198
/* Delete the GPGME FILE pointer cryptotext data buffer */
199
gpgme_data_release(dh_crypto);
201
226
/* Seek back to the beginning of the GPGME plaintext data buffer */
202
227
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
203
228
perror("pgpme_data_seek");
229
plaintext_length = -1;
208
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
209
*new_packet = realloc(*new_packet,
210
(unsigned int)new_packet_capacity
212
if (*new_packet == NULL){
216
new_packet_capacity += BUFFER_SIZE;
235
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
237
if (plaintext_capacity == 0){
238
perror("adjustbuffer");
239
plaintext_length = -1;
219
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
243
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
221
245
/* Print the data, if any */
226
251
perror("gpgme_data_read");
252
plaintext_length = -1;
229
new_packet_length += ret;
255
plaintext_length += ret;
232
/* FIXME: check characters before printing to screen so to not print
233
terminal control characters */
235
/* fprintf(stderr, "decrypted password is: "); */
236
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
237
/* fprintf(stderr, "\n"); */
259
fprintf(stderr, "Decrypted password is: ");
260
for(ssize_t i = 0; i < plaintext_length; i++){
261
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
263
fprintf(stderr, "\n");
268
/* Delete the GPGME cryptotext data buffer */
269
gpgme_data_release(dh_crypto);
240
271
/* Delete the GPGME plaintext data buffer */
241
272
gpgme_data_release(dh_plain);
242
return new_packet_length;
273
return plaintext_length;
245
276
static const char * safer_gnutls_strerror (int value) {
265
297
if ((ret = gnutls_global_init ())
266
298
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
299
fprintf (stderr, "GnuTLS global_init: %s\n",
300
safer_gnutls_strerror(ret));
305
/* "Use a log level over 10 to enable all debugging options."
272
308
gnutls_global_set_log_level(11);
273
309
gnutls_global_set_log_function(debuggnutls);
276
/* openpgp credentials */
277
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
312
/* OpenPGP credentials */
313
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
278
314
!= GNUTLS_E_SUCCESS) {
279
fprintf (stderr, "memory error: %s\n",
315
fprintf (stderr, "GnuTLS memory error: %s\n",
280
316
safer_gnutls_strerror(ret));
285
321
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
286
" and keyfile %s as GnuTLS credentials\n", certfile,
322
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
290
326
ret = gnutls_certificate_set_openpgp_key_file
291
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
327
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
292
328
if (ret != GNUTLS_E_SUCCESS) {
294
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
296
ret, certfile, certkey);
297
fprintf(stdout, "The Error is: %s\n",
330
"Error[%d] while reading the OpenPGP key pair ('%s',"
331
" '%s')\n", ret, pubkeyfile, seckeyfile);
332
fprintf(stdout, "The GnuTLS error is: %s\n",
298
333
safer_gnutls_strerror(ret));
302
//GnuTLS server initialization
303
if ((ret = gnutls_dh_params_init (&es->dh_params))
304
!= GNUTLS_E_SUCCESS) {
305
fprintf (stderr, "Error in dh parameter initialization: %s\n",
306
safer_gnutls_strerror(ret));
310
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
311
!= GNUTLS_E_SUCCESS) {
312
fprintf (stderr, "Error in prime generation: %s\n",
313
safer_gnutls_strerror(ret));
317
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
319
// GnuTLS session creation
320
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
321
!= GNUTLS_E_SUCCESS){
337
/* GnuTLS server initialization */
338
ret = gnutls_dh_params_init(dh_params);
339
if (ret != GNUTLS_E_SUCCESS) {
340
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
341
" %s\n", safer_gnutls_strerror(ret));
344
ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits);
345
if (ret != GNUTLS_E_SUCCESS) {
346
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
347
safer_gnutls_strerror(ret));
351
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
353
/* GnuTLS session creation */
354
ret = gnutls_init(session, GNUTLS_SERVER);
355
if (ret != GNUTLS_E_SUCCESS){
322
356
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
323
357
safer_gnutls_strerror(ret));
326
if ((ret = gnutls_priority_set_direct (es->session, mc->priority, &err))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Syntax error at: %s\n", err);
329
fprintf(stderr, "GnuTLS error: %s\n",
330
safer_gnutls_strerror(ret));
362
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
363
if (ret != GNUTLS_E_SUCCESS) {
364
fprintf(stderr, "Syntax error at: %s\n", err);
365
fprintf(stderr, "GnuTLS error: %s\n",
366
safer_gnutls_strerror(ret));
334
if ((ret = gnutls_credentials_set
335
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
336
!= GNUTLS_E_SUCCESS) {
337
fprintf(stderr, "Error setting a credentials set: %s\n",
371
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
373
if (ret != GNUTLS_E_SUCCESS) {
374
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
338
375
safer_gnutls_strerror(ret));
342
379
/* ignore client certificate if any. */
343
gnutls_certificate_server_set_request (es->session,
380
gnutls_certificate_server_set_request (*session,
344
381
GNUTLS_CERT_IGNORE);
346
gnutls_dh_set_prime_bits (es->session, DH_BITS);
383
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
388
/* Avahi log function callback */
351
389
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
352
390
__attribute__((unused)) const char *txt){}
392
/* Called when a Mandos server is found */
354
393
static int start_mandos_communication(const char *ip, uint16_t port,
355
394
AvahiIfIndex if_index,
356
395
mandos_context *mc){
358
397
struct sockaddr_in6 to;
359
encrypted_session es;
360
398
char *buffer = NULL;
361
399
char *decrypted_buffer;
362
400
size_t buffer_length = 0;
363
401
size_t buffer_capacity = 0;
364
402
ssize_t decrypted_buffer_size;
367
405
char interface[IF_NAMESIZE];
406
gnutls_session_t session;
407
gnutls_dh_params_t dh_params;
409
ret = initgnutls (mc, &session, &dh_params);
370
415
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
407
451
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
408
/* char addrstr[INET6_ADDRSTRLEN]; */
409
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
410
/* sizeof(addrstr)) == NULL){ */
411
/* perror("inet_ntop"); */
413
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
414
/* addrstr, ntohs(to.sin6_port)); */
452
char addrstr[INET6_ADDRSTRLEN] = "";
453
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
454
sizeof(addrstr)) == NULL){
457
if(strcmp(addrstr, ip) != 0){
458
fprintf(stderr, "Canonical address form: %s\n", addrstr);
418
463
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
420
465
perror("connect");
424
ret = initgnutls (&es);
469
const char *out = mandos_protocol_version;
472
size_t out_size = strlen(out);
473
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
474
out_size - written));
480
written += (size_t)ret;
481
if(written < out_size){
484
if (out == mandos_protocol_version){
430
gnutls_transport_set_ptr (es.session,
431
(gnutls_transport_ptr_t) tcp_sd);
434
494
fprintf(stderr, "Establishing TLS session with %s\n", ip);
437
ret = gnutls_handshake (es.session);
497
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
499
ret = gnutls_handshake (session);
439
501
if (ret != GNUTLS_E_SUCCESS){
441
fprintf(stderr, "\n*** Handshake failed ***\n");
503
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
442
504
gnutls_perror (ret);
448
//Retrieve OpenPGP packet that contains the wanted password
510
/* Read OpenPGP packet that contains the wanted password */
451
513
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
473
533
case GNUTLS_E_AGAIN:
475
535
case GNUTLS_E_REHANDSHAKE:
476
ret = gnutls_handshake (es.session);
536
ret = gnutls_handshake (session);
478
fprintf(stderr, "\n*** Handshake failed ***\n");
538
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
479
539
gnutls_perror (ret);
485
545
fprintf(stderr, "Unknown error while reading data from"
486
" encrypted session with mandos server\n");
546
" encrypted session with Mandos server\n");
488
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
548
gnutls_bye (session, GNUTLS_SHUT_RDWR);
492
552
buffer_length += (size_t) ret;
557
fprintf(stderr, "Closing TLS session\n");
560
gnutls_bye (session, GNUTLS_SHUT_RDWR);
496
562
if (buffer_length > 0){
497
563
decrypted_buffer_size = pgp_packet_decrypt(buffer,
499
565
&decrypted_buffer,
501
567
if (decrypted_buffer_size >= 0){
502
569
while(written < (size_t) decrypted_buffer_size){
503
570
ret = (int)fwrite (decrypted_buffer + written, 1,
504
571
(size_t)decrypted_buffer_size - written,
525
fprintf(stderr, "Closing TLS session\n");
589
/* Shutdown procedure */
529
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
532
gnutls_deinit (es.session);
533
gnutls_certificate_free_credentials (es.cred);
594
gnutls_deinit (session);
595
gnutls_certificate_free_credentials (mc->cred);
534
596
gnutls_global_deinit ();
538
static void resolve_callback( AvahiSServiceResolver *r,
539
AvahiIfIndex interface,
540
AVAHI_GCC_UNUSED AvahiProtocol protocol,
541
AvahiResolverEvent event,
545
const char *host_name,
546
const AvahiAddress *address,
548
AVAHI_GCC_UNUSED AvahiStringList *txt,
549
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
550
AVAHI_GCC_UNUSED void* userdata) {
600
static void resolve_callback(AvahiSServiceResolver *r,
601
AvahiIfIndex interface,
602
AVAHI_GCC_UNUSED AvahiProtocol protocol,
603
AvahiResolverEvent event,
607
const char *host_name,
608
const AvahiAddress *address,
610
AVAHI_GCC_UNUSED AvahiStringList *txt,
611
AVAHI_GCC_UNUSED AvahiLookupResultFlags
551
614
mandos_context *mc = userdata;
552
615
assert(r); /* Spurious warning */
599
663
case AVAHI_BROWSER_FAILURE:
601
fprintf(stderr, "(Browser) %s\n",
665
fprintf(stderr, "(Avahi browser) %s\n",
602
666
avahi_strerror(avahi_server_errno(mc->server)));
603
667
avahi_simple_poll_quit(mc->simple_poll);
606
670
case AVAHI_BROWSER_NEW:
607
/* We ignore the returned resolver object. In the callback
608
function we free it. If the server is terminated before
609
the callback function is called the server will free
610
the resolver for us. */
612
if (!(avahi_s_service_resolver_new(mc->server, interface, protocol, name,
671
/* We ignore the returned Avahi resolver object. In the callback
672
function we free it. If the Avahi server is terminated before
673
the callback function is called the Avahi server will free the
676
if (!(avahi_s_service_resolver_new(mc->server, interface,
677
protocol, name, type, domain,
614
678
AVAHI_PROTO_INET6, 0,
615
679
resolve_callback, mc)))
616
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
617
avahi_strerror(avahi_server_errno(s)));
680
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
681
name, avahi_strerror(avahi_server_errno(mc->server)));
620
684
case AVAHI_BROWSER_REMOVE:
623
687
case AVAHI_BROWSER_ALL_FOR_NOW:
624
688
case AVAHI_BROWSER_CACHE_EXHAUSTED:
690
fprintf(stderr, "No Mandos server found, still searching...\n");
639
memcpy(tmp, first, f_len);
706
memcpy(tmp, first, f_len); /* Spurious warning */
641
708
tmp[f_len] = '/';
643
memcpy(tmp + f_len + 1, second, s_len);
710
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
645
712
tmp[f_len + 1 + s_len] = '\0';
650
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
651
AvahiServerConfig config;
717
int main(int argc, char *argv[]){
652
718
AvahiSServiceBrowser *sb = NULL;
655
int returncode = EXIT_SUCCESS;
721
int exitcode = EXIT_SUCCESS;
656
722
const char *interface = "eth0";
657
723
struct ifreq network;
659
725
char *connect_to = NULL;
660
726
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
661
727
mandos_context mc = { .simple_poll = NULL, .server = NULL,
662
.dh_bits = 2048, .priority = "SECURE256"};
728
.dh_bits = 1024, .priority = "SECURE256"};
665
static struct option long_options[] = {
666
{"debug", no_argument, (int *)&debug, 1},
667
{"connect", required_argument, 0, 'C'},
668
{"interface", required_argument, 0, 'i'},
669
{"certdir", required_argument, 0, 'd'},
670
{"certkey", required_argument, 0, 'c'},
671
{"certfile", required_argument, 0, 'k'},
672
{"dh_bits", required_argument, 0, 'D'},
673
{"priority", required_argument, 0, 'p'},
676
int option_index = 0;
677
ret = getopt_long (argc, argv, "i:", long_options,
731
/* Temporary int to get the address of for getopt_long */
732
int debug_int = debug ? 1 : 0;
734
struct option long_options[] = {
735
{"debug", no_argument, &debug_int, 1},
736
{"connect", required_argument, NULL, 'c'},
737
{"interface", required_argument, NULL, 'i'},
738
{"keydir", required_argument, NULL, 'd'},
739
{"seckey", required_argument, NULL, 's'},
740
{"pubkey", required_argument, NULL, 'p'},
741
{"dh-bits", required_argument, NULL, 'D'},
742
{"priority", required_argument, NULL, 'P'},
745
int option_index = 0;
746
ret = getopt_long (argc, argv, "i:", long_options,
706
tmp = strtol(optarg, NULL, 10);
707
if (errno == ERANGE){
773
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
708
775
perror("strtol");
709
776
exit(EXIT_FAILURE);
780
mc.priority = optarg;
784
/* getopt_long() has already printed a message about the
785
unrcognized option, so just exit. */
715
mc.priority = optarg;
722
certfile = combinepath(certdir, certfile);
723
if (certfile == NULL){
724
perror("combinepath");
725
returncode = EXIT_FAILURE;
729
certkey = combinepath(certdir, certkey);
730
if (certkey == NULL){
731
perror("combinepath");
732
returncode = EXIT_FAILURE;
789
/* Set the global debug flag from the temporary int */
790
debug = debug_int ? true : false;
793
pubkeyfile = combinepath(keydir, pubkeyfile);
794
if (pubkeyfile == NULL){
795
perror("combinepath");
796
exitcode = EXIT_FAILURE;
800
seckeyfile = combinepath(keydir, seckeyfile);
801
if (seckeyfile == NULL){
802
perror("combinepath");
736
806
if_index = (AvahiIfIndex) if_nametoindex(interface);
766
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
769
returncode = EXIT_FAILURE;
772
strcpy(network.ifr_name, interface);
773
ret = ioctl(sd, SIOCGIFFLAGS, &network);
776
perror("ioctl SIOCGIFFLAGS");
777
returncode = EXIT_FAILURE;
780
if((network.ifr_flags & IFF_UP) == 0){
781
network.ifr_flags |= IFF_UP;
782
ret = ioctl(sd, SIOCSIFFLAGS, &network);
836
/* If the interface is down, bring it up */
838
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
841
exitcode = EXIT_FAILURE;
844
strcpy(network.ifr_name, interface); /* Spurious warning */
845
ret = ioctl(sd, SIOCGIFFLAGS, &network);
784
perror("ioctl SIOCSIFFLAGS");
785
returncode = EXIT_FAILURE;
847
perror("ioctl SIOCGIFFLAGS");
848
exitcode = EXIT_FAILURE;
851
if((network.ifr_flags & IFF_UP) == 0){
852
network.ifr_flags |= IFF_UP;
853
ret = ioctl(sd, SIOCSIFFLAGS, &network);
855
perror("ioctl SIOCSIFFLAGS");
856
exitcode = EXIT_FAILURE;
792
864
avahi_set_log_function(empty_log);
795
/* Initialize the psuedo-RNG */
867
/* Initialize the pseudo-RNG for Avahi */
796
868
srand((unsigned int) time(NULL));
798
/* Allocate main loop object */
799
if (!(mc.simple_poll = avahi_simple_poll_new())) {
800
fprintf(stderr, "Failed to create simple poll object.\n");
801
returncode = EXIT_FAILURE;
805
/* Do not publish any local records */
806
avahi_server_config_init(&config);
807
config.publish_hinfo = 0;
808
config.publish_addresses = 0;
809
config.publish_workstation = 0;
810
config.publish_domain = 0;
812
/* Allocate a new server */
813
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
814
&config, NULL, NULL, &error);
816
/* Free the configuration data */
817
avahi_server_config_free(&config);
819
/* Check if creating the server object succeeded */
821
fprintf(stderr, "Failed to create server: %s\n",
870
/* Allocate main Avahi loop object */
871
mc.simple_poll = avahi_simple_poll_new();
872
if (mc.simple_poll == NULL) {
873
fprintf(stderr, "Avahi: Failed to create simple poll"
875
exitcode = EXIT_FAILURE;
880
AvahiServerConfig config;
881
/* Do not publish any local Zeroconf records */
882
avahi_server_config_init(&config);
883
config.publish_hinfo = 0;
884
config.publish_addresses = 0;
885
config.publish_workstation = 0;
886
config.publish_domain = 0;
888
/* Allocate a new server */
889
mc.server = avahi_server_new(avahi_simple_poll_get
890
(mc.simple_poll), &config, NULL,
893
/* Free the Avahi configuration data */
894
avahi_server_config_free(&config);
897
/* Check if creating the Avahi server object succeeded */
898
if (mc.server == NULL) {
899
fprintf(stderr, "Failed to create Avahi server: %s\n",
822
900
avahi_strerror(error));
823
returncode = EXIT_FAILURE;
901
exitcode = EXIT_FAILURE;
827
/* Create the service browser */
905
/* Create the Avahi service browser */
828
906
sb = avahi_s_service_browser_new(mc.server, if_index,
829
907
AVAHI_PROTO_INET6,
830
908
"_mandos._tcp", NULL, 0,
831
909
browse_callback, &mc);
833
911
fprintf(stderr, "Failed to create service browser: %s\n",
834
912
avahi_strerror(avahi_server_errno(mc.server)));
835
returncode = EXIT_FAILURE;
913
exitcode = EXIT_FAILURE;
839
917
/* Run the main loop */
842
fprintf(stderr, "Starting avahi loop search\n");
920
fprintf(stderr, "Starting Avahi loop search\n");
845
avahi_simple_poll_loop(simple_poll);
923
avahi_simple_poll_loop(mc.simple_poll);
850
928
fprintf(stderr, "%s exiting\n", argv[0]);
853
931
/* Cleanup things */
855
933
avahi_s_service_browser_free(sb);
935
if (mc.server != NULL)
858
936
avahi_server_free(mc.server);
861
avahi_simple_poll_free(simple_poll);
938
if (mc.simple_poll != NULL)
939
avahi_simple_poll_free(mc.simple_poll);