/mandos/release : revision 17

1

/* $Id$ */

2

3

/* PLEASE NOTE *

4

* This file demonstrates how to use Avahi's core API, this is

5

* the embeddable mDNS stack for embedded applications.

6

*

7

* End user applications should *not* use this API and should use

8

* the D-Bus or C APIs, please see

9

* client-browse-services.c and glib-integration.c

10

*

11

* I repeat, you probably do *not* want to use this example.

12

*/

13

14

1

/***

15

2

This file is part of avahi.

16

3

72

59

#define BUFFER_SIZE 256

73

60

#define DH_BITS 1024

74

61

62

bool debug = false;

63

75

64

typedef struct {

76

65

gnutls_session_t session;

77

66

gnutls_certificate_credentials_t cred;

88

77

size_t new_packet_length = 0;

89

78

gpgme_engine_info_t engine_info;

90

79

80

if (debug){

81

fprintf(stderr, "Attempting to decrypt password from gpg packet\n");

82

}

83

91

84

/* Init GPGME */

92

85

gpgme_check_version(NULL);

93

86

gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);

143

136

gpgme_strsource(rc), gpgme_strerror(rc));

144

137

return -1;

145

138

}

139

140

if(debug){

141

fprintf(stderr, "decryption of gpg packet succeeded\n");

142

}

143

144

if (debug){

145

gpgme_decrypt_result_t result;

146

result = gpgme_op_decrypt_result(ctx);

147

if (result == NULL){

148

fprintf(stderr, "gpgme_op_decrypt_result failed\n");

149

} else {

150

fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm);

151

fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage);

152

if(result->file_name != NULL){

153

fprintf(stderr, "File name: %s\n", result->file_name);

154

}

155

gpgme_recipient_t recipient;

156

recipient = result->recipients;

157

if(recipient){

158

while(recipient != NULL){

159

fprintf(stderr, "Public key algorithm: %s\n",

160

gpgme_pubkey_algo_name(recipient->pubkey_algo));

161

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

162

fprintf(stderr, "Secret key available: %s\n",

163

recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes");

164

recipient = recipient->next;

165

}

166

}

167

}

168

}

146

169

147

/* gpgme_decrypt_result_t result; */

148

/* result = gpgme_op_decrypt_result(ctx); */

149

/* fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm); */

150

/* fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage); */

151

/* if(result->file_name != NULL){ */

152

/* fprintf(stderr, "File name: %s\n", result->file_name); */

153

/* } */

154

/* gpgme_recipient_t recipient; */

155

/* recipient = result->recipients; */

156

/* if(recipient){ */

157

/* while(recipient != NULL){ */

158

/* fprintf(stderr, "Public key algorithm: %s\n", */

159

/* gpgme_pubkey_algo_name(recipient->pubkey_algo)); */

160

/* fprintf(stderr, "Key ID: %s\n", recipient->keyid); */

161

/* fprintf(stderr, "Secret key available: %s\n", */

162

/* recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes"); */

163

/* recipient = recipient->next; */

164

/* } */

165

/* } */

166

167

170

/* Delete the GPGME FILE pointer cryptotext data buffer */

168

171

gpgme_data_release(dh_crypto);

169

172

194

197

new_packet_length += ret;

195

198

}

196

199

200

if(debug){

201

fprintf(stderr, "decrypted password is: %s\n", *new_packet);

202

}

203

197

204

/* Delete the GPGME plaintext data buffer */

198

205

gpgme_data_release(dh_plain);

199

206

return new_packet_length;

213

220

int initgnutls(encrypted_session *es){

214

221

const char *err;

215

222

int ret;

223

224

if(debug){

225

fprintf(stderr, "Initializing gnutls\n");

226

}

227

216

228

217

229

if ((ret = gnutls_global_init ())

218

230

!= GNUTLS_E_SUCCESS) {

220

232

return -1;

221

233

}

222

234

223

/* Uncomment to enable full debuggin on the gnutls library */

224

/* gnutls_global_set_log_level(11); */

225

/* gnutls_global_set_log_function(debuggnutls); */

226

235

if (debug){

236

gnutls_global_set_log_level(11);

237

gnutls_global_set_log_function(debuggnutls);

238

}

239

227

240

228

241

/* openpgp credentials */

229

242

if ((ret = gnutls_certificate_allocate_credentials (&es->cred))

232

245

return -1;

233

246

}

234

247

248

if(debug){

249

fprintf(stderr, "Attempting to use openpgp certificate %s"

250

" and keyfile %s as gnutls credentials\n", CERTFILE, KEYFILE);

251

}

252

235

253

ret = gnutls_certificate_set_openpgp_key_file

236

254

(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);

237

255

if (ret != GNUTLS_E_SUCCESS) {

304

322

size_t buffer_capacity = 0;

305

323

ssize_t decrypted_buffer_size;

306

324

int retval = 0;

325

const char interface[] = "eth0";

307

326

327

if(debug){

328

fprintf(stderr, "Setting up a tcp connection to %s\n", ip);

329

}

308

330

309

331

tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);

310

332

if(tcp_sd < 0) {

311

333

perror("socket");

312

334

return -1;

313

335

}

314

315

ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, "eth0", 5);

336

337

if(debug){

338

fprintf(stderr, "Binding to interface %s\n", interface);

339

}

340

341

ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);

316

342

if(tcp_sd < 0) {

317

343

perror("setsockopt bindtodevice");

318

344

return -1;

330

356

return -1;

331

357

}

332

358

to.sin6_port = htons(port);

333

to.sin6_scope_id = if_nametoindex("eth0");

359

to.sin6_scope_id = if_nametoindex(interface);

360

361

if(debug){

362

fprintf(stderr, "Connection to: %s\n", ip);

363

}

334

364

335

365

ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));

336

366

if (ret < 0){

347

377

348

378

gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);

349

379

380

if(debug){

381

fprintf(stderr, "Establishing tls session with %s\n", ip);

382

}

383

384

350

385

ret = gnutls_handshake (es.session);

351

386

352

387

if (ret != GNUTLS_E_SUCCESS){

356

391

goto exit;

357

392

}

358

393

359

//retrive password

394

//Retrieve gpg packet that contains the wanted password

395

396

if(debug){

397

fprintf(stderr, "Retrieving pgp encrypted password from %s\n", ip);

398

}

399

360

400

while(true){

361

401

if (buffer_length + BUFFER_SIZE > buffer_capacity){

362

402

buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);

396

436

buffer_length += ret;

397

437

}

398

438

}

399

439

400

440

if (buffer_length > 0){

401

if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) == 0){

402

retval = -1;

403

} else {

441

if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) >= 0){

404

442

fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);

405

443

free(decrypted_buffer);

444

} else {

445

retval = -1;

406

446

}

407

447

}

408

448

449

//shutdown procedure

450

451

if(debug){

452

fprintf(stderr, "Closing tls session\n");

453

}

454

409

455

free(buffer);

410

411

//shutdown procedure

412

456

gnutls_bye (es.session, GNUTLS_SHUT_RDWR);

413

457

exit:

414

458

close(tcp_sd);

448

492

case AVAHI_RESOLVER_FOUND: {

449

493

char ip[AVAHI_ADDRESS_STR_MAX];

450

494

avahi_address_snprint(ip, sizeof(ip), address);

495

if(debug){

496

fprintf(stderr, "Mandos server found at %s on port %d\n", ip, port);

497

}

451

498

int ret = start_mandos_communcation(ip, port);

452

499

if (ret == 0){

453

500

exit(EXIT_SUCCESS);

506

553

int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {

507

554

AvahiServerConfig config;

508

555

AvahiSServiceBrowser *sb = NULL;

556

const char db[] = "--debug";

509

557

int error;

510

558

int ret = 1;

511

512

avahi_set_log_function(empty_log);

559

int returncode = EXIT_SUCCESS;

560

char *basename = rindex(argv[0], '/');

561

if(basename == NULL){

562

basename = argv[0];

563

} else {

564

basename++;

565

}

566

567

char *program_name = malloc(strlen(basename) + sizeof(db));

568

569

if (program_name == NULL){

570

perror("argv[0]");

571

return EXIT_FAILURE;

572

}

573

574

program_name[0] = '\0';

575

576

for (int i = 1; i < argc; i++){

577

if (not strncmp(argv[i], db, 5)){

578

strcat(strcat(strcat(program_name, db ), "="), basename);

579

if(not strcmp(argv[i], db) or not strcmp(argv[i], program_name)){

580

debug = true;

581

}

582

}

583

}

584

free(program_name);

585

586

if (not debug){

587

avahi_set_log_function(empty_log);

588

}

513

589

514

590

/* Initialize the psuedo-RNG */

515

591

srand(time(NULL));

517

593

/* Allocate main loop object */

518

594

if (!(simple_poll = avahi_simple_poll_new())) {

519

595

fprintf(stderr, "Failed to create simple poll object.\n");

520

goto fail;

596

597

goto exit;

521

598

}

522

599

523

600

/* Do not publish any local records */

527

604

config.publish_workstation = 0;

528

605

config.publish_domain = 0;

529

606

530

/* /\* Set a unicast DNS server for wide area DNS-SD *\/ */

531

/* avahi_address_parse("193.11.177.11", AVAHI_PROTO_UNSPEC, &config.wide_area_servers[0]); */

532

/* config.n_wide_area_servers = 1; */

533

/* config.enable_wide_area = 1; */

534

535

607

/* Allocate a new server */

536

608

server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);

537

609

538

610

/* Free the configuration data */

539

611

avahi_server_config_free(&config);

540

612

541

/* Check wether creating the server object succeeded */

613

/* Check if creating the server object succeeded */

542

614

if (!server) {

543

615

fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));

544

goto fail;

616

returncode = EXIT_FAILURE;

617

goto exit;

545

618

}

546

619

547

620

/* Create the service browser */

548

621

if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {

549

622

fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));

550

goto fail;

623

returncode = EXIT_FAILURE;

624

goto exit;

551

625

}

552

626

553

627

/* Run the main loop */

628

629

if (debug){

630

fprintf(stderr, "Starting avahi loop search\n");

631

}

632

554

633

avahi_simple_poll_loop(simple_poll);

555

634

556

ret = 0;

557

558

fail:

635

exit:

636

637

if (debug){

638

fprintf(stderr, "%s exiting\n", argv[0]);

639

}

559

640

560

641

/* Cleanup things */

561

642

if (sb)