/mandos/release : revision 12

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to plugins.d/mandosclient.c

Committer: Teddy Hogeborn
Date: 2008-07-19 18:43:24 UTC
Revision ID: teddy@fukt.bsnet.se-20080719184324-iwhoa5in75xa0u2u

* mandos-clients.conf ([foo]/dn, [foo]/password, [braxen_client]/dn,
                       [braxen_client]/password): Removed.
  ([foo]/fingerprint, [braxen_client]/fingerprint): New.
  ([foo]/checker): New.
  ([foo]/secfile): New.
  ([braxen_client]/secret): New.

* server.py: New "--debug" option to set debug flag.  Removed "cert",
             "key", "ca", "crl", and "cred" variables.  Added default
             value for "checker" config file setting.  Do not pass
             credentials to IPv6_TCPServer constructor.
  (debug): New global debug flag.  Used by most debugging output code.
  (Client.__init__): Keyword argument "dn" replaced by "fingerprint",
                     "password" renamed to "secret", and "passfile"
                     renamed to "secfile".  New keyword argument
                     "checker". All callers changed.
  (Client.dn): Removed.
  (Client.fingerprint): New.
  (Client.password): Renamed to "secret"; all users changed.
  (Client.passfile): Renamed to "secfile"; all users changed.
  (Client.timeout, Client.interval): Changed to be properties; now
                                     automatically updates the
                                     "_timeout_milliseconds" and
                                     "_interval_milliseconds" values.
  (Client.timeout_milliseconds): Renamed to "_timeout_milliseconds".
  (Client.interval_milliseconds): Renamed to "_interval_milliseconds".
  (Client.check_command): New.
  (Client.start_checker): Use the new "check_command" attribute.
  (peer_certificate, fingerprint): New functions.

  (tcp_handler.handle): Use ClientSession with empty credentials
                        object instead of ServerSession.  Set gnutls
                        priority string.  Do not verify peer.  Use
                        fingerprint instead of DN when searching for
                        clients.  Bug fix: Loop sending data so even large
                        secret data strings are sent.
  (IPv6_TCPServer.credentials): Removed.
  (if_nametoindex): Do not import ctypes since that is now imported
                    globally.

files added:
client.cpp

files removed:
plugbasedclient.c

plugins.d

plugins.d/mandosclient.c

plugins.d/passprompt.c

server.conf

files renamed:
clients.conf => mandos-clients.conf

files modified:
Makefile

TODO

server.py

Show diffs side-by-side

added added

removed removed

plugins.d/mandosclient.c

/* -*- coding: utf-8 -*- */

* Mandos client - get and decrypt data from a Mandos server

* This program is partly derived from an example program for an Avahi

* service browser, downloaded from

* <http://avahi.org/browser/examples/core-browse-services.c>. This

* includes the following functions: "resolve_callback",

* "browse_callback", and parts of "main".

* Everything else is

* This program is free software: you can redistribute it and/or

* modify it under the terms of the GNU General Public License as

* published by the Free Software Foundation, either version 3 of the

* License, or (at your option) any later version.

* This program is distributed in the hope that it will be useful, but

* WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU

* General Public License for more details.

* You should have received a copy of the GNU General Public License

* along with this program. If not, see

* <http://www.gnu.org/licenses/>.

* Contact the authors at <mandos@fukt.bsnet.se>.

/* Needed by GPGME, specifically gpgme_data_seek() */

#define _LARGEFILE_SOURCE

#define _FILE_OFFSET_BITS 64

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */

#include <stdio.h>

#include <assert.h>

#include <stdlib.h>

#include <time.h>

#include <net/if.h> /* if_nametoindex */

#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

SIOCSIFFLAGS */

#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

SIOCSIFFLAGS */

#include <avahi-core/core.h>

#include <avahi-core/lookup.h>

#include <avahi-core/log.h>

#include <avahi-common/simple-watch.h>

#include <avahi-common/malloc.h>

#include <avahi-common/error.h>

/* Mandos client part */

#include <sys/types.h> /* socket(), inet_pton() */

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

struct in6_addr, inet_pton() */

#include <gnutls/gnutls.h> /* All GnuTLS stuff */

#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */

#include <unistd.h> /* close() */

#include <netinet/in.h>

#include <stdbool.h> /* true */

#include <string.h> /* memset */

#include <arpa/inet.h> /* inet_pton() */

#include <iso646.h> /* not */

#include <net/if.h> /* IF_NAMESIZE */

/* GPGME */

#include <errno.h> /* perror() */

#include <gpgme.h>

/* getopt_long */

#include <getopt.h>

#define BUFFER_SIZE 256

static const char *keydir = "/conf/conf.d/mandos";

static const char *pubkeyfile = "pubkey.txt";

static const char *seckeyfile = "seckey.txt";

bool debug = false;

const char mandos_protocol_version[] = "1";

/* Used for passing in values through all the callback functions */

typedef struct {

AvahiSimplePoll *simple_poll;

AvahiServer *server;

gnutls_certificate_credentials_t cred;

unsigned int dh_bits;

gnutls_dh_params_t dh_params;

const char *priority;

} mandos_context;

size_t adjustbuffer(char **buffer, size_t buffer_length,

size_t buffer_capacity){

if (buffer_length + BUFFER_SIZE > buffer_capacity){

*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

100

if (buffer == NULL){

101

return 0;

102

}

103

buffer_capacity += BUFFER_SIZE;

104

}

105

return buffer_capacity;

106

}

107

108

109

* Decrypt OpenPGP data using keyrings in HOMEDIR.

110

* Returns -1 on error

111

112

static ssize_t pgp_packet_decrypt (const char *cryptotext,

113

size_t crypto_size,

114

char **plaintext,

115

const char *homedir){

116

gpgme_data_t dh_crypto, dh_plain;

117

gpgme_ctx_t ctx;

118

gpgme_error_t rc;

119

ssize_t ret;

120

size_t plaintext_capacity = 0;

121

ssize_t plaintext_length = 0;

122

gpgme_engine_info_t engine_info;

123

124

if (debug){

125

fprintf(stderr, "Trying to decrypt OpenPGP data\n");

126

}

127

128

/* Init GPGME */

129

gpgme_check_version(NULL);

130

rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);

131

if (rc != GPG_ERR_NO_ERROR){

132

fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",

133

gpgme_strsource(rc), gpgme_strerror(rc));

134

return -1;

135

}

136

137

/* Set GPGME home directory for the OpenPGP engine only */

138

rc = gpgme_get_engine_info (&engine_info);

139

if (rc != GPG_ERR_NO_ERROR){

140

fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",

141

gpgme_strsource(rc), gpgme_strerror(rc));

142

return -1;

143

}

144

while(engine_info != NULL){

145

if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){

146

gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,

147

engine_info->file_name, homedir);

148

break;

149

}

150

engine_info = engine_info->next;

151

}

152

if(engine_info == NULL){

153

fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);

154

return -1;

155

}

156

157

/* Create new GPGME data buffer from memory cryptotext */

158

rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,

159

0);

160

if (rc != GPG_ERR_NO_ERROR){

161

fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",

162

gpgme_strsource(rc), gpgme_strerror(rc));

163

return -1;

164

}

165

166

/* Create new empty GPGME data buffer for the plaintext */

167

rc = gpgme_data_new(&dh_plain);

168

if (rc != GPG_ERR_NO_ERROR){

169

fprintf(stderr, "bad gpgme_data_new: %s: %s\n",

170

gpgme_strsource(rc), gpgme_strerror(rc));

171

gpgme_data_release(dh_crypto);

172

return -1;

173

}

174

175

/* Create new GPGME "context" */

176

rc = gpgme_new(&ctx);

177

if (rc != GPG_ERR_NO_ERROR){

178

fprintf(stderr, "bad gpgme_new: %s: %s\n",

179

gpgme_strsource(rc), gpgme_strerror(rc));

180

plaintext_length = -1;

181

goto decrypt_end;

182

}

183

184

/* Decrypt data from the cryptotext data buffer to the plaintext

185

data buffer */

186

rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);

187

if (rc != GPG_ERR_NO_ERROR){

188

fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",

189

gpgme_strsource(rc), gpgme_strerror(rc));

190

plaintext_length = -1;

191

goto decrypt_end;

192

}

193

194

if(debug){

195

fprintf(stderr, "Decryption of OpenPGP data succeeded\n");

196

}

197

198

if (debug){

199

gpgme_decrypt_result_t result;

200

result = gpgme_op_decrypt_result(ctx);

201

if (result == NULL){

202

fprintf(stderr, "gpgme_op_decrypt_result failed\n");

203

} else {

204

fprintf(stderr, "Unsupported algorithm: %s\n",

205

result->unsupported_algorithm);

206

fprintf(stderr, "Wrong key usage: %d\n",

207

result->wrong_key_usage);

208

if(result->file_name != NULL){

209

fprintf(stderr, "File name: %s\n", result->file_name);

210

}

211

gpgme_recipient_t recipient;

212

recipient = result->recipients;

213

if(recipient){

214

while(recipient != NULL){

215

fprintf(stderr, "Public key algorithm: %s\n",

216

gpgme_pubkey_algo_name(recipient->pubkey_algo));

217

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

218

fprintf(stderr, "Secret key available: %s\n",

219

recipient->status == GPG_ERR_NO_SECKEY

220

? "No" : "Yes");

221

recipient = recipient->next;

222

}

223

}

224

}

225

}

226

227

/* Seek back to the beginning of the GPGME plaintext data buffer */

228

if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){

229

perror("pgpme_data_seek");

230

plaintext_length = -1;

231

goto decrypt_end;

232

}

233

234

*plaintext = NULL;

235

while(true){

236

plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,

237

plaintext_capacity);

238

if (plaintext_capacity == 0){

239

perror("adjustbuffer");

240

plaintext_length = -1;

241

goto decrypt_end;

242

}

243

244

ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,

245

BUFFER_SIZE);

246

/* Print the data, if any */

247

if (ret == 0){

248

/* EOF */

249

break;

250

}

251

if(ret < 0){

252

perror("gpgme_data_read");

253

plaintext_length = -1;

254

goto decrypt_end;

255

}

256

plaintext_length += ret;

257

}

258

259

if(debug){

260

fprintf(stderr, "Decrypted password is: ");

261

for(ssize_t i = 0; i < plaintext_length; i++){

262

fprintf(stderr, "%02hhX ", (*plaintext)[i]);

263

}

264

fprintf(stderr, "\n");

265

}

266

267

decrypt_end:

268

269

/* Delete the GPGME cryptotext data buffer */

270

gpgme_data_release(dh_crypto);

271

272

/* Delete the GPGME plaintext data buffer */

273

gpgme_data_release(dh_plain);

274

return plaintext_length;

275

}

276

277

static const char * safer_gnutls_strerror (int value) {

278

const char *ret = gnutls_strerror (value);

279

if (ret == NULL)

280

ret = "(unknown)";

281

return ret;

282

}

283

284

/* GnuTLS log function callback */

285

static void debuggnutls(__attribute__((unused)) int level,

286

const char* string){

287

fprintf(stderr, "GnuTLS: %s", string);

288

}

289

290

static int init_gnutls_global(mandos_context *mc){

291

int ret;

292

293

if(debug){

294

fprintf(stderr, "Initializing GnuTLS\n");

295

}

296

297

if ((ret = gnutls_global_init ())

298

!= GNUTLS_E_SUCCESS) {

299

fprintf (stderr, "GnuTLS global_init: %s\n",

300

safer_gnutls_strerror(ret));

301

return -1;

302

}

303

304

if (debug){

305

/* "Use a log level over 10 to enable all debugging options."

306

* - GnuTLS manual

307

308

gnutls_global_set_log_level(11);

309

gnutls_global_set_log_function(debuggnutls);

310

}

311

312

/* OpenPGP credentials */

313

if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))

314

!= GNUTLS_E_SUCCESS) {

315

fprintf (stderr, "GnuTLS memory error: %s\n",

316

safer_gnutls_strerror(ret));

317

return -1;

318

}

319

320

if(debug){

321

fprintf(stderr, "Attempting to use OpenPGP certificate %s"

322

" and keyfile %s as GnuTLS credentials\n", pubkeyfile,

323

seckeyfile);

324

}

325

326

ret = gnutls_certificate_set_openpgp_key_file

327

(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);

328

if (ret != GNUTLS_E_SUCCESS) {

329

fprintf(stderr,

330

"Error[%d] while reading the OpenPGP key pair ('%s',"

331

" '%s')\n", ret, pubkeyfile, seckeyfile);

332

fprintf(stdout, "The GnuTLS error is: %s\n",

333

safer_gnutls_strerror(ret));

334

return -1;

335

}

336

337

/* GnuTLS server initialization */

338

ret = gnutls_dh_params_init(&mc->dh_params);

339

if (ret != GNUTLS_E_SUCCESS) {

340

fprintf (stderr, "Error in GnuTLS DH parameter initialization:"

341

" %s\n", safer_gnutls_strerror(ret));

342

return -1;

343

}

344

ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);

345

if (ret != GNUTLS_E_SUCCESS) {

346

fprintf (stderr, "Error in GnuTLS prime generation: %s\n",

347

safer_gnutls_strerror(ret));

348

return -1;

349

}

350

351

gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);

352

353

return 0;

354

}

355

356

static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){

357

int ret;

358

/* GnuTLS session creation */

359

ret = gnutls_init(session, GNUTLS_SERVER);

360

if (ret != GNUTLS_E_SUCCESS){

361

fprintf(stderr, "Error in GnuTLS session initialization: %s\n",

362

safer_gnutls_strerror(ret));

363

}

364

365

{

366

const char *err;

367

ret = gnutls_priority_set_direct(*session, mc->priority, &err);

368

if (ret != GNUTLS_E_SUCCESS) {

369

fprintf(stderr, "Syntax error at: %s\n", err);

370

fprintf(stderr, "GnuTLS error: %s\n",

371

safer_gnutls_strerror(ret));

372

return -1;

373

}

374

}

375

376

ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,

377

mc->cred);

378

if (ret != GNUTLS_E_SUCCESS) {

379

fprintf(stderr, "Error setting GnuTLS credentials: %s\n",

380

safer_gnutls_strerror(ret));

381

return -1;

382

}

383

384

/* ignore client certificate if any. */

385

gnutls_certificate_server_set_request (*session,

386

GNUTLS_CERT_IGNORE);

387

388

gnutls_dh_set_prime_bits (*session, mc->dh_bits);

389

390

return 0;

391

}

392

393

/* Avahi log function callback */

394

static void empty_log(__attribute__((unused)) AvahiLogLevel level,

395

__attribute__((unused)) const char *txt){}

396

397

/* Called when a Mandos server is found */

398

static int start_mandos_communication(const char *ip, uint16_t port,

399

AvahiIfIndex if_index,

400

mandos_context *mc){

401

int ret, tcp_sd;

402

struct sockaddr_in6 to;

403

char *buffer = NULL;

404

char *decrypted_buffer;

405

size_t buffer_length = 0;

406

size_t buffer_capacity = 0;

407

ssize_t decrypted_buffer_size;

408

size_t written;

409

int retval = 0;

410

char interface[IF_NAMESIZE];

411

gnutls_session_t session;

412

gnutls_dh_params_t dh_params;

413

414

ret = init_gnutls_session (mc, &session);

415

if (ret != 0){

416

return -1;

417

}

418

419

if(debug){

420

fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",

421

ip, port);

422

}

423

424

tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);

425

if(tcp_sd < 0) {

426

perror("socket");

427

return -1;

428

}

429

430

if(debug){

431

if(if_indextoname((unsigned int)if_index, interface) == NULL){

432

perror("if_indextoname");

433

return -1;

434

}

435

fprintf(stderr, "Binding to interface %s\n", interface);

436

}

437

438

memset(&to,0,sizeof(to)); /* Spurious warning */

439

to.sin6_family = AF_INET6;

440

/* It would be nice to have a way to detect if we were passed an

441

IPv4 address here. Now we assume an IPv6 address. */

442

ret = inet_pton(AF_INET6, ip, &to.sin6_addr);

443

if (ret < 0 ){

444

perror("inet_pton");

445

return -1;

446

}

447

if(ret == 0){

448

fprintf(stderr, "Bad address: %s\n", ip);

449

return -1;

450

}

451

to.sin6_port = htons(port); /* Spurious warning */

452

453

to.sin6_scope_id = (uint32_t)if_index;

454

455

if(debug){

456

fprintf(stderr, "Connection to: %s, port %d\n", ip, port);

457

char addrstr[INET6_ADDRSTRLEN] = "";

458

if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,

459

sizeof(addrstr)) == NULL){

460

perror("inet_ntop");

461

} else {

462

if(strcmp(addrstr, ip) != 0){

463

fprintf(stderr, "Canonical address form: %s\n", addrstr);

464

}

465

}

466

}

467

468

ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));

469

if (ret < 0){

470

perror("connect");

471

return -1;

472

}

473

474

const char *out = mandos_protocol_version;

475

written = 0;

476

while (true){

477

size_t out_size = strlen(out);

478

ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,

479

out_size - written));

480

if (ret == -1){

481

perror("write");

482

retval = -1;

483

goto mandos_end;

484

}

485

written += (size_t)ret;

486

if(written < out_size){

487

continue;

488

} else {

489

if (out == mandos_protocol_version){

490

written = 0;

491

out = "\r\n";

492

} else {

493

break;

494

}

495

}

496

}

497

498

if(debug){

499

fprintf(stderr, "Establishing TLS session with %s\n", ip);

500

}

501

502

gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);

503

504

ret = gnutls_handshake (session);

505

506

if (ret != GNUTLS_E_SUCCESS){

507

if(debug){

508

fprintf(stderr, "*** GnuTLS Handshake failed ***\n");

509

gnutls_perror (ret);

510

}

511

retval = -1;

512

goto mandos_end;

513

}

514

515

/* Read OpenPGP packet that contains the wanted password */

516

517

if(debug){

518

fprintf(stderr, "Retrieving pgp encrypted password from %s\n",

519

ip);

520

}

521

522

while(true){

523

buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);

524

if (buffer_capacity == 0){

525

perror("adjustbuffer");

526

retval = -1;

527

goto mandos_end;

528

}

529

530

ret = gnutls_record_recv(session, buffer+buffer_length,

531

BUFFER_SIZE);

532

if (ret == 0){

533

break;

534

}

535

if (ret < 0){

536

switch(ret){

537

case GNUTLS_E_INTERRUPTED:

538

case GNUTLS_E_AGAIN:

539

break;

540

case GNUTLS_E_REHANDSHAKE:

541

ret = gnutls_handshake (session);

542

if (ret < 0){

543

fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");

544

gnutls_perror (ret);

545

retval = -1;

546

goto mandos_end;

547

}

548

break;

549

default:

550

fprintf(stderr, "Unknown error while reading data from"

551

" encrypted session with Mandos server\n");

552

retval = -1;

553

gnutls_bye (session, GNUTLS_SHUT_RDWR);

554

goto mandos_end;

555

}

556

} else {

557

buffer_length += (size_t) ret;

558

}

559

}

560

561

if(debug){

562

fprintf(stderr, "Closing TLS session\n");

563

}

564

565

gnutls_bye (session, GNUTLS_SHUT_RDWR);

566

567

if (buffer_length > 0){

568

decrypted_buffer_size = pgp_packet_decrypt(buffer,

569

buffer_length,

570

&decrypted_buffer,

571

keydir);

572

if (decrypted_buffer_size >= 0){

573

written = 0;

574

while(written < (size_t) decrypted_buffer_size){

575

ret = (int)fwrite (decrypted_buffer + written, 1,

576

(size_t)decrypted_buffer_size - written,

577

stdout);

578

if(ret == 0 and ferror(stdout)){

579

if(debug){

580

fprintf(stderr, "Error writing encrypted data: %s\n",

581

strerror(errno));

582

}

583

retval = -1;

584

break;

585

}

586

written += (size_t)ret;

587

}

588

free(decrypted_buffer);

589

} else {

590

retval = -1;

591

}

592

}

593

594

/* Shutdown procedure */

595

596

mandos_end:

597

free(buffer);

598

close(tcp_sd);

599

gnutls_deinit (session);

600

gnutls_certificate_free_credentials (mc->cred);

601

gnutls_global_deinit ();

602

return retval;

603

}

604

605

static void resolve_callback(AvahiSServiceResolver *r,

606

AvahiIfIndex interface,

607

AVAHI_GCC_UNUSED AvahiProtocol protocol,

608

AvahiResolverEvent event,

609

const char *name,

610

const char *type,

611

const char *domain,

612

const char *host_name,

613

const AvahiAddress *address,

614

uint16_t port,

615

AVAHI_GCC_UNUSED AvahiStringList *txt,

616

AVAHI_GCC_UNUSED AvahiLookupResultFlags

617

flags,

618

void* userdata) {

619

mandos_context *mc = userdata;

620

assert(r); /* Spurious warning */

621

622

/* Called whenever a service has been resolved successfully or

623

timed out */

624

625

switch (event) {

626

default:

627

case AVAHI_RESOLVER_FAILURE:

628

fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"

629

" of type '%s' in domain '%s': %s\n", name, type, domain,

630

avahi_strerror(avahi_server_errno(mc->server)));

631

break;

632

633

case AVAHI_RESOLVER_FOUND:

634

{

635

char ip[AVAHI_ADDRESS_STR_MAX];

636

avahi_address_snprint(ip, sizeof(ip), address);

637

if(debug){

638

fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"

639

" port %d\n", name, host_name, ip, interface, port);

640

}

641

int ret = start_mandos_communication(ip, port, interface, mc);

642

if (ret == 0){

643

exit(EXIT_SUCCESS);

644

}

645

}

646

}

647

avahi_s_service_resolver_free(r);

648

}

649

650

static void browse_callback( AvahiSServiceBrowser *b,

651

AvahiIfIndex interface,

652

AvahiProtocol protocol,

653

AvahiBrowserEvent event,

654

const char *name,

655

const char *type,

656

const char *domain,

657

AVAHI_GCC_UNUSED AvahiLookupResultFlags

658

flags,

659

void* userdata) {

660

mandos_context *mc = userdata;

661

assert(b); /* Spurious warning */

662

663

/* Called whenever a new services becomes available on the LAN or

664

is removed from the LAN */

665

666

switch (event) {

667

default:

668

case AVAHI_BROWSER_FAILURE:

669

670

fprintf(stderr, "(Avahi browser) %s\n",

671

avahi_strerror(avahi_server_errno(mc->server)));

672

avahi_simple_poll_quit(mc->simple_poll);

673

return;

674

675

case AVAHI_BROWSER_NEW:

676

/* We ignore the returned Avahi resolver object. In the callback

677

function we free it. If the Avahi server is terminated before

678

the callback function is called the Avahi server will free the

679

resolver for us. */

680

681

if (!(avahi_s_service_resolver_new(mc->server, interface,

682

protocol, name, type, domain,

683

AVAHI_PROTO_INET6, 0,

684

resolve_callback, mc)))

685

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

686

name, avahi_strerror(avahi_server_errno(mc->server)));

687

break;

688

689

case AVAHI_BROWSER_REMOVE:

690

break;

691

692

case AVAHI_BROWSER_ALL_FOR_NOW:

693

case AVAHI_BROWSER_CACHE_EXHAUSTED:

694

if(debug){

695

fprintf(stderr, "No Mandos server found, still searching...\n");

696

}

697

break;

698

}

699

}

700

701

/* Combines file name and path and returns the malloced new

702

string. some sane checks could/should be added */

703

static const char *combinepath(const char *first, const char *second){

704

size_t f_len = strlen(first);

705

size_t s_len = strlen(second);

706

char *tmp = malloc(f_len + s_len + 2);

707

if (tmp == NULL){

708

return NULL;

709

}

710

if(f_len > 0){

711

memcpy(tmp, first, f_len); /* Spurious warning */

712

}

713

tmp[f_len] = '/';

714

if(s_len > 0){

715

memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */

716

}

717

tmp[f_len + 1 + s_len] = '\0';

718

return tmp;

719

}

720

721

722

int main(int argc, char *argv[]){

723

AvahiSServiceBrowser *sb = NULL;

724

int error;

725

int ret;

726

int exitcode = EXIT_SUCCESS;

727

const char *interface = "eth0";

728

struct ifreq network;

729

int sd;

730

uid_t uid;

731

gid_t gid;

732

char *connect_to = NULL;

733

AvahiIfIndex if_index = AVAHI_IF_UNSPEC;

734

mandos_context mc = { .simple_poll = NULL, .server = NULL,

735

.dh_bits = 1024, .priority = "SECURE256"};

736

737

{

738

/* Temporary int to get the address of for getopt_long */

739

int debug_int = debug ? 1 : 0;

740

while (true){

741

struct option long_options[] = {

742

{"debug", no_argument, &debug_int, 1},

743

{"connect", required_argument, NULL, 'c'},

744

{"interface", required_argument, NULL, 'i'},

745

{"keydir", required_argument, NULL, 'd'},

746

{"seckey", required_argument, NULL, 's'},

747

{"pubkey", required_argument, NULL, 'p'},

748

{"dh-bits", required_argument, NULL, 'D'},

749

{"priority", required_argument, NULL, 'P'},

750

{0, 0, 0, 0} };

751

752

int option_index = 0;

753

ret = getopt_long (argc, argv, "i:", long_options,

754

&option_index);

755

756

if (ret == -1){

757

break;

758

}

759

760

switch(ret){

761

case 0:

762

break;

763

case 'i':

764

interface = optarg;

765

break;

766

case 'c':

767

connect_to = optarg;

768

break;

769

case 'd':

770

keydir = optarg;

771

break;

772

case 'p':

773

pubkeyfile = optarg;

774

break;

775

case 's':

776

seckeyfile = optarg;

777

break;

778

case 'D':

779

errno = 0;

780

mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);

781

if (errno){

782

perror("strtol");

783

exit(EXIT_FAILURE);

784

}

785

break;

786

case 'P':

787

mc.priority = optarg;

788

break;

789

case '?':

790

default:

791

/* getopt_long() has already printed a message about the

792

unrcognized option, so just exit. */

793

exit(EXIT_FAILURE);

794

}

795

}

796

/* Set the global debug flag from the temporary int */

797

debug = debug_int ? true : false;

798

}

799

800

pubkeyfile = combinepath(keydir, pubkeyfile);

801

if (pubkeyfile == NULL){

802

perror("combinepath");

803

exitcode = EXIT_FAILURE;

804

goto end;

805

}

806

807

seckeyfile = combinepath(keydir, seckeyfile);

808

if (seckeyfile == NULL){

809

perror("combinepath");

810

goto end;

811

}

812

813

ret = init_gnutls_global(&mc);

814

if (ret == -1){

815

fprintf(stderr, "init_gnutls_global\n");

816

goto end;

817

}

818

819

uid = getuid();

820

gid = getgid();

821

822

ret = setuid(uid);

823

if (ret == -1){

824

perror("setuid");

825

}

826

827

setgid(gid);

828

if (ret == -1){

829

perror("setgid");

830

}

831

832

if_index = (AvahiIfIndex) if_nametoindex(interface);

833

if(if_index == 0){

834

fprintf(stderr, "No such interface: \"%s\"\n", interface);

835

exit(EXIT_FAILURE);

836

}

837

838

if(connect_to != NULL){

839

/* Connect directly, do not use Zeroconf */

840

/* (Mainly meant for debugging) */

841

char *address = strrchr(connect_to, ':');

842

if(address == NULL){

843

fprintf(stderr, "No colon in address\n");

844

exitcode = EXIT_FAILURE;

845

goto end;

846

}

847

errno = 0;

848

uint16_t port = (uint16_t) strtol(address+1, NULL, 10);

849

if(errno){

850

perror("Bad port number");

851

exitcode = EXIT_FAILURE;

852

goto end;

853

}

854

*address = '\0';

855

address = connect_to;

856

ret = start_mandos_communication(address, port, if_index, &mc);

857

if(ret < 0){

858

exitcode = EXIT_FAILURE;

859

} else {

860

exitcode = EXIT_SUCCESS;

861

}

862

goto end;

863

}

864

865

/* If the interface is down, bring it up */

866

{

867

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

868

if(sd < 0) {

869

perror("socket");

870

exitcode = EXIT_FAILURE;

871

goto end;

872

}

873

strcpy(network.ifr_name, interface); /* Spurious warning */

874

ret = ioctl(sd, SIOCGIFFLAGS, &network);

875

if(ret == -1){

876

perror("ioctl SIOCGIFFLAGS");

877

exitcode = EXIT_FAILURE;

878

goto end;

879

}

880

if((network.ifr_flags & IFF_UP) == 0){

881

network.ifr_flags |= IFF_UP;

882

ret = ioctl(sd, SIOCSIFFLAGS, &network);

883

if(ret == -1){

884

perror("ioctl SIOCSIFFLAGS");

885

exitcode = EXIT_FAILURE;

886

goto end;

887

}

888

}

889

close(sd);

890

}

891

892

if (not debug){

893

avahi_set_log_function(empty_log);

894

}

895

896

/* Initialize the pseudo-RNG for Avahi */

897

srand((unsigned int) time(NULL));

898

899

/* Allocate main Avahi loop object */

900

mc.simple_poll = avahi_simple_poll_new();

901

if (mc.simple_poll == NULL) {

902

fprintf(stderr, "Avahi: Failed to create simple poll"

903

" object.\n");

904

exitcode = EXIT_FAILURE;

905

goto end;

906

}

907

908

{

909

AvahiServerConfig config;

910

/* Do not publish any local Zeroconf records */

911

avahi_server_config_init(&config);

912

config.publish_hinfo = 0;

913

config.publish_addresses = 0;

914

config.publish_workstation = 0;

915

config.publish_domain = 0;

916

917

/* Allocate a new server */

918

mc.server = avahi_server_new(avahi_simple_poll_get

919

(mc.simple_poll), &config, NULL,

920

NULL, &error);

921

922

/* Free the Avahi configuration data */

923

avahi_server_config_free(&config);

924

}

925

926

/* Check if creating the Avahi server object succeeded */

927

if (mc.server == NULL) {

928

fprintf(stderr, "Failed to create Avahi server: %s\n",

929

avahi_strerror(error));

930

exitcode = EXIT_FAILURE;

931

goto end;

932

}

933

934

/* Create the Avahi service browser */

935

sb = avahi_s_service_browser_new(mc.server, if_index,

936

AVAHI_PROTO_INET6,

937

"_mandos._tcp", NULL, 0,

938

browse_callback, &mc);

939

if (sb == NULL) {

940

fprintf(stderr, "Failed to create service browser: %s\n",

941

avahi_strerror(avahi_server_errno(mc.server)));

942

exitcode = EXIT_FAILURE;

943

goto end;

944

}

945

946

/* Run the main loop */

947

948

if (debug){

949

fprintf(stderr, "Starting Avahi loop search\n");

950

}

951

952

avahi_simple_poll_loop(mc.simple_poll);

953

954

end:

955

956

if (debug){

957

fprintf(stderr, "%s exiting\n", argv[0]);

958

}

959

960

/* Cleanup things */

961

if (sb != NULL)

962

avahi_s_service_browser_free(sb);

963

964

if (mc.server != NULL)

965

avahi_server_free(mc.server);

966

967

if (mc.simple_poll != NULL)

968

avahi_simple_poll_free(mc.simple_poll);

969

free(pubkeyfile);

970

free(seckeyfile);

971

972

return exitcode;

973

}

Older »