
{ .name = "priority", .key = 130,
1098
.arg = "STRING",
1099
.doc = "GnuTLS priority string for the TLS handshake",
1100
.group = 1 },
1101
{ .name = "delay", .key = 131,
1102
.arg = "SECONDS",
1103
.doc = "Maximum delay to wait for interface startup",
1104
.group = 2 },
1105
/*
1106
* These reproduce what we would get without ARGP_NO_HELP
1107
*/
1108
{ .name = "help", .key = '?',
1109
.doc = "Give this help list", .group = -1 },
1110
{ .name = "usage", .key = -3,
1111
.doc = "Give a short usage message", .group = -1 },
1112
{ .name = "version", .key = 'V',
1113
.doc = "Print program version", .group = -1 },
1114
{ .name = NULL }
1115
};
1116
1117
error_t parse_opt(int key, char *arg,
1118
struct argp_state *state){
1119
errno = 0;
1120
switch(key){
1121
case 128: /* --debug */
1122
debug = true;
1123
break;
1124
case 'c': /* --connect */
1125
connect_to = arg;
1126
break;
1127
case 'i': /* --interface */
1128
interface = arg;
1129
break;
1130
case 's': /* --seckey */
1131
seckey = arg;
1132
break;
1133
case 'p': /* --pubkey */
1134
pubkey = arg;
1135
break;
1136
case 129: /* --dh-bits */
1137
errno = 0;
1138
tmpmax = strtoimax(arg, &tmp, 10);
1139
if(errno != 0 or tmp == arg or *tmp != '\0'
1140
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1141
argp_error(state, "Bad number of DH bits");
1142
}
1143
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1144
break;
1145
case 130: /* --priority */
1146
mc.priority = arg;
1147
break;
1148
case 131: /* --delay */
1149
errno = 0;
1150
delay = strtof(arg, &tmp);
1151
if(errno != 0 or tmp == arg or *tmp != '\0'){
1152
argp_error(state, "Bad delay");
1153
}
1154
break;
1155
/*
1156
* These reproduce what we would get without ARGP_NO_HELP
1157
*/
1158
case '?': /* --help */
1159
argp_state_help(state, state->out_stream,
1160
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1161
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1162
case -3: /* --usage */
1163
argp_state_help(state, state->out_stream,
1164
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1165
case 'V': /* --version */
1166
fprintf(state->out_stream, "%s\n", argp_program_version);
1167
exit(argp_err_exit_status);
1168
break;
1169
default:
1170
return ARGP_ERR_UNKNOWN;
1171
}
1172
return errno;
1173
}
1174
1175
struct argp argp = { .options = options, .parser = parse_opt,
1176
.args_doc = "",
1177
.doc = "Mandos client -- Get and decrypt"
1178
" passwords from a Mandos server" };
1179
ret = argp_parse(&argp, argc, argv,
1180
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1181
switch(ret){
1182
case 0:
1183
break;
1184
case ENOMEM:
1185
default:
1186
errno = ret;
1187
perror("argp_parse");
1188
exitcode = EX_OSERR;
1189
goto end;
1190
case EINVAL:
1191
exitcode = EX_USAGE;
1192
goto end;
1193
}
1194
}
1195
1196
if(not debug){
1197
avahi_set_log_function(empty_log);
1198
}
1199
1200
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1201
from the signal handler */
1202
/* Initialize the pseudo-RNG for Avahi */
1203
srand((unsigned int) time(NULL));
1204
mc.simple_poll = avahi_simple_poll_new();
1205
if(mc.simple_poll == NULL){
1206
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1207
exitcode = EX_UNAVAILABLE;
1208
goto end;
1209
}
1210
1211
sigemptyset(&sigterm_action.sa_mask);
1212
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1213
if(ret == -1){
1214
perror("sigaddset");
1215
exitcode = EX_OSERR;
1216
goto end;
1217
}
1218
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1219
if(ret == -1){
1220
perror("sigaddset");
1221
exitcode = EX_OSERR;
1222
goto end;
1223
}
1224
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1225
if(ret == -1){
1226
perror("sigaddset");
1227
exitcode = EX_OSERR;
1228
goto end;
1229
}
1230
/* Need to check if the handler is SIG_IGN before handling:
1231
| [[info:libc:Initial Signal Actions]] |
1232
| [[info:libc:Basic Signal Handling]] |
1233
*/
1234
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1235
if(ret == -1){
1236
perror("sigaction");
1237
return EX_OSERR;
1238
}
1239
if(old_sigterm_action.sa_handler != SIG_IGN){
1240
ret = sigaction(SIGINT, &sigterm_action, NULL);
1241
if(ret == -1){
1242
perror("sigaction");
1243
exitcode = EX_OSERR;
1244
goto end;
1245
}
1246
}
1247
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1248
if(ret == -1){
1249
perror("sigaction");
1250
return EX_OSERR;
1251
}
1252
if(old_sigterm_action.sa_handler != SIG_IGN){
1253
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1254
if(ret == -1){
1255
perror("sigaction");
1256
exitcode = EX_OSERR;
1257
goto end;
1258
}
1259
}
1260
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1261
if(ret == -1){
1262
perror("sigaction");
1263
return EX_OSERR;
1264
}
1265
if(old_sigterm_action.sa_handler != SIG_IGN){
1266
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1267
if(ret == -1){
1268
perror("sigaction");
1269
exitcode = EX_OSERR;
1270
goto end;
1271
}
1272
}
1273
1274
/* If the interface is down, bring it up */
1275
if(interface[0] != '\0'){
759
AvahiSServiceBrowser *sb = NULL;
760
int error;
761
int ret;
762
int exitcode = EXIT_SUCCESS;
763
const char *interface = "eth0";
764
struct ifreq network;
765
int sd;
766
uid_t uid;
767
gid_t gid;
768
char *connect_to = NULL;
769
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
770
char *pubkeyfilename = NULL;
771
char *seckeyfilename = NULL;
772
const char *pubkeyname = "pubkey.txt";
773
const char *seckeyname = "seckey.txt";
774
mandos_context mc = { .simple_poll = NULL, .server = NULL,
775
.dh_bits = 1024, .priority = "SECURE256"};
776
bool gnutls_initalized = false;
777
778
{
779
struct argp_option options[] = {
780
{ .name = "debug", .key = 128,
781
.doc = "Debug mode", .group = 3 },
782
{ .name = "connect", .key = 'c',
783
.arg = "IP",
784
.doc = "Connect directly to a sepcified mandos server",
785
.group = 1 },
786
{ .name = "interface", .key = 'i',
787
.arg = "INTERFACE",
788
.doc = "Interface that Avahi will conntect through",
789
.group = 1 },
790
{ .name = "keydir", .key = 'd',
791
.arg = "KEYDIR",
792
.doc = "Directory where the openpgp keyring is",
793
.group = 1 },
794
{ .name = "seckey", .key = 's',
795
.arg = "SECKEY",
796
.doc = "Secret openpgp key for gnutls authentication",
797
.group = 1 },
798
{ .name = "pubkey", .key = 'p',
799
.arg = "PUBKEY",
800
.doc = "Public openpgp key for gnutls authentication",
801
.group = 2 },
802
{ .name = "dh-bits", .key = 129,
803
.arg = "BITS",
804
.doc = "dh-bits to use in gnutls communication",
805
.group = 2 },
806
{ .name = "priority", .key = 130,
807
.arg = "PRIORITY",
808
.doc = "GNUTLS priority", .group = 1 },
809
{ .name = NULL }
810
};
811
812
813
error_t parse_opt (int key, char *arg,
814
struct argp_state *state) {
815
/* Get the INPUT argument from `argp_parse', which we know is
816
a pointer to our plugin list pointer. */
817
switch (key) {
818
case 128:
819
debug = true;
820
break;
821
case 'c':
822
connect_to = arg;
823
break;
824
case 'i':
825
interface = arg;
826
break;
827
case 'd':
828
keydir = arg;
829
break;
830
case 's':
831
seckeyname = arg;
832
break;
833
case 'p':
834
pubkeyname = arg;
835
break;
836
case 129:
837
errno = 0;
838
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
839
if (errno){
840
perror("strtol");
841
exit(EXIT_FAILURE);
842
}
843
break;
844
case 130:
845
mc.priority = arg;
846
break;
847
case ARGP_KEY_ARG:
848
argp_usage (state);
849
case ARGP_KEY_END:
850
break;
851
default:
852
return ARGP_ERR_UNKNOWN;
853
}
854
return 0;
855
}
856
857
struct argp argp = { .options = options, .parser = parse_opt,
858
.args_doc = "",
859
.doc = "Mandos client -- Get and decrypt"
860
" passwords from mandos server" };
861
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
862
if (ret == ARGP_ERR_UNKNOWN){
863
fprintf(stderr, "Unknown error while parsing arguments\n");
864
exitcode = EXIT_FAILURE;
865
goto end;
866
}
867
}
868
869
pubkeyfilename = combinepath(keydir, pubkeyname);
870
if (pubkeyfilename == NULL){
871
perror("combinepath");
872
exitcode = EXIT_FAILURE;
873
goto end;
874
}
875
876
seckeyfilename = combinepath(keydir, seckeyname);
877
if (seckeyfilename == NULL){
878
perror("combinepath");
879
exitcode = EXIT_FAILURE;
880
goto end;
881
}
882
883
ret = init_gnutls_global(&mc, pubkeyfilename, seckeyfilename);
884
if (ret == -1){
885
fprintf(stderr, "init_gnutls_global failed\n");
886
exitcode = EXIT_FAILURE;
887
goto end;
888
} else {
889
gnutls_initalized = true;
890
}
891
892
/* If the interface is down, bring it up */
893
{
894
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
895
if(sd < 0) {
896
perror("socket");
897
exitcode = EXIT_FAILURE;
898
goto end;
899
}
900
strcpy(network.ifr_name, interface); /* Spurious warning */
901
ret = ioctl(sd, SIOCGIFFLAGS, &network);
902
if(ret == -1){
903
perror("ioctl SIOCGIFFLAGS");
904
exitcode = EXIT_FAILURE;
905
goto end;
906
}
907
if((network.ifr_flags & IFF_UP) == 0){
908
network.ifr_flags |= IFF_UP;
909
ret = ioctl(sd, SIOCSIFFLAGS, &network);
910
if(ret == -1){
911
perror("ioctl SIOCSIFFLAGS");
912
exitcode = EXIT_FAILURE;
913
goto end;
914
}
915
}
916
close(sd);
917
}
918
919
uid = getuid();
920
gid = getgid();
921
922
ret = setuid(uid);
923
if (ret == -1){
924
perror("setuid");
925
}
926
927
setgid(gid);
928
if (ret == -1){
929
perror("setgid");
930
}
931
1276
932
if_index = (AvahiIfIndex) if_nametoindex(interface);
1277
933
if(if_index == 0){
1278
934
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1279
exitcode = EX_UNAVAILABLE;
1280
goto end;
1281
}
1282
1283
if(quit_now){
1284
goto end;
1285
}
1286
1287
/* Re-raise priviliges */
1288
errno = 0;
1289
ret = seteuid(0);
1290
if(ret == -1){
1291
perror("seteuid");
1292
}
1293
1294
#ifdef __linux__
1295
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1296
messages about the network interface to mess up the prompt */
1297
ret = klogctl(8, NULL, 5);
1298
bool restore_loglevel = true;
1299
if(ret == -1){
1300
restore_loglevel = false;
1301
perror("klogctl");
1302
}
1303
#endif /* __linux__ */
1304
1305
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1306
if(sd < 0){
1307
perror("socket");
1308
exitcode = EX_OSERR;
1309
#ifdef __linux__
1310
if(restore_loglevel){
1311
ret = klogctl(7, NULL, 0);
1312
if(ret == -1){
1313
perror("klogctl");
1314
}
1315
}
1316
#endif /* __linux__ */
1317
/* Lower privileges */
1318
errno = 0;
1319
ret = seteuid(uid);
1320
if(ret == -1){
1321
perror("seteuid");
1322
}
1323
goto end;
1324
}
1325
strcpy(network.ifr_name, interface);
1326
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1327
if(ret == -1){
1328
perror("ioctl SIOCGIFFLAGS");
1329
#ifdef __linux__
1330
if(restore_loglevel){
1331
ret = klogctl(7, NULL, 0);
1332
if(ret == -1){
1333
perror("klogctl");
1334
}
1335
}
1336
#endif /* __linux__ */
1337
exitcode = EX_OSERR;
1338
/* Lower privileges */
1339
errno = 0;
1340
ret = seteuid(uid);
1341
if(ret == -1){
1342
perror("seteuid");
1343
}
1344
goto end;
1345
}
1346
if((network.ifr_flags & IFF_UP) == 0){
1347
network.ifr_flags |= IFF_UP;
1348
take_down_interface = true;
1349
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1350
if(ret == -1){
1351
take_down_interface = false;
1352
perror("ioctl SIOCSIFFLAGS");
1353
exitcode = EX_OSERR;
1354
#ifdef __linux__
1355
if(restore_loglevel){
1356
ret = klogctl(7, NULL, 0);
1357
if(ret == -1){
1358
perror("klogctl");
1359
}
1360
}
1361
#endif /* __linux__ */
1362
/* Lower privileges */
1363
errno = 0;
1364
ret = seteuid(uid);
1365
if(ret == -1){
1366
perror("seteuid");
1367
}
1368
goto end;
1369
}
1370
}
1371
/* sleep checking until interface is running */
1372
for(int i=0; i < delay * 4; i++){
1373
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1374
if(ret == -1){
1375
perror("ioctl SIOCGIFFLAGS");
1376
} else if(network.ifr_flags & IFF_RUNNING){
1377
break;
1378
}
1379
struct timespec sleeptime = { .tv_nsec = 250000000 };
1380
ret = nanosleep(&sleeptime, NULL);
1381
if(ret == -1 and errno != EINTR){
1382
perror("nanosleep");
1383
}
1384
}
1385
if(not take_down_interface){
1386
/* We won't need the socket anymore */
1387
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1388
if(ret == -1){
1389
perror("close");
1390
}
1391
}
1392
#ifdef __linux__
1393
if(restore_loglevel){
1394
/* Restores kernel loglevel to default */
1395
ret = klogctl(7, NULL, 0);
1396
if(ret == -1){
1397
perror("klogctl");
1398
}
1399
}
1400
#endif /* __linux__ */
1401
/* Lower privileges */
1402
errno = 0;
1403
if(take_down_interface){
1404
/* Lower privileges */
1405
ret = seteuid(uid);
1406
if(ret == -1){
1407
perror("seteuid");
1408
}
1409
} else {
1410
/* Lower privileges permanently */
1411
ret = setuid(uid);
1412
if(ret == -1){
1413
perror("setuid");
1414
}
1415
}
1416
}
1417
1418
if(quit_now){
1419
goto end;
1420
}
1421
1422
ret = init_gnutls_global(pubkey, seckey);
1423
if(ret == -1){
1424
fprintf(stderr, "init_gnutls_global failed\n");
1425
exitcode = EX_UNAVAILABLE;
1426
goto end;
1427
} else {
1428
gnutls_initialized = true;
1429
}
1430
1431
if(quit_now){
1432
goto end;
1433
}
1434
1435
tempdir_created = true;
1436
if(mkdtemp(tempdir) == NULL){
1437
tempdir_created = false;
1438
perror("mkdtemp");
1439
goto end;
1440
}
1441
1442
if(quit_now){
1443
goto end;
1444
}
1445
1446
if(not init_gpgme(pubkey, seckey, tempdir)){
1447
fprintf(stderr, "init_gpgme failed\n");
1448
exitcode = EX_UNAVAILABLE;
1449
goto end;
1450
} else {
1451
gpgme_initialized = true;
1452
}
1453
1454
if(quit_now){
1455
goto end;
1456
}
1457
1458
if(connect_to != NULL){
1459
/* Connect directly, do not use Zeroconf */
1460
/* (Mainly meant for debugging) */
1461
char *address = strrchr(connect_to, ':');
1462
if(address == NULL){
1463
fprintf(stderr, "No colon in address\n");
1464
exitcode = EX_USAGE;
1465
goto end;
1466
}
1467
1468
if(quit_now){
1469
goto end;
1470
}
1471
1472
uint16_t port;
1473
errno = 0;
1474
tmpmax = strtoimax(address+1, &tmp, 10);
1475
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1476
or tmpmax != (uint16_t)tmpmax){
1477
fprintf(stderr, "Bad port number\n");
1478
exitcode = EX_USAGE;
1479
goto end;
1480
}
1481
1482
if(quit_now){
1483
goto end;
1484
}
1485
1486
port = (uint16_t)tmpmax;
1487
*address = '\0';
1488
address = connect_to;
1489
/* Colon in address indicates IPv6 */
1490
int af;
1491
if(strchr(address, ':') != NULL){
1492
af = AF_INET6;
1493
} else {
1494
af = AF_INET;
1495
}
1496
1497
if(quit_now){
1498
goto end;
1499
}
1500
1501
ret = start_mandos_communication(address, port, if_index, af);
1502
if(ret < 0){
1503
switch(errno){
1504
case ENETUNREACH:
1505
case EHOSTDOWN:
1506
case EHOSTUNREACH:
1507
exitcode = EX_NOHOST;
1508
break;
1509
case EINVAL:
1510
exitcode = EX_USAGE;
1511
break;
1512
case EIO:
1513
exitcode = EX_IOERR;
1514
break;
1515
case EPROTO:
1516
exitcode = EX_PROTOCOL;
1517
break;
1518
default:
1519
exitcode = EX_OSERR;
1520
break;
1521
}
1522
} else {
1523
exitcode = EXIT_SUCCESS;
1524
}
1525
goto end;
1526
}
1527
1528
if(quit_now){
1529
goto end;
1530
}
1531
1532
{
1533
AvahiServerConfig config;
1534
/* Do not publish any local Zeroconf records */
1535
avahi_server_config_init(&config);
1536
config.publish_hinfo = 0;
1537
config.publish_addresses = 0;
1538
config.publish_workstation = 0;
1539
config.publish_domain = 0;
1540
1541
/* Allocate a new server */
1542
mc.server = avahi_server_new(avahi_simple_poll_get
1543
(mc.simple_poll), &config, NULL,
1544
NULL, &error);
1545
1546
/* Free the Avahi configuration data */
1547
avahi_server_config_free(&config);
1548
}
1549
1550
/* Check if creating the Avahi server object succeeded */
1551
if(mc.server == NULL){
1552
fprintf(stderr, "Failed to create Avahi server: %s\n",
1553
avahi_strerror(error));
1554
exitcode = EX_UNAVAILABLE;
1555
goto end;
1556
}
1557
1558
if(quit_now){
1559
goto end;
1560
}
1561
1562
/* Create the Avahi service browser */
1563
sb = avahi_s_service_browser_new(mc.server, if_index,
1564
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1565
NULL, 0, browse_callback, NULL);
1566
if(sb == NULL){
1567
fprintf(stderr, "Failed to create service browser: %s\n",
1568
avahi_strerror(avahi_server_errno(mc.server)));
1569
exitcode = EX_UNAVAILABLE;
1570
goto end;
1571
}
1572
1573
if(quit_now){
1574
goto end;
1575
}
1576
1577
/* Run the main loop */
1578
1579
if(debug){
1580
fprintf(stderr, "Starting Avahi loop search\n");
1581
}
1582
1583
avahi_simple_poll_loop(mc.simple_poll);
1584
935
exit(EXIT_FAILURE);
936
}
937
938
if(connect_to != NULL){
939
/* Connect directly, do not use Zeroconf */
940
/* (Mainly meant for debugging) */
941
char *address = strrchr(connect_to, ':');
942
if(address == NULL){
943
fprintf(stderr, "No colon in address\n");
944
exitcode = EXIT_FAILURE;
945
goto end;
946
}
947
errno = 0;
948
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
949
if(errno){
950
perror("Bad port number");
951
exitcode = EXIT_FAILURE;
952
goto end;
953
}
954
*address = '\0';
955
address = connect_to;
956
ret = start_mandos_communication(address, port, if_index, &mc);
957
if(ret < 0){
958
exitcode = EXIT_FAILURE;
959
} else {
960
exitcode = EXIT_SUCCESS;
961
}
962
goto end;
963
}
964
965
if (not debug){
966
avahi_set_log_function(empty_log);
967
}
968
969
/* Initialize the pseudo-RNG for Avahi */
970
srand((unsigned int) time(NULL));
971
972
/* Allocate main Avahi loop object */
973
mc.simple_poll = avahi_simple_poll_new();
974
if (mc.simple_poll == NULL) {
975
fprintf(stderr, "Avahi: Failed to create simple poll"
976
" object.\n");
977
exitcode = EXIT_FAILURE;
978
goto end;
979
}
980
981
{
982
AvahiServerConfig config;
983
/* Do not publish any local Zeroconf records */
984
avahi_server_config_init(&config);
985
config.publish_hinfo = 0;
986
config.publish_addresses = 0;
987
config.publish_workstation = 0;
988
config.publish_domain = 0;
989
990
/* Allocate a new server */
991
mc.server = avahi_server_new(avahi_simple_poll_get
992
(mc.simple_poll), &config, NULL,
993
NULL, &error);
994
995
/* Free the Avahi configuration data */
996
avahi_server_config_free(&config);
997
}
998
999
/* Check if creating the Avahi server object succeeded */
1000
if (mc.server == NULL) {
1001
fprintf(stderr, "Failed to create Avahi server: %s\n",
1002
avahi_strerror(error));
1003
exitcode = EXIT_FAILURE;
1004
goto end;
1005
}
1006
1007
/* Create the Avahi service browser */
1008
sb = avahi_s_service_browser_new(mc.server, if_index,
1009
AVAHI_PROTO_INET6,
1010
"_mandos._tcp", NULL, 0,
1011
browse_callback, &mc);
1012
if (sb == NULL) {
1013
fprintf(stderr, "Failed to create service browser: %s\n",
1014
avahi_strerror(avahi_server_errno(mc.server)));
1015
exitcode = EXIT_FAILURE;
1016
goto end;
1017
}
1018
1019
/* Run the main loop */
1020
1021
if (debug){
1022
fprintf(stderr, "Starting Avahi loop search\n");
1023
}
1024
1025
avahi_simple_poll_loop(mc.simple_poll);
1026
1585
1027
end:
1586
1587
if(debug){
1588
fprintf(stderr, "%s exiting\n", argv[0]);
1589
}
1590
1591
/* Cleanup things */
1592
if(sb != NULL)
1593
avahi_s_service_browser_free(sb);
1594
1595
if(mc.server != NULL)
1596
avahi_server_free(mc.server);
1597
1598
if(mc.simple_poll != NULL)
1599
avahi_simple_poll_free(mc.simple_poll);
1600
1601
if(gnutls_initialized){
1602
gnutls_certificate_free_credentials(mc.cred);
1603
gnutls_global_deinit();
1604
gnutls_dh_params_deinit(mc.dh_params);
1605
}
1606
1607
if(gpgme_initialized){
1608
gpgme_release(mc.ctx);
1609
}
1610
1611
/* Take down the network interface */
1612
if(take_down_interface){
1613
/* Re-raise priviliges */
1614
errno = 0;
1615
ret = seteuid(0);
1616
if(ret == -1){
1617
perror("seteuid");
1618
}
1619
if(geteuid() == 0){
1620
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1621
if(ret == -1){
1622
perror("ioctl SIOCGIFFLAGS");
1623
} else if(network.ifr_flags & IFF_UP) {
1624
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1625
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1626
if(ret == -1){
1627
perror("ioctl SIOCSIFFLAGS");
1628
}
1629
}
1630
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1631
if(ret == -1){
1632
perror("close");
1633
}
1634
/* Lower privileges permanently */
1635
errno = 0;
1636
ret = setuid(uid);
1637
if(ret == -1){
1638
perror("setuid");
1639
}
1640
}
1641
}
1642
1643
/* Removes the temp directory used by GPGME */
1644
if(tempdir_created){
1645
DIR *d;
1646
struct dirent *direntry;
1647
d = opendir(tempdir);
1648
if(d == NULL){
1649
if(errno != ENOENT){
1650
perror("opendir");
1651
}
1652
} else {
1653
while(true){
1654
direntry = readdir(d);
1655
if(direntry == NULL){
1656
break;
1657
}
1658
/* Skip "." and ".." */
1659
if(direntry->d_name[0] == '.'
1660
and (direntry->d_name[1] == '\0'
1661
or (direntry->d_name[1] == '.'
1662
and direntry->d_name[2] == '\0'))){
1663
continue;
1664
}
1665
char *fullname = NULL;
1666
ret = asprintf(&fullname, "%s/%s", tempdir,
1667
direntry->d_name);
1668
if(ret < 0){
1669
perror("asprintf");
1670
continue;
1671
}
1672
ret = remove(fullname);
1673
if(ret == -1){
1674
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1675
strerror(errno));
1676
}
1677
free(fullname);
1678
}
1679
closedir(d);
1680
}
1681
ret = rmdir(tempdir);
1682
if(ret == -1 and errno != ENOENT){
1683
perror("rmdir");
1684
}
1685
}
1686
1687
if(quit_now){
1688
sigemptyset(&old_sigterm_action.sa_mask);
1689
old_sigterm_action.sa_handler = SIG_DFL;
1690
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1691
&old_sigterm_action,
1692
NULL));
1693
if(ret == -1){
1694
perror("sigaction");
1695
}
1696
do {
1697
ret = raise(signal_received);
1698
} while(ret != 0 and errno == EINTR);
1699
if(ret != 0){
1700
perror("raise");
1701
abort();
1702
}
1703
TEMP_FAILURE_RETRY(pause());
1704
}
1705
1706
return exitcode;
1028
1029
if (debug){
1030
fprintf(stderr, "%s exiting\n", argv[0]);
1031
}
1032
1033
/* Cleanup things */
1034
if (sb != NULL)
1035
avahi_s_service_browser_free(sb);
1036
1037
if (mc.server != NULL)
1038
avahi_server_free(mc.server);
1039
1040
if (mc.simple_poll != NULL)
1041
avahi_simple_poll_free(mc.simple_poll);
1042
free(pubkeyfilename);
1043
free(seckeyfilename);
1044
1045
if (gnutls_initalized){
1046
gnutls_certificate_free_credentials(mc.cred);
1047
gnutls_global_deinit ();
1048
}
1049
1050
return exitcode;
1707
1051
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0