To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 24.1.125
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.125
- Committer: Björn Påhlsson
- Date: 2009-01-17 12:16:21 UTC
- mfrom: (237.2.37 mandos)
- mto: (237.7.1 mandos) (24.1.154 mandos)
- mto: This revision was merged to the branch mainline in revision 250.
- Revision ID: belorn@braxen-20090117121621-06637yub6r1p1t6c
merge
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
32
33
#define _LARGEFILE_SOURCE
33
34
#define _FILE_OFFSET_BITS 64
34
35
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf */
40
#include <stdint.h> /* uint16_t, uint32_t */
41
#include <stddef.h> /* NULL, size_t, ssize_t */
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
srand() */
44
#include <stdbool.h> /* bool, true */
45
#include <string.h> /* memset(), strcmp(), strlen(),
46
strerror(), asprintf(), strcpy() */
47
#include <sys/ioctl.h> /* ioctl */
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
49
sockaddr_in6, PF_INET6,
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(),
52
DIR */
53
#include <sys/stat.h> /* open() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton(),
56
connect() */
57
#include <fcntl.h> /* open() */
58
#include <dirent.h> /* opendir(), struct dirent, readdir()
59
*/
60
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
61
#include <assert.h> /* assert() */
62
#include <errno.h> /* perror(), errno */
63
#include <time.h> /* time(), nanosleep() */
64
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
65
SIOCSIFFLAGS, if_indextoname(),
66
if_nametoindex(), IF_NAMESIZE */
67
#include <netinet/in.h>
68
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
69
getuid(), getgid(), setuid(),
70
setgid() */
71
#include <arpa/inet.h> /* inet_pton(), htons */
72
#include <iso646.h> /* not, and, or */
73
#include <argp.h> /* struct argp_option, error_t, struct
74
argp_state, struct argp,
75
argp_parse(), ARGP_KEY_ARG,
76
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
77
#include <sys/klog.h> /* klogctl() */
78
79
/* Avahi */
80
/* All Avahi types, constants and functions
81
Avahi*, avahi_*,
82
AVAHI_* */
41
83
#include <avahi-core/core.h>
42
84
#include <avahi-core/lookup.h>
43
85
#include <avahi-core/log.h>
45
87
#include <avahi-common/malloc.h>
46
88
#include <avahi-common/error.h>
47
89
48
//mandos client part
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
// getopt long
67
#include <getopt.h>
90
/* GnuTLS */
91
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
92
functions:
93
gnutls_*
94
init_gnutls_session(),
95
GNUTLS_* */
96
#include <gnutls/openpgp.h>
97
/* gnutls_certificate_set_openpgp_key_file(),
98
GNUTLS_OPENPGP_FMT_BASE64 */
99
100
/* GPGME */
101
#include <gpgme.h> /* All GPGME types, constants and
102
functions:
103
gpgme_*
104
GPGME_PROTOCOL_OpenPGP,
105
GPG_ERR_NO_* */
68
106
69
107
#define BUFFER_SIZE 256
70
#define DH_BITS 1024
71
108
72
const char *certdir = "/conf/conf.d/cryptkeyreq/";
73
const char *certfile = "openpgp-client.txt";
74
const char *certkey = "openpgp-client-key.txt";
109
#define PATHDIR "/conf/conf.d/mandos"
110
#define SECKEY "seckey.txt"
111
#define PUBKEY "pubkey.txt"
75
112
76
113
bool debug = false;
114
static const char mandos_protocol_version[] = "1";
115
const char *argp_program_version = "mandos-client " VERSION;
116
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
77
117
118
/* Used for passing in values through the Avahi callback functions */
78
119
typedef struct {
79
gnutls_session_t session;
120
AvahiSimplePoll *simple_poll;
121
AvahiServer *server;
80
122
gnutls_certificate_credentials_t cred;
123
unsigned int dh_bits;
81
124
gnutls_dh_params_t dh_params;
82
} encrypted_session;
83
84
85
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
86
char **new_packet, const char *homedir){
87
gpgme_data_t dh_crypto, dh_plain;
125
const char *priority;
88
126
gpgme_ctx_t ctx;
127
} mandos_context;
128
129
/*
130
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
131
* "buffer_capacity" is how much is currently allocated,
132
* "buffer_length" is how much is already used.
133
*/
134
size_t adjustbuffer(char **buffer, size_t buffer_length,
135
size_t buffer_capacity){
136
if(buffer_length + BUFFER_SIZE > buffer_capacity){
137
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
138
if(buffer == NULL){
139
return 0;
140
}
141
buffer_capacity += BUFFER_SIZE;
142
}
143
return buffer_capacity;
144
}
145
146
/*
147
* Initialize GPGME.
148
*/
149
static bool init_gpgme(mandos_context *mc, const char *seckey,
150
const char *pubkey, const char *tempdir){
151
int ret;
89
152
gpgme_error_t rc;
90
ssize_t ret;
91
ssize_t new_packet_capacity = 0;
92
ssize_t new_packet_length = 0;
93
153
gpgme_engine_info_t engine_info;
94
95
if (debug){
96
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
154
155
156
/*
157
* Helper function to insert pub and seckey to the enigne keyring.
158
*/
159
bool import_key(const char *filename){
160
int fd;
161
gpgme_data_t pgp_data;
162
163
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
164
if(fd == -1){
165
perror("open");
166
return false;
167
}
168
169
rc = gpgme_data_new_from_fd(&pgp_data, fd);
170
if(rc != GPG_ERR_NO_ERROR){
171
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
172
gpgme_strsource(rc), gpgme_strerror(rc));
173
return false;
174
}
175
176
rc = gpgme_op_import(mc->ctx, pgp_data);
177
if(rc != GPG_ERR_NO_ERROR){
178
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
179
gpgme_strsource(rc), gpgme_strerror(rc));
180
return false;
181
}
182
183
ret = (int)TEMP_FAILURE_RETRY(close(fd));
184
if(ret == -1){
185
perror("close");
186
}
187
gpgme_data_release(pgp_data);
188
return true;
189
}
190
191
if(debug){
192
fprintf(stderr, "Initialize gpgme\n");
97
193
}
98
194
99
195
/* Init GPGME */
100
196
gpgme_check_version(NULL);
101
197
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
102
if (rc != GPG_ERR_NO_ERROR){
198
if(rc != GPG_ERR_NO_ERROR){
103
199
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
104
200
gpgme_strsource(rc), gpgme_strerror(rc));
105
return -1;
201
return false;
106
202
}
107
203
108
/* Set GPGME home directory */
109
rc = gpgme_get_engine_info (&engine_info);
110
if (rc != GPG_ERR_NO_ERROR){
204
/* Set GPGME home directory for the OpenPGP engine only */
205
rc = gpgme_get_engine_info(&engine_info);
206
if(rc != GPG_ERR_NO_ERROR){
111
207
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
112
208
gpgme_strsource(rc), gpgme_strerror(rc));
113
return -1;
209
return false;
114
210
}
115
211
while(engine_info != NULL){
116
212
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
117
213
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
118
engine_info->file_name, homedir);
214
engine_info->file_name, tempdir);
119
215
break;
120
216
}
121
217
engine_info = engine_info->next;
122
218
}
123
219
if(engine_info == NULL){
124
fprintf(stderr, "Could not set home dir to %s\n", homedir);
125
return -1;
126
}
127
128
/* Create new GPGME data buffer from packet buffer */
129
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
130
if (rc != GPG_ERR_NO_ERROR){
220
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
221
return false;
222
}
223
224
/* Create new GPGME "context" */
225
rc = gpgme_new(&(mc->ctx));
226
if(rc != GPG_ERR_NO_ERROR){
227
fprintf(stderr, "bad gpgme_new: %s: %s\n",
228
gpgme_strsource(rc), gpgme_strerror(rc));
229
return false;
230
}
231
232
if(not import_key(pubkey) or not import_key(seckey)){
233
return false;
234
}
235
236
return true;
237
}
238
239
/*
240
* Decrypt OpenPGP data.
241
* Returns -1 on error
242
*/
243
static ssize_t pgp_packet_decrypt(const mandos_context *mc,
244
const char *cryptotext,
245
size_t crypto_size,
246
char **plaintext){
247
gpgme_data_t dh_crypto, dh_plain;
248
gpgme_error_t rc;
249
ssize_t ret;
250
size_t plaintext_capacity = 0;
251
ssize_t plaintext_length = 0;
252
253
if(debug){
254
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
255
}
256
257
/* Create new GPGME data buffer from memory cryptotext */
258
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
259
0);
260
if(rc != GPG_ERR_NO_ERROR){
131
261
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
132
262
gpgme_strsource(rc), gpgme_strerror(rc));
133
263
return -1;
135
265
136
266
/* Create new empty GPGME data buffer for the plaintext */
137
267
rc = gpgme_data_new(&dh_plain);
138
if (rc != GPG_ERR_NO_ERROR){
268
if(rc != GPG_ERR_NO_ERROR){
139
269
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
140
270
gpgme_strsource(rc), gpgme_strerror(rc));
141
return -1;
142
}
143
144
/* Create new GPGME "context" */
145
rc = gpgme_new(&ctx);
146
if (rc != GPG_ERR_NO_ERROR){
147
fprintf(stderr, "bad gpgme_new: %s: %s\n",
148
gpgme_strsource(rc), gpgme_strerror(rc));
149
return -1;
150
}
151
152
/* Decrypt data from the FILE pointer to the plaintext data
153
buffer */
154
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
155
if (rc != GPG_ERR_NO_ERROR){
271
gpgme_data_release(dh_crypto);
272
return -1;
273
}
274
275
/* Decrypt data from the cryptotext data buffer to the plaintext
276
data buffer */
277
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
278
if(rc != GPG_ERR_NO_ERROR){
156
279
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
157
280
gpgme_strsource(rc), gpgme_strerror(rc));
158
return -1;
281
plaintext_length = -1;
282
if(debug){
283
gpgme_decrypt_result_t result;
284
result = gpgme_op_decrypt_result(mc->ctx);
285
if(result == NULL){
286
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
287
} else {
288
fprintf(stderr, "Unsupported algorithm: %s\n",
289
result->unsupported_algorithm);
290
fprintf(stderr, "Wrong key usage: %u\n",
291
result->wrong_key_usage);
292
if(result->file_name != NULL){
293
fprintf(stderr, "File name: %s\n", result->file_name);
294
}
295
gpgme_recipient_t recipient;
296
recipient = result->recipients;
297
if(recipient){
298
while(recipient != NULL){
299
fprintf(stderr, "Public key algorithm: %s\n",
300
gpgme_pubkey_algo_name(recipient->pubkey_algo));
301
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
302
fprintf(stderr, "Secret key available: %s\n",
303
recipient->status == GPG_ERR_NO_SECKEY
304
? "No" : "Yes");
305
recipient = recipient->next;
306
}
307
}
308
}
309
}
310
goto decrypt_end;
159
311
}
160
312
161
313
if(debug){
162
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
163
}
164
165
if (debug){
166
gpgme_decrypt_result_t result;
167
result = gpgme_op_decrypt_result(ctx);
168
if (result == NULL){
169
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
170
} else {
171
fprintf(stderr, "Unsupported algorithm: %s\n",
172
result->unsupported_algorithm);
173
fprintf(stderr, "Wrong key usage: %d\n",
174
result->wrong_key_usage);
175
if(result->file_name != NULL){
176
fprintf(stderr, "File name: %s\n", result->file_name);
177
}
178
gpgme_recipient_t recipient;
179
recipient = result->recipients;
180
if(recipient){
181
while(recipient != NULL){
182
fprintf(stderr, "Public key algorithm: %s\n",
183
gpgme_pubkey_algo_name(recipient->pubkey_algo));
184
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
185
fprintf(stderr, "Secret key available: %s\n",
186
recipient->status == GPG_ERR_NO_SECKEY
187
? "No" : "Yes");
188
recipient = recipient->next;
189
}
190
}
191
}
192
}
193
194
/* Delete the GPGME FILE pointer cryptotext data buffer */
195
gpgme_data_release(dh_crypto);
314
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
315
}
196
316
197
317
/* Seek back to the beginning of the GPGME plaintext data buffer */
198
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
199
perror("pgpme_data_seek");
318
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
319
perror("gpgme_data_seek");
320
plaintext_length = -1;
321
goto decrypt_end;
200
322
}
201
323
202
*new_packet = 0;
324
*plaintext = NULL;
203
325
while(true){
204
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
205
*new_packet = realloc(*new_packet,
206
(unsigned int)new_packet_capacity
207
+ BUFFER_SIZE);
208
if (*new_packet == NULL){
209
perror("realloc");
210
return -1;
211
}
212
new_packet_capacity += BUFFER_SIZE;
326
plaintext_capacity = adjustbuffer(plaintext,
327
(size_t)plaintext_length,
328
plaintext_capacity);
329
if(plaintext_capacity == 0){
330
perror("adjustbuffer");
331
plaintext_length = -1;
332
goto decrypt_end;
213
333
}
214
334
215
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
335
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
216
336
BUFFER_SIZE);
217
337
/* Print the data, if any */
218
if (ret == 0){
338
if(ret == 0){
339
/* EOF */
219
340
break;
220
341
}
221
342
if(ret < 0){
222
343
perror("gpgme_data_read");
223
return -1;
224
}
225
new_packet_length += ret;
226
}
227
228
/* FIXME: check characters before printing to screen so to not print
229
terminal control characters */
230
/* if(debug){ */
231
/* fprintf(stderr, "decrypted password is: "); */
232
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
233
/* fprintf(stderr, "\n"); */
234
/* } */
344
plaintext_length = -1;
345
goto decrypt_end;
346
}
347
plaintext_length += ret;
348
}
349
350
if(debug){
351
fprintf(stderr, "Decrypted password is: ");
352
for(ssize_t i = 0; i < plaintext_length; i++){
353
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
354
}
355
fprintf(stderr, "\n");
356
}
357
358
decrypt_end:
359
360
/* Delete the GPGME cryptotext data buffer */
361
gpgme_data_release(dh_crypto);
235
362
236
363
/* Delete the GPGME plaintext data buffer */
237
364
gpgme_data_release(dh_plain);
238
return new_packet_length;
365
return plaintext_length;
239
366
}
240
367
241
static const char * safer_gnutls_strerror (int value) {
242
const char *ret = gnutls_strerror (value);
243
if (ret == NULL)
368
static const char * safer_gnutls_strerror(int value) {
369
const char *ret = gnutls_strerror(value); /* Spurious warning from
370
-Wunreachable-code */
371
if(ret == NULL)
244
372
ret = "(unknown)";
245
373
return ret;
246
374
}
247
375
248
void debuggnutls(__attribute__((unused)) int level,
249
const char* string){
250
fprintf(stderr, "%s", string);
376
/* GnuTLS log function callback */
377
static void debuggnutls(__attribute__((unused)) int level,
378
const char* string){
379
fprintf(stderr, "GnuTLS: %s", string);
251
380
}
252
381
253
int initgnutls(encrypted_session *es){
254
const char *err;
382
static int init_gnutls_global(mandos_context *mc,
383
const char *pubkeyfilename,
384
const char *seckeyfilename){
255
385
int ret;
256
386
257
387
if(debug){
258
388
fprintf(stderr, "Initializing GnuTLS\n");
259
389
}
260
261
if ((ret = gnutls_global_init ())
262
!= GNUTLS_E_SUCCESS) {
263
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
390
391
ret = gnutls_global_init();
392
if(ret != GNUTLS_E_SUCCESS) {
393
fprintf(stderr, "GnuTLS global_init: %s\n",
394
safer_gnutls_strerror(ret));
264
395
return -1;
265
396
}
266
267
if (debug){
397
398
if(debug){
399
/* "Use a log level over 10 to enable all debugging options."
400
* - GnuTLS manual
401
*/
268
402
gnutls_global_set_log_level(11);
269
403
gnutls_global_set_log_function(debuggnutls);
270
404
}
271
405
272
/* openpgp credentials */
273
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
274
!= GNUTLS_E_SUCCESS) {
275
fprintf (stderr, "memory error: %s\n",
276
safer_gnutls_strerror(ret));
406
/* OpenPGP credentials */
407
gnutls_certificate_allocate_credentials(&mc->cred);
408
if(ret != GNUTLS_E_SUCCESS){
409
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
410
* from
411
* -Wunreachable-code
412
*/
413
safer_gnutls_strerror(ret));
414
gnutls_global_deinit();
277
415
return -1;
278
416
}
279
417
280
418
if(debug){
281
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
282
" and keyfile %s as GnuTLS credentials\n", certfile,
283
certkey);
419
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
420
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
421
seckeyfilename);
284
422
}
285
423
286
424
ret = gnutls_certificate_set_openpgp_key_file
287
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
288
if (ret != GNUTLS_E_SUCCESS) {
289
fprintf
290
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
291
" '%s')\n",
292
ret, certfile, certkey);
293
fprintf(stdout, "The Error is: %s\n",
294
safer_gnutls_strerror(ret));
295
return -1;
296
}
297
298
//GnuTLS server initialization
299
if ((ret = gnutls_dh_params_init (&es->dh_params))
300
!= GNUTLS_E_SUCCESS) {
301
fprintf (stderr, "Error in dh parameter initialization: %s\n",
302
safer_gnutls_strerror(ret));
303
return -1;
304
}
305
306
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
307
!= GNUTLS_E_SUCCESS) {
308
fprintf (stderr, "Error in prime generation: %s\n",
309
safer_gnutls_strerror(ret));
310
return -1;
311
}
312
313
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
314
315
// GnuTLS session creation
316
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
317
!= GNUTLS_E_SUCCESS){
425
(mc->cred, pubkeyfilename, seckeyfilename,
426
GNUTLS_OPENPGP_FMT_BASE64);
427
if(ret != GNUTLS_E_SUCCESS) {
428
fprintf(stderr,
429
"Error[%d] while reading the OpenPGP key pair ('%s',"
430
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
431
fprintf(stderr, "The GnuTLS error is: %s\n",
432
safer_gnutls_strerror(ret));
433
goto globalfail;
434
}
435
436
/* GnuTLS server initialization */
437
ret = gnutls_dh_params_init(&mc->dh_params);
438
if(ret != GNUTLS_E_SUCCESS) {
439
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
440
" %s\n", safer_gnutls_strerror(ret));
441
goto globalfail;
442
}
443
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
444
if(ret != GNUTLS_E_SUCCESS) {
445
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
446
safer_gnutls_strerror(ret));
447
goto globalfail;
448
}
449
450
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
451
452
return 0;
453
454
globalfail:
455
456
gnutls_certificate_free_credentials(mc->cred);
457
gnutls_global_deinit();
458
gnutls_dh_params_deinit(mc->dh_params);
459
return -1;
460
}
461
462
static int init_gnutls_session(mandos_context *mc,
463
gnutls_session_t *session){
464
int ret;
465
/* GnuTLS session creation */
466
ret = gnutls_init(session, GNUTLS_SERVER);
467
if(ret != GNUTLS_E_SUCCESS){
318
468
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
319
469
safer_gnutls_strerror(ret));
320
470
}
321
471
322
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf(stderr, "Syntax error at: %s\n", err);
325
fprintf(stderr, "GnuTLS error: %s\n",
326
safer_gnutls_strerror(ret));
327
return -1;
472
{
473
const char *err;
474
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
475
if(ret != GNUTLS_E_SUCCESS) {
476
fprintf(stderr, "Syntax error at: %s\n", err);
477
fprintf(stderr, "GnuTLS error: %s\n",
478
safer_gnutls_strerror(ret));
479
gnutls_deinit(*session);
480
return -1;
481
}
328
482
}
329
483
330
if ((ret = gnutls_credentials_set
331
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
332
!= GNUTLS_E_SUCCESS) {
333
fprintf(stderr, "Error setting a credentials set: %s\n",
484
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
485
mc->cred);
486
if(ret != GNUTLS_E_SUCCESS) {
487
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
334
488
safer_gnutls_strerror(ret));
489
gnutls_deinit(*session);
335
490
return -1;
336
491
}
337
492
338
493
/* ignore client certificate if any. */
339
gnutls_certificate_server_set_request (es->session,
340
GNUTLS_CERT_IGNORE);
494
gnutls_certificate_server_set_request(*session,
495
GNUTLS_CERT_IGNORE);
341
496
342
gnutls_dh_set_prime_bits (es->session, DH_BITS);
497
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
343
498
344
499
return 0;
345
500
}
346
501
347
void empty_log(__attribute__((unused)) AvahiLogLevel level,
348
__attribute__((unused)) const char *txt){}
502
/* Avahi log function callback */
503
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
504
__attribute__((unused)) const char *txt){}
349
505
350
int start_mandos_communication(const char *ip, uint16_t port,
351
AvahiIfIndex if_index){
506
/* Called when a Mandos server is found */
507
static int start_mandos_communication(const char *ip, uint16_t port,
508
AvahiIfIndex if_index,
509
mandos_context *mc){
352
510
int ret, tcp_sd;
353
struct sockaddr_in6 to;
354
encrypted_session es;
511
ssize_t sret;
512
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
355
513
char *buffer = NULL;
356
514
char *decrypted_buffer;
357
515
size_t buffer_length = 0;
358
516
size_t buffer_capacity = 0;
359
517
ssize_t decrypted_buffer_size;
360
size_t written = 0;
518
size_t written;
361
519
int retval = 0;
362
520
char interface[IF_NAMESIZE];
521
gnutls_session_t session;
522
523
ret = init_gnutls_session(mc, &session);
524
if(ret != 0){
525
return -1;
526
}
363
527
364
528
if(debug){
365
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
366
ip, port);
529
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
530
"\n", ip, port);
367
531
}
368
532
369
533
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
372
536
return -1;
373
537
}
374
538
375
if(if_indextoname((unsigned int)if_index, interface) == NULL){
376
if(debug){
539
if(debug){
540
if(if_indextoname((unsigned int)if_index, interface) == NULL){
377
541
perror("if_indextoname");
542
return -1;
378
543
}
379
return -1;
380
}
381
382
if(debug){
383
544
fprintf(stderr, "Binding to interface %s\n", interface);
384
545
}
385
546
386
memset(&to,0,sizeof(to)); /* Spurious warning */
387
to.sin6_family = AF_INET6;
388
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
389
if (ret < 0 ){
547
memset(&to, 0, sizeof(to));
548
to.in6.sin6_family = AF_INET6;
549
/* It would be nice to have a way to detect if we were passed an
550
IPv4 address here. Now we assume an IPv6 address. */
551
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
552
if(ret < 0 ){
390
553
perror("inet_pton");
391
554
return -1;
392
}
555
}
393
556
if(ret == 0){
394
557
fprintf(stderr, "Bad address: %s\n", ip);
395
558
return -1;
396
559
}
397
to.sin6_port = htons(port); /* Spurious warning */
560
to.in6.sin6_port = htons(port); /* Spurious warnings from
561
-Wconversion and
562
-Wunreachable-code */
398
563
399
to.sin6_scope_id = (uint32_t)if_index;
564
to.in6.sin6_scope_id = (uint32_t)if_index;
400
565
401
566
if(debug){
402
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
403
/* char addrstr[INET6_ADDRSTRLEN]; */
404
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
405
/* sizeof(addrstr)) == NULL){ */
406
/* perror("inet_ntop"); */
407
/* } else { */
408
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
409
/* addrstr, ntohs(to.sin6_port)); */
410
/* } */
567
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
568
port);
569
char addrstr[INET6_ADDRSTRLEN] = "";
570
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
571
sizeof(addrstr)) == NULL){
572
perror("inet_ntop");
573
} else {
574
if(strcmp(addrstr, ip) != 0){
575
fprintf(stderr, "Canonical address form: %s\n", addrstr);
576
}
577
}
411
578
}
412
579
413
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
414
if (ret < 0){
580
ret = connect(tcp_sd, &to.in, sizeof(to));
581
if(ret < 0){
415
582
perror("connect");
416
583
return -1;
417
584
}
418
585
419
ret = initgnutls (&es);
420
if (ret != 0){
421
retval = -1;
422
return -1;
586
const char *out = mandos_protocol_version;
587
written = 0;
588
while(true){
589
size_t out_size = strlen(out);
590
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
591
out_size - written));
592
if(ret == -1){
593
perror("write");
594
retval = -1;
595
goto mandos_end;
596
}
597
written += (size_t)ret;
598
if(written < out_size){
599
continue;
600
} else {
601
if(out == mandos_protocol_version){
602
written = 0;
603
out = "\r\n";
604
} else {
605
break;
606
}
607
}
423
608
}
424
609
425
gnutls_transport_set_ptr (es.session,
426
(gnutls_transport_ptr_t) tcp_sd);
427
428
610
if(debug){
429
611
fprintf(stderr, "Establishing TLS session with %s\n", ip);
430
612
}
431
613
432
ret = gnutls_handshake (es.session);
433
434
if (ret != GNUTLS_E_SUCCESS){
614
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
615
616
do{
617
ret = gnutls_handshake(session);
618
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
619
620
if(ret != GNUTLS_E_SUCCESS){
435
621
if(debug){
436
fprintf(stderr, "\n*** Handshake failed ***\n");
437
gnutls_perror (ret);
622
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
623
gnutls_perror(ret);
438
624
}
439
625
retval = -1;
440
goto exit;
626
goto mandos_end;
441
627
}
442
628
443
//Retrieve OpenPGP packet that contains the wanted password
629
/* Read OpenPGP packet that contains the wanted password */
444
630
445
631
if(debug){
446
632
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
447
633
ip);
448
634
}
449
635
450
636
while(true){
451
if (buffer_length + BUFFER_SIZE > buffer_capacity){
452
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
453
if (buffer == NULL){
454
perror("realloc");
455
goto exit;
456
}
457
buffer_capacity += BUFFER_SIZE;
637
buffer_capacity = adjustbuffer(&buffer, buffer_length,
638
buffer_capacity);
639
if(buffer_capacity == 0){
640
perror("adjustbuffer");
641
retval = -1;
642
goto mandos_end;
458
643
}
459
644
460
ret = gnutls_record_recv
461
(es.session, buffer+buffer_length, BUFFER_SIZE);
462
if (ret == 0){
645
sret = gnutls_record_recv(session, buffer+buffer_length,
646
BUFFER_SIZE);
647
if(sret == 0){
463
648
break;
464
649
}
465
if (ret < 0){
466
switch(ret){
650
if(sret < 0){
651
switch(sret){
467
652
case GNUTLS_E_INTERRUPTED:
468
653
case GNUTLS_E_AGAIN:
469
654
break;
470
655
case GNUTLS_E_REHANDSHAKE:
471
ret = gnutls_handshake (es.session);
472
if (ret < 0){
473
fprintf(stderr, "\n*** Handshake failed ***\n");
474
gnutls_perror (ret);
656
do{
657
ret = gnutls_handshake(session);
658
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
659
if(ret < 0){
660
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
661
gnutls_perror(ret);
475
662
retval = -1;
476
goto exit;
663
goto mandos_end;
477
664
}
478
665
break;
479
666
default:
480
667
fprintf(stderr, "Unknown error while reading data from"
481
" encrypted session with mandos server\n");
668
" encrypted session with Mandos server\n");
482
669
retval = -1;
483
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
484
goto exit;
670
gnutls_bye(session, GNUTLS_SHUT_RDWR);
671
goto mandos_end;
485
672
}
486
673
} else {
487
buffer_length += (size_t) ret;
674
buffer_length += (size_t) sret;
488
675
}
489
676
}
490
677
491
if (buffer_length > 0){
492
decrypted_buffer_size = pgp_packet_decrypt(buffer,
678
if(debug){
679
fprintf(stderr, "Closing TLS session\n");
680
}
681
682
gnutls_bye(session, GNUTLS_SHUT_RDWR);
683
684
if(buffer_length > 0){
685
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
493
686
buffer_length,
494
&decrypted_buffer,
495
certdir);
496
if (decrypted_buffer_size >= 0){
687
&decrypted_buffer);
688
if(decrypted_buffer_size >= 0){
689
written = 0;
497
690
while(written < (size_t) decrypted_buffer_size){
498
ret = (int)fwrite (decrypted_buffer + written, 1,
499
(size_t)decrypted_buffer_size - written,
500
stdout);
691
ret = (int)fwrite(decrypted_buffer + written, 1,
692
(size_t)decrypted_buffer_size - written,
693
stdout);
501
694
if(ret == 0 and ferror(stdout)){
502
695
if(debug){
503
696
fprintf(stderr, "Error writing encrypted data: %s\n",
512
705
} else {
513
706
retval = -1;
514
707
}
515
}
516
517
//shutdown procedure
518
519
if(debug){
520
fprintf(stderr, "Closing TLS session\n");
521
}
522
708
} else {
709
retval = -1;
710
}
711
712
/* Shutdown procedure */
713
714
mandos_end:
523
715
free(buffer);
524
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
525
exit:
526
close(tcp_sd);
527
gnutls_deinit (es.session);
528
gnutls_certificate_free_credentials (es.cred);
529
gnutls_global_deinit ();
716
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
717
if(ret == -1){
718
perror("close");
719
}
720
gnutls_deinit(session);
530
721
return retval;
531
722
}
532
723
533
static AvahiSimplePoll *simple_poll = NULL;
534
static AvahiServer *server = NULL;
535
536
static void resolve_callback(
537
AvahiSServiceResolver *r,
538
AvahiIfIndex interface,
539
AVAHI_GCC_UNUSED AvahiProtocol protocol,
540
AvahiResolverEvent event,
541
const char *name,
542
const char *type,
543
const char *domain,
544
const char *host_name,
545
const AvahiAddress *address,
546
uint16_t port,
547
AVAHI_GCC_UNUSED AvahiStringList *txt,
548
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
549
AVAHI_GCC_UNUSED void* userdata) {
550
551
assert(r); /* Spurious warning */
724
static void resolve_callback(AvahiSServiceResolver *r,
725
AvahiIfIndex interface,
726
AVAHI_GCC_UNUSED AvahiProtocol protocol,
727
AvahiResolverEvent event,
728
const char *name,
729
const char *type,
730
const char *domain,
731
const char *host_name,
732
const AvahiAddress *address,
733
uint16_t port,
734
AVAHI_GCC_UNUSED AvahiStringList *txt,
735
AVAHI_GCC_UNUSED AvahiLookupResultFlags
736
flags,
737
void* userdata) {
738
mandos_context *mc = userdata;
739
assert(r);
552
740
553
741
/* Called whenever a service has been resolved successfully or
554
742
timed out */
555
743
556
switch (event) {
744
switch(event) {
557
745
default:
558
746
case AVAHI_RESOLVER_FAILURE:
559
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
560
" type '%s' in domain '%s': %s\n", name, type, domain,
561
avahi_strerror(avahi_server_errno(server)));
747
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
748
" of type '%s' in domain '%s': %s\n", name, type, domain,
749
avahi_strerror(avahi_server_errno(mc->server)));
562
750
break;
563
751
564
752
case AVAHI_RESOLVER_FOUND:
566
754
char ip[AVAHI_ADDRESS_STR_MAX];
567
755
avahi_address_snprint(ip, sizeof(ip), address);
568
756
if(debug){
569
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
570
" port %d\n", name, host_name, ip, port);
757
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
758
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
759
ip, (intmax_t)interface, port);
571
760
}
572
int ret = start_mandos_communication(ip, port, interface);
573
if (ret == 0){
574
exit(EXIT_SUCCESS);
761
int ret = start_mandos_communication(ip, port, interface, mc);
762
if(ret == 0){
763
avahi_simple_poll_quit(mc->simple_poll);
575
764
}
576
765
}
577
766
}
578
767
avahi_s_service_resolver_free(r);
579
768
}
580
769
581
static void browse_callback(
582
AvahiSServiceBrowser *b,
583
AvahiIfIndex interface,
584
AvahiProtocol protocol,
585
AvahiBrowserEvent event,
586
const char *name,
587
const char *type,
588
const char *domain,
589
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
590
void* userdata) {
591
592
AvahiServer *s = userdata;
593
assert(b); /* Spurious warning */
594
595
/* Called whenever a new services becomes available on the LAN or
596
is removed from the LAN */
597
598
switch (event) {
599
default:
600
case AVAHI_BROWSER_FAILURE:
601
602
fprintf(stderr, "(Browser) %s\n",
603
avahi_strerror(avahi_server_errno(server)));
604
avahi_simple_poll_quit(simple_poll);
605
return;
606
607
case AVAHI_BROWSER_NEW:
608
/* We ignore the returned resolver object. In the callback
609
function we free it. If the server is terminated before
610
the callback function is called the server will free
611
the resolver for us. */
612
613
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
614
type, domain,
615
AVAHI_PROTO_INET6, 0,
616
resolve_callback, s)))
617
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
618
avahi_strerror(avahi_server_errno(s)));
619
break;
620
621
case AVAHI_BROWSER_REMOVE:
622
break;
623
624
case AVAHI_BROWSER_ALL_FOR_NOW:
625
case AVAHI_BROWSER_CACHE_EXHAUSTED:
626
break;
770
static void browse_callback( AvahiSServiceBrowser *b,
771
AvahiIfIndex interface,
772
AvahiProtocol protocol,
773
AvahiBrowserEvent event,
774
const char *name,
775
const char *type,
776
const char *domain,
777
AVAHI_GCC_UNUSED AvahiLookupResultFlags
778
flags,
779
void* userdata) {
780
mandos_context *mc = userdata;
781
assert(b);
782
783
/* Called whenever a new services becomes available on the LAN or
784
is removed from the LAN */
785
786
switch(event) {
787
default:
788
case AVAHI_BROWSER_FAILURE:
789
790
fprintf(stderr, "(Avahi browser) %s\n",
791
avahi_strerror(avahi_server_errno(mc->server)));
792
avahi_simple_poll_quit(mc->simple_poll);
793
return;
794
795
case AVAHI_BROWSER_NEW:
796
/* We ignore the returned Avahi resolver object. In the callback
797
function we free it. If the Avahi server is terminated before
798
the callback function is called the Avahi server will free the
799
resolver for us. */
800
801
if(!(avahi_s_service_resolver_new(mc->server, interface,
802
protocol, name, type, domain,
803
AVAHI_PROTO_INET6, 0,
804
resolve_callback, mc)))
805
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
806
name, avahi_strerror(avahi_server_errno(mc->server)));
807
break;
808
809
case AVAHI_BROWSER_REMOVE:
810
break;
811
812
case AVAHI_BROWSER_ALL_FOR_NOW:
813
case AVAHI_BROWSER_CACHE_EXHAUSTED:
814
if(debug){
815
fprintf(stderr, "No Mandos server found, still searching...\n");
627
816
}
628
}
629
630
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
631
const char *combinepath(const char *first, const char *second){
632
char *tmp;
633
tmp = malloc(strlen(first) + strlen(second) + 2);
634
if (tmp == NULL){
635
perror("malloc");
636
return NULL;
637
}
638
strcpy(tmp, first);
639
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
640
strcat(tmp, "/");
641
}
642
strcat(tmp, second);
643
return tmp;
644
}
645
646
647
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
648
AvahiServerConfig config;
817
break;
818
}
819
}
820
821
int main(int argc, char *argv[]){
649
822
AvahiSServiceBrowser *sb = NULL;
650
823
int error;
651
824
int ret;
652
int returncode = EXIT_SUCCESS;
653
const char *interface = NULL;
825
intmax_t tmpmax;
826
int numchars;
827
int exitcode = EXIT_SUCCESS;
828
const char *interface = "eth0";
829
struct ifreq network;
830
int sd;
831
uid_t uid;
832
gid_t gid;
833
char *connect_to = NULL;
834
char tempdir[] = "/tmp/mandosXXXXXX";
654
835
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
655
char *connect_to = NULL;
656
657
while (true){
658
static struct option long_options[] = {
659
{"debug", no_argument, (int *)&debug, 1},
660
{"connect", required_argument, 0, 'C'},
661
{"interface", required_argument, 0, 'i'},
662
{"certdir", required_argument, 0, 'd'},
663
{"certkey", required_argument, 0, 'c'},
664
{"certfile", required_argument, 0, 'k'},
665
{0, 0, 0, 0} };
666
667
int option_index = 0;
668
ret = getopt_long (argc, argv, "i:", long_options,
669
&option_index);
670
671
if (ret == -1){
672
break;
836
const char *seckey = PATHDIR "/" SECKEY;
837
const char *pubkey = PATHDIR "/" PUBKEY;
838
839
mandos_context mc = { .simple_poll = NULL, .server = NULL,
840
.dh_bits = 1024, .priority = "SECURE256"
841
":!CTYPE-X.509:+CTYPE-OPENPGP" };
842
bool gnutls_initalized = false;
843
bool gpgme_initalized = false;
844
double delay = 2.5;
845
846
{
847
struct argp_option options[] = {
848
{ .name = "debug", .key = 128,
849
.doc = "Debug mode", .group = 3 },
850
{ .name = "connect", .key = 'c',
851
.arg = "ADDRESS:PORT",
852
.doc = "Connect directly to a specific Mandos server",
853
.group = 1 },
854
{ .name = "interface", .key = 'i',
855
.arg = "NAME",
856
.doc = "Interface that will be used to search for Mandos"
857
" servers",
858
.group = 1 },
859
{ .name = "seckey", .key = 's',
860
.arg = "FILE",
861
.doc = "OpenPGP secret key file base name",
862
.group = 1 },
863
{ .name = "pubkey", .key = 'p',
864
.arg = "FILE",
865
.doc = "OpenPGP public key file base name",
866
.group = 2 },
867
{ .name = "dh-bits", .key = 129,
868
.arg = "BITS",
869
.doc = "Bit length of the prime number used in the"
870
" Diffie-Hellman key exchange",
871
.group = 2 },
872
{ .name = "priority", .key = 130,
873
.arg = "STRING",
874
.doc = "GnuTLS priority string for the TLS handshake",
875
.group = 1 },
876
{ .name = "delay", .key = 131,
877
.arg = "SECONDS",
878
.doc = "Maximum delay to wait for interface startup",
879
.group = 2 },
880
{ .name = NULL }
881
};
882
883
error_t parse_opt(int key, char *arg,
884
struct argp_state *state) {
885
switch(key) {
886
case 128: /* --debug */
887
debug = true;
888
break;
889
case 'c': /* --connect */
890
connect_to = arg;
891
break;
892
case 'i': /* --interface */
893
interface = arg;
894
break;
895
case 's': /* --seckey */
896
seckey = arg;
897
break;
898
case 'p': /* --pubkey */
899
pubkey = arg;
900
break;
901
case 129: /* --dh-bits */
902
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
903
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
904
or arg[numchars] != '\0'){
905
fprintf(stderr, "Bad number of DH bits\n");
906
exit(EXIT_FAILURE);
907
}
908
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
909
break;
910
case 130: /* --priority */
911
mc.priority = arg;
912
break;
913
case 131: /* --delay */
914
ret = sscanf(arg, "%lf%n", &delay, &numchars);
915
if(ret < 1 or arg[numchars] != '\0'){
916
fprintf(stderr, "Bad delay\n");
917
exit(EXIT_FAILURE);
918
}
919
break;
920
case ARGP_KEY_ARG:
921
argp_usage(state);
922
case ARGP_KEY_END:
923
break;
924
default:
925
return ARGP_ERR_UNKNOWN;
926
}
927
return 0;
673
928
}
674
929
675
switch(ret){
676
case 0:
677
break;
678
case 'i':
679
interface = optarg;
680
break;
681
case 'C':
682
connect_to = optarg;
683
break;
684
case 'd':
685
certdir = optarg;
686
break;
687
case 'c':
688
certfile = optarg;
689
break;
690
case 'k':
691
certkey = optarg;
692
break;
693
default:
694
exit(EXIT_FAILURE);
930
struct argp argp = { .options = options, .parser = parse_opt,
931
.args_doc = "",
932
.doc = "Mandos client -- Get and decrypt"
933
" passwords from a Mandos server" };
934
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
935
if(ret == ARGP_ERR_UNKNOWN){
936
fprintf(stderr, "Unknown error while parsing arguments\n");
937
exitcode = EXIT_FAILURE;
938
goto end;
695
939
}
696
940
}
941
942
/* If the interface is down, bring it up */
943
{
944
// Lower kernel loglevel to KERN_NOTICE to avoid
945
// KERN_INFO messages to mess up the prompt
946
ret = klogctl(8, NULL, 5);
947
if(ret == -1){
948
perror("klogctl");
949
}
697
950
698
certfile = combinepath(certdir, certfile);
699
if (certfile == NULL){
700
goto exit;
701
}
702
703
if(interface != NULL){
704
if_index = (AvahiIfIndex) if_nametoindex(interface);
705
if(if_index == 0){
706
fprintf(stderr, "No such interface: \"%s\"\n", interface);
707
exit(EXIT_FAILURE);
708
}
951
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
952
if(sd < 0) {
953
perror("socket");
954
exitcode = EXIT_FAILURE;
955
ret = klogctl(7, NULL, 0);
956
if(ret == -1){
957
perror("klogctl");
958
}
959
goto end;
960
}
961
strcpy(network.ifr_name, interface);
962
ret = ioctl(sd, SIOCGIFFLAGS, &network);
963
if(ret == -1){
964
perror("ioctl SIOCGIFFLAGS");
965
ret = klogctl(7, NULL, 0);
966
if(ret == -1){
967
perror("klogctl");
968
}
969
exitcode = EXIT_FAILURE;
970
goto end;
971
}
972
if((network.ifr_flags & IFF_UP) == 0){
973
network.ifr_flags |= IFF_UP;
974
ret = ioctl(sd, SIOCSIFFLAGS, &network);
975
if(ret == -1){
976
perror("ioctl SIOCSIFFLAGS");
977
exitcode = EXIT_FAILURE;
978
ret = klogctl(7, NULL, 0);
979
if(ret == -1){
980
perror("klogctl");
981
}
982
goto end;
983
}
984
}
985
// sleep checking until interface is running
986
for(int i=0; i < delay * 4; i++){
987
ret = ioctl(sd, SIOCGIFFLAGS, &network);
988
if(ret == -1){
989
perror("ioctl SIOCGIFFLAGS");
990
} else if(network.ifr_flags & IFF_RUNNING){
991
break;
992
}
993
struct timespec sleeptime = { .tv_nsec = 250000000 };
994
nanosleep(&sleeptime, NULL);
995
}
996
ret = (int)TEMP_FAILURE_RETRY(close(sd));
997
if(ret == -1){
998
perror("close");
999
}
1000
// Restores kernel loglevel to default
1001
ret = klogctl(7, NULL, 0);
1002
if(ret == -1){
1003
perror("klogctl");
1004
}
1005
}
1006
1007
uid = getuid();
1008
gid = getgid();
1009
1010
ret = setuid(uid);
1011
if(ret == -1){
1012
perror("setuid");
1013
}
1014
1015
setgid(gid);
1016
if(ret == -1){
1017
perror("setgid");
1018
}
1019
1020
ret = init_gnutls_global(&mc, pubkey, seckey);
1021
if(ret == -1){
1022
fprintf(stderr, "init_gnutls_global failed\n");
1023
exitcode = EXIT_FAILURE;
1024
goto end;
1025
} else {
1026
gnutls_initalized = true;
1027
}
1028
1029
if(mkdtemp(tempdir) == NULL){
1030
perror("mkdtemp");
1031
tempdir[0] = '\0';
1032
goto end;
1033
}
1034
1035
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
1036
fprintf(stderr, "gpgme_initalized failed\n");
1037
exitcode = EXIT_FAILURE;
1038
goto end;
1039
} else {
1040
gpgme_initalized = true;
1041
}
1042
1043
if_index = (AvahiIfIndex) if_nametoindex(interface);
1044
if(if_index == 0){
1045
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1046
exit(EXIT_FAILURE);
709
1047
}
710
1048
711
1049
if(connect_to != NULL){
714
1052
char *address = strrchr(connect_to, ':');
715
1053
if(address == NULL){
716
1054
fprintf(stderr, "No colon in address\n");
717
exit(EXIT_FAILURE);
718
}
719
errno = 0;
720
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
721
if(errno){
722
perror("Bad port number");
723
exit(EXIT_FAILURE);
724
}
1055
exitcode = EXIT_FAILURE;
1056
goto end;
1057
}
1058
uint16_t port;
1059
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1060
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1061
or address[numchars+1] != '\0'){
1062
fprintf(stderr, "Bad port number\n");
1063
exitcode = EXIT_FAILURE;
1064
goto end;
1065
}
1066
port = (uint16_t)tmpmax;
725
1067
*address = '\0';
726
1068
address = connect_to;
727
ret = start_mandos_communication(address, port, if_index);
1069
ret = start_mandos_communication(address, port, if_index, &mc);
728
1070
if(ret < 0){
729
exit(EXIT_FAILURE);
1071
exitcode = EXIT_FAILURE;
730
1072
} else {
731
exit(EXIT_SUCCESS);
1073
exitcode = EXIT_SUCCESS;
732
1074
}
733
}
734
735
certkey = combinepath(certdir, certkey);
736
if (certkey == NULL){
737
goto exit;
738
}
739
740
if (not debug){
1075
goto end;
1076
}
1077
1078
if(not debug){
741
1079
avahi_set_log_function(empty_log);
742
1080
}
743
1081
744
/* Initialize the psuedo-RNG */
1082
/* Initialize the pseudo-RNG for Avahi */
745
1083
srand((unsigned int) time(NULL));
746
747
/* Allocate main loop object */
748
if (!(simple_poll = avahi_simple_poll_new())) {
749
fprintf(stderr, "Failed to create simple poll object.\n");
750
751
goto exit;
752
}
753
754
/* Do not publish any local records */
755
avahi_server_config_init(&config);
756
config.publish_hinfo = 0;
757
config.publish_addresses = 0;
758
config.publish_workstation = 0;
759
config.publish_domain = 0;
760
761
/* Allocate a new server */
762
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
763
&config, NULL, NULL, &error);
764
765
/* Free the configuration data */
766
avahi_server_config_free(&config);
767
768
/* Check if creating the server object succeeded */
769
if (!server) {
770
fprintf(stderr, "Failed to create server: %s\n",
1084
1085
/* Allocate main Avahi loop object */
1086
mc.simple_poll = avahi_simple_poll_new();
1087
if(mc.simple_poll == NULL) {
1088
fprintf(stderr, "Avahi: Failed to create simple poll"
1089
" object.\n");
1090
exitcode = EXIT_FAILURE;
1091
goto end;
1092
}
1093
1094
{
1095
AvahiServerConfig config;
1096
/* Do not publish any local Zeroconf records */
1097
avahi_server_config_init(&config);
1098
config.publish_hinfo = 0;
1099
config.publish_addresses = 0;
1100
config.publish_workstation = 0;
1101
config.publish_domain = 0;
1102
1103
/* Allocate a new server */
1104
mc.server = avahi_server_new(avahi_simple_poll_get
1105
(mc.simple_poll), &config, NULL,
1106
NULL, &error);
1107
1108
/* Free the Avahi configuration data */
1109
avahi_server_config_free(&config);
1110
}
1111
1112
/* Check if creating the Avahi server object succeeded */
1113
if(mc.server == NULL) {
1114
fprintf(stderr, "Failed to create Avahi server: %s\n",
771
1115
avahi_strerror(error));
772
returncode = EXIT_FAILURE;
773
goto exit;
1116
exitcode = EXIT_FAILURE;
1117
goto end;
774
1118
}
775
1119
776
/* Create the service browser */
777
sb = avahi_s_service_browser_new(server, if_index,
1120
/* Create the Avahi service browser */
1121
sb = avahi_s_service_browser_new(mc.server, if_index,
778
1122
AVAHI_PROTO_INET6,
779
1123
"_mandos._tcp", NULL, 0,
780
browse_callback, server);
781
if (!sb) {
1124
browse_callback, &mc);
1125
if(sb == NULL) {
782
1126
fprintf(stderr, "Failed to create service browser: %s\n",
783
avahi_strerror(avahi_server_errno(server)));
784
returncode = EXIT_FAILURE;
785
goto exit;
1127
avahi_strerror(avahi_server_errno(mc.server)));
1128
exitcode = EXIT_FAILURE;
1129
goto end;
786
1130
}
787
1131
788
1132
/* Run the main loop */
789
790
if (debug){
791
fprintf(stderr, "Starting avahi loop search\n");
1133
1134
if(debug){
1135
fprintf(stderr, "Starting Avahi loop search\n");
792
1136
}
793
794
avahi_simple_poll_loop(simple_poll);
795
796
exit:
797
1137
798
if (debug){
1138
avahi_simple_poll_loop(mc.simple_poll);
1139
1140
end:
1141
1142
if(debug){
799
1143
fprintf(stderr, "%s exiting\n", argv[0]);
800
1144
}
801
1145
802
1146
/* Cleanup things */
803
if (sb)
1147
if(sb != NULL)
804
1148
avahi_s_service_browser_free(sb);
805
1149
806
if (server)
807
avahi_server_free(server);
808
809
if (simple_poll)
810
avahi_simple_poll_free(simple_poll);
811
free(certfile);
812
free(certkey);
813
814
return returncode;
1150
if(mc.server != NULL)
1151
avahi_server_free(mc.server);
1152
1153
if(mc.simple_poll != NULL)
1154
avahi_simple_poll_free(mc.simple_poll);
1155
1156
if(gnutls_initalized){
1157
gnutls_certificate_free_credentials(mc.cred);
1158
gnutls_global_deinit();
1159
gnutls_dh_params_deinit(mc.dh_params);
1160
}
1161
1162
if(gpgme_initalized){
1163
gpgme_release(mc.ctx);
1164
}
1165
1166
/* Removes the temp directory used by GPGME */
1167
if(tempdir[0] != '\0'){
1168
DIR *d;
1169
struct dirent *direntry;
1170
d = opendir(tempdir);
1171
if(d == NULL){
1172
if(errno != ENOENT){
1173
perror("opendir");
1174
}
1175
} else {
1176
while(true){
1177
direntry = readdir(d);
1178
if(direntry == NULL){
1179
break;
1180
}
1181
if(direntry->d_type == DT_REG){
1182
char *fullname = NULL;
1183
ret = asprintf(&fullname, "%s/%s", tempdir,
1184
direntry->d_name);
1185
if(ret < 0){
1186
perror("asprintf");
1187
continue;
1188
}
1189
ret = unlink(fullname);
1190
if(ret == -1){
1191
fprintf(stderr, "unlink(\"%s\"): %s",
1192
fullname, strerror(errno));
1193
}
1194
free(fullname);
1195
}
1196
}
1197
closedir(d);
1198
}
1199
ret = rmdir(tempdir);
1200
if(ret == -1 and errno != ENOENT){
1201
perror("rmdir");
1202
}
1203
}
1204
1205
return exitcode;
815
1206
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0