To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 15.1.3
- compare with another revision
- download diff
- download tarball
- view history from revision 15.1.3
- Committer: Björn Påhlsson
- Date: 2008-07-21 03:58:36 UTC
- mfrom: (17 mandos)
- mto: This revision was merged to the branch mainline in revision 20.
- Revision ID: belorn@braxen-20080721035836-v7220bmolr608r61
Added getopt_long support for mandosclient and passprompt
Added support for --interface for mandosclient
Added support for --prefix for passprompt
Added support for --interface for mandosclient
Added support for --prefix for passprompt
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
/* -*- coding: utf-8 -*- */
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
4
*
5
* This program is partly derived from an example program for an Avahi
6
* service browser, downloaded from
7
* <http://avahi.org/browser/examples/core-browse-services.c>. This
8
* includes the following functions: "resolve_callback",
9
* "browse_callback", and parts of "main".
10
*
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
14
*
15
* This program is free software: you can redistribute it and/or
16
* modify it under the terms of the GNU General Public License as
17
* published by the Free Software Foundation, either version 3 of the
18
* License, or (at your option) any later version.
19
*
20
* This program is distributed in the hope that it will be useful, but
21
* WITHOUT ANY WARRANTY; without even the implied warranty of
22
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
23
* General Public License for more details.
24
*
25
* You should have received a copy of the GNU General Public License
26
* along with this program. If not, see
27
* <http://www.gnu.org/licenses/>.
28
*
29
* Contact the authors at <mandos@fukt.bsnet.se>.
30
*/
1
/***
2
This file is part of avahi.
3
4
avahi is free software; you can redistribute it and/or modify it
5
under the terms of the GNU Lesser General Public License as
6
published by the Free Software Foundation; either version 2.1 of the
7
License, or (at your option) any later version.
8
9
avahi is distributed in the hope that it will be useful, but WITHOUT
10
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
12
Public License for more details.
13
14
You should have received a copy of the GNU Lesser General Public
15
License along with avahi; if not, write to the Free Software
16
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
17
USA.
18
***/
31
19
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
20
#define _LARGEFILE_SOURCE
34
21
#define _FILE_OFFSET_BITS 64
35
22
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror() */
40
#include <stdint.h> /* uint16_t, uint32_t */
41
#include <stddef.h> /* NULL, size_t, ssize_t */
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
srand() */
44
#include <stdbool.h> /* bool, true */
45
#include <string.h> /* memset(), strcmp(), strlen(),
46
strerror(), asprintf(), strcpy() */
47
#include <sys/ioctl.h> /* ioctl */
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
49
sockaddr_in6, PF_INET6,
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(), DIR */
52
#include <sys/stat.h> /* open() */
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
54
struct in6_addr, inet_pton(),
55
connect() */
56
#include <fcntl.h> /* open() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16 */
59
#include <assert.h> /* assert() */
60
#include <errno.h> /* perror(), errno */
61
#include <time.h> /* time() */
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
63
SIOCSIFFLAGS, if_indextoname(),
64
if_nametoindex(), IF_NAMESIZE */
65
#include <netinet/in.h>
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
67
getuid(), getgid(), setuid(),
68
setgid() */
69
#include <arpa/inet.h> /* inet_pton(), htons */
70
#include <iso646.h> /* not, and */
71
#include <argp.h> /* struct argp_option, error_t, struct
72
argp_state, struct argp,
73
argp_parse(), ARGP_KEY_ARG,
74
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
75
76
/* Avahi */
77
/* All Avahi types, constants and functions
78
Avahi*, avahi_*,
79
AVAHI_* */
23
#include <stdio.h>
24
#include <assert.h>
25
#include <stdlib.h>
26
#include <time.h>
27
#include <net/if.h> /* if_nametoindex */
28
80
29
#include <avahi-core/core.h>
81
30
#include <avahi-core/lookup.h>
82
31
#include <avahi-core/log.h>
84
33
#include <avahi-common/malloc.h>
85
34
#include <avahi-common/error.h>
86
35
87
/* GnuTLS */
88
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
89
functions:
90
gnutls_*
91
init_gnutls_session(),
92
GNUTLS_* */
93
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
94
GNUTLS_OPENPGP_FMT_BASE64 */
95
96
/* GPGME */
97
#include <gpgme.h> /* All GPGME types, constants and
98
functions:
99
gpgme_*
100
GPGME_PROTOCOL_OpenPGP,
101
GPG_ERR_NO_* */
102
36
//mandos client part
37
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
38
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
39
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
40
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
41
42
#include <unistd.h> /* close() */
43
#include <netinet/in.h>
44
#include <stdbool.h> /* true */
45
#include <string.h> /* memset */
46
#include <arpa/inet.h> /* inet_pton() */
47
#include <iso646.h> /* not */
48
49
// gpgme
50
#include <errno.h> /* perror() */
51
#include <gpgme.h>
52
53
// getopt long
54
#include <getopt.h>
55
56
#ifndef CERT_ROOT
57
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
58
#endif
59
#define CERTFILE CERT_ROOT "openpgp-client.txt"
60
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
103
61
#define BUFFER_SIZE 256
104
105
#define PATHDIR "/conf/conf.d/mandos"
106
#define SECKEY "seckey.txt"
107
#define PUBKEY "pubkey.txt"
62
#define DH_BITS 1024
108
63
109
64
bool debug = false;
110
static const char mandos_protocol_version[] = "1";
111
const char *argp_program_version = "mandos-client " VERSION;
112
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
65
char *interface = "eth0";
113
66
114
/* Used for passing in values through the Avahi callback functions */
115
67
typedef struct {
116
AvahiSimplePoll *simple_poll;
117
AvahiServer *server;
68
gnutls_session_t session;
118
69
gnutls_certificate_credentials_t cred;
119
unsigned int dh_bits;
120
70
gnutls_dh_params_t dh_params;
121
const char *priority;
71
} encrypted_session;
72
73
74
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
75
gpgme_data_t dh_crypto, dh_plain;
122
76
gpgme_ctx_t ctx;
123
} mandos_context;
124
125
/*
126
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
127
* "buffer_capacity" is how much is currently allocated,
128
* "buffer_length" is how much is already used.
129
*/
130
size_t adjustbuffer(char **buffer, size_t buffer_length,
131
size_t buffer_capacity){
132
if (buffer_length + BUFFER_SIZE > buffer_capacity){
133
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
134
if (buffer == NULL){
135
return 0;
136
}
137
buffer_capacity += BUFFER_SIZE;
138
}
139
return buffer_capacity;
140
}
141
142
/*
143
* Initialize GPGME.
144
*/
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
146
const char *pubkey, const char *tempdir){
147
int ret;
148
77
gpgme_error_t rc;
78
ssize_t ret;
79
size_t new_packet_capacity = 0;
80
size_t new_packet_length = 0;
149
81
gpgme_engine_info_t engine_info;
150
151
152
/*
153
* Helper function to insert pub and seckey to the enigne keyring.
154
*/
155
bool import_key(const char *filename){
156
int fd;
157
gpgme_data_t pgp_data;
158
159
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
160
if(fd == -1){
161
perror("open");
162
return false;
163
}
164
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
166
if (rc != GPG_ERR_NO_ERROR){
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
168
gpgme_strsource(rc), gpgme_strerror(rc));
169
return false;
170
}
171
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
175
gpgme_strsource(rc), gpgme_strerror(rc));
176
return false;
177
}
178
179
ret = TEMP_FAILURE_RETRY(close(fd));
180
if(ret == -1){
181
perror("close");
182
}
183
gpgme_data_release(pgp_data);
184
return true;
185
}
186
82
187
83
if (debug){
188
fprintf(stderr, "Initialize gpgme\n");
84
fprintf(stderr, "Attempting to decrypt password from gpg packet\n");
189
85
}
190
86
191
87
/* Init GPGME */
192
88
gpgme_check_version(NULL);
193
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
194
if (rc != GPG_ERR_NO_ERROR){
195
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
196
gpgme_strsource(rc), gpgme_strerror(rc));
197
return false;
198
}
89
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
199
90
200
/* Set GPGME home directory for the OpenPGP engine only */
91
/* Set GPGME home directory */
201
92
rc = gpgme_get_engine_info (&engine_info);
202
93
if (rc != GPG_ERR_NO_ERROR){
203
94
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
204
95
gpgme_strsource(rc), gpgme_strerror(rc));
205
return false;
96
return -1;
206
97
}
207
98
while(engine_info != NULL){
208
99
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
209
100
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
210
engine_info->file_name, tempdir);
101
engine_info->file_name, homedir);
211
102
break;
212
103
}
213
104
engine_info = engine_info->next;
214
105
}
215
106
if(engine_info == NULL){
216
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
217
return false;
218
}
219
220
/* Create new GPGME "context" */
221
rc = gpgme_new(&(mc->ctx));
222
if (rc != GPG_ERR_NO_ERROR){
223
fprintf(stderr, "bad gpgme_new: %s: %s\n",
224
gpgme_strsource(rc), gpgme_strerror(rc));
225
return false;
226
}
227
228
if (not import_key(pubkey) or not import_key(seckey)){
229
return false;
230
}
231
232
return true;
233
}
234
235
/*
236
* Decrypt OpenPGP data.
237
* Returns -1 on error
238
*/
239
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
240
const char *cryptotext,
241
size_t crypto_size,
242
char **plaintext){
243
gpgme_data_t dh_crypto, dh_plain;
244
gpgme_error_t rc;
245
ssize_t ret;
246
size_t plaintext_capacity = 0;
247
ssize_t plaintext_length = 0;
248
249
if (debug){
250
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
251
}
252
253
/* Create new GPGME data buffer from memory cryptotext */
254
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
255
0);
107
fprintf(stderr, "Could not set home dir to %s\n", homedir);
108
return -1;
109
}
110
111
/* Create new GPGME data buffer from packet buffer */
112
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
256
113
if (rc != GPG_ERR_NO_ERROR){
257
114
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
258
115
gpgme_strsource(rc), gpgme_strerror(rc));
264
121
if (rc != GPG_ERR_NO_ERROR){
265
122
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
266
123
gpgme_strsource(rc), gpgme_strerror(rc));
267
gpgme_data_release(dh_crypto);
268
return -1;
269
}
270
271
/* Decrypt data from the cryptotext data buffer to the plaintext
272
data buffer */
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
124
return -1;
125
}
126
127
/* Create new GPGME "context" */
128
rc = gpgme_new(&ctx);
129
if (rc != GPG_ERR_NO_ERROR){
130
fprintf(stderr, "bad gpgme_new: %s: %s\n",
131
gpgme_strsource(rc), gpgme_strerror(rc));
132
return -1;
133
}
134
135
/* Decrypt data from the FILE pointer to the plaintext data buffer */
136
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
274
137
if (rc != GPG_ERR_NO_ERROR){
275
138
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
276
139
gpgme_strsource(rc), gpgme_strerror(rc));
277
plaintext_length = -1;
278
if (debug){
279
gpgme_decrypt_result_t result;
280
result = gpgme_op_decrypt_result(mc->ctx);
281
if (result == NULL){
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
283
} else {
284
fprintf(stderr, "Unsupported algorithm: %s\n",
285
result->unsupported_algorithm);
286
fprintf(stderr, "Wrong key usage: %u\n",
287
result->wrong_key_usage);
288
if(result->file_name != NULL){
289
fprintf(stderr, "File name: %s\n", result->file_name);
290
}
291
gpgme_recipient_t recipient;
292
recipient = result->recipients;
293
if(recipient){
294
while(recipient != NULL){
295
fprintf(stderr, "Public key algorithm: %s\n",
296
gpgme_pubkey_algo_name(recipient->pubkey_algo));
297
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
298
fprintf(stderr, "Secret key available: %s\n",
299
recipient->status == GPG_ERR_NO_SECKEY
300
? "No" : "Yes");
301
recipient = recipient->next;
302
}
140
return -1;
141
}
142
143
if(debug){
144
fprintf(stderr, "decryption of gpg packet succeeded\n");
145
}
146
147
if (debug){
148
gpgme_decrypt_result_t result;
149
result = gpgme_op_decrypt_result(ctx);
150
if (result == NULL){
151
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
152
} else {
153
fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm);
154
fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage);
155
if(result->file_name != NULL){
156
fprintf(stderr, "File name: %s\n", result->file_name);
157
}
158
gpgme_recipient_t recipient;
159
recipient = result->recipients;
160
if(recipient){
161
while(recipient != NULL){
162
fprintf(stderr, "Public key algorithm: %s\n",
163
gpgme_pubkey_algo_name(recipient->pubkey_algo));
164
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
165
fprintf(stderr, "Secret key available: %s\n",
166
recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes");
167
recipient = recipient->next;
303
168
}
304
169
}
305
170
}
306
goto decrypt_end;
307
171
}
308
172
309
if(debug){
310
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
311
}
173
/* Delete the GPGME FILE pointer cryptotext data buffer */
174
gpgme_data_release(dh_crypto);
312
175
313
176
/* Seek back to the beginning of the GPGME plaintext data buffer */
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
315
perror("gpgme_data_seek");
316
plaintext_length = -1;
317
goto decrypt_end;
318
}
319
320
*plaintext = NULL;
177
gpgme_data_seek(dh_plain, 0, SEEK_SET);
178
179
*new_packet = 0;
321
180
while(true){
322
plaintext_capacity = adjustbuffer(plaintext,
323
(size_t)plaintext_length,
324
plaintext_capacity);
325
if (plaintext_capacity == 0){
326
perror("adjustbuffer");
327
plaintext_length = -1;
328
goto decrypt_end;
181
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
182
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
183
if (*new_packet == NULL){
184
perror("realloc");
185
return -1;
186
}
187
new_packet_capacity += BUFFER_SIZE;
329
188
}
330
189
331
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
332
BUFFER_SIZE);
190
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
333
191
/* Print the data, if any */
334
192
if (ret == 0){
335
/* EOF */
193
/* If password is empty, then a incorrect error will be printed */
336
194
break;
337
195
}
338
196
if(ret < 0){
339
197
perror("gpgme_data_read");
340
plaintext_length = -1;
341
goto decrypt_end;
342
}
343
plaintext_length += ret;
344
}
345
346
if(debug){
347
fprintf(stderr, "Decrypted password is: ");
348
for(ssize_t i = 0; i < plaintext_length; i++){
349
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
350
}
351
fprintf(stderr, "\n");
352
}
353
354
decrypt_end:
355
356
/* Delete the GPGME cryptotext data buffer */
357
gpgme_data_release(dh_crypto);
198
return -1;
199
}
200
new_packet_length += ret;
201
}
202
203
/* FIXME: check characters before printing to screen so to not print
204
terminal control characters */
205
/* if(debug){ */
206
/* fprintf(stderr, "decrypted password is: "); */
207
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
208
/* fprintf(stderr, "\n"); */
209
/* } */
358
210
359
211
/* Delete the GPGME plaintext data buffer */
360
212
gpgme_data_release(dh_plain);
361
return plaintext_length;
213
return new_packet_length;
362
214
}
363
215
364
216
static const char * safer_gnutls_strerror (int value) {
365
const char *ret = gnutls_strerror (value); /* Spurious warning */
217
const char *ret = gnutls_strerror (value);
366
218
if (ret == NULL)
367
219
ret = "(unknown)";
368
220
return ret;
369
221
}
370
222
371
/* GnuTLS log function callback */
372
static void debuggnutls(__attribute__((unused)) int level,
373
const char* string){
374
fprintf(stderr, "GnuTLS: %s", string);
223
void debuggnutls(int level, const char* string){
224
fprintf(stderr, "%s", string);
375
225
}
376
226
377
static int init_gnutls_global(mandos_context *mc,
378
const char *pubkeyfilename,
379
const char *seckeyfilename){
227
int initgnutls(encrypted_session *es){
228
const char *err;
380
229
int ret;
381
230
382
231
if(debug){
383
fprintf(stderr, "Initializing GnuTLS\n");
232
fprintf(stderr, "Initializing gnutls\n");
384
233
}
234
385
235
386
ret = gnutls_global_init();
387
if (ret != GNUTLS_E_SUCCESS) {
388
fprintf (stderr, "GnuTLS global_init: %s\n",
389
safer_gnutls_strerror(ret));
236
if ((ret = gnutls_global_init ())
237
!= GNUTLS_E_SUCCESS) {
238
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
390
239
return -1;
391
240
}
392
241
393
242
if (debug){
394
/* "Use a log level over 10 to enable all debugging options."
395
* - GnuTLS manual
396
*/
397
243
gnutls_global_set_log_level(11);
398
244
gnutls_global_set_log_function(debuggnutls);
399
245
}
400
246
401
/* OpenPGP credentials */
402
gnutls_certificate_allocate_credentials(&mc->cred);
403
if (ret != GNUTLS_E_SUCCESS){
404
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
405
warning */
406
safer_gnutls_strerror(ret));
407
gnutls_global_deinit ();
247
248
/* openpgp credentials */
249
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
250
!= GNUTLS_E_SUCCESS) {
251
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
408
252
return -1;
409
253
}
410
254
411
255
if(debug){
412
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
413
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
414
seckeyfilename);
256
fprintf(stderr, "Attempting to use openpgp certificate %s"
257
" and keyfile %s as gnutls credentials\n", CERTFILE, KEYFILE);
415
258
}
416
259
417
260
ret = gnutls_certificate_set_openpgp_key_file
418
(mc->cred, pubkeyfilename, seckeyfilename,
419
GNUTLS_OPENPGP_FMT_BASE64);
420
if (ret != GNUTLS_E_SUCCESS) {
421
fprintf(stderr,
422
"Error[%d] while reading the OpenPGP key pair ('%s',"
423
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
424
fprintf(stderr, "The GnuTLS error is: %s\n",
425
safer_gnutls_strerror(ret));
426
goto globalfail;
427
}
428
429
/* GnuTLS server initialization */
430
ret = gnutls_dh_params_init(&mc->dh_params);
431
if (ret != GNUTLS_E_SUCCESS) {
432
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
433
" %s\n", safer_gnutls_strerror(ret));
434
goto globalfail;
435
}
436
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
437
if (ret != GNUTLS_E_SUCCESS) {
438
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
439
safer_gnutls_strerror(ret));
440
goto globalfail;
441
}
442
443
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
444
445
return 0;
446
447
globalfail:
448
449
gnutls_certificate_free_credentials(mc->cred);
450
gnutls_global_deinit();
451
gnutls_dh_params_deinit(mc->dh_params);
452
return -1;
453
}
454
455
static int init_gnutls_session(mandos_context *mc,
456
gnutls_session_t *session){
457
int ret;
458
/* GnuTLS session creation */
459
ret = gnutls_init(session, GNUTLS_SERVER);
460
if (ret != GNUTLS_E_SUCCESS){
461
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
462
safer_gnutls_strerror(ret));
463
}
464
465
{
466
const char *err;
467
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
468
if (ret != GNUTLS_E_SUCCESS) {
469
fprintf(stderr, "Syntax error at: %s\n", err);
470
fprintf(stderr, "GnuTLS error: %s\n",
471
safer_gnutls_strerror(ret));
472
gnutls_deinit (*session);
473
return -1;
474
}
475
}
476
477
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
478
mc->cred);
479
if (ret != GNUTLS_E_SUCCESS) {
480
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
481
safer_gnutls_strerror(ret));
482
gnutls_deinit (*session);
483
return -1;
484
}
485
261
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
262
if (ret != GNUTLS_E_SUCCESS) {
263
fprintf
264
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
265
ret, CERTFILE, KEYFILE);
266
fprintf(stdout, "The Error is: %s\n",
267
safer_gnutls_strerror(ret));
268
return -1;
269
}
270
271
//Gnutls server initialization
272
if ((ret = gnutls_dh_params_init (&es->dh_params))
273
!= GNUTLS_E_SUCCESS) {
274
fprintf (stderr, "Error in dh parameter initialization: %s\n",
275
safer_gnutls_strerror(ret));
276
return -1;
277
}
278
279
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
280
!= GNUTLS_E_SUCCESS) {
281
fprintf (stderr, "Error in prime generation: %s\n",
282
safer_gnutls_strerror(ret));
283
return -1;
284
}
285
286
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
287
288
// Gnutls session creation
289
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
290
!= GNUTLS_E_SUCCESS){
291
fprintf(stderr, "Error in gnutls session initialization: %s\n",
292
safer_gnutls_strerror(ret));
293
}
294
295
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
296
!= GNUTLS_E_SUCCESS) {
297
fprintf(stderr, "Syntax error at: %s\n", err);
298
fprintf(stderr, "Gnutls error: %s\n",
299
safer_gnutls_strerror(ret));
300
return -1;
301
}
302
303
if ((ret = gnutls_credentials_set
304
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
305
!= GNUTLS_E_SUCCESS) {
306
fprintf(stderr, "Error setting a credentials set: %s\n",
307
safer_gnutls_strerror(ret));
308
return -1;
309
}
310
486
311
/* ignore client certificate if any. */
487
gnutls_certificate_server_set_request (*session,
488
GNUTLS_CERT_IGNORE);
312
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
489
313
490
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
314
gnutls_dh_set_prime_bits (es->session, DH_BITS);
491
315
492
316
return 0;
493
317
}
494
318
495
/* Avahi log function callback */
496
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
497
__attribute__((unused)) const char *txt){}
319
void empty_log(AvahiLogLevel level, const char *txt){}
498
320
499
/* Called when a Mandos server is found */
500
static int start_mandos_communication(const char *ip, uint16_t port,
501
AvahiIfIndex if_index,
502
mandos_context *mc){
321
int start_mandos_communcation(char *ip, uint16_t port){
503
322
int ret, tcp_sd;
504
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
323
struct sockaddr_in6 to;
324
struct in6_addr ip_addr;
325
encrypted_session es;
505
326
char *buffer = NULL;
506
327
char *decrypted_buffer;
507
328
size_t buffer_length = 0;
508
329
size_t buffer_capacity = 0;
509
330
ssize_t decrypted_buffer_size;
510
size_t written;
511
331
int retval = 0;
512
char interface[IF_NAMESIZE];
513
gnutls_session_t session;
514
515
ret = init_gnutls_session (mc, &session);
516
if (ret != 0){
517
return -1;
518
}
519
332
520
333
if(debug){
521
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
522
"\n", ip, port);
334
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
523
335
}
524
336
525
337
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
527
339
perror("socket");
528
340
return -1;
529
341
}
530
342
531
343
if(debug){
532
if(if_indextoname((unsigned int)if_index, interface) == NULL){
533
perror("if_indextoname");
534
return -1;
535
}
536
344
fprintf(stderr, "Binding to interface %s\n", interface);
537
345
}
346
347
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
348
if(tcp_sd < 0) {
349
perror("setsockopt bindtodevice");
350
return -1;
351
}
538
352
539
memset(&to, 0, sizeof(to));
540
to.in6.sin6_family = AF_INET6;
541
/* It would be nice to have a way to detect if we were passed an
542
IPv4 address here. Now we assume an IPv6 address. */
543
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
353
memset(&to,0,sizeof(to));
354
to.sin6_family = AF_INET6;
355
ret = inet_pton(AF_INET6, ip, &ip_addr);
544
356
if (ret < 0 ){
545
357
perror("inet_pton");
546
358
return -1;
547
}
359
}
548
360
if(ret == 0){
549
361
fprintf(stderr, "Bad address: %s\n", ip);
550
362
return -1;
551
363
}
552
to.in6.sin6_port = htons(port); /* Spurious warning */
553
554
to.in6.sin6_scope_id = (uint32_t)if_index;
555
364
to.sin6_port = htons(port);
365
to.sin6_scope_id = if_nametoindex(interface);
366
556
367
if(debug){
557
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
558
port);
559
char addrstr[INET6_ADDRSTRLEN] = "";
560
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
561
sizeof(addrstr)) == NULL){
562
perror("inet_ntop");
563
} else {
564
if(strcmp(addrstr, ip) != 0){
565
fprintf(stderr, "Canonical address form: %s\n", addrstr);
566
}
567
}
368
fprintf(stderr, "Connection to: %s\n", ip);
568
369
}
569
370
570
ret = connect(tcp_sd, &to.in, sizeof(to));
371
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
571
372
if (ret < 0){
572
373
perror("connect");
573
374
return -1;
574
375
}
575
376
576
const char *out = mandos_protocol_version;
577
written = 0;
578
while (true){
579
size_t out_size = strlen(out);
580
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
581
out_size - written));
582
if (ret == -1){
583
perror("write");
584
retval = -1;
585
goto mandos_end;
586
}
587
written += (size_t)ret;
588
if(written < out_size){
589
continue;
590
} else {
591
if (out == mandos_protocol_version){
592
written = 0;
593
out = "\r\n";
594
} else {
595
break;
596
}
597
}
377
ret = initgnutls (&es);
378
if (ret != 0){
379
retval = -1;
380
return -1;
598
381
}
382
599
383
384
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
385
600
386
if(debug){
601
fprintf(stderr, "Establishing TLS session with %s\n", ip);
387
fprintf(stderr, "Establishing tls session with %s\n", ip);
602
388
}
603
604
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
605
606
do{
607
ret = gnutls_handshake (session);
608
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
389
390
391
ret = gnutls_handshake (es.session);
609
392
610
393
if (ret != GNUTLS_E_SUCCESS){
611
if(debug){
612
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
613
gnutls_perror (ret);
614
}
394
fprintf(stderr, "\n*** Handshake failed ***\n");
395
gnutls_perror (ret);
615
396
retval = -1;
616
goto mandos_end;
397
goto exit;
617
398
}
618
619
/* Read OpenPGP packet that contains the wanted password */
620
399
400
//Retrieve gpg packet that contains the wanted password
401
621
402
if(debug){
622
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
623
ip);
403
fprintf(stderr, "Retrieving pgp encrypted password from %s\n", ip);
624
404
}
625
405
626
406
while(true){
627
buffer_capacity = adjustbuffer(&buffer, buffer_length,
628
buffer_capacity);
629
if (buffer_capacity == 0){
630
perror("adjustbuffer");
631
retval = -1;
632
goto mandos_end;
407
if (buffer_length + BUFFER_SIZE > buffer_capacity){
408
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
409
if (buffer == NULL){
410
perror("realloc");
411
goto exit;
412
}
413
buffer_capacity += BUFFER_SIZE;
633
414
}
634
415
635
ret = gnutls_record_recv(session, buffer+buffer_length,
636
BUFFER_SIZE);
416
ret = gnutls_record_recv
417
(es.session, buffer+buffer_length, BUFFER_SIZE);
637
418
if (ret == 0){
638
419
break;
639
420
}
643
424
case GNUTLS_E_AGAIN:
644
425
break;
645
426
case GNUTLS_E_REHANDSHAKE:
646
do{
647
ret = gnutls_handshake (session);
648
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
427
ret = gnutls_handshake (es.session);
649
428
if (ret < 0){
650
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
429
fprintf(stderr, "\n*** Handshake failed ***\n");
651
430
gnutls_perror (ret);
652
431
retval = -1;
653
goto mandos_end;
432
goto exit;
654
433
}
655
434
break;
656
435
default:
657
fprintf(stderr, "Unknown error while reading data from"
658
" encrypted session with Mandos server\n");
436
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
659
437
retval = -1;
660
gnutls_bye (session, GNUTLS_SHUT_RDWR);
661
goto mandos_end;
438
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
439
goto exit;
662
440
}
663
441
} else {
664
buffer_length += (size_t) ret;
442
buffer_length += ret;
665
443
}
666
444
}
667
445
668
if(debug){
669
fprintf(stderr, "Closing TLS session\n");
670
}
671
672
gnutls_bye (session, GNUTLS_SHUT_RDWR);
673
674
446
if (buffer_length > 0){
675
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
676
buffer_length,
677
&decrypted_buffer);
678
if (decrypted_buffer_size >= 0){
679
written = 0;
680
while(written < (size_t) decrypted_buffer_size){
681
ret = (int)fwrite (decrypted_buffer + written, 1,
682
(size_t)decrypted_buffer_size - written,
683
stdout);
684
if(ret == 0 and ferror(stdout)){
685
if(debug){
686
fprintf(stderr, "Error writing encrypted data: %s\n",
687
strerror(errno));
688
}
689
retval = -1;
690
break;
691
}
692
written += (size_t)ret;
693
}
447
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) >= 0){
448
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
694
449
free(decrypted_buffer);
695
450
} else {
696
451
retval = -1;
697
452
}
698
} else {
699
retval = -1;
700
}
701
702
/* Shutdown procedure */
703
704
mandos_end:
453
}
454
455
//shutdown procedure
456
457
if(debug){
458
fprintf(stderr, "Closing tls session\n");
459
}
460
705
461
free(buffer);
706
ret = TEMP_FAILURE_RETRY(close(tcp_sd));
707
if(ret == -1){
708
perror("close");
709
}
710
gnutls_deinit (session);
462
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
463
exit:
464
close(tcp_sd);
465
gnutls_deinit (es.session);
466
gnutls_certificate_free_credentials (es.cred);
467
gnutls_global_deinit ();
711
468
return retval;
712
469
}
713
470
714
static void resolve_callback(AvahiSServiceResolver *r,
715
AvahiIfIndex interface,
716
AVAHI_GCC_UNUSED AvahiProtocol protocol,
717
AvahiResolverEvent event,
718
const char *name,
719
const char *type,
720
const char *domain,
721
const char *host_name,
722
const AvahiAddress *address,
723
uint16_t port,
724
AVAHI_GCC_UNUSED AvahiStringList *txt,
725
AVAHI_GCC_UNUSED AvahiLookupResultFlags
726
flags,
727
void* userdata) {
728
mandos_context *mc = userdata;
729
assert(r);
730
731
/* Called whenever a service has been resolved successfully or
732
timed out */
733
734
switch (event) {
735
default:
736
case AVAHI_RESOLVER_FAILURE:
737
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
738
" of type '%s' in domain '%s': %s\n", name, type, domain,
739
avahi_strerror(avahi_server_errno(mc->server)));
740
break;
741
742
case AVAHI_RESOLVER_FOUND:
743
{
744
char ip[AVAHI_ADDRESS_STR_MAX];
745
avahi_address_snprint(ip, sizeof(ip), address);
746
if(debug){
747
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
748
PRIu16 ") on port %d\n", name, host_name, ip,
749
interface, port);
750
}
751
int ret = start_mandos_communication(ip, port, interface, mc);
752
if (ret == 0){
753
avahi_simple_poll_quit(mc->simple_poll);
754
}
755
}
756
}
757
avahi_s_service_resolver_free(r);
758
}
759
760
static void browse_callback( AvahiSServiceBrowser *b,
761
AvahiIfIndex interface,
762
AvahiProtocol protocol,
763
AvahiBrowserEvent event,
764
const char *name,
765
const char *type,
766
const char *domain,
767
AVAHI_GCC_UNUSED AvahiLookupResultFlags
768
flags,
769
void* userdata) {
770
mandos_context *mc = userdata;
771
assert(b);
772
773
/* Called whenever a new services becomes available on the LAN or
774
is removed from the LAN */
775
776
switch (event) {
777
default:
778
case AVAHI_BROWSER_FAILURE:
779
780
fprintf(stderr, "(Avahi browser) %s\n",
781
avahi_strerror(avahi_server_errno(mc->server)));
782
avahi_simple_poll_quit(mc->simple_poll);
783
return;
784
785
case AVAHI_BROWSER_NEW:
786
/* We ignore the returned Avahi resolver object. In the callback
787
function we free it. If the Avahi server is terminated before
788
the callback function is called the Avahi server will free the
789
resolver for us. */
790
791
if (!(avahi_s_service_resolver_new(mc->server, interface,
792
protocol, name, type, domain,
793
AVAHI_PROTO_INET6, 0,
794
resolve_callback, mc)))
795
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
796
name, avahi_strerror(avahi_server_errno(mc->server)));
797
break;
798
799
case AVAHI_BROWSER_REMOVE:
800
break;
801
802
case AVAHI_BROWSER_ALL_FOR_NOW:
803
case AVAHI_BROWSER_CACHE_EXHAUSTED:
804
if(debug){
805
fprintf(stderr, "No Mandos server found, still searching...\n");
806
}
807
break;
808
}
809
}
810
811
int main(int argc, char *argv[]){
471
static AvahiSimplePoll *simple_poll = NULL;
472
static AvahiServer *server = NULL;
473
474
static void resolve_callback(
475
AvahiSServiceResolver *r,
476
AVAHI_GCC_UNUSED AvahiIfIndex interface,
477
AVAHI_GCC_UNUSED AvahiProtocol protocol,
478
AvahiResolverEvent event,
479
const char *name,
480
const char *type,
481
const char *domain,
482
const char *host_name,
483
const AvahiAddress *address,
484
uint16_t port,
485
AvahiStringList *txt,
486
AvahiLookupResultFlags flags,
487
AVAHI_GCC_UNUSED void* userdata) {
488
489
assert(r);
490
491
/* Called whenever a service has been resolved successfully or timed out */
492
493
switch (event) {
494
case AVAHI_RESOLVER_FAILURE:
495
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
496
break;
497
498
case AVAHI_RESOLVER_FOUND: {
499
char ip[AVAHI_ADDRESS_STR_MAX];
500
avahi_address_snprint(ip, sizeof(ip), address);
501
if(debug){
502
fprintf(stderr, "Mandos server found at %s on port %d\n", ip, port);
503
}
504
int ret = start_mandos_communcation(ip, port);
505
if (ret == 0){
506
exit(EXIT_SUCCESS);
507
} else {
508
exit(EXIT_FAILURE);
509
}
510
}
511
}
512
avahi_s_service_resolver_free(r);
513
}
514
515
static void browse_callback(
516
AvahiSServiceBrowser *b,
517
AvahiIfIndex interface,
518
AvahiProtocol protocol,
519
AvahiBrowserEvent event,
520
const char *name,
521
const char *type,
522
const char *domain,
523
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
524
void* userdata) {
525
526
AvahiServer *s = userdata;
527
assert(b);
528
529
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
530
531
switch (event) {
532
533
case AVAHI_BROWSER_FAILURE:
534
535
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
536
avahi_simple_poll_quit(simple_poll);
537
return;
538
539
case AVAHI_BROWSER_NEW:
540
/* We ignore the returned resolver object. In the callback
541
function we free it. If the server is terminated before
542
the callback function is called the server will free
543
the resolver for us. */
544
545
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
546
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
547
548
break;
549
550
case AVAHI_BROWSER_REMOVE:
551
break;
552
553
case AVAHI_BROWSER_ALL_FOR_NOW:
554
case AVAHI_BROWSER_CACHE_EXHAUSTED:
555
break;
556
}
557
}
558
559
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
560
AvahiServerConfig config;
812
561
AvahiSServiceBrowser *sb = NULL;
813
562
int error;
814
563
int ret;
815
int exitcode = EXIT_SUCCESS;
816
const char *interface = "eth0";
817
struct ifreq network;
818
int sd;
819
uid_t uid;
820
gid_t gid;
821
char *connect_to = NULL;
822
char tempdir[] = "/tmp/mandosXXXXXX";
823
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
824
const char *seckey = PATHDIR "/" SECKEY;
825
const char *pubkey = PATHDIR "/" PUBKEY;
826
827
mandos_context mc = { .simple_poll = NULL, .server = NULL,
828
.dh_bits = 1024, .priority = "SECURE256"
829
":!CTYPE-X.509:+CTYPE-OPENPGP" };
830
bool gnutls_initalized = false;
831
bool gpgme_initalized = false;
832
833
{
834
struct argp_option options[] = {
835
{ .name = "debug", .key = 128,
836
.doc = "Debug mode", .group = 3 },
837
{ .name = "connect", .key = 'c',
838
.arg = "ADDRESS:PORT",
839
.doc = "Connect directly to a specific Mandos server",
840
.group = 1 },
841
{ .name = "interface", .key = 'i',
842
.arg = "NAME",
843
.doc = "Interface that will be used to search for Mandos"
844
" servers",
845
.group = 1 },
846
{ .name = "seckey", .key = 's',
847
.arg = "FILE",
848
.doc = "OpenPGP secret key file base name",
849
.group = 1 },
850
{ .name = "pubkey", .key = 'p',
851
.arg = "FILE",
852
.doc = "OpenPGP public key file base name",
853
.group = 2 },
854
{ .name = "dh-bits", .key = 129,
855
.arg = "BITS",
856
.doc = "Bit length of the prime number used in the"
857
" Diffie-Hellman key exchange",
858
.group = 2 },
859
{ .name = "priority", .key = 130,
860
.arg = "STRING",
861
.doc = "GnuTLS priority string for the TLS handshake",
862
.group = 1 },
863
{ .name = NULL }
864
};
865
866
error_t parse_opt (int key, char *arg,
867
struct argp_state *state) {
868
/* Get the INPUT argument from `argp_parse', which we know is
869
a pointer to our plugin list pointer. */
870
switch (key) {
871
case 128: /* --debug */
872
debug = true;
873
break;
874
case 'c': /* --connect */
875
connect_to = arg;
876
break;
877
case 'i': /* --interface */
878
interface = arg;
879
break;
880
case 's': /* --seckey */
881
seckey = arg;
882
break;
883
case 'p': /* --pubkey */
884
pubkey = arg;
885
break;
886
case 129: /* --dh-bits */
887
errno = 0;
888
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
889
if (errno){
890
perror("strtol");
891
exit(EXIT_FAILURE);
892
}
893
break;
894
case 130: /* --priority */
895
mc.priority = arg;
896
break;
897
case ARGP_KEY_ARG:
898
argp_usage (state);
899
case ARGP_KEY_END:
900
break;
901
default:
902
return ARGP_ERR_UNKNOWN;
903
}
904
return 0;
905
}
906
907
struct argp argp = { .options = options, .parser = parse_opt,
908
.args_doc = "",
909
.doc = "Mandos client -- Get and decrypt"
910
" passwords from a Mandos server" };
911
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
912
if (ret == ARGP_ERR_UNKNOWN){
913
fprintf(stderr, "Unknown error while parsing arguments\n");
914
exitcode = EXIT_FAILURE;
915
goto end;
916
}
917
}
918
919
/* If the interface is down, bring it up */
920
{
921
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
922
if(sd < 0) {
923
perror("socket");
924
exitcode = EXIT_FAILURE;
925
goto end;
926
}
927
strcpy(network.ifr_name, interface);
928
ret = ioctl(sd, SIOCGIFFLAGS, &network);
929
if(ret == -1){
930
perror("ioctl SIOCGIFFLAGS");
931
exitcode = EXIT_FAILURE;
932
goto end;
933
}
934
if((network.ifr_flags & IFF_UP) == 0){
935
network.ifr_flags |= IFF_UP;
936
ret = ioctl(sd, SIOCSIFFLAGS, &network);
937
if(ret == -1){
938
perror("ioctl SIOCSIFFLAGS");
939
exitcode = EXIT_FAILURE;
940
goto end;
941
}
942
}
943
ret = TEMP_FAILURE_RETRY(close(sd));
944
if(ret == -1){
945
perror("close");
946
}
947
}
948
949
uid = getuid();
950
gid = getgid();
951
952
ret = setuid(uid);
953
if (ret == -1){
954
perror("setuid");
955
}
956
957
setgid(gid);
958
if (ret == -1){
959
perror("setgid");
960
}
961
962
ret = init_gnutls_global(&mc, pubkey, seckey);
963
if (ret == -1){
964
fprintf(stderr, "init_gnutls_global failed\n");
965
exitcode = EXIT_FAILURE;
966
goto end;
967
} else {
968
gnutls_initalized = true;
969
}
970
971
if(mkdtemp(tempdir) == NULL){
972
perror("mkdtemp");
973
tempdir[0] = '\0';
974
goto end;
975
}
976
977
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
978
fprintf(stderr, "gpgme_initalized failed\n");
979
exitcode = EXIT_FAILURE;
980
goto end;
981
} else {
982
gpgme_initalized = true;
983
}
984
985
if_index = (AvahiIfIndex) if_nametoindex(interface);
986
if(if_index == 0){
987
fprintf(stderr, "No such interface: \"%s\"\n", interface);
988
exit(EXIT_FAILURE);
989
}
990
991
if(connect_to != NULL){
992
/* Connect directly, do not use Zeroconf */
993
/* (Mainly meant for debugging) */
994
char *address = strrchr(connect_to, ':');
995
if(address == NULL){
996
fprintf(stderr, "No colon in address\n");
997
exitcode = EXIT_FAILURE;
998
goto end;
999
}
1000
errno = 0;
1001
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
1002
if(errno){
1003
perror("Bad port number");
1004
exitcode = EXIT_FAILURE;
1005
goto end;
1006
}
1007
*address = '\0';
1008
address = connect_to;
1009
ret = start_mandos_communication(address, port, if_index, &mc);
1010
if(ret < 0){
1011
exitcode = EXIT_FAILURE;
1012
} else {
1013
exitcode = EXIT_SUCCESS;
1014
}
1015
goto end;
564
int returncode = EXIT_SUCCESS;
565
566
while (true){
567
static struct option long_options[] = {
568
{"debug", no_argument, (int *)&debug, 1},
569
{"interface", required_argument, 0, 'i'},
570
{0, 0, 0, 0} };
571
572
int option_index = 0;
573
ret = getopt_long (argc, argv, "i:", long_options, &option_index);
574
575
if (ret == -1){
576
break;
577
}
578
579
switch(ret){
580
case 0:
581
break;
582
case 'i':
583
interface = optarg;
584
break;
585
default:
586
exit(EXIT_FAILURE);
587
}
1016
588
}
1017
589
1018
590
if (not debug){
1019
591
avahi_set_log_function(empty_log);
1020
592
}
1021
593
1022
/* Initialize the pseudo-RNG for Avahi */
1023
srand((unsigned int) time(NULL));
1024
1025
/* Allocate main Avahi loop object */
1026
mc.simple_poll = avahi_simple_poll_new();
1027
if (mc.simple_poll == NULL) {
1028
fprintf(stderr, "Avahi: Failed to create simple poll"
1029
" object.\n");
1030
exitcode = EXIT_FAILURE;
1031
goto end;
1032
}
1033
1034
{
1035
AvahiServerConfig config;
1036
/* Do not publish any local Zeroconf records */
1037
avahi_server_config_init(&config);
1038
config.publish_hinfo = 0;
1039
config.publish_addresses = 0;
1040
config.publish_workstation = 0;
1041
config.publish_domain = 0;
1042
1043
/* Allocate a new server */
1044
mc.server = avahi_server_new(avahi_simple_poll_get
1045
(mc.simple_poll), &config, NULL,
1046
NULL, &error);
1047
1048
/* Free the Avahi configuration data */
1049
avahi_server_config_free(&config);
1050
}
1051
1052
/* Check if creating the Avahi server object succeeded */
1053
if (mc.server == NULL) {
1054
fprintf(stderr, "Failed to create Avahi server: %s\n",
1055
avahi_strerror(error));
1056
exitcode = EXIT_FAILURE;
1057
goto end;
1058
}
1059
1060
/* Create the Avahi service browser */
1061
sb = avahi_s_service_browser_new(mc.server, if_index,
1062
AVAHI_PROTO_INET6,
1063
"_mandos._tcp", NULL, 0,
1064
browse_callback, &mc);
1065
if (sb == NULL) {
1066
fprintf(stderr, "Failed to create service browser: %s\n",
1067
avahi_strerror(avahi_server_errno(mc.server)));
1068
exitcode = EXIT_FAILURE;
1069
goto end;
594
/* Initialize the psuedo-RNG */
595
srand(time(NULL));
596
597
/* Allocate main loop object */
598
if (!(simple_poll = avahi_simple_poll_new())) {
599
fprintf(stderr, "Failed to create simple poll object.\n");
600
601
goto exit;
602
}
603
604
/* Do not publish any local records */
605
avahi_server_config_init(&config);
606
config.publish_hinfo = 0;
607
config.publish_addresses = 0;
608
config.publish_workstation = 0;
609
config.publish_domain = 0;
610
611
/* Allocate a new server */
612
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
613
614
/* Free the configuration data */
615
avahi_server_config_free(&config);
616
617
/* Check if creating the server object succeeded */
618
if (!server) {
619
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
620
returncode = EXIT_FAILURE;
621
goto exit;
622
}
623
624
/* Create the service browser */
625
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
626
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
627
returncode = EXIT_FAILURE;
628
goto exit;
1070
629
}
1071
630
1072
631
/* Run the main loop */
1073
632
1074
633
if (debug){
1075
fprintf(stderr, "Starting Avahi loop search\n");
634
fprintf(stderr, "Starting avahi loop search\n");
1076
635
}
1077
636
1078
avahi_simple_poll_loop(mc.simple_poll);
1079
1080
end:
1081
637
avahi_simple_poll_loop(simple_poll);
638
639
exit:
640
1082
641
if (debug){
1083
642
fprintf(stderr, "%s exiting\n", argv[0]);
1084
643
}
1085
644
1086
645
/* Cleanup things */
1087
if (sb != NULL)
646
if (sb)
1088
647
avahi_s_service_browser_free(sb);
1089
648
1090
if (mc.server != NULL)
1091
avahi_server_free(mc.server);
1092
1093
if (mc.simple_poll != NULL)
1094
avahi_simple_poll_free(mc.simple_poll);
1095
1096
if (gnutls_initalized){
1097
gnutls_certificate_free_credentials(mc.cred);
1098
gnutls_global_deinit ();
1099
gnutls_dh_params_deinit(mc.dh_params);
1100
}
1101
1102
if(gpgme_initalized){
1103
gpgme_release(mc.ctx);
1104
}
1105
1106
/* Removes the temp directory used by GPGME */
1107
if(tempdir[0] != '\0'){
1108
DIR *d;
1109
struct dirent *direntry;
1110
d = opendir(tempdir);
1111
if(d == NULL){
1112
perror("opendir");
1113
} else {
1114
while(true){
1115
direntry = readdir(d);
1116
if(direntry == NULL){
1117
break;
1118
}
1119
if (direntry->d_type == DT_REG){
1120
char *fullname = NULL;
1121
ret = asprintf(&fullname, "%s/%s", tempdir,
1122
direntry->d_name);
1123
if(ret < 0){
1124
perror("asprintf");
1125
continue;
1126
}
1127
ret = unlink(fullname);
1128
if(ret == -1){
1129
fprintf(stderr, "unlink(\"%s\"): %s",
1130
fullname, strerror(errno));
1131
}
1132
free(fullname);
1133
}
1134
}
1135
closedir(d);
1136
}
1137
ret = rmdir(tempdir);
1138
if(ret == -1){
1139
perror("rmdir");
1140
}
1141
}
1142
1143
return exitcode;
649
if (server)
650
avahi_server_free(server);
651
652
if (simple_poll)
653
avahi_simple_poll_free(simple_poll);
654
655
return returncode;
1144
656
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0