25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
31
/* Needed by GPGME, specifically gpgme_data_seek() */
32
#define _FORTIFY_SOURCE 2
32
34
#define _LARGEFILE_SOURCE
33
35
#define _FILE_OFFSET_BITS 64
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), asprintf(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
sockaddr_in6, PF_INET6,
49
SOCK_STREAM, INET6_ADDRSTRLEN,
51
#include <inttypes.h> /* PRIu16 */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton(),
55
#include <assert.h> /* assert() */
56
#include <errno.h> /* perror(), errno */
57
#include <time.h> /* time() */
58
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
59
SIOCSIFFLAGS, if_indextoname(),
60
if_nametoindex(), IF_NAMESIZE */
61
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
62
getuid(), getgid(), setuid(),
64
#include <netinet/in.h>
65
#include <arpa/inet.h> /* inet_pton(), htons */
66
#include <iso646.h> /* not, and */
67
#include <argp.h> /* struct argp_option, error_t, struct
68
argp_state, struct argp,
69
argp_parse(), ARGP_KEY_ARG,
70
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
73
/* All Avahi types, constants and functions
41
#include <net/if.h> /* if_nametoindex */
76
43
#include <avahi-core/core.h>
77
44
#include <avahi-core/lookup.h>
78
45
#include <avahi-core/log.h>
80
47
#include <avahi-common/malloc.h>
81
48
#include <avahi-common/error.h>
84
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
87
init_gnutls_session(),
89
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
90
GNUTLS_OPENPGP_FMT_BASE64 */
93
#include <gpgme.h> /* All GPGME types, constants and
96
GPGME_PROTOCOL_OpenPGP,
51
#include <sys/types.h> /* socket(), setsockopt(),
53
#include <sys/socket.h> /* socket(), setsockopt(),
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
67
#include <errno.h> /* perror() */
74
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
76
#define CERTFILE CERT_ROOT "openpgp-client.txt"
77
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
99
78
#define BUFFER_SIZE 256
101
81
bool debug = false;
102
static const char *keydir = "/conf/conf.d/mandos";
103
static const char mandos_protocol_version[] = "1";
104
const char *argp_program_version = "password-request 1.0";
105
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
107
/* Used for passing in values through the Avahi callback functions */
109
AvahiSimplePoll *simple_poll;
84
gnutls_session_t session;
111
85
gnutls_certificate_credentials_t cred;
112
unsigned int dh_bits;
113
86
gnutls_dh_params_t dh_params;
114
const char *priority;
118
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
119
* "buffer_capacity" is how much is currently allocated,
120
* "buffer_length" is how much is already used.
122
size_t adjustbuffer(char **buffer, size_t buffer_length,
123
size_t buffer_capacity){
124
if (buffer_length + BUFFER_SIZE > buffer_capacity){
125
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
129
buffer_capacity += BUFFER_SIZE;
131
return buffer_capacity;
135
* Decrypt OpenPGP data using keyrings in HOMEDIR.
136
* Returns -1 on error
138
static ssize_t pgp_packet_decrypt (const char *cryptotext,
141
const char *homedir){
90
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
91
char **new_packet, const char *homedir){
142
92
gpgme_data_t dh_crypto, dh_plain;
146
size_t plaintext_capacity = 0;
147
ssize_t plaintext_length = 0;
96
ssize_t new_packet_capacity = 0;
97
ssize_t new_packet_length = 0;
148
98
gpgme_engine_info_t engine_info;
151
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
101
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
155
105
gpgme_check_version(NULL);
156
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
157
if (rc != GPG_ERR_NO_ERROR){
158
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
159
gpgme_strsource(rc), gpgme_strerror(rc));
106
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
163
/* Set GPGME home directory for the OpenPGP engine only */
108
/* Set GPGME home directory */
164
109
rc = gpgme_get_engine_info (&engine_info);
165
110
if (rc != GPG_ERR_NO_ERROR){
166
111
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
203
146
if (rc != GPG_ERR_NO_ERROR){
204
147
fprintf(stderr, "bad gpgme_new: %s: %s\n",
205
148
gpgme_strsource(rc), gpgme_strerror(rc));
206
plaintext_length = -1;
210
/* Decrypt data from the cryptotext data buffer to the plaintext
152
/* Decrypt data from the FILE pointer to the plaintext data
212
154
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
213
155
if (rc != GPG_ERR_NO_ERROR){
214
156
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
215
157
gpgme_strsource(rc), gpgme_strerror(rc));
216
plaintext_length = -1;
218
gpgme_decrypt_result_t result;
219
result = gpgme_op_decrypt_result(ctx);
221
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
223
fprintf(stderr, "Unsupported algorithm: %s\n",
224
result->unsupported_algorithm);
225
fprintf(stderr, "Wrong key usage: %u\n",
226
result->wrong_key_usage);
227
if(result->file_name != NULL){
228
fprintf(stderr, "File name: %s\n", result->file_name);
230
gpgme_recipient_t recipient;
231
recipient = result->recipients;
233
while(recipient != NULL){
234
fprintf(stderr, "Public key algorithm: %s\n",
235
gpgme_pubkey_algo_name(recipient->pubkey_algo));
236
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
237
fprintf(stderr, "Secret key available: %s\n",
238
recipient->status == GPG_ERR_NO_SECKEY
240
recipient = recipient->next;
162
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
166
gpgme_decrypt_result_t result;
167
result = gpgme_op_decrypt_result(ctx);
169
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
171
fprintf(stderr, "Unsupported algorithm: %s\n",
172
result->unsupported_algorithm);
173
fprintf(stderr, "Wrong key usage: %d\n",
174
result->wrong_key_usage);
175
if(result->file_name != NULL){
176
fprintf(stderr, "File name: %s\n", result->file_name);
178
gpgme_recipient_t recipient;
179
recipient = result->recipients;
181
while(recipient != NULL){
182
fprintf(stderr, "Public key algorithm: %s\n",
183
gpgme_pubkey_algo_name(recipient->pubkey_algo));
184
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
185
fprintf(stderr, "Secret key available: %s\n",
186
recipient->status == GPG_ERR_NO_SECKEY
188
recipient = recipient->next;
249
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
194
/* Delete the GPGME FILE pointer cryptotext data buffer */
195
gpgme_data_release(dh_crypto);
252
197
/* Seek back to the beginning of the GPGME plaintext data buffer */
253
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
254
perror("pgpme_data_seek");
255
plaintext_length = -1;
198
gpgme_data_seek(dh_plain, 0, SEEK_SET);
261
plaintext_capacity = adjustbuffer(plaintext,
262
(size_t)plaintext_length,
264
if (plaintext_capacity == 0){
265
perror("adjustbuffer");
266
plaintext_length = -1;
202
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
203
*new_packet = realloc(*new_packet,
204
(unsigned int)new_packet_capacity
206
if (*new_packet == NULL){
210
new_packet_capacity += BUFFER_SIZE;
270
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
213
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
272
215
/* Print the data, if any */
278
220
perror("gpgme_data_read");
279
plaintext_length = -1;
282
plaintext_length += ret;
286
fprintf(stderr, "Decrypted password is: ");
287
for(ssize_t i = 0; i < plaintext_length; i++){
288
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
290
fprintf(stderr, "\n");
295
/* Delete the GPGME cryptotext data buffer */
296
gpgme_data_release(dh_crypto);
223
new_packet_length += ret;
226
/* FIXME: check characters before printing to screen so to not print
227
terminal control characters */
229
/* fprintf(stderr, "decrypted password is: "); */
230
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
231
/* fprintf(stderr, "\n"); */
298
234
/* Delete the GPGME plaintext data buffer */
299
235
gpgme_data_release(dh_plain);
300
return plaintext_length;
236
return new_packet_length;
303
239
static const char * safer_gnutls_strerror (int value) {
304
const char *ret = gnutls_strerror (value); /* Spurious warning */
240
const char *ret = gnutls_strerror (value);
306
242
ret = "(unknown)";
310
/* GnuTLS log function callback */
311
static void debuggnutls(__attribute__((unused)) int level,
313
fprintf(stderr, "GnuTLS: %s", string);
246
void debuggnutls(__attribute__((unused)) int level,
248
fprintf(stderr, "%s", string);
316
static int init_gnutls_global(mandos_context *mc,
317
const char *pubkeyfilename,
318
const char *seckeyfilename){
251
int initgnutls(encrypted_session *es){
322
256
fprintf(stderr, "Initializing GnuTLS\n");
325
ret = gnutls_global_init();
326
if (ret != GNUTLS_E_SUCCESS) {
327
fprintf (stderr, "GnuTLS global_init: %s\n",
328
safer_gnutls_strerror(ret));
259
if ((ret = gnutls_global_init ())
260
!= GNUTLS_E_SUCCESS) {
261
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
333
/* "Use a log level over 10 to enable all debugging options."
336
266
gnutls_global_set_log_level(11);
337
267
gnutls_global_set_log_function(debuggnutls);
340
/* OpenPGP credentials */
341
gnutls_certificate_allocate_credentials(&mc->cred);
342
if (ret != GNUTLS_E_SUCCESS){
343
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
270
/* openpgp credentials */
271
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
272
!= GNUTLS_E_SUCCESS) {
273
fprintf (stderr, "memory error: %s\n",
345
274
safer_gnutls_strerror(ret));
346
gnutls_global_deinit ();
351
279
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
352
" and keyfile %s as GnuTLS credentials\n", pubkeyfilename,
280
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
356
284
ret = gnutls_certificate_set_openpgp_key_file
357
(mc->cred, pubkeyfilename, seckeyfilename,
358
GNUTLS_OPENPGP_FMT_BASE64);
285
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
359
286
if (ret != GNUTLS_E_SUCCESS) {
361
"Error[%d] while reading the OpenPGP key pair ('%s',"
362
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
363
fprintf(stdout, "The GnuTLS error is: %s\n",
288
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
290
ret, CERTFILE, KEYFILE);
291
fprintf(stdout, "The Error is: %s\n",
364
292
safer_gnutls_strerror(ret));
368
/* GnuTLS server initialization */
369
ret = gnutls_dh_params_init(&mc->dh_params);
370
if (ret != GNUTLS_E_SUCCESS) {
371
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
372
" %s\n", safer_gnutls_strerror(ret));
375
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
376
if (ret != GNUTLS_E_SUCCESS) {
377
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
378
safer_gnutls_strerror(ret));
382
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
388
gnutls_certificate_free_credentials(mc->cred);
389
gnutls_global_deinit();
393
static int init_gnutls_session(mandos_context *mc,
394
gnutls_session_t *session){
396
/* GnuTLS session creation */
397
ret = gnutls_init(session, GNUTLS_SERVER);
398
if (ret != GNUTLS_E_SUCCESS){
296
//GnuTLS server initialization
297
if ((ret = gnutls_dh_params_init (&es->dh_params))
298
!= GNUTLS_E_SUCCESS) {
299
fprintf (stderr, "Error in dh parameter initialization: %s\n",
300
safer_gnutls_strerror(ret));
304
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
305
!= GNUTLS_E_SUCCESS) {
306
fprintf (stderr, "Error in prime generation: %s\n",
307
safer_gnutls_strerror(ret));
311
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
313
// GnuTLS session creation
314
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
315
!= GNUTLS_E_SUCCESS){
399
316
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
400
317
safer_gnutls_strerror(ret));
405
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
406
if (ret != GNUTLS_E_SUCCESS) {
407
fprintf(stderr, "Syntax error at: %s\n", err);
408
fprintf(stderr, "GnuTLS error: %s\n",
409
safer_gnutls_strerror(ret));
410
gnutls_deinit (*session);
320
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
321
!= GNUTLS_E_SUCCESS) {
322
fprintf(stderr, "Syntax error at: %s\n", err);
323
fprintf(stderr, "GnuTLS error: %s\n",
324
safer_gnutls_strerror(ret));
415
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
417
if (ret != GNUTLS_E_SUCCESS) {
418
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
328
if ((ret = gnutls_credentials_set
329
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
330
!= GNUTLS_E_SUCCESS) {
331
fprintf(stderr, "Error setting a credentials set: %s\n",
419
332
safer_gnutls_strerror(ret));
420
gnutls_deinit (*session);
424
336
/* ignore client certificate if any. */
425
gnutls_certificate_server_set_request (*session,
337
gnutls_certificate_server_set_request (es->session,
426
338
GNUTLS_CERT_IGNORE);
428
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
340
gnutls_dh_set_prime_bits (es->session, DH_BITS);
433
/* Avahi log function callback */
434
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
435
__attribute__((unused)) const char *txt){}
345
void empty_log(__attribute__((unused)) AvahiLogLevel level,
346
__attribute__((unused)) const char *txt){}
437
/* Called when a Mandos server is found */
438
static int start_mandos_communication(const char *ip, uint16_t port,
439
AvahiIfIndex if_index,
348
int start_mandos_communication(char *ip, uint16_t port,
349
unsigned int if_index){
442
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
351
struct sockaddr_in6 to;
352
encrypted_session es;
443
353
char *buffer = NULL;
444
354
char *decrypted_buffer;
445
355
size_t buffer_length = 0;
446
356
size_t buffer_capacity = 0;
447
357
ssize_t decrypted_buffer_size;
450
359
char interface[IF_NAMESIZE];
451
gnutls_session_t session;
453
ret = init_gnutls_session (mc, &session);
459
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
362
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
463
365
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
470
if(if_indextoname((unsigned int)if_index, interface) == NULL){
371
if(if_indextoname(if_index, interface) == NULL){
471
373
perror("if_indextoname");
474
379
fprintf(stderr, "Binding to interface %s\n", interface);
477
memset(&to, 0, sizeof(to));
478
to.in6.sin6_family = AF_INET6;
479
/* It would be nice to have a way to detect if we were passed an
480
IPv4 address here. Now we assume an IPv6 address. */
481
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
382
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
384
perror("setsockopt bindtodevice");
388
memset(&to,0,sizeof(to));
389
to.sin6_family = AF_INET6;
390
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
483
392
perror("inet_pton");
487
396
fprintf(stderr, "Bad address: %s\n", ip);
490
to.in6.sin6_port = htons(port); /* Spurious warning */
399
/* Spurious warnings for the next line, see for instance
400
<http://bugs.debian.org/488884> */
401
to.sin6_port = htons(port);
492
to.in6.sin6_scope_id = (uint32_t)if_index;
403
to.sin6_scope_id = (uint32_t)if_index;
495
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
497
char addrstr[INET6_ADDRSTRLEN] = "";
498
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
499
sizeof(addrstr)) == NULL){
502
if(strcmp(addrstr, ip) != 0){
503
fprintf(stderr, "Canonical address form: %s\n", addrstr);
406
fprintf(stderr, "Connection to: %s\n", ip);
508
ret = connect(tcp_sd, &to.in, sizeof(to));
409
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
510
411
perror("connect");
514
const char *out = mandos_protocol_version;
517
size_t out_size = strlen(out);
518
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
519
out_size - written));
525
written += (size_t)ret;
526
if(written < out_size){
529
if (out == mandos_protocol_version){
415
ret = initgnutls (&es);
421
gnutls_transport_set_ptr (es.session,
422
(gnutls_transport_ptr_t) tcp_sd);
539
425
fprintf(stderr, "Establishing TLS session with %s\n", ip);
542
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
545
ret = gnutls_handshake (session);
546
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
428
ret = gnutls_handshake (es.session);
548
430
if (ret != GNUTLS_E_SUCCESS){
550
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
431
fprintf(stderr, "\n*** Handshake failed ***\n");
557
/* Read OpenPGP packet that contains the wanted password */
437
//Retrieve OpenPGP packet that contains the wanted password
560
440
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
565
buffer_capacity = adjustbuffer(&buffer, buffer_length,
567
if (buffer_capacity == 0){
568
perror("adjustbuffer");
445
if (buffer_length + BUFFER_SIZE > buffer_capacity){
446
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
451
buffer_capacity += BUFFER_SIZE;
573
ret = gnutls_record_recv(session, buffer+buffer_length,
454
ret = gnutls_record_recv
455
(es.session, buffer+buffer_length, BUFFER_SIZE);
631
written += (size_t)ret;
502
decrypted_buffer += ret;
503
decrypted_buffer_size -= ret;
633
505
free(decrypted_buffer);
641
/* Shutdown procedure */
514
fprintf(stderr, "Closing TLS session\n");
518
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
646
gnutls_deinit (session);
521
gnutls_deinit (es.session);
522
gnutls_certificate_free_credentials (es.cred);
523
gnutls_global_deinit ();
650
static void resolve_callback(AvahiSServiceResolver *r,
651
AvahiIfIndex interface,
652
AVAHI_GCC_UNUSED AvahiProtocol protocol,
653
AvahiResolverEvent event,
657
const char *host_name,
658
const AvahiAddress *address,
660
AVAHI_GCC_UNUSED AvahiStringList *txt,
661
AVAHI_GCC_UNUSED AvahiLookupResultFlags
664
mandos_context *mc = userdata;
527
static AvahiSimplePoll *simple_poll = NULL;
528
static AvahiServer *server = NULL;
530
static void resolve_callback(
531
AvahiSServiceResolver *r,
532
AVAHI_GCC_UNUSED AvahiIfIndex interface,
533
AVAHI_GCC_UNUSED AvahiProtocol protocol,
534
AvahiResolverEvent event,
538
const char *host_name,
539
const AvahiAddress *address,
541
AVAHI_GCC_UNUSED AvahiStringList *txt,
542
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
543
AVAHI_GCC_UNUSED void* userdata) {
667
547
/* Called whenever a service has been resolved successfully or
672
552
case AVAHI_RESOLVER_FAILURE:
673
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
674
" of type '%s' in domain '%s': %s\n", name, type, domain,
675
avahi_strerror(avahi_server_errno(mc->server)));
553
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
554
" type '%s' in domain '%s': %s\n", name, type, domain,
555
avahi_strerror(avahi_server_errno(server)));
678
558
case AVAHI_RESOLVER_FOUND:
680
560
char ip[AVAHI_ADDRESS_STR_MAX];
681
561
avahi_address_snprint(ip, sizeof(ip), address);
683
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
684
PRIu16 ") on port %d\n", name, host_name, ip,
563
fprintf(stderr, "Mandos server found on %s (%s) on port %d\n",
564
host_name, ip, port);
687
int ret = start_mandos_communication(ip, port, interface, mc);
566
int ret = start_mandos_communication(ip, port,
689
avahi_simple_poll_quit(mc->simple_poll);
693
576
avahi_s_service_resolver_free(r);
696
static void browse_callback( AvahiSServiceBrowser *b,
697
AvahiIfIndex interface,
698
AvahiProtocol protocol,
699
AvahiBrowserEvent event,
703
AVAHI_GCC_UNUSED AvahiLookupResultFlags
706
mandos_context *mc = userdata;
709
/* Called whenever a new services becomes available on the LAN or
710
is removed from the LAN */
714
case AVAHI_BROWSER_FAILURE:
716
fprintf(stderr, "(Avahi browser) %s\n",
717
avahi_strerror(avahi_server_errno(mc->server)));
718
avahi_simple_poll_quit(mc->simple_poll);
721
case AVAHI_BROWSER_NEW:
722
/* We ignore the returned Avahi resolver object. In the callback
723
function we free it. If the Avahi server is terminated before
724
the callback function is called the Avahi server will free the
727
if (!(avahi_s_service_resolver_new(mc->server, interface,
728
protocol, name, type, domain,
729
AVAHI_PROTO_INET6, 0,
730
resolve_callback, mc)))
731
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
732
name, avahi_strerror(avahi_server_errno(mc->server)));
735
case AVAHI_BROWSER_REMOVE:
738
case AVAHI_BROWSER_ALL_FOR_NOW:
739
case AVAHI_BROWSER_CACHE_EXHAUSTED:
741
fprintf(stderr, "No Mandos server found, still searching...\n");
579
static void browse_callback(
580
AvahiSServiceBrowser *b,
581
AvahiIfIndex interface,
582
AvahiProtocol protocol,
583
AvahiBrowserEvent event,
587
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
590
AvahiServer *s = userdata;
593
/* Called whenever a new services becomes available on the LAN or
594
is removed from the LAN */
598
case AVAHI_BROWSER_FAILURE:
600
fprintf(stderr, "(Browser) %s\n",
601
avahi_strerror(avahi_server_errno(server)));
602
avahi_simple_poll_quit(simple_poll);
605
case AVAHI_BROWSER_NEW:
606
/* We ignore the returned resolver object. In the callback
607
function we free it. If the server is terminated before
608
the callback function is called the server will free
609
the resolver for us. */
611
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
613
AVAHI_PROTO_INET6, 0,
614
resolve_callback, s)))
615
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
616
avahi_strerror(avahi_server_errno(s)));
619
case AVAHI_BROWSER_REMOVE:
622
case AVAHI_BROWSER_ALL_FOR_NOW:
623
case AVAHI_BROWSER_CACHE_EXHAUSTED:
747
/* Combines file name and path and returns the malloced new
748
string. some sane checks could/should be added */
749
static char *combinepath(const char *first, const char *second){
751
int ret = asprintf(&tmp, "%s/%s", first, second);
759
int main(int argc, char *argv[]){
628
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
629
AvahiServerConfig config;
760
630
AvahiSServiceBrowser *sb = NULL;
763
int exitcode = EXIT_SUCCESS;
633
int returncode = EXIT_SUCCESS;
764
634
const char *interface = "eth0";
765
struct ifreq network;
769
char *connect_to = NULL;
770
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
771
char *pubkeyfilename = NULL;
772
char *seckeyfilename = NULL;
773
const char *pubkeyname = "pubkey.txt";
774
const char *seckeyname = "seckey.txt";
775
mandos_context mc = { .simple_poll = NULL, .server = NULL,
776
.dh_bits = 1024, .priority = "SECURE256"
777
":!CTYPE-X.509:+CTYPE-OPENPGP" };
778
bool gnutls_initalized = false;
781
struct argp_option options[] = {
782
{ .name = "debug", .key = 128,
783
.doc = "Debug mode", .group = 3 },
784
{ .name = "connect", .key = 'c',
785
.arg = "ADDRESS:PORT",
786
.doc = "Connect directly to a specific Mandos server",
788
{ .name = "interface", .key = 'i',
790
.doc = "Interface that will be used to search for Mandos"
793
{ .name = "keydir", .key = 'd',
795
.doc = "Directory to read the OpenPGP key files from",
797
{ .name = "seckey", .key = 's',
799
.doc = "OpenPGP secret key file base name",
801
{ .name = "pubkey", .key = 'p',
803
.doc = "OpenPGP public key file base name",
805
{ .name = "dh-bits", .key = 129,
807
.doc = "Bit length of the prime number used in the"
808
" Diffie-Hellman key exchange",
810
{ .name = "priority", .key = 130,
812
.doc = "GnuTLS priority string for the TLS handshake",
817
error_t parse_opt (int key, char *arg,
818
struct argp_state *state) {
819
/* Get the INPUT argument from `argp_parse', which we know is
820
a pointer to our plugin list pointer. */
822
case 128: /* --debug */
825
case 'c': /* --connect */
828
case 'i': /* --interface */
831
case 'd': /* --keydir */
834
case 's': /* --seckey */
837
case 'p': /* --pubkey */
840
case 129: /* --dh-bits */
842
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
848
case 130: /* --priority */
856
return ARGP_ERR_UNKNOWN;
861
struct argp argp = { .options = options, .parser = parse_opt,
863
.doc = "Mandos client -- Get and decrypt"
864
" passwords from a Mandos server" };
865
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
866
if (ret == ARGP_ERR_UNKNOWN){
867
fprintf(stderr, "Unknown error while parsing arguments\n");
868
exitcode = EXIT_FAILURE;
873
pubkeyfilename = combinepath(keydir, pubkeyname);
874
if (pubkeyfilename == NULL){
875
perror("combinepath");
876
exitcode = EXIT_FAILURE;
880
seckeyfilename = combinepath(keydir, seckeyname);
881
if (seckeyfilename == NULL){
882
perror("combinepath");
883
exitcode = EXIT_FAILURE;
887
ret = init_gnutls_global(&mc, pubkeyfilename, seckeyfilename);
889
fprintf(stderr, "init_gnutls_global failed\n");
890
exitcode = EXIT_FAILURE;
893
gnutls_initalized = true;
896
/* If the interface is down, bring it up */
898
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
901
exitcode = EXIT_FAILURE;
904
strcpy(network.ifr_name, interface);
905
ret = ioctl(sd, SIOCGIFFLAGS, &network);
907
perror("ioctl SIOCGIFFLAGS");
908
exitcode = EXIT_FAILURE;
911
if((network.ifr_flags & IFF_UP) == 0){
912
network.ifr_flags |= IFF_UP;
913
ret = ioctl(sd, SIOCSIFFLAGS, &network);
915
perror("ioctl SIOCSIFFLAGS");
916
exitcode = EXIT_FAILURE;
936
if_index = (AvahiIfIndex) if_nametoindex(interface);
938
fprintf(stderr, "No such interface: \"%s\"\n", interface);
942
if(connect_to != NULL){
943
/* Connect directly, do not use Zeroconf */
944
/* (Mainly meant for debugging) */
945
char *address = strrchr(connect_to, ':');
947
fprintf(stderr, "No colon in address\n");
948
exitcode = EXIT_FAILURE;
952
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
954
perror("Bad port number");
955
exitcode = EXIT_FAILURE;
959
address = connect_to;
960
ret = start_mandos_communication(address, port, if_index, &mc);
962
exitcode = EXIT_FAILURE;
964
exitcode = EXIT_SUCCESS;
637
static struct option long_options[] = {
638
{"debug", no_argument, (int *)&debug, 1},
639
{"interface", required_argument, 0, 'i'},
642
int option_index = 0;
643
ret = getopt_long (argc, argv, "i:", long_options,
970
662
avahi_set_log_function(empty_log);
973
/* Initialize the pseudo-RNG for Avahi */
665
/* Initialize the psuedo-RNG */
974
666
srand((unsigned int) time(NULL));
976
/* Allocate main Avahi loop object */
977
mc.simple_poll = avahi_simple_poll_new();
978
if (mc.simple_poll == NULL) {
979
fprintf(stderr, "Avahi: Failed to create simple poll"
981
exitcode = EXIT_FAILURE;
986
AvahiServerConfig config;
987
/* Do not publish any local Zeroconf records */
988
avahi_server_config_init(&config);
989
config.publish_hinfo = 0;
990
config.publish_addresses = 0;
991
config.publish_workstation = 0;
992
config.publish_domain = 0;
994
/* Allocate a new server */
995
mc.server = avahi_server_new(avahi_simple_poll_get
996
(mc.simple_poll), &config, NULL,
999
/* Free the Avahi configuration data */
1000
avahi_server_config_free(&config);
1003
/* Check if creating the Avahi server object succeeded */
1004
if (mc.server == NULL) {
1005
fprintf(stderr, "Failed to create Avahi server: %s\n",
668
/* Allocate main loop object */
669
if (!(simple_poll = avahi_simple_poll_new())) {
670
fprintf(stderr, "Failed to create simple poll object.\n");
675
/* Do not publish any local records */
676
avahi_server_config_init(&config);
677
config.publish_hinfo = 0;
678
config.publish_addresses = 0;
679
config.publish_workstation = 0;
680
config.publish_domain = 0;
682
/* Allocate a new server */
683
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
684
&config, NULL, NULL, &error);
686
/* Free the configuration data */
687
avahi_server_config_free(&config);
689
/* Check if creating the server object succeeded */
691
fprintf(stderr, "Failed to create server: %s\n",
1006
692
avahi_strerror(error));
1007
exitcode = EXIT_FAILURE;
693
returncode = EXIT_FAILURE;
1011
/* Create the Avahi service browser */
1012
sb = avahi_s_service_browser_new(mc.server, if_index,
697
/* Create the service browser */
698
sb = avahi_s_service_browser_new(server,
700
if_nametoindex(interface),
1013
701
AVAHI_PROTO_INET6,
1014
702
"_mandos._tcp", NULL, 0,
1015
browse_callback, &mc);
703
browse_callback, server);
1017
705
fprintf(stderr, "Failed to create service browser: %s\n",
1018
avahi_strerror(avahi_server_errno(mc.server)));
1019
exitcode = EXIT_FAILURE;
706
avahi_strerror(avahi_server_errno(server)));
707
returncode = EXIT_FAILURE;
1023
711
/* Run the main loop */
1026
fprintf(stderr, "Starting Avahi loop search\n");
714
fprintf(stderr, "Starting avahi loop search\n");
1029
avahi_simple_poll_loop(mc.simple_poll);
717
avahi_simple_poll_loop(simple_poll);
1034
722
fprintf(stderr, "%s exiting\n", argv[0]);
1037
725
/* Cleanup things */
1039
727
avahi_s_service_browser_free(sb);
1041
if (mc.server != NULL)
1042
avahi_server_free(mc.server);
1044
if (mc.simple_poll != NULL)
1045
avahi_simple_poll_free(mc.simple_poll);
1046
free(pubkeyfilename);
1047
free(seckeyfilename);
1049
if (gnutls_initalized){
1050
gnutls_certificate_free_credentials(mc.cred);
1051
gnutls_global_deinit ();
730
avahi_server_free(server);
733
avahi_simple_poll_free(simple_poll);