25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
32
31
/* Needed by GPGME, specifically gpgme_data_seek() */
33
32
#define _LARGEFILE_SOURCE
34
33
#define _FILE_OFFSET_BITS 64
40
#include <net/if.h> /* if_nametoindex */
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), asprintf(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
sockaddr_in6, PF_INET6,
49
SOCK_STREAM, INET6_ADDRSTRLEN,
51
#include <inttypes.h> /* PRIu16 */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton(),
55
#include <assert.h> /* assert() */
56
#include <errno.h> /* perror(), errno */
57
#include <time.h> /* time() */
58
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
59
SIOCSIFFLAGS, if_indextoname(),
60
if_nametoindex(), IF_NAMESIZE */
61
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
62
getuid(), getgid(), setuid(),
64
#include <netinet/in.h>
65
#include <arpa/inet.h> /* inet_pton(), htons */
66
#include <iso646.h> /* not, and */
67
#include <argp.h> /* struct argp_option, error_t, struct
68
argp_state, struct argp,
69
argp_parse(), ARGP_KEY_ARG,
70
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
73
/* All Avahi types, constants and functions
42
76
#include <avahi-core/core.h>
43
77
#include <avahi-core/lookup.h>
44
78
#include <avahi-core/log.h>
46
80
#include <avahi-common/malloc.h>
47
81
#include <avahi-common/error.h>
50
#include <sys/types.h> /* socket(), inet_pton() */
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
52
struct in6_addr, inet_pton() */
53
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
54
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
#include <unistd.h> /* close() */
57
#include <netinet/in.h>
58
#include <stdbool.h> /* true */
59
#include <string.h> /* memset */
60
#include <arpa/inet.h> /* inet_pton() */
61
#include <iso646.h> /* not */
64
#include <errno.h> /* perror() */
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
84
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
87
init_gnutls_session(),
89
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
90
GNUTLS_OPENPGP_FMT_BASE64 */
93
#include <gpgme.h> /* All GPGME types, constants and
96
GPGME_PROTOCOL_OpenPGP,
75
99
#define BUFFER_SIZE 256
78
101
bool debug = false;
102
static const char *keydir = "/conf/conf.d/mandos";
103
static const char mandos_protocol_version[] = "1";
104
const char *argp_program_version = "password-request 1.0";
105
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
107
/* Used for passing in values through the Avahi callback functions */
81
gnutls_session_t session;
109
AvahiSimplePoll *simple_poll;
82
111
gnutls_certificate_credentials_t cred;
112
unsigned int dh_bits;
83
113
gnutls_dh_params_t dh_params;
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
114
const char *priority;
118
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
119
* "buffer_capacity" is how much is currently allocated,
120
* "buffer_length" is how much is already used.
122
size_t adjustbuffer(char **buffer, size_t buffer_length,
123
size_t buffer_capacity){
124
if (buffer_length + BUFFER_SIZE > buffer_capacity){
125
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
129
buffer_capacity += BUFFER_SIZE;
131
return buffer_capacity;
135
* Decrypt OpenPGP data using keyrings in HOMEDIR.
136
* Returns -1 on error
138
static ssize_t pgp_packet_decrypt (const char *cryptotext,
141
const char *homedir){
89
142
gpgme_data_t dh_crypto, dh_plain;
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
146
size_t plaintext_capacity = 0;
147
ssize_t plaintext_length = 0;
95
148
gpgme_engine_info_t engine_info;
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
151
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
102
155
gpgme_check_version(NULL);
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
156
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
157
if (rc != GPG_ERR_NO_ERROR){
158
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
159
gpgme_strsource(rc), gpgme_strerror(rc));
105
/* Set GPGME home directory */
163
/* Set GPGME home directory for the OpenPGP engine only */
106
164
rc = gpgme_get_engine_info (&engine_info);
107
165
if (rc != GPG_ERR_NO_ERROR){
108
166
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
143
203
if (rc != GPG_ERR_NO_ERROR){
144
204
fprintf(stderr, "bad gpgme_new: %s: %s\n",
145
205
gpgme_strsource(rc), gpgme_strerror(rc));
206
plaintext_length = -1;
149
/* Decrypt data from the FILE pointer to the plaintext data
210
/* Decrypt data from the cryptotext data buffer to the plaintext
151
212
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
152
213
if (rc != GPG_ERR_NO_ERROR){
153
214
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
154
215
gpgme_strsource(rc), gpgme_strerror(rc));
216
plaintext_length = -1;
218
gpgme_decrypt_result_t result;
219
result = gpgme_op_decrypt_result(ctx);
221
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
223
fprintf(stderr, "Unsupported algorithm: %s\n",
224
result->unsupported_algorithm);
225
fprintf(stderr, "Wrong key usage: %u\n",
226
result->wrong_key_usage);
227
if(result->file_name != NULL){
228
fprintf(stderr, "File name: %s\n", result->file_name);
230
gpgme_recipient_t recipient;
231
recipient = result->recipients;
233
while(recipient != NULL){
234
fprintf(stderr, "Public key algorithm: %s\n",
235
gpgme_pubkey_algo_name(recipient->pubkey_algo));
236
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
237
fprintf(stderr, "Secret key available: %s\n",
238
recipient->status == GPG_ERR_NO_SECKEY
240
recipient = recipient->next;
159
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
163
gpgme_decrypt_result_t result;
164
result = gpgme_op_decrypt_result(ctx);
166
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
168
fprintf(stderr, "Unsupported algorithm: %s\n",
169
result->unsupported_algorithm);
170
fprintf(stderr, "Wrong key usage: %d\n",
171
result->wrong_key_usage);
172
if(result->file_name != NULL){
173
fprintf(stderr, "File name: %s\n", result->file_name);
175
gpgme_recipient_t recipient;
176
recipient = result->recipients;
178
while(recipient != NULL){
179
fprintf(stderr, "Public key algorithm: %s\n",
180
gpgme_pubkey_algo_name(recipient->pubkey_algo));
181
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
182
fprintf(stderr, "Secret key available: %s\n",
183
recipient->status == GPG_ERR_NO_SECKEY
185
recipient = recipient->next;
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
249
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
194
252
/* Seek back to the beginning of the GPGME plaintext data buffer */
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
253
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
254
perror("pgpme_data_seek");
255
plaintext_length = -1;
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
203
if (*new_packet == NULL){
207
new_packet_capacity += BUFFER_SIZE;
261
plaintext_capacity = adjustbuffer(plaintext,
262
(size_t)plaintext_length,
264
if (plaintext_capacity == 0){
265
perror("adjustbuffer");
266
plaintext_length = -1;
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
270
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
212
272
/* Print the data, if any */
217
278
perror("gpgme_data_read");
220
new_packet_length += ret;
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
279
plaintext_length = -1;
282
plaintext_length += ret;
286
fprintf(stderr, "Decrypted password is: ");
287
for(ssize_t i = 0; i < plaintext_length; i++){
288
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
290
fprintf(stderr, "\n");
295
/* Delete the GPGME cryptotext data buffer */
296
gpgme_data_release(dh_crypto);
231
298
/* Delete the GPGME plaintext data buffer */
232
299
gpgme_data_release(dh_plain);
233
return new_packet_length;
300
return plaintext_length;
236
303
static const char * safer_gnutls_strerror (int value) {
237
const char *ret = gnutls_strerror (value);
304
const char *ret = gnutls_strerror (value); /* Spurious warning */
239
306
ret = "(unknown)";
243
void debuggnutls(__attribute__((unused)) int level,
245
fprintf(stderr, "%s", string);
310
/* GnuTLS log function callback */
311
static void debuggnutls(__attribute__((unused)) int level,
313
fprintf(stderr, "GnuTLS: %s", string);
248
int initgnutls(encrypted_session *es){
316
static int init_gnutls_global(mandos_context *mc,
317
const char *pubkeyfilename,
318
const char *seckeyfilename){
253
322
fprintf(stderr, "Initializing GnuTLS\n");
256
if ((ret = gnutls_global_init ())
257
!= GNUTLS_E_SUCCESS) {
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
325
ret = gnutls_global_init();
326
if (ret != GNUTLS_E_SUCCESS) {
327
fprintf (stderr, "GnuTLS global_init: %s\n",
328
safer_gnutls_strerror(ret));
333
/* "Use a log level over 10 to enable all debugging options."
263
336
gnutls_global_set_log_level(11);
264
337
gnutls_global_set_log_function(debuggnutls);
267
/* openpgp credentials */
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
269
!= GNUTLS_E_SUCCESS) {
270
fprintf (stderr, "memory error: %s\n",
340
/* OpenPGP credentials */
341
gnutls_certificate_allocate_credentials(&mc->cred);
342
if (ret != GNUTLS_E_SUCCESS){
343
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
271
345
safer_gnutls_strerror(ret));
346
gnutls_global_deinit ();
276
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
351
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
352
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
281
356
ret = gnutls_certificate_set_openpgp_key_file
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
357
(mc->cred, pubkeyfilename, seckeyfilename,
358
GNUTLS_OPENPGP_FMT_BASE64);
283
359
if (ret != GNUTLS_E_SUCCESS) {
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
287
ret, CERTFILE, KEYFILE);
288
fprintf(stdout, "The Error is: %s\n",
361
"Error[%d] while reading the OpenPGP key pair ('%s',"
362
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
363
fprintf(stderr, "The GnuTLS error is: %s\n",
289
364
safer_gnutls_strerror(ret));
293
//GnuTLS server initialization
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
295
!= GNUTLS_E_SUCCESS) {
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
297
safer_gnutls_strerror(ret));
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in prime generation: %s\n",
304
safer_gnutls_strerror(ret));
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
310
// GnuTLS session creation
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
312
!= GNUTLS_E_SUCCESS){
368
/* GnuTLS server initialization */
369
ret = gnutls_dh_params_init(&mc->dh_params);
370
if (ret != GNUTLS_E_SUCCESS) {
371
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
372
" %s\n", safer_gnutls_strerror(ret));
375
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
376
if (ret != GNUTLS_E_SUCCESS) {
377
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
378
safer_gnutls_strerror(ret));
382
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
388
gnutls_certificate_free_credentials(mc->cred);
389
gnutls_global_deinit();
393
static int init_gnutls_session(mandos_context *mc,
394
gnutls_session_t *session){
396
/* GnuTLS session creation */
397
ret = gnutls_init(session, GNUTLS_SERVER);
398
if (ret != GNUTLS_E_SUCCESS){
313
399
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
314
400
safer_gnutls_strerror(ret));
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf(stderr, "Syntax error at: %s\n", err);
320
fprintf(stderr, "GnuTLS error: %s\n",
321
safer_gnutls_strerror(ret));
405
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
406
if (ret != GNUTLS_E_SUCCESS) {
407
fprintf(stderr, "Syntax error at: %s\n", err);
408
fprintf(stderr, "GnuTLS error: %s\n",
409
safer_gnutls_strerror(ret));
410
gnutls_deinit (*session);
325
if ((ret = gnutls_credentials_set
326
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Error setting a credentials set: %s\n",
415
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
417
if (ret != GNUTLS_E_SUCCESS) {
418
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
329
419
safer_gnutls_strerror(ret));
420
gnutls_deinit (*session);
333
424
/* ignore client certificate if any. */
334
gnutls_certificate_server_set_request (es->session,
425
gnutls_certificate_server_set_request (*session,
335
426
GNUTLS_CERT_IGNORE);
337
gnutls_dh_set_prime_bits (es->session, DH_BITS);
428
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
342
void empty_log(__attribute__((unused)) AvahiLogLevel level,
343
__attribute__((unused)) const char *txt){}
433
/* Avahi log function callback */
434
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
435
__attribute__((unused)) const char *txt){}
345
int start_mandos_communication(const char *ip, uint16_t port,
346
unsigned int if_index){
437
/* Called when a Mandos server is found */
438
static int start_mandos_communication(const char *ip, uint16_t port,
439
AvahiIfIndex if_index,
348
struct sockaddr_in6 to;
349
encrypted_session es;
442
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
350
443
char *buffer = NULL;
351
444
char *decrypted_buffer;
352
445
size_t buffer_length = 0;
353
446
size_t buffer_capacity = 0;
354
447
ssize_t decrypted_buffer_size;
357
450
char interface[IF_NAMESIZE];
451
gnutls_session_t session;
453
ret = init_gnutls_session (mc, &session);
360
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
459
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
364
463
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
370
if(if_indextoname(if_index, interface) == NULL){
470
if(if_indextoname((unsigned int)if_index, interface) == NULL){
372
471
perror("if_indextoname");
378
474
fprintf(stderr, "Binding to interface %s\n", interface);
381
memset(&to,0,sizeof(to)); /* Spurious warning */
382
to.sin6_family = AF_INET6;
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
477
memset(&to, 0, sizeof(to));
478
to.in6.sin6_family = AF_INET6;
479
/* It would be nice to have a way to detect if we were passed an
480
IPv4 address here. Now we assume an IPv6 address. */
481
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
385
483
perror("inet_pton");
389
487
fprintf(stderr, "Bad address: %s\n", ip);
392
to.sin6_port = htons(port); /* Spurious warning */
490
to.in6.sin6_port = htons(port); /* Spurious warning */
394
to.sin6_scope_id = (uint32_t)if_index;
492
to.in6.sin6_scope_id = (uint32_t)if_index;
397
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
495
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
497
char addrstr[INET6_ADDRSTRLEN] = "";
498
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
499
sizeof(addrstr)) == NULL){
502
if(strcmp(addrstr, ip) != 0){
503
fprintf(stderr, "Canonical address form: %s\n", addrstr);
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
508
ret = connect(tcp_sd, &to.in, sizeof(to));
410
510
perror("connect");
414
ret = initgnutls (&es);
514
const char *out = mandos_protocol_version;
517
size_t out_size = strlen(out);
518
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
519
out_size - written));
525
written += (size_t)ret;
526
if(written < out_size){
529
if (out == mandos_protocol_version){
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
424
539
fprintf(stderr, "Establishing TLS session with %s\n", ip);
427
ret = gnutls_handshake (es.session);
542
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
545
ret = gnutls_handshake (session);
546
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
429
548
if (ret != GNUTLS_E_SUCCESS){
431
fprintf(stderr, "\n*** Handshake failed ***\n");
550
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
432
551
gnutls_perror (ret);
438
//Retrieve OpenPGP packet that contains the wanted password
557
/* Read OpenPGP packet that contains the wanted password */
441
560
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
452
buffer_capacity += BUFFER_SIZE;
565
buffer_capacity = adjustbuffer(&buffer, buffer_length,
567
if (buffer_capacity == 0){
568
perror("adjustbuffer");
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
573
ret = gnutls_record_recv(session, buffer+buffer_length,
561
680
char ip[AVAHI_ADDRESS_STR_MAX];
562
681
avahi_address_snprint(ip, sizeof(ip), address);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
683
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
684
PRIu16 ") on port %d\n", name, host_name, ip,
567
int ret = start_mandos_communication(ip, port,
568
(unsigned int) interface);
687
int ret = start_mandos_communication(ip, port, interface, mc);
689
avahi_simple_poll_quit(mc->simple_poll);
574
693
avahi_s_service_resolver_free(r);
577
static void browse_callback(
578
AvahiSServiceBrowser *b,
579
AvahiIfIndex interface,
580
AvahiProtocol protocol,
581
AvahiBrowserEvent event,
585
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
588
AvahiServer *s = userdata;
589
assert(b); /* Spurious warning */
591
/* Called whenever a new services becomes available on the LAN or
592
is removed from the LAN */
596
case AVAHI_BROWSER_FAILURE:
598
fprintf(stderr, "(Browser) %s\n",
599
avahi_strerror(avahi_server_errno(server)));
600
avahi_simple_poll_quit(simple_poll);
603
case AVAHI_BROWSER_NEW:
604
/* We ignore the returned resolver object. In the callback
605
function we free it. If the server is terminated before
606
the callback function is called the server will free
607
the resolver for us. */
609
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
611
AVAHI_PROTO_INET6, 0,
612
resolve_callback, s)))
613
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
614
avahi_strerror(avahi_server_errno(s)));
617
case AVAHI_BROWSER_REMOVE:
620
case AVAHI_BROWSER_ALL_FOR_NOW:
621
case AVAHI_BROWSER_CACHE_EXHAUSTED:
696
static void browse_callback( AvahiSServiceBrowser *b,
697
AvahiIfIndex interface,
698
AvahiProtocol protocol,
699
AvahiBrowserEvent event,
703
AVAHI_GCC_UNUSED AvahiLookupResultFlags
706
mandos_context *mc = userdata;
709
/* Called whenever a new services becomes available on the LAN or
710
is removed from the LAN */
714
case AVAHI_BROWSER_FAILURE:
716
fprintf(stderr, "(Avahi browser) %s\n",
717
avahi_strerror(avahi_server_errno(mc->server)));
718
avahi_simple_poll_quit(mc->simple_poll);
721
case AVAHI_BROWSER_NEW:
722
/* We ignore the returned Avahi resolver object. In the callback
723
function we free it. If the Avahi server is terminated before
724
the callback function is called the Avahi server will free the
727
if (!(avahi_s_service_resolver_new(mc->server, interface,
728
protocol, name, type, domain,
729
AVAHI_PROTO_INET6, 0,
730
resolve_callback, mc)))
731
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
732
name, avahi_strerror(avahi_server_errno(mc->server)));
735
case AVAHI_BROWSER_REMOVE:
738
case AVAHI_BROWSER_ALL_FOR_NOW:
739
case AVAHI_BROWSER_CACHE_EXHAUSTED:
741
fprintf(stderr, "No Mandos server found, still searching...\n");
626
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
627
AvahiServerConfig config;
747
/* Combines file name and path and returns the malloced new
748
string. some sane checks could/should be added */
749
static char *combinepath(const char *first, const char *second){
751
int ret = asprintf(&tmp, "%s/%s", first, second);
759
int main(int argc, char *argv[]){
628
760
AvahiSServiceBrowser *sb = NULL;
631
int returncode = EXIT_SUCCESS;
763
int exitcode = EXIT_SUCCESS;
632
764
const char *interface = "eth0";
633
unsigned int if_index;
765
struct ifreq network;
634
769
char *connect_to = NULL;
637
static struct option long_options[] = {
638
{"debug", no_argument, (int *)&debug, 1},
639
{"connect", required_argument, 0, 'c'},
640
{"interface", required_argument, 0, 'i'},
643
int option_index = 0;
644
ret = getopt_long (argc, argv, "i:", long_options,
665
if_index = if_nametoindex(interface);
770
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
771
char *pubkeyfilename = NULL;
772
char *seckeyfilename = NULL;
773
const char *pubkeyname = "pubkey.txt";
774
const char *seckeyname = "seckey.txt";
775
mandos_context mc = { .simple_poll = NULL, .server = NULL,
776
.dh_bits = 1024, .priority = "SECURE256"
777
":!CTYPE-X.509:+CTYPE-OPENPGP" };
778
bool gnutls_initalized = false;
781
struct argp_option options[] = {
782
{ .name = "debug", .key = 128,
783
.doc = "Debug mode", .group = 3 },
784
{ .name = "connect", .key = 'c',
785
.arg = "ADDRESS:PORT",
786
.doc = "Connect directly to a specific Mandos server",
788
{ .name = "interface", .key = 'i',
790
.doc = "Interface that will be used to search for Mandos"
793
{ .name = "keydir", .key = 'd',
795
.doc = "Directory to read the OpenPGP key files from",
797
{ .name = "seckey", .key = 's',
799
.doc = "OpenPGP secret key file base name",
801
{ .name = "pubkey", .key = 'p',
803
.doc = "OpenPGP public key file base name",
805
{ .name = "dh-bits", .key = 129,
807
.doc = "Bit length of the prime number used in the"
808
" Diffie-Hellman key exchange",
810
{ .name = "priority", .key = 130,
812
.doc = "GnuTLS priority string for the TLS handshake",
817
error_t parse_opt (int key, char *arg,
818
struct argp_state *state) {
819
/* Get the INPUT argument from `argp_parse', which we know is
820
a pointer to our plugin list pointer. */
822
case 128: /* --debug */
825
case 'c': /* --connect */
828
case 'i': /* --interface */
831
case 'd': /* --keydir */
834
case 's': /* --seckey */
837
case 'p': /* --pubkey */
840
case 129: /* --dh-bits */
842
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
848
case 130: /* --priority */
856
return ARGP_ERR_UNKNOWN;
861
struct argp argp = { .options = options, .parser = parse_opt,
863
.doc = "Mandos client -- Get and decrypt"
864
" passwords from a Mandos server" };
865
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
866
if (ret == ARGP_ERR_UNKNOWN){
867
fprintf(stderr, "Unknown error while parsing arguments\n");
868
exitcode = EXIT_FAILURE;
873
pubkeyfilename = combinepath(keydir, pubkeyname);
874
if (pubkeyfilename == NULL){
875
perror("combinepath");
876
exitcode = EXIT_FAILURE;
880
seckeyfilename = combinepath(keydir, seckeyname);
881
if (seckeyfilename == NULL){
882
perror("combinepath");
883
exitcode = EXIT_FAILURE;
887
ret = init_gnutls_global(&mc, pubkeyfilename, seckeyfilename);
889
fprintf(stderr, "init_gnutls_global failed\n");
890
exitcode = EXIT_FAILURE;
893
gnutls_initalized = true;
896
/* If the interface is down, bring it up */
898
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
901
exitcode = EXIT_FAILURE;
904
strcpy(network.ifr_name, interface);
905
ret = ioctl(sd, SIOCGIFFLAGS, &network);
907
perror("ioctl SIOCGIFFLAGS");
908
exitcode = EXIT_FAILURE;
911
if((network.ifr_flags & IFF_UP) == 0){
912
network.ifr_flags |= IFF_UP;
913
ret = ioctl(sd, SIOCSIFFLAGS, &network);
915
perror("ioctl SIOCSIFFLAGS");
916
exitcode = EXIT_FAILURE;
936
if_index = (AvahiIfIndex) if_nametoindex(interface);
666
937
if(if_index == 0){
667
938
fprintf(stderr, "No such interface: \"%s\"\n", interface);
668
939
exit(EXIT_FAILURE);
674
945
char *address = strrchr(connect_to, ':');
675
946
if(address == NULL){
676
947
fprintf(stderr, "No colon in address\n");
948
exitcode = EXIT_FAILURE;
680
952
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
682
954
perror("Bad port number");
955
exitcode = EXIT_FAILURE;
686
959
address = connect_to;
687
ret = start_mandos_communication(address, port, if_index);
960
ret = start_mandos_communication(address, port, if_index, &mc);
962
exitcode = EXIT_FAILURE;
964
exitcode = EXIT_SUCCESS;
696
970
avahi_set_log_function(empty_log);
699
/* Initialize the psuedo-RNG */
973
/* Initialize the pseudo-RNG for Avahi */
700
974
srand((unsigned int) time(NULL));
702
/* Allocate main loop object */
703
if (!(simple_poll = avahi_simple_poll_new())) {
704
fprintf(stderr, "Failed to create simple poll object.\n");
709
/* Do not publish any local records */
710
avahi_server_config_init(&config);
711
config.publish_hinfo = 0;
712
config.publish_addresses = 0;
713
config.publish_workstation = 0;
714
config.publish_domain = 0;
716
/* Allocate a new server */
717
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
718
&config, NULL, NULL, &error);
720
/* Free the configuration data */
721
avahi_server_config_free(&config);
723
/* Check if creating the server object succeeded */
725
fprintf(stderr, "Failed to create server: %s\n",
976
/* Allocate main Avahi loop object */
977
mc.simple_poll = avahi_simple_poll_new();
978
if (mc.simple_poll == NULL) {
979
fprintf(stderr, "Avahi: Failed to create simple poll"
981
exitcode = EXIT_FAILURE;
986
AvahiServerConfig config;
987
/* Do not publish any local Zeroconf records */
988
avahi_server_config_init(&config);
989
config.publish_hinfo = 0;
990
config.publish_addresses = 0;
991
config.publish_workstation = 0;
992
config.publish_domain = 0;
994
/* Allocate a new server */
995
mc.server = avahi_server_new(avahi_simple_poll_get
996
(mc.simple_poll), &config, NULL,
999
/* Free the Avahi configuration data */
1000
avahi_server_config_free(&config);
1003
/* Check if creating the Avahi server object succeeded */
1004
if (mc.server == NULL) {
1005
fprintf(stderr, "Failed to create Avahi server: %s\n",
726
1006
avahi_strerror(error));
727
returncode = EXIT_FAILURE;
1007
exitcode = EXIT_FAILURE;
731
/* Create the service browser */
732
sb = avahi_s_service_browser_new(server, (AvahiIfIndex)if_index,
1011
/* Create the Avahi service browser */
1012
sb = avahi_s_service_browser_new(mc.server, if_index,
733
1013
AVAHI_PROTO_INET6,
734
1014
"_mandos._tcp", NULL, 0,
735
browse_callback, server);
1015
browse_callback, &mc);
737
1017
fprintf(stderr, "Failed to create service browser: %s\n",
738
avahi_strerror(avahi_server_errno(server)));
739
returncode = EXIT_FAILURE;
1018
avahi_strerror(avahi_server_errno(mc.server)));
1019
exitcode = EXIT_FAILURE;
743
1023
/* Run the main loop */
746
fprintf(stderr, "Starting avahi loop search\n");
1026
fprintf(stderr, "Starting Avahi loop search\n");
749
avahi_simple_poll_loop(simple_poll);
1029
avahi_simple_poll_loop(mc.simple_poll);
754
1034
fprintf(stderr, "%s exiting\n", argv[0]);
757
1037
/* Cleanup things */
759
1039
avahi_s_service_browser_free(sb);
762
avahi_server_free(server);
765
avahi_simple_poll_free(simple_poll);
1041
if (mc.server != NULL)
1042
avahi_server_free(mc.server);
1044
if (mc.simple_poll != NULL)
1045
avahi_simple_poll_free(mc.simple_poll);
1046
free(pubkeyfilename);
1047
free(seckeyfilename);
1049
if (gnutls_initalized){
1050
gnutls_certificate_free_credentials(mc.cred);
1051
gnutls_global_deinit ();