To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.2.126
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.126
- Committer: Teddy Hogeborn
- Date: 2009-09-07 07:48:59 UTC
- mto: (24.1.140 mandos) (237.12.2 mandos-persistent) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 264.
- Revision ID: teddy@fukt.bsnet.se-20090907074859-nv2nni1wwib5hi10
* plugin-runner.c: Minor stylistic changes.
* plugins.d/askpass-fifo.c: Changed contact information and did minor
stylistic changes.
* plugins.d/mandos-client.c: Minor stylistic changes.
* plugins.d/password-prompt.c: Changed contact information.
* plugins.d/splashy.c: Changed contact information.
(main): Changed error handling design. Bug fix: Will now be much
more tolerant against signals. Bug fix: Will now re-raise
signal received.
* plugins.d/usplash.c: Changed contact information and did minor
stylistic changes.
* plugins.d/askpass-fifo.c: Changed contact information and did minor
stylistic changes.
* plugins.d/mandos-client.c: Minor stylistic changes.
* plugins.d/password-prompt.c: Changed contact information.
* plugins.d/splashy.c: Changed contact information.
(main): Changed error handling design. Bug fix: Will now be much
more tolerant against signals. Bug fix: Will now re-raise
signal received.
* plugins.d/usplash.c: Changed contact information and did minor
stylistic changes.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
29
30
*/
30
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
32
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
33
37
#define _FILE_OFFSET_BITS 64
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), setuid(),
75
setgid() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
90
/* Avahi */
91
/* All Avahi types, constants and functions
92
Avahi*, avahi_*,
93
AVAHI_* */
41
94
#include <avahi-core/core.h>
42
95
#include <avahi-core/lookup.h>
43
96
#include <avahi-core/log.h>
45
98
#include <avahi-common/malloc.h>
46
99
#include <avahi-common/error.h>
47
100
48
//mandos client part
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
// getopt long
67
#include <getopt.h>
101
/* GnuTLS */
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
103
functions:
104
gnutls_*
105
init_gnutls_session(),
106
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
110
111
/* GPGME */
112
#include <gpgme.h> /* All GPGME types, constants and
113
functions:
114
gpgme_*
115
GPGME_PROTOCOL_OpenPGP,
116
GPG_ERR_NO_* */
68
117
69
118
#define BUFFER_SIZE 256
70
#define DH_BITS 1024
71
119
72
const char *certdir = "/conf/conf.d/cryptkeyreq/";
73
const char *certfile = "openpgp-client.txt";
74
const char *certkey = "openpgp-client-key.txt";
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
75
123
76
124
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
77
128
129
/* Used for passing in values through the Avahi callback functions */
78
130
typedef struct {
79
gnutls_session_t session;
131
AvahiSimplePoll *simple_poll;
132
AvahiServer *server;
80
133
gnutls_certificate_credentials_t cred;
134
unsigned int dh_bits;
81
135
gnutls_dh_params_t dh_params;
82
} encrypted_session;
83
84
85
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
86
char **new_packet, const char *homedir){
87
gpgme_data_t dh_crypto, dh_plain;
136
const char *priority;
88
137
gpgme_ctx_t ctx;
138
} mandos_context;
139
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
/*
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
* bytes. "buffer_capacity" is how much is currently allocated,
148
* "buffer_length" is how much is already used.
149
*/
150
size_t incbuffer(char **buffer, size_t buffer_length,
151
size_t buffer_capacity){
152
if(buffer_length + BUFFER_SIZE > buffer_capacity){
153
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
154
if(buffer == NULL){
155
return 0;
156
}
157
buffer_capacity += BUFFER_SIZE;
158
}
159
return buffer_capacity;
160
}
161
162
/*
163
* Initialize GPGME.
164
*/
165
static bool init_gpgme(const char *seckey,
166
const char *pubkey, const char *tempdir){
89
167
gpgme_error_t rc;
90
ssize_t ret;
91
ssize_t new_packet_capacity = 0;
92
ssize_t new_packet_length = 0;
93
168
gpgme_engine_info_t engine_info;
94
95
if (debug){
96
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
169
170
171
/*
172
* Helper function to insert pub and seckey to the engine keyring.
173
*/
174
bool import_key(const char *filename){
175
int ret;
176
int fd;
177
gpgme_data_t pgp_data;
178
179
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
180
if(fd == -1){
181
perror("open");
182
return false;
183
}
184
185
rc = gpgme_data_new_from_fd(&pgp_data, fd);
186
if(rc != GPG_ERR_NO_ERROR){
187
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
188
gpgme_strsource(rc), gpgme_strerror(rc));
189
return false;
190
}
191
192
rc = gpgme_op_import(mc.ctx, pgp_data);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
196
return false;
197
}
198
199
ret = (int)TEMP_FAILURE_RETRY(close(fd));
200
if(ret == -1){
201
perror("close");
202
}
203
gpgme_data_release(pgp_data);
204
return true;
205
}
206
207
if(debug){
208
fprintf(stderr, "Initializing GPGME\n");
97
209
}
98
210
99
211
/* Init GPGME */
100
212
gpgme_check_version(NULL);
101
213
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
102
if (rc != GPG_ERR_NO_ERROR){
214
if(rc != GPG_ERR_NO_ERROR){
103
215
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
104
216
gpgme_strsource(rc), gpgme_strerror(rc));
105
return -1;
217
return false;
106
218
}
107
219
108
/* Set GPGME home directory */
109
rc = gpgme_get_engine_info (&engine_info);
110
if (rc != GPG_ERR_NO_ERROR){
220
/* Set GPGME home directory for the OpenPGP engine only */
221
rc = gpgme_get_engine_info(&engine_info);
222
if(rc != GPG_ERR_NO_ERROR){
111
223
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
112
224
gpgme_strsource(rc), gpgme_strerror(rc));
113
return -1;
225
return false;
114
226
}
115
227
while(engine_info != NULL){
116
228
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
117
229
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
118
engine_info->file_name, homedir);
230
engine_info->file_name, tempdir);
119
231
break;
120
232
}
121
233
engine_info = engine_info->next;
122
234
}
123
235
if(engine_info == NULL){
124
fprintf(stderr, "Could not set home dir to %s\n", homedir);
125
return -1;
126
}
127
128
/* Create new GPGME data buffer from packet buffer */
129
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
130
if (rc != GPG_ERR_NO_ERROR){
236
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
237
return false;
238
}
239
240
/* Create new GPGME "context" */
241
rc = gpgme_new(&(mc.ctx));
242
if(rc != GPG_ERR_NO_ERROR){
243
fprintf(stderr, "bad gpgme_new: %s: %s\n",
244
gpgme_strsource(rc), gpgme_strerror(rc));
245
return false;
246
}
247
248
if(not import_key(pubkey) or not import_key(seckey)){
249
return false;
250
}
251
252
return true;
253
}
254
255
/*
256
* Decrypt OpenPGP data.
257
* Returns -1 on error
258
*/
259
static ssize_t pgp_packet_decrypt(const char *cryptotext,
260
size_t crypto_size,
261
char **plaintext){
262
gpgme_data_t dh_crypto, dh_plain;
263
gpgme_error_t rc;
264
ssize_t ret;
265
size_t plaintext_capacity = 0;
266
ssize_t plaintext_length = 0;
267
268
if(debug){
269
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
270
}
271
272
/* Create new GPGME data buffer from memory cryptotext */
273
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
274
0);
275
if(rc != GPG_ERR_NO_ERROR){
131
276
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
132
277
gpgme_strsource(rc), gpgme_strerror(rc));
133
278
return -1;
135
280
136
281
/* Create new empty GPGME data buffer for the plaintext */
137
282
rc = gpgme_data_new(&dh_plain);
138
if (rc != GPG_ERR_NO_ERROR){
283
if(rc != GPG_ERR_NO_ERROR){
139
284
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
140
285
gpgme_strsource(rc), gpgme_strerror(rc));
141
return -1;
142
}
143
144
/* Create new GPGME "context" */
145
rc = gpgme_new(&ctx);
146
if (rc != GPG_ERR_NO_ERROR){
147
fprintf(stderr, "bad gpgme_new: %s: %s\n",
148
gpgme_strsource(rc), gpgme_strerror(rc));
149
return -1;
150
}
151
152
/* Decrypt data from the FILE pointer to the plaintext data
153
buffer */
154
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
155
if (rc != GPG_ERR_NO_ERROR){
286
gpgme_data_release(dh_crypto);
287
return -1;
288
}
289
290
/* Decrypt data from the cryptotext data buffer to the plaintext
291
data buffer */
292
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
293
if(rc != GPG_ERR_NO_ERROR){
156
294
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
157
295
gpgme_strsource(rc), gpgme_strerror(rc));
158
return -1;
159
}
160
161
if(debug){
162
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
163
}
164
165
if (debug){
166
gpgme_decrypt_result_t result;
167
result = gpgme_op_decrypt_result(ctx);
168
if (result == NULL){
169
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
170
} else {
171
fprintf(stderr, "Unsupported algorithm: %s\n",
172
result->unsupported_algorithm);
173
fprintf(stderr, "Wrong key usage: %d\n",
174
result->wrong_key_usage);
175
if(result->file_name != NULL){
176
fprintf(stderr, "File name: %s\n", result->file_name);
177
}
178
gpgme_recipient_t recipient;
179
recipient = result->recipients;
180
if(recipient){
296
plaintext_length = -1;
297
if(debug){
298
gpgme_decrypt_result_t result;
299
result = gpgme_op_decrypt_result(mc.ctx);
300
if(result == NULL){
301
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
302
} else {
303
fprintf(stderr, "Unsupported algorithm: %s\n",
304
result->unsupported_algorithm);
305
fprintf(stderr, "Wrong key usage: %u\n",
306
result->wrong_key_usage);
307
if(result->file_name != NULL){
308
fprintf(stderr, "File name: %s\n", result->file_name);
309
}
310
gpgme_recipient_t recipient;
311
recipient = result->recipients;
181
312
while(recipient != NULL){
182
313
fprintf(stderr, "Public key algorithm: %s\n",
183
314
gpgme_pubkey_algo_name(recipient->pubkey_algo));
189
320
}
190
321
}
191
322
}
323
goto decrypt_end;
192
324
}
193
325
194
/* Delete the GPGME FILE pointer cryptotext data buffer */
195
gpgme_data_release(dh_crypto);
326
if(debug){
327
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
328
}
196
329
197
330
/* Seek back to the beginning of the GPGME plaintext data buffer */
198
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
199
perror("pgpme_data_seek");
331
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
332
perror("gpgme_data_seek");
333
plaintext_length = -1;
334
goto decrypt_end;
200
335
}
201
336
202
*new_packet = 0;
337
*plaintext = NULL;
203
338
while(true){
204
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
205
*new_packet = realloc(*new_packet,
206
(unsigned int)new_packet_capacity
207
+ BUFFER_SIZE);
208
if (*new_packet == NULL){
209
perror("realloc");
210
return -1;
211
}
212
new_packet_capacity += BUFFER_SIZE;
339
plaintext_capacity = incbuffer(plaintext,
340
(size_t)plaintext_length,
341
plaintext_capacity);
342
if(plaintext_capacity == 0){
343
perror("incbuffer");
344
plaintext_length = -1;
345
goto decrypt_end;
213
346
}
214
347
215
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
348
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
216
349
BUFFER_SIZE);
217
350
/* Print the data, if any */
218
if (ret == 0){
351
if(ret == 0){
352
/* EOF */
219
353
break;
220
354
}
221
355
if(ret < 0){
222
356
perror("gpgme_data_read");
223
return -1;
224
}
225
new_packet_length += ret;
226
}
227
228
/* FIXME: check characters before printing to screen so to not print
229
terminal control characters */
230
/* if(debug){ */
231
/* fprintf(stderr, "decrypted password is: "); */
232
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
233
/* fprintf(stderr, "\n"); */
234
/* } */
357
plaintext_length = -1;
358
goto decrypt_end;
359
}
360
plaintext_length += ret;
361
}
362
363
if(debug){
364
fprintf(stderr, "Decrypted password is: ");
365
for(ssize_t i = 0; i < plaintext_length; i++){
366
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
367
}
368
fprintf(stderr, "\n");
369
}
370
371
decrypt_end:
372
373
/* Delete the GPGME cryptotext data buffer */
374
gpgme_data_release(dh_crypto);
235
375
236
376
/* Delete the GPGME plaintext data buffer */
237
377
gpgme_data_release(dh_plain);
238
return new_packet_length;
378
return plaintext_length;
239
379
}
240
380
241
static const char * safer_gnutls_strerror (int value) {
242
const char *ret = gnutls_strerror (value);
243
if (ret == NULL)
381
static const char * safer_gnutls_strerror(int value){
382
const char *ret = gnutls_strerror(value); /* Spurious warning from
383
-Wunreachable-code */
384
if(ret == NULL)
244
385
ret = "(unknown)";
245
386
return ret;
246
387
}
247
388
248
void debuggnutls(__attribute__((unused)) int level,
249
const char* string){
250
fprintf(stderr, "%s", string);
389
/* GnuTLS log function callback */
390
static void debuggnutls(__attribute__((unused)) int level,
391
const char* string){
392
fprintf(stderr, "GnuTLS: %s", string);
251
393
}
252
394
253
int initgnutls(encrypted_session *es){
254
const char *err;
395
static int init_gnutls_global(const char *pubkeyfilename,
396
const char *seckeyfilename){
255
397
int ret;
256
398
257
399
if(debug){
258
400
fprintf(stderr, "Initializing GnuTLS\n");
259
401
}
260
261
if ((ret = gnutls_global_init ())
262
!= GNUTLS_E_SUCCESS) {
263
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
402
403
ret = gnutls_global_init();
404
if(ret != GNUTLS_E_SUCCESS){
405
fprintf(stderr, "GnuTLS global_init: %s\n",
406
safer_gnutls_strerror(ret));
264
407
return -1;
265
408
}
266
267
if (debug){
409
410
if(debug){
411
/* "Use a log level over 10 to enable all debugging options."
412
* - GnuTLS manual
413
*/
268
414
gnutls_global_set_log_level(11);
269
415
gnutls_global_set_log_function(debuggnutls);
270
416
}
271
417
272
/* openpgp credentials */
273
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
274
!= GNUTLS_E_SUCCESS) {
275
fprintf (stderr, "memory error: %s\n",
276
safer_gnutls_strerror(ret));
418
/* OpenPGP credentials */
419
gnutls_certificate_allocate_credentials(&mc.cred);
420
if(ret != GNUTLS_E_SUCCESS){
421
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
422
from
423
-Wunreachable-code
424
*/
425
safer_gnutls_strerror(ret));
426
gnutls_global_deinit();
277
427
return -1;
278
428
}
279
429
280
430
if(debug){
281
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
282
" and keyfile %s as GnuTLS credentials\n", certfile,
283
certkey);
431
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
432
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
433
seckeyfilename);
284
434
}
285
435
286
436
ret = gnutls_certificate_set_openpgp_key_file
287
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
288
if (ret != GNUTLS_E_SUCCESS) {
289
fprintf
290
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
291
" '%s')\n",
292
ret, certfile, certkey);
293
fprintf(stdout, "The Error is: %s\n",
294
safer_gnutls_strerror(ret));
295
return -1;
296
}
297
298
//GnuTLS server initialization
299
if ((ret = gnutls_dh_params_init (&es->dh_params))
300
!= GNUTLS_E_SUCCESS) {
301
fprintf (stderr, "Error in dh parameter initialization: %s\n",
302
safer_gnutls_strerror(ret));
303
return -1;
304
}
305
306
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
307
!= GNUTLS_E_SUCCESS) {
308
fprintf (stderr, "Error in prime generation: %s\n",
309
safer_gnutls_strerror(ret));
310
return -1;
311
}
312
313
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
314
315
// GnuTLS session creation
316
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
317
!= GNUTLS_E_SUCCESS){
437
(mc.cred, pubkeyfilename, seckeyfilename,
438
GNUTLS_OPENPGP_FMT_BASE64);
439
if(ret != GNUTLS_E_SUCCESS){
440
fprintf(stderr,
441
"Error[%d] while reading the OpenPGP key pair ('%s',"
442
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
443
fprintf(stderr, "The GnuTLS error is: %s\n",
444
safer_gnutls_strerror(ret));
445
goto globalfail;
446
}
447
448
/* GnuTLS server initialization */
449
ret = gnutls_dh_params_init(&mc.dh_params);
450
if(ret != GNUTLS_E_SUCCESS){
451
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
452
" %s\n", safer_gnutls_strerror(ret));
453
goto globalfail;
454
}
455
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
456
if(ret != GNUTLS_E_SUCCESS){
457
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
458
safer_gnutls_strerror(ret));
459
goto globalfail;
460
}
461
462
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
463
464
return 0;
465
466
globalfail:
467
468
gnutls_certificate_free_credentials(mc.cred);
469
gnutls_global_deinit();
470
gnutls_dh_params_deinit(mc.dh_params);
471
return -1;
472
}
473
474
static int init_gnutls_session(gnutls_session_t *session){
475
int ret;
476
/* GnuTLS session creation */
477
ret = gnutls_init(session, GNUTLS_SERVER);
478
if(ret != GNUTLS_E_SUCCESS){
318
479
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
319
480
safer_gnutls_strerror(ret));
320
481
}
321
482
322
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf(stderr, "Syntax error at: %s\n", err);
325
fprintf(stderr, "GnuTLS error: %s\n",
326
safer_gnutls_strerror(ret));
327
return -1;
483
{
484
const char *err;
485
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
486
if(ret != GNUTLS_E_SUCCESS){
487
fprintf(stderr, "Syntax error at: %s\n", err);
488
fprintf(stderr, "GnuTLS error: %s\n",
489
safer_gnutls_strerror(ret));
490
gnutls_deinit(*session);
491
return -1;
492
}
328
493
}
329
494
330
if ((ret = gnutls_credentials_set
331
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
332
!= GNUTLS_E_SUCCESS) {
333
fprintf(stderr, "Error setting a credentials set: %s\n",
495
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
496
mc.cred);
497
if(ret != GNUTLS_E_SUCCESS){
498
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
334
499
safer_gnutls_strerror(ret));
500
gnutls_deinit(*session);
335
501
return -1;
336
502
}
337
503
338
504
/* ignore client certificate if any. */
339
gnutls_certificate_server_set_request (es->session,
340
GNUTLS_CERT_IGNORE);
505
gnutls_certificate_server_set_request(*session,
506
GNUTLS_CERT_IGNORE);
341
507
342
gnutls_dh_set_prime_bits (es->session, DH_BITS);
508
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
343
509
344
510
return 0;
345
511
}
346
512
347
void empty_log(__attribute__((unused)) AvahiLogLevel level,
348
__attribute__((unused)) const char *txt){}
349
350
int start_mandos_communication(const char *ip, uint16_t port,
351
AvahiIfIndex if_index){
352
int ret, tcp_sd;
353
struct sockaddr_in6 to;
354
encrypted_session es;
513
/* Avahi log function callback */
514
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
515
__attribute__((unused)) const char *txt){}
516
517
sig_atomic_t quit_now = 0;
518
int signal_received = 0;
519
520
/* Called when a Mandos server is found */
521
static int start_mandos_communication(const char *ip, uint16_t port,
522
AvahiIfIndex if_index,
523
int af){
524
int ret, tcp_sd = -1;
525
ssize_t sret;
526
union {
527
struct sockaddr_in in;
528
struct sockaddr_in6 in6;
529
} to;
355
530
char *buffer = NULL;
356
531
char *decrypted_buffer;
357
532
size_t buffer_length = 0;
358
533
size_t buffer_capacity = 0;
359
ssize_t decrypted_buffer_size;
360
size_t written = 0;
534
size_t written;
361
535
int retval = 0;
362
char interface[IF_NAMESIZE];
536
gnutls_session_t session;
537
int pf; /* Protocol family */
538
539
if(quit_now){
540
return -1;
541
}
542
543
switch(af){
544
case AF_INET6:
545
pf = PF_INET6;
546
break;
547
case AF_INET:
548
pf = PF_INET;
549
break;
550
default:
551
fprintf(stderr, "Bad address family: %d\n", af);
552
return -1;
553
}
554
555
ret = init_gnutls_session(&session);
556
if(ret != 0){
557
return -1;
558
}
363
559
364
560
if(debug){
365
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
366
ip, port);
561
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
562
"\n", ip, port);
367
563
}
368
564
369
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
370
if(tcp_sd < 0) {
565
tcp_sd = socket(pf, SOCK_STREAM, 0);
566
if(tcp_sd < 0){
371
567
perror("socket");
372
return -1;
373
}
374
375
if(if_indextoname((unsigned int)if_index, interface) == NULL){
376
if(debug){
377
perror("if_indextoname");
378
}
379
return -1;
380
}
381
382
if(debug){
383
fprintf(stderr, "Binding to interface %s\n", interface);
384
}
385
386
memset(&to,0,sizeof(to)); /* Spurious warning */
387
to.sin6_family = AF_INET6;
388
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
389
if (ret < 0 ){
568
retval = -1;
569
goto mandos_end;
570
}
571
572
if(quit_now){
573
goto mandos_end;
574
}
575
576
memset(&to, 0, sizeof(to));
577
if(af == AF_INET6){
578
to.in6.sin6_family = (sa_family_t)af;
579
ret = inet_pton(af, ip, &to.in6.sin6_addr);
580
} else { /* IPv4 */
581
to.in.sin_family = (sa_family_t)af;
582
ret = inet_pton(af, ip, &to.in.sin_addr);
583
}
584
if(ret < 0 ){
390
585
perror("inet_pton");
391
return -1;
392
}
586
retval = -1;
587
goto mandos_end;
588
}
393
589
if(ret == 0){
394
590
fprintf(stderr, "Bad address: %s\n", ip);
395
return -1;
396
}
397
to.sin6_port = htons(port); /* Spurious warning */
591
retval = -1;
592
goto mandos_end;
593
}
594
if(af == AF_INET6){
595
to.in6.sin6_port = htons(port); /* Spurious warnings from
596
-Wconversion and
597
-Wunreachable-code */
598
599
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
600
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
601
-Wunreachable-code*/
602
if(if_index == AVAHI_IF_UNSPEC){
603
fprintf(stderr, "An IPv6 link-local address is incomplete"
604
" without a network interface\n");
605
retval = -1;
606
goto mandos_end;
607
}
608
/* Set the network interface number as scope */
609
to.in6.sin6_scope_id = (uint32_t)if_index;
610
}
611
} else {
612
to.in.sin_port = htons(port); /* Spurious warnings from
613
-Wconversion and
614
-Wunreachable-code */
615
}
398
616
399
to.sin6_scope_id = (uint32_t)if_index;
617
if(quit_now){
618
goto mandos_end;
619
}
400
620
401
621
if(debug){
402
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
403
/* char addrstr[INET6_ADDRSTRLEN]; */
404
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
405
/* sizeof(addrstr)) == NULL){ */
406
/* perror("inet_ntop"); */
407
/* } else { */
408
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
409
/* addrstr, ntohs(to.sin6_port)); */
410
/* } */
411
}
412
413
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
414
if (ret < 0){
622
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
623
char interface[IF_NAMESIZE];
624
if(if_indextoname((unsigned int)if_index, interface) == NULL){
625
perror("if_indextoname");
626
} else {
627
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
628
ip, interface, port);
629
}
630
} else {
631
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
632
port);
633
}
634
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
635
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
636
const char *pcret;
637
if(af == AF_INET6){
638
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
639
sizeof(addrstr));
640
} else {
641
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
642
sizeof(addrstr));
643
}
644
if(pcret == NULL){
645
perror("inet_ntop");
646
} else {
647
if(strcmp(addrstr, ip) != 0){
648
fprintf(stderr, "Canonical address form: %s\n", addrstr);
649
}
650
}
651
}
652
653
if(quit_now){
654
goto mandos_end;
655
}
656
657
if(af == AF_INET6){
658
ret = connect(tcp_sd, &to.in6, sizeof(to));
659
} else {
660
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
661
}
662
if(ret < 0){
415
663
perror("connect");
416
return -1;
417
}
418
419
ret = initgnutls (&es);
420
if (ret != 0){
421
664
retval = -1;
422
return -1;
423
}
424
425
gnutls_transport_set_ptr (es.session,
426
(gnutls_transport_ptr_t) tcp_sd);
665
goto mandos_end;
666
}
667
668
if(quit_now){
669
goto mandos_end;
670
}
671
672
const char *out = mandos_protocol_version;
673
written = 0;
674
while(true){
675
size_t out_size = strlen(out);
676
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
677
out_size - written));
678
if(ret == -1){
679
perror("write");
680
retval = -1;
681
goto mandos_end;
682
}
683
written += (size_t)ret;
684
if(written < out_size){
685
continue;
686
} else {
687
if(out == mandos_protocol_version){
688
written = 0;
689
out = "\r\n";
690
} else {
691
break;
692
}
693
}
694
695
if(quit_now){
696
goto mandos_end;
697
}
698
}
427
699
428
700
if(debug){
429
701
fprintf(stderr, "Establishing TLS session with %s\n", ip);
430
702
}
431
703
432
ret = gnutls_handshake (es.session);
433
434
if (ret != GNUTLS_E_SUCCESS){
704
if(quit_now){
705
goto mandos_end;
706
}
707
708
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
709
710
if(quit_now){
711
goto mandos_end;
712
}
713
714
do {
715
ret = gnutls_handshake(session);
716
if(quit_now){
717
goto mandos_end;
718
}
719
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
720
721
if(ret != GNUTLS_E_SUCCESS){
435
722
if(debug){
436
fprintf(stderr, "\n*** Handshake failed ***\n");
437
gnutls_perror (ret);
723
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
724
gnutls_perror(ret);
438
725
}
439
726
retval = -1;
440
goto exit;
727
goto mandos_end;
441
728
}
442
729
443
//Retrieve OpenPGP packet that contains the wanted password
730
/* Read OpenPGP packet that contains the wanted password */
444
731
445
732
if(debug){
446
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
733
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
447
734
ip);
448
735
}
449
736
450
737
while(true){
451
if (buffer_length + BUFFER_SIZE > buffer_capacity){
452
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
453
if (buffer == NULL){
454
perror("realloc");
455
goto exit;
456
}
457
buffer_capacity += BUFFER_SIZE;
458
}
459
460
ret = gnutls_record_recv
461
(es.session, buffer+buffer_length, BUFFER_SIZE);
462
if (ret == 0){
738
739
if(quit_now){
740
goto mandos_end;
741
}
742
743
buffer_capacity = incbuffer(&buffer, buffer_length,
744
buffer_capacity);
745
if(buffer_capacity == 0){
746
perror("incbuffer");
747
retval = -1;
748
goto mandos_end;
749
}
750
751
if(quit_now){
752
goto mandos_end;
753
}
754
755
sret = gnutls_record_recv(session, buffer+buffer_length,
756
BUFFER_SIZE);
757
if(sret == 0){
463
758
break;
464
759
}
465
if (ret < 0){
466
switch(ret){
760
if(sret < 0){
761
switch(sret){
467
762
case GNUTLS_E_INTERRUPTED:
468
763
case GNUTLS_E_AGAIN:
469
764
break;
470
765
case GNUTLS_E_REHANDSHAKE:
471
ret = gnutls_handshake (es.session);
472
if (ret < 0){
473
fprintf(stderr, "\n*** Handshake failed ***\n");
474
gnutls_perror (ret);
766
do {
767
ret = gnutls_handshake(session);
768
769
if(quit_now){
770
goto mandos_end;
771
}
772
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
773
if(ret < 0){
774
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
775
gnutls_perror(ret);
475
776
retval = -1;
476
goto exit;
777
goto mandos_end;
477
778
}
478
779
break;
479
780
default:
480
781
fprintf(stderr, "Unknown error while reading data from"
481
" encrypted session with mandos server\n");
782
" encrypted session with Mandos server\n");
482
783
retval = -1;
483
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
484
goto exit;
784
gnutls_bye(session, GNUTLS_SHUT_RDWR);
785
goto mandos_end;
485
786
}
486
787
} else {
487
buffer_length += (size_t) ret;
788
buffer_length += (size_t) sret;
488
789
}
489
790
}
490
791
491
if (buffer_length > 0){
792
if(debug){
793
fprintf(stderr, "Closing TLS session\n");
794
}
795
796
if(quit_now){
797
goto mandos_end;
798
}
799
800
gnutls_bye(session, GNUTLS_SHUT_RDWR);
801
802
if(quit_now){
803
goto mandos_end;
804
}
805
806
if(buffer_length > 0){
807
ssize_t decrypted_buffer_size;
492
808
decrypted_buffer_size = pgp_packet_decrypt(buffer,
493
809
buffer_length,
494
&decrypted_buffer,
495
certdir);
496
if (decrypted_buffer_size >= 0){
810
&decrypted_buffer);
811
if(decrypted_buffer_size >= 0){
812
813
written = 0;
497
814
while(written < (size_t) decrypted_buffer_size){
498
ret = (int)fwrite (decrypted_buffer + written, 1,
499
(size_t)decrypted_buffer_size - written,
500
stdout);
815
if(quit_now){
816
goto mandos_end;
817
}
818
819
ret = (int)fwrite(decrypted_buffer + written, 1,
820
(size_t)decrypted_buffer_size - written,
821
stdout);
501
822
if(ret == 0 and ferror(stdout)){
502
823
if(debug){
503
824
fprintf(stderr, "Error writing encrypted data: %s\n",
512
833
} else {
513
834
retval = -1;
514
835
}
515
}
516
517
//shutdown procedure
518
519
if(debug){
520
fprintf(stderr, "Closing TLS session\n");
521
}
522
836
} else {
837
retval = -1;
838
}
839
840
/* Shutdown procedure */
841
842
mandos_end:
523
843
free(buffer);
524
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
525
exit:
526
close(tcp_sd);
527
gnutls_deinit (es.session);
528
gnutls_certificate_free_credentials (es.cred);
529
gnutls_global_deinit ();
844
if(tcp_sd >= 0){
845
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
846
}
847
if(ret == -1){
848
perror("close");
849
}
850
gnutls_deinit(session);
851
if(quit_now){
852
retval = -1;
853
}
530
854
return retval;
531
855
}
532
856
533
static AvahiSimplePoll *simple_poll = NULL;
534
static AvahiServer *server = NULL;
535
536
static void resolve_callback(
537
AvahiSServiceResolver *r,
538
AvahiIfIndex interface,
539
AVAHI_GCC_UNUSED AvahiProtocol protocol,
540
AvahiResolverEvent event,
541
const char *name,
542
const char *type,
543
const char *domain,
544
const char *host_name,
545
const AvahiAddress *address,
546
uint16_t port,
547
AVAHI_GCC_UNUSED AvahiStringList *txt,
548
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
549
AVAHI_GCC_UNUSED void* userdata) {
550
551
assert(r); /* Spurious warning */
857
static void resolve_callback(AvahiSServiceResolver *r,
858
AvahiIfIndex interface,
859
AvahiProtocol proto,
860
AvahiResolverEvent event,
861
const char *name,
862
const char *type,
863
const char *domain,
864
const char *host_name,
865
const AvahiAddress *address,
866
uint16_t port,
867
AVAHI_GCC_UNUSED AvahiStringList *txt,
868
AVAHI_GCC_UNUSED AvahiLookupResultFlags
869
flags,
870
AVAHI_GCC_UNUSED void* userdata){
871
assert(r);
552
872
553
873
/* Called whenever a service has been resolved successfully or
554
874
timed out */
555
875
556
switch (event) {
876
if(quit_now){
877
return;
878
}
879
880
switch(event){
557
881
default:
558
882
case AVAHI_RESOLVER_FAILURE:
559
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
560
" type '%s' in domain '%s': %s\n", name, type, domain,
561
avahi_strerror(avahi_server_errno(server)));
883
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
884
" of type '%s' in domain '%s': %s\n", name, type, domain,
885
avahi_strerror(avahi_server_errno(mc.server)));
562
886
break;
563
887
564
888
case AVAHI_RESOLVER_FOUND:
566
890
char ip[AVAHI_ADDRESS_STR_MAX];
567
891
avahi_address_snprint(ip, sizeof(ip), address);
568
892
if(debug){
569
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
570
" port %d\n", name, host_name, ip, port);
893
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
894
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
895
ip, (intmax_t)interface, port);
571
896
}
572
int ret = start_mandos_communication(ip, port, interface);
573
if (ret == 0){
574
exit(EXIT_SUCCESS);
897
int ret = start_mandos_communication(ip, port, interface,
898
avahi_proto_to_af(proto));
899
if(ret == 0){
900
avahi_simple_poll_quit(mc.simple_poll);
575
901
}
576
902
}
577
903
}
578
904
avahi_s_service_resolver_free(r);
579
905
}
580
906
581
static void browse_callback(
582
AvahiSServiceBrowser *b,
583
AvahiIfIndex interface,
584
AvahiProtocol protocol,
585
AvahiBrowserEvent event,
586
const char *name,
587
const char *type,
588
const char *domain,
589
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
590
void* userdata) {
591
592
AvahiServer *s = userdata;
593
assert(b); /* Spurious warning */
594
595
/* Called whenever a new services becomes available on the LAN or
596
is removed from the LAN */
597
598
switch (event) {
599
default:
600
case AVAHI_BROWSER_FAILURE:
601
602
fprintf(stderr, "(Browser) %s\n",
603
avahi_strerror(avahi_server_errno(server)));
604
avahi_simple_poll_quit(simple_poll);
605
return;
606
607
case AVAHI_BROWSER_NEW:
608
/* We ignore the returned resolver object. In the callback
609
function we free it. If the server is terminated before
610
the callback function is called the server will free
611
the resolver for us. */
612
613
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
614
type, domain,
615
AVAHI_PROTO_INET6, 0,
616
resolve_callback, s)))
617
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
618
avahi_strerror(avahi_server_errno(s)));
619
break;
620
621
case AVAHI_BROWSER_REMOVE:
622
break;
623
624
case AVAHI_BROWSER_ALL_FOR_NOW:
625
case AVAHI_BROWSER_CACHE_EXHAUSTED:
626
break;
907
static void browse_callback(AvahiSServiceBrowser *b,
908
AvahiIfIndex interface,
909
AvahiProtocol protocol,
910
AvahiBrowserEvent event,
911
const char *name,
912
const char *type,
913
const char *domain,
914
AVAHI_GCC_UNUSED AvahiLookupResultFlags
915
flags,
916
AVAHI_GCC_UNUSED void* userdata){
917
assert(b);
918
919
/* Called whenever a new services becomes available on the LAN or
920
is removed from the LAN */
921
922
if(quit_now){
923
return;
924
}
925
926
switch(event){
927
default:
928
case AVAHI_BROWSER_FAILURE:
929
930
fprintf(stderr, "(Avahi browser) %s\n",
931
avahi_strerror(avahi_server_errno(mc.server)));
932
avahi_simple_poll_quit(mc.simple_poll);
933
return;
934
935
case AVAHI_BROWSER_NEW:
936
/* We ignore the returned Avahi resolver object. In the callback
937
function we free it. If the Avahi server is terminated before
938
the callback function is called the Avahi server will free the
939
resolver for us. */
940
941
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
942
name, type, domain, protocol, 0,
943
resolve_callback, NULL) == NULL)
944
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
945
name, avahi_strerror(avahi_server_errno(mc.server)));
946
break;
947
948
case AVAHI_BROWSER_REMOVE:
949
break;
950
951
case AVAHI_BROWSER_ALL_FOR_NOW:
952
case AVAHI_BROWSER_CACHE_EXHAUSTED:
953
if(debug){
954
fprintf(stderr, "No Mandos server found, still searching...\n");
627
955
}
628
}
629
630
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
631
const char *combinepath(const char *first, const char *second){
956
break;
957
}
958
}
959
960
/* stop main loop after sigterm has been called */
961
static void handle_sigterm(int sig){
962
if(quit_now){
963
return;
964
}
965
quit_now = 1;
966
signal_received = sig;
967
int old_errno = errno;
968
if(mc.simple_poll != NULL){
969
avahi_simple_poll_quit(mc.simple_poll);
970
}
971
errno = old_errno;
972
}
973
974
int main(int argc, char *argv[]){
975
AvahiSServiceBrowser *sb = NULL;
976
int error;
977
int ret;
978
intmax_t tmpmax;
632
979
char *tmp;
633
tmp = malloc(strlen(first) + strlen(second) + 2);
634
if (tmp == NULL){
635
perror("malloc");
636
return NULL;
637
}
638
strcpy(tmp, first);
639
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
640
strcat(tmp, "/");
641
}
642
strcat(tmp, second);
643
return tmp;
644
}
645
646
647
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
980
int exitcode = EXIT_SUCCESS;
981
const char *interface = "eth0";
982
struct ifreq network;
983
int sd = -1;
984
bool take_down_interface = false;
985
uid_t uid;
986
gid_t gid;
987
char *connect_to = NULL;
988
char tempdir[] = "/tmp/mandosXXXXXX";
989
bool tempdir_created = false;
990
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
991
const char *seckey = PATHDIR "/" SECKEY;
992
const char *pubkey = PATHDIR "/" PUBKEY;
993
994
bool gnutls_initialized = false;
995
bool gpgme_initialized = false;
996
float delay = 2.5f;
997
998
struct sigaction old_sigterm_action;
999
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1000
1001
{
1002
struct argp_option options[] = {
1003
{ .name = "debug", .key = 128,
1004
.doc = "Debug mode", .group = 3 },
1005
{ .name = "connect", .key = 'c',
1006
.arg = "ADDRESS:PORT",
1007
.doc = "Connect directly to a specific Mandos server",
1008
.group = 1 },
1009
{ .name = "interface", .key = 'i',
1010
.arg = "NAME",
1011
.doc = "Network interface that will be used to search for"
1012
" Mandos servers",
1013
.group = 1 },
1014
{ .name = "seckey", .key = 's',
1015
.arg = "FILE",
1016
.doc = "OpenPGP secret key file base name",
1017
.group = 1 },
1018
{ .name = "pubkey", .key = 'p',
1019
.arg = "FILE",
1020
.doc = "OpenPGP public key file base name",
1021
.group = 2 },
1022
{ .name = "dh-bits", .key = 129,
1023
.arg = "BITS",
1024
.doc = "Bit length of the prime number used in the"
1025
" Diffie-Hellman key exchange",
1026
.group = 2 },
1027
{ .name = "priority", .key = 130,
1028
.arg = "STRING",
1029
.doc = "GnuTLS priority string for the TLS handshake",
1030
.group = 1 },
1031
{ .name = "delay", .key = 131,
1032
.arg = "SECONDS",
1033
.doc = "Maximum delay to wait for interface startup",
1034
.group = 2 },
1035
{ .name = NULL }
1036
};
1037
1038
error_t parse_opt(int key, char *arg,
1039
struct argp_state *state){
1040
switch(key){
1041
case 128: /* --debug */
1042
debug = true;
1043
break;
1044
case 'c': /* --connect */
1045
connect_to = arg;
1046
break;
1047
case 'i': /* --interface */
1048
interface = arg;
1049
break;
1050
case 's': /* --seckey */
1051
seckey = arg;
1052
break;
1053
case 'p': /* --pubkey */
1054
pubkey = arg;
1055
break;
1056
case 129: /* --dh-bits */
1057
errno = 0;
1058
tmpmax = strtoimax(arg, &tmp, 10);
1059
if(errno != 0 or tmp == arg or *tmp != '\0'
1060
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1061
fprintf(stderr, "Bad number of DH bits\n");
1062
exit(EXIT_FAILURE);
1063
}
1064
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1065
break;
1066
case 130: /* --priority */
1067
mc.priority = arg;
1068
break;
1069
case 131: /* --delay */
1070
errno = 0;
1071
delay = strtof(arg, &tmp);
1072
if(errno != 0 or tmp == arg or *tmp != '\0'){
1073
fprintf(stderr, "Bad delay\n");
1074
exit(EXIT_FAILURE);
1075
}
1076
break;
1077
case ARGP_KEY_ARG:
1078
argp_usage(state);
1079
case ARGP_KEY_END:
1080
break;
1081
default:
1082
return ARGP_ERR_UNKNOWN;
1083
}
1084
return 0;
1085
}
1086
1087
struct argp argp = { .options = options, .parser = parse_opt,
1088
.args_doc = "",
1089
.doc = "Mandos client -- Get and decrypt"
1090
" passwords from a Mandos server" };
1091
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1092
if(ret == ARGP_ERR_UNKNOWN){
1093
fprintf(stderr, "Unknown error while parsing arguments\n");
1094
exitcode = EXIT_FAILURE;
1095
goto end;
1096
}
1097
}
1098
1099
if(not debug){
1100
avahi_set_log_function(empty_log);
1101
}
1102
1103
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1104
from the signal handler */
1105
/* Initialize the pseudo-RNG for Avahi */
1106
srand((unsigned int) time(NULL));
1107
mc.simple_poll = avahi_simple_poll_new();
1108
if(mc.simple_poll == NULL){
1109
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1110
exitcode = EXIT_FAILURE;
1111
goto end;
1112
}
1113
1114
sigemptyset(&sigterm_action.sa_mask);
1115
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1116
if(ret == -1){
1117
perror("sigaddset");
1118
exitcode = EXIT_FAILURE;
1119
goto end;
1120
}
1121
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1122
if(ret == -1){
1123
perror("sigaddset");
1124
exitcode = EXIT_FAILURE;
1125
goto end;
1126
}
1127
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1128
if(ret == -1){
1129
perror("sigaddset");
1130
exitcode = EXIT_FAILURE;
1131
goto end;
1132
}
1133
/* Need to check if the handler is SIG_IGN before handling:
1134
| [[info:libc:Initial Signal Actions]] |
1135
| [[info:libc:Basic Signal Handling]] |
1136
*/
1137
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1138
if(ret == -1){
1139
perror("sigaction");
1140
return EXIT_FAILURE;
1141
}
1142
if(old_sigterm_action.sa_handler != SIG_IGN){
1143
ret = sigaction(SIGINT, &sigterm_action, NULL);
1144
if(ret == -1){
1145
perror("sigaction");
1146
exitcode = EXIT_FAILURE;
1147
goto end;
1148
}
1149
}
1150
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1151
if(ret == -1){
1152
perror("sigaction");
1153
return EXIT_FAILURE;
1154
}
1155
if(old_sigterm_action.sa_handler != SIG_IGN){
1156
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1157
if(ret == -1){
1158
perror("sigaction");
1159
exitcode = EXIT_FAILURE;
1160
goto end;
1161
}
1162
}
1163
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1164
if(ret == -1){
1165
perror("sigaction");
1166
return EXIT_FAILURE;
1167
}
1168
if(old_sigterm_action.sa_handler != SIG_IGN){
1169
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1170
if(ret == -1){
1171
perror("sigaction");
1172
exitcode = EXIT_FAILURE;
1173
goto end;
1174
}
1175
}
1176
1177
/* If the interface is down, bring it up */
1178
if(interface[0] != '\0'){
1179
if_index = (AvahiIfIndex) if_nametoindex(interface);
1180
if(if_index == 0){
1181
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1182
exitcode = EXIT_FAILURE;
1183
goto end;
1184
}
1185
1186
if(quit_now){
1187
goto end;
1188
}
1189
1190
#ifdef __linux__
1191
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1192
messages to mess up the prompt */
1193
ret = klogctl(8, NULL, 5);
1194
bool restore_loglevel = true;
1195
if(ret == -1){
1196
restore_loglevel = false;
1197
perror("klogctl");
1198
}
1199
#endif /* __linux__ */
1200
1201
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1202
if(sd < 0){
1203
perror("socket");
1204
exitcode = EXIT_FAILURE;
1205
#ifdef __linux__
1206
if(restore_loglevel){
1207
ret = klogctl(7, NULL, 0);
1208
if(ret == -1){
1209
perror("klogctl");
1210
}
1211
}
1212
#endif /* __linux__ */
1213
goto end;
1214
}
1215
strcpy(network.ifr_name, interface);
1216
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1217
if(ret == -1){
1218
perror("ioctl SIOCGIFFLAGS");
1219
#ifdef __linux__
1220
if(restore_loglevel){
1221
ret = klogctl(7, NULL, 0);
1222
if(ret == -1){
1223
perror("klogctl");
1224
}
1225
}
1226
#endif /* __linux__ */
1227
exitcode = EXIT_FAILURE;
1228
goto end;
1229
}
1230
if((network.ifr_flags & IFF_UP) == 0){
1231
network.ifr_flags |= IFF_UP;
1232
take_down_interface = true;
1233
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1234
if(ret == -1){
1235
take_down_interface = false;
1236
perror("ioctl SIOCSIFFLAGS");
1237
exitcode = EXIT_FAILURE;
1238
#ifdef __linux__
1239
if(restore_loglevel){
1240
ret = klogctl(7, NULL, 0);
1241
if(ret == -1){
1242
perror("klogctl");
1243
}
1244
}
1245
#endif /* __linux__ */
1246
goto end;
1247
}
1248
}
1249
/* sleep checking until interface is running */
1250
for(int i=0; i < delay * 4; i++){
1251
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1252
if(ret == -1){
1253
perror("ioctl SIOCGIFFLAGS");
1254
} else if(network.ifr_flags & IFF_RUNNING){
1255
break;
1256
}
1257
struct timespec sleeptime = { .tv_nsec = 250000000 };
1258
ret = nanosleep(&sleeptime, NULL);
1259
if(ret == -1 and errno != EINTR){
1260
perror("nanosleep");
1261
}
1262
}
1263
if(not take_down_interface){
1264
/* We won't need the socket anymore */
1265
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1266
if(ret == -1){
1267
perror("close");
1268
}
1269
}
1270
#ifdef __linux__
1271
if(restore_loglevel){
1272
/* Restores kernel loglevel to default */
1273
ret = klogctl(7, NULL, 0);
1274
if(ret == -1){
1275
perror("klogctl");
1276
}
1277
}
1278
#endif /* __linux__ */
1279
}
1280
1281
if(quit_now){
1282
goto end;
1283
}
1284
1285
uid = getuid();
1286
gid = getgid();
1287
1288
errno = 0;
1289
setgid(gid);
1290
if(ret == -1){
1291
perror("setgid");
1292
}
1293
1294
ret = setuid(uid);
1295
if(ret == -1){
1296
perror("setuid");
1297
}
1298
1299
if(quit_now){
1300
goto end;
1301
}
1302
1303
ret = init_gnutls_global(pubkey, seckey);
1304
if(ret == -1){
1305
fprintf(stderr, "init_gnutls_global failed\n");
1306
exitcode = EXIT_FAILURE;
1307
goto end;
1308
} else {
1309
gnutls_initialized = true;
1310
}
1311
1312
if(quit_now){
1313
goto end;
1314
}
1315
1316
tempdir_created = true;
1317
if(mkdtemp(tempdir) == NULL){
1318
tempdir_created = false;
1319
perror("mkdtemp");
1320
goto end;
1321
}
1322
1323
if(quit_now){
1324
goto end;
1325
}
1326
1327
if(not init_gpgme(pubkey, seckey, tempdir)){
1328
fprintf(stderr, "init_gpgme failed\n");
1329
exitcode = EXIT_FAILURE;
1330
goto end;
1331
} else {
1332
gpgme_initialized = true;
1333
}
1334
1335
if(quit_now){
1336
goto end;
1337
}
1338
1339
if(connect_to != NULL){
1340
/* Connect directly, do not use Zeroconf */
1341
/* (Mainly meant for debugging) */
1342
char *address = strrchr(connect_to, ':');
1343
if(address == NULL){
1344
fprintf(stderr, "No colon in address\n");
1345
exitcode = EXIT_FAILURE;
1346
goto end;
1347
}
1348
1349
if(quit_now){
1350
goto end;
1351
}
1352
1353
uint16_t port;
1354
errno = 0;
1355
tmpmax = strtoimax(address+1, &tmp, 10);
1356
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1357
or tmpmax != (uint16_t)tmpmax){
1358
fprintf(stderr, "Bad port number\n");
1359
exitcode = EXIT_FAILURE;
1360
goto end;
1361
}
1362
1363
if(quit_now){
1364
goto end;
1365
}
1366
1367
port = (uint16_t)tmpmax;
1368
*address = '\0';
1369
address = connect_to;
1370
/* Colon in address indicates IPv6 */
1371
int af;
1372
if(strchr(address, ':') != NULL){
1373
af = AF_INET6;
1374
} else {
1375
af = AF_INET;
1376
}
1377
1378
if(quit_now){
1379
goto end;
1380
}
1381
1382
ret = start_mandos_communication(address, port, if_index, af);
1383
if(ret < 0){
1384
exitcode = EXIT_FAILURE;
1385
} else {
1386
exitcode = EXIT_SUCCESS;
1387
}
1388
goto end;
1389
}
1390
1391
if(quit_now){
1392
goto end;
1393
}
1394
1395
{
648
1396
AvahiServerConfig config;
649
AvahiSServiceBrowser *sb = NULL;
650
int error;
651
int ret;
652
int returncode = EXIT_SUCCESS;
653
const char *interface = NULL;
654
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
655
char *connect_to = NULL;
656
657
while (true){
658
static struct option long_options[] = {
659
{"debug", no_argument, (int *)&debug, 1},
660
{"connect", required_argument, 0, 'C'},
661
{"interface", required_argument, 0, 'i'},
662
{"certdir", required_argument, 0, 'd'},
663
{"certkey", required_argument, 0, 'c'},
664
{"certfile", required_argument, 0, 'k'},
665
{0, 0, 0, 0} };
666
667
int option_index = 0;
668
ret = getopt_long (argc, argv, "i:", long_options,
669
&option_index);
670
671
if (ret == -1){
672
break;
673
}
674
675
switch(ret){
676
case 0:
677
break;
678
case 'i':
679
interface = optarg;
680
break;
681
case 'C':
682
connect_to = optarg;
683
break;
684
case 'd':
685
certdir = optarg;
686
break;
687
case 'c':
688
certfile = optarg;
689
break;
690
case 'k':
691
certkey = optarg;
692
break;
693
default:
694
exit(EXIT_FAILURE);
695
}
696
}
697
698
certfile = combinepath(certdir, certfile);
699
if (certfile == NULL){
700
goto exit;
701
}
702
703
if(interface != NULL){
704
if_index = (AvahiIfIndex) if_nametoindex(interface);
705
if(if_index == 0){
706
fprintf(stderr, "No such interface: \"%s\"\n", interface);
707
exit(EXIT_FAILURE);
708
}
709
}
710
711
if(connect_to != NULL){
712
/* Connect directly, do not use Zeroconf */
713
/* (Mainly meant for debugging) */
714
char *address = strrchr(connect_to, ':');
715
if(address == NULL){
716
fprintf(stderr, "No colon in address\n");
717
exit(EXIT_FAILURE);
718
}
719
errno = 0;
720
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
721
if(errno){
722
perror("Bad port number");
723
exit(EXIT_FAILURE);
724
}
725
*address = '\0';
726
address = connect_to;
727
ret = start_mandos_communication(address, port, if_index);
728
if(ret < 0){
729
exit(EXIT_FAILURE);
730
} else {
731
exit(EXIT_SUCCESS);
732
}
733
}
734
735
certkey = combinepath(certdir, certkey);
736
if (certkey == NULL){
737
goto exit;
738
}
739
740
if (not debug){
741
avahi_set_log_function(empty_log);
742
}
743
744
/* Initialize the psuedo-RNG */
745
srand((unsigned int) time(NULL));
746
747
/* Allocate main loop object */
748
if (!(simple_poll = avahi_simple_poll_new())) {
749
fprintf(stderr, "Failed to create simple poll object.\n");
750
751
goto exit;
752
}
753
754
/* Do not publish any local records */
1397
/* Do not publish any local Zeroconf records */
755
1398
avahi_server_config_init(&config);
756
1399
config.publish_hinfo = 0;
757
1400
config.publish_addresses = 0;
758
1401
config.publish_workstation = 0;
759
1402
config.publish_domain = 0;
760
1403
761
1404
/* Allocate a new server */
762
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
763
&config, NULL, NULL, &error);
764
765
/* Free the configuration data */
1405
mc.server = avahi_server_new(avahi_simple_poll_get
1406
(mc.simple_poll), &config, NULL,
1407
NULL, &error);
1408
1409
/* Free the Avahi configuration data */
766
1410
avahi_server_config_free(&config);
767
768
/* Check if creating the server object succeeded */
769
if (!server) {
770
fprintf(stderr, "Failed to create server: %s\n",
771
avahi_strerror(error));
772
returncode = EXIT_FAILURE;
773
goto exit;
774
}
775
776
/* Create the service browser */
777
sb = avahi_s_service_browser_new(server, if_index,
778
AVAHI_PROTO_INET6,
779
"_mandos._tcp", NULL, 0,
780
browse_callback, server);
781
if (!sb) {
782
fprintf(stderr, "Failed to create service browser: %s\n",
783
avahi_strerror(avahi_server_errno(server)));
784
returncode = EXIT_FAILURE;
785
goto exit;
786
}
787
788
/* Run the main loop */
789
790
if (debug){
791
fprintf(stderr, "Starting avahi loop search\n");
792
}
793
794
avahi_simple_poll_loop(simple_poll);
795
796
exit:
797
798
if (debug){
799
fprintf(stderr, "%s exiting\n", argv[0]);
800
}
801
802
/* Cleanup things */
803
if (sb)
804
avahi_s_service_browser_free(sb);
805
806
if (server)
807
avahi_server_free(server);
808
809
if (simple_poll)
810
avahi_simple_poll_free(simple_poll);
811
free(certfile);
812
free(certkey);
813
814
return returncode;
1411
}
1412
1413
/* Check if creating the Avahi server object succeeded */
1414
if(mc.server == NULL){
1415
fprintf(stderr, "Failed to create Avahi server: %s\n",
1416
avahi_strerror(error));
1417
exitcode = EXIT_FAILURE;
1418
goto end;
1419
}
1420
1421
if(quit_now){
1422
goto end;
1423
}
1424
1425
/* Create the Avahi service browser */
1426
sb = avahi_s_service_browser_new(mc.server, if_index,
1427
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1428
NULL, 0, browse_callback, NULL);
1429
if(sb == NULL){
1430
fprintf(stderr, "Failed to create service browser: %s\n",
1431
avahi_strerror(avahi_server_errno(mc.server)));
1432
exitcode = EXIT_FAILURE;
1433
goto end;
1434
}
1435
1436
if(quit_now){
1437
goto end;
1438
}
1439
1440
/* Run the main loop */
1441
1442
if(debug){
1443
fprintf(stderr, "Starting Avahi loop search\n");
1444
}
1445
1446
avahi_simple_poll_loop(mc.simple_poll);
1447
1448
end:
1449
1450
if(debug){
1451
fprintf(stderr, "%s exiting\n", argv[0]);
1452
}
1453
1454
/* Cleanup things */
1455
if(sb != NULL)
1456
avahi_s_service_browser_free(sb);
1457
1458
if(mc.server != NULL)
1459
avahi_server_free(mc.server);
1460
1461
if(mc.simple_poll != NULL)
1462
avahi_simple_poll_free(mc.simple_poll);
1463
1464
if(gnutls_initialized){
1465
gnutls_certificate_free_credentials(mc.cred);
1466
gnutls_global_deinit();
1467
gnutls_dh_params_deinit(mc.dh_params);
1468
}
1469
1470
if(gpgme_initialized){
1471
gpgme_release(mc.ctx);
1472
}
1473
1474
/* Take down the network interface */
1475
if(take_down_interface){
1476
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1477
if(ret == -1){
1478
perror("ioctl SIOCGIFFLAGS");
1479
} else if(network.ifr_flags & IFF_UP) {
1480
network.ifr_flags &= ~IFF_UP; /* clear flag */
1481
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1482
if(ret == -1){
1483
perror("ioctl SIOCSIFFLAGS");
1484
}
1485
}
1486
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1487
if(ret == -1){
1488
perror("close");
1489
}
1490
}
1491
1492
/* Removes the temp directory used by GPGME */
1493
if(tempdir_created){
1494
DIR *d;
1495
struct dirent *direntry;
1496
d = opendir(tempdir);
1497
if(d == NULL){
1498
if(errno != ENOENT){
1499
perror("opendir");
1500
}
1501
} else {
1502
while(true){
1503
direntry = readdir(d);
1504
if(direntry == NULL){
1505
break;
1506
}
1507
/* Skip "." and ".." */
1508
if(direntry->d_name[0] == '.'
1509
and (direntry->d_name[1] == '\0'
1510
or (direntry->d_name[1] == '.'
1511
and direntry->d_name[2] == '\0'))){
1512
continue;
1513
}
1514
char *fullname = NULL;
1515
ret = asprintf(&fullname, "%s/%s", tempdir,
1516
direntry->d_name);
1517
if(ret < 0){
1518
perror("asprintf");
1519
continue;
1520
}
1521
ret = remove(fullname);
1522
if(ret == -1){
1523
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1524
strerror(errno));
1525
}
1526
free(fullname);
1527
}
1528
closedir(d);
1529
}
1530
ret = rmdir(tempdir);
1531
if(ret == -1 and errno != ENOENT){
1532
perror("rmdir");
1533
}
1534
}
1535
1536
if(quit_now){
1537
sigemptyset(&old_sigterm_action.sa_mask);
1538
old_sigterm_action.sa_handler = SIG_DFL;
1539
ret = sigaction(signal_received, &old_sigterm_action, NULL);
1540
if(ret == -1){
1541
perror("sigaction");
1542
}
1543
raise(signal_received);
1544
}
1545
1546
return exitcode;
815
1547
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0