46
116
#include <avahi-common/malloc.h>
47
117
#include <avahi-common/error.h>
50
#include <sys/types.h> /* socket(), inet_pton() */
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
52
struct in6_addr, inet_pton() */
53
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
54
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
#include <unistd.h> /* close() */
57
#include <netinet/in.h>
58
#include <stdbool.h> /* true */
59
#include <string.h> /* memset */
60
#include <arpa/inet.h> /* inet_pton() */
61
#include <iso646.h> /* not */
64
#include <errno.h> /* perror() */
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
120
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
123
init_gnutls_session(),
125
#include <gnutls/openpgp.h>
126
/* gnutls_certificate_set_openpgp_key_file(),
127
GNUTLS_OPENPGP_FMT_BASE64 */
130
#include <gpgme.h> /* All GPGME types, constants and
133
GPGME_PROTOCOL_OpenPGP,
75
136
#define BUFFER_SIZE 256
138
#define PATHDIR "/conf/conf.d/mandos"
139
#define SECKEY "seckey.txt"
140
#define PUBKEY "pubkey.txt"
141
#define HOOKDIR "/lib/mandos/network-hooks.d"
78
143
bool debug = false;
144
static const char mandos_protocol_version[] = "1";
145
const char *argp_program_version = "mandos-client " VERSION;
146
const char *argp_program_bug_address = "<mandos@recompile.se>";
147
static const char sys_class_net[] = "/sys/class/net";
148
char *connect_to = NULL;
149
const char *hookdir = HOOKDIR;
154
/* Doubly linked list that need to be circularly linked when used */
155
typedef struct server{
158
AvahiIfIndex if_index;
160
struct timespec last_seen;
165
/* Used for passing in values through the Avahi callback functions */
81
gnutls_session_t session;
82
168
gnutls_certificate_credentials_t cred;
169
unsigned int dh_bits;
83
170
gnutls_dh_params_t dh_params;
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
89
gpgme_data_t dh_crypto, dh_plain;
171
const char *priority;
173
server *current_server;
175
size_t interfaces_size;
178
/* global so signal handler can reach it*/
179
AvahiSimplePoll *simple_poll;
181
sig_atomic_t quit_now = 0;
182
int signal_received = 0;
184
/* Function to use when printing errors */
185
void perror_plus(const char *print_text){
187
fprintf(stderr, "Mandos plugin %s: ",
188
program_invocation_short_name);
193
__attribute__((format (gnu_printf, 2, 3), nonnull))
194
int fprintf_plus(FILE *stream, const char *format, ...){
196
va_start (ap, format);
198
TEMP_FAILURE_RETRY(fprintf(stream, "Mandos plugin %s: ",
199
program_invocation_short_name));
200
return (int)TEMP_FAILURE_RETRY(vfprintf(stream, format, ap));
204
* Make additional room in "buffer" for at least BUFFER_SIZE more
205
* bytes. "buffer_capacity" is how much is currently allocated,
206
* "buffer_length" is how much is already used.
208
__attribute__((nonnull, warn_unused_result))
209
size_t incbuffer(char **buffer, size_t buffer_length,
210
size_t buffer_capacity){
211
if(buffer_length + BUFFER_SIZE > buffer_capacity){
212
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
214
int old_errno = errno;
221
buffer_capacity += BUFFER_SIZE;
223
return buffer_capacity;
226
/* Add server to set of servers to retry periodically */
227
__attribute__((nonnull, warn_unused_result))
228
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
229
int af, server **current_server){
231
server *new_server = malloc(sizeof(server));
232
if(new_server == NULL){
233
perror_plus("malloc");
236
*new_server = (server){ .ip = strdup(ip),
238
.if_index = if_index,
240
if(new_server->ip == NULL){
241
perror_plus("strdup");
245
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
247
perror_plus("clock_gettime");
249
#pragma GCC diagnostic push
250
#pragma GCC diagnostic ignored "-Wcast-qual"
252
free((char *)(new_server->ip));
254
#pragma GCC diagnostic pop
259
/* Special case of first server */
260
if(*current_server == NULL){
261
new_server->next = new_server;
262
new_server->prev = new_server;
263
*current_server = new_server;
265
/* Place the new server last in the list */
266
new_server->next = *current_server;
267
new_server->prev = (*current_server)->prev;
268
new_server->prev->next = new_server;
269
(*current_server)->prev = new_server;
277
__attribute__((nonnull, warn_unused_result))
278
static bool init_gpgme(const char * const seckey,
279
const char * const pubkey,
280
const char * const tempdir,
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
95
283
gpgme_engine_info_t engine_info;
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
286
* Helper function to insert pub and seckey to the engine keyring.
288
bool import_key(const char * const filename){
291
gpgme_data_t pgp_data;
293
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
299
rc = gpgme_data_new_from_fd(&pgp_data, fd);
300
if(rc != GPG_ERR_NO_ERROR){
301
fprintf_plus(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
302
gpgme_strsource(rc), gpgme_strerror(rc));
306
rc = gpgme_op_import(mc->ctx, pgp_data);
307
if(rc != GPG_ERR_NO_ERROR){
308
fprintf_plus(stderr, "bad gpgme_op_import: %s: %s\n",
309
gpgme_strsource(rc), gpgme_strerror(rc));
315
perror_plus("close");
317
gpgme_data_release(pgp_data);
322
fprintf_plus(stderr, "Initializing GPGME\n");
102
326
gpgme_check_version(NULL);
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
327
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
328
if(rc != GPG_ERR_NO_ERROR){
329
fprintf_plus(stderr, "bad gpgme_engine_check_version: %s: %s\n",
330
gpgme_strsource(rc), gpgme_strerror(rc));
105
/* Set GPGME home directory */
106
rc = gpgme_get_engine_info (&engine_info);
107
if (rc != GPG_ERR_NO_ERROR){
108
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
109
gpgme_strsource(rc), gpgme_strerror(rc));
334
/* Set GPGME home directory for the OpenPGP engine only */
335
rc = gpgme_get_engine_info(&engine_info);
336
if(rc != GPG_ERR_NO_ERROR){
337
fprintf_plus(stderr, "bad gpgme_get_engine_info: %s: %s\n",
338
gpgme_strsource(rc), gpgme_strerror(rc));
112
341
while(engine_info != NULL){
113
342
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
114
343
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
115
engine_info->file_name, homedir);
344
engine_info->file_name, tempdir);
118
347
engine_info = engine_info->next;
120
349
if(engine_info == NULL){
121
fprintf(stderr, "Could not set home dir to %s\n", homedir);
125
/* Create new GPGME data buffer from packet buffer */
126
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
127
if (rc != GPG_ERR_NO_ERROR){
128
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
129
gpgme_strsource(rc), gpgme_strerror(rc));
350
fprintf_plus(stderr, "Could not set GPGME home dir to %s\n",
355
/* Create new GPGME "context" */
356
rc = gpgme_new(&(mc->ctx));
357
if(rc != GPG_ERR_NO_ERROR){
358
fprintf_plus(stderr, "Mandos plugin mandos-client: "
359
"bad gpgme_new: %s: %s\n", gpgme_strsource(rc),
364
if(not import_key(pubkey) or not import_key(seckey)){
372
* Decrypt OpenPGP data.
373
* Returns -1 on error
375
__attribute__((nonnull, warn_unused_result))
376
static ssize_t pgp_packet_decrypt(const char *cryptotext,
380
gpgme_data_t dh_crypto, dh_plain;
383
size_t plaintext_capacity = 0;
384
ssize_t plaintext_length = 0;
387
fprintf_plus(stderr, "Trying to decrypt OpenPGP data\n");
390
/* Create new GPGME data buffer from memory cryptotext */
391
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
393
if(rc != GPG_ERR_NO_ERROR){
394
fprintf_plus(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
395
gpgme_strsource(rc), gpgme_strerror(rc));
133
399
/* Create new empty GPGME data buffer for the plaintext */
134
400
rc = gpgme_data_new(&dh_plain);
135
if (rc != GPG_ERR_NO_ERROR){
136
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
137
gpgme_strsource(rc), gpgme_strerror(rc));
141
/* Create new GPGME "context" */
142
rc = gpgme_new(&ctx);
143
if (rc != GPG_ERR_NO_ERROR){
144
fprintf(stderr, "bad gpgme_new: %s: %s\n",
145
gpgme_strsource(rc), gpgme_strerror(rc));
149
/* Decrypt data from the FILE pointer to the plaintext data
151
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
152
if (rc != GPG_ERR_NO_ERROR){
153
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
154
gpgme_strsource(rc), gpgme_strerror(rc));
159
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
163
gpgme_decrypt_result_t result;
164
result = gpgme_op_decrypt_result(ctx);
166
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
168
fprintf(stderr, "Unsupported algorithm: %s\n",
169
result->unsupported_algorithm);
170
fprintf(stderr, "Wrong key usage: %d\n",
171
result->wrong_key_usage);
172
if(result->file_name != NULL){
173
fprintf(stderr, "File name: %s\n", result->file_name);
175
gpgme_recipient_t recipient;
176
recipient = result->recipients;
401
if(rc != GPG_ERR_NO_ERROR){
402
fprintf_plus(stderr, "Mandos plugin mandos-client: "
403
"bad gpgme_data_new: %s: %s\n",
404
gpgme_strsource(rc), gpgme_strerror(rc));
405
gpgme_data_release(dh_crypto);
409
/* Decrypt data from the cryptotext data buffer to the plaintext
411
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
412
if(rc != GPG_ERR_NO_ERROR){
413
fprintf_plus(stderr, "bad gpgme_op_decrypt: %s: %s\n",
414
gpgme_strsource(rc), gpgme_strerror(rc));
415
plaintext_length = -1;
417
gpgme_decrypt_result_t result;
418
result = gpgme_op_decrypt_result(mc->ctx);
420
fprintf_plus(stderr, "gpgme_op_decrypt_result failed\n");
422
fprintf_plus(stderr, "Unsupported algorithm: %s\n",
423
result->unsupported_algorithm);
424
fprintf_plus(stderr, "Wrong key usage: %u\n",
425
result->wrong_key_usage);
426
if(result->file_name != NULL){
427
fprintf_plus(stderr, "File name: %s\n", result->file_name);
429
gpgme_recipient_t recipient;
430
recipient = result->recipients;
178
431
while(recipient != NULL){
179
fprintf(stderr, "Public key algorithm: %s\n",
180
gpgme_pubkey_algo_name(recipient->pubkey_algo));
181
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
182
fprintf(stderr, "Secret key available: %s\n",
183
recipient->status == GPG_ERR_NO_SECKEY
432
fprintf_plus(stderr, "Public key algorithm: %s\n",
433
gpgme_pubkey_algo_name
434
(recipient->pubkey_algo));
435
fprintf_plus(stderr, "Key ID: %s\n", recipient->keyid);
436
fprintf_plus(stderr, "Secret key available: %s\n",
437
recipient->status == GPG_ERR_NO_SECKEY
185
439
recipient = recipient->next;
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
447
fprintf_plus(stderr, "Decryption of OpenPGP data succeeded\n");
194
450
/* Seek back to the beginning of the GPGME plaintext data buffer */
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
451
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
452
perror_plus("gpgme_data_seek");
453
plaintext_length = -1;
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
203
if (*new_packet == NULL){
207
new_packet_capacity += BUFFER_SIZE;
459
plaintext_capacity = incbuffer(plaintext,
460
(size_t)plaintext_length,
462
if(plaintext_capacity == 0){
463
perror_plus("incbuffer");
464
plaintext_length = -1;
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
468
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
212
470
/* Print the data, if any */
217
perror("gpgme_data_read");
220
new_packet_length += ret;
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
476
perror_plus("gpgme_data_read");
477
plaintext_length = -1;
480
plaintext_length += ret;
484
fprintf_plus(stderr, "Decrypted password is: ");
485
for(ssize_t i = 0; i < plaintext_length; i++){
486
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
488
fprintf(stderr, "\n");
493
/* Delete the GPGME cryptotext data buffer */
494
gpgme_data_release(dh_crypto);
231
496
/* Delete the GPGME plaintext data buffer */
232
497
gpgme_data_release(dh_plain);
233
return new_packet_length;
236
static const char * safer_gnutls_strerror (int value) {
237
const char *ret = gnutls_strerror (value);
243
void debuggnutls(__attribute__((unused)) int level,
245
fprintf(stderr, "%s", string);
248
int initgnutls(encrypted_session *es){
498
return plaintext_length;
501
__attribute__((warn_unused_result, const))
502
static const char *safe_string(const char *str){
508
__attribute__((warn_unused_result))
509
static const char *safer_gnutls_strerror(int value){
510
const char *ret = gnutls_strerror(value);
511
return safe_string(ret);
514
/* GnuTLS log function callback */
515
__attribute__((nonnull))
516
static void debuggnutls(__attribute__((unused)) int level,
518
fprintf_plus(stderr, "GnuTLS: %s", string);
521
__attribute__((nonnull(1, 2, 4), warn_unused_result))
522
static int init_gnutls_global(const char *pubkeyfilename,
523
const char *seckeyfilename,
524
const char *dhparamsfilename,
253
fprintf(stderr, "Initializing GnuTLS\n");
256
if ((ret = gnutls_global_init ())
257
!= GNUTLS_E_SUCCESS) {
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
530
fprintf_plus(stderr, "Initializing GnuTLS\n");
534
/* "Use a log level over 10 to enable all debugging options."
263
537
gnutls_global_set_log_level(11);
264
538
gnutls_global_set_log_function(debuggnutls);
267
/* openpgp credentials */
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
269
!= GNUTLS_E_SUCCESS) {
270
fprintf (stderr, "memory error: %s\n",
271
safer_gnutls_strerror(ret));
541
/* OpenPGP credentials */
542
ret = gnutls_certificate_allocate_credentials(&mc->cred);
543
if(ret != GNUTLS_E_SUCCESS){
544
fprintf_plus(stderr, "GnuTLS memory error: %s\n",
545
safer_gnutls_strerror(ret));
276
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
550
fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
551
" secret key %s as GnuTLS credentials\n",
281
556
ret = gnutls_certificate_set_openpgp_key_file
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
283
if (ret != GNUTLS_E_SUCCESS) {
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
287
ret, CERTFILE, KEYFILE);
288
fprintf(stdout, "The Error is: %s\n",
289
safer_gnutls_strerror(ret));
293
//GnuTLS server initialization
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
295
!= GNUTLS_E_SUCCESS) {
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
297
safer_gnutls_strerror(ret));
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in prime generation: %s\n",
304
safer_gnutls_strerror(ret));
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
310
// GnuTLS session creation
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
312
!= GNUTLS_E_SUCCESS){
313
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
314
safer_gnutls_strerror(ret));
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf(stderr, "Syntax error at: %s\n", err);
320
fprintf(stderr, "GnuTLS error: %s\n",
321
safer_gnutls_strerror(ret));
325
if ((ret = gnutls_credentials_set
326
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Error setting a credentials set: %s\n",
329
safer_gnutls_strerror(ret));
557
(mc->cred, pubkeyfilename, seckeyfilename,
558
GNUTLS_OPENPGP_FMT_BASE64);
559
if(ret != GNUTLS_E_SUCCESS){
561
"Error[%d] while reading the OpenPGP key pair ('%s',"
562
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
563
fprintf_plus(stderr, "The GnuTLS error is: %s\n",
564
safer_gnutls_strerror(ret));
568
/* GnuTLS server initialization */
569
ret = gnutls_dh_params_init(&mc->dh_params);
570
if(ret != GNUTLS_E_SUCCESS){
571
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
572
" initialization: %s\n",
573
safer_gnutls_strerror(ret));
576
/* If a Diffie-Hellman parameters file was given, try to use it */
577
if(dhparamsfilename != NULL){
578
gnutls_datum_t params = { .data = NULL, .size = 0 };
580
int dhpfile = open(dhparamsfilename, O_RDONLY);
583
dhparamsfilename = NULL;
586
size_t params_capacity = 0;
588
params_capacity = incbuffer((char **)¶ms.data,
590
(size_t)params_capacity);
591
if(params_capacity == 0){
592
perror_plus("incbuffer");
595
dhparamsfilename = NULL;
598
ssize_t bytes_read = read(dhpfile,
599
params.data + params.size,
605
/* check bytes_read for failure */
610
dhparamsfilename = NULL;
613
params.size += (unsigned int)bytes_read;
615
if(params.data == NULL){
616
dhparamsfilename = NULL;
618
if(dhparamsfilename == NULL){
621
ret = gnutls_dh_params_import_pkcs3(mc->dh_params, ¶ms,
622
GNUTLS_X509_FMT_PEM);
623
if(ret != GNUTLS_E_SUCCESS){
624
fprintf_plus(stderr, "Failed to parse DH parameters in file"
625
" \"%s\": %s\n", dhparamsfilename,
626
safer_gnutls_strerror(ret));
627
dhparamsfilename = NULL;
632
if(dhparamsfilename == NULL){
633
if(mc->dh_bits == 0){
634
/* Find out the optimal number of DH bits */
635
/* Try to read the private key file */
636
gnutls_datum_t buffer = { .data = NULL, .size = 0 };
638
int secfile = open(seckeyfilename, O_RDONLY);
643
size_t buffer_capacity = 0;
645
buffer_capacity = incbuffer((char **)&buffer.data,
647
(size_t)buffer_capacity);
648
if(buffer_capacity == 0){
649
perror_plus("incbuffer");
654
ssize_t bytes_read = read(secfile,
655
buffer.data + buffer.size,
661
/* check bytes_read for failure */
668
buffer.size += (unsigned int)bytes_read;
672
/* If successful, use buffer to parse private key */
673
gnutls_sec_param_t sec_param = GNUTLS_SEC_PARAM_ULTRA;
674
if(buffer.data != NULL){
676
gnutls_openpgp_privkey_t privkey = NULL;
677
ret = gnutls_openpgp_privkey_init(&privkey);
678
if(ret != GNUTLS_E_SUCCESS){
679
fprintf_plus(stderr, "Error initializing OpenPGP key"
681
safer_gnutls_strerror(ret));
685
ret = gnutls_openpgp_privkey_import
686
(privkey, &buffer, GNUTLS_OPENPGP_FMT_BASE64, "", 0);
687
if(ret != GNUTLS_E_SUCCESS){
688
fprintf_plus(stderr, "Error importing OpenPGP key : %s",
689
safer_gnutls_strerror(ret));
695
/* Use private key to suggest an appropriate
697
sec_param = gnutls_openpgp_privkey_sec_param(privkey);
698
gnutls_openpgp_privkey_deinit(privkey);
700
fprintf_plus(stderr, "This OpenPGP key implies using"
701
" a GnuTLS security parameter \"%s\".\n",
702
safe_string(gnutls_sec_param_get_name
708
if(sec_param == GNUTLS_SEC_PARAM_UNKNOWN){
709
/* Err on the side of caution */
710
sec_param = GNUTLS_SEC_PARAM_ULTRA;
712
fprintf_plus(stderr, "Falling back to security parameter"
714
safe_string(gnutls_sec_param_get_name
719
uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
723
fprintf_plus(stderr, "A \"%s\" GnuTLS security parameter"
724
" implies %u DH bits; using that.\n",
725
safe_string(gnutls_sec_param_get_name
730
fprintf_plus(stderr, "Failed to get implied number of DH"
731
" bits for security parameter \"%s\"): %s\n",
732
safe_string(gnutls_sec_param_get_name
734
safer_gnutls_strerror(ret));
738
fprintf_plus(stderr, "DH bits explicitly set to %u\n",
741
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
742
if(ret != GNUTLS_E_SUCCESS){
743
fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
744
" bits): %s\n", mc->dh_bits,
745
safer_gnutls_strerror(ret));
749
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
755
gnutls_certificate_free_credentials(mc->cred);
756
gnutls_dh_params_deinit(mc->dh_params);
760
__attribute__((nonnull, warn_unused_result))
761
static int init_gnutls_session(gnutls_session_t *session,
764
/* GnuTLS session creation */
766
ret = gnutls_init(session, GNUTLS_SERVER);
770
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
771
if(ret != GNUTLS_E_SUCCESS){
773
"Error in GnuTLS session initialization: %s\n",
774
safer_gnutls_strerror(ret));
780
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
782
gnutls_deinit(*session);
785
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
786
if(ret != GNUTLS_E_SUCCESS){
787
fprintf_plus(stderr, "Syntax error at: %s\n", err);
788
fprintf_plus(stderr, "GnuTLS error: %s\n",
789
safer_gnutls_strerror(ret));
790
gnutls_deinit(*session);
796
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
799
gnutls_deinit(*session);
802
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
803
if(ret != GNUTLS_E_SUCCESS){
804
fprintf_plus(stderr, "Error setting GnuTLS credentials: %s\n",
805
safer_gnutls_strerror(ret));
806
gnutls_deinit(*session);
333
810
/* ignore client certificate if any. */
334
gnutls_certificate_server_set_request (es->session,
337
gnutls_dh_set_prime_bits (es->session, DH_BITS);
811
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
342
void empty_log(__attribute__((unused)) AvahiLogLevel level,
343
__attribute__((unused)) const char *txt){}
345
int start_mandos_communication(const char *ip, uint16_t port,
816
/* Avahi log function callback */
817
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
818
__attribute__((unused)) const char *txt){}
820
/* Set effective uid to 0, return errno */
821
__attribute__((warn_unused_result))
822
int raise_privileges(void){
823
int old_errno = errno;
825
if(seteuid(0) == -1){
832
/* Set effective and real user ID to 0. Return errno. */
833
__attribute__((warn_unused_result))
834
int raise_privileges_permanently(void){
835
int old_errno = errno;
836
int ret = raise_privileges();
848
/* Set effective user ID to unprivileged saved user ID */
849
__attribute__((warn_unused_result))
850
int lower_privileges(void){
851
int old_errno = errno;
853
if(seteuid(uid) == -1){
860
/* Lower privileges permanently */
861
__attribute__((warn_unused_result))
862
int lower_privileges_permanently(void){
863
int old_errno = errno;
865
if(setuid(uid) == -1){
872
/* Helper function to add_local_route() and delete_local_route() */
873
__attribute__((nonnull, warn_unused_result))
874
static bool add_delete_local_route(const bool add,
876
AvahiIfIndex if_index){
878
char helper[] = "mandos-client-iprouteadddel";
879
char add_arg[] = "add";
880
char delete_arg[] = "delete";
881
char debug_flag[] = "--debug";
882
char *pluginhelperdir = getenv("MANDOSPLUGINHELPERDIR");
883
if(pluginhelperdir == NULL){
885
fprintf_plus(stderr, "MANDOSPLUGINHELPERDIR environment"
886
" variable not set; cannot run helper\n");
891
char interface[IF_NAMESIZE];
892
if(if_indextoname((unsigned int)if_index, interface) == NULL){
893
perror_plus("if_indextoname");
897
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
899
perror_plus("open(\"/dev/null\", O_RDONLY)");
905
/* Raise privileges */
906
errno = raise_privileges_permanently();
908
perror_plus("Failed to raise privileges");
909
/* _exit(EX_NOPERM); */
915
perror_plus("setgid");
918
/* Reset supplementary groups */
920
ret = setgroups(0, NULL);
922
perror_plus("setgroups");
926
ret = dup2(devnull, STDIN_FILENO);
928
perror_plus("dup2(devnull, STDIN_FILENO)");
931
ret = close(devnull);
933
perror_plus("close");
936
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
938
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
941
int helperdir_fd = (int)TEMP_FAILURE_RETRY(open(pluginhelperdir,
946
if(helperdir_fd == -1){
948
_exit(EX_UNAVAILABLE);
950
int helper_fd = (int)TEMP_FAILURE_RETRY(openat(helperdir_fd,
953
perror_plus("openat");
955
_exit(EX_UNAVAILABLE);
959
#pragma GCC diagnostic push
960
#pragma GCC diagnostic ignored "-Wcast-qual"
962
if(fexecve(helper_fd, (char *const [])
963
{ helper, add ? add_arg : delete_arg, (char *)address,
964
interface, debug ? debug_flag : NULL, NULL },
967
#pragma GCC diagnostic pop
969
perror_plus("fexecve");
981
pret = waitpid(pid, &status, 0);
982
if(pret == -1 and errno == EINTR and quit_now){
983
int errno_raising = 0;
984
if((errno = raise_privileges()) != 0){
985
errno_raising = errno;
986
perror_plus("Failed to raise privileges in order to"
987
" kill helper program");
989
if(kill(pid, SIGTERM) == -1){
992
if((errno_raising == 0) and (errno = lower_privileges()) != 0){
993
perror_plus("Failed to lower privileges after killing"
998
} while(pret == -1 and errno == EINTR);
1000
perror_plus("waitpid");
1003
if(WIFEXITED(status)){
1004
if(WEXITSTATUS(status) != 0){
1005
fprintf_plus(stderr, "Error: iprouteadddel exited"
1006
" with status %d\n", WEXITSTATUS(status));
1011
if(WIFSIGNALED(status)){
1012
fprintf_plus(stderr, "Error: iprouteadddel died by"
1013
" signal %d\n", WTERMSIG(status));
1016
fprintf_plus(stderr, "Error: iprouteadddel crashed\n");
1020
__attribute__((nonnull, warn_unused_result))
1021
static bool add_local_route(const char *address,
1022
AvahiIfIndex if_index){
1024
fprintf_plus(stderr, "Adding route to %s\n", address);
1026
return add_delete_local_route(true, address, if_index);
1029
__attribute__((nonnull, warn_unused_result))
1030
static bool delete_local_route(const char *address,
346
1031
AvahiIfIndex if_index){
348
struct sockaddr_in6 to;
349
encrypted_session es;
1033
fprintf_plus(stderr, "Removing route to %s\n", address);
1035
return add_delete_local_route(false, address, if_index);
1038
/* Called when a Mandos server is found */
1039
__attribute__((nonnull, warn_unused_result))
1040
static int start_mandos_communication(const char *ip, in_port_t port,
1041
AvahiIfIndex if_index,
1042
int af, mandos_context *mc){
1043
int ret, tcp_sd = -1;
1045
struct sockaddr_storage to;
350
1046
char *buffer = NULL;
351
char *decrypted_buffer;
1047
char *decrypted_buffer = NULL;
352
1048
size_t buffer_length = 0;
353
1049
size_t buffer_capacity = 0;
354
ssize_t decrypted_buffer_size;
357
char interface[IF_NAMESIZE];
360
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
364
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
370
if(if_indextoname((unsigned int)if_index, interface) == NULL){
372
perror("if_indextoname");
378
fprintf(stderr, "Binding to interface %s\n", interface);
381
memset(&to,0,sizeof(to)); /* Spurious warning */
382
to.sin6_family = AF_INET6;
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
1052
gnutls_session_t session;
1053
int pf; /* Protocol family */
1054
bool route_added = false;
1071
fprintf_plus(stderr, "Bad address family: %d\n", af);
1076
/* If the interface is specified and we have a list of interfaces */
1077
if(if_index != AVAHI_IF_UNSPEC and mc->interfaces != NULL){
1078
/* Check if the interface is one of the interfaces we are using */
1081
char *interface = NULL;
1082
while((interface = argz_next(mc->interfaces,
1083
mc->interfaces_size,
1085
if(if_nametoindex(interface) == (unsigned int)if_index){
1092
/* This interface does not match any in the list, so we don't
1093
connect to the server */
1095
char interface[IF_NAMESIZE];
1096
if(if_indextoname((unsigned int)if_index, interface) == NULL){
1097
perror_plus("if_indextoname");
1099
fprintf_plus(stderr, "Skipping server on non-used interface"
1101
if_indextoname((unsigned int)if_index,
1109
ret = init_gnutls_session(&session, mc);
1115
fprintf_plus(stderr, "Setting up a TCP connection to %s, port %"
1116
PRIuMAX "\n", ip, (uintmax_t)port);
1119
tcp_sd = socket(pf, SOCK_STREAM | SOCK_CLOEXEC, 0);
1122
perror_plus("socket");
1133
struct sockaddr_in6 *to6 = (struct sockaddr_in6 *)&to;
1134
*to6 = (struct sockaddr_in6){ .sin6_family = (sa_family_t)af };
1135
ret = inet_pton(af, ip, &to6->sin6_addr);
1137
struct sockaddr_in *to4 = (struct sockaddr_in *)&to;
1138
*to4 = (struct sockaddr_in){ .sin_family = (sa_family_t)af };
1139
ret = inet_pton(af, ip, &to4->sin_addr);
1143
perror_plus("inet_pton");
389
fprintf(stderr, "Bad address: %s\n", ip);
392
to.sin6_port = htons(port); /* Spurious warning */
394
to.sin6_scope_id = (uint32_t)if_index;
397
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
414
ret = initgnutls (&es);
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
424
fprintf(stderr, "Establishing TLS session with %s\n", ip);
427
ret = gnutls_handshake (es.session);
429
if (ret != GNUTLS_E_SUCCESS){
1149
fprintf_plus(stderr, "Bad address: %s\n", ip);
1154
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
1155
if(IN6_IS_ADDR_LINKLOCAL
1156
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
1157
if(if_index == AVAHI_IF_UNSPEC){
1158
fprintf_plus(stderr, "An IPv6 link-local address is"
1159
" incomplete without a network interface\n");
1163
/* Set the network interface number as scope */
1164
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
1167
((struct sockaddr_in *)&to)->sin_port = htons(port);
1176
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
1177
char interface[IF_NAMESIZE];
1178
if(if_indextoname((unsigned int)if_index, interface) == NULL){
1179
perror_plus("if_indextoname");
1181
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
1182
"\n", ip, interface, (uintmax_t)port);
1185
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
1186
ip, (uintmax_t)port);
1188
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
1189
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
1191
ret = getnameinfo((struct sockaddr *)&to,
1192
sizeof(struct sockaddr_in6),
1193
addrstr, sizeof(addrstr), NULL, 0,
1196
ret = getnameinfo((struct sockaddr *)&to,
1197
sizeof(struct sockaddr_in),
1198
addrstr, sizeof(addrstr), NULL, 0,
1201
if(ret == EAI_SYSTEM){
1202
perror_plus("getnameinfo");
1203
} else if(ret != 0) {
1204
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
1205
} else if(strcmp(addrstr, ip) != 0){
1206
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1217
ret = connect(tcp_sd, (struct sockaddr *)&to,
1218
sizeof(struct sockaddr_in6));
1220
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
1221
sizeof(struct sockaddr_in));
1224
if(((errno == ENETUNREACH) or (errno == EHOSTUNREACH))
1225
and if_index != AVAHI_IF_UNSPEC
1226
and connect_to == NULL
1227
and not route_added and
1228
((af == AF_INET6 and not
1229
IN6_IS_ADDR_LINKLOCAL(&(((struct sockaddr_in6 *)
1231
or (af == AF_INET and
1232
/* Not a a IPv4LL address */
1233
(ntohl(((struct sockaddr_in *)&to)->sin_addr.s_addr)
1234
& 0xFFFF0000L) != 0xA9FE0000L))){
1235
/* Work around Avahi bug - Avahi does not announce link-local
1236
addresses if it has a global address, so local hosts with
1237
*only* a link-local address (e.g. Mandos clients) cannot
1238
connect to a Mandos server announced by Avahi on a server
1239
host with a global address. Work around this by retrying
1240
with an explicit route added with the server's address.
1242
Avahi bug reference:
1243
https://lists.freedesktop.org/archives/avahi/2010-February/001833.html
1244
https://bugs.debian.org/587961
1247
fprintf_plus(stderr, "Mandos server unreachable, trying"
1251
route_added = add_local_route(ip, if_index);
1257
if(errno != ECONNREFUSED or debug){
1259
perror_plus("connect");
1272
const char *out = mandos_protocol_version;
1275
size_t out_size = strlen(out);
1276
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
1277
out_size - written));
1280
perror_plus("write");
1284
written += (size_t)ret;
1285
if(written < out_size){
1288
if(out == mandos_protocol_version){
1303
fprintf_plus(stderr, "Establishing TLS session with %s\n", ip);
1311
/* This casting via intptr_t is to eliminate warning about casting
1312
an int to a pointer type. This is exactly how the GnuTLS Guile
1313
function "set-session-transport-fd!" does it. */
1314
gnutls_transport_set_ptr(session,
1315
(gnutls_transport_ptr_t)(intptr_t)tcp_sd);
1323
ret = gnutls_handshake(session);
1328
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
1330
if(ret != GNUTLS_E_SUCCESS){
431
fprintf(stderr, "\n*** Handshake failed ***\n");
1332
fprintf_plus(stderr, "*** GnuTLS Handshake failed ***\n");
438
//Retrieve OpenPGP packet that contains the wanted password
1339
/* Read OpenPGP packet that contains the wanted password */
441
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
1342
fprintf_plus(stderr, "Retrieving OpenPGP encrypted password from"
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
452
buffer_capacity += BUFFER_SIZE;
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
1353
buffer_capacity = incbuffer(&buffer, buffer_length,
1355
if(buffer_capacity == 0){
1357
perror_plus("incbuffer");
1367
sret = gnutls_record_recv(session, buffer+buffer_length,
462
1374
case GNUTLS_E_INTERRUPTED:
463
1375
case GNUTLS_E_AGAIN:
465
1377
case GNUTLS_E_REHANDSHAKE:
466
ret = gnutls_handshake (es.session);
468
fprintf(stderr, "\n*** Handshake failed ***\n");
1379
ret = gnutls_handshake(session);
1385
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
1387
fprintf_plus(stderr, "*** GnuTLS Re-handshake failed "
475
fprintf(stderr, "Unknown error while reading data from"
476
" encrypted session with mandos server\n");
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
1395
fprintf_plus(stderr, "Unknown error while reading data from"
1396
" encrypted session with Mandos server\n");
1397
gnutls_bye(session, GNUTLS_SHUT_RDWR);
482
buffer_length += (size_t) ret;
486
if (buffer_length > 0){
487
decrypted_buffer_size = pgp_packet_decrypt(buffer,
491
if (decrypted_buffer_size >= 0){
1402
buffer_length += (size_t) sret;
1407
fprintf_plus(stderr, "Closing TLS session\n");
1416
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
1421
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
1423
if(buffer_length > 0){
1424
ssize_t decrypted_buffer_size;
1425
decrypted_buffer_size = pgp_packet_decrypt(buffer, buffer_length,
1426
&decrypted_buffer, mc);
1427
if(decrypted_buffer_size >= 0){
492
1431
while(written < (size_t) decrypted_buffer_size){
493
ret = (int)fwrite (decrypted_buffer + written, 1,
494
(size_t)decrypted_buffer_size - written,
1437
ret = (int)fwrite(decrypted_buffer + written, 1,
1438
(size_t)decrypted_buffer_size - written,
496
1440
if(ret == 0 and ferror(stdout)){
498
fprintf(stderr, "Error writing encrypted data: %s\n",
1443
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
504
1449
written += (size_t)ret;
506
free(decrypted_buffer);
1451
ret = fflush(stdout);
1455
fprintf_plus(stderr, "Error writing encrypted data: %s\n",
1465
/* Shutdown procedure */
1470
if(not delete_local_route(ip, if_index)){
1471
fprintf_plus(stderr, "Failed to delete local route to %s on"
1472
" interface %d", ip, if_index);
1476
free(decrypted_buffer);
1479
ret = close(tcp_sd);
1485
perror_plus("close");
1487
gnutls_deinit(session);
515
fprintf(stderr, "Closing TLS session\n");
519
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
522
gnutls_deinit (es.session);
523
gnutls_certificate_free_credentials (es.cred);
524
gnutls_global_deinit ();
528
static AvahiSimplePoll *simple_poll = NULL;
529
static AvahiServer *server = NULL;
531
static void resolve_callback(
532
AvahiSServiceResolver *r,
533
AvahiIfIndex interface,
534
AVAHI_GCC_UNUSED AvahiProtocol protocol,
535
AvahiResolverEvent event,
539
const char *host_name,
540
const AvahiAddress *address,
542
AVAHI_GCC_UNUSED AvahiStringList *txt,
543
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
544
AVAHI_GCC_UNUSED void* userdata) {
546
assert(r); /* Spurious warning */
1497
__attribute__((nonnull))
1498
static void resolve_callback(AvahiSServiceResolver *r,
1499
AvahiIfIndex interface,
1500
AvahiProtocol proto,
1501
AvahiResolverEvent event,
1505
const char *host_name,
1506
const AvahiAddress *address,
1508
AVAHI_GCC_UNUSED AvahiStringList *txt,
1509
AVAHI_GCC_UNUSED AvahiLookupResultFlags
548
1516
/* Called whenever a service has been resolved successfully or
1520
avahi_s_service_resolver_free(r);
553
1526
case AVAHI_RESOLVER_FAILURE:
554
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
555
" type '%s' in domain '%s': %s\n", name, type, domain,
556
avahi_strerror(avahi_server_errno(server)));
1527
fprintf_plus(stderr, "(Avahi Resolver) Failed to resolve service "
1528
"'%s' of type '%s' in domain '%s': %s\n", name, type,
1530
avahi_strerror(avahi_server_errno
1531
(((mandos_context*)mc)->server)));
559
1534
case AVAHI_RESOLVER_FOUND:
561
1536
char ip[AVAHI_ADDRESS_STR_MAX];
562
1537
avahi_address_snprint(ip, sizeof(ip), address);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
1539
fprintf_plus(stderr, "Mandos server \"%s\" found on %s (%s, %"
1540
PRIdMAX ") on port %" PRIu16 "\n", name,
1541
host_name, ip, (intmax_t)interface, port);
567
int ret = start_mandos_communication(ip, port, interface);
1543
int ret = start_mandos_communication(ip, (in_port_t)port,
1545
avahi_proto_to_af(proto),
1548
avahi_simple_poll_quit(simple_poll);
1550
if(not add_server(ip, (in_port_t)port, interface,
1551
avahi_proto_to_af(proto),
1552
&((mandos_context*)mc)->current_server)){
1553
fprintf_plus(stderr, "Failed to add server \"%s\" to server"
573
1559
avahi_s_service_resolver_free(r);
576
static void browse_callback(
577
AvahiSServiceBrowser *b,
578
AvahiIfIndex interface,
579
AvahiProtocol protocol,
580
AvahiBrowserEvent event,
584
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
587
AvahiServer *s = userdata;
588
assert(b); /* Spurious warning */
590
/* Called whenever a new services becomes available on the LAN or
591
is removed from the LAN */
1562
static void browse_callback(AvahiSServiceBrowser *b,
1563
AvahiIfIndex interface,
1564
AvahiProtocol protocol,
1565
AvahiBrowserEvent event,
1569
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1576
/* Called whenever a new services becomes available on the LAN or
1577
is removed from the LAN */
1585
case AVAHI_BROWSER_FAILURE:
1587
fprintf_plus(stderr, "(Avahi browser) %s\n",
1588
avahi_strerror(avahi_server_errno
1589
(((mandos_context*)mc)->server)));
1590
avahi_simple_poll_quit(simple_poll);
1593
case AVAHI_BROWSER_NEW:
1594
/* We ignore the returned Avahi resolver object. In the callback
1595
function we free it. If the Avahi server is terminated before
1596
the callback function is called the Avahi server will free the
1599
if(avahi_s_service_resolver_new(((mandos_context*)mc)->server,
1600
interface, protocol, name, type,
1601
domain, protocol, 0,
1602
resolve_callback, mc) == NULL)
1603
fprintf_plus(stderr, "Avahi: Failed to resolve service '%s':"
1605
avahi_strerror(avahi_server_errno
1606
(((mandos_context*)mc)->server)));
1609
case AVAHI_BROWSER_REMOVE:
1612
case AVAHI_BROWSER_ALL_FOR_NOW:
1613
case AVAHI_BROWSER_CACHE_EXHAUSTED:
1615
fprintf_plus(stderr, "No Mandos server found, still"
1622
/* Signal handler that stops main loop after SIGTERM */
1623
static void handle_sigterm(int sig){
1628
signal_received = sig;
1629
int old_errno = errno;
1630
/* set main loop to exit */
1631
if(simple_poll != NULL){
1632
avahi_simple_poll_quit(simple_poll);
1637
__attribute__((nonnull, warn_unused_result))
1638
bool get_flags(const char *ifname, struct ifreq *ifr){
1642
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1645
perror_plus("socket");
1649
strncpy(ifr->ifr_name, ifname, IF_NAMESIZE);
1650
ifr->ifr_name[IF_NAMESIZE-1] = '\0'; /* NUL terminate */
1651
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1655
perror_plus("ioctl SIOCGIFFLAGS");
1663
__attribute__((nonnull, warn_unused_result))
1664
bool good_flags(const char *ifname, const struct ifreq *ifr){
1666
/* Reject the loopback device */
1667
if(ifr->ifr_flags & IFF_LOOPBACK){
1669
fprintf_plus(stderr, "Rejecting loopback interface \"%s\"\n",
1674
/* Accept point-to-point devices only if connect_to is specified */
1675
if(connect_to != NULL and (ifr->ifr_flags & IFF_POINTOPOINT)){
1677
fprintf_plus(stderr, "Accepting point-to-point interface"
1678
" \"%s\"\n", ifname);
1682
/* Otherwise, reject non-broadcast-capable devices */
1683
if(not (ifr->ifr_flags & IFF_BROADCAST)){
1685
fprintf_plus(stderr, "Rejecting non-broadcast interface"
1686
" \"%s\"\n", ifname);
1690
/* Reject non-ARP interfaces (including dummy interfaces) */
1691
if(ifr->ifr_flags & IFF_NOARP){
1693
fprintf_plus(stderr, "Rejecting non-ARP interface \"%s\"\n",
1699
/* Accept this device */
1701
fprintf_plus(stderr, "Interface \"%s\" is good\n", ifname);
1707
* This function determines if a directory entry in /sys/class/net
1708
* corresponds to an acceptable network device.
1709
* (This function is passed to scandir(3) as a filter function.)
1711
__attribute__((nonnull, warn_unused_result))
1712
int good_interface(const struct dirent *if_entry){
1713
if(if_entry->d_name[0] == '.'){
1718
if(not get_flags(if_entry->d_name, &ifr)){
1720
fprintf_plus(stderr, "Failed to get flags for interface "
1721
"\"%s\"\n", if_entry->d_name);
1726
if(not good_flags(if_entry->d_name, &ifr)){
1733
* This function determines if a network interface is up.
1735
__attribute__((nonnull, warn_unused_result))
1736
bool interface_is_up(const char *interface){
1738
if(not get_flags(interface, &ifr)){
1740
fprintf_plus(stderr, "Failed to get flags for interface "
1741
"\"%s\"\n", interface);
1746
return (bool)(ifr.ifr_flags & IFF_UP);
1750
* This function determines if a network interface is running
1752
__attribute__((nonnull, warn_unused_result))
1753
bool interface_is_running(const char *interface){
1755
if(not get_flags(interface, &ifr)){
1757
fprintf_plus(stderr, "Failed to get flags for interface "
1758
"\"%s\"\n", interface);
1763
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1766
__attribute__((nonnull, pure, warn_unused_result))
1767
int notdotentries(const struct dirent *direntry){
1768
/* Skip "." and ".." */
1769
if(direntry->d_name[0] == '.'
1770
and (direntry->d_name[1] == '\0'
1771
or (direntry->d_name[1] == '.'
1772
and direntry->d_name[2] == '\0'))){
1778
/* Is this directory entry a runnable program? */
1779
__attribute__((nonnull, warn_unused_result))
1780
int runnable_hook(const struct dirent *direntry){
1785
if((direntry->d_name)[0] == '\0'){
1790
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1791
"abcdefghijklmnopqrstuvwxyz"
1794
if((direntry->d_name)[sret] != '\0'){
1795
/* Contains non-allowed characters */
1797
fprintf_plus(stderr, "Ignoring hook \"%s\" with bad name\n",
1803
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1806
perror_plus("Could not stat hook");
1810
if(not (S_ISREG(st.st_mode))){
1811
/* Not a regular file */
1813
fprintf_plus(stderr, "Ignoring hook \"%s\" - not a file\n",
1818
if(not (st.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))){
1819
/* Not executable */
1821
fprintf_plus(stderr, "Ignoring hook \"%s\" - not executable\n",
1827
fprintf_plus(stderr, "Hook \"%s\" is acceptable\n",
1833
__attribute__((nonnull, warn_unused_result))
1834
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1835
mandos_context *mc){
1837
struct timespec now;
1838
struct timespec waited_time;
1839
intmax_t block_time;
1842
if(mc->current_server == NULL){
1844
fprintf_plus(stderr, "Wait until first server is found."
1847
ret = avahi_simple_poll_iterate(s, -1);
1850
fprintf_plus(stderr, "Check current_server if we should run"
1853
/* the current time */
1854
ret = clock_gettime(CLOCK_MONOTONIC, &now);
1856
perror_plus("clock_gettime");
1859
/* Calculating in ms how long time between now and server
1860
who we visted longest time ago. Now - last seen. */
1861
waited_time.tv_sec = (now.tv_sec
1862
- mc->current_server->last_seen.tv_sec);
1863
waited_time.tv_nsec = (now.tv_nsec
1864
- mc->current_server->last_seen.tv_nsec);
1865
/* total time is 10s/10,000ms.
1866
Converting to s from ms by dividing by 1,000,
1867
and ns to ms by dividing by 1,000,000. */
1868
block_time = ((retry_interval
1869
- ((intmax_t)waited_time.tv_sec * 1000))
1870
- ((intmax_t)waited_time.tv_nsec / 1000000));
1873
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1877
if(block_time <= 0){
1878
ret = start_mandos_communication(mc->current_server->ip,
1879
mc->current_server->port,
1880
mc->current_server->if_index,
1881
mc->current_server->af, mc);
1883
avahi_simple_poll_quit(s);
1886
ret = clock_gettime(CLOCK_MONOTONIC,
1887
&mc->current_server->last_seen);
1889
perror_plus("clock_gettime");
1892
mc->current_server = mc->current_server->next;
1893
block_time = 0; /* Call avahi to find new Mandos
1894
servers, but don't block */
1897
ret = avahi_simple_poll_iterate(s, (int)block_time);
1900
if(ret > 0 or errno != EINTR){
1901
return (ret != 1) ? ret : 0;
1907
__attribute__((nonnull))
1908
void run_network_hooks(const char *mode, const char *interface,
1910
struct dirent **direntries = NULL;
1911
if(hookdir_fd == -1){
1912
hookdir_fd = open(hookdir, O_RDONLY | O_DIRECTORY | O_PATH
1914
if(hookdir_fd == -1){
1915
if(errno == ENOENT){
1917
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1918
" found\n", hookdir);
1921
perror_plus("open");
1926
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1927
runnable_hook, alphasort);
1929
perror_plus("scandir");
1932
struct dirent *direntry;
1934
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1936
perror_plus("open(\"/dev/null\", O_RDONLY)");
1939
for(int i = 0; i < numhooks; i++){
1940
direntry = direntries[i];
1942
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1945
pid_t hook_pid = fork();
1948
/* Raise privileges */
1949
errno = raise_privileges_permanently();
1951
perror_plus("Failed to raise privileges");
1958
perror_plus("setgid");
1961
/* Reset supplementary groups */
1963
ret = setgroups(0, NULL);
1965
perror_plus("setgroups");
1968
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1970
perror_plus("setenv");
1973
ret = setenv("DEVICE", interface, 1);
1975
perror_plus("setenv");
1978
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1980
perror_plus("setenv");
1983
ret = setenv("MODE", mode, 1);
1985
perror_plus("setenv");
1989
ret = asprintf(&delaystring, "%f", (double)delay);
1991
perror_plus("asprintf");
1994
ret = setenv("DELAY", delaystring, 1);
1997
perror_plus("setenv");
2001
if(connect_to != NULL){
2002
ret = setenv("CONNECT", connect_to, 1);
2004
perror_plus("setenv");
2008
int hook_fd = (int)TEMP_FAILURE_RETRY(openat(hookdir_fd,
2012
perror_plus("openat");
2013
_exit(EXIT_FAILURE);
2015
if(close(hookdir_fd) == -1){
2016
perror_plus("close");
2017
_exit(EXIT_FAILURE);
2019
ret = dup2(devnull, STDIN_FILENO);
2021
perror_plus("dup2(devnull, STDIN_FILENO)");
2024
ret = close(devnull);
2026
perror_plus("close");
2029
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
2031
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
2034
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
2036
perror_plus("fexecve");
2037
_exit(EXIT_FAILURE);
2041
perror_plus("fork");
2046
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
2047
perror_plus("waitpid");
2051
if(WIFEXITED(status)){
2052
if(WEXITSTATUS(status) != 0){
2053
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
2054
" with status %d\n", direntry->d_name,
2055
WEXITSTATUS(status));
2059
} else if(WIFSIGNALED(status)){
2060
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
2061
" signal %d\n", direntry->d_name,
2066
fprintf_plus(stderr, "Warning: network hook \"%s\""
2067
" crashed\n", direntry->d_name);
2073
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
2079
if(close(hookdir_fd) == -1){
2080
perror_plus("close");
2087
__attribute__((nonnull, warn_unused_result))
2088
int bring_up_interface(const char *const interface,
2090
int old_errno = errno;
2092
struct ifreq network;
2093
unsigned int if_index = if_nametoindex(interface);
2095
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
2105
if(not interface_is_up(interface)){
2107
int ioctl_errno = 0;
2108
if(not get_flags(interface, &network)){
2110
fprintf_plus(stderr, "Failed to get flags for interface "
2111
"\"%s\"\n", interface);
2115
network.ifr_flags |= IFF_UP; /* set flag */
2117
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
2120
perror_plus("socket");
2128
perror_plus("close");
2135
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
2139
/* Raise privileges */
2140
ret_errno = raise_privileges();
2143
perror_plus("Failed to raise privileges");
2148
bool restore_loglevel = false;
2150
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
2151
messages about the network interface to mess up the prompt */
2152
ret_linux = klogctl(8, NULL, 5);
2153
if(ret_linux == -1){
2154
perror_plus("klogctl");
2156
restore_loglevel = true;
2159
#endif /* __linux__ */
2160
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
2161
ioctl_errno = errno;
2163
if(restore_loglevel){
2164
ret_linux = klogctl(7, NULL, 0);
2165
if(ret_linux == -1){
2166
perror_plus("klogctl");
2169
#endif /* __linux__ */
2171
/* If raise_privileges() succeeded above */
2173
/* Lower privileges */
2174
ret_errno = lower_privileges();
2177
perror_plus("Failed to lower privileges");
2181
/* Close the socket */
2184
perror_plus("close");
2187
if(ret_setflags == -1){
2188
errno = ioctl_errno;
2189
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
2194
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
2198
/* Sleep checking until interface is running.
2199
Check every 0.25s, up to total time of delay */
2200
for(int i = 0; i < delay * 4; i++){
2201
if(interface_is_running(interface)){
2204
struct timespec sleeptime = { .tv_nsec = 250000000 };
2205
ret = nanosleep(&sleeptime, NULL);
2206
if(ret == -1 and errno != EINTR){
2207
perror_plus("nanosleep");
2215
__attribute__((nonnull, warn_unused_result))
2216
int take_down_interface(const char *const interface){
2217
int old_errno = errno;
2218
struct ifreq network;
2219
unsigned int if_index = if_nametoindex(interface);
2221
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
2225
if(interface_is_up(interface)){
2227
int ioctl_errno = 0;
2228
if(not get_flags(interface, &network) and debug){
2230
fprintf_plus(stderr, "Failed to get flags for interface "
2231
"\"%s\"\n", interface);
2235
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2237
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
2240
perror_plus("socket");
2246
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
2250
/* Raise privileges */
2251
ret_errno = raise_privileges();
2254
perror_plus("Failed to raise privileges");
2257
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
2258
ioctl_errno = errno;
2260
/* If raise_privileges() succeeded above */
2262
/* Lower privileges */
2263
ret_errno = lower_privileges();
2266
perror_plus("Failed to lower privileges");
2270
/* Close the socket */
2271
int ret = close(sd);
2273
perror_plus("close");
2276
if(ret_setflags == -1){
2277
errno = ioctl_errno;
2278
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2283
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
2291
int main(int argc, char *argv[]){
2292
mandos_context mc = { .server = NULL, .dh_bits = 0,
2293
.priority = "SECURE256:!CTYPE-X.509"
2294
":+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256",
2295
.current_server = NULL, .interfaces = NULL,
2296
.interfaces_size = 0 };
2297
AvahiSServiceBrowser *sb = NULL;
2302
int exitcode = EXIT_SUCCESS;
2303
char *interfaces_to_take_down = NULL;
2304
size_t interfaces_to_take_down_size = 0;
2305
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
2306
char old_tempdir[] = "/tmp/mandosXXXXXX";
2307
char *tempdir = NULL;
2308
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
2309
const char *seckey = PATHDIR "/" SECKEY;
2310
const char *pubkey = PATHDIR "/" PUBKEY;
2311
const char *dh_params_file = NULL;
2312
char *interfaces_hooks = NULL;
2314
bool gnutls_initialized = false;
2315
bool gpgme_initialized = false;
2317
double retry_interval = 10; /* 10s between trying a server and
2318
retrying the same server again */
2320
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
2321
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
2326
/* Lower any group privileges we might have, just to be safe */
2330
perror_plus("setgid");
2333
/* Lower user privileges (temporarily) */
2337
perror_plus("seteuid");
2345
struct argp_option options[] = {
2346
{ .name = "debug", .key = 128,
2347
.doc = "Debug mode", .group = 3 },
2348
{ .name = "connect", .key = 'c',
2349
.arg = "ADDRESS:PORT",
2350
.doc = "Connect directly to a specific Mandos server",
2352
{ .name = "interface", .key = 'i',
2354
.doc = "Network interface that will be used to search for"
2357
{ .name = "seckey", .key = 's',
2359
.doc = "OpenPGP secret key file base name",
2361
{ .name = "pubkey", .key = 'p',
2363
.doc = "OpenPGP public key file base name",
2365
{ .name = "dh-bits", .key = 129,
2367
.doc = "Bit length of the prime number used in the"
2368
" Diffie-Hellman key exchange",
2370
{ .name = "dh-params", .key = 134,
2372
.doc = "PEM-encoded PKCS#3 file with pre-generated parameters"
2373
" for the Diffie-Hellman key exchange",
2375
{ .name = "priority", .key = 130,
2377
.doc = "GnuTLS priority string for the TLS handshake",
2379
{ .name = "delay", .key = 131,
2381
.doc = "Maximum delay to wait for interface startup",
2383
{ .name = "retry", .key = 132,
2385
.doc = "Retry interval used when denied by the Mandos server",
2387
{ .name = "network-hook-dir", .key = 133,
2389
.doc = "Directory where network hooks are located",
2392
* These reproduce what we would get without ARGP_NO_HELP
2394
{ .name = "help", .key = '?',
2395
.doc = "Give this help list", .group = -1 },
2396
{ .name = "usage", .key = -3,
2397
.doc = "Give a short usage message", .group = -1 },
2398
{ .name = "version", .key = 'V',
2399
.doc = "Print program version", .group = -1 },
2403
error_t parse_opt(int key, char *arg,
2404
struct argp_state *state){
2407
case 128: /* --debug */
2410
case 'c': /* --connect */
2413
case 'i': /* --interface */
2414
ret_errno = argz_add_sep(&mc.interfaces, &mc.interfaces_size,
2417
argp_error(state, "%s", strerror(ret_errno));
2420
case 's': /* --seckey */
2423
case 'p': /* --pubkey */
2426
case 129: /* --dh-bits */
2428
tmpmax = strtoimax(arg, &tmp, 10);
2429
if(errno != 0 or tmp == arg or *tmp != '\0'
2430
or tmpmax != (typeof(mc.dh_bits))tmpmax){
2431
argp_error(state, "Bad number of DH bits");
2433
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
2435
case 134: /* --dh-params */
2436
dh_params_file = arg;
2438
case 130: /* --priority */
2441
case 131: /* --delay */
2443
delay = strtof(arg, &tmp);
2444
if(errno != 0 or tmp == arg or *tmp != '\0'){
2445
argp_error(state, "Bad delay");
2447
case 132: /* --retry */
2449
retry_interval = strtod(arg, &tmp);
2450
if(errno != 0 or tmp == arg or *tmp != '\0'
2451
or (retry_interval * 1000) > INT_MAX
2452
or retry_interval < 0){
2453
argp_error(state, "Bad retry interval");
2456
case 133: /* --network-hook-dir */
2460
* These reproduce what we would get without ARGP_NO_HELP
2462
case '?': /* --help */
2463
argp_state_help(state, state->out_stream,
2464
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
2465
& ~(unsigned int)ARGP_HELP_EXIT_OK);
2466
case -3: /* --usage */
2467
argp_state_help(state, state->out_stream,
2468
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
2469
case 'V': /* --version */
2470
fprintf_plus(state->out_stream, "%s\n", argp_program_version);
2471
exit(argp_err_exit_status);
2474
return ARGP_ERR_UNKNOWN;
2479
struct argp argp = { .options = options, .parser = parse_opt,
2481
.doc = "Mandos client -- Get and decrypt"
2482
" passwords from a Mandos server" };
2483
ret_errno = argp_parse(&argp, argc, argv,
2484
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
595
case AVAHI_BROWSER_FAILURE:
597
fprintf(stderr, "(Browser) %s\n",
598
avahi_strerror(avahi_server_errno(server)));
599
avahi_simple_poll_quit(simple_poll);
602
case AVAHI_BROWSER_NEW:
603
/* We ignore the returned resolver object. In the callback
604
function we free it. If the server is terminated before
605
the callback function is called the server will free
606
the resolver for us. */
608
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
610
AVAHI_PROTO_INET6, 0,
611
resolve_callback, s)))
612
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
613
avahi_strerror(avahi_server_errno(s)));
616
case AVAHI_BROWSER_REMOVE:
619
case AVAHI_BROWSER_ALL_FOR_NOW:
620
case AVAHI_BROWSER_CACHE_EXHAUSTED:
625
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
2491
perror_plus("argp_parse");
2492
exitcode = EX_OSERR;
2495
exitcode = EX_USAGE;
2501
/* Work around Debian bug #633582:
2502
<https://bugs.debian.org/633582> */
2504
/* Re-raise privileges */
2505
ret = raise_privileges();
2508
perror_plus("Failed to raise privileges");
2512
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2513
int seckey_fd = open(seckey, O_RDONLY);
2514
if(seckey_fd == -1){
2515
perror_plus("open");
2517
ret = (int)TEMP_FAILURE_RETRY(fstat(seckey_fd, &st));
2519
perror_plus("fstat");
2521
if(S_ISREG(st.st_mode)
2522
and st.st_uid == 0 and st.st_gid == 0){
2523
ret = fchown(seckey_fd, uid, gid);
2525
perror_plus("fchown");
2533
if(strcmp(pubkey, PATHDIR "/" PUBKEY) == 0){
2534
int pubkey_fd = open(pubkey, O_RDONLY);
2535
if(pubkey_fd == -1){
2536
perror_plus("open");
2538
ret = (int)TEMP_FAILURE_RETRY(fstat(pubkey_fd, &st));
2540
perror_plus("fstat");
2542
if(S_ISREG(st.st_mode)
2543
and st.st_uid == 0 and st.st_gid == 0){
2544
ret = fchown(pubkey_fd, uid, gid);
2546
perror_plus("fchown");
2554
if(dh_params_file != NULL
2555
and strcmp(dh_params_file, PATHDIR "/dhparams.pem" ) == 0){
2556
int dhparams_fd = open(dh_params_file, O_RDONLY);
2557
if(dhparams_fd == -1){
2558
perror_plus("open");
2560
ret = (int)TEMP_FAILURE_RETRY(fstat(dhparams_fd, &st));
2562
perror_plus("fstat");
2564
if(S_ISREG(st.st_mode)
2565
and st.st_uid == 0 and st.st_gid == 0){
2566
ret = fchown(dhparams_fd, uid, gid);
2568
perror_plus("fchown");
2576
/* Lower privileges */
2577
ret = lower_privileges();
2580
perror_plus("Failed to lower privileges");
2585
/* Remove invalid interface names (except "none") */
2587
char *interface = NULL;
2588
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2590
if(strcmp(interface, "none") != 0
2591
and if_nametoindex(interface) == 0){
2592
if(interface[0] != '\0'){
2593
fprintf_plus(stderr, "Not using nonexisting interface"
2594
" \"%s\"\n", interface);
2596
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
2602
/* Run network hooks */
2604
if(mc.interfaces != NULL){
2605
interfaces_hooks = malloc(mc.interfaces_size);
2606
if(interfaces_hooks == NULL){
2607
perror_plus("malloc");
2610
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2611
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2613
run_network_hooks("start", interfaces_hooks != NULL ?
2614
interfaces_hooks : "", delay);
2618
avahi_set_log_function(empty_log);
2621
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
2622
from the signal handler */
2623
/* Initialize the pseudo-RNG for Avahi */
2624
srand((unsigned int) time(NULL));
2625
simple_poll = avahi_simple_poll_new();
2626
if(simple_poll == NULL){
2627
fprintf_plus(stderr,
2628
"Avahi: Failed to create simple poll object.\n");
2629
exitcode = EX_UNAVAILABLE;
2633
sigemptyset(&sigterm_action.sa_mask);
2634
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
2636
perror_plus("sigaddset");
2637
exitcode = EX_OSERR;
2640
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
2642
perror_plus("sigaddset");
2643
exitcode = EX_OSERR;
2646
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
2648
perror_plus("sigaddset");
2649
exitcode = EX_OSERR;
2652
/* Need to check if the handler is SIG_IGN before handling:
2653
| [[info:libc:Initial Signal Actions]] |
2654
| [[info:libc:Basic Signal Handling]] |
2656
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
2658
perror_plus("sigaction");
2661
if(old_sigterm_action.sa_handler != SIG_IGN){
2662
ret = sigaction(SIGINT, &sigterm_action, NULL);
2664
perror_plus("sigaction");
2665
exitcode = EX_OSERR;
2669
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
2671
perror_plus("sigaction");
2674
if(old_sigterm_action.sa_handler != SIG_IGN){
2675
ret = sigaction(SIGHUP, &sigterm_action, NULL);
2677
perror_plus("sigaction");
2678
exitcode = EX_OSERR;
2682
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
2684
perror_plus("sigaction");
2687
if(old_sigterm_action.sa_handler != SIG_IGN){
2688
ret = sigaction(SIGTERM, &sigterm_action, NULL);
2690
perror_plus("sigaction");
2691
exitcode = EX_OSERR;
2696
/* If no interfaces were specified, make a list */
2697
if(mc.interfaces == NULL){
2698
struct dirent **direntries = NULL;
2699
/* Look for any good interfaces */
2700
ret = scandir(sys_class_net, &direntries, good_interface,
2703
/* Add all found interfaces to interfaces list */
2704
for(int i = 0; i < ret; ++i){
2705
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2706
direntries[i]->d_name);
2709
perror_plus("argz_add");
2710
free(direntries[i]);
2714
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2715
direntries[i]->d_name);
2717
free(direntries[i]);
2724
fprintf_plus(stderr, "Could not find a network interface\n");
2725
exitcode = EXIT_FAILURE;
2730
/* Bring up interfaces which are down, and remove any "none"s */
2732
char *interface = NULL;
2733
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2735
/* If interface name is "none", stop bringing up interfaces.
2736
Also remove all instances of "none" from the list */
2737
if(strcmp(interface, "none") == 0){
2738
argz_delete(&mc.interfaces, &mc.interfaces_size,
2741
while((interface = argz_next(mc.interfaces,
2742
mc.interfaces_size, interface))){
2743
if(strcmp(interface, "none") == 0){
2744
argz_delete(&mc.interfaces, &mc.interfaces_size,
2751
bool interface_was_up = interface_is_up(interface);
2752
errno = bring_up_interface(interface, delay);
2753
if(not interface_was_up){
2755
fprintf_plus(stderr, "Failed to bring up interface \"%s\":"
2756
" %s\n", interface, strerror(errno));
2758
errno = argz_add(&interfaces_to_take_down,
2759
&interfaces_to_take_down_size,
2762
perror_plus("argz_add");
2767
if(debug and (interfaces_to_take_down == NULL)){
2768
fprintf_plus(stderr, "No interfaces were brought up\n");
2772
/* If we only got one interface, explicitly use only that one */
2773
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2775
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2778
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2785
ret = init_gnutls_global(pubkey, seckey, dh_params_file, &mc);
2787
fprintf_plus(stderr, "init_gnutls_global failed\n");
2788
exitcode = EX_UNAVAILABLE;
2791
gnutls_initialized = true;
2798
/* Try /run/tmp before /tmp */
2799
tempdir = mkdtemp(run_tempdir);
2800
if(tempdir == NULL and errno == ENOENT){
2802
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2803
run_tempdir, old_tempdir);
2805
tempdir = mkdtemp(old_tempdir);
2807
if(tempdir == NULL){
2808
perror_plus("mkdtemp");
2816
if(not init_gpgme(pubkey, seckey, tempdir, &mc)){
2817
fprintf_plus(stderr, "init_gpgme failed\n");
2818
exitcode = EX_UNAVAILABLE;
2821
gpgme_initialized = true;
2828
if(connect_to != NULL){
2829
/* Connect directly, do not use Zeroconf */
2830
/* (Mainly meant for debugging) */
2831
char *address = strrchr(connect_to, ':');
2833
if(address == NULL){
2834
fprintf_plus(stderr, "No colon in address\n");
2835
exitcode = EX_USAGE;
2845
tmpmax = strtoimax(address+1, &tmp, 10);
2846
if(errno != 0 or tmp == address+1 or *tmp != '\0'
2847
or tmpmax != (in_port_t)tmpmax){
2848
fprintf_plus(stderr, "Bad port number\n");
2849
exitcode = EX_USAGE;
2857
port = (in_port_t)tmpmax;
2859
/* Colon in address indicates IPv6 */
2861
if(strchr(connect_to, ':') != NULL){
2863
/* Accept [] around IPv6 address - see RFC 5952 */
2864
if(connect_to[0] == '[' and address[-1] == ']')
2872
address = connect_to;
2878
while(not quit_now){
2879
ret = start_mandos_communication(address, port, if_index, af,
2881
if(quit_now or ret == 0){
2885
fprintf_plus(stderr, "Retrying in %d seconds\n",
2886
(int)retry_interval);
2888
sleep((unsigned int)retry_interval);
2892
exitcode = EXIT_SUCCESS;
626
2903
AvahiServerConfig config;
627
AvahiSServiceBrowser *sb = NULL;
630
int returncode = EXIT_SUCCESS;
631
const char *interface = NULL;
632
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
633
char *connect_to = NULL;
636
static struct option long_options[] = {
637
{"debug", no_argument, (int *)&debug, 1},
638
{"connect", required_argument, 0, 'c'},
639
{"interface", required_argument, 0, 'i'},
642
int option_index = 0;
643
ret = getopt_long (argc, argv, "i:", long_options,
664
if(interface != NULL){
665
if_index = (AvahiIfIndex) if_nametoindex(interface);
667
fprintf(stderr, "No such interface: \"%s\"\n", interface);
672
if(connect_to != NULL){
673
/* Connect directly, do not use Zeroconf */
674
/* (Mainly meant for debugging) */
675
char *address = strrchr(connect_to, ':');
677
fprintf(stderr, "No colon in address\n");
681
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
683
perror("Bad port number");
687
address = connect_to;
688
ret = start_mandos_communication(address, port, if_index);
697
avahi_set_log_function(empty_log);
700
/* Initialize the psuedo-RNG */
701
srand((unsigned int) time(NULL));
703
/* Allocate main loop object */
704
if (!(simple_poll = avahi_simple_poll_new())) {
705
fprintf(stderr, "Failed to create simple poll object.\n");
710
/* Do not publish any local records */
2904
/* Do not publish any local Zeroconf records */
711
2905
avahi_server_config_init(&config);
712
2906
config.publish_hinfo = 0;
713
2907
config.publish_addresses = 0;
714
2908
config.publish_workstation = 0;
715
2909
config.publish_domain = 0;
717
2911
/* Allocate a new server */
718
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
719
&config, NULL, NULL, &error);
721
/* Free the configuration data */
2912
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2913
&config, NULL, NULL, &ret);
2915
/* Free the Avahi configuration data */
722
2916
avahi_server_config_free(&config);
724
/* Check if creating the server object succeeded */
726
fprintf(stderr, "Failed to create server: %s\n",
727
avahi_strerror(error));
728
returncode = EXIT_FAILURE;
732
/* Create the service browser */
733
sb = avahi_s_service_browser_new(server, if_index,
735
"_mandos._tcp", NULL, 0,
736
browse_callback, server);
738
fprintf(stderr, "Failed to create service browser: %s\n",
739
avahi_strerror(avahi_server_errno(server)));
740
returncode = EXIT_FAILURE;
744
/* Run the main loop */
747
fprintf(stderr, "Starting avahi loop search\n");
750
avahi_simple_poll_loop(simple_poll);
755
fprintf(stderr, "%s exiting\n", argv[0]);
760
avahi_s_service_browser_free(sb);
763
avahi_server_free(server);
766
avahi_simple_poll_free(simple_poll);
2919
/* Check if creating the Avahi server object succeeded */
2920
if(mc.server == NULL){
2921
fprintf_plus(stderr, "Failed to create Avahi server: %s\n",
2922
avahi_strerror(ret));
2923
exitcode = EX_UNAVAILABLE;
2931
/* Create the Avahi service browser */
2932
sb = avahi_s_service_browser_new(mc.server, if_index,
2933
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
2934
NULL, 0, browse_callback,
2937
fprintf_plus(stderr, "Failed to create service browser: %s\n",
2938
avahi_strerror(avahi_server_errno(mc.server)));
2939
exitcode = EX_UNAVAILABLE;
2947
/* Run the main loop */
2950
fprintf_plus(stderr, "Starting Avahi loop search\n");
2953
ret = avahi_loop_with_timeout(simple_poll,
2954
(int)(retry_interval * 1000), &mc);
2956
fprintf_plus(stderr, "avahi_loop_with_timeout exited %s\n",
2957
(ret == 0) ? "successfully" : "with error");
2963
if(signal_received){
2964
fprintf_plus(stderr, "%s exiting due to signal %d: %s\n",
2965
argv[0], signal_received,
2966
strsignal(signal_received));
2968
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2972
/* Cleanup things */
2973
free(mc.interfaces);
2976
avahi_s_service_browser_free(sb);
2978
if(mc.server != NULL)
2979
avahi_server_free(mc.server);
2981
if(simple_poll != NULL)
2982
avahi_simple_poll_free(simple_poll);
2984
if(gnutls_initialized){
2985
gnutls_certificate_free_credentials(mc.cred);
2986
gnutls_dh_params_deinit(mc.dh_params);
2989
if(gpgme_initialized){
2990
gpgme_release(mc.ctx);
2993
/* Cleans up the circular linked list of Mandos servers the client
2995
if(mc.current_server != NULL){
2996
mc.current_server->prev->next = NULL;
2997
while(mc.current_server != NULL){
2998
server *next = mc.current_server->next;
3000
#pragma GCC diagnostic push
3001
#pragma GCC diagnostic ignored "-Wcast-qual"
3003
free((char *)(mc.current_server->ip));
3005
#pragma GCC diagnostic pop
3007
free(mc.current_server);
3008
mc.current_server = next;
3012
/* Re-raise privileges */
3014
ret = raise_privileges();
3017
perror_plus("Failed to raise privileges");
3020
/* Run network hooks */
3021
run_network_hooks("stop", interfaces_hooks != NULL ?
3022
interfaces_hooks : "", delay);
3024
/* Take down the network interfaces which were brought up */
3026
char *interface = NULL;
3027
while((interface = argz_next(interfaces_to_take_down,
3028
interfaces_to_take_down_size,
3030
ret = take_down_interface(interface);
3033
perror_plus("Failed to take down interface");
3036
if(debug and (interfaces_to_take_down == NULL)){
3037
fprintf_plus(stderr, "No interfaces needed to be taken"
3043
ret = lower_privileges_permanently();
3046
perror_plus("Failed to lower privileges permanently");
3050
free(interfaces_to_take_down);
3051
free(interfaces_hooks);
3053
void clean_dir_at(int base, const char * const dirname,
3055
struct dirent **direntries = NULL;
3057
int dir_fd = (int)TEMP_FAILURE_RETRY(openat(base, dirname,
3063
perror_plus("open");
3065
int numentries = scandirat(dir_fd, ".", &direntries,
3066
notdotentries, alphasort);
3067
if(numentries >= 0){
3068
for(int i = 0; i < numentries; i++){
3070
fprintf_plus(stderr, "Unlinking \"%s/%s\"\n",
3071
dirname, direntries[i]->d_name);
3073
dret = unlinkat(dir_fd, direntries[i]->d_name, 0);
3075
if(errno == EISDIR){
3076
dret = unlinkat(dir_fd, direntries[i]->d_name,
3079
if((dret == -1) and (errno == ENOTEMPTY)
3080
and (strcmp(direntries[i]->d_name, "private-keys-v1.d")
3081
== 0) and (level == 0)){
3082
/* Recurse only in this special case */
3083
clean_dir_at(dir_fd, direntries[i]->d_name, level+1);
3087
fprintf_plus(stderr, "unlink(\"%s/%s\"): %s\n", dirname,
3088
direntries[i]->d_name, strerror(errno));
3091
free(direntries[i]);
3094
/* need to clean even if 0 because man page doesn't specify */
3096
if(numentries == -1){
3097
perror_plus("scandirat");
3099
dret = unlinkat(base, dirname, AT_REMOVEDIR);
3100
if(dret == -1 and errno != ENOENT){
3101
perror_plus("rmdir");
3104
perror_plus("scandirat");
3109
/* Removes the GPGME temp directory and all files inside */
3110
if(tempdir != NULL){
3111
clean_dir_at(-1, tempdir, 0);
3115
sigemptyset(&old_sigterm_action.sa_mask);
3116
old_sigterm_action.sa_handler = SIG_DFL;
3117
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
3118
&old_sigterm_action,
3121
perror_plus("sigaction");
3124
ret = raise(signal_received);
3125
} while(ret != 0 and errno == EINTR);
3127
perror_plus("raise");
3130
TEMP_FAILURE_RETRY(pause());