47
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
49
sockaddr_in6, PF_INET6,
49
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
#include <inttypes.h> /* PRIu16 */
51
uid_t, gid_t, open(), opendir(), DIR */
52
#include <sys/stat.h> /* open() */
52
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
54
struct in6_addr, inet_pton(),
56
#include <fcntl.h> /* open() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16 */
55
59
#include <assert.h> /* assert() */
56
60
#include <errno.h> /* perror(), errno */
57
61
#include <time.h> /* time() */
58
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
59
63
SIOCSIFFLAGS, if_indextoname(),
60
64
if_nametoindex(), IF_NAMESIZE */
65
#include <netinet/in.h>
61
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
62
67
getuid(), getgid(), setuid(),
64
#include <netinet/in.h>
65
69
#include <arpa/inet.h> /* inet_pton(), htons */
66
70
#include <iso646.h> /* not, and */
67
71
#include <argp.h> /* struct argp_option, error_t, struct
99
103
#define BUFFER_SIZE 256
105
#define PATHDIR "/conf/conf.d/mandos"
106
#define SECKEY "seckey.txt"
107
#define PUBKEY "pubkey.txt"
101
109
bool debug = false;
102
static const char *keydir = "/conf/conf.d/mandos";
103
110
static const char mandos_protocol_version[] = "1";
104
const char *argp_program_version = "password-request 1.0";
111
const char *argp_program_version = "mandos-client " VERSION;
105
112
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
107
114
/* Used for passing in values through the Avahi callback functions */
135
* Decrypt OpenPGP data using keyrings in HOMEDIR.
136
* Returns -1 on error
138
static ssize_t pgp_packet_decrypt (const char *cryptotext,
141
const char *homedir){
142
gpgme_data_t dh_crypto, dh_plain;
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
146
const char *pubkey, const char *tempdir){
144
148
gpgme_error_t rc;
146
size_t plaintext_capacity = 0;
147
ssize_t plaintext_length = 0;
148
149
gpgme_engine_info_t engine_info;
153
* Helper function to insert pub and seckey to the enigne keyring.
155
bool import_key(const char *filename){
157
gpgme_data_t pgp_data;
159
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
166
if (rc != GPG_ERR_NO_ERROR){
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
168
gpgme_strsource(rc), gpgme_strerror(rc));
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
175
gpgme_strsource(rc), gpgme_strerror(rc));
179
ret = TEMP_FAILURE_RETRY(close(fd));
183
gpgme_data_release(pgp_data);
151
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
188
fprintf(stderr, "Initialize gpgme\n");
157
194
if (rc != GPG_ERR_NO_ERROR){
158
195
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
159
196
gpgme_strsource(rc), gpgme_strerror(rc));
163
/* Set GPGME home directory for the OpenPGP engine only */
200
/* Set GPGME home directory for the OpenPGP engine only */
164
201
rc = gpgme_get_engine_info (&engine_info);
165
202
if (rc != GPG_ERR_NO_ERROR){
166
203
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
167
204
gpgme_strsource(rc), gpgme_strerror(rc));
170
207
while(engine_info != NULL){
171
208
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
172
209
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
173
engine_info->file_name, homedir);
210
engine_info->file_name, tempdir);
176
213
engine_info = engine_info->next;
178
215
if(engine_info == NULL){
179
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
216
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
220
/* Create new GPGME "context" */
221
rc = gpgme_new(&(mc->ctx));
222
if (rc != GPG_ERR_NO_ERROR){
223
fprintf(stderr, "bad gpgme_new: %s: %s\n",
224
gpgme_strsource(rc), gpgme_strerror(rc));
228
if (not import_key(pubkey) or not import_key(seckey)){
236
* Decrypt OpenPGP data.
237
* Returns -1 on error
239
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
240
const char *cryptotext,
243
gpgme_data_t dh_crypto, dh_plain;
246
size_t plaintext_capacity = 0;
247
ssize_t plaintext_length = 0;
250
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
183
253
/* Create new GPGME data buffer from memory cryptotext */
201
/* Create new GPGME "context" */
202
rc = gpgme_new(&ctx);
203
if (rc != GPG_ERR_NO_ERROR){
204
fprintf(stderr, "bad gpgme_new: %s: %s\n",
205
gpgme_strsource(rc), gpgme_strerror(rc));
206
plaintext_length = -1;
210
271
/* Decrypt data from the cryptotext data buffer to the plaintext
212
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
213
274
if (rc != GPG_ERR_NO_ERROR){
214
275
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
215
276
gpgme_strsource(rc), gpgme_strerror(rc));
216
277
plaintext_length = -1;
279
gpgme_decrypt_result_t result;
280
result = gpgme_op_decrypt_result(mc->ctx);
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
284
fprintf(stderr, "Unsupported algorithm: %s\n",
285
result->unsupported_algorithm);
286
fprintf(stderr, "Wrong key usage: %u\n",
287
result->wrong_key_usage);
288
if(result->file_name != NULL){
289
fprintf(stderr, "File name: %s\n", result->file_name);
291
gpgme_recipient_t recipient;
292
recipient = result->recipients;
294
while(recipient != NULL){
295
fprintf(stderr, "Public key algorithm: %s\n",
296
gpgme_pubkey_algo_name(recipient->pubkey_algo));
297
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
298
fprintf(stderr, "Secret key available: %s\n",
299
recipient->status == GPG_ERR_NO_SECKEY
301
recipient = recipient->next;
217
306
goto decrypt_end;
221
310
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
225
gpgme_decrypt_result_t result;
226
result = gpgme_op_decrypt_result(ctx);
228
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
230
fprintf(stderr, "Unsupported algorithm: %s\n",
231
result->unsupported_algorithm);
232
fprintf(stderr, "Wrong key usage: %u\n",
233
result->wrong_key_usage);
234
if(result->file_name != NULL){
235
fprintf(stderr, "File name: %s\n", result->file_name);
237
gpgme_recipient_t recipient;
238
recipient = result->recipients;
240
while(recipient != NULL){
241
fprintf(stderr, "Public key algorithm: %s\n",
242
gpgme_pubkey_algo_name(recipient->pubkey_algo));
243
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
244
fprintf(stderr, "Secret key available: %s\n",
245
recipient->status == GPG_ERR_NO_SECKEY
247
recipient = recipient->next;
253
313
/* Seek back to the beginning of the GPGME plaintext data buffer */
254
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
255
perror("pgpme_data_seek");
315
perror("gpgme_data_seek");
256
316
plaintext_length = -1;
257
317
goto decrypt_end;
771
821
char *connect_to = NULL;
822
char tempdir[] = "/tmp/mandosXXXXXX";
772
823
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
773
char *pubkeyfilename = NULL;
774
char *seckeyfilename = NULL;
775
const char *pubkeyname = "pubkey.txt";
776
const char *seckeyname = "seckey.txt";
824
const char *seckey = PATHDIR "/" SECKEY;
825
const char *pubkey = PATHDIR "/" PUBKEY;
777
827
mandos_context mc = { .simple_poll = NULL, .server = NULL,
778
.dh_bits = 1024, .priority = "SECURE256"};
828
.dh_bits = 1024, .priority = "SECURE256"
829
":!CTYPE-X.509:+CTYPE-OPENPGP" };
779
830
bool gnutls_initalized = false;
831
bool gpgme_initalized = false;
782
834
struct argp_option options[] = {
783
835
{ .name = "debug", .key = 128,
784
836
.doc = "Debug mode", .group = 3 },
785
837
{ .name = "connect", .key = 'c',
787
.doc = "Connect directly to a sepcified mandos server",
838
.arg = "ADDRESS:PORT",
839
.doc = "Connect directly to a specific Mandos server",
789
841
{ .name = "interface", .key = 'i',
791
.doc = "Interface that Avahi will conntect through",
793
{ .name = "keydir", .key = 'd',
795
.doc = "Directory where the openpgp keyring is",
843
.doc = "Interface that will be used to search for Mandos"
797
846
{ .name = "seckey", .key = 's',
799
.doc = "Secret openpgp key for gnutls authentication",
848
.doc = "OpenPGP secret key file base name",
801
850
{ .name = "pubkey", .key = 'p',
803
.doc = "Public openpgp key for gnutls authentication",
852
.doc = "OpenPGP public key file base name",
805
854
{ .name = "dh-bits", .key = 129,
807
.doc = "dh-bits to use in gnutls communication",
856
.doc = "Bit length of the prime number used in the"
857
" Diffie-Hellman key exchange",
809
859
{ .name = "priority", .key = 130,
811
.doc = "GNUTLS priority", .group = 1 },
861
.doc = "GnuTLS priority string for the TLS handshake",
816
866
error_t parse_opt (int key, char *arg,
817
867
struct argp_state *state) {
818
868
/* Get the INPUT argument from `argp_parse', which we know is
819
869
a pointer to our plugin list pointer. */
871
case 128: /* --debug */
874
case 'c': /* --connect */
825
875
connect_to = arg;
877
case 'i': /* --interface */
880
case 's': /* --seckey */
883
case 'p': /* --pubkey */
886
case 129: /* --dh-bits */
841
888
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
860
907
struct argp argp = { .options = options, .parser = parse_opt,
862
909
.doc = "Mandos client -- Get and decrypt"
863
" passwords from mandos server" };
910
" passwords from a Mandos server" };
864
911
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
865
912
if (ret == ARGP_ERR_UNKNOWN){
866
913
fprintf(stderr, "Unknown error while parsing arguments\n");
872
pubkeyfilename = combinepath(keydir, pubkeyname);
873
if (pubkeyfilename == NULL){
874
perror("combinepath");
875
exitcode = EXIT_FAILURE;
879
seckeyfilename = combinepath(keydir, seckeyname);
880
if (seckeyfilename == NULL){
881
perror("combinepath");
882
exitcode = EXIT_FAILURE;
886
ret = init_gnutls_global(&mc, pubkeyfilename, seckeyfilename);
888
fprintf(stderr, "init_gnutls_global failed\n");
889
exitcode = EXIT_FAILURE;
892
gnutls_initalized = true;
895
919
/* If the interface is down, bring it up */
932
959
perror("setgid");
962
ret = init_gnutls_global(&mc, pubkey, seckey);
964
fprintf(stderr, "init_gnutls_global failed\n");
965
exitcode = EXIT_FAILURE;
968
gnutls_initalized = true;
971
if(mkdtemp(tempdir) == NULL){
977
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
978
fprintf(stderr, "gpgme_initalized failed\n");
979
exitcode = EXIT_FAILURE;
982
gpgme_initalized = true;
935
985
if_index = (AvahiIfIndex) if_nametoindex(interface);
936
986
if(if_index == 0){
937
987
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1040
1090
if (mc.server != NULL)
1041
1091
avahi_server_free(mc.server);
1043
1093
if (mc.simple_poll != NULL)
1044
1094
avahi_simple_poll_free(mc.simple_poll);
1045
free(pubkeyfilename);
1046
free(seckeyfilename);
1048
1096
if (gnutls_initalized){
1049
1097
gnutls_certificate_free_credentials(mc.cred);
1050
1098
gnutls_global_deinit ();
1099
gnutls_dh_params_deinit(mc.dh_params);
1102
if(gpgme_initalized){
1103
gpgme_release(mc.ctx);
1106
/* Removes the temp directory used by GPGME */
1107
if(tempdir[0] != '\0'){
1109
struct dirent *direntry;
1110
d = opendir(tempdir);
1115
direntry = readdir(d);
1116
if(direntry == NULL){
1119
if (direntry->d_type == DT_REG){
1120
char *fullname = NULL;
1121
ret = asprintf(&fullname, "%s/%s", tempdir,
1127
ret = unlink(fullname);
1129
fprintf(stderr, "unlink(\"%s\"): %s",
1130
fullname, strerror(errno));
1137
ret = rmdir(tempdir);
1053
1143
return exitcode;