/mandos/release : revision 24.1.18

32

#define _LARGEFILE_SOURCE

33

#define _FILE_OFFSET_BITS 64

34

35

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */

36

35

37

#include <stdio.h>

36

38

#include <assert.h>

37

39

#include <stdlib.h>

63

65

#include <arpa/inet.h> /* inet_pton() */

64

66

#include <iso646.h> /* not */

65

67

#include <net/if.h> /* IF_NAMESIZE */

66

68

#include <argp.h> /* struct argp_option,

69

struct argp_state, struct argp,

70

argp_parse() */

67

71

/* GPGME */

68

72

#include <errno.h> /* perror() */

69

73

#include <gpgme.h>

70

74

71

/* getopt_long */

72

#include <getopt.h>

73

74

75

#define BUFFER_SIZE 256

75

76

77

bool debug = false;

76

78

static const char *keydir = "/conf/conf.d/mandos";

77

static const char *pubkeyfile = "pubkey.txt";

78

static const char *seckeyfile = "seckey.txt";

79

80

bool debug = false;

81

82

/* Used for passing in values through all the callback functions */

79

static const char mandos_protocol_version[] = "1";

80

const char *argp_program_version = "mandosclient 0.9";

81

const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";

82

83

/* Used for passing in values through the Avahi callback functions */

83

84

typedef struct {

84

85

AvahiSimplePoll *simple_poll;

85

86

AvahiServer *server;

86

87

gnutls_certificate_credentials_t cred;

87

88

unsigned int dh_bits;

89

gnutls_dh_params_t dh_params;

88

90

const char *priority;

89

91

} mandos_context;

90

92

93

/*

94

* Make room in "buffer" for at least BUFFER_SIZE additional bytes.

95

* "buffer_capacity" is how much is currently allocated,

96

* "buffer_length" is how much is already used.

97

*/

98

size_t adjustbuffer(char **buffer, size_t buffer_length,

99

size_t buffer_capacity){

100

if (buffer_length + BUFFER_SIZE > buffer_capacity){

101

*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

102

if (buffer == NULL){

103

return 0;

104

}

105

buffer_capacity += BUFFER_SIZE;

106

}

107

return buffer_capacity;

108

}

109

91

110

/*

92

111

* Decrypt OpenPGP data using keyrings in HOMEDIR.

93

112

* Returns -1 on error

216

235

217

236

*plaintext = NULL;

218

237

while(true){

219

if (plaintext_length + BUFFER_SIZE

220

> (ssize_t) plaintext_capacity){

221

*plaintext = realloc(*plaintext, plaintext_capacity

222

+ BUFFER_SIZE);

223

if (*plaintext == NULL){

224

perror("realloc");

238

plaintext_capacity = adjustbuffer(plaintext,

239

(size_t)plaintext_length,

240

plaintext_capacity);

241

if (plaintext_capacity == 0){

242

perror("adjustbuffer");

225

243

plaintext_length = -1;

226

244

goto decrypt_end;

227

}

228

plaintext_capacity += BUFFER_SIZE;

229

245

}

230

246

231

247

ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,

274

290

fprintf(stderr, "GnuTLS: %s", string);

275

291

}

276

292

277

static int initgnutls(mandos_context *mc, gnutls_session_t *session,

278

gnutls_dh_params_t *dh_params){

293

static int init_gnutls_global(mandos_context *mc,

294

const char *pubkeyfile,

295

const char *seckeyfile){

279

296

int ret;

280

297

281

298

if(debug){

323

340

}

324

341

325

342

/* GnuTLS server initialization */

326

ret = gnutls_dh_params_init(dh_params);

343

ret = gnutls_dh_params_init(&mc->dh_params);

327

344

if (ret != GNUTLS_E_SUCCESS) {

328

345

fprintf (stderr, "Error in GnuTLS DH parameter initialization:"

329

346

" %s\n", safer_gnutls_strerror(ret));

330

347

return -1;

331

348

}

332

ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits);

349

ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);

333

350

if (ret != GNUTLS_E_SUCCESS) {

334

351

fprintf (stderr, "Error in GnuTLS prime generation: %s\n",

335

352

safer_gnutls_strerror(ret));

336

353

return -1;

337

354

}

338

355

339

gnutls_certificate_set_dh_params(mc->cred, *dh_params);

340

356

gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);

357

358

return 0;

359

}

360

361

static int init_gnutls_session(mandos_context *mc,

362

gnutls_session_t *session){

363

int ret;

341

364

/* GnuTLS session creation */

342

365

ret = gnutls_init(session, GNUTLS_SERVER);

343

366

if (ret != GNUTLS_E_SUCCESS){

382

405

AvahiIfIndex if_index,

383

406

mandos_context *mc){

384

407

int ret, tcp_sd;

385

struct sockaddr_in6 to;

408

union { struct sockaddr in; struct sockaddr_in6 in6; } to;

386

409

char *buffer = NULL;

387

410

char *decrypted_buffer;

388

411

size_t buffer_length = 0;

389

412

size_t buffer_capacity = 0;

390

413

ssize_t decrypted_buffer_size;

391

size_t written = 0;

414

size_t written;

392

415

int retval = 0;

393

416

char interface[IF_NAMESIZE];

394

417

gnutls_session_t session;

395

gnutls_dh_params_t dh_params;

396

418

397

ret = initgnutls (mc, &session, &dh_params);

419

ret = init_gnutls_session (mc, &session);

398

420

if (ret != 0){

399

421

return -1;

400

422

}

419

441

}

420

442

421

443

memset(&to,0,sizeof(to)); /* Spurious warning */

422

to.sin6_family = AF_INET6;

444

to.in6.sin6_family = AF_INET6;

423

445

/* It would be nice to have a way to detect if we were passed an

424

446

IPv4 address here. Now we assume an IPv6 address. */

425

ret = inet_pton(AF_INET6, ip, &to.sin6_addr);

447

ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);

426

448

if (ret < 0 ){

427

449

perror("inet_pton");

428

450

return -1;

431

453

fprintf(stderr, "Bad address: %s\n", ip);

432

454

return -1;

433

455

}

434

to.sin6_port = htons(port); /* Spurious warning */

456

to.in6.sin6_port = htons(port); /* Spurious warning */

435

457

436

to.sin6_scope_id = (uint32_t)if_index;

458

to.in6.sin6_scope_id = (uint32_t)if_index;

437

459

438

460

if(debug){

439

461

fprintf(stderr, "Connection to: %s, port %d\n", ip, port);

440

462

char addrstr[INET6_ADDRSTRLEN] = "";

441

if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,

463

if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,

442

464

sizeof(addrstr)) == NULL){

443

465

perror("inet_ntop");

444

466

} else {

448

470

}

449

471

}

450

472

451

ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));

473

ret = connect(tcp_sd, &to.in, sizeof(to));

452

474

if (ret < 0){

453

475

perror("connect");

454

476

return -1;

455

477

}

456

478

479

const char *out = mandos_protocol_version;

480

written = 0;

481

while (true){

482

size_t out_size = strlen(out);

483

ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,

484

out_size - written));

485

if (ret == -1){

486

perror("write");

487

retval = -1;

488

goto mandos_end;

489

}

490

written += (size_t)ret;

491

if(written < out_size){

492

continue;

493

} else {

494

if (out == mandos_protocol_version){

495

written = 0;

496

out = "\r\n";

497

} else {

498

break;

499

}

500

}

501

}

502

457

503

if(debug){

458

504

fprintf(stderr, "Establishing TLS session with %s\n", ip);

459

505

}

479

525

}

480

526

481

527

while(true){

482

if (buffer_length + BUFFER_SIZE > buffer_capacity){

483

buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);

484

if (buffer == NULL){

485

perror("realloc");

486

retval = -1;

487

goto mandos_end;

488

}

489

buffer_capacity += BUFFER_SIZE;

528

buffer_capacity = adjustbuffer(&buffer, buffer_length,

529

buffer_capacity);

530

if (buffer_capacity == 0){

531

perror("adjustbuffer");

532

retval = -1;

533

goto mandos_end;

490

534

}

491

535

492

536

ret = gnutls_record_recv(session, buffer+buffer_length,

532

576

&decrypted_buffer,

533

577

keydir);

534

578

if (decrypted_buffer_size >= 0){

579

written = 0;

535

580

while(written < (size_t) decrypted_buffer_size){

536

581

ret = (int)fwrite (decrypted_buffer + written, 1,

537

582

(size_t)decrypted_buffer_size - written,

688

733

const char *interface = "eth0";

689

734

struct ifreq network;

690

735

int sd;

736

uid_t uid;

737

gid_t gid;

691

738

char *connect_to = NULL;

692

739

AvahiIfIndex if_index = AVAHI_IF_UNSPEC;

740

const char *pubkeyfile = "pubkey.txt";

741

const char *seckeyfile = "seckey.txt";

693

742

mandos_context mc = { .simple_poll = NULL, .server = NULL,

694

743

.dh_bits = 1024, .priority = "SECURE256"};

695

744

696

745

{

697

/* Temporary int to get the address of for getopt_long */

698

int debug_int = debug ? 1 : 0;

699

while (true){

700

struct option long_options[] = {

701

{"debug", no_argument, &debug_int, 1},

702

{"connect", required_argument, NULL, 'c'},

703

{"interface", required_argument, NULL, 'i'},

704

{"keydir", required_argument, NULL, 'd'},

705

{"seckey", required_argument, NULL, 's'},

706

{"pubkey", required_argument, NULL, 'p'},

707

{"dh-bits", required_argument, NULL, 'D'},

708

{"priority", required_argument, NULL, 'P'},

709

{0, 0, 0, 0} };

710

711

int option_index = 0;

712

ret = getopt_long (argc, argv, "i:", long_options,

713

&option_index);

714

715

if (ret == -1){

746

struct argp_option options[] = {

747

{ .name = "debug", .key = 128,

748

.doc = "Debug mode", .group = 3 },

749

{ .name = "connect", .key = 'c',

750

.arg = "IP",

751

.doc = "Connect directly to a sepcified mandos server",

752

.group = 1 },

753

{ .name = "interface", .key = 'i',

754

.arg = "INTERFACE",

755

.doc = "Interface that Avahi will conntect through",

756

.group = 1 },

757

{ .name = "keydir", .key = 'd',

758

.arg = "KEYDIR",

759

.doc = "Directory where the openpgp keyring is",

760

.group = 1 },

761

{ .name = "seckey", .key = 's',

762

.arg = "SECKEY",

763

.doc = "Secret openpgp key for gnutls authentication",

764

.group = 1 },

765

{ .name = "pubkey", .key = 'p',

766

.arg = "PUBKEY",

767

.doc = "Public openpgp key for gnutls authentication",

768

.group = 2 },

769

{ .name = "dh-bits", .key = 129,

770

.arg = "BITS",

771

.doc = "dh-bits to use in gnutls communication",

772

.group = 2 },

773

{ .name = "priority", .key = 130,

774

.arg = "PRIORITY",

775

.doc = "GNUTLS priority", .group = 1 },

776

{ .name = NULL }

777

};

778

779

780

error_t parse_opt (int key, char *arg,

781

struct argp_state *state) {

782

/* Get the INPUT argument from `argp_parse', which we know is

783

a pointer to our plugin list pointer. */

784

switch (key) {

785

case 128:

786

debug = true;

716

787

break;

717

}

718

719

switch(ret){

720

case 0:

788

case 'c':

789

connect_to = arg;

721

790

break;

722

791

case 'i':

723

interface = optarg;

724

break;

725

case 'c':

726

connect_to = optarg;

792

interface = arg;

727

793

break;

728

794

case 'd':

729

keydir = optarg;

795

keydir = arg;

796

break;

797

case 's':

798

seckeyfile = arg;

730

799

break;

731

800

case 'p':

732

pubkeyfile = optarg;

733

break;

734

case 's':

735

seckeyfile = optarg;

736

break;

737

case 'D':

801

pubkeyfile = arg;

802

break;

803

case 129:

738

804

errno = 0;

739

mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);

805

mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);

740

806

if (errno){

741

807

perror("strtol");

742

808

exit(EXIT_FAILURE);

743

809

}

744

810

break;

745

case 'P':

746

mc.priority = optarg;

747

break;

748

case '?':

811

case 130:

812

mc.priority = arg;

813

break;

814

case ARGP_KEY_ARG:

815

argp_usage (state);

816

break;

817

case ARGP_KEY_END:

818

break;

749

819

default:

750

/* getopt_long() has already printed a message about the

751

unrcognized option, so just exit. */

752

exit(EXIT_FAILURE);

820

return ARGP_ERR_UNKNOWN;

753

821

}

822

return 0;

754

823

}

755

/* Set the global debug flag from the temporary int */

756

debug = debug_int ? true : false;

824

825

struct argp argp = { .options = options, .parser = parse_opt,

826

.args_doc = "",

827

.doc = "Mandos client -- Get and decrypt"

828

" passwords from mandos server" };

829

argp_parse (&argp, argc, argv, 0, 0, NULL);

757

830

}

758

831

759

832

pubkeyfile = combinepath(keydir, pubkeyfile);

760

833

if (pubkeyfile == NULL){

761

834

perror("combinepath");

768

841

perror("combinepath");

769

842

goto end;

770

843

}

844

845

ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);

846

if (ret == -1){

847

fprintf(stderr, "init_gnutls_global\n");

848

goto end;

849

}

850

851

uid = getuid();

852

gid = getgid();

853

854

ret = setuid(uid);

855

if (ret == -1){

856

perror("setuid");

857

}

858

859

setgid(gid);

860

if (ret == -1){

861

perror("setgid");

862

}

771

863

772

864

if_index = (AvahiIfIndex) if_nametoindex(interface);

773

865

if(if_index == 0){

781

873

char *address = strrchr(connect_to, ':');

782

874

if(address == NULL){

783

875

fprintf(stderr, "No colon in address\n");

784

exit(EXIT_FAILURE);

876

exitcode = EXIT_FAILURE;

877

goto end;

785

878

}

786

879

errno = 0;

787

880

uint16_t port = (uint16_t) strtol(address+1, NULL, 10);

788

881

if(errno){

789

882

perror("Bad port number");

790

exit(EXIT_FAILURE);

883

exitcode = EXIT_FAILURE;

884

goto end;

791

885

}

792

886

*address = '\0';

793

887

address = connect_to;

794

888

ret = start_mandos_communication(address, port, if_index, &mc);

795

889

if(ret < 0){

796

exit(EXIT_FAILURE);

890

exitcode = EXIT_FAILURE;

797

891

} else {

798

exit(EXIT_SUCCESS);

892

exitcode = EXIT_SUCCESS;

799

893

}

894

goto end;

800

895

}

801

896

802

897

/* If the interface is down, bring it up */