To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.2.134
- compare with another revision
- download diff
- download tarball
- view history from revision 237.2.134
- Committer: Teddy Hogeborn
- Date: 2009-09-17 02:42:49 UTC
- mto: (24.1.142 mandos) (237.12.2 mandos-persistent) (299.1.1 release) (300.1.1 release) (301.1.1 release)
- mto: This revision was merged to the branch mainline in revision 264.
- Revision ID: teddy@fukt.bsnet.se-20090917024249-y6j76xtzz3i2vptv
* plugins.d/mandos-client.c (init_gnutls_session): Always fail and
return immediately
if interrupted by
signal.
return immediately
if interrupted by
signal.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- server.py => mandos
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
8
8
* includes the following functions: "resolve_callback",
9
9
* "browse_callback", and parts of "main".
10
10
*
11
* Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
12
* Påhlsson.
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
25
26
* along with this program. If not, see
26
27
* <http://www.gnu.org/licenses/>.
27
28
*
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
29
* Contact the authors at <mandos@fukt.bsnet.se>.
30
30
*/
31
31
32
#define _FORTIFY_SOURCE 2
33
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
35
37
#define _FILE_OFFSET_BITS 64
36
37
#include <stdio.h>
38
#include <assert.h>
39
#include <stdlib.h>
40
#include <time.h>
41
#include <net/if.h> /* if_nametoindex */
42
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
90
/* Avahi */
91
/* All Avahi types, constants and functions
92
Avahi*, avahi_*,
93
AVAHI_* */
43
94
#include <avahi-core/core.h>
44
95
#include <avahi-core/lookup.h>
45
96
#include <avahi-core/log.h>
47
98
#include <avahi-common/malloc.h>
48
99
#include <avahi-common/error.h>
49
100
50
//mandos client part
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
63
64
// gpgme
65
#include <errno.h> /* perror() */
66
#include <gpgme.h>
67
68
// getopt long
69
#include <getopt.h>
70
71
#ifndef CERT_ROOT
72
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#endif
74
#define CERTFILE CERT_ROOT "openpgp-client.txt"
75
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
101
/* GnuTLS */
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
103
functions:
104
gnutls_*
105
init_gnutls_session(),
106
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
110
111
/* GPGME */
112
#include <gpgme.h> /* All GPGME types, constants and
113
functions:
114
gpgme_*
115
GPGME_PROTOCOL_OpenPGP,
116
GPG_ERR_NO_* */
117
76
118
#define BUFFER_SIZE 256
77
#define DH_BITS 1024
119
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
78
123
79
124
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
80
128
129
/* Used for passing in values through the Avahi callback functions */
81
130
typedef struct {
82
gnutls_session_t session;
131
AvahiSimplePoll *simple_poll;
132
AvahiServer *server;
83
133
gnutls_certificate_credentials_t cred;
134
unsigned int dh_bits;
84
135
gnutls_dh_params_t dh_params;
85
} encrypted_session;
86
87
88
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
89
char **new_packet, const char *homedir){
90
gpgme_data_t dh_crypto, dh_plain;
136
const char *priority;
91
137
gpgme_ctx_t ctx;
138
} mandos_context;
139
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
sig_atomic_t quit_now = 0;
146
int signal_received = 0;
147
148
/*
149
* Make additional room in "buffer" for at least BUFFER_SIZE more
150
* bytes. "buffer_capacity" is how much is currently allocated,
151
* "buffer_length" is how much is already used.
152
*/
153
size_t incbuffer(char **buffer, size_t buffer_length,
154
size_t buffer_capacity){
155
if(buffer_length + BUFFER_SIZE > buffer_capacity){
156
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
157
if(buffer == NULL){
158
return 0;
159
}
160
buffer_capacity += BUFFER_SIZE;
161
}
162
return buffer_capacity;
163
}
164
165
/*
166
* Initialize GPGME.
167
*/
168
static bool init_gpgme(const char *seckey,
169
const char *pubkey, const char *tempdir){
92
170
gpgme_error_t rc;
93
ssize_t ret;
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
96
171
gpgme_engine_info_t engine_info;
97
98
if (debug){
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
172
173
174
/*
175
* Helper function to insert pub and seckey to the engine keyring.
176
*/
177
bool import_key(const char *filename){
178
int ret;
179
int fd;
180
gpgme_data_t pgp_data;
181
182
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
183
if(fd == -1){
184
perror("open");
185
return false;
186
}
187
188
rc = gpgme_data_new_from_fd(&pgp_data, fd);
189
if(rc != GPG_ERR_NO_ERROR){
190
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
191
gpgme_strsource(rc), gpgme_strerror(rc));
192
return false;
193
}
194
195
rc = gpgme_op_import(mc.ctx, pgp_data);
196
if(rc != GPG_ERR_NO_ERROR){
197
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
198
gpgme_strsource(rc), gpgme_strerror(rc));
199
return false;
200
}
201
202
ret = (int)TEMP_FAILURE_RETRY(close(fd));
203
if(ret == -1){
204
perror("close");
205
}
206
gpgme_data_release(pgp_data);
207
return true;
208
}
209
210
if(debug){
211
fprintf(stderr, "Initializing GPGME\n");
100
212
}
101
213
102
214
/* Init GPGME */
103
215
gpgme_check_version(NULL);
104
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
216
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
217
if(rc != GPG_ERR_NO_ERROR){
218
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
219
gpgme_strsource(rc), gpgme_strerror(rc));
220
return false;
221
}
105
222
106
/* Set GPGME home directory */
107
rc = gpgme_get_engine_info (&engine_info);
108
if (rc != GPG_ERR_NO_ERROR){
223
/* Set GPGME home directory for the OpenPGP engine only */
224
rc = gpgme_get_engine_info(&engine_info);
225
if(rc != GPG_ERR_NO_ERROR){
109
226
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
110
227
gpgme_strsource(rc), gpgme_strerror(rc));
111
return -1;
228
return false;
112
229
}
113
230
while(engine_info != NULL){
114
231
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
115
232
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
116
engine_info->file_name, homedir);
233
engine_info->file_name, tempdir);
117
234
break;
118
235
}
119
236
engine_info = engine_info->next;
120
237
}
121
238
if(engine_info == NULL){
122
fprintf(stderr, "Could not set home dir to %s\n", homedir);
123
return -1;
124
}
125
126
/* Create new GPGME data buffer from packet buffer */
127
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
128
if (rc != GPG_ERR_NO_ERROR){
239
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
240
return false;
241
}
242
243
/* Create new GPGME "context" */
244
rc = gpgme_new(&(mc.ctx));
245
if(rc != GPG_ERR_NO_ERROR){
246
fprintf(stderr, "bad gpgme_new: %s: %s\n",
247
gpgme_strsource(rc), gpgme_strerror(rc));
248
return false;
249
}
250
251
if(not import_key(pubkey) or not import_key(seckey)){
252
return false;
253
}
254
255
return true;
256
}
257
258
/*
259
* Decrypt OpenPGP data.
260
* Returns -1 on error
261
*/
262
static ssize_t pgp_packet_decrypt(const char *cryptotext,
263
size_t crypto_size,
264
char **plaintext){
265
gpgme_data_t dh_crypto, dh_plain;
266
gpgme_error_t rc;
267
ssize_t ret;
268
size_t plaintext_capacity = 0;
269
ssize_t plaintext_length = 0;
270
271
if(debug){
272
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
273
}
274
275
/* Create new GPGME data buffer from memory cryptotext */
276
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
277
0);
278
if(rc != GPG_ERR_NO_ERROR){
129
279
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
130
280
gpgme_strsource(rc), gpgme_strerror(rc));
131
281
return -1;
133
283
134
284
/* Create new empty GPGME data buffer for the plaintext */
135
285
rc = gpgme_data_new(&dh_plain);
136
if (rc != GPG_ERR_NO_ERROR){
286
if(rc != GPG_ERR_NO_ERROR){
137
287
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
138
288
gpgme_strsource(rc), gpgme_strerror(rc));
139
return -1;
140
}
141
142
/* Create new GPGME "context" */
143
rc = gpgme_new(&ctx);
144
if (rc != GPG_ERR_NO_ERROR){
145
fprintf(stderr, "bad gpgme_new: %s: %s\n",
146
gpgme_strsource(rc), gpgme_strerror(rc));
147
return -1;
148
}
149
150
/* Decrypt data from the FILE pointer to the plaintext data
151
buffer */
152
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
153
if (rc != GPG_ERR_NO_ERROR){
289
gpgme_data_release(dh_crypto);
290
return -1;
291
}
292
293
/* Decrypt data from the cryptotext data buffer to the plaintext
294
data buffer */
295
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
296
if(rc != GPG_ERR_NO_ERROR){
154
297
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
155
298
gpgme_strsource(rc), gpgme_strerror(rc));
156
return -1;
157
}
158
159
if(debug){
160
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
161
}
162
163
if (debug){
164
gpgme_decrypt_result_t result;
165
result = gpgme_op_decrypt_result(ctx);
166
if (result == NULL){
167
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
168
} else {
169
fprintf(stderr, "Unsupported algorithm: %s\n",
170
result->unsupported_algorithm);
171
fprintf(stderr, "Wrong key usage: %d\n",
172
result->wrong_key_usage);
173
if(result->file_name != NULL){
174
fprintf(stderr, "File name: %s\n", result->file_name);
175
}
176
gpgme_recipient_t recipient;
177
recipient = result->recipients;
178
if(recipient){
299
plaintext_length = -1;
300
if(debug){
301
gpgme_decrypt_result_t result;
302
result = gpgme_op_decrypt_result(mc.ctx);
303
if(result == NULL){
304
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
305
} else {
306
fprintf(stderr, "Unsupported algorithm: %s\n",
307
result->unsupported_algorithm);
308
fprintf(stderr, "Wrong key usage: %u\n",
309
result->wrong_key_usage);
310
if(result->file_name != NULL){
311
fprintf(stderr, "File name: %s\n", result->file_name);
312
}
313
gpgme_recipient_t recipient;
314
recipient = result->recipients;
179
315
while(recipient != NULL){
180
316
fprintf(stderr, "Public key algorithm: %s\n",
181
317
gpgme_pubkey_algo_name(recipient->pubkey_algo));
187
323
}
188
324
}
189
325
}
326
goto decrypt_end;
190
327
}
191
328
192
/* Delete the GPGME FILE pointer cryptotext data buffer */
193
gpgme_data_release(dh_crypto);
329
if(debug){
330
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
331
}
194
332
195
333
/* Seek back to the beginning of the GPGME plaintext data buffer */
196
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
197
198
*new_packet = 0;
334
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
335
perror("gpgme_data_seek");
336
plaintext_length = -1;
337
goto decrypt_end;
338
}
339
340
*plaintext = NULL;
199
341
while(true){
200
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
201
*new_packet = realloc(*new_packet,
202
(unsigned int)new_packet_capacity
203
+ BUFFER_SIZE);
204
if (*new_packet == NULL){
205
perror("realloc");
206
return -1;
207
}
208
new_packet_capacity += BUFFER_SIZE;
342
plaintext_capacity = incbuffer(plaintext,
343
(size_t)plaintext_length,
344
plaintext_capacity);
345
if(plaintext_capacity == 0){
346
perror("incbuffer");
347
plaintext_length = -1;
348
goto decrypt_end;
209
349
}
210
350
211
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
351
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
212
352
BUFFER_SIZE);
213
353
/* Print the data, if any */
214
if (ret == 0){
354
if(ret == 0){
355
/* EOF */
215
356
break;
216
357
}
217
358
if(ret < 0){
218
359
perror("gpgme_data_read");
219
return -1;
220
}
221
new_packet_length += ret;
222
}
223
224
/* FIXME: check characters before printing to screen so to not print
225
terminal control characters */
226
/* if(debug){ */
227
/* fprintf(stderr, "decrypted password is: "); */
228
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
229
/* fprintf(stderr, "\n"); */
230
/* } */
360
plaintext_length = -1;
361
goto decrypt_end;
362
}
363
plaintext_length += ret;
364
}
365
366
if(debug){
367
fprintf(stderr, "Decrypted password is: ");
368
for(ssize_t i = 0; i < plaintext_length; i++){
369
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
370
}
371
fprintf(stderr, "\n");
372
}
373
374
decrypt_end:
375
376
/* Delete the GPGME cryptotext data buffer */
377
gpgme_data_release(dh_crypto);
231
378
232
379
/* Delete the GPGME plaintext data buffer */
233
380
gpgme_data_release(dh_plain);
234
return new_packet_length;
381
return plaintext_length;
235
382
}
236
383
237
static const char * safer_gnutls_strerror (int value) {
238
const char *ret = gnutls_strerror (value);
239
if (ret == NULL)
384
static const char * safer_gnutls_strerror(int value){
385
const char *ret = gnutls_strerror(value); /* Spurious warning from
386
-Wunreachable-code */
387
if(ret == NULL)
240
388
ret = "(unknown)";
241
389
return ret;
242
390
}
243
391
244
void debuggnutls(__attribute__((unused)) int level,
245
const char* string){
246
fprintf(stderr, "%s", string);
392
/* GnuTLS log function callback */
393
static void debuggnutls(__attribute__((unused)) int level,
394
const char* string){
395
fprintf(stderr, "GnuTLS: %s", string);
247
396
}
248
397
249
int initgnutls(encrypted_session *es){
250
const char *err;
398
static int init_gnutls_global(const char *pubkeyfilename,
399
const char *seckeyfilename){
251
400
int ret;
252
401
253
402
if(debug){
254
403
fprintf(stderr, "Initializing GnuTLS\n");
255
404
}
256
405
257
if ((ret = gnutls_global_init ())
258
!= GNUTLS_E_SUCCESS) {
259
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
406
ret = gnutls_global_init();
407
if(ret != GNUTLS_E_SUCCESS){
408
fprintf(stderr, "GnuTLS global_init: %s\n",
409
safer_gnutls_strerror(ret));
260
410
return -1;
261
411
}
262
263
if (debug){
412
413
if(debug){
414
/* "Use a log level over 10 to enable all debugging options."
415
* - GnuTLS manual
416
*/
264
417
gnutls_global_set_log_level(11);
265
418
gnutls_global_set_log_function(debuggnutls);
266
419
}
267
420
268
/* openpgp credentials */
269
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
270
!= GNUTLS_E_SUCCESS) {
271
fprintf (stderr, "memory error: %s\n",
272
safer_gnutls_strerror(ret));
421
/* OpenPGP credentials */
422
gnutls_certificate_allocate_credentials(&mc.cred);
423
if(ret != GNUTLS_E_SUCCESS){
424
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
425
from
426
-Wunreachable-code
427
*/
428
safer_gnutls_strerror(ret));
429
gnutls_global_deinit();
273
430
return -1;
274
431
}
275
432
276
433
if(debug){
277
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
278
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
279
KEYFILE);
434
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
435
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
436
seckeyfilename);
280
437
}
281
438
282
439
ret = gnutls_certificate_set_openpgp_key_file
283
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
284
if (ret != GNUTLS_E_SUCCESS) {
285
fprintf
286
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
287
" '%s')\n",
288
ret, CERTFILE, KEYFILE);
289
fprintf(stdout, "The Error is: %s\n",
290
safer_gnutls_strerror(ret));
291
return -1;
292
}
293
294
//GnuTLS server initialization
295
if ((ret = gnutls_dh_params_init (&es->dh_params))
296
!= GNUTLS_E_SUCCESS) {
297
fprintf (stderr, "Error in dh parameter initialization: %s\n",
298
safer_gnutls_strerror(ret));
299
return -1;
300
}
301
302
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in prime generation: %s\n",
305
safer_gnutls_strerror(ret));
306
return -1;
307
}
308
309
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
310
311
// GnuTLS session creation
312
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
313
!= GNUTLS_E_SUCCESS){
440
(mc.cred, pubkeyfilename, seckeyfilename,
441
GNUTLS_OPENPGP_FMT_BASE64);
442
if(ret != GNUTLS_E_SUCCESS){
443
fprintf(stderr,
444
"Error[%d] while reading the OpenPGP key pair ('%s',"
445
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
446
fprintf(stderr, "The GnuTLS error is: %s\n",
447
safer_gnutls_strerror(ret));
448
goto globalfail;
449
}
450
451
/* GnuTLS server initialization */
452
ret = gnutls_dh_params_init(&mc.dh_params);
453
if(ret != GNUTLS_E_SUCCESS){
454
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
455
" %s\n", safer_gnutls_strerror(ret));
456
goto globalfail;
457
}
458
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
459
if(ret != GNUTLS_E_SUCCESS){
460
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
461
safer_gnutls_strerror(ret));
462
goto globalfail;
463
}
464
465
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
466
467
return 0;
468
469
globalfail:
470
471
gnutls_certificate_free_credentials(mc.cred);
472
gnutls_global_deinit();
473
gnutls_dh_params_deinit(mc.dh_params);
474
return -1;
475
}
476
477
static int init_gnutls_session(gnutls_session_t *session){
478
int ret;
479
/* GnuTLS session creation */
480
do {
481
ret = gnutls_init(session, GNUTLS_SERVER);
482
if(quit_now){
483
return -1;
484
}
485
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
486
if(ret != GNUTLS_E_SUCCESS){
314
487
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
315
488
safer_gnutls_strerror(ret));
316
489
}
317
490
318
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
319
!= GNUTLS_E_SUCCESS) {
320
fprintf(stderr, "Syntax error at: %s\n", err);
321
fprintf(stderr, "GnuTLS error: %s\n",
322
safer_gnutls_strerror(ret));
323
return -1;
491
{
492
const char *err;
493
do {
494
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
495
if(quit_now){
496
gnutls_deinit(*session);
497
return -1;
498
}
499
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
500
if(ret != GNUTLS_E_SUCCESS){
501
fprintf(stderr, "Syntax error at: %s\n", err);
502
fprintf(stderr, "GnuTLS error: %s\n",
503
safer_gnutls_strerror(ret));
504
gnutls_deinit(*session);
505
return -1;
506
}
324
507
}
325
508
326
if ((ret = gnutls_credentials_set
327
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
328
!= GNUTLS_E_SUCCESS) {
329
fprintf(stderr, "Error setting a credentials set: %s\n",
509
do {
510
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
511
mc.cred);
512
if(quit_now){
513
gnutls_deinit(*session);
514
return -1;
515
}
516
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
517
if(ret != GNUTLS_E_SUCCESS){
518
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
330
519
safer_gnutls_strerror(ret));
520
gnutls_deinit(*session);
331
521
return -1;
332
522
}
333
523
334
524
/* ignore client certificate if any. */
335
gnutls_certificate_server_set_request (es->session,
336
GNUTLS_CERT_IGNORE);
525
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
337
526
338
gnutls_dh_set_prime_bits (es->session, DH_BITS);
527
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
339
528
340
529
return 0;
341
530
}
342
531
343
void empty_log(__attribute__((unused)) AvahiLogLevel level,
344
__attribute__((unused)) const char *txt){}
532
/* Avahi log function callback */
533
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
534
__attribute__((unused)) const char *txt){}
345
535
346
int start_mandos_communication(const char *ip, uint16_t port,
347
unsigned int if_index){
348
int ret, tcp_sd;
349
struct sockaddr_in6 to;
350
encrypted_session es;
536
/* Called when a Mandos server is found */
537
static int start_mandos_communication(const char *ip, uint16_t port,
538
AvahiIfIndex if_index,
539
int af){
540
int ret, tcp_sd = -1;
541
ssize_t sret;
542
union {
543
struct sockaddr_in in;
544
struct sockaddr_in6 in6;
545
} to;
351
546
char *buffer = NULL;
352
547
char *decrypted_buffer;
353
548
size_t buffer_length = 0;
354
549
size_t buffer_capacity = 0;
355
ssize_t decrypted_buffer_size;
356
size_t written = 0;
550
size_t written;
357
551
int retval = 0;
358
char interface[IF_NAMESIZE];
552
gnutls_session_t session;
553
int pf; /* Protocol family */
554
555
if(quit_now){
556
return -1;
557
}
558
559
switch(af){
560
case AF_INET6:
561
pf = PF_INET6;
562
break;
563
case AF_INET:
564
pf = PF_INET;
565
break;
566
default:
567
fprintf(stderr, "Bad address family: %d\n", af);
568
return -1;
569
}
570
571
ret = init_gnutls_session(&session);
572
if(ret != 0){
573
return -1;
574
}
359
575
360
576
if(debug){
361
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
577
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
578
"\n", ip, port);
362
579
}
363
580
364
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
365
if(tcp_sd < 0) {
581
tcp_sd = socket(pf, SOCK_STREAM, 0);
582
if(tcp_sd < 0){
366
583
perror("socket");
367
return -1;
368
}
369
370
if(if_indextoname(if_index, interface) == NULL){
371
if(debug){
372
perror("if_indextoname");
373
}
374
return -1;
375
}
376
377
if(debug){
378
fprintf(stderr, "Binding to interface %s\n", interface);
379
}
380
381
memset(&to,0,sizeof(to)); /* Spurious warning */
382
to.sin6_family = AF_INET6;
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
384
if (ret < 0 ){
584
retval = -1;
585
goto mandos_end;
586
}
587
588
if(quit_now){
589
retval = -1;
590
goto mandos_end;
591
}
592
593
memset(&to, 0, sizeof(to));
594
if(af == AF_INET6){
595
to.in6.sin6_family = (sa_family_t)af;
596
ret = inet_pton(af, ip, &to.in6.sin6_addr);
597
} else { /* IPv4 */
598
to.in.sin_family = (sa_family_t)af;
599
ret = inet_pton(af, ip, &to.in.sin_addr);
600
}
601
if(ret < 0 ){
385
602
perror("inet_pton");
386
return -1;
387
}
603
retval = -1;
604
goto mandos_end;
605
}
388
606
if(ret == 0){
389
607
fprintf(stderr, "Bad address: %s\n", ip);
390
return -1;
391
}
392
to.sin6_port = htons(port); /* Spurious warning */
608
retval = -1;
609
goto mandos_end;
610
}
611
if(af == AF_INET6){
612
to.in6.sin6_port = htons(port); /* Spurious warnings from
613
-Wconversion and
614
-Wunreachable-code */
615
616
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
617
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
618
-Wunreachable-code*/
619
if(if_index == AVAHI_IF_UNSPEC){
620
fprintf(stderr, "An IPv6 link-local address is incomplete"
621
" without a network interface\n");
622
retval = -1;
623
goto mandos_end;
624
}
625
/* Set the network interface number as scope */
626
to.in6.sin6_scope_id = (uint32_t)if_index;
627
}
628
} else {
629
to.in.sin_port = htons(port); /* Spurious warnings from
630
-Wconversion and
631
-Wunreachable-code */
632
}
393
633
394
to.sin6_scope_id = (uint32_t)if_index;
634
if(quit_now){
635
retval = -1;
636
goto mandos_end;
637
}
395
638
396
639
if(debug){
397
fprintf(stderr, "Connection to: %s\n", ip);
398
}
399
400
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
401
if (ret < 0){
640
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
641
char interface[IF_NAMESIZE];
642
if(if_indextoname((unsigned int)if_index, interface) == NULL){
643
perror("if_indextoname");
644
} else {
645
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
646
ip, interface, port);
647
}
648
} else {
649
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
650
port);
651
}
652
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
653
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
654
const char *pcret;
655
if(af == AF_INET6){
656
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
657
sizeof(addrstr));
658
} else {
659
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
660
sizeof(addrstr));
661
}
662
if(pcret == NULL){
663
perror("inet_ntop");
664
} else {
665
if(strcmp(addrstr, ip) != 0){
666
fprintf(stderr, "Canonical address form: %s\n", addrstr);
667
}
668
}
669
}
670
671
if(quit_now){
672
retval = -1;
673
goto mandos_end;
674
}
675
676
if(af == AF_INET6){
677
ret = connect(tcp_sd, &to.in6, sizeof(to));
678
} else {
679
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
680
}
681
if(ret < 0){
402
682
perror("connect");
403
return -1;
404
}
405
406
ret = initgnutls (&es);
407
if (ret != 0){
408
retval = -1;
409
return -1;
410
}
411
412
gnutls_transport_set_ptr (es.session,
413
(gnutls_transport_ptr_t) tcp_sd);
683
retval = -1;
684
goto mandos_end;
685
}
686
687
if(quit_now){
688
retval = -1;
689
goto mandos_end;
690
}
691
692
const char *out = mandos_protocol_version;
693
written = 0;
694
while(true){
695
size_t out_size = strlen(out);
696
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
697
out_size - written));
698
if(ret == -1){
699
perror("write");
700
retval = -1;
701
goto mandos_end;
702
}
703
written += (size_t)ret;
704
if(written < out_size){
705
continue;
706
} else {
707
if(out == mandos_protocol_version){
708
written = 0;
709
out = "\r\n";
710
} else {
711
break;
712
}
713
}
714
715
if(quit_now){
716
retval = -1;
717
goto mandos_end;
718
}
719
}
414
720
415
721
if(debug){
416
722
fprintf(stderr, "Establishing TLS session with %s\n", ip);
417
723
}
418
724
419
ret = gnutls_handshake (es.session);
420
421
if (ret != GNUTLS_E_SUCCESS){
422
fprintf(stderr, "\n*** Handshake failed ***\n");
423
gnutls_perror (ret);
424
retval = -1;
425
goto exit;
426
}
427
428
//Retrieve OpenPGP packet that contains the wanted password
725
if(quit_now){
726
retval = -1;
727
goto mandos_end;
728
}
729
730
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
731
732
if(quit_now){
733
retval = -1;
734
goto mandos_end;
735
}
736
737
do {
738
ret = gnutls_handshake(session);
739
if(quit_now){
740
retval = -1;
741
goto mandos_end;
742
}
743
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
744
745
if(ret != GNUTLS_E_SUCCESS){
746
if(debug){
747
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
748
gnutls_perror(ret);
749
}
750
retval = -1;
751
goto mandos_end;
752
}
753
754
/* Read OpenPGP packet that contains the wanted password */
429
755
430
756
if(debug){
431
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
757
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
432
758
ip);
433
759
}
434
760
435
761
while(true){
436
if (buffer_length + BUFFER_SIZE > buffer_capacity){
437
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
438
if (buffer == NULL){
439
perror("realloc");
440
goto exit;
441
}
442
buffer_capacity += BUFFER_SIZE;
443
}
444
445
ret = gnutls_record_recv
446
(es.session, buffer+buffer_length, BUFFER_SIZE);
447
if (ret == 0){
762
763
if(quit_now){
764
retval = -1;
765
goto mandos_end;
766
}
767
768
buffer_capacity = incbuffer(&buffer, buffer_length,
769
buffer_capacity);
770
if(buffer_capacity == 0){
771
perror("incbuffer");
772
retval = -1;
773
goto mandos_end;
774
}
775
776
if(quit_now){
777
retval = -1;
778
goto mandos_end;
779
}
780
781
sret = gnutls_record_recv(session, buffer+buffer_length,
782
BUFFER_SIZE);
783
if(sret == 0){
448
784
break;
449
785
}
450
if (ret < 0){
451
switch(ret){
786
if(sret < 0){
787
switch(sret){
452
788
case GNUTLS_E_INTERRUPTED:
453
789
case GNUTLS_E_AGAIN:
454
790
break;
455
791
case GNUTLS_E_REHANDSHAKE:
456
ret = gnutls_handshake (es.session);
457
if (ret < 0){
458
fprintf(stderr, "\n*** Handshake failed ***\n");
459
gnutls_perror (ret);
792
do {
793
ret = gnutls_handshake(session);
794
795
if(quit_now){
796
retval = -1;
797
goto mandos_end;
798
}
799
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
800
if(ret < 0){
801
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
802
gnutls_perror(ret);
460
803
retval = -1;
461
goto exit;
804
goto mandos_end;
462
805
}
463
806
break;
464
807
default:
465
808
fprintf(stderr, "Unknown error while reading data from"
466
" encrypted session with mandos server\n");
809
" encrypted session with Mandos server\n");
467
810
retval = -1;
468
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
469
goto exit;
811
gnutls_bye(session, GNUTLS_SHUT_RDWR);
812
goto mandos_end;
470
813
}
471
814
} else {
472
buffer_length += (size_t) ret;
473
}
474
}
475
476
if (buffer_length > 0){
815
buffer_length += (size_t) sret;
816
}
817
}
818
819
if(debug){
820
fprintf(stderr, "Closing TLS session\n");
821
}
822
823
if(quit_now){
824
retval = -1;
825
goto mandos_end;
826
}
827
828
do {
829
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
830
if(quit_now){
831
retval = -1;
832
goto mandos_end;
833
}
834
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
835
836
if(buffer_length > 0){
837
ssize_t decrypted_buffer_size;
477
838
decrypted_buffer_size = pgp_packet_decrypt(buffer,
478
839
buffer_length,
479
&decrypted_buffer,
480
CERT_ROOT);
481
if (decrypted_buffer_size >= 0){
482
while(written < decrypted_buffer_size){
483
ret = (int)fwrite (decrypted_buffer + written, 1,
484
(size_t)decrypted_buffer_size - written,
485
stdout);
840
&decrypted_buffer);
841
if(decrypted_buffer_size >= 0){
842
843
written = 0;
844
while(written < (size_t) decrypted_buffer_size){
845
if(quit_now){
846
retval = -1;
847
goto mandos_end;
848
}
849
850
ret = (int)fwrite(decrypted_buffer + written, 1,
851
(size_t)decrypted_buffer_size - written,
852
stdout);
486
853
if(ret == 0 and ferror(stdout)){
487
854
if(debug){
488
855
fprintf(stderr, "Error writing encrypted data: %s\n",
497
864
} else {
498
865
retval = -1;
499
866
}
500
}
501
502
//shutdown procedure
503
504
if(debug){
505
fprintf(stderr, "Closing TLS session\n");
506
}
507
867
} else {
868
retval = -1;
869
}
870
871
/* Shutdown procedure */
872
873
mandos_end:
508
874
free(buffer);
509
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
510
exit:
511
close(tcp_sd);
512
gnutls_deinit (es.session);
513
gnutls_certificate_free_credentials (es.cred);
514
gnutls_global_deinit ();
875
if(tcp_sd >= 0){
876
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
877
}
878
if(ret == -1){
879
perror("close");
880
}
881
gnutls_deinit(session);
882
if(quit_now){
883
retval = -1;
884
}
515
885
return retval;
516
886
}
517
887
518
static AvahiSimplePoll *simple_poll = NULL;
519
static AvahiServer *server = NULL;
520
521
static void resolve_callback(
522
AvahiSServiceResolver *r,
523
AvahiIfIndex interface,
524
AVAHI_GCC_UNUSED AvahiProtocol protocol,
525
AvahiResolverEvent event,
526
const char *name,
527
const char *type,
528
const char *domain,
529
const char *host_name,
530
const AvahiAddress *address,
531
uint16_t port,
532
AVAHI_GCC_UNUSED AvahiStringList *txt,
533
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
534
AVAHI_GCC_UNUSED void* userdata) {
535
536
assert(r); /* Spurious warning */
888
static void resolve_callback(AvahiSServiceResolver *r,
889
AvahiIfIndex interface,
890
AvahiProtocol proto,
891
AvahiResolverEvent event,
892
const char *name,
893
const char *type,
894
const char *domain,
895
const char *host_name,
896
const AvahiAddress *address,
897
uint16_t port,
898
AVAHI_GCC_UNUSED AvahiStringList *txt,
899
AVAHI_GCC_UNUSED AvahiLookupResultFlags
900
flags,
901
AVAHI_GCC_UNUSED void* userdata){
902
assert(r);
537
903
538
904
/* Called whenever a service has been resolved successfully or
539
905
timed out */
540
906
541
switch (event) {
907
if(quit_now){
908
return;
909
}
910
911
switch(event){
542
912
default:
543
913
case AVAHI_RESOLVER_FAILURE:
544
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
545
" type '%s' in domain '%s': %s\n", name, type, domain,
546
avahi_strerror(avahi_server_errno(server)));
914
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
915
" of type '%s' in domain '%s': %s\n", name, type, domain,
916
avahi_strerror(avahi_server_errno(mc.server)));
547
917
break;
548
918
549
919
case AVAHI_RESOLVER_FOUND:
551
921
char ip[AVAHI_ADDRESS_STR_MAX];
552
922
avahi_address_snprint(ip, sizeof(ip), address);
553
923
if(debug){
554
fprintf(stderr, "Mandos server found on %s (%s) on port %d\n",
555
host_name, ip, port);
924
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
925
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
926
ip, (intmax_t)interface, port);
556
927
}
557
int ret = start_mandos_communication(ip, port,
558
(unsigned int) interface);
559
if (ret == 0){
560
exit(EXIT_SUCCESS);
561
} else {
562
exit(EXIT_FAILURE);
928
int ret = start_mandos_communication(ip, port, interface,
929
avahi_proto_to_af(proto));
930
if(ret == 0){
931
avahi_simple_poll_quit(mc.simple_poll);
563
932
}
564
933
}
565
934
}
566
935
avahi_s_service_resolver_free(r);
567
936
}
568
937
569
static void browse_callback(
570
AvahiSServiceBrowser *b,
571
AvahiIfIndex interface,
572
AvahiProtocol protocol,
573
AvahiBrowserEvent event,
574
const char *name,
575
const char *type,
576
const char *domain,
577
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
578
void* userdata) {
579
580
AvahiServer *s = userdata;
581
assert(b); /* Spurious warning */
582
583
/* Called whenever a new services becomes available on the LAN or
584
is removed from the LAN */
585
586
switch (event) {
587
default:
588
case AVAHI_BROWSER_FAILURE:
589
590
fprintf(stderr, "(Browser) %s\n",
591
avahi_strerror(avahi_server_errno(server)));
592
avahi_simple_poll_quit(simple_poll);
593
return;
594
595
case AVAHI_BROWSER_NEW:
596
/* We ignore the returned resolver object. In the callback
597
function we free it. If the server is terminated before
598
the callback function is called the server will free
599
the resolver for us. */
600
601
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
602
type, domain,
603
AVAHI_PROTO_INET6, 0,
604
resolve_callback, s)))
605
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
606
avahi_strerror(avahi_server_errno(s)));
607
break;
608
609
case AVAHI_BROWSER_REMOVE:
610
break;
611
612
case AVAHI_BROWSER_ALL_FOR_NOW:
613
case AVAHI_BROWSER_CACHE_EXHAUSTED:
614
break;
615
}
616
}
617
618
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
938
static void browse_callback(AvahiSServiceBrowser *b,
939
AvahiIfIndex interface,
940
AvahiProtocol protocol,
941
AvahiBrowserEvent event,
942
const char *name,
943
const char *type,
944
const char *domain,
945
AVAHI_GCC_UNUSED AvahiLookupResultFlags
946
flags,
947
AVAHI_GCC_UNUSED void* userdata){
948
assert(b);
949
950
/* Called whenever a new services becomes available on the LAN or
951
is removed from the LAN */
952
953
if(quit_now){
954
return;
955
}
956
957
switch(event){
958
default:
959
case AVAHI_BROWSER_FAILURE:
960
961
fprintf(stderr, "(Avahi browser) %s\n",
962
avahi_strerror(avahi_server_errno(mc.server)));
963
avahi_simple_poll_quit(mc.simple_poll);
964
return;
965
966
case AVAHI_BROWSER_NEW:
967
/* We ignore the returned Avahi resolver object. In the callback
968
function we free it. If the Avahi server is terminated before
969
the callback function is called the Avahi server will free the
970
resolver for us. */
971
972
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
973
name, type, domain, protocol, 0,
974
resolve_callback, NULL) == NULL)
975
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
976
name, avahi_strerror(avahi_server_errno(mc.server)));
977
break;
978
979
case AVAHI_BROWSER_REMOVE:
980
break;
981
982
case AVAHI_BROWSER_ALL_FOR_NOW:
983
case AVAHI_BROWSER_CACHE_EXHAUSTED:
984
if(debug){
985
fprintf(stderr, "No Mandos server found, still searching...\n");
986
}
987
break;
988
}
989
}
990
991
/* stop main loop after sigterm has been called */
992
static void handle_sigterm(int sig){
993
if(quit_now){
994
return;
995
}
996
quit_now = 1;
997
signal_received = sig;
998
int old_errno = errno;
999
if(mc.simple_poll != NULL){
1000
avahi_simple_poll_quit(mc.simple_poll);
1001
}
1002
errno = old_errno;
1003
}
1004
1005
int main(int argc, char *argv[]){
1006
AvahiSServiceBrowser *sb = NULL;
1007
int error;
1008
int ret;
1009
intmax_t tmpmax;
1010
char *tmp;
1011
int exitcode = EXIT_SUCCESS;
1012
const char *interface = "eth0";
1013
struct ifreq network;
1014
int sd = -1;
1015
bool take_down_interface = false;
1016
uid_t uid;
1017
gid_t gid;
1018
char *connect_to = NULL;
1019
char tempdir[] = "/tmp/mandosXXXXXX";
1020
bool tempdir_created = false;
1021
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1022
const char *seckey = PATHDIR "/" SECKEY;
1023
const char *pubkey = PATHDIR "/" PUBKEY;
1024
1025
bool gnutls_initialized = false;
1026
bool gpgme_initialized = false;
1027
float delay = 2.5f;
1028
1029
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1030
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1031
1032
uid = getuid();
1033
gid = getgid();
1034
1035
/* Lower any group privileges we might have, just to be safe */
1036
errno = 0;
1037
ret = setgid(gid);
1038
if(ret == -1){
1039
perror("setgid");
1040
}
1041
1042
/* Lower user privileges (temporarily) */
1043
errno = 0;
1044
ret = seteuid(uid);
1045
if(ret == -1){
1046
perror("seteuid");
1047
}
1048
1049
if(quit_now){
1050
goto end;
1051
}
1052
1053
{
1054
struct argp_option options[] = {
1055
{ .name = "debug", .key = 128,
1056
.doc = "Debug mode", .group = 3 },
1057
{ .name = "connect", .key = 'c',
1058
.arg = "ADDRESS:PORT",
1059
.doc = "Connect directly to a specific Mandos server",
1060
.group = 1 },
1061
{ .name = "interface", .key = 'i',
1062
.arg = "NAME",
1063
.doc = "Network interface that will be used to search for"
1064
" Mandos servers",
1065
.group = 1 },
1066
{ .name = "seckey", .key = 's',
1067
.arg = "FILE",
1068
.doc = "OpenPGP secret key file base name",
1069
.group = 1 },
1070
{ .name = "pubkey", .key = 'p',
1071
.arg = "FILE",
1072
.doc = "OpenPGP public key file base name",
1073
.group = 2 },
1074
{ .name = "dh-bits", .key = 129,
1075
.arg = "BITS",
1076
.doc = "Bit length of the prime number used in the"
1077
" Diffie-Hellman key exchange",
1078
.group = 2 },
1079
{ .name = "priority", .key = 130,
1080
.arg = "STRING",
1081
.doc = "GnuTLS priority string for the TLS handshake",
1082
.group = 1 },
1083
{ .name = "delay", .key = 131,
1084
.arg = "SECONDS",
1085
.doc = "Maximum delay to wait for interface startup",
1086
.group = 2 },
1087
{ .name = NULL }
1088
};
1089
1090
error_t parse_opt(int key, char *arg,
1091
struct argp_state *state){
1092
switch(key){
1093
case 128: /* --debug */
1094
debug = true;
1095
break;
1096
case 'c': /* --connect */
1097
connect_to = arg;
1098
break;
1099
case 'i': /* --interface */
1100
interface = arg;
1101
break;
1102
case 's': /* --seckey */
1103
seckey = arg;
1104
break;
1105
case 'p': /* --pubkey */
1106
pubkey = arg;
1107
break;
1108
case 129: /* --dh-bits */
1109
errno = 0;
1110
tmpmax = strtoimax(arg, &tmp, 10);
1111
if(errno != 0 or tmp == arg or *tmp != '\0'
1112
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1113
fprintf(stderr, "Bad number of DH bits\n");
1114
exit(EXIT_FAILURE);
1115
}
1116
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1117
break;
1118
case 130: /* --priority */
1119
mc.priority = arg;
1120
break;
1121
case 131: /* --delay */
1122
errno = 0;
1123
delay = strtof(arg, &tmp);
1124
if(errno != 0 or tmp == arg or *tmp != '\0'){
1125
fprintf(stderr, "Bad delay\n");
1126
exit(EXIT_FAILURE);
1127
}
1128
break;
1129
case ARGP_KEY_ARG:
1130
argp_usage(state);
1131
case ARGP_KEY_END:
1132
break;
1133
default:
1134
return ARGP_ERR_UNKNOWN;
1135
}
1136
return 0;
1137
}
1138
1139
struct argp argp = { .options = options, .parser = parse_opt,
1140
.args_doc = "",
1141
.doc = "Mandos client -- Get and decrypt"
1142
" passwords from a Mandos server" };
1143
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1144
if(ret == ARGP_ERR_UNKNOWN){
1145
fprintf(stderr, "Unknown error while parsing arguments\n");
1146
exitcode = EXIT_FAILURE;
1147
goto end;
1148
}
1149
}
1150
1151
if(not debug){
1152
avahi_set_log_function(empty_log);
1153
}
1154
1155
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1156
from the signal handler */
1157
/* Initialize the pseudo-RNG for Avahi */
1158
srand((unsigned int) time(NULL));
1159
mc.simple_poll = avahi_simple_poll_new();
1160
if(mc.simple_poll == NULL){
1161
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1162
exitcode = EXIT_FAILURE;
1163
goto end;
1164
}
1165
1166
sigemptyset(&sigterm_action.sa_mask);
1167
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1168
if(ret == -1){
1169
perror("sigaddset");
1170
exitcode = EXIT_FAILURE;
1171
goto end;
1172
}
1173
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1174
if(ret == -1){
1175
perror("sigaddset");
1176
exitcode = EXIT_FAILURE;
1177
goto end;
1178
}
1179
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1180
if(ret == -1){
1181
perror("sigaddset");
1182
exitcode = EXIT_FAILURE;
1183
goto end;
1184
}
1185
/* Need to check if the handler is SIG_IGN before handling:
1186
| [[info:libc:Initial Signal Actions]] |
1187
| [[info:libc:Basic Signal Handling]] |
1188
*/
1189
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1190
if(ret == -1){
1191
perror("sigaction");
1192
return EXIT_FAILURE;
1193
}
1194
if(old_sigterm_action.sa_handler != SIG_IGN){
1195
ret = sigaction(SIGINT, &sigterm_action, NULL);
1196
if(ret == -1){
1197
perror("sigaction");
1198
exitcode = EXIT_FAILURE;
1199
goto end;
1200
}
1201
}
1202
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1203
if(ret == -1){
1204
perror("sigaction");
1205
return EXIT_FAILURE;
1206
}
1207
if(old_sigterm_action.sa_handler != SIG_IGN){
1208
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1209
if(ret == -1){
1210
perror("sigaction");
1211
exitcode = EXIT_FAILURE;
1212
goto end;
1213
}
1214
}
1215
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1216
if(ret == -1){
1217
perror("sigaction");
1218
return EXIT_FAILURE;
1219
}
1220
if(old_sigterm_action.sa_handler != SIG_IGN){
1221
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1222
if(ret == -1){
1223
perror("sigaction");
1224
exitcode = EXIT_FAILURE;
1225
goto end;
1226
}
1227
}
1228
1229
/* If the interface is down, bring it up */
1230
if(interface[0] != '\0'){
1231
if_index = (AvahiIfIndex) if_nametoindex(interface);
1232
if(if_index == 0){
1233
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1234
exitcode = EXIT_FAILURE;
1235
goto end;
1236
}
1237
1238
if(quit_now){
1239
goto end;
1240
}
1241
1242
/* Re-raise priviliges */
1243
errno = 0;
1244
ret = seteuid(0);
1245
if(ret == -1){
1246
perror("seteuid");
1247
}
1248
1249
#ifdef __linux__
1250
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1251
messages to mess up the prompt */
1252
ret = klogctl(8, NULL, 5);
1253
bool restore_loglevel = true;
1254
if(ret == -1){
1255
restore_loglevel = false;
1256
perror("klogctl");
1257
}
1258
#endif /* __linux__ */
1259
1260
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1261
if(sd < 0){
1262
perror("socket");
1263
exitcode = EXIT_FAILURE;
1264
#ifdef __linux__
1265
if(restore_loglevel){
1266
ret = klogctl(7, NULL, 0);
1267
if(ret == -1){
1268
perror("klogctl");
1269
}
1270
}
1271
#endif /* __linux__ */
1272
/* Lower privileges */
1273
errno = 0;
1274
ret = seteuid(uid);
1275
if(ret == -1){
1276
perror("seteuid");
1277
}
1278
goto end;
1279
}
1280
strcpy(network.ifr_name, interface);
1281
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1282
if(ret == -1){
1283
perror("ioctl SIOCGIFFLAGS");
1284
#ifdef __linux__
1285
if(restore_loglevel){
1286
ret = klogctl(7, NULL, 0);
1287
if(ret == -1){
1288
perror("klogctl");
1289
}
1290
}
1291
#endif /* __linux__ */
1292
exitcode = EXIT_FAILURE;
1293
/* Lower privileges */
1294
errno = 0;
1295
ret = seteuid(uid);
1296
if(ret == -1){
1297
perror("seteuid");
1298
}
1299
goto end;
1300
}
1301
if((network.ifr_flags & IFF_UP) == 0){
1302
network.ifr_flags |= IFF_UP;
1303
take_down_interface = true;
1304
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1305
if(ret == -1){
1306
take_down_interface = false;
1307
perror("ioctl SIOCSIFFLAGS");
1308
exitcode = EXIT_FAILURE;
1309
#ifdef __linux__
1310
if(restore_loglevel){
1311
ret = klogctl(7, NULL, 0);
1312
if(ret == -1){
1313
perror("klogctl");
1314
}
1315
}
1316
#endif /* __linux__ */
1317
/* Lower privileges */
1318
errno = 0;
1319
ret = seteuid(uid);
1320
if(ret == -1){
1321
perror("seteuid");
1322
}
1323
goto end;
1324
}
1325
}
1326
/* sleep checking until interface is running */
1327
for(int i=0; i < delay * 4; i++){
1328
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1329
if(ret == -1){
1330
perror("ioctl SIOCGIFFLAGS");
1331
} else if(network.ifr_flags & IFF_RUNNING){
1332
break;
1333
}
1334
struct timespec sleeptime = { .tv_nsec = 250000000 };
1335
ret = nanosleep(&sleeptime, NULL);
1336
if(ret == -1 and errno != EINTR){
1337
perror("nanosleep");
1338
}
1339
}
1340
if(not take_down_interface){
1341
/* We won't need the socket anymore */
1342
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1343
if(ret == -1){
1344
perror("close");
1345
}
1346
}
1347
#ifdef __linux__
1348
if(restore_loglevel){
1349
/* Restores kernel loglevel to default */
1350
ret = klogctl(7, NULL, 0);
1351
if(ret == -1){
1352
perror("klogctl");
1353
}
1354
}
1355
#endif /* __linux__ */
1356
/* Lower privileges */
1357
errno = 0;
1358
if(take_down_interface){
1359
/* Lower privileges */
1360
ret = seteuid(uid);
1361
if(ret == -1){
1362
perror("seteuid");
1363
}
1364
} else {
1365
/* Lower privileges permanently */
1366
ret = setuid(uid);
1367
if(ret == -1){
1368
perror("setuid");
1369
}
1370
}
1371
}
1372
1373
if(quit_now){
1374
goto end;
1375
}
1376
1377
ret = init_gnutls_global(pubkey, seckey);
1378
if(ret == -1){
1379
fprintf(stderr, "init_gnutls_global failed\n");
1380
exitcode = EXIT_FAILURE;
1381
goto end;
1382
} else {
1383
gnutls_initialized = true;
1384
}
1385
1386
if(quit_now){
1387
goto end;
1388
}
1389
1390
tempdir_created = true;
1391
if(mkdtemp(tempdir) == NULL){
1392
tempdir_created = false;
1393
perror("mkdtemp");
1394
goto end;
1395
}
1396
1397
if(quit_now){
1398
goto end;
1399
}
1400
1401
if(not init_gpgme(pubkey, seckey, tempdir)){
1402
fprintf(stderr, "init_gpgme failed\n");
1403
exitcode = EXIT_FAILURE;
1404
goto end;
1405
} else {
1406
gpgme_initialized = true;
1407
}
1408
1409
if(quit_now){
1410
goto end;
1411
}
1412
1413
if(connect_to != NULL){
1414
/* Connect directly, do not use Zeroconf */
1415
/* (Mainly meant for debugging) */
1416
char *address = strrchr(connect_to, ':');
1417
if(address == NULL){
1418
fprintf(stderr, "No colon in address\n");
1419
exitcode = EXIT_FAILURE;
1420
goto end;
1421
}
1422
1423
if(quit_now){
1424
goto end;
1425
}
1426
1427
uint16_t port;
1428
errno = 0;
1429
tmpmax = strtoimax(address+1, &tmp, 10);
1430
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1431
or tmpmax != (uint16_t)tmpmax){
1432
fprintf(stderr, "Bad port number\n");
1433
exitcode = EXIT_FAILURE;
1434
goto end;
1435
}
1436
1437
if(quit_now){
1438
goto end;
1439
}
1440
1441
port = (uint16_t)tmpmax;
1442
*address = '\0';
1443
address = connect_to;
1444
/* Colon in address indicates IPv6 */
1445
int af;
1446
if(strchr(address, ':') != NULL){
1447
af = AF_INET6;
1448
} else {
1449
af = AF_INET;
1450
}
1451
1452
if(quit_now){
1453
goto end;
1454
}
1455
1456
ret = start_mandos_communication(address, port, if_index, af);
1457
if(ret < 0){
1458
exitcode = EXIT_FAILURE;
1459
} else {
1460
exitcode = EXIT_SUCCESS;
1461
}
1462
goto end;
1463
}
1464
1465
if(quit_now){
1466
goto end;
1467
}
1468
1469
{
619
1470
AvahiServerConfig config;
620
AvahiSServiceBrowser *sb = NULL;
621
int error;
622
int ret;
623
int returncode = EXIT_SUCCESS;
624
const char *interface = "eth0";
625
626
while (true){
627
static struct option long_options[] = {
628
{"debug", no_argument, (int *)&debug, 1},
629
{"interface", required_argument, 0, 'i'},
630
{0, 0, 0, 0} };
631
632
int option_index = 0;
633
ret = getopt_long (argc, argv, "i:", long_options,
634
&option_index);
635
636
if (ret == -1){
637
break;
638
}
639
640
switch(ret){
641
case 0:
642
break;
643
case 'i':
644
interface = optarg;
645
break;
646
default:
647
exit(EXIT_FAILURE);
648
}
649
}
650
651
if (not debug){
652
avahi_set_log_function(empty_log);
653
}
654
655
/* Initialize the psuedo-RNG */
656
srand((unsigned int) time(NULL));
657
658
/* Allocate main loop object */
659
if (!(simple_poll = avahi_simple_poll_new())) {
660
fprintf(stderr, "Failed to create simple poll object.\n");
661
662
goto exit;
663
}
664
665
/* Do not publish any local records */
1471
/* Do not publish any local Zeroconf records */
666
1472
avahi_server_config_init(&config);
667
1473
config.publish_hinfo = 0;
668
1474
config.publish_addresses = 0;
669
1475
config.publish_workstation = 0;
670
1476
config.publish_domain = 0;
671
1477
672
1478
/* Allocate a new server */
673
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
674
&config, NULL, NULL, &error);
675
676
/* Free the configuration data */
1479
mc.server = avahi_server_new(avahi_simple_poll_get
1480
(mc.simple_poll), &config, NULL,
1481
NULL, &error);
1482
1483
/* Free the Avahi configuration data */
677
1484
avahi_server_config_free(&config);
678
679
/* Check if creating the server object succeeded */
680
if (!server) {
681
fprintf(stderr, "Failed to create server: %s\n",
682
avahi_strerror(error));
683
returncode = EXIT_FAILURE;
684
goto exit;
685
}
686
687
/* Create the service browser */
688
sb = avahi_s_service_browser_new(server,
689
(AvahiIfIndex)
690
if_nametoindex(interface),
691
AVAHI_PROTO_INET6,
692
"_mandos._tcp", NULL, 0,
693
browse_callback, server);
694
if (!sb) {
695
fprintf(stderr, "Failed to create service browser: %s\n",
696
avahi_strerror(avahi_server_errno(server)));
697
returncode = EXIT_FAILURE;
698
goto exit;
699
}
700
701
/* Run the main loop */
702
703
if (debug){
704
fprintf(stderr, "Starting avahi loop search\n");
705
}
706
707
avahi_simple_poll_loop(simple_poll);
708
709
exit:
710
711
if (debug){
712
fprintf(stderr, "%s exiting\n", argv[0]);
713
}
714
715
/* Cleanup things */
716
if (sb)
717
avahi_s_service_browser_free(sb);
718
719
if (server)
720
avahi_server_free(server);
721
722
if (simple_poll)
723
avahi_simple_poll_free(simple_poll);
724
725
return returncode;
1485
}
1486
1487
/* Check if creating the Avahi server object succeeded */
1488
if(mc.server == NULL){
1489
fprintf(stderr, "Failed to create Avahi server: %s\n",
1490
avahi_strerror(error));
1491
exitcode = EXIT_FAILURE;
1492
goto end;
1493
}
1494
1495
if(quit_now){
1496
goto end;
1497
}
1498
1499
/* Create the Avahi service browser */
1500
sb = avahi_s_service_browser_new(mc.server, if_index,
1501
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1502
NULL, 0, browse_callback, NULL);
1503
if(sb == NULL){
1504
fprintf(stderr, "Failed to create service browser: %s\n",
1505
avahi_strerror(avahi_server_errno(mc.server)));
1506
exitcode = EXIT_FAILURE;
1507
goto end;
1508
}
1509
1510
if(quit_now){
1511
goto end;
1512
}
1513
1514
/* Run the main loop */
1515
1516
if(debug){
1517
fprintf(stderr, "Starting Avahi loop search\n");
1518
}
1519
1520
avahi_simple_poll_loop(mc.simple_poll);
1521
1522
end:
1523
1524
if(debug){
1525
fprintf(stderr, "%s exiting\n", argv[0]);
1526
}
1527
1528
/* Cleanup things */
1529
if(sb != NULL)
1530
avahi_s_service_browser_free(sb);
1531
1532
if(mc.server != NULL)
1533
avahi_server_free(mc.server);
1534
1535
if(mc.simple_poll != NULL)
1536
avahi_simple_poll_free(mc.simple_poll);
1537
1538
if(gnutls_initialized){
1539
gnutls_certificate_free_credentials(mc.cred);
1540
gnutls_global_deinit();
1541
gnutls_dh_params_deinit(mc.dh_params);
1542
}
1543
1544
if(gpgme_initialized){
1545
gpgme_release(mc.ctx);
1546
}
1547
1548
/* Take down the network interface */
1549
if(take_down_interface){
1550
/* Re-raise priviliges */
1551
errno = 0;
1552
ret = seteuid(0);
1553
if(ret == -1){
1554
perror("seteuid");
1555
}
1556
if(geteuid() == 0){
1557
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1558
if(ret == -1){
1559
perror("ioctl SIOCGIFFLAGS");
1560
} else if(network.ifr_flags & IFF_UP) {
1561
network.ifr_flags &= ~IFF_UP; /* clear flag */
1562
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1563
if(ret == -1){
1564
perror("ioctl SIOCSIFFLAGS");
1565
}
1566
}
1567
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1568
if(ret == -1){
1569
perror("close");
1570
}
1571
/* Lower privileges permanently */
1572
errno = 0;
1573
ret = setuid(uid);
1574
if(ret == -1){
1575
perror("setuid");
1576
}
1577
}
1578
}
1579
1580
/* Removes the temp directory used by GPGME */
1581
if(tempdir_created){
1582
DIR *d;
1583
struct dirent *direntry;
1584
d = opendir(tempdir);
1585
if(d == NULL){
1586
if(errno != ENOENT){
1587
perror("opendir");
1588
}
1589
} else {
1590
while(true){
1591
direntry = readdir(d);
1592
if(direntry == NULL){
1593
break;
1594
}
1595
/* Skip "." and ".." */
1596
if(direntry->d_name[0] == '.'
1597
and (direntry->d_name[1] == '\0'
1598
or (direntry->d_name[1] == '.'
1599
and direntry->d_name[2] == '\0'))){
1600
continue;
1601
}
1602
char *fullname = NULL;
1603
ret = asprintf(&fullname, "%s/%s", tempdir,
1604
direntry->d_name);
1605
if(ret < 0){
1606
perror("asprintf");
1607
continue;
1608
}
1609
ret = remove(fullname);
1610
if(ret == -1){
1611
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1612
strerror(errno));
1613
}
1614
free(fullname);
1615
}
1616
closedir(d);
1617
}
1618
ret = rmdir(tempdir);
1619
if(ret == -1 and errno != ENOENT){
1620
perror("rmdir");
1621
}
1622
}
1623
1624
if(quit_now){
1625
sigemptyset(&old_sigterm_action.sa_mask);
1626
old_sigterm_action.sa_handler = SIG_DFL;
1627
ret = sigaction(signal_received, &old_sigterm_action, NULL);
1628
if(ret == -1){
1629
perror("sigaction");
1630
}
1631
raise(signal_received);
1632
}
1633
1634
return exitcode;
726
1635
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0