1
/* -*- coding: utf-8 -*- */
3
* Mandos client - get and decrypt data from a Mandos server
5
* This program is partly derived from an example program for an Avahi
6
* service browser, downloaded from
7
* <http://avahi.org/browser/examples/core-browse-services.c>. This
8
* includes the following functions: "resolve_callback",
9
* "browse_callback", and parts of "main".
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
* This program is free software: you can redistribute it and/or
15
* modify it under the terms of the GNU General Public License as
16
* published by the Free Software Foundation, either version 3 of the
17
* License, or (at your option) any later version.
19
* This program is distributed in the hope that it will be useful, but
20
* WITHOUT ANY WARRANTY; without even the implied warranty of
21
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
22
* General Public License for more details.
24
* You should have received a copy of the GNU General Public License
25
* along with this program. If not, see
26
* <http://www.gnu.org/licenses/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
2
This file is part of avahi.
4
avahi is free software; you can redistribute it and/or modify it
5
under the terms of the GNU Lesser General Public License as
6
published by the Free Software Foundation; either version 2.1 of the
7
License, or (at your option) any later version.
9
avahi is distributed in the hope that it will be useful, but WITHOUT
10
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
12
Public License for more details.
14
You should have received a copy of the GNU Lesser General Public
15
License along with avahi; if not, write to the Free Software
16
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
31
/* Needed by GPGME, specifically gpgme_data_seek() */
32
20
#define _LARGEFILE_SOURCE
33
21
#define _FILE_OFFSET_BITS 64
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
37
#include <stdio.h> /* fprintf(), stderr, fwrite(), stdout,
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), memcpy(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <net/if.h> /* ifreq, SIOCGIFFLAGS, SIOCSIFFLAGS,
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, INET6_ADDRSTRLEN,
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
54
struct in6_addr, inet_pton(),
56
#include <assert.h> /* assert() */
57
#include <errno.h> /* perror(), errno */
58
#include <time.h> /* time() */
59
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
60
SIOCSIFFLAGS, if_indextoname(),
61
if_nametoindex(), IF_NAMESIZE */
62
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
63
getuid(), getgid(), setuid(),
65
#include <netinet/in.h>
66
#include <arpa/inet.h> /* inet_pton(), htons */
67
#include <iso646.h> /* not, and */
68
#include <argp.h> /* struct argp_option, error_t, struct
69
argp_state, struct argp,
70
argp_parse(), ARGP_KEY_ARG,
71
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
74
/* All Avahi types, constants and functions
27
#include <net/if.h> /* if_nametoindex */
77
29
#include <avahi-core/core.h>
78
30
#include <avahi-core/lookup.h>
79
31
#include <avahi-core/log.h>
81
33
#include <avahi-common/malloc.h>
82
34
#include <avahi-common/error.h>
85
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and functions
87
init_gnutls_session(),
89
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
90
GNUTLS_OPENPGP_FMT_BASE64 */
93
#include <gpgme.h> /* All GPGME types, constants and functions
95
GPGME_PROTOCOL_OpenPGP,
37
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
38
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
39
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
40
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
42
#include <unistd.h> /* close() */
43
#include <netinet/in.h>
44
#include <stdbool.h> /* true */
45
#include <string.h> /* memset */
46
#include <arpa/inet.h> /* inet_pton() */
47
#include <iso646.h> /* not */
50
#include <errno.h> /* perror() */
55
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
57
#define CERTFILE CERT_ROOT "openpgp-client.txt"
58
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
98
59
#define BUFFER_SIZE 256
100
62
bool debug = false;
101
static const char *keydir = "/conf/conf.d/mandos";
102
static const char mandos_protocol_version[] = "1";
103
const char *argp_program_version = "mandosclient 1.0";
104
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
106
/* Used for passing in values through the Avahi callback functions */
108
AvahiSimplePoll *simple_poll;
65
gnutls_session_t session;
110
66
gnutls_certificate_credentials_t cred;
111
unsigned int dh_bits;
112
67
gnutls_dh_params_t dh_params;
113
const char *priority;
117
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
118
* "buffer_capacity" is how much is currently allocated,
119
* "buffer_length" is how much is already used.
121
size_t adjustbuffer(char **buffer, size_t buffer_length,
122
size_t buffer_capacity){
123
if (buffer_length + BUFFER_SIZE > buffer_capacity){
124
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
128
buffer_capacity += BUFFER_SIZE;
130
return buffer_capacity;
134
* Decrypt OpenPGP data using keyrings in HOMEDIR.
135
* Returns -1 on error
137
static ssize_t pgp_packet_decrypt (const char *cryptotext,
140
const char *homedir){
71
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
141
72
gpgme_data_t dh_crypto, dh_plain;
145
size_t plaintext_capacity = 0;
146
ssize_t plaintext_length = 0;
76
size_t new_packet_capacity = 0;
77
size_t new_packet_length = 0;
147
78
gpgme_engine_info_t engine_info;
150
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
81
fprintf(stderr, "Attempting to decrypt password from gpg packet\n");
154
85
gpgme_check_version(NULL);
155
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
156
if (rc != GPG_ERR_NO_ERROR){
157
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
158
gpgme_strsource(rc), gpgme_strerror(rc));
86
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
162
/* Set GPGME home directory for the OpenPGP engine only */
88
/* Set GPGME home directory */
163
89
rc = gpgme_get_engine_info (&engine_info);
164
90
if (rc != GPG_ERR_NO_ERROR){
165
91
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
310
/* GnuTLS log function callback */
311
static void debuggnutls(__attribute__((unused)) int level,
313
fprintf(stderr, "GnuTLS: %s", string);
216
void debuggnutls(int level, const char* string){
217
fprintf(stderr, "%s", string);
316
static int init_gnutls_global(mandos_context *mc,
317
const char *pubkeyfile,
318
const char *seckeyfile){
220
int initgnutls(encrypted_session *es){
322
fprintf(stderr, "Initializing GnuTLS\n");
225
fprintf(stderr, "Initializing gnutls\n");
325
ret = gnutls_global_init();
326
if (ret != GNUTLS_E_SUCCESS) {
327
fprintf (stderr, "GnuTLS global_init: %s\n",
328
safer_gnutls_strerror(ret));
229
if ((ret = gnutls_global_init ())
230
!= GNUTLS_E_SUCCESS) {
231
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
333
/* "Use a log level over 10 to enable all debugging options."
336
236
gnutls_global_set_log_level(11);
337
237
gnutls_global_set_log_function(debuggnutls);
340
/* OpenPGP credentials */
341
gnutls_certificate_allocate_credentials(&mc->cred);
342
if (ret != GNUTLS_E_SUCCESS){
343
fprintf (stderr, "GnuTLS memory error: %s\n",
344
safer_gnutls_strerror(ret));
345
gnutls_global_deinit ();
241
/* openpgp credentials */
242
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
243
!= GNUTLS_E_SUCCESS) {
244
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
350
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
351
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
249
fprintf(stderr, "Attempting to use openpgp certificate %s"
250
" and keyfile %s as gnutls credentials\n", CERTFILE, KEYFILE);
355
253
ret = gnutls_certificate_set_openpgp_key_file
356
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
357
if (ret != GNUTLS_E_SUCCESS) {
359
"Error[%d] while reading the OpenPGP key pair ('%s',"
360
" '%s')\n", ret, pubkeyfile, seckeyfile);
361
fprintf(stdout, "The GnuTLS error is: %s\n",
362
safer_gnutls_strerror(ret));
366
/* GnuTLS server initialization */
367
ret = gnutls_dh_params_init(&mc->dh_params);
368
if (ret != GNUTLS_E_SUCCESS) {
369
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
370
" %s\n", safer_gnutls_strerror(ret));
373
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
374
if (ret != GNUTLS_E_SUCCESS) {
375
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
376
safer_gnutls_strerror(ret));
380
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
386
gnutls_certificate_free_credentials(mc->cred);
387
gnutls_global_deinit();
392
static int init_gnutls_session(mandos_context *mc,
393
gnutls_session_t *session){
395
/* GnuTLS session creation */
396
ret = gnutls_init(session, GNUTLS_SERVER);
397
if (ret != GNUTLS_E_SUCCESS){
398
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
399
safer_gnutls_strerror(ret));
404
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
405
if (ret != GNUTLS_E_SUCCESS) {
406
fprintf(stderr, "Syntax error at: %s\n", err);
407
fprintf(stderr, "GnuTLS error: %s\n",
408
safer_gnutls_strerror(ret));
409
gnutls_deinit (*session);
414
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
416
if (ret != GNUTLS_E_SUCCESS) {
417
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
418
safer_gnutls_strerror(ret));
419
gnutls_deinit (*session);
254
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
255
if (ret != GNUTLS_E_SUCCESS) {
257
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
258
ret, CERTFILE, KEYFILE);
259
fprintf(stdout, "The Error is: %s\n",
260
safer_gnutls_strerror(ret));
264
//Gnutls server initialization
265
if ((ret = gnutls_dh_params_init (&es->dh_params))
266
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "Error in dh parameter initialization: %s\n",
268
safer_gnutls_strerror(ret));
272
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
273
!= GNUTLS_E_SUCCESS) {
274
fprintf (stderr, "Error in prime generation: %s\n",
275
safer_gnutls_strerror(ret));
279
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
281
// Gnutls session creation
282
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
283
!= GNUTLS_E_SUCCESS){
284
fprintf(stderr, "Error in gnutls session initialization: %s\n",
285
safer_gnutls_strerror(ret));
288
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
289
!= GNUTLS_E_SUCCESS) {
290
fprintf(stderr, "Syntax error at: %s\n", err);
291
fprintf(stderr, "Gnutls error: %s\n",
292
safer_gnutls_strerror(ret));
296
if ((ret = gnutls_credentials_set
297
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
298
!= GNUTLS_E_SUCCESS) {
299
fprintf(stderr, "Error setting a credentials set: %s\n",
300
safer_gnutls_strerror(ret));
423
304
/* ignore client certificate if any. */
424
gnutls_certificate_server_set_request (*session,
305
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
427
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
307
gnutls_dh_set_prime_bits (es->session, DH_BITS);
432
/* Avahi log function callback */
433
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
434
__attribute__((unused)) const char *txt){}
312
void empty_log(AvahiLogLevel level, const char *txt){}
436
/* Called when a Mandos server is found */
437
static int start_mandos_communication(const char *ip, uint16_t port,
438
AvahiIfIndex if_index,
314
int start_mandos_communcation(char *ip, uint16_t port){
441
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
316
struct sockaddr_in6 to;
317
encrypted_session es;
442
318
char *buffer = NULL;
443
319
char *decrypted_buffer;
444
320
size_t buffer_length = 0;
445
321
size_t buffer_capacity = 0;
446
322
ssize_t decrypted_buffer_size;
449
char interface[IF_NAMESIZE];
450
gnutls_session_t session;
452
ret = init_gnutls_session (mc, &session);
324
const char interface[] = "eth0";
458
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
327
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
462
330
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
469
if(if_indextoname((unsigned int)if_index, interface) == NULL){
470
perror("if_indextoname");
473
337
fprintf(stderr, "Binding to interface %s\n", interface);
340
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
342
perror("setsockopt bindtodevice");
476
memset(&to,0,sizeof(to)); /* Spurious warning */
477
to.in6.sin6_family = AF_INET6;
478
/* It would be nice to have a way to detect if we were passed an
479
IPv4 address here. Now we assume an IPv6 address. */
480
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
346
memset(&to,0,sizeof(to));
347
to.sin6_family = AF_INET6;
348
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
482
350
perror("inet_pton");
486
354
fprintf(stderr, "Bad address: %s\n", ip);
489
to.in6.sin6_port = htons(port); /* Spurious warning */
491
to.in6.sin6_scope_id = (uint32_t)if_index;
357
to.sin6_port = htons(port);
358
to.sin6_scope_id = if_nametoindex(interface);
494
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
495
char addrstr[INET6_ADDRSTRLEN] = "";
496
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
497
sizeof(addrstr)) == NULL){
500
if(strcmp(addrstr, ip) != 0){
501
fprintf(stderr, "Canonical address form: %s\n", addrstr);
361
fprintf(stderr, "Connection to: %s\n", ip);
506
ret = connect(tcp_sd, &to.in, sizeof(to));
364
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
508
366
perror("connect");
370
ret = initgnutls (&es);
377
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
512
const char *out = mandos_protocol_version;
515
size_t out_size = strlen(out);
516
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
517
out_size - written));
523
written += (size_t)ret;
524
if(written < out_size){
527
if (out == mandos_protocol_version){
537
fprintf(stderr, "Establishing TLS session with %s\n", ip);
380
fprintf(stderr, "Establishing tls session with %s\n", ip);
540
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
543
ret = gnutls_handshake (session);
544
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
384
ret = gnutls_handshake (es.session);
546
386
if (ret != GNUTLS_E_SUCCESS){
548
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
387
fprintf(stderr, "\n*** Handshake failed ***\n");
555
/* Read OpenPGP packet that contains the wanted password */
393
//Retrieve gpg packet that contains the wanted password
558
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
396
fprintf(stderr, "Retrieving pgp encrypted password from %s\n", ip);
563
buffer_capacity = adjustbuffer(&buffer, buffer_length,
565
if (buffer_capacity == 0){
566
perror("adjustbuffer");
400
if (buffer_length + BUFFER_SIZE > buffer_capacity){
401
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
406
buffer_capacity += BUFFER_SIZE;
571
ret = gnutls_record_recv(session, buffer+buffer_length,
409
ret = gnutls_record_recv
410
(es.session, buffer+buffer_length, BUFFER_SIZE);
579
417
case GNUTLS_E_AGAIN:
581
419
case GNUTLS_E_REHANDSHAKE:
583
ret = gnutls_handshake (session);
584
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
420
ret = gnutls_handshake (es.session);
586
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
422
fprintf(stderr, "\n*** Handshake failed ***\n");
587
423
gnutls_perror (ret);
593
fprintf(stderr, "Unknown error while reading data from"
594
" encrypted session with Mandos server\n");
429
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
596
gnutls_bye (session, GNUTLS_SHUT_RDWR);
431
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
600
buffer_length += (size_t) ret;
435
buffer_length += ret;
605
fprintf(stderr, "Closing TLS session\n");
608
gnutls_bye (session, GNUTLS_SHUT_RDWR);
610
439
if (buffer_length > 0){
611
decrypted_buffer_size = pgp_packet_decrypt(buffer,
615
if (decrypted_buffer_size >= 0){
617
while(written < (size_t) decrypted_buffer_size){
618
ret = (int)fwrite (decrypted_buffer + written, 1,
619
(size_t)decrypted_buffer_size - written,
621
if(ret == 0 and ferror(stdout)){
623
fprintf(stderr, "Error writing encrypted data: %s\n",
629
written += (size_t)ret;
440
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) >= 0){
441
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
631
442
free(decrypted_buffer);
637
/* Shutdown procedure */
451
fprintf(stderr, "Closing tls session\n");
455
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
642
gnutls_deinit (session);
458
gnutls_deinit (es.session);
459
gnutls_certificate_free_credentials (es.cred);
460
gnutls_global_deinit ();
646
static void resolve_callback(AvahiSServiceResolver *r,
647
AvahiIfIndex interface,
648
AVAHI_GCC_UNUSED AvahiProtocol protocol,
649
AvahiResolverEvent event,
653
const char *host_name,
654
const AvahiAddress *address,
656
AVAHI_GCC_UNUSED AvahiStringList *txt,
657
AVAHI_GCC_UNUSED AvahiLookupResultFlags
660
mandos_context *mc = userdata;
661
assert(r); /* Spurious warning */
663
/* Called whenever a service has been resolved successfully or
668
case AVAHI_RESOLVER_FAILURE:
669
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
670
" of type '%s' in domain '%s': %s\n", name, type, domain,
671
avahi_strerror(avahi_server_errno(mc->server)));
674
case AVAHI_RESOLVER_FOUND:
676
char ip[AVAHI_ADDRESS_STR_MAX];
677
avahi_address_snprint(ip, sizeof(ip), address);
679
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"
680
" port %d\n", name, host_name, ip, interface, port);
682
int ret = start_mandos_communication(ip, port, interface, mc);
688
avahi_s_service_resolver_free(r);
691
static void browse_callback( AvahiSServiceBrowser *b,
692
AvahiIfIndex interface,
693
AvahiProtocol protocol,
694
AvahiBrowserEvent event,
698
AVAHI_GCC_UNUSED AvahiLookupResultFlags
701
mandos_context *mc = userdata;
702
assert(b); /* Spurious warning */
704
/* Called whenever a new services becomes available on the LAN or
705
is removed from the LAN */
709
case AVAHI_BROWSER_FAILURE:
711
fprintf(stderr, "(Avahi browser) %s\n",
712
avahi_strerror(avahi_server_errno(mc->server)));
713
avahi_simple_poll_quit(mc->simple_poll);
716
case AVAHI_BROWSER_NEW:
717
/* We ignore the returned Avahi resolver object. In the callback
718
function we free it. If the Avahi server is terminated before
719
the callback function is called the Avahi server will free the
722
if (!(avahi_s_service_resolver_new(mc->server, interface,
723
protocol, name, type, domain,
724
AVAHI_PROTO_INET6, 0,
725
resolve_callback, mc)))
726
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
727
name, avahi_strerror(avahi_server_errno(mc->server)));
730
case AVAHI_BROWSER_REMOVE:
733
case AVAHI_BROWSER_ALL_FOR_NOW:
734
case AVAHI_BROWSER_CACHE_EXHAUSTED:
736
fprintf(stderr, "No Mandos server found, still searching...\n");
742
/* Combines file name and path and returns the malloced new
743
string. some sane checks could/should be added */
744
static const char *combinepath(const char *first, const char *second){
745
size_t f_len = strlen(first);
746
size_t s_len = strlen(second);
747
char *tmp = malloc(f_len + s_len + 2);
752
memcpy(tmp, first, f_len); /* Spurious warning */
756
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
758
tmp[f_len + 1 + s_len] = '\0';
763
int main(int argc, char *argv[]){
464
static AvahiSimplePoll *simple_poll = NULL;
465
static AvahiServer *server = NULL;
467
static void resolve_callback(
468
AvahiSServiceResolver *r,
469
AVAHI_GCC_UNUSED AvahiIfIndex interface,
470
AVAHI_GCC_UNUSED AvahiProtocol protocol,
471
AvahiResolverEvent event,
475
const char *host_name,
476
const AvahiAddress *address,
478
AvahiStringList *txt,
479
AvahiLookupResultFlags flags,
480
AVAHI_GCC_UNUSED void* userdata) {
484
/* Called whenever a service has been resolved successfully or timed out */
487
case AVAHI_RESOLVER_FAILURE:
488
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
491
case AVAHI_RESOLVER_FOUND: {
492
char ip[AVAHI_ADDRESS_STR_MAX];
493
avahi_address_snprint(ip, sizeof(ip), address);
495
fprintf(stderr, "Mandos server found at %s on port %d\n", ip, port);
497
int ret = start_mandos_communcation(ip, port);
505
avahi_s_service_resolver_free(r);
508
static void browse_callback(
509
AvahiSServiceBrowser *b,
510
AvahiIfIndex interface,
511
AvahiProtocol protocol,
512
AvahiBrowserEvent event,
516
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
519
AvahiServer *s = userdata;
522
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
526
case AVAHI_BROWSER_FAILURE:
528
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
529
avahi_simple_poll_quit(simple_poll);
532
case AVAHI_BROWSER_NEW:
533
/* We ignore the returned resolver object. In the callback
534
function we free it. If the server is terminated before
535
the callback function is called the server will free
536
the resolver for us. */
538
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
539
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
543
case AVAHI_BROWSER_REMOVE:
546
case AVAHI_BROWSER_ALL_FOR_NOW:
547
case AVAHI_BROWSER_CACHE_EXHAUSTED:
552
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
553
AvahiServerConfig config;
764
554
AvahiSServiceBrowser *sb = NULL;
555
const char db[] = "--debug";
767
int exitcode = EXIT_SUCCESS;
768
const char *interface = "eth0";
769
struct ifreq network;
773
char *connect_to = NULL;
774
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
775
const char *pubkeyfile = "pubkey.txt";
776
const char *seckeyfile = "seckey.txt";
777
mandos_context mc = { .simple_poll = NULL, .server = NULL,
778
.dh_bits = 1024, .priority = "SECURE256"};
779
bool gnutls_initalized = false;
558
int returncode = EXIT_SUCCESS;
559
char *basename = rindex(argv[0], '/');
560
if(basename == NULL){
782
struct argp_option options[] = {
783
{ .name = "debug", .key = 128,
784
.doc = "Debug mode", .group = 3 },
785
{ .name = "connect", .key = 'c',
787
.doc = "Connect directly to a sepcified mandos server",
789
{ .name = "interface", .key = 'i',
791
.doc = "Interface that Avahi will conntect through",
793
{ .name = "keydir", .key = 'd',
795
.doc = "Directory where the openpgp keyring is",
797
{ .name = "seckey", .key = 's',
799
.doc = "Secret openpgp key for gnutls authentication",
801
{ .name = "pubkey", .key = 'p',
803
.doc = "Public openpgp key for gnutls authentication",
805
{ .name = "dh-bits", .key = 129,
807
.doc = "dh-bits to use in gnutls communication",
809
{ .name = "priority", .key = 130,
811
.doc = "GNUTLS priority", .group = 1 },
566
char *program_name = malloc(strlen(basename) + sizeof(db));
816
error_t parse_opt (int key, char *arg,
817
struct argp_state *state) {
818
/* Get the INPUT argument from `argp_parse', which we know is
819
a pointer to our plugin list pointer. */
841
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
568
if (program_name == NULL){
573
program_name[0] = '\0';
575
for (int i = 1; i < argc; i++){
576
if (not strncmp(argv[i], db, 5)){
577
strcat(strcat(strcat(program_name, db ), "="), basename);
578
if(not strcmp(argv[i], db) or not strcmp(argv[i], program_name)){
856
return ARGP_ERR_UNKNOWN;
861
struct argp argp = { .options = options, .parser = parse_opt,
863
.doc = "Mandos client -- Get and decrypt"
864
" passwords from mandos server" };
865
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
866
if (ret == ARGP_ERR_UNKNOWN){
867
fprintf(stderr, "Unkown error while parsing arguments\n");
868
exitcode = EXIT_FAILURE;
873
pubkeyfile = combinepath(keydir, pubkeyfile);
874
if (pubkeyfile == NULL){
875
perror("combinepath");
876
exitcode = EXIT_FAILURE;
880
seckeyfile = combinepath(keydir, seckeyfile);
881
if (seckeyfile == NULL){
882
perror("combinepath");
886
ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);
888
fprintf(stderr, "init_gnutls_global\n");
891
gnutls_initalized = true;
907
if_index = (AvahiIfIndex) if_nametoindex(interface);
909
fprintf(stderr, "No such interface: \"%s\"\n", interface);
913
if(connect_to != NULL){
914
/* Connect directly, do not use Zeroconf */
915
/* (Mainly meant for debugging) */
916
char *address = strrchr(connect_to, ':');
918
fprintf(stderr, "No colon in address\n");
919
exitcode = EXIT_FAILURE;
923
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
925
perror("Bad port number");
926
exitcode = EXIT_FAILURE;
930
address = connect_to;
931
ret = start_mandos_communication(address, port, if_index, &mc);
933
exitcode = EXIT_FAILURE;
935
exitcode = EXIT_SUCCESS;
940
/* If the interface is down, bring it up */
942
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
945
exitcode = EXIT_FAILURE;
948
strcpy(network.ifr_name, interface); /* Spurious warning */
949
ret = ioctl(sd, SIOCGIFFLAGS, &network);
951
perror("ioctl SIOCGIFFLAGS");
952
exitcode = EXIT_FAILURE;
955
if((network.ifr_flags & IFF_UP) == 0){
956
network.ifr_flags |= IFF_UP;
957
ret = ioctl(sd, SIOCSIFFLAGS, &network);
959
perror("ioctl SIOCSIFFLAGS");
960
exitcode = EXIT_FAILURE;
968
586
avahi_set_log_function(empty_log);
971
/* Initialize the pseudo-RNG for Avahi */
972
srand((unsigned int) time(NULL));
974
/* Allocate main Avahi loop object */
975
mc.simple_poll = avahi_simple_poll_new();
976
if (mc.simple_poll == NULL) {
977
fprintf(stderr, "Avahi: Failed to create simple poll"
979
exitcode = EXIT_FAILURE;
984
AvahiServerConfig config;
985
/* Do not publish any local Zeroconf records */
986
avahi_server_config_init(&config);
987
config.publish_hinfo = 0;
988
config.publish_addresses = 0;
989
config.publish_workstation = 0;
990
config.publish_domain = 0;
992
/* Allocate a new server */
993
mc.server = avahi_server_new(avahi_simple_poll_get
994
(mc.simple_poll), &config, NULL,
997
/* Free the Avahi configuration data */
998
avahi_server_config_free(&config);
1001
/* Check if creating the Avahi server object succeeded */
1002
if (mc.server == NULL) {
1003
fprintf(stderr, "Failed to create Avahi server: %s\n",
1004
avahi_strerror(error));
1005
exitcode = EXIT_FAILURE;
1009
/* Create the Avahi service browser */
1010
sb = avahi_s_service_browser_new(mc.server, if_index,
1012
"_mandos._tcp", NULL, 0,
1013
browse_callback, &mc);
1015
fprintf(stderr, "Failed to create service browser: %s\n",
1016
avahi_strerror(avahi_server_errno(mc.server)));
1017
exitcode = EXIT_FAILURE;
589
/* Initialize the psuedo-RNG */
592
/* Allocate main loop object */
593
if (!(simple_poll = avahi_simple_poll_new())) {
594
fprintf(stderr, "Failed to create simple poll object.\n");
599
/* Do not publish any local records */
600
avahi_server_config_init(&config);
601
config.publish_hinfo = 0;
602
config.publish_addresses = 0;
603
config.publish_workstation = 0;
604
config.publish_domain = 0;
606
/* Allocate a new server */
607
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
609
/* Free the configuration data */
610
avahi_server_config_free(&config);
612
/* Check if creating the server object succeeded */
614
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
615
returncode = EXIT_FAILURE;
619
/* Create the service browser */
620
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
621
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
622
returncode = EXIT_FAILURE;
1021
626
/* Run the main loop */
1024
fprintf(stderr, "Starting Avahi loop search\n");
629
fprintf(stderr, "Starting avahi loop search\n");
1027
avahi_simple_poll_loop(mc.simple_poll);
632
avahi_simple_poll_loop(simple_poll);
1032
637
fprintf(stderr, "%s exiting\n", argv[0]);
1035
640
/* Cleanup things */
1037
642
avahi_s_service_browser_free(sb);
1039
if (mc.server != NULL)
1040
avahi_server_free(mc.server);
1042
if (mc.simple_poll != NULL)
1043
avahi_simple_poll_free(mc.simple_poll);
1047
if (gnutls_initalized){
1048
gnutls_certificate_free_credentials(mc.cred);
1049
gnutls_global_deinit ();
645
avahi_server_free(server);
648
avahi_simple_poll_free(simple_poll);