/mandos/release : revision 24.1.23

32

#define _LARGEFILE_SOURCE

33

#define _FILE_OFFSET_BITS 64

34

35

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */

36

35

37

#include <stdio.h>

36

38

#include <assert.h>

37

39

#include <stdlib.h>

38

40

#include <time.h>

39

41

#include <net/if.h> /* if_nametoindex */

42

#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

43

SIOCSIFFLAGS */

44

#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

45

SIOCSIFFLAGS */

40

46

41

47

#include <avahi-core/core.h>

42

48

#include <avahi-core/lookup.h>

45

51

#include <avahi-common/malloc.h>

46

52

#include <avahi-common/error.h>

47

53

48

//mandos client part

54

/* Mandos client part */

49

55

#include <sys/types.h> /* socket(), inet_pton() */

50

56

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

51

57

struct in6_addr, inet_pton() */

58

64

#include <string.h> /* memset */

59

65

#include <arpa/inet.h> /* inet_pton() */

60

66

#include <iso646.h> /* not */

61

62

// gpgme

67

#include <net/if.h> /* IF_NAMESIZE */

68

#include <argp.h> /* struct argp_option,

69

struct argp_state, struct argp,

70

argp_parse() */

71

/* GPGME */

63

72

#include <errno.h> /* perror() */

64

73

#include <gpgme.h>

65

74

66

// getopt_long

67

#include <getopt.h>

68

69

75

#define BUFFER_SIZE 256

70

76

71

static int dh_bits = 1024;

72

77

bool debug = false;

73

78

static const char *keydir = "/conf/conf.d/mandos";

74

static const char *pubkeyfile = "pubkey.txt";

75

static const char *seckeyfile = "seckey.txt";

76

77

bool debug = false;

78

79

/* Used for */

79

static const char mandos_protocol_version[] = "1";

80

const char *argp_program_version = "mandosclient 0.9";

81

const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";

82

83

/* Used for passing in values through the Avahi callback functions */

80

84

typedef struct {

81

gnutls_session_t session;

85

AvahiSimplePoll *simple_poll;

86

AvahiServer *server;

82

87

gnutls_certificate_credentials_t cred;

88

unsigned int dh_bits;

83

89

gnutls_dh_params_t dh_params;

84

} encrypted_session;

85

86

87

static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,

88

char **new_packet,

90

const char *priority;

91

} mandos_context;

92

93

/*

94

* Make room in "buffer" for at least BUFFER_SIZE additional bytes.

95

* "buffer_capacity" is how much is currently allocated,

96

* "buffer_length" is how much is already used.

97

*/

98

size_t adjustbuffer(char **buffer, size_t buffer_length,

99

size_t buffer_capacity){

100

if (buffer_length + BUFFER_SIZE > buffer_capacity){

101

*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

102

if (buffer == NULL){

103

return 0;

104

}

105

buffer_capacity += BUFFER_SIZE;

106

}

107

return buffer_capacity;

108

}

109

110

/*

111

* Decrypt OpenPGP data using keyrings in HOMEDIR.

112

* Returns -1 on error

113

*/

114

static ssize_t pgp_packet_decrypt (const char *cryptotext,

115

size_t crypto_size,

116

char **plaintext,

89

117

const char *homedir){

90

118

gpgme_data_t dh_crypto, dh_plain;

91

119

gpgme_ctx_t ctx;

92

120

gpgme_error_t rc;

93

121

ssize_t ret;

94

ssize_t new_packet_capacity = 0;

95

ssize_t new_packet_length = 0;

122

size_t plaintext_capacity = 0;

123

ssize_t plaintext_length = 0;

96

124

gpgme_engine_info_t engine_info;

97

125

98

126

if (debug){

99

fprintf(stderr, "Trying to decrypt OpenPGP packet\n");

127

fprintf(stderr, "Trying to decrypt OpenPGP data\n");

100

128

}

101

129

102

130

/* Init GPGME */

108

136

return -1;

109

137

}

110

138

111

/* Set GPGME home directory */

139

/* Set GPGME home directory for the OpenPGP engine only */

112

140

rc = gpgme_get_engine_info (&engine_info);

113

141

if (rc != GPG_ERR_NO_ERROR){

114

142

fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",

124

152

engine_info = engine_info->next;

125

153

}

126

154

if(engine_info == NULL){

127

fprintf(stderr, "Could not set home dir to %s\n", homedir);

155

fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);

128

156

return -1;

129

157

}

130

158

131

/* Create new GPGME data buffer from packet buffer */

132

rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);

159

/* Create new GPGME data buffer from memory cryptotext */

160

rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,

161

0);

133

162

if (rc != GPG_ERR_NO_ERROR){

134

163

fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",

135

164

gpgme_strsource(rc), gpgme_strerror(rc));

141

170

if (rc != GPG_ERR_NO_ERROR){

142

171

fprintf(stderr, "bad gpgme_data_new: %s: %s\n",

143

172

gpgme_strsource(rc), gpgme_strerror(rc));

173

gpgme_data_release(dh_crypto);

144

174

return -1;

145

175

}

146

176

149

179

if (rc != GPG_ERR_NO_ERROR){

150

180

fprintf(stderr, "bad gpgme_new: %s: %s\n",

151

181

gpgme_strsource(rc), gpgme_strerror(rc));

152

return -1;

182

plaintext_length = -1;

183

goto decrypt_end;

153

184

}

154

185

155

/* Decrypt data from the FILE pointer to the plaintext data

156

buffer */

186

/* Decrypt data from the cryptotext data buffer to the plaintext

187

data buffer */

157

188

rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);

158

189

if (rc != GPG_ERR_NO_ERROR){

159

190

fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",

160

191

gpgme_strsource(rc), gpgme_strerror(rc));

161

return -1;

192

plaintext_length = -1;

193

goto decrypt_end;

162

194

}

163

195

164

196

if(debug){

165

fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");

197

fprintf(stderr, "Decryption of OpenPGP data succeeded\n");

166

198

}

167

199

168

200

if (debug){

169

201

gpgme_decrypt_result_t result;

170

202

result = gpgme_op_decrypt_result(ctx);

194

226

}

195

227

}

196

228

197

/* Delete the GPGME FILE pointer cryptotext data buffer */

198

gpgme_data_release(dh_crypto);

199

200

229

/* Seek back to the beginning of the GPGME plaintext data buffer */

201

230

if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){

202

231

perror("pgpme_data_seek");

232

plaintext_length = -1;

233

goto decrypt_end;

203

234

}

204

235

205

*new_packet = 0;

236

*plaintext = NULL;

206

237

while(true){

207

if (new_packet_length + BUFFER_SIZE > new_packet_capacity){

208

*new_packet = realloc(*new_packet,

209

(unsigned int)new_packet_capacity

210

+ BUFFER_SIZE);

211

if (*new_packet == NULL){

212

perror("realloc");

213

return -1;

214

}

215

new_packet_capacity += BUFFER_SIZE;

238

plaintext_capacity = adjustbuffer(plaintext,

239

(size_t)plaintext_length,

240

plaintext_capacity);

241

if (plaintext_capacity == 0){

242

perror("adjustbuffer");

243

plaintext_length = -1;

244

goto decrypt_end;

216

245

}

217

246

218

ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,

247

ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,

219

248

BUFFER_SIZE);

220

249

/* Print the data, if any */

221

250

if (ret == 0){

251

/* EOF */

222

252

break;

223

253

}

224

254

if(ret < 0){

225

255

perror("gpgme_data_read");

226

return -1;

256

plaintext_length = -1;

257

goto decrypt_end;

227

258

}

228

new_packet_length += ret;

259

plaintext_length += ret;

229

260

}

230

261

231

/* FIXME: check characters before printing to screen so to not print

232

terminal control characters */

233

/* if(debug){ */

234

/* fprintf(stderr, "decrypted password is: "); */

235

/* fwrite(*new_packet, 1, new_packet_length, stderr); */

236

/* fprintf(stderr, "\n"); */

237

/* } */

262

if(debug){

263

fprintf(stderr, "Decrypted password is: ");

264

for(ssize_t i = 0; i < plaintext_length; i++){

265

fprintf(stderr, "%02hhX ", (*plaintext)[i]);

266

}

267

fprintf(stderr, "\n");

268

}

269

270

decrypt_end:

271

272

/* Delete the GPGME cryptotext data buffer */

273

gpgme_data_release(dh_crypto);

238

274

239

275

/* Delete the GPGME plaintext data buffer */

240

276

gpgme_data_release(dh_plain);

241

return new_packet_length;

277

return plaintext_length;

242

278

}

243

279

244

280

static const char * safer_gnutls_strerror (int value) {

248

284

return ret;

249

285

}

250

286

287

/* GnuTLS log function callback */

251

288

static void debuggnutls(__attribute__((unused)) int level,

252

289

const char* string){

253

fprintf(stderr, "%s", string);

290

fprintf(stderr, "GnuTLS: %s", string);

254

291

}

255

292

256

static int initgnutls(encrypted_session *es){

257

const char *err;

293

static int init_gnutls_global(mandos_context *mc,

294

const char *pubkeyfile,

295

const char *seckeyfile){

258

296

int ret;

259

297

260

298

if(debug){

263

301

264

302

if ((ret = gnutls_global_init ())

265

303

!= GNUTLS_E_SUCCESS) {

266

fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));

304

fprintf (stderr, "GnuTLS global_init: %s\n",

305

safer_gnutls_strerror(ret));

267

306

return -1;

268

307

}

269

308

270

309

if (debug){

310

/* "Use a log level over 10 to enable all debugging options."

311

* - GnuTLS manual

312

*/

271

313

gnutls_global_set_log_level(11);

272

314

gnutls_global_set_log_function(debuggnutls);

273

315

}

274

316

275

/* openpgp credentials */

276

if ((ret = gnutls_certificate_allocate_credentials (&es->cred))

317

/* OpenPGP credentials */

318

if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))

277

319

!= GNUTLS_E_SUCCESS) {

278

fprintf (stderr, "memory error: %s\n",

320

fprintf (stderr, "GnuTLS memory error: %s\n",

279

321

safer_gnutls_strerror(ret));

322

gnutls_global_deinit ();

280

323

return -1;

281

324

}

282

325

287

330

}

288

331

289

332

ret = gnutls_certificate_set_openpgp_key_file

290

(es->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);

333

(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);

291

334

if (ret != GNUTLS_E_SUCCESS) {

292

fprintf

293

(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"

294

" '%s')\n",

295

ret, pubkeyfile, seckeyfile);

296

fprintf(stdout, "The Error is: %s\n",

335

fprintf(stderr,

336

"Error[%d] while reading the OpenPGP key pair ('%s',"

337

" '%s')\n", ret, pubkeyfile, seckeyfile);

338

fprintf(stdout, "The GnuTLS error is: %s\n",

297

339

safer_gnutls_strerror(ret));

298

return -1;

299

}

300

301

//GnuTLS server initialization

302

if ((ret = gnutls_dh_params_init (&es->dh_params))

303

!= GNUTLS_E_SUCCESS) {

304

fprintf (stderr, "Error in dh parameter initialization: %s\n",

305

safer_gnutls_strerror(ret));

306

return -1;

307

}

308

309

if ((ret = gnutls_dh_params_generate2 (es->dh_params, dh_bits))

310

!= GNUTLS_E_SUCCESS) {

311

fprintf (stderr, "Error in prime generation: %s\n",

312

safer_gnutls_strerror(ret));

313

return -1;

314

}

315

316

gnutls_certificate_set_dh_params (es->cred, es->dh_params);

317

318

// GnuTLS session creation

319

if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))

320

!= GNUTLS_E_SUCCESS){

340

goto globalfail;

341

}

342

343

/* GnuTLS server initialization */

344

ret = gnutls_dh_params_init(&mc->dh_params);

345

if (ret != GNUTLS_E_SUCCESS) {

346

fprintf (stderr, "Error in GnuTLS DH parameter initialization:"

347

" %s\n", safer_gnutls_strerror(ret));

348

goto globalfail;

349

}

350

ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);

351

if (ret != GNUTLS_E_SUCCESS) {

352

fprintf (stderr, "Error in GnuTLS prime generation: %s\n",

353

safer_gnutls_strerror(ret));

354

goto globalfail;

355

}

356

357

gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);

358

359

return 0;

360

361

globalfail:

362

363

gnutls_certificate_free_credentials (mc->cred);

364

gnutls_global_deinit ();

365

return -1;

366

367

}

368

369

static int init_gnutls_session(mandos_context *mc,

370

gnutls_session_t *session){

371

int ret;

372

/* GnuTLS session creation */

373

ret = gnutls_init(session, GNUTLS_SERVER);

374

if (ret != GNUTLS_E_SUCCESS){

321

375

fprintf(stderr, "Error in GnuTLS session initialization: %s\n",

322

376

safer_gnutls_strerror(ret));

323

377

}

324

378

325

if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))

326

!= GNUTLS_E_SUCCESS) {

327

fprintf(stderr, "Syntax error at: %s\n", err);

328

fprintf(stderr, "GnuTLS error: %s\n",

329

safer_gnutls_strerror(ret));

330

return -1;

379

{

380

const char *err;

381

ret = gnutls_priority_set_direct(*session, mc->priority, &err);

382

if (ret != GNUTLS_E_SUCCESS) {

383

fprintf(stderr, "Syntax error at: %s\n", err);

384

fprintf(stderr, "GnuTLS error: %s\n",

385

safer_gnutls_strerror(ret));

386

gnutls_deinit (*session);

387

return -1;

388

}

331

389

}

332

390

333

if ((ret = gnutls_credentials_set

334

(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))

335

!= GNUTLS_E_SUCCESS) {

336

fprintf(stderr, "Error setting a credentials set: %s\n",

391

ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,

392

mc->cred);

393

if (ret != GNUTLS_E_SUCCESS) {

394

fprintf(stderr, "Error setting GnuTLS credentials: %s\n",

337

395

safer_gnutls_strerror(ret));

396

gnutls_deinit (*session);

338

397

return -1;

339

398

}

340

399

341

400

/* ignore client certificate if any. */

342

gnutls_certificate_server_set_request (es->session,

401

gnutls_certificate_server_set_request (*session,

343

402

GNUTLS_CERT_IGNORE);

344

403

345

gnutls_dh_set_prime_bits (es->session, dh_bits);

404

gnutls_dh_set_prime_bits (*session, mc->dh_bits);

346

405

347

406

return 0;

348

407

}

349

408

409

/* Avahi log function callback */

350

410

static void empty_log(__attribute__((unused)) AvahiLogLevel level,

351

411

__attribute__((unused)) const char *txt){}

352

412

413

/* Called when a Mandos server is found */

353

414

static int start_mandos_communication(const char *ip, uint16_t port,

354

AvahiIfIndex if_index){

415

AvahiIfIndex if_index,

416

mandos_context *mc){

355

417

int ret, tcp_sd;

356

struct sockaddr_in6 to;

357

encrypted_session es;

418

union { struct sockaddr in; struct sockaddr_in6 in6; } to;

358

419

char *buffer = NULL;

359

420

char *decrypted_buffer;

360

421

size_t buffer_length = 0;

361

422

size_t buffer_capacity = 0;

362

423

ssize_t decrypted_buffer_size;

363

size_t written = 0;

424

size_t written;

364

425

int retval = 0;

365

426

char interface[IF_NAMESIZE];

427

gnutls_session_t session;

428

429

ret = init_gnutls_session (mc, &session);

430

if (ret != 0){

431

return -1;

432

}

366

433

367

434

if(debug){

368

435

fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",

374

441

perror("socket");

375

442

return -1;

376

443

}

377

378

if(if_indextoname((unsigned int)if_index, interface) == NULL){

379

if(debug){

444

445

if(debug){

446

if(if_indextoname((unsigned int)if_index, interface) == NULL){

380

447

perror("if_indextoname");

448

return -1;

381

449

}

382

return -1;

383

}

384

385

if(debug){

386

450

fprintf(stderr, "Binding to interface %s\n", interface);

387

451

}

388

452

389

453

memset(&to,0,sizeof(to)); /* Spurious warning */

390

to.sin6_family = AF_INET6;

391

ret = inet_pton(AF_INET6, ip, &to.sin6_addr);

454

to.in6.sin6_family = AF_INET6;

455

/* It would be nice to have a way to detect if we were passed an

456

IPv4 address here. Now we assume an IPv6 address. */

457

ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);

392

458

if (ret < 0 ){

393

459

perror("inet_pton");

394

460

return -1;

395

}

461

}

396

462

if(ret == 0){

397

463

fprintf(stderr, "Bad address: %s\n", ip);

398

464

return -1;

399

465

}

400

to.sin6_port = htons(port); /* Spurious warning */

466

to.in6.sin6_port = htons(port); /* Spurious warning */

401

467

402

to.sin6_scope_id = (uint32_t)if_index;

468

to.in6.sin6_scope_id = (uint32_t)if_index;

403

469

404

470

if(debug){

405

471

fprintf(stderr, "Connection to: %s, port %d\n", ip, port);

406

472

char addrstr[INET6_ADDRSTRLEN] = "";

407

if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,

473

if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,

408

474

sizeof(addrstr)) == NULL){

409

475

perror("inet_ntop");

410

476

} else {

411

477

if(strcmp(addrstr, ip) != 0){

412

fprintf(stderr, "Canonical address form: %s\n",

413

addrstr, ntohs(to.sin6_port));

478

fprintf(stderr, "Canonical address form: %s\n", addrstr);

414

479

}

415

480

}

416

481

}

417

482

418

ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));

483

ret = connect(tcp_sd, &to.in, sizeof(to));

419

484

if (ret < 0){

420

485

perror("connect");

421

486

return -1;

422

487

}

423

424

ret = initgnutls (&es);

425

if (ret != 0){

426

retval = -1;

427

return -1;

488

489

const char *out = mandos_protocol_version;

490

written = 0;

491

while (true){

492

size_t out_size = strlen(out);

493

ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,

494

out_size - written));

495

if (ret == -1){

496

perror("write");

497

retval = -1;

498

goto mandos_end;

499

}

500

written += (size_t)ret;

501

if(written < out_size){

502

continue;

503

} else {

504

if (out == mandos_protocol_version){

505

written = 0;

506

out = "\r\n";

507

} else {

508

break;

509

}

510

}

428

511

}

429

430

gnutls_transport_set_ptr (es.session,

431

(gnutls_transport_ptr_t) tcp_sd);

432

512

433

513

if(debug){

434

514

fprintf(stderr, "Establishing TLS session with %s\n", ip);

435

515

}

436

516

437

ret = gnutls_handshake (es.session);

517

gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);

518

519

ret = gnutls_handshake (session);

438

520

439

521

if (ret != GNUTLS_E_SUCCESS){

440

522

if(debug){

441

fprintf(stderr, "\n*** Handshake failed ***\n");

523

fprintf(stderr, "*** GnuTLS Handshake failed ***\n");

442

524

gnutls_perror (ret);

443

525

}

444

526

retval = -1;

445

goto exit;

527

goto mandos_end;

446

528

}

447

529

448

//Retrieve OpenPGP packet that contains the wanted password

530

/* Read OpenPGP packet that contains the wanted password */

449

531

450

532

if(debug){

451

533

fprintf(stderr, "Retrieving pgp encrypted password from %s\n",

453

535

}

454

536

455

537

while(true){

456

if (buffer_length + BUFFER_SIZE > buffer_capacity){

457

buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);

458

if (buffer == NULL){

459

perror("realloc");

460

goto exit;

461

}

462

buffer_capacity += BUFFER_SIZE;

538

buffer_capacity = adjustbuffer(&buffer, buffer_length,

539

buffer_capacity);

540

if (buffer_capacity == 0){

541

perror("adjustbuffer");

542

retval = -1;

543

goto mandos_end;

463

544

}

464

545

465

ret = gnutls_record_recv

466

(es.session, buffer+buffer_length, BUFFER_SIZE);

546

ret = gnutls_record_recv(session, buffer+buffer_length,

547

BUFFER_SIZE);

467

548

if (ret == 0){

468

549

break;

469

550

}

473

554

case GNUTLS_E_AGAIN:

474

555

break;

475

556

case GNUTLS_E_REHANDSHAKE:

476

ret = gnutls_handshake (es.session);

557

ret = gnutls_handshake (session);

477

558

if (ret < 0){

478

fprintf(stderr, "\n*** Handshake failed ***\n");

559

fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");

479

560

gnutls_perror (ret);

480

561

retval = -1;

481

goto exit;

562

goto mandos_end;

482

563

}

483

564

break;

484

565

default:

485

566

fprintf(stderr, "Unknown error while reading data from"

486

" encrypted session with mandos server\n");

567

" encrypted session with Mandos server\n");

487

568

retval = -1;

488

gnutls_bye (es.session, GNUTLS_SHUT_RDWR);

489

goto exit;

569

gnutls_bye (session, GNUTLS_SHUT_RDWR);

570

goto mandos_end;

490

571

}

491

572

} else {

492

573

buffer_length += (size_t) ret;

493

574

}

494

575

}

495

576

577

if(debug){

578

fprintf(stderr, "Closing TLS session\n");

579

}

580

581

gnutls_bye (session, GNUTLS_SHUT_RDWR);

582

496

583

if (buffer_length > 0){

497

584

decrypted_buffer_size = pgp_packet_decrypt(buffer,

498

585

buffer_length,

499

586

&decrypted_buffer,

500

587

keydir);

501

588

if (decrypted_buffer_size >= 0){

589

written = 0;

502

590

while(written < (size_t) decrypted_buffer_size){

503

591

ret = (int)fwrite (decrypted_buffer + written, 1,

504

592

(size_t)decrypted_buffer_size - written,

518

606

retval = -1;

519

607

}

520

608

}

521

522

//shutdown procedure

523

524

if(debug){

525

fprintf(stderr, "Closing TLS session\n");

526

}

527

609

610

/* Shutdown procedure */

611

612

mandos_end:

528

613

free(buffer);

529

gnutls_bye (es.session, GNUTLS_SHUT_RDWR);

530

exit:

531

614

close(tcp_sd);

532

gnutls_deinit (es.session);

533

gnutls_certificate_free_credentials (es.cred);

534

gnutls_global_deinit ();

615

gnutls_deinit (session);

535

616

return retval;

536

617

}

537

618

538

static AvahiSimplePoll *simple_poll = NULL;

539

static AvahiServer *server = NULL;

540

541

static void resolve_callback(

542

AvahiSServiceResolver *r,

543

AvahiIfIndex interface,

544

AVAHI_GCC_UNUSED AvahiProtocol protocol,

545

AvahiResolverEvent event,

546

const char *name,

547

const char *type,

548

const char *domain,

549

const char *host_name,

550

const AvahiAddress *address,

551

uint16_t port,

552

AVAHI_GCC_UNUSED AvahiStringList *txt,

553

AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,

554

AVAHI_GCC_UNUSED void* userdata) {

555

619

static void resolve_callback(AvahiSServiceResolver *r,

620

AvahiIfIndex interface,

621

AVAHI_GCC_UNUSED AvahiProtocol protocol,

622

AvahiResolverEvent event,

623

const char *name,

624

const char *type,

625

const char *domain,

626

const char *host_name,

627

const AvahiAddress *address,

628

uint16_t port,

629

AVAHI_GCC_UNUSED AvahiStringList *txt,

630

AVAHI_GCC_UNUSED AvahiLookupResultFlags

631

flags,

632

void* userdata) {

633

mandos_context *mc = userdata;

556

634

assert(r); /* Spurious warning */

557

635

558

636

/* Called whenever a service has been resolved successfully or

561

639

switch (event) {

562

640

default:

563

641

case AVAHI_RESOLVER_FAILURE:

564

fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"

565

" type '%s' in domain '%s': %s\n", name, type, domain,

566

avahi_strerror(avahi_server_errno(server)));

642

fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"

643

" of type '%s' in domain '%s': %s\n", name, type, domain,

644

avahi_strerror(avahi_server_errno(mc->server)));

567

645

break;

568

646

569

647

case AVAHI_RESOLVER_FOUND:

571

649

char ip[AVAHI_ADDRESS_STR_MAX];

572

650

avahi_address_snprint(ip, sizeof(ip), address);

573

651

if(debug){

574

fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"

575

" port %d\n", name, host_name, ip, port);

652

fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"

653

" port %d\n", name, host_name, ip, interface, port);

576

654

}

577

int ret = start_mandos_communication(ip, port, interface);

655

int ret = start_mandos_communication(ip, port, interface, mc);

578

656

if (ret == 0){

579

657

exit(EXIT_SUCCESS);

580

658

}

583

661

avahi_s_service_resolver_free(r);

584

662

}

585

663

586

static void browse_callback(

587

AvahiSServiceBrowser *b,

588

AvahiIfIndex interface,

589

AvahiProtocol protocol,

590

AvahiBrowserEvent event,

591

const char *name,

592

const char *type,

593

const char *domain,

594

AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,

595

void* userdata) {

596

597

AvahiServer *s = userdata;

598

assert(b); /* Spurious warning */

599

600

/* Called whenever a new services becomes available on the LAN or

601

is removed from the LAN */

602

603

switch (event) {

604

default:

605

case AVAHI_BROWSER_FAILURE:

606

607

fprintf(stderr, "(Browser) %s\n",

608

avahi_strerror(avahi_server_errno(server)));

609

avahi_simple_poll_quit(simple_poll);

610

return;

611

612

case AVAHI_BROWSER_NEW:

613

/* We ignore the returned resolver object. In the callback

614

function we free it. If the server is terminated before

615

the callback function is called the server will free

616

the resolver for us. */

617

618

if (!(avahi_s_service_resolver_new(s, interface, protocol, name,

619

type, domain,

620

AVAHI_PROTO_INET6, 0,

621

resolve_callback, s)))

622

fprintf(stderr, "Failed to resolve service '%s': %s\n", name,

623

avahi_strerror(avahi_server_errno(s)));

624

break;

625

626

case AVAHI_BROWSER_REMOVE:

627

break;

628

629

case AVAHI_BROWSER_ALL_FOR_NOW:

630

case AVAHI_BROWSER_CACHE_EXHAUSTED:

631

break;

664

static void browse_callback( AvahiSServiceBrowser *b,

665

AvahiIfIndex interface,

666

AvahiProtocol protocol,

667

AvahiBrowserEvent event,

668

const char *name,

669

const char *type,

670

const char *domain,

671

AVAHI_GCC_UNUSED AvahiLookupResultFlags

672

flags,

673

void* userdata) {

674

mandos_context *mc = userdata;

675

assert(b); /* Spurious warning */

676

677

/* Called whenever a new services becomes available on the LAN or

678

is removed from the LAN */

679

680

switch (event) {

681

default:

682

case AVAHI_BROWSER_FAILURE:

683

684

fprintf(stderr, "(Avahi browser) %s\n",

685

avahi_strerror(avahi_server_errno(mc->server)));

686

avahi_simple_poll_quit(mc->simple_poll);

687

return;

688

689

case AVAHI_BROWSER_NEW:

690

/* We ignore the returned Avahi resolver object. In the callback

691

function we free it. If the Avahi server is terminated before

692

the callback function is called the Avahi server will free the

693

resolver for us. */

694

695

if (!(avahi_s_service_resolver_new(mc->server, interface,

696

protocol, name, type, domain,

697

AVAHI_PROTO_INET6, 0,

698

resolve_callback, mc)))

699

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

700

name, avahi_strerror(avahi_server_errno(mc->server)));

701

break;

702

703

case AVAHI_BROWSER_REMOVE:

704

break;

705

706

case AVAHI_BROWSER_ALL_FOR_NOW:

707

case AVAHI_BROWSER_CACHE_EXHAUSTED:

708

if(debug){

709

fprintf(stderr, "No Mandos server found, still searching...\n");

632

710

}

711

break;

712

}

633

713

}

634

714

635

715

/* Combines file name and path and returns the malloced new

642

722

return NULL;

643

723

}

644

724

if(f_len > 0){

645

memcpy(tmp, first, f_len);

725

memcpy(tmp, first, f_len); /* Spurious warning */

646

726

}

647

727

tmp[f_len] = '/';

648

728

if(s_len > 0){

649

memcpy(tmp + f_len + 1, second, s_len);

729

memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */

650

730

}

651

731

tmp[f_len + 1 + s_len] = '\0';

652

732

return tmp;

653

733

}

654

734

655

735

656

int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {

657

AvahiServerConfig config;

736

int main(int argc, char *argv[]){

658

737

AvahiSServiceBrowser *sb = NULL;

659

738

int error;

660

739

int ret;

661

int debug_int = 0;

662

int returncode = EXIT_SUCCESS;

663

const char *interface = NULL;

740

int exitcode = EXIT_SUCCESS;

741

const char *interface = "eth0";

742

struct ifreq network;

743

int sd;

744

uid_t uid;

745

gid_t gid;

746

char *connect_to = NULL;

664

747

AvahiIfIndex if_index = AVAHI_IF_UNSPEC;

665

char *connect_to = NULL;

748

const char *pubkeyfile = "pubkey.txt";

749

const char *seckeyfile = "seckey.txt";

750

mandos_context mc = { .simple_poll = NULL, .server = NULL,

751

.dh_bits = 1024, .priority = "SECURE256"};

752

bool gnutls_initalized = false;

666

753

667

debug_int = debug ? 1 : 0;

668

while (true){

669

static struct option long_options[] = {

670

{"debug", no_argument, &debug_int, 1},

671

{"connect", required_argument, NULL, 'C'},

672

{"interface", required_argument, NULL, 'i'},

673

{"keydir", required_argument, NULL, 'd'},

674

{"seckey", required_argument, NULL, 'c'},

675

{"pubkey", required_argument, NULL, 'k'},

676

{"dh-bits", required_argument, NULL, 'D'},

677

{0, 0, 0, 0} };

678

679

int option_index = 0;

680

ret = getopt_long (argc, argv, "i:", long_options,

681

&option_index);

682

683

if (ret == -1){

684

break;

685

}

686

687

switch(ret){

688

case 0:

689

break;

690

case 'i':

691

interface = optarg;

692

break;

693

case 'C':

694

connect_to = optarg;

695

break;

696

case 'd':

697

keydir = optarg;

698

break;

699

case 'c':

700

pubkeyfile = optarg;

701

break;

702

case 'k':

703

seckeyfile = optarg;

704

break;

705

case 'D':

706

dh_bits = atoi(optarg);

707

break;

708

case '?':

709

break

710

default:

711

exit(EXIT_FAILURE);

712

}

754

{

755

struct argp_option options[] = {

756

{ .name = "debug", .key = 128,

757

.doc = "Debug mode", .group = 3 },

758

{ .name = "connect", .key = 'c',

759

.arg = "IP",

760

.doc = "Connect directly to a sepcified mandos server",

761

.group = 1 },

762

{ .name = "interface", .key = 'i',

763

.arg = "INTERFACE",

764

.doc = "Interface that Avahi will conntect through",

765

.group = 1 },

766

{ .name = "keydir", .key = 'd',

767

.arg = "KEYDIR",

768

.doc = "Directory where the openpgp keyring is",

769

.group = 1 },

770

{ .name = "seckey", .key = 's',

771

.arg = "SECKEY",

772

.doc = "Secret openpgp key for gnutls authentication",

773

.group = 1 },

774

{ .name = "pubkey", .key = 'p',

775

.arg = "PUBKEY",

776

.doc = "Public openpgp key for gnutls authentication",

777

.group = 2 },

778

{ .name = "dh-bits", .key = 129,

779

.arg = "BITS",

780

.doc = "dh-bits to use in gnutls communication",

781

.group = 2 },

782

{ .name = "priority", .key = 130,

783

.arg = "PRIORITY",

784

.doc = "GNUTLS priority", .group = 1 },

785

{ .name = NULL }

786

};

787

788

789

error_t parse_opt (int key, char *arg,

790

struct argp_state *state) {

791

/* Get the INPUT argument from `argp_parse', which we know is

792

a pointer to our plugin list pointer. */

793

switch (key) {

794

case 128:

795

debug = true;

796

break;

797

case 'c':

798

connect_to = arg;

799

break;

800

case 'i':

801

interface = arg;

802

break;

803

case 'd':

804

keydir = arg;

805

break;

806

case 's':

807

seckeyfile = arg;

808

break;

809

case 'p':

810

pubkeyfile = arg;

811

break;

812

case 129:

813

errno = 0;

814

mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);

815

if (errno){

816

perror("strtol");

817

exit(EXIT_FAILURE);

818

}

819

break;

820

case 130:

821

mc.priority = arg;

822

break;

823

case ARGP_KEY_ARG:

824

argp_usage (state);

825

break;

826

case ARGP_KEY_END:

827

break;

828

default:

829

return ARGP_ERR_UNKNOWN;

830

}

831

return 0;

832

}

833

834

struct argp argp = { .options = options, .parser = parse_opt,

835

.args_doc = "",

836

.doc = "Mandos client -- Get and decrypt"

837

" passwords from mandos server" };

838

argp_parse (&argp, argc, argv, 0, 0, NULL);

713

839

}

714

debug = debug_int ? true : false;

715

840

716

841

pubkeyfile = combinepath(keydir, pubkeyfile);

717

842

if (pubkeyfile == NULL){

718

843

perror("combinepath");

719

goto exit;

720

}

721

722

if(interface != NULL){

723

if_index = (AvahiIfIndex) if_nametoindex(interface);

724

if(if_index == 0){

725

fprintf(stderr, "No such interface: \"%s\"\n", interface);

726

exit(EXIT_FAILURE);

727

}

844

exitcode = EXIT_FAILURE;

845

goto end;

846

}

847

848

seckeyfile = combinepath(keydir, seckeyfile);

849

if (seckeyfile == NULL){

850

perror("combinepath");

851

goto end;

852

}

853

854

ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);

855

if (ret == -1){

856

fprintf(stderr, "init_gnutls_global\n");

857

goto end;

858

} else {

859

gnutls_initalized = true;

860

}

861

862

uid = getuid();

863

gid = getgid();

864

865

ret = setuid(uid);

866

if (ret == -1){

867

perror("setuid");

868

}

869

870

setgid(gid);

871

if (ret == -1){

872

perror("setgid");

873

}

874

875

if_index = (AvahiIfIndex) if_nametoindex(interface);

876

if(if_index == 0){

877

fprintf(stderr, "No such interface: \"%s\"\n", interface);

878

exit(EXIT_FAILURE);

728

879

}

729

880

730

881

if(connect_to != NULL){

733

884

char *address = strrchr(connect_to, ':');

734

885

if(address == NULL){

735

886

fprintf(stderr, "No colon in address\n");

736

exit(EXIT_FAILURE);

887

exitcode = EXIT_FAILURE;

888

goto end;

737

889

}

738

890

errno = 0;

739

891

uint16_t port = (uint16_t) strtol(address+1, NULL, 10);

740

892

if(errno){

741

893

perror("Bad port number");

742

exit(EXIT_FAILURE);

894

exitcode = EXIT_FAILURE;

895

goto end;

743

896

}

744

897

*address = '\0';

745

898

address = connect_to;

746

ret = start_mandos_communication(address, port, if_index);

899

ret = start_mandos_communication(address, port, if_index, &mc);

747

900

if(ret < 0){

748

exit(EXIT_FAILURE);

901

exitcode = EXIT_FAILURE;

749

902

} else {

750

exit(EXIT_SUCCESS);

903

exitcode = EXIT_SUCCESS;

751

904

}

905

goto end;

752

906

}

753

907

754

seckeyfile = combinepath(keydir, seckeyfile);

755

if (seckeyfile == NULL){

756

perror("combinepath");

757

goto exit;

908

/* If the interface is down, bring it up */

909

{

910

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

911

if(sd < 0) {

912

perror("socket");

913

exitcode = EXIT_FAILURE;

914

goto end;

915

}

916

strcpy(network.ifr_name, interface); /* Spurious warning */

917

ret = ioctl(sd, SIOCGIFFLAGS, &network);

918

if(ret == -1){

919

perror("ioctl SIOCGIFFLAGS");

920

exitcode = EXIT_FAILURE;

921

goto end;

922

}

923

if((network.ifr_flags & IFF_UP) == 0){

924

network.ifr_flags |= IFF_UP;

925

ret = ioctl(sd, SIOCSIFFLAGS, &network);

926

if(ret == -1){

927

perror("ioctl SIOCSIFFLAGS");

928

exitcode = EXIT_FAILURE;

929

goto end;

930

}

931

}

932

close(sd);

758

933

}

759

934

760

935

if (not debug){

761

936

avahi_set_log_function(empty_log);

762

937

}

763

938

764

/* Initialize the psuedo-RNG */

939

/* Initialize the pseudo-RNG for Avahi */

765

940

srand((unsigned int) time(NULL));

766

767

/* Allocate main loop object */

768

if (!(simple_poll = avahi_simple_poll_new())) {

769

fprintf(stderr, "Failed to create simple poll object.\n");

770

771

goto exit;

772

}

773

774

/* Do not publish any local records */

775

avahi_server_config_init(&config);

776

config.publish_hinfo = 0;

777

config.publish_addresses = 0;

778

config.publish_workstation = 0;

779

config.publish_domain = 0;

780

781

/* Allocate a new server */

782

server = avahi_server_new(avahi_simple_poll_get(simple_poll),

783

&config, NULL, NULL, &error);

784

785

/* Free the configuration data */

786

avahi_server_config_free(&config);

787

788

/* Check if creating the server object succeeded */

789

if (!server) {

790

fprintf(stderr, "Failed to create server: %s\n",

941

942

/* Allocate main Avahi loop object */

943

mc.simple_poll = avahi_simple_poll_new();

944

if (mc.simple_poll == NULL) {

945

fprintf(stderr, "Avahi: Failed to create simple poll"

946

" object.\n");

947

exitcode = EXIT_FAILURE;

948

goto end;

949

}

950

951

{

952

AvahiServerConfig config;

953

/* Do not publish any local Zeroconf records */

954

avahi_server_config_init(&config);

955

config.publish_hinfo = 0;

956

config.publish_addresses = 0;

957

config.publish_workstation = 0;

958

config.publish_domain = 0;

959

960

/* Allocate a new server */

961

mc.server = avahi_server_new(avahi_simple_poll_get

962

(mc.simple_poll), &config, NULL,

963

NULL, &error);

964

965

/* Free the Avahi configuration data */

966

avahi_server_config_free(&config);

967

}

968

969

/* Check if creating the Avahi server object succeeded */

970

if (mc.server == NULL) {

971

fprintf(stderr, "Failed to create Avahi server: %s\n",

791

972

avahi_strerror(error));

792

returncode = EXIT_FAILURE;

793

goto exit;

973

exitcode = EXIT_FAILURE;

974

goto end;

794

975

}

795

976

796

/* Create the service browser */

797

sb = avahi_s_service_browser_new(server, if_index,

977

/* Create the Avahi service browser */

978

sb = avahi_s_service_browser_new(mc.server, if_index,

798

979

AVAHI_PROTO_INET6,

799

980

"_mandos._tcp", NULL, 0,

800

browse_callback, server);

801

if (!sb) {

981

browse_callback, &mc);

982

if (sb == NULL) {

802

983

fprintf(stderr, "Failed to create service browser: %s\n",

803

avahi_strerror(avahi_server_errno(server)));

804

returncode = EXIT_FAILURE;

805

goto exit;

984

avahi_strerror(avahi_server_errno(mc.server)));

985

exitcode = EXIT_FAILURE;

986

goto end;

806

987

}

807

988

808

989

/* Run the main loop */

809

990

810

991

if (debug){

811

fprintf(stderr, "Starting avahi loop search\n");

992

fprintf(stderr, "Starting Avahi loop search\n");

812

993

}

813

994

814

avahi_simple_poll_loop(simple_poll);

995

avahi_simple_poll_loop(mc.simple_poll);

815

996

816

exit:

997

end:

817

998

818

999

if (debug){

819

1000

fprintf(stderr, "%s exiting\n", argv[0]);

820

1001

}

821

1002

822

1003

/* Cleanup things */

823

if (sb)

1004

if (sb != NULL)

824

1005

avahi_s_service_browser_free(sb);

825

1006

826

if (server)

827

avahi_server_free(server);

1007

if (mc.server != NULL)

1008

avahi_server_free(mc.server);

828

1009

829

if (simple_poll)

830

avahi_simple_poll_free(simple_poll);

1010

if (mc.simple_poll != NULL)

1011

avahi_simple_poll_free(mc.simple_poll);

831

1012

free(pubkeyfile);

832

1013

free(seckeyfile);

1014

1015

if (gnutls_initalized){

1016

gnutls_certificate_free_credentials (mc.cred);

1017

gnutls_global_deinit ();

1018

}

833

1019

834

return returncode;

1020

return exitcode;

835

1021

}