To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/password-request.c
- browse files at revision 160
- compare with another revision
- download diff
- download tarball
- view history from revision 160
- Committer: Teddy Hogeborn
- Date: 2008-09-05 07:11:24 UTC
- Revision ID: teddy@fukt.bsnet.se-20080905071124-9dq11jq5rfd6zfxf
* Makefile: Changed to use symbolic instead of octal modes throughout.
(KEYDIR): New variable for the key directory.
(install-server): Bug fix: remove "--parents" from install args.
(install-client): Bug fix: - '' - Also create key directory. Do
not chmod plugin dir. Create custom plugin directory
if not the same as normal plugin directory. Add
"--dir" option to "mandos-keygen". Add note about
running "mandos-keygen --password".
(uninstall-server): Do not depend on the installed server binary,
since this made it impossible to do a purge
after an uninstall.
(purge-client): Shred seckey.txt. Use $(KEYDIR).
* README: Improved wording.
* initramfs-tools-hook: Use a loop to find prefix. Also find keydir.
Remove "${DESTDIR}" from "copy_exec". Do not
try to copy literal "*" if no custom plugins
are found. Copy key files from keydir, not
config dir. Only repair mode on directories
that actually exist. Do not run chmod if
nothing needs repairing.
* plugin-runner.conf: New file.
(KEYDIR): New variable for the key directory.
(install-server): Bug fix: remove "--parents" from install args.
(install-client): Bug fix: - '' - Also create key directory. Do
not chmod plugin dir. Create custom plugin directory
if not the same as normal plugin directory. Add
"--dir" option to "mandos-keygen". Add note about
running "mandos-keygen --password".
(uninstall-server): Do not depend on the installed server binary,
since this made it impossible to do a purge
after an uninstall.
(purge-client): Shred seckey.txt. Use $(KEYDIR).
* README: Improved wording.
* initramfs-tools-hook: Use a loop to find prefix. Also find keydir.
Remove "${DESTDIR}" from "copy_exec". Do not
try to copy literal "*" if no custom plugins
are found. Copy key files from keydir, not
config dir. Only repair mode on directories
that actually exist. Do not run chmod if
nothing needs repairing.
* plugin-runner.conf: New file.
- files added:
- .bzrignore
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- plugins.d/mandosclient.c => plugins.d/password-request.c
- files modified:
- Makefile
added
removed
plugins.d/password-request.c
25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
27
27
*
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
30
29
*/
31
30
32
31
/* Needed by GPGME, specifically gpgme_data_seek() */
33
32
#define _LARGEFILE_SOURCE
34
33
#define _FILE_OFFSET_BITS 64
35
34
36
#include <stdio.h>
37
#include <assert.h>
38
#include <stdlib.h>
39
#include <time.h>
40
#include <net/if.h> /* if_nametoindex */
41
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
36
37
#include <stdio.h> /* fprintf(), stderr, fwrite(),
38
stdout, ferror() */
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
42
srand() */
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), asprintf(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
sockaddr_in6, PF_INET6,
49
SOCK_STREAM, INET6_ADDRSTRLEN,
50
uid_t, gid_t, open(), opendir(), DIR */
51
#include <sys/stat.h> /* open() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton(),
54
connect() */
55
#include <fcntl.h> /* open() */
56
#include <dirent.h> /* opendir(), struct dirent, readdir() */
57
#include <inttypes.h> /* PRIu16 */
58
#include <assert.h> /* assert() */
59
#include <errno.h> /* perror(), errno */
60
#include <time.h> /* time() */
61
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
62
SIOCSIFFLAGS, if_indextoname(),
63
if_nametoindex(), IF_NAMESIZE */
64
#include <netinet/in.h>
65
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
66
getuid(), getgid(), setuid(),
67
setgid() */
68
#include <arpa/inet.h> /* inet_pton(), htons */
69
#include <iso646.h> /* not, and */
70
#include <argp.h> /* struct argp_option, error_t, struct
71
argp_state, struct argp,
72
argp_parse(), ARGP_KEY_ARG,
73
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
74
75
/* Avahi */
76
/* All Avahi types, constants and functions
77
Avahi*, avahi_*,
78
AVAHI_* */
42
79
#include <avahi-core/core.h>
43
80
#include <avahi-core/lookup.h>
44
81
#include <avahi-core/log.h>
46
83
#include <avahi-common/malloc.h>
47
84
#include <avahi-common/error.h>
48
85
49
//mandos client part
50
#include <sys/types.h> /* socket(), inet_pton() */
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
52
struct in6_addr, inet_pton() */
53
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
54
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
55
56
#include <unistd.h> /* close() */
57
#include <netinet/in.h>
58
#include <stdbool.h> /* true */
59
#include <string.h> /* memset */
60
#include <arpa/inet.h> /* inet_pton() */
61
#include <iso646.h> /* not */
62
63
// gpgme
64
#include <errno.h> /* perror() */
65
#include <gpgme.h>
66
67
// getopt long
68
#include <getopt.h>
86
/* GnuTLS */
87
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
88
functions:
89
gnutls_*
90
init_gnutls_session(),
91
GNUTLS_* */
92
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
93
GNUTLS_OPENPGP_FMT_BASE64 */
94
95
/* GPGME */
96
#include <gpgme.h> /* All GPGME types, constants and
97
functions:
98
gpgme_*
99
GPGME_PROTOCOL_OpenPGP,
100
GPG_ERR_NO_* */
69
101
70
102
#define BUFFER_SIZE 256
71
#define DH_BITS 1024
72
73
const char *certdir = "/conf/conf.d/cryptkeyreq/";
74
const char *certfile = "openpgp-client.txt";
75
const char *certkey = "openpgp-client-key.txt";
103
104
/*
105
#define PATHDIR "/conf/conf.d/mandos"
106
*/
107
108
#define PATHDIR "/conf/conf.d/mandos"
109
#define SECKEY "seckey.txt"
110
#define PUBKEY "pupkey.txt"
76
111
77
112
bool debug = false;
113
static const char mandos_protocol_version[] = "1";
114
const char *argp_program_version = "password-request 1.0";
115
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
78
116
117
/* Used for passing in values through the Avahi callback functions */
79
118
typedef struct {
80
gnutls_session_t session;
119
AvahiSimplePoll *simple_poll;
120
AvahiServer *server;
81
121
gnutls_certificate_credentials_t cred;
122
unsigned int dh_bits;
82
123
gnutls_dh_params_t dh_params;
83
} encrypted_session;
84
85
86
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
87
char **new_packet, const char *homedir){
88
gpgme_data_t dh_crypto, dh_plain;
124
const char *priority;
89
125
gpgme_ctx_t ctx;
126
} mandos_context;
127
128
/*
129
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
130
* "buffer_capacity" is how much is currently allocated,
131
* "buffer_length" is how much is already used.
132
*/
133
size_t adjustbuffer(char **buffer, size_t buffer_length,
134
size_t buffer_capacity){
135
if (buffer_length + BUFFER_SIZE > buffer_capacity){
136
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
137
if (buffer == NULL){
138
return 0;
139
}
140
buffer_capacity += BUFFER_SIZE;
141
}
142
return buffer_capacity;
143
}
144
145
/*
146
* Initialize GPGME.
147
*/
148
static bool init_gpgme(mandos_context *mc, const char *seckey,
149
const char *pubkey, const char *tempdir){
150
int ret;
90
151
gpgme_error_t rc;
91
ssize_t ret;
92
ssize_t new_packet_capacity = 0;
93
ssize_t new_packet_length = 0;
94
152
gpgme_engine_info_t engine_info;
95
153
154
155
/*
156
* Helper function to insert pub and seckey to the enigne keyring.
157
*/
158
bool import_key(const char *filename){
159
int fd;
160
gpgme_data_t pgp_data;
161
162
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
163
if(fd == -1){
164
perror("open");
165
return false;
166
}
167
168
rc = gpgme_data_new_from_fd(&pgp_data, fd);
169
if (rc != GPG_ERR_NO_ERROR){
170
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
171
gpgme_strsource(rc), gpgme_strerror(rc));
172
return false;
173
}
174
175
rc = gpgme_op_import(mc->ctx, pgp_data);
176
if (rc != GPG_ERR_NO_ERROR){
177
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
178
gpgme_strsource(rc), gpgme_strerror(rc));
179
return false;
180
}
181
182
ret = TEMP_FAILURE_RETRY(close(fd));
183
if(ret == -1){
184
perror("close");
185
}
186
gpgme_data_release(pgp_data);
187
return true;
188
}
189
96
190
if (debug){
97
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
191
fprintf(stderr, "Initialize gpgme\n");
98
192
}
99
193
100
194
/* Init GPGME */
101
195
gpgme_check_version(NULL);
102
196
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
103
197
if (rc != GPG_ERR_NO_ERROR){
104
198
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
105
199
gpgme_strsource(rc), gpgme_strerror(rc));
106
return -1;
200
return false;
107
201
}
108
109
/* Set GPGME home directory */
202
203
/* Set GPGME home directory for the OpenPGP engine only */
110
204
rc = gpgme_get_engine_info (&engine_info);
111
205
if (rc != GPG_ERR_NO_ERROR){
112
206
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
113
207
gpgme_strsource(rc), gpgme_strerror(rc));
114
return -1;
208
return false;
115
209
}
116
210
while(engine_info != NULL){
117
211
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
118
212
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
119
engine_info->file_name, homedir);
213
engine_info->file_name, tempdir);
120
214
break;
121
215
}
122
216
engine_info = engine_info->next;
123
217
}
124
218
if(engine_info == NULL){
125
fprintf(stderr, "Could not set home dir to %s\n", homedir);
126
return -1;
127
}
128
129
/* Create new GPGME data buffer from packet buffer */
130
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
219
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
220
return false;
221
}
222
223
/* Create new GPGME "context" */
224
rc = gpgme_new(&(mc->ctx));
225
if (rc != GPG_ERR_NO_ERROR){
226
fprintf(stderr, "bad gpgme_new: %s: %s\n",
227
gpgme_strsource(rc), gpgme_strerror(rc));
228
return false;
229
}
230
231
if (not import_key(pubkey) or not import_key(seckey)){
232
return false;
233
}
234
235
return true;
236
}
237
238
/*
239
* Decrypt OpenPGP data.
240
* Returns -1 on error
241
*/
242
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
243
const char *cryptotext,
244
size_t crypto_size,
245
char **plaintext){
246
gpgme_data_t dh_crypto, dh_plain;
247
gpgme_error_t rc;
248
ssize_t ret;
249
size_t plaintext_capacity = 0;
250
ssize_t plaintext_length = 0;
251
252
if (debug){
253
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
254
}
255
256
/* Create new GPGME data buffer from memory cryptotext */
257
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
258
0);
131
259
if (rc != GPG_ERR_NO_ERROR){
132
260
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
133
261
gpgme_strsource(rc), gpgme_strerror(rc));
139
267
if (rc != GPG_ERR_NO_ERROR){
140
268
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
141
269
gpgme_strsource(rc), gpgme_strerror(rc));
142
return -1;
143
}
144
145
/* Create new GPGME "context" */
146
rc = gpgme_new(&ctx);
147
if (rc != GPG_ERR_NO_ERROR){
148
fprintf(stderr, "bad gpgme_new: %s: %s\n",
149
gpgme_strsource(rc), gpgme_strerror(rc));
150
return -1;
151
}
152
153
/* Decrypt data from the FILE pointer to the plaintext data
154
buffer */
155
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
270
gpgme_data_release(dh_crypto);
271
return -1;
272
}
273
274
/* Decrypt data from the cryptotext data buffer to the plaintext
275
data buffer */
276
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
156
277
if (rc != GPG_ERR_NO_ERROR){
157
278
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
158
279
gpgme_strsource(rc), gpgme_strerror(rc));
159
return -1;
280
plaintext_length = -1;
281
if (debug){
282
gpgme_decrypt_result_t result;
283
result = gpgme_op_decrypt_result(mc->ctx);
284
if (result == NULL){
285
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
286
} else {
287
fprintf(stderr, "Unsupported algorithm: %s\n",
288
result->unsupported_algorithm);
289
fprintf(stderr, "Wrong key usage: %u\n",
290
result->wrong_key_usage);
291
if(result->file_name != NULL){
292
fprintf(stderr, "File name: %s\n", result->file_name);
293
}
294
gpgme_recipient_t recipient;
295
recipient = result->recipients;
296
if(recipient){
297
while(recipient != NULL){
298
fprintf(stderr, "Public key algorithm: %s\n",
299
gpgme_pubkey_algo_name(recipient->pubkey_algo));
300
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
301
fprintf(stderr, "Secret key available: %s\n",
302
recipient->status == GPG_ERR_NO_SECKEY
303
? "No" : "Yes");
304
recipient = recipient->next;
305
}
306
}
307
}
308
}
309
goto decrypt_end;
160
310
}
161
311
162
312
if(debug){
163
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
164
}
165
166
if (debug){
167
gpgme_decrypt_result_t result;
168
result = gpgme_op_decrypt_result(ctx);
169
if (result == NULL){
170
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
171
} else {
172
fprintf(stderr, "Unsupported algorithm: %s\n",
173
result->unsupported_algorithm);
174
fprintf(stderr, "Wrong key usage: %d\n",
175
result->wrong_key_usage);
176
if(result->file_name != NULL){
177
fprintf(stderr, "File name: %s\n", result->file_name);
178
}
179
gpgme_recipient_t recipient;
180
recipient = result->recipients;
181
if(recipient){
182
while(recipient != NULL){
183
fprintf(stderr, "Public key algorithm: %s\n",
184
gpgme_pubkey_algo_name(recipient->pubkey_algo));
185
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
186
fprintf(stderr, "Secret key available: %s\n",
187
recipient->status == GPG_ERR_NO_SECKEY
188
? "No" : "Yes");
189
recipient = recipient->next;
190
}
191
}
192
}
193
}
194
195
/* Delete the GPGME FILE pointer cryptotext data buffer */
196
gpgme_data_release(dh_crypto);
313
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
314
}
197
315
198
316
/* Seek back to the beginning of the GPGME plaintext data buffer */
199
317
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
200
318
perror("pgpme_data_seek");
319
plaintext_length = -1;
320
goto decrypt_end;
201
321
}
202
322
203
*new_packet = 0;
323
*plaintext = NULL;
204
324
while(true){
205
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
206
*new_packet = realloc(*new_packet,
207
(unsigned int)new_packet_capacity
208
+ BUFFER_SIZE);
209
if (*new_packet == NULL){
210
perror("realloc");
211
return -1;
212
}
213
new_packet_capacity += BUFFER_SIZE;
325
plaintext_capacity = adjustbuffer(plaintext,
326
(size_t)plaintext_length,
327
plaintext_capacity);
328
if (plaintext_capacity == 0){
329
perror("adjustbuffer");
330
plaintext_length = -1;
331
goto decrypt_end;
214
332
}
215
333
216
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
334
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
217
335
BUFFER_SIZE);
218
336
/* Print the data, if any */
219
337
if (ret == 0){
338
/* EOF */
220
339
break;
221
340
}
222
341
if(ret < 0){
223
342
perror("gpgme_data_read");
224
return -1;
225
}
226
new_packet_length += ret;
227
}
228
229
/* FIXME: check characters before printing to screen so to not print
230
terminal control characters */
231
/* if(debug){ */
232
/* fprintf(stderr, "decrypted password is: "); */
233
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
234
/* fprintf(stderr, "\n"); */
235
/* } */
343
plaintext_length = -1;
344
goto decrypt_end;
345
}
346
plaintext_length += ret;
347
}
348
349
if(debug){
350
fprintf(stderr, "Decrypted password is: ");
351
for(ssize_t i = 0; i < plaintext_length; i++){
352
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
353
}
354
fprintf(stderr, "\n");
355
}
356
357
decrypt_end:
358
359
/* Delete the GPGME cryptotext data buffer */
360
gpgme_data_release(dh_crypto);
236
361
237
362
/* Delete the GPGME plaintext data buffer */
238
363
gpgme_data_release(dh_plain);
239
return new_packet_length;
364
return plaintext_length;
240
365
}
241
366
242
367
static const char * safer_gnutls_strerror (int value) {
243
const char *ret = gnutls_strerror (value);
368
const char *ret = gnutls_strerror (value); /* Spurious warning */
244
369
if (ret == NULL)
245
370
ret = "(unknown)";
246
371
return ret;
247
372
}
248
373
249
void debuggnutls(__attribute__((unused)) int level,
250
const char* string){
251
fprintf(stderr, "%s", string);
374
/* GnuTLS log function callback */
375
static void debuggnutls(__attribute__((unused)) int level,
376
const char* string){
377
fprintf(stderr, "GnuTLS: %s", string);
252
378
}
253
379
254
int initgnutls(encrypted_session *es){
255
const char *err;
380
static int init_gnutls_global(mandos_context *mc,
381
const char *pubkeyfilename,
382
const char *seckeyfilename){
256
383
int ret;
257
384
258
385
if(debug){
259
386
fprintf(stderr, "Initializing GnuTLS\n");
260
387
}
261
262
if ((ret = gnutls_global_init ())
263
!= GNUTLS_E_SUCCESS) {
264
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
388
389
ret = gnutls_global_init();
390
if (ret != GNUTLS_E_SUCCESS) {
391
fprintf (stderr, "GnuTLS global_init: %s\n",
392
safer_gnutls_strerror(ret));
265
393
return -1;
266
394
}
267
395
268
396
if (debug){
397
/* "Use a log level over 10 to enable all debugging options."
398
* - GnuTLS manual
399
*/
269
400
gnutls_global_set_log_level(11);
270
401
gnutls_global_set_log_function(debuggnutls);
271
402
}
272
403
273
/* openpgp credentials */
274
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
275
!= GNUTLS_E_SUCCESS) {
276
fprintf (stderr, "memory error: %s\n",
404
/* OpenPGP credentials */
405
gnutls_certificate_allocate_credentials(&mc->cred);
406
if (ret != GNUTLS_E_SUCCESS){
407
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
408
warning */
277
409
safer_gnutls_strerror(ret));
410
gnutls_global_deinit ();
278
411
return -1;
279
412
}
280
413
281
414
if(debug){
282
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
283
" and keyfile %s as GnuTLS credentials\n", certfile,
284
certkey);
415
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
416
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
417
seckeyfilename);
285
418
}
286
419
287
420
ret = gnutls_certificate_set_openpgp_key_file
288
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
421
(mc->cred, pubkeyfilename, seckeyfilename,
422
GNUTLS_OPENPGP_FMT_BASE64);
289
423
if (ret != GNUTLS_E_SUCCESS) {
290
fprintf
291
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
292
" '%s')\n",
293
ret, certfile, certkey);
294
fprintf(stdout, "The Error is: %s\n",
424
fprintf(stderr,
425
"Error[%d] while reading the OpenPGP key pair ('%s',"
426
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
427
fprintf(stderr, "The GnuTLS error is: %s\n",
295
428
safer_gnutls_strerror(ret));
296
return -1;
297
}
298
299
//GnuTLS server initialization
300
if ((ret = gnutls_dh_params_init (&es->dh_params))
301
!= GNUTLS_E_SUCCESS) {
302
fprintf (stderr, "Error in dh parameter initialization: %s\n",
303
safer_gnutls_strerror(ret));
304
return -1;
305
}
306
307
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
308
!= GNUTLS_E_SUCCESS) {
309
fprintf (stderr, "Error in prime generation: %s\n",
310
safer_gnutls_strerror(ret));
311
return -1;
312
}
313
314
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
315
316
// GnuTLS session creation
317
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
318
!= GNUTLS_E_SUCCESS){
429
goto globalfail;
430
}
431
432
/* GnuTLS server initialization */
433
ret = gnutls_dh_params_init(&mc->dh_params);
434
if (ret != GNUTLS_E_SUCCESS) {
435
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
436
" %s\n", safer_gnutls_strerror(ret));
437
goto globalfail;
438
}
439
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
440
if (ret != GNUTLS_E_SUCCESS) {
441
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
442
safer_gnutls_strerror(ret));
443
goto globalfail;
444
}
445
446
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
447
448
return 0;
449
450
globalfail:
451
452
gnutls_certificate_free_credentials(mc->cred);
453
gnutls_global_deinit();
454
return -1;
455
}
456
457
static int init_gnutls_session(mandos_context *mc,
458
gnutls_session_t *session){
459
int ret;
460
/* GnuTLS session creation */
461
ret = gnutls_init(session, GNUTLS_SERVER);
462
if (ret != GNUTLS_E_SUCCESS){
319
463
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
320
464
safer_gnutls_strerror(ret));
321
465
}
322
466
323
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
324
!= GNUTLS_E_SUCCESS) {
325
fprintf(stderr, "Syntax error at: %s\n", err);
326
fprintf(stderr, "GnuTLS error: %s\n",
327
safer_gnutls_strerror(ret));
328
return -1;
467
{
468
const char *err;
469
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
470
if (ret != GNUTLS_E_SUCCESS) {
471
fprintf(stderr, "Syntax error at: %s\n", err);
472
fprintf(stderr, "GnuTLS error: %s\n",
473
safer_gnutls_strerror(ret));
474
gnutls_deinit (*session);
475
return -1;
476
}
329
477
}
330
478
331
if ((ret = gnutls_credentials_set
332
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
333
!= GNUTLS_E_SUCCESS) {
334
fprintf(stderr, "Error setting a credentials set: %s\n",
479
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
480
mc->cred);
481
if (ret != GNUTLS_E_SUCCESS) {
482
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
335
483
safer_gnutls_strerror(ret));
484
gnutls_deinit (*session);
336
485
return -1;
337
486
}
338
487
339
488
/* ignore client certificate if any. */
340
gnutls_certificate_server_set_request (es->session,
489
gnutls_certificate_server_set_request (*session,
341
490
GNUTLS_CERT_IGNORE);
342
491
343
gnutls_dh_set_prime_bits (es->session, DH_BITS);
492
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
344
493
345
494
return 0;
346
495
}
347
496
348
void empty_log(__attribute__((unused)) AvahiLogLevel level,
349
__attribute__((unused)) const char *txt){}
497
/* Avahi log function callback */
498
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
499
__attribute__((unused)) const char *txt){}
350
500
351
int start_mandos_communication(const char *ip, uint16_t port,
352
AvahiIfIndex if_index){
501
/* Called when a Mandos server is found */
502
static int start_mandos_communication(const char *ip, uint16_t port,
503
AvahiIfIndex if_index,
504
mandos_context *mc){
353
505
int ret, tcp_sd;
354
struct sockaddr_in6 to;
355
encrypted_session es;
506
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
356
507
char *buffer = NULL;
357
508
char *decrypted_buffer;
358
509
size_t buffer_length = 0;
359
510
size_t buffer_capacity = 0;
360
511
ssize_t decrypted_buffer_size;
361
size_t written = 0;
512
size_t written;
362
513
int retval = 0;
363
514
char interface[IF_NAMESIZE];
515
gnutls_session_t session;
516
517
ret = init_gnutls_session (mc, &session);
518
if (ret != 0){
519
return -1;
520
}
364
521
365
522
if(debug){
366
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
367
ip, port);
523
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
524
"\n", ip, port);
368
525
}
369
526
370
527
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
373
530
return -1;
374
531
}
375
532
376
if(if_indextoname((unsigned int)if_index, interface) == NULL){
377
if(debug){
533
if(debug){
534
if(if_indextoname((unsigned int)if_index, interface) == NULL){
378
535
perror("if_indextoname");
536
return -1;
379
537
}
380
return -1;
381
}
382
383
if(debug){
384
538
fprintf(stderr, "Binding to interface %s\n", interface);
385
539
}
386
540
387
memset(&to,0,sizeof(to)); /* Spurious warning */
388
to.sin6_family = AF_INET6;
389
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
541
memset(&to, 0, sizeof(to));
542
to.in6.sin6_family = AF_INET6;
543
/* It would be nice to have a way to detect if we were passed an
544
IPv4 address here. Now we assume an IPv6 address. */
545
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
390
546
if (ret < 0 ){
391
547
perror("inet_pton");
392
548
return -1;
393
}
549
}
394
550
if(ret == 0){
395
551
fprintf(stderr, "Bad address: %s\n", ip);
396
552
return -1;
397
553
}
398
to.sin6_port = htons(port); /* Spurious warning */
554
to.in6.sin6_port = htons(port); /* Spurious warning */
399
555
400
to.sin6_scope_id = (uint32_t)if_index;
556
to.in6.sin6_scope_id = (uint32_t)if_index;
401
557
402
558
if(debug){
403
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
404
/* char addrstr[INET6_ADDRSTRLEN]; */
405
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
406
/* sizeof(addrstr)) == NULL){ */
407
/* perror("inet_ntop"); */
408
/* } else { */
409
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
410
/* addrstr, ntohs(to.sin6_port)); */
411
/* } */
559
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
560
port);
561
char addrstr[INET6_ADDRSTRLEN] = "";
562
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
563
sizeof(addrstr)) == NULL){
564
perror("inet_ntop");
565
} else {
566
if(strcmp(addrstr, ip) != 0){
567
fprintf(stderr, "Canonical address form: %s\n", addrstr);
568
}
569
}
412
570
}
413
571
414
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
572
ret = connect(tcp_sd, &to.in, sizeof(to));
415
573
if (ret < 0){
416
574
perror("connect");
417
575
return -1;
418
576
}
419
577
420
ret = initgnutls (&es);
421
if (ret != 0){
422
retval = -1;
423
return -1;
578
const char *out = mandos_protocol_version;
579
written = 0;
580
while (true){
581
size_t out_size = strlen(out);
582
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
583
out_size - written));
584
if (ret == -1){
585
perror("write");
586
retval = -1;
587
goto mandos_end;
588
}
589
written += (size_t)ret;
590
if(written < out_size){
591
continue;
592
} else {
593
if (out == mandos_protocol_version){
594
written = 0;
595
out = "\r\n";
596
} else {
597
break;
598
}
599
}
424
600
}
425
601
426
gnutls_transport_set_ptr (es.session,
427
(gnutls_transport_ptr_t) tcp_sd);
428
429
602
if(debug){
430
603
fprintf(stderr, "Establishing TLS session with %s\n", ip);
431
604
}
432
605
433
ret = gnutls_handshake (es.session);
606
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
607
608
do{
609
ret = gnutls_handshake (session);
610
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
434
611
435
612
if (ret != GNUTLS_E_SUCCESS){
436
613
if(debug){
437
fprintf(stderr, "\n*** Handshake failed ***\n");
614
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
438
615
gnutls_perror (ret);
439
616
}
440
617
retval = -1;
441
goto exit;
618
goto mandos_end;
442
619
}
443
620
444
//Retrieve OpenPGP packet that contains the wanted password
621
/* Read OpenPGP packet that contains the wanted password */
445
622
446
623
if(debug){
447
624
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
448
625
ip);
449
626
}
450
627
451
628
while(true){
452
if (buffer_length + BUFFER_SIZE > buffer_capacity){
453
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
454
if (buffer == NULL){
455
perror("realloc");
456
goto exit;
457
}
458
buffer_capacity += BUFFER_SIZE;
629
buffer_capacity = adjustbuffer(&buffer, buffer_length,
630
buffer_capacity);
631
if (buffer_capacity == 0){
632
perror("adjustbuffer");
633
retval = -1;
634
goto mandos_end;
459
635
}
460
636
461
ret = gnutls_record_recv
462
(es.session, buffer+buffer_length, BUFFER_SIZE);
637
ret = gnutls_record_recv(session, buffer+buffer_length,
638
BUFFER_SIZE);
463
639
if (ret == 0){
464
640
break;
465
641
}
469
645
case GNUTLS_E_AGAIN:
470
646
break;
471
647
case GNUTLS_E_REHANDSHAKE:
472
ret = gnutls_handshake (es.session);
648
do{
649
ret = gnutls_handshake (session);
650
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
473
651
if (ret < 0){
474
fprintf(stderr, "\n*** Handshake failed ***\n");
652
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
475
653
gnutls_perror (ret);
476
654
retval = -1;
477
goto exit;
655
goto mandos_end;
478
656
}
479
657
break;
480
658
default:
481
659
fprintf(stderr, "Unknown error while reading data from"
482
" encrypted session with mandos server\n");
660
" encrypted session with Mandos server\n");
483
661
retval = -1;
484
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
485
goto exit;
662
gnutls_bye (session, GNUTLS_SHUT_RDWR);
663
goto mandos_end;
486
664
}
487
665
} else {
488
666
buffer_length += (size_t) ret;
489
667
}
490
668
}
491
669
670
if(debug){
671
fprintf(stderr, "Closing TLS session\n");
672
}
673
674
gnutls_bye (session, GNUTLS_SHUT_RDWR);
675
492
676
if (buffer_length > 0){
493
decrypted_buffer_size = pgp_packet_decrypt(buffer,
677
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
494
678
buffer_length,
495
&decrypted_buffer,
496
certdir);
679
&decrypted_buffer);
497
680
if (decrypted_buffer_size >= 0){
681
written = 0;
498
682
while(written < (size_t) decrypted_buffer_size){
499
683
ret = (int)fwrite (decrypted_buffer + written, 1,
500
684
(size_t)decrypted_buffer_size - written,
513
697
} else {
514
698
retval = -1;
515
699
}
516
}
517
518
//shutdown procedure
519
520
if(debug){
521
fprintf(stderr, "Closing TLS session\n");
522
}
523
700
} else {
701
retval = -1;
702
}
703
704
/* Shutdown procedure */
705
706
mandos_end:
524
707
free(buffer);
525
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
526
exit:
527
close(tcp_sd);
528
gnutls_deinit (es.session);
529
gnutls_certificate_free_credentials (es.cred);
530
gnutls_global_deinit ();
708
ret = TEMP_FAILURE_RETRY(close(tcp_sd));
709
if(ret == -1){
710
perror("close");
711
}
712
gnutls_deinit (session);
531
713
return retval;
532
714
}
533
715
534
static AvahiSimplePoll *simple_poll = NULL;
535
static AvahiServer *server = NULL;
536
537
static void resolve_callback(
538
AvahiSServiceResolver *r,
539
AvahiIfIndex interface,
540
AVAHI_GCC_UNUSED AvahiProtocol protocol,
541
AvahiResolverEvent event,
542
const char *name,
543
const char *type,
544
const char *domain,
545
const char *host_name,
546
const AvahiAddress *address,
547
uint16_t port,
548
AVAHI_GCC_UNUSED AvahiStringList *txt,
549
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
550
AVAHI_GCC_UNUSED void* userdata) {
551
552
assert(r); /* Spurious warning */
716
static void resolve_callback(AvahiSServiceResolver *r,
717
AvahiIfIndex interface,
718
AVAHI_GCC_UNUSED AvahiProtocol protocol,
719
AvahiResolverEvent event,
720
const char *name,
721
const char *type,
722
const char *domain,
723
const char *host_name,
724
const AvahiAddress *address,
725
uint16_t port,
726
AVAHI_GCC_UNUSED AvahiStringList *txt,
727
AVAHI_GCC_UNUSED AvahiLookupResultFlags
728
flags,
729
void* userdata) {
730
mandos_context *mc = userdata;
731
assert(r);
553
732
554
733
/* Called whenever a service has been resolved successfully or
555
734
timed out */
557
736
switch (event) {
558
737
default:
559
738
case AVAHI_RESOLVER_FAILURE:
560
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
561
" type '%s' in domain '%s': %s\n", name, type, domain,
562
avahi_strerror(avahi_server_errno(server)));
739
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
740
" of type '%s' in domain '%s': %s\n", name, type, domain,
741
avahi_strerror(avahi_server_errno(mc->server)));
563
742
break;
564
743
565
744
case AVAHI_RESOLVER_FOUND:
567
746
char ip[AVAHI_ADDRESS_STR_MAX];
568
747
avahi_address_snprint(ip, sizeof(ip), address);
569
748
if(debug){
570
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
571
" port %d\n", name, host_name, ip, port);
749
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
750
PRIu16 ") on port %d\n", name, host_name, ip,
751
interface, port);
572
752
}
573
int ret = start_mandos_communication(ip, port, interface);
753
int ret = start_mandos_communication(ip, port, interface, mc);
574
754
if (ret == 0){
575
exit(EXIT_SUCCESS);
755
avahi_simple_poll_quit(mc->simple_poll);
576
756
}
577
757
}
578
758
}
579
759
avahi_s_service_resolver_free(r);
580
760
}
581
761
582
static void browse_callback(
583
AvahiSServiceBrowser *b,
584
AvahiIfIndex interface,
585
AvahiProtocol protocol,
586
AvahiBrowserEvent event,
587
const char *name,
588
const char *type,
589
const char *domain,
590
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
591
void* userdata) {
592
593
AvahiServer *s = userdata;
594
assert(b); /* Spurious warning */
595
596
/* Called whenever a new services becomes available on the LAN or
597
is removed from the LAN */
598
599
switch (event) {
600
default:
601
case AVAHI_BROWSER_FAILURE:
602
603
fprintf(stderr, "(Browser) %s\n",
604
avahi_strerror(avahi_server_errno(server)));
605
avahi_simple_poll_quit(simple_poll);
606
return;
607
608
case AVAHI_BROWSER_NEW:
609
/* We ignore the returned resolver object. In the callback
610
function we free it. If the server is terminated before
611
the callback function is called the server will free
612
the resolver for us. */
613
614
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
615
type, domain,
616
AVAHI_PROTO_INET6, 0,
617
resolve_callback, s)))
618
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
619
avahi_strerror(avahi_server_errno(s)));
620
break;
621
622
case AVAHI_BROWSER_REMOVE:
623
break;
624
625
case AVAHI_BROWSER_ALL_FOR_NOW:
626
case AVAHI_BROWSER_CACHE_EXHAUSTED:
627
break;
762
static void browse_callback( AvahiSServiceBrowser *b,
763
AvahiIfIndex interface,
764
AvahiProtocol protocol,
765
AvahiBrowserEvent event,
766
const char *name,
767
const char *type,
768
const char *domain,
769
AVAHI_GCC_UNUSED AvahiLookupResultFlags
770
flags,
771
void* userdata) {
772
mandos_context *mc = userdata;
773
assert(b);
774
775
/* Called whenever a new services becomes available on the LAN or
776
is removed from the LAN */
777
778
switch (event) {
779
default:
780
case AVAHI_BROWSER_FAILURE:
781
782
fprintf(stderr, "(Avahi browser) %s\n",
783
avahi_strerror(avahi_server_errno(mc->server)));
784
avahi_simple_poll_quit(mc->simple_poll);
785
return;
786
787
case AVAHI_BROWSER_NEW:
788
/* We ignore the returned Avahi resolver object. In the callback
789
function we free it. If the Avahi server is terminated before
790
the callback function is called the Avahi server will free the
791
resolver for us. */
792
793
if (!(avahi_s_service_resolver_new(mc->server, interface,
794
protocol, name, type, domain,
795
AVAHI_PROTO_INET6, 0,
796
resolve_callback, mc)))
797
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
798
name, avahi_strerror(avahi_server_errno(mc->server)));
799
break;
800
801
case AVAHI_BROWSER_REMOVE:
802
break;
803
804
case AVAHI_BROWSER_ALL_FOR_NOW:
805
case AVAHI_BROWSER_CACHE_EXHAUSTED:
806
if(debug){
807
fprintf(stderr, "No Mandos server found, still searching...\n");
628
808
}
629
}
630
631
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
632
const char *combinepath(const char *first, const char *second){
633
char *tmp;
634
tmp = malloc(strlen(first) + strlen(second) + 2);
635
if (tmp == NULL){
636
perror("malloc");
637
return NULL;
638
}
639
strcpy(tmp, first);
640
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
641
strcat(tmp, "/");
642
}
643
strcat(tmp, second);
644
return tmp;
645
}
646
647
648
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
649
AvahiServerConfig config;
809
break;
810
}
811
}
812
813
int main(int argc, char *argv[]){
650
814
AvahiSServiceBrowser *sb = NULL;
651
815
int error;
652
816
int ret;
653
int returncode = EXIT_SUCCESS;
654
const char *interface = NULL;
817
int exitcode = EXIT_SUCCESS;
818
const char *interface = "eth0";
819
struct ifreq network;
820
int sd;
821
uid_t uid;
822
gid_t gid;
823
char *connect_to = NULL;
824
char tempdir[] = "/tmp/mandosXXXXXX";
655
825
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
656
char *connect_to = NULL;
657
658
while (true){
659
static struct option long_options[] = {
660
{"debug", no_argument, (int *)&debug, 1},
661
{"connect", required_argument, 0, 'C'},
662
{"interface", required_argument, 0, 'i'},
663
{"certdir", required_argument, 0, 'd'},
664
{"certkey", required_argument, 0, 'c'},
665
{"certfile", required_argument, 0, 'k'},
666
{0, 0, 0, 0} };
667
668
int option_index = 0;
669
ret = getopt_long (argc, argv, "i:", long_options,
670
&option_index);
671
672
if (ret == -1){
673
break;
674
}
675
676
switch(ret){
677
case 0:
678
break;
679
case 'i':
680
interface = optarg;
681
break;
682
case 'C':
683
connect_to = optarg;
684
break;
685
case 'd':
686
certdir = optarg;
687
break;
688
case 'c':
689
certfile = optarg;
690
break;
691
case 'k':
692
certkey = optarg;
693
break;
694
default:
695
exit(EXIT_FAILURE);
696
}
826
const char *seckey = PATHDIR "/" SECKEY;
827
const char *pubkey = PATHDIR "/" PUBKEY;
828
829
mandos_context mc = { .simple_poll = NULL, .server = NULL,
830
.dh_bits = 1024, .priority = "SECURE256"
831
":!CTYPE-X.509:+CTYPE-OPENPGP" };
832
bool gnutls_initalized = false;
833
bool pgpme_initalized = false;
834
835
{
836
struct argp_option options[] = {
837
{ .name = "debug", .key = 128,
838
.doc = "Debug mode", .group = 3 },
839
{ .name = "connect", .key = 'c',
840
.arg = "ADDRESS:PORT",
841
.doc = "Connect directly to a specific Mandos server",
842
.group = 1 },
843
{ .name = "interface", .key = 'i',
844
.arg = "NAME",
845
.doc = "Interface that will be used to search for Mandos"
846
" servers",
847
.group = 1 },
848
{ .name = "seckey", .key = 's',
849
.arg = "FILE",
850
.doc = "OpenPGP secret key file base name",
851
.group = 1 },
852
{ .name = "pubkey", .key = 'p',
853
.arg = "FILE",
854
.doc = "OpenPGP public key file base name",
855
.group = 2 },
856
{ .name = "dh-bits", .key = 129,
857
.arg = "BITS",
858
.doc = "Bit length of the prime number used in the"
859
" Diffie-Hellman key exchange",
860
.group = 2 },
861
{ .name = "priority", .key = 130,
862
.arg = "STRING",
863
.doc = "GnuTLS priority string for the TLS handshake",
864
.group = 1 },
865
{ .name = NULL }
866
};
867
868
error_t parse_opt (int key, char *arg,
869
struct argp_state *state) {
870
/* Get the INPUT argument from `argp_parse', which we know is
871
a pointer to our plugin list pointer. */
872
switch (key) {
873
case 128: /* --debug */
874
debug = true;
875
break;
876
case 'c': /* --connect */
877
connect_to = arg;
878
break;
879
case 'i': /* --interface */
880
interface = arg;
881
break;
882
case 's': /* --seckey */
883
seckey = arg;
884
break;
885
case 'p': /* --pubkey */
886
pubkey = arg;
887
break;
888
case 129: /* --dh-bits */
889
errno = 0;
890
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
891
if (errno){
892
perror("strtol");
893
exit(EXIT_FAILURE);
894
}
895
break;
896
case 130: /* --priority */
897
mc.priority = arg;
898
break;
899
case ARGP_KEY_ARG:
900
argp_usage (state);
901
case ARGP_KEY_END:
902
break;
903
default:
904
return ARGP_ERR_UNKNOWN;
905
}
906
return 0;
907
}
908
909
struct argp argp = { .options = options, .parser = parse_opt,
910
.args_doc = "",
911
.doc = "Mandos client -- Get and decrypt"
912
" passwords from a Mandos server" };
913
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
914
if (ret == ARGP_ERR_UNKNOWN){
915
fprintf(stderr, "Unknown error while parsing arguments\n");
916
exitcode = EXIT_FAILURE;
917
goto end;
918
}
919
}
920
921
ret = init_gnutls_global(&mc, pubkey, seckey);
922
if (ret == -1){
923
fprintf(stderr, "init_gnutls_global failed\n");
924
exitcode = EXIT_FAILURE;
925
goto end;
926
} else {
927
gnutls_initalized = true;
697
928
}
698
929
699
certfile = combinepath(certdir, certfile);
700
if (certfile == NULL){
701
goto exit;
702
}
703
704
if(interface != NULL){
705
if_index = (AvahiIfIndex) if_nametoindex(interface);
706
if(if_index == 0){
707
fprintf(stderr, "No such interface: \"%s\"\n", interface);
708
exit(EXIT_FAILURE);
709
}
930
if(mkdtemp(tempdir) == NULL){
931
perror("mkdtemp");
932
tempdir[0] = '\0';
933
goto end;
934
}
935
936
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
937
fprintf(stderr, "pgpme_initalized failed\n");
938
exitcode = EXIT_FAILURE;
939
goto end;
940
} else {
941
pgpme_initalized = true;
942
}
943
944
/* If the interface is down, bring it up */
945
{
946
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
947
if(sd < 0) {
948
perror("socket");
949
exitcode = EXIT_FAILURE;
950
goto end;
951
}
952
strcpy(network.ifr_name, interface);
953
ret = ioctl(sd, SIOCGIFFLAGS, &network);
954
if(ret == -1){
955
perror("ioctl SIOCGIFFLAGS");
956
exitcode = EXIT_FAILURE;
957
goto end;
958
}
959
if((network.ifr_flags & IFF_UP) == 0){
960
network.ifr_flags |= IFF_UP;
961
ret = ioctl(sd, SIOCSIFFLAGS, &network);
962
if(ret == -1){
963
perror("ioctl SIOCSIFFLAGS");
964
exitcode = EXIT_FAILURE;
965
goto end;
966
}
967
}
968
ret = TEMP_FAILURE_RETRY(close(sd));
969
if(ret == -1){
970
perror("close");
971
}
972
}
973
974
uid = getuid();
975
gid = getgid();
976
977
ret = setuid(uid);
978
if (ret == -1){
979
perror("setuid");
980
}
981
982
setgid(gid);
983
if (ret == -1){
984
perror("setgid");
985
}
986
987
if_index = (AvahiIfIndex) if_nametoindex(interface);
988
if(if_index == 0){
989
fprintf(stderr, "No such interface: \"%s\"\n", interface);
990
exit(EXIT_FAILURE);
710
991
}
711
992
712
993
if(connect_to != NULL){
715
996
char *address = strrchr(connect_to, ':');
716
997
if(address == NULL){
717
998
fprintf(stderr, "No colon in address\n");
718
exit(EXIT_FAILURE);
999
exitcode = EXIT_FAILURE;
1000
goto end;
719
1001
}
720
1002
errno = 0;
721
1003
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
722
1004
if(errno){
723
1005
perror("Bad port number");
724
exit(EXIT_FAILURE);
1006
exitcode = EXIT_FAILURE;
1007
goto end;
725
1008
}
726
1009
*address = '\0';
727
1010
address = connect_to;
728
ret = start_mandos_communication(address, port, if_index);
1011
ret = start_mandos_communication(address, port, if_index, &mc);
729
1012
if(ret < 0){
730
exit(EXIT_FAILURE);
1013
exitcode = EXIT_FAILURE;
731
1014
} else {
732
exit(EXIT_SUCCESS);
1015
exitcode = EXIT_SUCCESS;
733
1016
}
734
}
735
736
certkey = combinepath(certdir, certkey);
737
if (certkey == NULL){
738
goto exit;
1017
goto end;
739
1018
}
740
1019
741
1020
if (not debug){
742
1021
avahi_set_log_function(empty_log);
743
1022
}
744
1023
745
/* Initialize the psuedo-RNG */
1024
/* Initialize the pseudo-RNG for Avahi */
746
1025
srand((unsigned int) time(NULL));
747
748
/* Allocate main loop object */
749
if (!(simple_poll = avahi_simple_poll_new())) {
750
fprintf(stderr, "Failed to create simple poll object.\n");
751
752
goto exit;
753
}
754
755
/* Do not publish any local records */
756
avahi_server_config_init(&config);
757
config.publish_hinfo = 0;
758
config.publish_addresses = 0;
759
config.publish_workstation = 0;
760
config.publish_domain = 0;
761
762
/* Allocate a new server */
763
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
764
&config, NULL, NULL, &error);
765
766
/* Free the configuration data */
767
avahi_server_config_free(&config);
768
769
/* Check if creating the server object succeeded */
770
if (!server) {
771
fprintf(stderr, "Failed to create server: %s\n",
1026
1027
/* Allocate main Avahi loop object */
1028
mc.simple_poll = avahi_simple_poll_new();
1029
if (mc.simple_poll == NULL) {
1030
fprintf(stderr, "Avahi: Failed to create simple poll"
1031
" object.\n");
1032
exitcode = EXIT_FAILURE;
1033
goto end;
1034
}
1035
1036
{
1037
AvahiServerConfig config;
1038
/* Do not publish any local Zeroconf records */
1039
avahi_server_config_init(&config);
1040
config.publish_hinfo = 0;
1041
config.publish_addresses = 0;
1042
config.publish_workstation = 0;
1043
config.publish_domain = 0;
1044
1045
/* Allocate a new server */
1046
mc.server = avahi_server_new(avahi_simple_poll_get
1047
(mc.simple_poll), &config, NULL,
1048
NULL, &error);
1049
1050
/* Free the Avahi configuration data */
1051
avahi_server_config_free(&config);
1052
}
1053
1054
/* Check if creating the Avahi server object succeeded */
1055
if (mc.server == NULL) {
1056
fprintf(stderr, "Failed to create Avahi server: %s\n",
772
1057
avahi_strerror(error));
773
returncode = EXIT_FAILURE;
774
goto exit;
1058
exitcode = EXIT_FAILURE;
1059
goto end;
775
1060
}
776
1061
777
/* Create the service browser */
778
sb = avahi_s_service_browser_new(server, if_index,
1062
/* Create the Avahi service browser */
1063
sb = avahi_s_service_browser_new(mc.server, if_index,
779
1064
AVAHI_PROTO_INET6,
780
1065
"_mandos._tcp", NULL, 0,
781
browse_callback, server);
782
if (!sb) {
1066
browse_callback, &mc);
1067
if (sb == NULL) {
783
1068
fprintf(stderr, "Failed to create service browser: %s\n",
784
avahi_strerror(avahi_server_errno(server)));
785
returncode = EXIT_FAILURE;
786
goto exit;
1069
avahi_strerror(avahi_server_errno(mc.server)));
1070
exitcode = EXIT_FAILURE;
1071
goto end;
787
1072
}
788
1073
789
1074
/* Run the main loop */
790
1075
791
1076
if (debug){
792
fprintf(stderr, "Starting avahi loop search\n");
1077
fprintf(stderr, "Starting Avahi loop search\n");
793
1078
}
794
1079
795
avahi_simple_poll_loop(simple_poll);
796
797
exit:
798
1080
avahi_simple_poll_loop(mc.simple_poll);
1081
1082
end:
1083
799
1084
if (debug){
800
1085
fprintf(stderr, "%s exiting\n", argv[0]);
801
1086
}
802
1087
803
1088
/* Cleanup things */
804
if (sb)
1089
if (sb != NULL)
805
1090
avahi_s_service_browser_free(sb);
806
1091
807
if (server)
808
avahi_server_free(server);
809
810
if (simple_poll)
811
avahi_simple_poll_free(simple_poll);
812
free(certfile);
813
free(certkey);
814
815
return returncode;
1092
if (mc.server != NULL)
1093
avahi_server_free(mc.server);
1094
1095
if (mc.simple_poll != NULL)
1096
avahi_simple_poll_free(mc.simple_poll);
1097
1098
if (gnutls_initalized){
1099
gnutls_certificate_free_credentials(mc.cred);
1100
gnutls_global_deinit ();
1101
}
1102
1103
if(pgpme_initalized){
1104
gpgme_release(mc.ctx);
1105
}
1106
1107
/* Removes the temp directory used by GPGME */
1108
if(tempdir[0] != '\0'){
1109
DIR *d;
1110
struct dirent *direntry;
1111
d = opendir(tempdir);
1112
if(d == NULL){
1113
perror("opendir");
1114
} else {
1115
while(true){
1116
direntry = readdir(d);
1117
if(direntry == NULL){
1118
break;
1119
}
1120
if (direntry->d_type == DT_REG){
1121
char *fullname = NULL;
1122
ret = asprintf(&fullname, "%s/%s", tempdir,
1123
direntry->d_name);
1124
if(ret < 0){
1125
perror("asprintf");
1126
continue;
1127
}
1128
ret = unlink(fullname);
1129
if(ret == -1){
1130
fprintf(stderr, "unlink(\"%s\"): %s",
1131
fullname, strerror(errno));
1132
}
1133
free(fullname);
1134
}
1135
}
1136
}
1137
ret = rmdir(tempdir);
1138
if(ret == -1){
1139
perror("rmdir");
1140
}
1141
}
1142
1143
return exitcode;
816
1144
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0