64
60
#include <string.h> /* memset */
65
61
#include <arpa/inet.h> /* inet_pton() */
66
62
#include <iso646.h> /* not */
67
#include <net/if.h> /* IF_NAMESIZE */
70
65
#include <errno.h> /* perror() */
74
69
#include <getopt.h>
72
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
74
#define CERTFILE CERT_ROOT "openpgp-client.txt"
75
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
76
76
#define BUFFER_SIZE 256
78
static const char *keydir = "/conf/conf.d/mandos";
79
static const char *pubkeyfile = "pubkey.txt";
80
static const char *seckeyfile = "seckey.txt";
82
79
bool debug = false;
84
const char mandos_protocol_version[] = "1";
86
/* Used for passing in values through all the callback functions */
88
AvahiSimplePoll *simple_poll;
82
gnutls_session_t session;
90
83
gnutls_certificate_credentials_t cred;
92
84
gnutls_dh_params_t dh_params;
96
size_t adjustbuffer(char **buffer, size_t buffer_length,
97
size_t buffer_capacity){
98
if (buffer_length + BUFFER_SIZE > buffer_capacity){
99
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
103
buffer_capacity += BUFFER_SIZE;
105
return buffer_capacity;
109
* Decrypt OpenPGP data using keyrings in HOMEDIR.
110
* Returns -1 on error
112
static ssize_t pgp_packet_decrypt (const char *cryptotext,
115
const char *homedir){
88
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
89
char **new_packet, const char *homedir){
116
90
gpgme_data_t dh_crypto, dh_plain;
120
size_t plaintext_capacity = 0;
121
ssize_t plaintext_length = 0;
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
122
96
gpgme_engine_info_t engine_info;
125
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
129
103
gpgme_check_version(NULL);
130
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
131
if (rc != GPG_ERR_NO_ERROR){
132
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
133
gpgme_strsource(rc), gpgme_strerror(rc));
104
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
137
/* Set GPGME home directory for the OpenPGP engine only */
106
/* Set GPGME home directory */
138
107
rc = gpgme_get_engine_info (&engine_info);
139
108
if (rc != GPG_ERR_NO_ERROR){
140
109
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
192
/* Delete the GPGME FILE pointer cryptotext data buffer */
193
gpgme_data_release(dh_crypto);
227
195
/* Seek back to the beginning of the GPGME plaintext data buffer */
228
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
229
perror("pgpme_data_seek");
230
plaintext_length = -1;
196
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
236
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
238
if (plaintext_capacity == 0){
239
perror("adjustbuffer");
240
plaintext_length = -1;
200
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
201
*new_packet = realloc(*new_packet,
202
(unsigned int)new_packet_capacity
204
if (*new_packet == NULL){
208
new_packet_capacity += BUFFER_SIZE;
244
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
211
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
246
213
/* Print the data, if any */
252
218
perror("gpgme_data_read");
253
plaintext_length = -1;
256
plaintext_length += ret;
221
new_packet_length += ret;
260
fprintf(stderr, "Decrypted password is: ");
261
for(ssize_t i = 0; i < plaintext_length; i++){
262
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
264
fprintf(stderr, "\n");
269
/* Delete the GPGME cryptotext data buffer */
270
gpgme_data_release(dh_crypto);
224
/* FIXME: check characters before printing to screen so to not print
225
terminal control characters */
227
/* fprintf(stderr, "decrypted password is: "); */
228
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
229
/* fprintf(stderr, "\n"); */
272
232
/* Delete the GPGME plaintext data buffer */
273
233
gpgme_data_release(dh_plain);
274
return plaintext_length;
234
return new_packet_length;
277
237
static const char * safer_gnutls_strerror (int value) {
284
/* GnuTLS log function callback */
285
static void debuggnutls(__attribute__((unused)) int level,
287
fprintf(stderr, "GnuTLS: %s", string);
244
void debuggnutls(__attribute__((unused)) int level,
246
fprintf(stderr, "%s", string);
290
static int init_gnutls_global(mandos_context *mc){
249
int initgnutls(encrypted_session *es){
294
254
fprintf(stderr, "Initializing GnuTLS\n");
297
257
if ((ret = gnutls_global_init ())
298
258
!= GNUTLS_E_SUCCESS) {
299
fprintf (stderr, "GnuTLS global_init: %s\n",
300
safer_gnutls_strerror(ret));
259
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
305
/* "Use a log level over 10 to enable all debugging options."
308
264
gnutls_global_set_log_level(11);
309
265
gnutls_global_set_log_function(debuggnutls);
312
/* OpenPGP credentials */
313
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
268
/* openpgp credentials */
269
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
314
270
!= GNUTLS_E_SUCCESS) {
315
fprintf (stderr, "GnuTLS memory error: %s\n",
271
fprintf (stderr, "memory error: %s\n",
316
272
safer_gnutls_strerror(ret));
321
277
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
322
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
278
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
326
282
ret = gnutls_certificate_set_openpgp_key_file
327
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
283
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
328
284
if (ret != GNUTLS_E_SUCCESS) {
330
"Error[%d] while reading the OpenPGP key pair ('%s',"
331
" '%s')\n", ret, pubkeyfile, seckeyfile);
332
fprintf(stdout, "The GnuTLS error is: %s\n",
286
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
288
ret, CERTFILE, KEYFILE);
289
fprintf(stdout, "The Error is: %s\n",
333
290
safer_gnutls_strerror(ret));
337
/* GnuTLS server initialization */
338
ret = gnutls_dh_params_init(&mc->dh_params);
339
if (ret != GNUTLS_E_SUCCESS) {
340
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
341
" %s\n", safer_gnutls_strerror(ret));
344
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
345
if (ret != GNUTLS_E_SUCCESS) {
346
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
347
safer_gnutls_strerror(ret));
351
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
356
static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
358
/* GnuTLS session creation */
359
ret = gnutls_init(session, GNUTLS_SERVER);
360
if (ret != GNUTLS_E_SUCCESS){
294
//GnuTLS server initialization
295
if ((ret = gnutls_dh_params_init (&es->dh_params))
296
!= GNUTLS_E_SUCCESS) {
297
fprintf (stderr, "Error in dh parameter initialization: %s\n",
298
safer_gnutls_strerror(ret));
302
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in prime generation: %s\n",
305
safer_gnutls_strerror(ret));
309
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
311
// GnuTLS session creation
312
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
313
!= GNUTLS_E_SUCCESS){
361
314
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
362
315
safer_gnutls_strerror(ret));
367
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
368
if (ret != GNUTLS_E_SUCCESS) {
369
fprintf(stderr, "Syntax error at: %s\n", err);
370
fprintf(stderr, "GnuTLS error: %s\n",
371
safer_gnutls_strerror(ret));
318
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
319
!= GNUTLS_E_SUCCESS) {
320
fprintf(stderr, "Syntax error at: %s\n", err);
321
fprintf(stderr, "GnuTLS error: %s\n",
322
safer_gnutls_strerror(ret));
376
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
378
if (ret != GNUTLS_E_SUCCESS) {
379
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
326
if ((ret = gnutls_credentials_set
327
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
328
!= GNUTLS_E_SUCCESS) {
329
fprintf(stderr, "Error setting a credentials set: %s\n",
380
330
safer_gnutls_strerror(ret));
384
334
/* ignore client certificate if any. */
385
gnutls_certificate_server_set_request (*session,
335
gnutls_certificate_server_set_request (es->session,
386
336
GNUTLS_CERT_IGNORE);
388
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
338
gnutls_dh_set_prime_bits (es->session, DH_BITS);
393
/* Avahi log function callback */
394
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
395
__attribute__((unused)) const char *txt){}
343
void empty_log(__attribute__((unused)) AvahiLogLevel level,
344
__attribute__((unused)) const char *txt){}
397
/* Called when a Mandos server is found */
398
static int start_mandos_communication(const char *ip, uint16_t port,
399
AvahiIfIndex if_index,
346
int start_mandos_communication(const char *ip, uint16_t port,
347
unsigned int if_index){
402
349
struct sockaddr_in6 to;
350
encrypted_session es;
403
351
char *buffer = NULL;
404
352
char *decrypted_buffer;
405
353
size_t buffer_length = 0;
406
354
size_t buffer_capacity = 0;
407
355
ssize_t decrypted_buffer_size;
410
358
char interface[IF_NAMESIZE];
411
gnutls_session_t session;
412
gnutls_dh_params_t dh_params;
414
ret = init_gnutls_session (mc, &session);
420
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
361
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
424
364
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
647
566
avahi_s_service_resolver_free(r);
650
static void browse_callback( AvahiSServiceBrowser *b,
651
AvahiIfIndex interface,
652
AvahiProtocol protocol,
653
AvahiBrowserEvent event,
657
AVAHI_GCC_UNUSED AvahiLookupResultFlags
660
mandos_context *mc = userdata;
661
assert(b); /* Spurious warning */
663
/* Called whenever a new services becomes available on the LAN or
664
is removed from the LAN */
668
case AVAHI_BROWSER_FAILURE:
670
fprintf(stderr, "(Avahi browser) %s\n",
671
avahi_strerror(avahi_server_errno(mc->server)));
672
avahi_simple_poll_quit(mc->simple_poll);
675
case AVAHI_BROWSER_NEW:
676
/* We ignore the returned Avahi resolver object. In the callback
677
function we free it. If the Avahi server is terminated before
678
the callback function is called the Avahi server will free the
681
if (!(avahi_s_service_resolver_new(mc->server, interface,
682
protocol, name, type, domain,
683
AVAHI_PROTO_INET6, 0,
684
resolve_callback, mc)))
685
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
686
name, avahi_strerror(avahi_server_errno(mc->server)));
689
case AVAHI_BROWSER_REMOVE:
692
case AVAHI_BROWSER_ALL_FOR_NOW:
693
case AVAHI_BROWSER_CACHE_EXHAUSTED:
695
fprintf(stderr, "No Mandos server found, still searching...\n");
569
static void browse_callback(
570
AvahiSServiceBrowser *b,
571
AvahiIfIndex interface,
572
AvahiProtocol protocol,
573
AvahiBrowserEvent event,
577
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
580
AvahiServer *s = userdata;
581
assert(b); /* Spurious warning */
583
/* Called whenever a new services becomes available on the LAN or
584
is removed from the LAN */
588
case AVAHI_BROWSER_FAILURE:
590
fprintf(stderr, "(Browser) %s\n",
591
avahi_strerror(avahi_server_errno(server)));
592
avahi_simple_poll_quit(simple_poll);
595
case AVAHI_BROWSER_NEW:
596
/* We ignore the returned resolver object. In the callback
597
function we free it. If the server is terminated before
598
the callback function is called the server will free
599
the resolver for us. */
601
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
603
AVAHI_PROTO_INET6, 0,
604
resolve_callback, s)))
605
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
606
avahi_strerror(avahi_server_errno(s)));
609
case AVAHI_BROWSER_REMOVE:
612
case AVAHI_BROWSER_ALL_FOR_NOW:
613
case AVAHI_BROWSER_CACHE_EXHAUSTED:
701
/* Combines file name and path and returns the malloced new
702
string. some sane checks could/should be added */
703
static const char *combinepath(const char *first, const char *second){
704
size_t f_len = strlen(first);
705
size_t s_len = strlen(second);
706
char *tmp = malloc(f_len + s_len + 2);
711
memcpy(tmp, first, f_len); /* Spurious warning */
715
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
717
tmp[f_len + 1 + s_len] = '\0';
722
int main(int argc, char *argv[]){
618
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
619
AvahiServerConfig config;
723
620
AvahiSServiceBrowser *sb = NULL;
726
int exitcode = EXIT_SUCCESS;
623
int returncode = EXIT_SUCCESS;
727
624
const char *interface = "eth0";
728
struct ifreq network;
732
char *connect_to = NULL;
733
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
734
mandos_context mc = { .simple_poll = NULL, .server = NULL,
735
.dh_bits = 1024, .priority = "SECURE256"};
738
/* Temporary int to get the address of for getopt_long */
739
int debug_int = debug ? 1 : 0;
741
struct option long_options[] = {
742
{"debug", no_argument, &debug_int, 1},
743
{"connect", required_argument, NULL, 'c'},
744
{"interface", required_argument, NULL, 'i'},
745
{"keydir", required_argument, NULL, 'd'},
746
{"seckey", required_argument, NULL, 's'},
747
{"pubkey", required_argument, NULL, 'p'},
748
{"dh-bits", required_argument, NULL, 'D'},
749
{"priority", required_argument, NULL, 'P'},
752
int option_index = 0;
753
ret = getopt_long (argc, argv, "i:", long_options,
780
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
787
mc.priority = optarg;
791
/* getopt_long() has already printed a message about the
792
unrcognized option, so just exit. */
796
/* Set the global debug flag from the temporary int */
797
debug = debug_int ? true : false;
800
pubkeyfile = combinepath(keydir, pubkeyfile);
801
if (pubkeyfile == NULL){
802
perror("combinepath");
803
exitcode = EXIT_FAILURE;
807
seckeyfile = combinepath(keydir, seckeyfile);
808
if (seckeyfile == NULL){
809
perror("combinepath");
813
ret = init_gnutls_global(&mc);
815
fprintf(stderr, "init_gnutls_global\n");
832
if_index = (AvahiIfIndex) if_nametoindex(interface);
834
fprintf(stderr, "No such interface: \"%s\"\n", interface);
838
if(connect_to != NULL){
839
/* Connect directly, do not use Zeroconf */
840
/* (Mainly meant for debugging) */
841
char *address = strrchr(connect_to, ':');
843
fprintf(stderr, "No colon in address\n");
844
exitcode = EXIT_FAILURE;
848
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
850
perror("Bad port number");
851
exitcode = EXIT_FAILURE;
855
address = connect_to;
856
ret = start_mandos_communication(address, port, if_index, &mc);
858
exitcode = EXIT_FAILURE;
860
exitcode = EXIT_SUCCESS;
865
/* If the interface is down, bring it up */
867
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
870
exitcode = EXIT_FAILURE;
873
strcpy(network.ifr_name, interface); /* Spurious warning */
874
ret = ioctl(sd, SIOCGIFFLAGS, &network);
876
perror("ioctl SIOCGIFFLAGS");
877
exitcode = EXIT_FAILURE;
880
if((network.ifr_flags & IFF_UP) == 0){
881
network.ifr_flags |= IFF_UP;
882
ret = ioctl(sd, SIOCSIFFLAGS, &network);
884
perror("ioctl SIOCSIFFLAGS");
885
exitcode = EXIT_FAILURE;
627
static struct option long_options[] = {
628
{"debug", no_argument, (int *)&debug, 1},
629
{"interface", required_argument, 0, 'i'},
632
int option_index = 0;
633
ret = getopt_long (argc, argv, "i:", long_options,
893
652
avahi_set_log_function(empty_log);
896
/* Initialize the pseudo-RNG for Avahi */
655
/* Initialize the psuedo-RNG */
897
656
srand((unsigned int) time(NULL));
899
/* Allocate main Avahi loop object */
900
mc.simple_poll = avahi_simple_poll_new();
901
if (mc.simple_poll == NULL) {
902
fprintf(stderr, "Avahi: Failed to create simple poll"
904
exitcode = EXIT_FAILURE;
909
AvahiServerConfig config;
910
/* Do not publish any local Zeroconf records */
911
avahi_server_config_init(&config);
912
config.publish_hinfo = 0;
913
config.publish_addresses = 0;
914
config.publish_workstation = 0;
915
config.publish_domain = 0;
917
/* Allocate a new server */
918
mc.server = avahi_server_new(avahi_simple_poll_get
919
(mc.simple_poll), &config, NULL,
922
/* Free the Avahi configuration data */
923
avahi_server_config_free(&config);
926
/* Check if creating the Avahi server object succeeded */
927
if (mc.server == NULL) {
928
fprintf(stderr, "Failed to create Avahi server: %s\n",
658
/* Allocate main loop object */
659
if (!(simple_poll = avahi_simple_poll_new())) {
660
fprintf(stderr, "Failed to create simple poll object.\n");
665
/* Do not publish any local records */
666
avahi_server_config_init(&config);
667
config.publish_hinfo = 0;
668
config.publish_addresses = 0;
669
config.publish_workstation = 0;
670
config.publish_domain = 0;
672
/* Allocate a new server */
673
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
674
&config, NULL, NULL, &error);
676
/* Free the configuration data */
677
avahi_server_config_free(&config);
679
/* Check if creating the server object succeeded */
681
fprintf(stderr, "Failed to create server: %s\n",
929
682
avahi_strerror(error));
930
exitcode = EXIT_FAILURE;
683
returncode = EXIT_FAILURE;
934
/* Create the Avahi service browser */
935
sb = avahi_s_service_browser_new(mc.server, if_index,
687
/* Create the service browser */
688
sb = avahi_s_service_browser_new(server,
690
if_nametoindex(interface),
936
691
AVAHI_PROTO_INET6,
937
692
"_mandos._tcp", NULL, 0,
938
browse_callback, &mc);
693
browse_callback, server);
940
695
fprintf(stderr, "Failed to create service browser: %s\n",
941
avahi_strerror(avahi_server_errno(mc.server)));
942
exitcode = EXIT_FAILURE;
696
avahi_strerror(avahi_server_errno(server)));
697
returncode = EXIT_FAILURE;
946
701
/* Run the main loop */
949
fprintf(stderr, "Starting Avahi loop search\n");
704
fprintf(stderr, "Starting avahi loop search\n");
952
avahi_simple_poll_loop(mc.simple_poll);
707
avahi_simple_poll_loop(simple_poll);
957
712
fprintf(stderr, "%s exiting\n", argv[0]);
960
715
/* Cleanup things */
962
717
avahi_s_service_browser_free(sb);
964
if (mc.server != NULL)
965
avahi_server_free(mc.server);
967
if (mc.simple_poll != NULL)
968
avahi_simple_poll_free(mc.simple_poll);
720
avahi_server_free(server);
723
avahi_simple_poll_free(simple_poll);