/mandos/release : revision 24.1.12

34

35

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */

36

37

#include <stdio.h> /* fprintf(), stderr, fwrite(), stdout,

38

ferror() */

39

#include <stdint.h> /* uint16_t, uint32_t */

40

#include <stddef.h> /* NULL, size_t, ssize_t */

41

#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,

42

srand() */

43

#include <stdbool.h> /* bool, true */

44

#include <string.h> /* memset(), strcmp(), strlen(),

45

strerror(), memcpy(), strcpy() */

46

#include <sys/ioctl.h> /* ioctl */

47

#include <sys/types.h> /* socket(), inet_pton(), sockaddr,

48

sockaddr_in6, PF_INET6,

49

SOCK_STREAM, INET6_ADDRSTRLEN,

50

uid_t, gid_t */

51

#include <inttypes.h> /* PRIu16 */

52

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

53

struct in6_addr, inet_pton(),

54

connect() */

55

#include <assert.h> /* assert() */

56

#include <errno.h> /* perror(), errno */

57

#include <time.h> /* time() */

37

#include <stdio.h>

38

#include <assert.h>

39

#include <stdlib.h>

40

#include <time.h>

41

#include <net/if.h> /* if_nametoindex */

42

#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

43

SIOCSIFFLAGS */

58

44

#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

59

SIOCSIFFLAGS, if_indextoname(),

60

if_nametoindex(), IF_NAMESIZE */

61

#include <unistd.h> /* close(), SEEK_SET, off_t, write(),

62

getuid(), getgid(), setuid(),

63

setgid() */

64

#include <netinet/in.h>

65

#include <arpa/inet.h> /* inet_pton(), htons */

66

#include <iso646.h> /* not, and */

67

#include <argp.h> /* struct argp_option, error_t, struct

68

argp_state, struct argp,

69

argp_parse(), ARGP_KEY_ARG,

70

ARGP_KEY_END, ARGP_ERR_UNKNOWN */

45

SIOCSIFFLAGS */

71

46

72

/* Avahi */

73

/* All Avahi types, constants and functions

74

Avahi*, avahi_*,

75

AVAHI_* */

76

47

#include <avahi-core/core.h>

77

48

#include <avahi-core/lookup.h>

78

49

#include <avahi-core/log.h>

80

51

#include <avahi-common/malloc.h>

81

52

#include <avahi-common/error.h>

82

53

83

/* GnuTLS */

84

#include <gnutls/gnutls.h> /* All GnuTLS types, constants and functions

85

gnutls_*

86

init_gnutls_session(),

87

GNUTLS_* */

88

#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),

89

GNUTLS_OPENPGP_FMT_BASE64 */

54

/* Mandos client part */

55

#include <sys/types.h> /* socket(), inet_pton() */

56

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

57

struct in6_addr, inet_pton() */

58

#include <gnutls/gnutls.h> /* All GnuTLS stuff */

59

#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */

60

61

#include <unistd.h> /* close() */

62

#include <netinet/in.h>

63

#include <stdbool.h> /* true */

64

#include <string.h> /* memset */

65

#include <arpa/inet.h> /* inet_pton() */

66

#include <iso646.h> /* not */

67

#include <net/if.h> /* IF_NAMESIZE */

90

68

91

69

/* GPGME */

92

#include <gpgme.h> /* All GPGME types, constants and functions

93

gpgme_*

94

GPGME_PROTOCOL_OpenPGP,

95

GPG_ERR_NO_* */

70

#include <errno.h> /* perror() */

71

#include <gpgme.h>

72

73

/* getopt_long */

74

#include <getopt.h>

96

75

97

76

#define BUFFER_SIZE 256

98

77

78

static const char *keydir = "/conf/conf.d/mandos";

79

static const char *pubkeyfile = "pubkey.txt";

80

static const char *seckeyfile = "seckey.txt";

81

99

82

bool debug = false;

100

static const char *keydir = "/conf/conf.d/mandos";

101

static const char mandos_protocol_version[] = "1";

102

const char *argp_program_version = "password-request 1.0";

103

const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";

104

105

/* Used for passing in values through the Avahi callback functions */

83

84

const char mandos_protocol_version[] = "1";

85

86

/* Used for passing in values through all the callback functions */

106

87

typedef struct {

107

88

AvahiSimplePoll *simple_poll;

108

89

AvahiServer *server;

109

90

gnutls_certificate_credentials_t cred;

110

91

unsigned int dh_bits;

111

gnutls_dh_params_t dh_params;

112

92

const char *priority;

113

93

} mandos_context;

114

94

115

/*

116

* Make room in "buffer" for at least BUFFER_SIZE additional bytes.

117

* "buffer_capacity" is how much is currently allocated,

118

* "buffer_length" is how much is already used.

119

*/

120

95

size_t adjustbuffer(char **buffer, size_t buffer_length,

121

96

size_t buffer_capacity){

122

97

if (buffer_length + BUFFER_SIZE > buffer_capacity){

227

202

} else {

228

203

fprintf(stderr, "Unsupported algorithm: %s\n",

229

204

result->unsupported_algorithm);

230

fprintf(stderr, "Wrong key usage: %u\n",

205

fprintf(stderr, "Wrong key usage: %d\n",

231

206

result->wrong_key_usage);

232

207

if(result->file_name != NULL){

233

208

fprintf(stderr, "File name: %s\n", result->file_name);

257

232

258

233

*plaintext = NULL;

259

234

while(true){

260

plaintext_capacity = adjustbuffer(plaintext,

261

(size_t)plaintext_length,

235

plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,

262

236

plaintext_capacity);

263

237

if (plaintext_capacity == 0){

264

238

perror("adjustbuffer");

312

286

fprintf(stderr, "GnuTLS: %s", string);

313

287

}

314

288

315

static int init_gnutls_global(mandos_context *mc,

316

const char *pubkeyfile,

317

const char *seckeyfile){

289

static int initgnutls(mandos_context *mc, gnutls_session_t *session,

290

gnutls_dh_params_t *dh_params){

318

291

int ret;

319

292

320

293

if(debug){

321

294

fprintf(stderr, "Initializing GnuTLS\n");

322

295

}

323

324

ret = gnutls_global_init();

325

if (ret != GNUTLS_E_SUCCESS) {

296

297

if ((ret = gnutls_global_init ())

298

!= GNUTLS_E_SUCCESS) {

326

299

fprintf (stderr, "GnuTLS global_init: %s\n",

327

300

safer_gnutls_strerror(ret));

328

301

return -1;

337

310

}

338

311

339

312

/* OpenPGP credentials */

340

gnutls_certificate_allocate_credentials(&mc->cred);

341

if (ret != GNUTLS_E_SUCCESS){

313

if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))

314

!= GNUTLS_E_SUCCESS) {

342

315

fprintf (stderr, "GnuTLS memory error: %s\n",

343

316

safer_gnutls_strerror(ret));

344

gnutls_global_deinit ();

345

317

return -1;

346

318

}

347

319

359

331

" '%s')\n", ret, pubkeyfile, seckeyfile);

360

332

fprintf(stdout, "The GnuTLS error is: %s\n",

361

333

safer_gnutls_strerror(ret));

362

goto globalfail;

334

return -1;

363

335

}

364

336

365

337

/* GnuTLS server initialization */

366

ret = gnutls_dh_params_init(&mc->dh_params);

338

ret = gnutls_dh_params_init(dh_params);

367

339

if (ret != GNUTLS_E_SUCCESS) {

368

340

fprintf (stderr, "Error in GnuTLS DH parameter initialization:"

369

341

" %s\n", safer_gnutls_strerror(ret));

370

goto globalfail;

342

return -1;

371

343

}

372

ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);

344

ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits);

373

345

if (ret != GNUTLS_E_SUCCESS) {

374

346

fprintf (stderr, "Error in GnuTLS prime generation: %s\n",

375

347

safer_gnutls_strerror(ret));

376

goto globalfail;

348

return -1;

377

349

}

378

350

379

gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);

380

381

return 0;

382

383

globalfail:

384

385

gnutls_certificate_free_credentials(mc->cred);

386

gnutls_global_deinit();

387

return -1;

388

389

}

390

391

static int init_gnutls_session(mandos_context *mc,

392

gnutls_session_t *session){

393

int ret;

351

gnutls_certificate_set_dh_params(mc->cred, *dh_params);

352

394

353

/* GnuTLS session creation */

395

354

ret = gnutls_init(session, GNUTLS_SERVER);

396

355

if (ret != GNUTLS_E_SUCCESS){

405

364

fprintf(stderr, "Syntax error at: %s\n", err);

406

365

fprintf(stderr, "GnuTLS error: %s\n",

407

366

safer_gnutls_strerror(ret));

408

gnutls_deinit (*session);

409

367

return -1;

410

368

}

411

369

}

415

373

if (ret != GNUTLS_E_SUCCESS) {

416

374

fprintf(stderr, "Error setting GnuTLS credentials: %s\n",

417

375

safer_gnutls_strerror(ret));

418

gnutls_deinit (*session);

419

376

return -1;

420

377

}

421

378

437

394

AvahiIfIndex if_index,

438

395

mandos_context *mc){

439

396

int ret, tcp_sd;

440

union { struct sockaddr in; struct sockaddr_in6 in6; } to;

397

struct sockaddr_in6 to;

441

398

char *buffer = NULL;

442

399

char *decrypted_buffer;

443

400

size_t buffer_length = 0;

447

404

int retval = 0;

448

405

char interface[IF_NAMESIZE];

449

406

gnutls_session_t session;

407

gnutls_dh_params_t dh_params;

450

408

451

ret = init_gnutls_session (mc, &session);

409

ret = initgnutls (mc, &session, &dh_params);

452

410

if (ret != 0){

453

411

return -1;

454

412

}

455

413

456

414

if(debug){

457

fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16

458

"\n", ip, port);

415

fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",

416

ip, port);

459

417

}

460

418

461

419

tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);

473

431

}

474

432

475

433

memset(&to,0,sizeof(to)); /* Spurious warning */

476

to.in6.sin6_family = AF_INET6;

434

to.sin6_family = AF_INET6;

477

435

/* It would be nice to have a way to detect if we were passed an

478

436

IPv4 address here. Now we assume an IPv6 address. */

479

ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);

437

ret = inet_pton(AF_INET6, ip, &to.sin6_addr);

480

438

if (ret < 0 ){

481

439

perror("inet_pton");

482

440

return -1;

485

443

fprintf(stderr, "Bad address: %s\n", ip);

486

444

return -1;

487

445

}

488

to.in6.sin6_port = htons(port); /* Spurious warning */

446

to.sin6_port = htons(port); /* Spurious warning */

489

447

490

to.in6.sin6_scope_id = (uint32_t)if_index;

448

to.sin6_scope_id = (uint32_t)if_index;

491

449

492

450

if(debug){

493

fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,

494

port);

451

fprintf(stderr, "Connection to: %s, port %d\n", ip, port);

495

452

char addrstr[INET6_ADDRSTRLEN] = "";

496

if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,

453

if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,

497

454

sizeof(addrstr)) == NULL){

498

455

perror("inet_ntop");

499

456

} else {

503

460

}

504

461

}

505

462

506

ret = connect(tcp_sd, &to.in, sizeof(to));

463

ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));

507

464

if (ret < 0){

508

465

perror("connect");

509

466

return -1;

538

495

}

539

496

540

497

gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);

541

542

do{

543

ret = gnutls_handshake (session);

544

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

498

499

ret = gnutls_handshake (session);

545

500

546

501

if (ret != GNUTLS_E_SUCCESS){

547

502

if(debug){

560

515

}

561

516

562

517

while(true){

563

buffer_capacity = adjustbuffer(&buffer, buffer_length,

564

buffer_capacity);

518

buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);

565

519

if (buffer_capacity == 0){

566

520

perror("adjustbuffer");

567

521

retval = -1;

579

533

case GNUTLS_E_AGAIN:

580

534

break;

581

535

case GNUTLS_E_REHANDSHAKE:

582

do{

583

ret = gnutls_handshake (session);

584

} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);

536

ret = gnutls_handshake (session);

585

537

if (ret < 0){

586

538

fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");

587

539

gnutls_perror (ret);

640

592

free(buffer);

641

593

close(tcp_sd);

642

594

gnutls_deinit (session);

595

gnutls_certificate_free_credentials (mc->cred);

596

gnutls_global_deinit ();

643

597

return retval;

644

598

}

645

599

676

630

char ip[AVAHI_ADDRESS_STR_MAX];

677

631

avahi_address_snprint(ip, sizeof(ip), address);

678

632

if(debug){

679

fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"

680

PRIu16 ") on port %d\n", name, host_name, ip,

681

interface, port);

633

fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"

634

" port %d\n", name, host_name, ip, interface, port);

682

635

}

683

636

int ret = start_mandos_communication(ip, port, interface, mc);

684

637

if (ret == 0){

685

avahi_simple_poll_quit(mc->simple_poll);

638

exit(EXIT_SUCCESS);

686

639

}

687

640

}

688

641

}

769

722

const char *interface = "eth0";

770

723

struct ifreq network;

771

724

int sd;

772

uid_t uid;

773

gid_t gid;

774

725

char *connect_to = NULL;

775

726

AvahiIfIndex if_index = AVAHI_IF_UNSPEC;

776

const char *pubkeyfile = "pubkey.txt";

777

const char *seckeyfile = "seckey.txt";

778

727

mandos_context mc = { .simple_poll = NULL, .server = NULL,

779

728

.dh_bits = 1024, .priority = "SECURE256"};

780

bool gnutls_initalized = false;

781

729

782

730

{

783

struct argp_option options[] = {

784

{ .name = "debug", .key = 128,

785

.doc = "Debug mode", .group = 3 },

786

{ .name = "connect", .key = 'c',

787

.arg = "IP",

788

.doc = "Connect directly to a sepcified mandos server",

789

.group = 1 },

790

{ .name = "interface", .key = 'i',

791

.arg = "INTERFACE",

792

.doc = "Interface that Avahi will conntect through",

793

.group = 1 },

794

{ .name = "keydir", .key = 'd',

795

.arg = "KEYDIR",

796

.doc = "Directory where the openpgp keyring is",

797

.group = 1 },

798

{ .name = "seckey", .key = 's',

799

.arg = "SECKEY",

800

.doc = "Secret openpgp key for gnutls authentication",

801

.group = 1 },

802

{ .name = "pubkey", .key = 'p',

803

.arg = "PUBKEY",

804

.doc = "Public openpgp key for gnutls authentication",

805

.group = 2 },

806

{ .name = "dh-bits", .key = 129,

807

.arg = "BITS",

808

.doc = "dh-bits to use in gnutls communication",

809

.group = 2 },

810

{ .name = "priority", .key = 130,

811

.arg = "PRIORITY",

812

.doc = "GNUTLS priority", .group = 1 },

813

{ .name = NULL }

814

};

815

816

817

error_t parse_opt (int key, char *arg,

818

struct argp_state *state) {

819

/* Get the INPUT argument from `argp_parse', which we know is

820

a pointer to our plugin list pointer. */

821

switch (key) {

822

case 128:

823

debug = true;

731

/* Temporary int to get the address of for getopt_long */

732

int debug_int = debug ? 1 : 0;

733

while (true){

734

struct option long_options[] = {

735

{"debug", no_argument, &debug_int, 1},

736

{"connect", required_argument, NULL, 'c'},

737

{"interface", required_argument, NULL, 'i'},

738

{"keydir", required_argument, NULL, 'd'},

739

{"seckey", required_argument, NULL, 's'},

740

{"pubkey", required_argument, NULL, 'p'},

741

{"dh-bits", required_argument, NULL, 'D'},

742

{"priority", required_argument, NULL, 'P'},

743

{0, 0, 0, 0} };

744

745

int option_index = 0;

746

ret = getopt_long (argc, argv, "i:", long_options,

747

&option_index);

748

749

if (ret == -1){

750

break;

751

}

752

753

switch(ret){

754

case 0:

755

break;

756

case 'i':

757

interface = optarg;

824

758

break;

825

759

case 'c':

826

connect_to = arg;

827

break;

828

case 'i':

829

interface = arg;

760

connect_to = optarg;

830

761

break;

831

762

case 'd':

832

keydir = arg;

763

keydir = optarg;

764

break;

765

case 'p':

766

pubkeyfile = optarg;

833

767

break;

834

768

case 's':

835

seckeyfile = arg;

836

break;

837

case 'p':

838

pubkeyfile = arg;

839

break;

840

case 129:

769

seckeyfile = optarg;

770

break;

771

case 'D':

841

772

errno = 0;

842

mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);

773

mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);

843

774

if (errno){

844

775

perror("strtol");

845

776

exit(EXIT_FAILURE);

846

777

}

847

778

break;

848

case 130:

849

mc.priority = arg;

850

break;

851

case ARGP_KEY_ARG:

852

argp_usage (state);

853

case ARGP_KEY_END:

854

break;

779

case 'P':

780

mc.priority = optarg;

781

break;

782

case '?':

855

783

default:

856

return ARGP_ERR_UNKNOWN;

784

/* getopt_long() has already printed a message about the

785

unrcognized option, so just exit. */

786

exit(EXIT_FAILURE);

857

787

}

858

return 0;

859

}

860

861

struct argp argp = { .options = options, .parser = parse_opt,

862

.args_doc = "",

863

.doc = "Mandos client -- Get and decrypt"

864

" passwords from mandos server" };

865

ret = argp_parse (&argp, argc, argv, 0, 0, NULL);

866

if (ret == ARGP_ERR_UNKNOWN){

867

fprintf(stderr, "Unknown error while parsing arguments\n");

868

exitcode = EXIT_FAILURE;

869

goto end;

870

}

788

}

789

/* Set the global debug flag from the temporary int */

790

debug = debug_int ? true : false;

871

791

}

872

792

873

793

pubkeyfile = combinepath(keydir, pubkeyfile);

874

794

if (pubkeyfile == NULL){

875

795

perror("combinepath");

880

800

seckeyfile = combinepath(keydir, seckeyfile);

881

801

if (seckeyfile == NULL){

882

802

perror("combinepath");

883

exitcode = EXIT_FAILURE;

884

goto end;

885

}

886

887

ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);

888

if (ret == -1){

889

fprintf(stderr, "init_gnutls_global failed\n");

890

exitcode = EXIT_FAILURE;

891

goto end;

892

} else {

893

gnutls_initalized = true;

894

}

895

896

/* If the interface is down, bring it up */

897

{

898

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

899

if(sd < 0) {

900

perror("socket");

901

exitcode = EXIT_FAILURE;

902

goto end;

903

}

904

strcpy(network.ifr_name, interface); /* Spurious warning */

905

ret = ioctl(sd, SIOCGIFFLAGS, &network);

906

if(ret == -1){

907

perror("ioctl SIOCGIFFLAGS");

908

exitcode = EXIT_FAILURE;

909

goto end;

910

}

911

if((network.ifr_flags & IFF_UP) == 0){

912

network.ifr_flags |= IFF_UP;

913

ret = ioctl(sd, SIOCSIFFLAGS, &network);

914

if(ret == -1){

915

perror("ioctl SIOCSIFFLAGS");

916

exitcode = EXIT_FAILURE;

917

goto end;

918

}

919

}

920

close(sd);

921

}

922

923

uid = getuid();

924

gid = getgid();

925

926

ret = setuid(uid);

927

if (ret == -1){

928

perror("setuid");

929

}

930

931

setgid(gid);

932

if (ret == -1){

933

perror("setgid");

803

goto end;

934

804

}

935

805

936

806

if_index = (AvahiIfIndex) if_nametoindex(interface);

945

815

char *address = strrchr(connect_to, ':');

946

816

if(address == NULL){

947

817

fprintf(stderr, "No colon in address\n");

948

exitcode = EXIT_FAILURE;

949

goto end;

818

exit(EXIT_FAILURE);

950

819

}

951

820

errno = 0;

952

821

uint16_t port = (uint16_t) strtol(address+1, NULL, 10);

953

822

if(errno){

954

823

perror("Bad port number");

955

exitcode = EXIT_FAILURE;

956

goto end;

824

exit(EXIT_FAILURE);

957

825

}

958

826

*address = '\0';

959

827

address = connect_to;

960

828

ret = start_mandos_communication(address, port, if_index, &mc);

961

829

if(ret < 0){

962

exitcode = EXIT_FAILURE;

830

exit(EXIT_FAILURE);

963

831

} else {

964

exitcode = EXIT_SUCCESS;

965

}

966

goto end;

832

exit(EXIT_SUCCESS);

833

}

834

}

835

836

/* If the interface is down, bring it up */

837

{

838

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

839

if(sd < 0) {

840

perror("socket");

841

exitcode = EXIT_FAILURE;

842

goto end;

843

}

844

strcpy(network.ifr_name, interface); /* Spurious warning */

845

ret = ioctl(sd, SIOCGIFFLAGS, &network);

846

if(ret == -1){

847

perror("ioctl SIOCGIFFLAGS");

848

exitcode = EXIT_FAILURE;

849

goto end;

850

}

851

if((network.ifr_flags & IFF_UP) == 0){

852

network.ifr_flags |= IFF_UP;

853

ret = ioctl(sd, SIOCSIFFLAGS, &network);

854

if(ret == -1){

855

perror("ioctl SIOCSIFFLAGS");

856

exitcode = EXIT_FAILURE;

857

goto end;

858

}

859

}

860

close(sd);

967

861

}

968

862

969

863

if (not debug){

1045

939

avahi_simple_poll_free(mc.simple_poll);

1046

940

free(pubkeyfile);

1047

941

free(seckeyfile);

1048

1049

if (gnutls_initalized){

1050

gnutls_certificate_free_credentials(mc.cred);

1051

gnutls_global_deinit ();

1052

}

1053

942

1054

943

return exitcode;

1055

944

}