/mandos/release : revision 237.2.55

1

/* -*- coding: utf-8 -*- */

2

/*

3

* Mandos client - get and decrypt data from a Mandos server

3

* Mandos-client - get and decrypt data from a Mandos server

4

*

5

* This program is partly derived from an example program for an Avahi

6

* service browser, downloaded from

9

* "browse_callback", and parts of "main".

10

*

11

* Everything else is

12

13

14

*

14

15

* This program is free software: you can redistribute it and/or

15

16

* modify it under the terms of the GNU General Public License as

32

33

#define _LARGEFILE_SOURCE

33

34

#define _FILE_OFFSET_BITS 64

34

35

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */

36

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */

36

37

#include <stdio.h> /* fprintf(), stderr, fwrite(), stdout,

38

ferror() */

38

#include <stdio.h> /* fprintf(), stderr, fwrite(),

39

stdout, ferror(), sscanf(),

40

remove() */

39

41

#include <stdint.h> /* uint16_t, uint32_t */

40

42

#include <stddef.h> /* NULL, size_t, ssize_t */

41

43

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

42

44

srand() */

43

45

#include <stdbool.h> /* bool, true */

44

46

#include <string.h> /* memset(), strcmp(), strlen(),

45

strerror(), memcpy(), strcpy() */

47

strerror(), asprintf(), strcpy() */

46

48

#include <sys/ioctl.h> /* ioctl */

47

49

#include <sys/types.h> /* socket(), inet_pton(), sockaddr,

48

50

sockaddr_in6, PF_INET6,

49

51

SOCK_STREAM, INET6_ADDRSTRLEN,

50

uid_t, gid_t */

51

#include <inttypes.h> /* PRIu16 */

52

uid_t, gid_t, open(), opendir(),

53

DIR */

54

#include <sys/stat.h> /* open() */

52

55

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

53

56

struct in6_addr, inet_pton(),

54

57

connect() */

58

#include <fcntl.h> /* open() */

59

#include <dirent.h> /* opendir(), struct dirent, readdir()

60

*/

61

#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */

55

62

#include <assert.h> /* assert() */

56

63

#include <errno.h> /* perror(), errno */

57

#include <time.h> /* time() */

64

#include <time.h> /* nanosleep(), time() */

58

65

#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

59

66

SIOCSIFFLAGS, if_indextoname(),

60

67

if_nametoindex(), IF_NAMESIZE */

68

#include <netinet/in.h>

61

69

#include <unistd.h> /* close(), SEEK_SET, off_t, write(),

62

70

getuid(), getgid(), setuid(),

63

71

setgid() */

64

#include <netinet/in.h>

65

72

#include <arpa/inet.h> /* inet_pton(), htons */

66

#include <iso646.h> /* not, and */

73

#include <iso646.h> /* not, and, or */

67

74

#include <argp.h> /* struct argp_option, error_t, struct

68

75

argp_state, struct argp,

69

76

argp_parse(), ARGP_KEY_ARG,

70

77

ARGP_KEY_END, ARGP_ERR_UNKNOWN */

78

#include <sys/klog.h> /* klogctl() */

71

79

72

80

/* Avahi */

73

81

/* All Avahi types, constants and functions

81

89

#include <avahi-common/error.h>

82

90

83

91

/* GnuTLS */

84

#include <gnutls/gnutls.h> /* All GnuTLS types, constants and functions

92

#include <gnutls/gnutls.h> /* All GnuTLS types, constants and

93

functions:

85

94

gnutls_*

86

95

init_gnutls_session(),

87

96

GNUTLS_* */

88

#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),

97

#include <gnutls/openpgp.h>

98

/* gnutls_certificate_set_openpgp_key_file(),

89

99

GNUTLS_OPENPGP_FMT_BASE64 */

90

100

91

101

/* GPGME */

92

#include <gpgme.h> /* All GPGME types, constants and functions

102

#include <gpgme.h> /* All GPGME types, constants and

103

functions:

93

104

gpgme_*

94

105

GPGME_PROTOCOL_OpenPGP,

95

106

GPG_ERR_NO_* */

96

107

97

108

#define BUFFER_SIZE 256

98

109

110

#define PATHDIR "/conf/conf.d/mandos"

111

#define SECKEY "seckey.txt"

112

#define PUBKEY "pubkey.txt"

113

99

114

bool debug = false;

100

static const char *keydir = "/conf/conf.d/mandos";

101

115

static const char mandos_protocol_version[] = "1";

102

const char *argp_program_version = "password-request 1.0";

116

const char *argp_program_version = "mandos-client " VERSION;

103

117

const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";

104

118

105

119

/* Used for passing in values through the Avahi callback functions */

110

124

unsigned int dh_bits;

111

125

gnutls_dh_params_t dh_params;

112

126

const char *priority;

127

gpgme_ctx_t ctx;

113

128

} mandos_context;

114

129

115

130

/*

119

134

*/

120

135

size_t adjustbuffer(char **buffer, size_t buffer_length,

121

136

size_t buffer_capacity){

122

if (buffer_length + BUFFER_SIZE > buffer_capacity){

137

if(buffer_length + BUFFER_SIZE > buffer_capacity){

123

138

*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

124

if (buffer == NULL){

139

if(buffer == NULL){

125

140

return 0;

126

141

}

127

142

buffer_capacity += BUFFER_SIZE;

130

145

}

131

146

132

147

/*

133

* Decrypt OpenPGP data using keyrings in HOMEDIR.

134

* Returns -1 on error

148

* Initialize GPGME.

135

149

*/

136

static ssize_t pgp_packet_decrypt (const char *cryptotext,

137

size_t crypto_size,

138

char **plaintext,

139

const char *homedir){

140

gpgme_data_t dh_crypto, dh_plain;

141

gpgme_ctx_t ctx;

150

static bool init_gpgme(mandos_context *mc, const char *seckey,

151

const char *pubkey, const char *tempdir){

152

int ret;

142

153

gpgme_error_t rc;

143

ssize_t ret;

144

size_t plaintext_capacity = 0;

145

ssize_t plaintext_length = 0;

146

154

gpgme_engine_info_t engine_info;

147

155

148

if (debug){

149

fprintf(stderr, "Trying to decrypt OpenPGP data\n");

156

157

/*

158

* Helper function to insert pub and seckey to the engine keyring.

159

*/

160

bool import_key(const char *filename){

161

int fd;

162

gpgme_data_t pgp_data;

163

164

fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));

165

if(fd == -1){

166

perror("open");

167

return false;

168

}

169

170

rc = gpgme_data_new_from_fd(&pgp_data, fd);

171

if(rc != GPG_ERR_NO_ERROR){

172

fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",

173

gpgme_strsource(rc), gpgme_strerror(rc));

174

return false;

175

}

176

177

rc = gpgme_op_import(mc->ctx, pgp_data);

178

if(rc != GPG_ERR_NO_ERROR){

179

fprintf(stderr, "bad gpgme_op_import: %s: %s\n",

180

gpgme_strsource(rc), gpgme_strerror(rc));

181

return false;

182

}

183

184

ret = (int)TEMP_FAILURE_RETRY(close(fd));

185

if(ret == -1){

186

perror("close");

187

}

188

gpgme_data_release(pgp_data);

189

return true;

190

}

191

192

if(debug){

193

fprintf(stderr, "Initialize gpgme\n");

150

194

}

151

195

152

196

/* Init GPGME */

153

197

gpgme_check_version(NULL);

154

198

rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);

155

if (rc != GPG_ERR_NO_ERROR){

199

if(rc != GPG_ERR_NO_ERROR){

156

200

fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",

157

201

gpgme_strsource(rc), gpgme_strerror(rc));

158

return -1;

202

return false;

159

203

}

160

204

161

/* Set GPGME home directory for the OpenPGP engine only */

162

rc = gpgme_get_engine_info (&engine_info);

163

if (rc != GPG_ERR_NO_ERROR){

205

/* Set GPGME home directory for the OpenPGP engine only */

206

rc = gpgme_get_engine_info(&engine_info);

207

if(rc != GPG_ERR_NO_ERROR){

164

208

fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",

165

209

gpgme_strsource(rc), gpgme_strerror(rc));

166

return -1;

210

return false;

167

211

}

168

212

while(engine_info != NULL){

169

213

if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){

170

214

gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,

171

engine_info->file_name, homedir);

215

engine_info->file_name, tempdir);

172

216

break;

173

217

}

174

218

engine_info = engine_info->next;

175

219

}

176

220

if(engine_info == NULL){

177

fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);

178

return -1;

221

fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);

222

return false;

223

}

224

225

/* Create new GPGME "context" */

226

rc = gpgme_new(&(mc->ctx));

227

if(rc != GPG_ERR_NO_ERROR){

228

fprintf(stderr, "bad gpgme_new: %s: %s\n",

229

gpgme_strsource(rc), gpgme_strerror(rc));

230

return false;

231

}

232

233

if(not import_key(pubkey) or not import_key(seckey)){

234

return false;

235

}

236

237

return true;

238

}

239

240

/*

241

* Decrypt OpenPGP data.

242

* Returns -1 on error

243

*/

244

static ssize_t pgp_packet_decrypt(const mandos_context *mc,

245

const char *cryptotext,

246

size_t crypto_size,

247

char **plaintext){

248

gpgme_data_t dh_crypto, dh_plain;

249

gpgme_error_t rc;

250

ssize_t ret;

251

size_t plaintext_capacity = 0;

252

ssize_t plaintext_length = 0;

253

254

if(debug){

255

fprintf(stderr, "Trying to decrypt OpenPGP data\n");

179

256

}

180

257

181

258

/* Create new GPGME data buffer from memory cryptotext */

182

259

rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,

183

260

0);

184

if (rc != GPG_ERR_NO_ERROR){

261

if(rc != GPG_ERR_NO_ERROR){

185

262

fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",

186

263

gpgme_strsource(rc), gpgme_strerror(rc));

187

264

return -1;

189

266

190

267

/* Create new empty GPGME data buffer for the plaintext */

191

268

rc = gpgme_data_new(&dh_plain);

192

if (rc != GPG_ERR_NO_ERROR){

269

if(rc != GPG_ERR_NO_ERROR){

193

270

fprintf(stderr, "bad gpgme_data_new: %s: %s\n",

194

271

gpgme_strsource(rc), gpgme_strerror(rc));

195

272

gpgme_data_release(dh_crypto);

196

273

return -1;

197

274

}

198

275

199

/* Create new GPGME "context" */

200

rc = gpgme_new(&ctx);

201

if (rc != GPG_ERR_NO_ERROR){

202

fprintf(stderr, "bad gpgme_new: %s: %s\n",

203

gpgme_strsource(rc), gpgme_strerror(rc));

204

plaintext_length = -1;

205

goto decrypt_end;

206

}

207

208

276

/* Decrypt data from the cryptotext data buffer to the plaintext

209

277

data buffer */

210

rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);

211

if (rc != GPG_ERR_NO_ERROR){

278

rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);

279

if(rc != GPG_ERR_NO_ERROR){

212

280

fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",

213

281

gpgme_strsource(rc), gpgme_strerror(rc));

214

282

plaintext_length = -1;

283

if(debug){

284

gpgme_decrypt_result_t result;

285

result = gpgme_op_decrypt_result(mc->ctx);

286

if(result == NULL){

287

fprintf(stderr, "gpgme_op_decrypt_result failed\n");

288

} else {

289

fprintf(stderr, "Unsupported algorithm: %s\n",

290

result->unsupported_algorithm);

291

fprintf(stderr, "Wrong key usage: %u\n",

292

result->wrong_key_usage);

293

if(result->file_name != NULL){

294

fprintf(stderr, "File name: %s\n", result->file_name);

295

}

296

gpgme_recipient_t recipient;

297

recipient = result->recipients;

298

if(recipient){

299

while(recipient != NULL){

300

fprintf(stderr, "Public key algorithm: %s\n",

301

gpgme_pubkey_algo_name(recipient->pubkey_algo));

302

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

303

fprintf(stderr, "Secret key available: %s\n",

304

recipient->status == GPG_ERR_NO_SECKEY

305

? "No" : "Yes");

306

recipient = recipient->next;

307

}

308

}

309

}

310

}

215

311

goto decrypt_end;

216

312

}

217

313

219

315

fprintf(stderr, "Decryption of OpenPGP data succeeded\n");

220

316

}

221

317

222

if (debug){

223

gpgme_decrypt_result_t result;

224

result = gpgme_op_decrypt_result(ctx);

225

if (result == NULL){

226

fprintf(stderr, "gpgme_op_decrypt_result failed\n");

227

} else {

228

fprintf(stderr, "Unsupported algorithm: %s\n",

229

result->unsupported_algorithm);

230

fprintf(stderr, "Wrong key usage: %u\n",

231

result->wrong_key_usage);

232

if(result->file_name != NULL){

233

fprintf(stderr, "File name: %s\n", result->file_name);

234

}

235

gpgme_recipient_t recipient;

236

recipient = result->recipients;

237

if(recipient){

238

while(recipient != NULL){

239

fprintf(stderr, "Public key algorithm: %s\n",

240

gpgme_pubkey_algo_name(recipient->pubkey_algo));

241

fprintf(stderr, "Key ID: %s\n", recipient->keyid);

242

fprintf(stderr, "Secret key available: %s\n",

243

recipient->status == GPG_ERR_NO_SECKEY

244

? "No" : "Yes");

245

recipient = recipient->next;

246

}

247

}

248

}

249

}

250

251

318

/* Seek back to the beginning of the GPGME plaintext data buffer */

252

if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){

253

perror("pgpme_data_seek");

319

if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){

320

perror("gpgme_data_seek");

254

321

plaintext_length = -1;

255

322

goto decrypt_end;

256

323

}

260

327

plaintext_capacity = adjustbuffer(plaintext,

261

328

(size_t)plaintext_length,

262

329

plaintext_capacity);

263

if (plaintext_capacity == 0){

330

if(plaintext_capacity == 0){

264

331

perror("adjustbuffer");

265

332

plaintext_length = -1;

266

333

goto decrypt_end;

269

336

ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,

270

337

BUFFER_SIZE);

271

338

/* Print the data, if any */

272

if (ret == 0){

339

if(ret == 0){

273

340

/* EOF */

274

341

break;

275

342

}

280

347

}

281

348

plaintext_length += ret;

282

349

}

283

350

284

351

if(debug){

285

352

fprintf(stderr, "Decrypted password is: ");

286

353

for(ssize_t i = 0; i < plaintext_length; i++){

299

366

return plaintext_length;

300

367

}

301

368

302

static const char * safer_gnutls_strerror (int value) {

303

const char *ret = gnutls_strerror (value);

304

if (ret == NULL)

369

static const char * safer_gnutls_strerror(int value) {

370

const char *ret = gnutls_strerror(value); /* Spurious warning from

371

-Wunreachable-code */

372

if(ret == NULL)

305

373

ret = "(unknown)";

306

374

return ret;

307

375

}

313

381

}

314

382

315

383

static int init_gnutls_global(mandos_context *mc,

316

const char *pubkeyfile,

317

const char *seckeyfile){

384

const char *pubkeyfilename,

385

const char *seckeyfilename){

318

386

int ret;

319

387

320

388

if(debug){

322

390

}

323

391

324

392

ret = gnutls_global_init();

325

if (ret != GNUTLS_E_SUCCESS) {

326

fprintf (stderr, "GnuTLS global_init: %s\n",

327

safer_gnutls_strerror(ret));

393

if(ret != GNUTLS_E_SUCCESS) {

394

fprintf(stderr, "GnuTLS global_init: %s\n",

395

safer_gnutls_strerror(ret));

328

396

return -1;

329

397

}

330

398

331

if (debug){

399

if(debug){

332

400

/* "Use a log level over 10 to enable all debugging options."

333

401

* - GnuTLS manual

334

402

*/

338

406

339

407

/* OpenPGP credentials */

340

408

gnutls_certificate_allocate_credentials(&mc->cred);

341

if (ret != GNUTLS_E_SUCCESS){

342

fprintf (stderr, "GnuTLS memory error: %s\n",

343

safer_gnutls_strerror(ret));

344

gnutls_global_deinit ();

409

if(ret != GNUTLS_E_SUCCESS){

410

fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning

411

* from

412

* -Wunreachable-code

413

*/

414

safer_gnutls_strerror(ret));

415

gnutls_global_deinit();

345

416

return -1;

346

417

}

347

418

348

419

if(debug){

349

fprintf(stderr, "Attempting to use OpenPGP certificate %s"

350

" and keyfile %s as GnuTLS credentials\n", pubkeyfile,

351

seckeyfile);

420

fprintf(stderr, "Attempting to use OpenPGP public key %s and"

421

" secret key %s as GnuTLS credentials\n", pubkeyfilename,

422

seckeyfilename);

352

423

}

353

424

354

425

ret = gnutls_certificate_set_openpgp_key_file

355

(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);

356

if (ret != GNUTLS_E_SUCCESS) {

426

(mc->cred, pubkeyfilename, seckeyfilename,

427

GNUTLS_OPENPGP_FMT_BASE64);

428

if(ret != GNUTLS_E_SUCCESS) {

357

429

fprintf(stderr,

358

430

"Error[%d] while reading the OpenPGP key pair ('%s',"

359

" '%s')\n", ret, pubkeyfile, seckeyfile);

360

fprintf(stdout, "The GnuTLS error is: %s\n",

431

" '%s')\n", ret, pubkeyfilename, seckeyfilename);

432

fprintf(stderr, "The GnuTLS error is: %s\n",

361

433

safer_gnutls_strerror(ret));

362

434

goto globalfail;

363

435

}

364

436

365

437

/* GnuTLS server initialization */

366

438

ret = gnutls_dh_params_init(&mc->dh_params);

367

if (ret != GNUTLS_E_SUCCESS) {

368

fprintf (stderr, "Error in GnuTLS DH parameter initialization:"

369

" %s\n", safer_gnutls_strerror(ret));

439

if(ret != GNUTLS_E_SUCCESS) {

440

fprintf(stderr, "Error in GnuTLS DH parameter initialization:"

441

" %s\n", safer_gnutls_strerror(ret));

370

442

goto globalfail;

371

443

}

372

444

ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);

373

if (ret != GNUTLS_E_SUCCESS) {

374

fprintf (stderr, "Error in GnuTLS prime generation: %s\n",

375

safer_gnutls_strerror(ret));

445

if(ret != GNUTLS_E_SUCCESS) {

446

fprintf(stderr, "Error in GnuTLS prime generation: %s\n",

447

safer_gnutls_strerror(ret));

376

448

goto globalfail;

377

449

}

378

450

379

451

gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);

380

452

381

453

return 0;

382

454

383

455

globalfail:

384

456

385

457

gnutls_certificate_free_credentials(mc->cred);

386

458

gnutls_global_deinit();

459

gnutls_dh_params_deinit(mc->dh_params);

387

460

return -1;

388

389

461

}

390

462

391

463

static int init_gnutls_session(mandos_context *mc,

393

465

int ret;

394

466

/* GnuTLS session creation */

395

467

ret = gnutls_init(session, GNUTLS_SERVER);

396

if (ret != GNUTLS_E_SUCCESS){

468

if(ret != GNUTLS_E_SUCCESS){

397

469

fprintf(stderr, "Error in GnuTLS session initialization: %s\n",

398

470

safer_gnutls_strerror(ret));

399

471

}

401

473

{

402

474

const char *err;

403

475

ret = gnutls_priority_set_direct(*session, mc->priority, &err);

404

if (ret != GNUTLS_E_SUCCESS) {

476

if(ret != GNUTLS_E_SUCCESS) {

405

477

fprintf(stderr, "Syntax error at: %s\n", err);

406

478

fprintf(stderr, "GnuTLS error: %s\n",

407

479

safer_gnutls_strerror(ret));

408

gnutls_deinit (*session);

480

gnutls_deinit(*session);

409

481

return -1;

410

482

}

411

483

}

412

484

413

485

ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,

414

486

mc->cred);

415

if (ret != GNUTLS_E_SUCCESS) {

487

if(ret != GNUTLS_E_SUCCESS) {

416

488

fprintf(stderr, "Error setting GnuTLS credentials: %s\n",

417

489

safer_gnutls_strerror(ret));

418

gnutls_deinit (*session);

490

gnutls_deinit(*session);

419

491

return -1;

420

492

}

421

493

422

494

/* ignore client certificate if any. */

423

gnutls_certificate_server_set_request (*session,

424

GNUTLS_CERT_IGNORE);

495

gnutls_certificate_server_set_request(*session,

496

GNUTLS_CERT_IGNORE);

425

497

426

gnutls_dh_set_prime_bits (*session, mc->dh_bits);

498

gnutls_dh_set_prime_bits(*session, mc->dh_bits);

427

499

428

500

return 0;

429

501

}

437

509

AvahiIfIndex if_index,

438

510

mandos_context *mc){

439

511

int ret, tcp_sd;

512

ssize_t sret;

440

513

union { struct sockaddr in; struct sockaddr_in6 in6; } to;

441

514

char *buffer = NULL;

442

515

char *decrypted_buffer;

448

521

char interface[IF_NAMESIZE];

449

522

gnutls_session_t session;

450

523

451

ret = init_gnutls_session (mc, &session);

452

if (ret != 0){

524

ret = init_gnutls_session(mc, &session);

525

if(ret != 0){

453

526

return -1;

454

527

}

455

528

463

536

perror("socket");

464

537

return -1;

465

538

}

466

539

467

540

if(debug){

468

541

if(if_indextoname((unsigned int)if_index, interface) == NULL){

469

542

perror("if_indextoname");

472

545

fprintf(stderr, "Binding to interface %s\n", interface);

473

546

}

474

547

475

memset(&to,0,sizeof(to)); /* Spurious warning */

548

memset(&to, 0, sizeof(to));

476

549

to.in6.sin6_family = AF_INET6;

477

550

/* It would be nice to have a way to detect if we were passed an

478

551

IPv4 address here. Now we assume an IPv6 address. */

479

552

ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);

480

if (ret < 0 ){

553

if(ret < 0 ){

481

554

perror("inet_pton");

482

555

return -1;

483

556

}

485

558

fprintf(stderr, "Bad address: %s\n", ip);

486

559

return -1;

487

560

}

488

to.in6.sin6_port = htons(port); /* Spurious warning */

561

to.in6.sin6_port = htons(port); /* Spurious warnings from

562

-Wconversion and

563

-Wunreachable-code */

489

564

490

565

to.in6.sin6_scope_id = (uint32_t)if_index;

491

566

504

579

}

505

580

506

581

ret = connect(tcp_sd, &to.in, sizeof(to));

507

if (ret < 0){

582

if(ret < 0){

508

583

perror("connect");

509

584

return -1;

510

585

}

511

586

512

587

const char *out = mandos_protocol_version;

513

588

written = 0;

514

while (true){

589

while(true){

515

590

size_t out_size = strlen(out);

516

ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,

591

ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,

517

592

out_size - written));

518

if (ret == -1){

593

if(ret == -1){

519

594

perror("write");

520

595

retval = -1;

521

596

goto mandos_end;

524

599

if(written < out_size){

525

600

continue;

526

601

} else {

527

if (out == mandos_protocol_version){

602

if(out == mandos_protocol_version){

528

603

written = 0;

529

604

out = "\r\n";

530

605

} else {

532

607

}

533

608

}

534

609

}

535

610

536

611

if(debug){

537

612

fprintf(stderr, "Establishing TLS session with %s\n", ip);

538

613

}

539

614

540

gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);

541

615

gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);

616

542

617

do{

543

ret = gnutls_handshake (session);

618

ret = gnutls_handshake(session);

544

619

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

545

620

546

if (ret != GNUTLS_E_SUCCESS){

621

if(ret != GNUTLS_E_SUCCESS){

547

622

if(debug){

548

623

fprintf(stderr, "*** GnuTLS Handshake failed ***\n");

549

gnutls_perror (ret);

624

gnutls_perror(ret);

550

625

}

551

626

retval = -1;

552

627

goto mandos_end;

558

633

fprintf(stderr, "Retrieving pgp encrypted password from %s\n",

559

634

ip);

560

635

}

561

636

562

637

while(true){

563

638

buffer_capacity = adjustbuffer(&buffer, buffer_length,

564

639

buffer_capacity);

565

if (buffer_capacity == 0){

640

if(buffer_capacity == 0){

566

641

perror("adjustbuffer");

567

642

retval = -1;

568

643

goto mandos_end;

569

644

}

570

645

571

ret = gnutls_record_recv(session, buffer+buffer_length,

572

BUFFER_SIZE);

573

if (ret == 0){

646

sret = gnutls_record_recv(session, buffer+buffer_length,

647

BUFFER_SIZE);

648

if(sret == 0){

574

649

break;

575

650

}

576

if (ret < 0){

577

switch(ret){

651

if(sret < 0){

652

switch(sret){

578

653

case GNUTLS_E_INTERRUPTED:

579

654

case GNUTLS_E_AGAIN:

580

655

break;

581

656

case GNUTLS_E_REHANDSHAKE:

582

657

do{

583

ret = gnutls_handshake (session);

658

ret = gnutls_handshake(session);

584

659

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

585

if (ret < 0){

660

if(ret < 0){

586

661

fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");

587

gnutls_perror (ret);

662

gnutls_perror(ret);

588

663

retval = -1;

589

664

goto mandos_end;

590

665

}

593

668

fprintf(stderr, "Unknown error while reading data from"

594

669

" encrypted session with Mandos server\n");

595

670

retval = -1;

596

gnutls_bye (session, GNUTLS_SHUT_RDWR);

671

gnutls_bye(session, GNUTLS_SHUT_RDWR);

597

672

goto mandos_end;

598

673

}

599

674

} else {

600

buffer_length += (size_t) ret;

675

buffer_length += (size_t) sret;

601

676

}

602

677

}

603

678

605

680

fprintf(stderr, "Closing TLS session\n");

606

681

}

607

682

608

gnutls_bye (session, GNUTLS_SHUT_RDWR);

683

gnutls_bye(session, GNUTLS_SHUT_RDWR);

609

684

610

if (buffer_length > 0){

611

decrypted_buffer_size = pgp_packet_decrypt(buffer,

685

if(buffer_length > 0){

686

decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,

612

687

buffer_length,

613

&decrypted_buffer,

614

keydir);

615

if (decrypted_buffer_size >= 0){

688

&decrypted_buffer);

689

if(decrypted_buffer_size >= 0){

616

690

written = 0;

617

691

while(written < (size_t) decrypted_buffer_size){

618

ret = (int)fwrite (decrypted_buffer + written, 1,

619

(size_t)decrypted_buffer_size - written,

620

stdout);

692

ret = (int)fwrite(decrypted_buffer + written, 1,

693

(size_t)decrypted_buffer_size - written,

694

stdout);

621

695

if(ret == 0 and ferror(stdout)){

622

696

if(debug){

623

697

fprintf(stderr, "Error writing encrypted data: %s\n",

632

706

} else {

633

707

retval = -1;

634

708

}

709

} else {

710

retval = -1;

635

711

}

636

712

637

713

/* Shutdown procedure */

638

714

639

715

mandos_end:

640

716

free(buffer);

641

close(tcp_sd);

642

gnutls_deinit (session);

717

ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));

718

if(ret == -1){

719

perror("close");

720

}

721

gnutls_deinit(session);

643

722

return retval;

644

723

}

645

724

658

737

flags,

659

738

void* userdata) {

660

739

mandos_context *mc = userdata;

661

assert(r); /* Spurious warning */

740

assert(r);

662

741

663

742

/* Called whenever a service has been resolved successfully or

664

743

timed out */

665

744

666

switch (event) {

745

switch(event) {

667

746

default:

668

747

case AVAHI_RESOLVER_FAILURE:

669

748

fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"

677

756

avahi_address_snprint(ip, sizeof(ip), address);

678

757

if(debug){

679

758

fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"

680

PRIu16 ") on port %d\n", name, host_name, ip,

681

interface, port);

759

PRIdMAX ") on port %" PRIu16 "\n", name, host_name,

760

ip, (intmax_t)interface, port);

682

761

}

683

762

int ret = start_mandos_communication(ip, port, interface, mc);

684

if (ret == 0){

763

if(ret == 0){

685

764

avahi_simple_poll_quit(mc->simple_poll);

686

765

}

687

766

}

700

779

flags,

701

780

void* userdata) {

702

781

mandos_context *mc = userdata;

703

assert(b); /* Spurious warning */

782

assert(b);

704

783

705

784

/* Called whenever a new services becomes available on the LAN or

706

785

is removed from the LAN */

707

786

708

switch (event) {

787

switch(event) {

709

788

default:

710

789

case AVAHI_BROWSER_FAILURE:

711

790

720

799

the callback function is called the Avahi server will free the

721

800

resolver for us. */

722

801

723

if (!(avahi_s_service_resolver_new(mc->server, interface,

802

if(!(avahi_s_service_resolver_new(mc->server, interface,

724

803

protocol, name, type, domain,

725

804

AVAHI_PROTO_INET6, 0,

726

805

resolve_callback, mc)))

740

819

}

741

820

}

742

821

743

/* Combines file name and path and returns the malloced new

744

string. some sane checks could/should be added */

745

static const char *combinepath(const char *first, const char *second){

746

size_t f_len = strlen(first);

747

size_t s_len = strlen(second);

748

char *tmp = malloc(f_len + s_len + 2);

749

if (tmp == NULL){

750

return NULL;

751

}

752

if(f_len > 0){

753

memcpy(tmp, first, f_len); /* Spurious warning */

754

}

755

tmp[f_len] = '/';

756

if(s_len > 0){

757

memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */

758

}

759

tmp[f_len + 1 + s_len] = '\0';

760

return tmp;

761

}

762

763

764

822

int main(int argc, char *argv[]){

765

823

AvahiSServiceBrowser *sb = NULL;

766

824

int error;

767

825

int ret;

826

intmax_t tmpmax;

827

int numchars;

768

828

int exitcode = EXIT_SUCCESS;

769

829

const char *interface = "eth0";

770

830

struct ifreq network;

772

832

uid_t uid;

773

833

gid_t gid;

774

834

char *connect_to = NULL;

835

char tempdir[] = "/tmp/mandosXXXXXX";

836

bool tempdir_created = false;

775

837

AvahiIfIndex if_index = AVAHI_IF_UNSPEC;

776

const char *pubkeyfile = "pubkey.txt";

777

const char *seckeyfile = "seckey.txt";

838

const char *seckey = PATHDIR "/" SECKEY;

839

const char *pubkey = PATHDIR "/" PUBKEY;

840

778

841

mandos_context mc = { .simple_poll = NULL, .server = NULL,

779

.dh_bits = 1024, .priority = "SECURE256"};

780

bool gnutls_initalized = false;

842

.dh_bits = 1024, .priority = "SECURE256"

843

":!CTYPE-X.509:+CTYPE-OPENPGP" };

844

bool gnutls_initialized = false;

845

bool gpgme_initialized = false;

846

double delay = 2.5;

781

847

782

848

{

783

849

struct argp_option options[] = {

784

850

{ .name = "debug", .key = 128,

785

851

.doc = "Debug mode", .group = 3 },

786

852

{ .name = "connect", .key = 'c',

787

.arg = "IP",

788

.doc = "Connect directly to a sepcified mandos server",

853

.arg = "ADDRESS:PORT",

854

.doc = "Connect directly to a specific Mandos server",

789

855

.group = 1 },

790

856

{ .name = "interface", .key = 'i',

791

.arg = "INTERFACE",

792

.doc = "Interface that Avahi will conntect through",

793

.group = 1 },

794

{ .name = "keydir", .key = 'd',

795

.arg = "KEYDIR",

796

.doc = "Directory where the openpgp keyring is",

857

.arg = "NAME",

858

.doc = "Interface that will be used to search for Mandos"

859

" servers",

797

860

.group = 1 },

798

861

{ .name = "seckey", .key = 's',

799

.arg = "SECKEY",

800

.doc = "Secret openpgp key for gnutls authentication",

862

.arg = "FILE",

863

.doc = "OpenPGP secret key file base name",

801

864

.group = 1 },

802

865

{ .name = "pubkey", .key = 'p',

803

.arg = "PUBKEY",

804

.doc = "Public openpgp key for gnutls authentication",

866

.arg = "FILE",

867

.doc = "OpenPGP public key file base name",

805

868

.group = 2 },

806

869

{ .name = "dh-bits", .key = 129,

807

870

.arg = "BITS",

808

.doc = "dh-bits to use in gnutls communication",

871

.doc = "Bit length of the prime number used in the"

872

" Diffie-Hellman key exchange",

809

873

.group = 2 },

810

874

{ .name = "priority", .key = 130,

811

.arg = "PRIORITY",

812

.doc = "GNUTLS priority", .group = 1 },

875

.arg = "STRING",

876

.doc = "GnuTLS priority string for the TLS handshake",

877

.group = 1 },

878

{ .name = "delay", .key = 131,

879

.arg = "SECONDS",

880

.doc = "Maximum delay to wait for interface startup",

881

.group = 2 },

813

882

{ .name = NULL }

814

883

};

815

816

884

817

error_t parse_opt (int key, char *arg,

818

struct argp_state *state) {

819

/* Get the INPUT argument from `argp_parse', which we know is

820

a pointer to our plugin list pointer. */

821

switch (key) {

822

case 128:

885

error_t parse_opt(int key, char *arg,

886

struct argp_state *state) {

887

switch(key) {

888

case 128: /* --debug */

823

889

debug = true;

824

890

break;

825

case 'c':

891

case 'c': /* --connect */

826

892

connect_to = arg;

827

893

break;

828

case 'i':

894

case 'i': /* --interface */

829

895

interface = arg;

830

896

break;

831

case 'd':

832

keydir = arg;

833

break;

834

case 's':

835

seckeyfile = arg;

836

break;

837

case 'p':

838

pubkeyfile = arg;

839

break;

840

case 129:

841

errno = 0;

842

mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);

843

if (errno){

844

perror("strtol");

897

case 's': /* --seckey */

898

seckey = arg;

899

break;

900

case 'p': /* --pubkey */

901

pubkey = arg;

902

break;

903

case 129: /* --dh-bits */

904

ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);

905

if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax

906

or arg[numchars] != '\0'){

907

fprintf(stderr, "Bad number of DH bits\n");

845

908

exit(EXIT_FAILURE);

846

909

}

910

mc.dh_bits = (typeof(mc.dh_bits))tmpmax;

847

911

break;

848

case 130:

912

case 130: /* --priority */

849

913

mc.priority = arg;

850

914

break;

915

case 131: /* --delay */

916

ret = sscanf(arg, "%lf%n", &delay, &numchars);

917

if(ret < 1 or arg[numchars] != '\0'){

918

fprintf(stderr, "Bad delay\n");

919

exit(EXIT_FAILURE);

920

}

921

break;

851

922

case ARGP_KEY_ARG:

852

argp_usage (state);

923

argp_usage(state);

853

924

case ARGP_KEY_END:

854

925

break;

855

926

default:

857

928

}

858

929

return 0;

859

930

}

860

931

861

932

struct argp argp = { .options = options, .parser = parse_opt,

862

933

.args_doc = "",

863

934

.doc = "Mandos client -- Get and decrypt"

864

" passwords from mandos server" };

865

ret = argp_parse (&argp, argc, argv, 0, 0, NULL);

866

if (ret == ARGP_ERR_UNKNOWN){

935

" passwords from a Mandos server" };

936

ret = argp_parse(&argp, argc, argv, 0, 0, NULL);

937

if(ret == ARGP_ERR_UNKNOWN){

867

938

fprintf(stderr, "Unknown error while parsing arguments\n");

868

939

exitcode = EXIT_FAILURE;

869

940

goto end;

870

941

}

871

942

}

872

873

pubkeyfile = combinepath(keydir, pubkeyfile);

874

if (pubkeyfile == NULL){

875

perror("combinepath");

876

exitcode = EXIT_FAILURE;

877

goto end;

878

}

879

880

seckeyfile = combinepath(keydir, seckeyfile);

881

if (seckeyfile == NULL){

882

perror("combinepath");

883

exitcode = EXIT_FAILURE;

884

goto end;

885

}

886

887

ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);

888

if (ret == -1){

889

fprintf(stderr, "init_gnutls_global failed\n");

890

exitcode = EXIT_FAILURE;

891

goto end;

892

} else {

893

gnutls_initalized = true;

894

}

895

943

896

944

/* If the interface is down, bring it up */

897

945

{

946

/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO

947

messages to mess up the prompt */

948

ret = klogctl(8, NULL, 5);

949

if(ret == -1){

950

perror("klogctl");

951

}

952

898

953

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

899

954

if(sd < 0) {

900

955

perror("socket");

901

956

exitcode = EXIT_FAILURE;

957

ret = klogctl(7, NULL, 0);

958

if(ret == -1){

959

perror("klogctl");

960

}

902

961

goto end;

903

962

}

904

strcpy(network.ifr_name, interface); /* Spurious warning */

963

strcpy(network.ifr_name, interface);

905

964

ret = ioctl(sd, SIOCGIFFLAGS, &network);

906

965

if(ret == -1){

907

966

perror("ioctl SIOCGIFFLAGS");

967

ret = klogctl(7, NULL, 0);

968

if(ret == -1){

969

perror("klogctl");

970

}

908

971

exitcode = EXIT_FAILURE;

909

972

goto end;

910

973

}

914

977

if(ret == -1){

915

978

perror("ioctl SIOCSIFFLAGS");

916

979

exitcode = EXIT_FAILURE;

980

ret = klogctl(7, NULL, 0);

981

if(ret == -1){

982

perror("klogctl");

983

}

917

984

goto end;

918

985

}

919

986

}

920

close(sd);

987

/* sleep checking until interface is running */

988

for(int i=0; i < delay * 4; i++){

989

ret = ioctl(sd, SIOCGIFFLAGS, &network);

990

if(ret == -1){

991

perror("ioctl SIOCGIFFLAGS");

992

} else if(network.ifr_flags & IFF_RUNNING){

993

break;

994

}

995

struct timespec sleeptime = { .tv_nsec = 250000000 };

996

nanosleep(&sleeptime, NULL);

997

}

998

ret = (int)TEMP_FAILURE_RETRY(close(sd));

999

if(ret == -1){

1000

perror("close");

1001

}

1002

/* Restores kernel loglevel to default */

1003

ret = klogctl(7, NULL, 0);

1004

if(ret == -1){

1005

perror("klogctl");

1006

}

921

1007

}

922

1008

923

1009

uid = getuid();

924

1010

gid = getgid();

925

1011

1012

setgid(gid);

1013

if(ret == -1){

1014

perror("setgid");

1015

}

1016

926

1017

ret = setuid(uid);

927

if (ret == -1){

1018

if(ret == -1){

928

1019

perror("setuid");

929

1020

}

930

1021

931

setgid(gid);

932

if (ret == -1){

933

perror("setgid");

1022

ret = init_gnutls_global(&mc, pubkey, seckey);

1023

if(ret == -1){

1024

fprintf(stderr, "init_gnutls_global failed\n");

1025

exitcode = EXIT_FAILURE;

1026

goto end;

1027

} else {

1028

gnutls_initialized = true;

1029

}

1030

1031

if(mkdtemp(tempdir) == NULL){

1032

perror("mkdtemp");

1033

goto end;

1034

}

1035

tempdir_created = true;

1036

1037

if(not init_gpgme(&mc, pubkey, seckey, tempdir)){

1038

fprintf(stderr, "init_gpgme failed\n");

1039

exitcode = EXIT_FAILURE;

1040

goto end;

1041

} else {

1042

gpgme_initialized = true;

934

1043

}

935

1044

936

1045

if_index = (AvahiIfIndex) if_nametoindex(interface);

937

1046

if(if_index == 0){

938

1047

fprintf(stderr, "No such interface: \"%s\"\n", interface);

939

exit(EXIT_FAILURE);

1048

exitcode = EXIT_FAILURE;

1049

goto end;

940

1050

}

941

1051

942

1052

if(connect_to != NULL){

948

1058

exitcode = EXIT_FAILURE;

949

1059

goto end;

950

1060

}

951

errno = 0;

952

uint16_t port = (uint16_t) strtol(address+1, NULL, 10);

953

if(errno){

954

perror("Bad port number");

1061

uint16_t port;

1062

ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);

1063

if(ret < 1 or tmpmax != (uint16_t)tmpmax

1064

or address[numchars+1] != '\0'){

1065

fprintf(stderr, "Bad port number\n");

955

1066

exitcode = EXIT_FAILURE;

956

1067

goto end;

957

1068

}

1069

port = (uint16_t)tmpmax;

958

1070

*address = '\0';

959

1071

address = connect_to;

960

1072

ret = start_mandos_communication(address, port, if_index, &mc);

966

1078

goto end;

967

1079

}

968

1080

969

if (not debug){

1081

if(not debug){

970

1082

avahi_set_log_function(empty_log);

971

1083

}

972

1084

975

1087

976

1088

/* Allocate main Avahi loop object */

977

1089

mc.simple_poll = avahi_simple_poll_new();

978

if (mc.simple_poll == NULL) {

1090

if(mc.simple_poll == NULL) {

979

1091

fprintf(stderr, "Avahi: Failed to create simple poll"

980

1092

" object.\n");

981

1093

exitcode = EXIT_FAILURE;

982

1094

goto end;

983

1095

}

984

1096

985

1097

{

986

1098

AvahiServerConfig config;

987

1099

/* Do not publish any local Zeroconf records */

990

1102

config.publish_addresses = 0;

991

1103

config.publish_workstation = 0;

992

1104

config.publish_domain = 0;

993

1105

994

1106

/* Allocate a new server */

995

1107

mc.server = avahi_server_new(avahi_simple_poll_get

996

1108

(mc.simple_poll), &config, NULL,

997

1109

NULL, &error);

998

1110

999

1111

/* Free the Avahi configuration data */

1000

1112

avahi_server_config_free(&config);

1001

1113

}

1002

1114

1003

1115

/* Check if creating the Avahi server object succeeded */

1004

if (mc.server == NULL) {

1116

if(mc.server == NULL) {

1005

1117

fprintf(stderr, "Failed to create Avahi server: %s\n",

1006

1118

avahi_strerror(error));

1007

1119

exitcode = EXIT_FAILURE;

1013

1125

AVAHI_PROTO_INET6,

1014

1126

"_mandos._tcp", NULL, 0,

1015

1127

browse_callback, &mc);

1016

if (sb == NULL) {

1128

if(sb == NULL) {

1017

1129

fprintf(stderr, "Failed to create service browser: %s\n",

1018

1130

avahi_strerror(avahi_server_errno(mc.server)));

1019

1131

exitcode = EXIT_FAILURE;

1021

1133

}

1022

1134

1023

1135

/* Run the main loop */

1024

1025

if (debug){

1136

1137

if(debug){

1026

1138

fprintf(stderr, "Starting Avahi loop search\n");

1027

1139

}

1028

1140

1029

1141

avahi_simple_poll_loop(mc.simple_poll);

1030

1142

1031

1143

end:

1032

1033

if (debug){

1144

1145

if(debug){

1034

1146

fprintf(stderr, "%s exiting\n", argv[0]);

1035

1147

}

1036

1148

1037

1149

/* Cleanup things */

1038

if (sb != NULL)

1150

if(sb != NULL)

1039

1151

avahi_s_service_browser_free(sb);

1040

1152

1041

if (mc.server != NULL)

1153

if(mc.server != NULL)

1042

1154

avahi_server_free(mc.server);

1043

1044

if (mc.simple_poll != NULL)

1155

1156

if(mc.simple_poll != NULL)

1045

1157

avahi_simple_poll_free(mc.simple_poll);

1046

free(pubkeyfile);

1047

free(seckeyfile);

1048

1049

if (gnutls_initalized){

1158

1159

if(gnutls_initialized){

1050

1160

gnutls_certificate_free_credentials(mc.cred);

1051

gnutls_global_deinit ();

1161

gnutls_global_deinit();

1162

gnutls_dh_params_deinit(mc.dh_params);

1163

}

1164

1165

if(gpgme_initialized){

1166

gpgme_release(mc.ctx);

1167

}

1168

1169

/* Removes the temp directory used by GPGME */

1170

if(tempdir_created){

1171

DIR *d;

1172

struct dirent *direntry;

1173

d = opendir(tempdir);

1174

if(d == NULL){

1175

if(errno != ENOENT){

1176

perror("opendir");

1177

}

1178

} else {

1179

while(true){

1180

direntry = readdir(d);

1181

if(direntry == NULL){

1182

break;

1183

}

1184

/* Skip "." and ".." */

1185

if(direntry->d_name[0] == '.'

1186

and (direntry->d_name[1] == '\0'

1187

or (direntry->d_name[1] == '.'

1188

and direntry->d_name[2] == '\0'))){

1189

continue;

1190

}

1191

char *fullname = NULL;

1192

ret = asprintf(&fullname, "%s/%s", tempdir,

1193

direntry->d_name);

1194

if(ret < 0){

1195

perror("asprintf");

1196

continue;

1197

}

1198

ret = remove(fullname);

1199

if(ret == -1){

1200

fprintf(stderr, "remove(\"%s\"): %s\n", fullname,

1201

strerror(errno));

1202

}

1203

free(fullname);

1204

}

1205

closedir(d);

1206

}

1207

ret = rmdir(tempdir);

1208

if(ret == -1 and errno != ENOENT){

1209

perror("rmdir");

1210

}

1052

1211

}

1053

1212

1054

1213

return exitcode;