To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 24.1.13
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.13
- Committer: Björn Påhlsson
- Date: 2008-08-03 20:35:01 UTC
- mto: (237.7.1 mandos) (24.1.154 mandos)
- mto: This revision was merged to the branch mainline in revision 41.
- Revision ID: belorn@braxen-20080803203501-av7janz21ve7iq0b
mandosclient
Droping privileges
split gnutls function into global and session
* server.py (if_nametoindex): Redefine itself instead of using a
default keyword argument.
Droping privileges
split gnutls function into global and session
* server.py (if_nametoindex): Redefine itself instead of using a
default keyword argument.
- files added:
- server.conf
- files removed:
- plugins.d/Makefile
- files renamed:
- mandos-clients.conf => clients.conf
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
/***
2
This file is part of avahi.
3
4
avahi is free software; you can redistribute it and/or modify it
5
under the terms of the GNU Lesser General Public License as
6
published by the Free Software Foundation; either version 2.1 of the
7
License, or (at your option) any later version.
8
9
avahi is distributed in the hope that it will be useful, but WITHOUT
10
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
11
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General
12
Public License for more details.
13
14
You should have received a copy of the GNU Lesser General Public
15
License along with avahi; if not, write to the Free Software
16
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
17
USA.
18
***/
1
/* -*- coding: utf-8 -*- */
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
4
*
5
* This program is partly derived from an example program for an Avahi
6
* service browser, downloaded from
7
* <http://avahi.org/browser/examples/core-browse-services.c>. This
8
* includes the following functions: "resolve_callback",
9
* "browse_callback", and parts of "main".
10
*
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
13
*
14
* This program is free software: you can redistribute it and/or
15
* modify it under the terms of the GNU General Public License as
16
* published by the Free Software Foundation, either version 3 of the
17
* License, or (at your option) any later version.
18
*
19
* This program is distributed in the hope that it will be useful, but
20
* WITHOUT ANY WARRANTY; without even the implied warranty of
21
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
22
* General Public License for more details.
23
*
24
* You should have received a copy of the GNU General Public License
25
* along with this program. If not, see
26
* <http://www.gnu.org/licenses/>.
27
*
28
* Contact the authors at <mandos@fukt.bsnet.se>.
29
*/
19
30
31
/* Needed by GPGME, specifically gpgme_data_seek() */
20
32
#define _LARGEFILE_SOURCE
21
33
#define _FILE_OFFSET_BITS 64
22
34
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
23
37
#include <stdio.h>
24
38
#include <assert.h>
25
39
#include <stdlib.h>
26
40
#include <time.h>
27
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
44
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
45
SIOCSIFFLAGS */
28
46
29
47
#include <avahi-core/core.h>
30
48
#include <avahi-core/lookup.h>
33
51
#include <avahi-common/malloc.h>
34
52
#include <avahi-common/error.h>
35
53
36
//mandos client part
37
#include <sys/types.h> /* socket(), setsockopt(), inet_pton() */
38
#include <sys/socket.h> /* socket(), setsockopt(), struct sockaddr_in6, struct in6_addr, inet_pton() */
39
#include <gnutls/gnutls.h> /* ALL GNUTLS STUFF */
40
#include <gnutls/openpgp.h> /* gnutls with openpgp stuff */
54
/* Mandos client part */
55
#include <sys/types.h> /* socket(), inet_pton() */
56
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
57
struct in6_addr, inet_pton() */
58
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
59
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
41
60
42
61
#include <unistd.h> /* close() */
43
62
#include <netinet/in.h>
45
64
#include <string.h> /* memset */
46
65
#include <arpa/inet.h> /* inet_pton() */
47
66
#include <iso646.h> /* not */
67
#include <net/if.h> /* IF_NAMESIZE */
48
68
49
// gpgme
69
/* GPGME */
50
70
#include <errno.h> /* perror() */
51
71
#include <gpgme.h>
52
72
73
/* getopt_long */
74
#include <getopt.h>
53
75
54
#ifndef CERT_ROOT
55
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
56
#endif
57
#define CERTFILE CERT_ROOT "openpgp-client.txt"
58
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
59
76
#define BUFFER_SIZE 256
60
#define DH_BITS 1024
77
78
static const char *keydir = "/conf/conf.d/mandos";
79
static const char *pubkeyfile = "pubkey.txt";
80
static const char *seckeyfile = "seckey.txt";
61
81
62
82
bool debug = false;
63
83
84
const char mandos_protocol_version[] = "1";
85
86
/* Used for passing in values through all the callback functions */
64
87
typedef struct {
65
gnutls_session_t session;
88
AvahiSimplePoll *simple_poll;
89
AvahiServer *server;
66
90
gnutls_certificate_credentials_t cred;
91
unsigned int dh_bits;
67
92
gnutls_dh_params_t dh_params;
68
} encrypted_session;
69
70
71
ssize_t gpg_packet_decrypt (char *packet, size_t packet_size, char **new_packet, char *homedir){
93
const char *priority;
94
} mandos_context;
95
96
size_t adjustbuffer(char **buffer, size_t buffer_length,
97
size_t buffer_capacity){
98
if (buffer_length + BUFFER_SIZE > buffer_capacity){
99
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
100
if (buffer == NULL){
101
return 0;
102
}
103
buffer_capacity += BUFFER_SIZE;
104
}
105
return buffer_capacity;
106
}
107
108
/*
109
* Decrypt OpenPGP data using keyrings in HOMEDIR.
110
* Returns -1 on error
111
*/
112
static ssize_t pgp_packet_decrypt (const char *cryptotext,
113
size_t crypto_size,
114
char **plaintext,
115
const char *homedir){
72
116
gpgme_data_t dh_crypto, dh_plain;
73
117
gpgme_ctx_t ctx;
74
118
gpgme_error_t rc;
75
119
ssize_t ret;
76
size_t new_packet_capacity = 0;
77
size_t new_packet_length = 0;
120
size_t plaintext_capacity = 0;
121
ssize_t plaintext_length = 0;
78
122
gpgme_engine_info_t engine_info;
79
123
80
124
if (debug){
81
fprintf(stderr, "Attempting to decrypt password from gpg packet\n");
125
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
82
126
}
83
127
84
128
/* Init GPGME */
85
129
gpgme_check_version(NULL);
86
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
130
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
131
if (rc != GPG_ERR_NO_ERROR){
132
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
133
gpgme_strsource(rc), gpgme_strerror(rc));
134
return -1;
135
}
87
136
88
/* Set GPGME home directory */
137
/* Set GPGME home directory for the OpenPGP engine only */
89
138
rc = gpgme_get_engine_info (&engine_info);
90
139
if (rc != GPG_ERR_NO_ERROR){
91
140
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
101
150
engine_info = engine_info->next;
102
151
}
103
152
if(engine_info == NULL){
104
fprintf(stderr, "Could not set home dir to %s\n", homedir);
153
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
105
154
return -1;
106
155
}
107
156
108
/* Create new GPGME data buffer from packet buffer */
109
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
157
/* Create new GPGME data buffer from memory cryptotext */
158
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
159
0);
110
160
if (rc != GPG_ERR_NO_ERROR){
111
161
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
112
162
gpgme_strsource(rc), gpgme_strerror(rc));
118
168
if (rc != GPG_ERR_NO_ERROR){
119
169
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
120
170
gpgme_strsource(rc), gpgme_strerror(rc));
171
gpgme_data_release(dh_crypto);
121
172
return -1;
122
173
}
123
174
126
177
if (rc != GPG_ERR_NO_ERROR){
127
178
fprintf(stderr, "bad gpgme_new: %s: %s\n",
128
179
gpgme_strsource(rc), gpgme_strerror(rc));
129
return -1;
180
plaintext_length = -1;
181
goto decrypt_end;
130
182
}
131
183
132
/* Decrypt data from the FILE pointer to the plaintext data buffer */
184
/* Decrypt data from the cryptotext data buffer to the plaintext
185
data buffer */
133
186
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
134
187
if (rc != GPG_ERR_NO_ERROR){
135
188
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
136
189
gpgme_strsource(rc), gpgme_strerror(rc));
137
return -1;
190
plaintext_length = -1;
191
goto decrypt_end;
138
192
}
139
193
140
194
if(debug){
141
fprintf(stderr, "decryption of gpg packet succeeded\n");
195
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
142
196
}
143
197
144
198
if (debug){
145
199
gpgme_decrypt_result_t result;
146
200
result = gpgme_op_decrypt_result(ctx);
147
201
if (result == NULL){
148
202
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
149
203
} else {
150
fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm);
151
fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage);
204
fprintf(stderr, "Unsupported algorithm: %s\n",
205
result->unsupported_algorithm);
206
fprintf(stderr, "Wrong key usage: %d\n",
207
result->wrong_key_usage);
152
208
if(result->file_name != NULL){
153
209
fprintf(stderr, "File name: %s\n", result->file_name);
154
210
}
160
216
gpgme_pubkey_algo_name(recipient->pubkey_algo));
161
217
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
162
218
fprintf(stderr, "Secret key available: %s\n",
163
recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes");
219
recipient->status == GPG_ERR_NO_SECKEY
220
? "No" : "Yes");
164
221
recipient = recipient->next;
165
222
}
166
223
}
167
224
}
168
225
}
169
226
170
/* Delete the GPGME FILE pointer cryptotext data buffer */
171
gpgme_data_release(dh_crypto);
172
173
227
/* Seek back to the beginning of the GPGME plaintext data buffer */
174
gpgme_data_seek(dh_plain, 0, SEEK_SET);
175
176
*new_packet = 0;
228
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
229
perror("pgpme_data_seek");
230
plaintext_length = -1;
231
goto decrypt_end;
232
}
233
234
*plaintext = NULL;
177
235
while(true){
178
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
179
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
180
if (*new_packet == NULL){
181
perror("realloc");
182
return -1;
183
}
184
new_packet_capacity += BUFFER_SIZE;
236
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
237
plaintext_capacity);
238
if (plaintext_capacity == 0){
239
perror("adjustbuffer");
240
plaintext_length = -1;
241
goto decrypt_end;
185
242
}
186
243
187
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
244
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
245
BUFFER_SIZE);
188
246
/* Print the data, if any */
189
247
if (ret == 0){
190
/* If password is empty, then a incorrect error will be printed */
248
/* EOF */
191
249
break;
192
250
}
193
251
if(ret < 0){
194
252
perror("gpgme_data_read");
195
return -1;
253
plaintext_length = -1;
254
goto decrypt_end;
196
255
}
197
new_packet_length += ret;
256
plaintext_length += ret;
198
257
}
199
258
200
259
if(debug){
201
fprintf(stderr, "decrypted password is: %s\n", *new_packet);
260
fprintf(stderr, "Decrypted password is: ");
261
for(ssize_t i = 0; i < plaintext_length; i++){
262
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
263
}
264
fprintf(stderr, "\n");
202
265
}
203
204
/* Delete the GPGME plaintext data buffer */
266
267
decrypt_end:
268
269
/* Delete the GPGME cryptotext data buffer */
270
gpgme_data_release(dh_crypto);
271
272
/* Delete the GPGME plaintext data buffer */
205
273
gpgme_data_release(dh_plain);
206
return new_packet_length;
274
return plaintext_length;
207
275
}
208
276
209
277
static const char * safer_gnutls_strerror (int value) {
213
281
return ret;
214
282
}
215
283
216
void debuggnutls(int level, const char* string){
217
fprintf(stderr, "%s", string);
284
/* GnuTLS log function callback */
285
static void debuggnutls(__attribute__((unused)) int level,
286
const char* string){
287
fprintf(stderr, "GnuTLS: %s", string);
218
288
}
219
289
220
int initgnutls(encrypted_session *es){
221
const char *err;
290
static int init_gnutls_global(mandos_context *mc){
222
291
int ret;
223
292
224
293
if(debug){
225
fprintf(stderr, "Initializing gnutls\n");
294
fprintf(stderr, "Initializing GnuTLS\n");
226
295
}
227
296
228
229
297
if ((ret = gnutls_global_init ())
230
298
!= GNUTLS_E_SUCCESS) {
231
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
299
fprintf (stderr, "GnuTLS global_init: %s\n",
300
safer_gnutls_strerror(ret));
232
301
return -1;
233
302
}
234
303
235
304
if (debug){
305
/* "Use a log level over 10 to enable all debugging options."
306
* - GnuTLS manual
307
*/
236
308
gnutls_global_set_log_level(11);
237
309
gnutls_global_set_log_function(debuggnutls);
238
310
}
239
311
240
241
/* openpgp credentials */
242
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
312
/* OpenPGP credentials */
313
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
243
314
!= GNUTLS_E_SUCCESS) {
244
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
315
fprintf (stderr, "GnuTLS memory error: %s\n",
316
safer_gnutls_strerror(ret));
245
317
return -1;
246
318
}
247
319
248
320
if(debug){
249
fprintf(stderr, "Attempting to use openpgp certificate %s"
250
" and keyfile %s as gnutls credentials\n", CERTFILE, KEYFILE);
321
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
322
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
323
seckeyfile);
251
324
}
252
325
253
326
ret = gnutls_certificate_set_openpgp_key_file
254
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
255
if (ret != GNUTLS_E_SUCCESS) {
256
fprintf
257
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
258
ret, CERTFILE, KEYFILE);
259
fprintf(stdout, "The Error is: %s\n",
260
safer_gnutls_strerror(ret));
261
return -1;
262
}
263
264
//Gnutls server initialization
265
if ((ret = gnutls_dh_params_init (&es->dh_params))
266
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "Error in dh parameter initialization: %s\n",
268
safer_gnutls_strerror(ret));
269
return -1;
270
}
271
272
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
273
!= GNUTLS_E_SUCCESS) {
274
fprintf (stderr, "Error in prime generation: %s\n",
275
safer_gnutls_strerror(ret));
276
return -1;
277
}
278
279
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
280
281
// Gnutls session creation
282
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
283
!= GNUTLS_E_SUCCESS){
284
fprintf(stderr, "Error in gnutls session initialization: %s\n",
285
safer_gnutls_strerror(ret));
286
}
287
288
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
289
!= GNUTLS_E_SUCCESS) {
290
fprintf(stderr, "Syntax error at: %s\n", err);
291
fprintf(stderr, "Gnutls error: %s\n",
292
safer_gnutls_strerror(ret));
293
return -1;
294
}
295
296
if ((ret = gnutls_credentials_set
297
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
298
!= GNUTLS_E_SUCCESS) {
299
fprintf(stderr, "Error setting a credentials set: %s\n",
300
safer_gnutls_strerror(ret));
301
return -1;
302
}
303
327
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
328
if (ret != GNUTLS_E_SUCCESS) {
329
fprintf(stderr,
330
"Error[%d] while reading the OpenPGP key pair ('%s',"
331
" '%s')\n", ret, pubkeyfile, seckeyfile);
332
fprintf(stdout, "The GnuTLS error is: %s\n",
333
safer_gnutls_strerror(ret));
334
return -1;
335
}
336
337
/* GnuTLS server initialization */
338
ret = gnutls_dh_params_init(&mc->dh_params);
339
if (ret != GNUTLS_E_SUCCESS) {
340
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
341
" %s\n", safer_gnutls_strerror(ret));
342
return -1;
343
}
344
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
345
if (ret != GNUTLS_E_SUCCESS) {
346
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
347
safer_gnutls_strerror(ret));
348
return -1;
349
}
350
351
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
352
353
return 0;
354
}
355
356
static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
357
int ret;
358
/* GnuTLS session creation */
359
ret = gnutls_init(session, GNUTLS_SERVER);
360
if (ret != GNUTLS_E_SUCCESS){
361
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
362
safer_gnutls_strerror(ret));
363
}
364
365
{
366
const char *err;
367
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
368
if (ret != GNUTLS_E_SUCCESS) {
369
fprintf(stderr, "Syntax error at: %s\n", err);
370
fprintf(stderr, "GnuTLS error: %s\n",
371
safer_gnutls_strerror(ret));
372
return -1;
373
}
374
}
375
376
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
377
mc->cred);
378
if (ret != GNUTLS_E_SUCCESS) {
379
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
380
safer_gnutls_strerror(ret));
381
return -1;
382
}
383
304
384
/* ignore client certificate if any. */
305
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
385
gnutls_certificate_server_set_request (*session,
386
GNUTLS_CERT_IGNORE);
306
387
307
gnutls_dh_set_prime_bits (es->session, DH_BITS);
388
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
308
389
309
390
return 0;
310
391
}
311
392
312
void empty_log(AvahiLogLevel level, const char *txt){}
393
/* Avahi log function callback */
394
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
395
__attribute__((unused)) const char *txt){}
313
396
314
int start_mandos_communcation(char *ip, uint16_t port){
397
/* Called when a Mandos server is found */
398
static int start_mandos_communication(const char *ip, uint16_t port,
399
AvahiIfIndex if_index,
400
mandos_context *mc){
315
401
int ret, tcp_sd;
316
402
struct sockaddr_in6 to;
317
struct in6_addr ip_addr;
318
encrypted_session es;
319
403
char *buffer = NULL;
320
404
char *decrypted_buffer;
321
405
size_t buffer_length = 0;
322
406
size_t buffer_capacity = 0;
323
407
ssize_t decrypted_buffer_size;
408
size_t written;
324
409
int retval = 0;
325
const char interface[] = "eth0";
326
410
char interface[IF_NAMESIZE];
411
gnutls_session_t session;
412
gnutls_dh_params_t dh_params;
413
414
ret = init_gnutls_session (mc, &session);
415
if (ret != 0){
416
return -1;
417
}
418
327
419
if(debug){
328
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
420
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
421
ip, port);
329
422
}
330
423
331
424
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
335
428
}
336
429
337
430
if(debug){
431
if(if_indextoname((unsigned int)if_index, interface) == NULL){
432
perror("if_indextoname");
433
return -1;
434
}
338
435
fprintf(stderr, "Binding to interface %s\n", interface);
339
436
}
340
341
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
342
if(tcp_sd < 0) {
343
perror("setsockopt bindtodevice");
344
return -1;
345
}
346
437
347
memset(&to,0,sizeof(to));
438
memset(&to,0,sizeof(to)); /* Spurious warning */
348
439
to.sin6_family = AF_INET6;
349
ret = inet_pton(AF_INET6, ip, &ip_addr);
440
/* It would be nice to have a way to detect if we were passed an
441
IPv4 address here. Now we assume an IPv6 address. */
442
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
350
443
if (ret < 0 ){
351
444
perror("inet_pton");
352
445
return -1;
353
}
446
}
354
447
if(ret == 0){
355
448
fprintf(stderr, "Bad address: %s\n", ip);
356
449
return -1;
357
450
}
358
to.sin6_port = htons(port);
359
to.sin6_scope_id = if_nametoindex(interface);
360
451
to.sin6_port = htons(port); /* Spurious warning */
452
453
to.sin6_scope_id = (uint32_t)if_index;
454
361
455
if(debug){
362
fprintf(stderr, "Connection to: %s\n", ip);
456
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
457
char addrstr[INET6_ADDRSTRLEN] = "";
458
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
459
sizeof(addrstr)) == NULL){
460
perror("inet_ntop");
461
} else {
462
if(strcmp(addrstr, ip) != 0){
463
fprintf(stderr, "Canonical address form: %s\n", addrstr);
464
}
465
}
363
466
}
364
467
365
468
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
367
470
perror("connect");
368
471
return -1;
369
472
}
370
371
ret = initgnutls (&es);
372
if (ret != 0){
373
retval = -1;
374
return -1;
375
}
376
377
378
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
379
473
474
const char *out = mandos_protocol_version;
475
written = 0;
476
while (true){
477
size_t out_size = strlen(out);
478
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
479
out_size - written));
480
if (ret == -1){
481
perror("write");
482
retval = -1;
483
goto mandos_end;
484
}
485
written += (size_t)ret;
486
if(written < out_size){
487
continue;
488
} else {
489
if (out == mandos_protocol_version){
490
written = 0;
491
out = "\r\n";
492
} else {
493
break;
494
}
495
}
496
}
497
380
498
if(debug){
381
fprintf(stderr, "Establishing tls session with %s\n", ip);
499
fprintf(stderr, "Establishing TLS session with %s\n", ip);
382
500
}
383
384
385
ret = gnutls_handshake (es.session);
501
502
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
503
504
ret = gnutls_handshake (session);
386
505
387
506
if (ret != GNUTLS_E_SUCCESS){
388
fprintf(stderr, "\n*** Handshake failed ***\n");
389
gnutls_perror (ret);
507
if(debug){
508
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
509
gnutls_perror (ret);
510
}
390
511
retval = -1;
391
goto exit;
512
goto mandos_end;
392
513
}
393
394
//Retrieve gpg packet that contains the wanted password
395
514
515
/* Read OpenPGP packet that contains the wanted password */
516
396
517
if(debug){
397
fprintf(stderr, "Retrieving pgp encrypted password from %s\n", ip);
518
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
519
ip);
398
520
}
399
521
400
522
while(true){
401
if (buffer_length + BUFFER_SIZE > buffer_capacity){
402
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
403
if (buffer == NULL){
404
perror("realloc");
405
goto exit;
406
}
407
buffer_capacity += BUFFER_SIZE;
523
buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);
524
if (buffer_capacity == 0){
525
perror("adjustbuffer");
526
retval = -1;
527
goto mandos_end;
408
528
}
409
529
410
ret = gnutls_record_recv
411
(es.session, buffer+buffer_length, BUFFER_SIZE);
530
ret = gnutls_record_recv(session, buffer+buffer_length,
531
BUFFER_SIZE);
412
532
if (ret == 0){
413
533
break;
414
534
}
418
538
case GNUTLS_E_AGAIN:
419
539
break;
420
540
case GNUTLS_E_REHANDSHAKE:
421
ret = gnutls_handshake (es.session);
541
ret = gnutls_handshake (session);
422
542
if (ret < 0){
423
fprintf(stderr, "\n*** Handshake failed ***\n");
543
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
424
544
gnutls_perror (ret);
425
545
retval = -1;
426
goto exit;
546
goto mandos_end;
427
547
}
428
548
break;
429
549
default:
430
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
550
fprintf(stderr, "Unknown error while reading data from"
551
" encrypted session with Mandos server\n");
431
552
retval = -1;
432
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
433
goto exit;
553
gnutls_bye (session, GNUTLS_SHUT_RDWR);
554
goto mandos_end;
434
555
}
435
556
} else {
436
buffer_length += ret;
557
buffer_length += (size_t) ret;
437
558
}
438
559
}
439
560
561
if(debug){
562
fprintf(stderr, "Closing TLS session\n");
563
}
564
565
gnutls_bye (session, GNUTLS_SHUT_RDWR);
566
440
567
if (buffer_length > 0){
441
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) >= 0){
442
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
568
decrypted_buffer_size = pgp_packet_decrypt(buffer,
569
buffer_length,
570
&decrypted_buffer,
571
keydir);
572
if (decrypted_buffer_size >= 0){
573
written = 0;
574
while(written < (size_t) decrypted_buffer_size){
575
ret = (int)fwrite (decrypted_buffer + written, 1,
576
(size_t)decrypted_buffer_size - written,
577
stdout);
578
if(ret == 0 and ferror(stdout)){
579
if(debug){
580
fprintf(stderr, "Error writing encrypted data: %s\n",
581
strerror(errno));
582
}
583
retval = -1;
584
break;
585
}
586
written += (size_t)ret;
587
}
443
588
free(decrypted_buffer);
444
589
} else {
445
590
retval = -1;
446
591
}
447
592
}
448
449
//shutdown procedure
450
451
if(debug){
452
fprintf(stderr, "Closing tls session\n");
453
}
454
593
594
/* Shutdown procedure */
595
596
mandos_end:
455
597
free(buffer);
456
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
457
exit:
458
598
close(tcp_sd);
459
gnutls_deinit (es.session);
460
gnutls_certificate_free_credentials (es.cred);
599
gnutls_deinit (session);
600
gnutls_certificate_free_credentials (mc->cred);
461
601
gnutls_global_deinit ();
462
602
return retval;
463
603
}
464
604
465
static AvahiSimplePoll *simple_poll = NULL;
466
static AvahiServer *server = NULL;
467
468
static void resolve_callback(
469
AvahiSServiceResolver *r,
470
AVAHI_GCC_UNUSED AvahiIfIndex interface,
471
AVAHI_GCC_UNUSED AvahiProtocol protocol,
472
AvahiResolverEvent event,
473
const char *name,
474
const char *type,
475
const char *domain,
476
const char *host_name,
477
const AvahiAddress *address,
478
uint16_t port,
479
AvahiStringList *txt,
480
AvahiLookupResultFlags flags,
481
AVAHI_GCC_UNUSED void* userdata) {
482
483
assert(r);
484
485
/* Called whenever a service has been resolved successfully or timed out */
486
487
switch (event) {
488
case AVAHI_RESOLVER_FAILURE:
489
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
490
break;
491
492
case AVAHI_RESOLVER_FOUND: {
493
char ip[AVAHI_ADDRESS_STR_MAX];
494
avahi_address_snprint(ip, sizeof(ip), address);
495
if(debug){
496
fprintf(stderr, "Mandos server found at %s on port %d\n", ip, port);
497
}
498
int ret = start_mandos_communcation(ip, port);
499
if (ret == 0){
500
exit(EXIT_SUCCESS);
501
} else {
502
exit(EXIT_FAILURE);
503
}
504
}
505
}
506
avahi_s_service_resolver_free(r);
507
}
508
509
static void browse_callback(
510
AvahiSServiceBrowser *b,
511
AvahiIfIndex interface,
512
AvahiProtocol protocol,
513
AvahiBrowserEvent event,
514
const char *name,
515
const char *type,
516
const char *domain,
517
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
518
void* userdata) {
519
520
AvahiServer *s = userdata;
521
assert(b);
522
523
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
524
525
switch (event) {
526
527
case AVAHI_BROWSER_FAILURE:
528
529
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
530
avahi_simple_poll_quit(simple_poll);
531
return;
532
533
case AVAHI_BROWSER_NEW:
534
/* We ignore the returned resolver object. In the callback
535
function we free it. If the server is terminated before
536
the callback function is called the server will free
537
the resolver for us. */
538
539
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
540
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
541
542
break;
543
544
case AVAHI_BROWSER_REMOVE:
545
break;
546
547
case AVAHI_BROWSER_ALL_FOR_NOW:
548
case AVAHI_BROWSER_CACHE_EXHAUSTED:
549
break;
550
}
551
}
552
553
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
554
AvahiServerConfig config;
605
static void resolve_callback(AvahiSServiceResolver *r,
606
AvahiIfIndex interface,
607
AVAHI_GCC_UNUSED AvahiProtocol protocol,
608
AvahiResolverEvent event,
609
const char *name,
610
const char *type,
611
const char *domain,
612
const char *host_name,
613
const AvahiAddress *address,
614
uint16_t port,
615
AVAHI_GCC_UNUSED AvahiStringList *txt,
616
AVAHI_GCC_UNUSED AvahiLookupResultFlags
617
flags,
618
void* userdata) {
619
mandos_context *mc = userdata;
620
assert(r); /* Spurious warning */
621
622
/* Called whenever a service has been resolved successfully or
623
timed out */
624
625
switch (event) {
626
default:
627
case AVAHI_RESOLVER_FAILURE:
628
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
629
" of type '%s' in domain '%s': %s\n", name, type, domain,
630
avahi_strerror(avahi_server_errno(mc->server)));
631
break;
632
633
case AVAHI_RESOLVER_FOUND:
634
{
635
char ip[AVAHI_ADDRESS_STR_MAX];
636
avahi_address_snprint(ip, sizeof(ip), address);
637
if(debug){
638
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"
639
" port %d\n", name, host_name, ip, interface, port);
640
}
641
int ret = start_mandos_communication(ip, port, interface, mc);
642
if (ret == 0){
643
exit(EXIT_SUCCESS);
644
}
645
}
646
}
647
avahi_s_service_resolver_free(r);
648
}
649
650
static void browse_callback( AvahiSServiceBrowser *b,
651
AvahiIfIndex interface,
652
AvahiProtocol protocol,
653
AvahiBrowserEvent event,
654
const char *name,
655
const char *type,
656
const char *domain,
657
AVAHI_GCC_UNUSED AvahiLookupResultFlags
658
flags,
659
void* userdata) {
660
mandos_context *mc = userdata;
661
assert(b); /* Spurious warning */
662
663
/* Called whenever a new services becomes available on the LAN or
664
is removed from the LAN */
665
666
switch (event) {
667
default:
668
case AVAHI_BROWSER_FAILURE:
669
670
fprintf(stderr, "(Avahi browser) %s\n",
671
avahi_strerror(avahi_server_errno(mc->server)));
672
avahi_simple_poll_quit(mc->simple_poll);
673
return;
674
675
case AVAHI_BROWSER_NEW:
676
/* We ignore the returned Avahi resolver object. In the callback
677
function we free it. If the Avahi server is terminated before
678
the callback function is called the Avahi server will free the
679
resolver for us. */
680
681
if (!(avahi_s_service_resolver_new(mc->server, interface,
682
protocol, name, type, domain,
683
AVAHI_PROTO_INET6, 0,
684
resolve_callback, mc)))
685
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
686
name, avahi_strerror(avahi_server_errno(mc->server)));
687
break;
688
689
case AVAHI_BROWSER_REMOVE:
690
break;
691
692
case AVAHI_BROWSER_ALL_FOR_NOW:
693
case AVAHI_BROWSER_CACHE_EXHAUSTED:
694
if(debug){
695
fprintf(stderr, "No Mandos server found, still searching...\n");
696
}
697
break;
698
}
699
}
700
701
/* Combines file name and path and returns the malloced new
702
string. some sane checks could/should be added */
703
static const char *combinepath(const char *first, const char *second){
704
size_t f_len = strlen(first);
705
size_t s_len = strlen(second);
706
char *tmp = malloc(f_len + s_len + 2);
707
if (tmp == NULL){
708
return NULL;
709
}
710
if(f_len > 0){
711
memcpy(tmp, first, f_len); /* Spurious warning */
712
}
713
tmp[f_len] = '/';
714
if(s_len > 0){
715
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
716
}
717
tmp[f_len + 1 + s_len] = '\0';
718
return tmp;
719
}
720
721
722
int main(int argc, char *argv[]){
555
723
AvahiSServiceBrowser *sb = NULL;
556
const char db[] = "--debug";
557
724
int error;
558
int ret = 1;
559
int returncode = EXIT_SUCCESS;
560
char *basename = rindex(argv[0], '/');
561
if(basename == NULL){
562
basename = argv[0];
563
} else {
564
basename++;
565
}
566
567
char *program_name = malloc(strlen(basename) + sizeof(db));
568
569
if (program_name == NULL){
570
perror("argv[0]");
571
return EXIT_FAILURE;
572
}
573
574
program_name[0] = '\0';
575
576
for (int i = 1; i < argc; i++){
577
if (not strncmp(argv[i], db, 5)){
578
strcat(strcat(strcat(program_name, db ), "="), basename);
579
if(not strcmp(argv[i], db) or not strcmp(argv[i], program_name)){
580
debug = true;
725
int ret;
726
int exitcode = EXIT_SUCCESS;
727
const char *interface = "eth0";
728
struct ifreq network;
729
int sd;
730
uid_t uid;
731
gid_t gid;
732
char *connect_to = NULL;
733
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
734
mandos_context mc = { .simple_poll = NULL, .server = NULL,
735
.dh_bits = 1024, .priority = "SECURE256"};
736
737
{
738
/* Temporary int to get the address of for getopt_long */
739
int debug_int = debug ? 1 : 0;
740
while (true){
741
struct option long_options[] = {
742
{"debug", no_argument, &debug_int, 1},
743
{"connect", required_argument, NULL, 'c'},
744
{"interface", required_argument, NULL, 'i'},
745
{"keydir", required_argument, NULL, 'd'},
746
{"seckey", required_argument, NULL, 's'},
747
{"pubkey", required_argument, NULL, 'p'},
748
{"dh-bits", required_argument, NULL, 'D'},
749
{"priority", required_argument, NULL, 'P'},
750
{0, 0, 0, 0} };
751
752
int option_index = 0;
753
ret = getopt_long (argc, argv, "i:", long_options,
754
&option_index);
755
756
if (ret == -1){
757
break;
758
}
759
760
switch(ret){
761
case 0:
762
break;
763
case 'i':
764
interface = optarg;
765
break;
766
case 'c':
767
connect_to = optarg;
768
break;
769
case 'd':
770
keydir = optarg;
771
break;
772
case 'p':
773
pubkeyfile = optarg;
774
break;
775
case 's':
776
seckeyfile = optarg;
777
break;
778
case 'D':
779
errno = 0;
780
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
781
if (errno){
782
perror("strtol");
783
exit(EXIT_FAILURE);
581
784
}
582
}
583
}
584
free(program_name);
585
785
break;
786
case 'P':
787
mc.priority = optarg;
788
break;
789
case '?':
790
default:
791
/* getopt_long() has already printed a message about the
792
unrcognized option, so just exit. */
793
exit(EXIT_FAILURE);
794
}
795
}
796
/* Set the global debug flag from the temporary int */
797
debug = debug_int ? true : false;
798
}
799
800
pubkeyfile = combinepath(keydir, pubkeyfile);
801
if (pubkeyfile == NULL){
802
perror("combinepath");
803
exitcode = EXIT_FAILURE;
804
goto end;
805
}
806
807
seckeyfile = combinepath(keydir, seckeyfile);
808
if (seckeyfile == NULL){
809
perror("combinepath");
810
goto end;
811
}
812
813
ret = init_gnutls_global(&mc);
814
if (ret == -1){
815
fprintf(stderr, "init_gnutls_global\n");
816
goto end;
817
}
818
819
uid = getuid();
820
gid = getgid();
821
822
ret = setuid(uid);
823
if (ret == -1){
824
perror("setuid");
825
}
826
827
setgid(gid);
828
if (ret == -1){
829
perror("setgid");
830
}
831
832
if_index = (AvahiIfIndex) if_nametoindex(interface);
833
if(if_index == 0){
834
fprintf(stderr, "No such interface: \"%s\"\n", interface);
835
exit(EXIT_FAILURE);
836
}
837
838
if(connect_to != NULL){
839
/* Connect directly, do not use Zeroconf */
840
/* (Mainly meant for debugging) */
841
char *address = strrchr(connect_to, ':');
842
if(address == NULL){
843
fprintf(stderr, "No colon in address\n");
844
exitcode = EXIT_FAILURE;
845
goto end;
846
}
847
errno = 0;
848
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
849
if(errno){
850
perror("Bad port number");
851
exitcode = EXIT_FAILURE;
852
goto end;
853
}
854
*address = '\0';
855
address = connect_to;
856
ret = start_mandos_communication(address, port, if_index, &mc);
857
if(ret < 0){
858
exitcode = EXIT_FAILURE;
859
} else {
860
exitcode = EXIT_SUCCESS;
861
}
862
goto end;
863
}
864
865
/* If the interface is down, bring it up */
866
{
867
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
868
if(sd < 0) {
869
perror("socket");
870
exitcode = EXIT_FAILURE;
871
goto end;
872
}
873
strcpy(network.ifr_name, interface); /* Spurious warning */
874
ret = ioctl(sd, SIOCGIFFLAGS, &network);
875
if(ret == -1){
876
perror("ioctl SIOCGIFFLAGS");
877
exitcode = EXIT_FAILURE;
878
goto end;
879
}
880
if((network.ifr_flags & IFF_UP) == 0){
881
network.ifr_flags |= IFF_UP;
882
ret = ioctl(sd, SIOCSIFFLAGS, &network);
883
if(ret == -1){
884
perror("ioctl SIOCSIFFLAGS");
885
exitcode = EXIT_FAILURE;
886
goto end;
887
}
888
}
889
close(sd);
890
}
891
586
892
if (not debug){
587
893
avahi_set_log_function(empty_log);
588
894
}
589
895
590
/* Initialize the psuedo-RNG */
591
srand(time(NULL));
592
593
/* Allocate main loop object */
594
if (!(simple_poll = avahi_simple_poll_new())) {
595
fprintf(stderr, "Failed to create simple poll object.\n");
596
597
goto exit;
598
}
599
600
/* Do not publish any local records */
601
avahi_server_config_init(&config);
602
config.publish_hinfo = 0;
603
config.publish_addresses = 0;
604
config.publish_workstation = 0;
605
config.publish_domain = 0;
606
607
/* Allocate a new server */
608
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
609
610
/* Free the configuration data */
611
avahi_server_config_free(&config);
612
613
/* Check if creating the server object succeeded */
614
if (!server) {
615
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
616
returncode = EXIT_FAILURE;
617
goto exit;
618
}
619
620
/* Create the service browser */
621
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
622
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
623
returncode = EXIT_FAILURE;
624
goto exit;
896
/* Initialize the pseudo-RNG for Avahi */
897
srand((unsigned int) time(NULL));
898
899
/* Allocate main Avahi loop object */
900
mc.simple_poll = avahi_simple_poll_new();
901
if (mc.simple_poll == NULL) {
902
fprintf(stderr, "Avahi: Failed to create simple poll"
903
" object.\n");
904
exitcode = EXIT_FAILURE;
905
goto end;
906
}
907
908
{
909
AvahiServerConfig config;
910
/* Do not publish any local Zeroconf records */
911
avahi_server_config_init(&config);
912
config.publish_hinfo = 0;
913
config.publish_addresses = 0;
914
config.publish_workstation = 0;
915
config.publish_domain = 0;
916
917
/* Allocate a new server */
918
mc.server = avahi_server_new(avahi_simple_poll_get
919
(mc.simple_poll), &config, NULL,
920
NULL, &error);
921
922
/* Free the Avahi configuration data */
923
avahi_server_config_free(&config);
924
}
925
926
/* Check if creating the Avahi server object succeeded */
927
if (mc.server == NULL) {
928
fprintf(stderr, "Failed to create Avahi server: %s\n",
929
avahi_strerror(error));
930
exitcode = EXIT_FAILURE;
931
goto end;
932
}
933
934
/* Create the Avahi service browser */
935
sb = avahi_s_service_browser_new(mc.server, if_index,
936
AVAHI_PROTO_INET6,
937
"_mandos._tcp", NULL, 0,
938
browse_callback, &mc);
939
if (sb == NULL) {
940
fprintf(stderr, "Failed to create service browser: %s\n",
941
avahi_strerror(avahi_server_errno(mc.server)));
942
exitcode = EXIT_FAILURE;
943
goto end;
625
944
}
626
945
627
946
/* Run the main loop */
628
947
629
948
if (debug){
630
fprintf(stderr, "Starting avahi loop search\n");
949
fprintf(stderr, "Starting Avahi loop search\n");
631
950
}
632
951
633
avahi_simple_poll_loop(simple_poll);
952
avahi_simple_poll_loop(mc.simple_poll);
634
953
635
exit:
954
end:
636
955
637
956
if (debug){
638
957
fprintf(stderr, "%s exiting\n", argv[0]);
639
958
}
640
959
641
960
/* Cleanup things */
642
if (sb)
961
if (sb != NULL)
643
962
avahi_s_service_browser_free(sb);
644
963
645
if (server)
646
avahi_server_free(server);
647
648
if (simple_poll)
649
avahi_simple_poll_free(simple_poll);
650
651
return ret;
964
if (mc.server != NULL)
965
avahi_server_free(mc.server);
966
967
if (mc.simple_poll != NULL)
968
avahi_simple_poll_free(mc.simple_poll);
969
free(pubkeyfile);
970
free(seckeyfile);
971
972
return exitcode;
652
973
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0