25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
31
/* Needed by GPGME, specifically gpgme_data_seek() */
32
#define _FORTIFY_SOURCE 2
32
34
#define _LARGEFILE_SOURCE
33
35
#define _FILE_OFFSET_BITS 64
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), asprintf(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
sockaddr_in6, PF_INET6,
49
SOCK_STREAM, INET6_ADDRSTRLEN,
51
#include <inttypes.h> /* PRIu16 */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton(),
55
#include <assert.h> /* assert() */
56
#include <errno.h> /* perror(), errno */
57
#include <time.h> /* time() */
58
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
59
SIOCSIFFLAGS, if_indextoname(),
60
if_nametoindex(), IF_NAMESIZE */
61
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
62
getuid(), getgid(), setuid(),
64
#include <netinet/in.h>
65
#include <arpa/inet.h> /* inet_pton(), htons */
66
#include <iso646.h> /* not, and */
67
#include <argp.h> /* struct argp_option, error_t, struct
68
argp_state, struct argp,
69
argp_parse(), ARGP_KEY_ARG,
70
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
73
/* All Avahi types, constants and functions
41
#include <net/if.h> /* if_nametoindex */
76
43
#include <avahi-core/core.h>
77
44
#include <avahi-core/lookup.h>
78
45
#include <avahi-core/log.h>
80
47
#include <avahi-common/malloc.h>
81
48
#include <avahi-common/error.h>
84
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
87
init_gnutls_session(),
89
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
90
GNUTLS_OPENPGP_FMT_BASE64 */
93
#include <gpgme.h> /* All GPGME types, constants and
96
GPGME_PROTOCOL_OpenPGP,
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
65
#include <errno.h> /* perror() */
99
71
#define BUFFER_SIZE 256
74
const char *certdir = "/conf/conf.d/cryptkeyreq/";
75
const char *certfile = "openpgp-client.txt";
76
const char *certkey = "openpgp-client-key.txt";
101
78
bool debug = false;
102
static const char *keydir = "/conf/conf.d/mandos";
103
static const char mandos_protocol_version[] = "1";
104
const char *argp_program_version = "password-request 1.0";
105
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
107
/* Used for passing in values through the Avahi callback functions */
109
AvahiSimplePoll *simple_poll;
81
gnutls_session_t session;
111
82
gnutls_certificate_credentials_t cred;
112
unsigned int dh_bits;
113
83
gnutls_dh_params_t dh_params;
114
const char *priority;
118
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
119
* "buffer_capacity" is how much is currently allocated,
120
* "buffer_length" is how much is already used.
122
size_t adjustbuffer(char **buffer, size_t buffer_length,
123
size_t buffer_capacity){
124
if (buffer_length + BUFFER_SIZE > buffer_capacity){
125
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
129
buffer_capacity += BUFFER_SIZE;
131
return buffer_capacity;
135
* Decrypt OpenPGP data using keyrings in HOMEDIR.
136
* Returns -1 on error
138
static ssize_t pgp_packet_decrypt (const char *cryptotext,
141
const char *homedir){
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
142
89
gpgme_data_t dh_crypto, dh_plain;
146
size_t plaintext_capacity = 0;
147
ssize_t plaintext_length = 0;
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
148
95
gpgme_engine_info_t engine_info;
151
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
203
148
if (rc != GPG_ERR_NO_ERROR){
204
149
fprintf(stderr, "bad gpgme_new: %s: %s\n",
205
150
gpgme_strsource(rc), gpgme_strerror(rc));
206
plaintext_length = -1;
210
/* Decrypt data from the cryptotext data buffer to the plaintext
154
/* Decrypt data from the FILE pointer to the plaintext data
212
156
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
213
157
if (rc != GPG_ERR_NO_ERROR){
214
158
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
215
159
gpgme_strsource(rc), gpgme_strerror(rc));
216
plaintext_length = -1;
218
gpgme_decrypt_result_t result;
219
result = gpgme_op_decrypt_result(ctx);
221
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
223
fprintf(stderr, "Unsupported algorithm: %s\n",
224
result->unsupported_algorithm);
225
fprintf(stderr, "Wrong key usage: %u\n",
226
result->wrong_key_usage);
227
if(result->file_name != NULL){
228
fprintf(stderr, "File name: %s\n", result->file_name);
230
gpgme_recipient_t recipient;
231
recipient = result->recipients;
233
while(recipient != NULL){
234
fprintf(stderr, "Public key algorithm: %s\n",
235
gpgme_pubkey_algo_name(recipient->pubkey_algo));
236
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
237
fprintf(stderr, "Secret key available: %s\n",
238
recipient->status == GPG_ERR_NO_SECKEY
240
recipient = recipient->next;
164
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
168
gpgme_decrypt_result_t result;
169
result = gpgme_op_decrypt_result(ctx);
171
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
173
fprintf(stderr, "Unsupported algorithm: %s\n",
174
result->unsupported_algorithm);
175
fprintf(stderr, "Wrong key usage: %d\n",
176
result->wrong_key_usage);
177
if(result->file_name != NULL){
178
fprintf(stderr, "File name: %s\n", result->file_name);
180
gpgme_recipient_t recipient;
181
recipient = result->recipients;
183
while(recipient != NULL){
184
fprintf(stderr, "Public key algorithm: %s\n",
185
gpgme_pubkey_algo_name(recipient->pubkey_algo));
186
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
187
fprintf(stderr, "Secret key available: %s\n",
188
recipient->status == GPG_ERR_NO_SECKEY
190
recipient = recipient->next;
249
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
196
/* Delete the GPGME FILE pointer cryptotext data buffer */
197
gpgme_data_release(dh_crypto);
252
199
/* Seek back to the beginning of the GPGME plaintext data buffer */
253
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
254
perror("pgpme_data_seek");
255
plaintext_length = -1;
200
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
261
plaintext_capacity = adjustbuffer(plaintext,
262
(size_t)plaintext_length,
264
if (plaintext_capacity == 0){
265
perror("adjustbuffer");
266
plaintext_length = -1;
204
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
205
*new_packet = realloc(*new_packet,
206
(unsigned int)new_packet_capacity
208
if (*new_packet == NULL){
212
new_packet_capacity += BUFFER_SIZE;
270
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
215
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
272
217
/* Print the data, if any */
278
222
perror("gpgme_data_read");
279
plaintext_length = -1;
282
plaintext_length += ret;
225
new_packet_length += ret;
286
fprintf(stderr, "Decrypted password is: ");
287
for(ssize_t i = 0; i < plaintext_length; i++){
288
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
290
fprintf(stderr, "\n");
295
/* Delete the GPGME cryptotext data buffer */
296
gpgme_data_release(dh_crypto);
228
/* FIXME: check characters before printing to screen so to not print
229
terminal control characters */
231
/* fprintf(stderr, "decrypted password is: "); */
232
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
233
/* fprintf(stderr, "\n"); */
298
236
/* Delete the GPGME plaintext data buffer */
299
237
gpgme_data_release(dh_plain);
300
return plaintext_length;
238
return new_packet_length;
303
241
static const char * safer_gnutls_strerror (int value) {
304
const char *ret = gnutls_strerror (value); /* Spurious warning */
242
const char *ret = gnutls_strerror (value);
306
244
ret = "(unknown)";
310
/* GnuTLS log function callback */
311
static void debuggnutls(__attribute__((unused)) int level,
313
fprintf(stderr, "GnuTLS: %s", string);
248
void debuggnutls(__attribute__((unused)) int level,
250
fprintf(stderr, "%s", string);
316
static int init_gnutls_global(mandos_context *mc,
317
const char *pubkeyfilename,
318
const char *seckeyfilename){
253
int initgnutls(encrypted_session *es){
322
258
fprintf(stderr, "Initializing GnuTLS\n");
325
ret = gnutls_global_init();
326
if (ret != GNUTLS_E_SUCCESS) {
327
fprintf (stderr, "GnuTLS global_init: %s\n",
328
safer_gnutls_strerror(ret));
261
if ((ret = gnutls_global_init ())
262
!= GNUTLS_E_SUCCESS) {
263
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
333
/* "Use a log level over 10 to enable all debugging options."
336
268
gnutls_global_set_log_level(11);
337
269
gnutls_global_set_log_function(debuggnutls);
340
/* OpenPGP credentials */
341
gnutls_certificate_allocate_credentials(&mc->cred);
342
if (ret != GNUTLS_E_SUCCESS){
343
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
272
/* openpgp credentials */
273
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
274
!= GNUTLS_E_SUCCESS) {
275
fprintf (stderr, "memory error: %s\n",
345
276
safer_gnutls_strerror(ret));
346
gnutls_global_deinit ();
351
281
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
352
" and keyfile %s as GnuTLS credentials\n", pubkeyfilename,
282
" and keyfile %s as GnuTLS credentials\n", certfile,
356
286
ret = gnutls_certificate_set_openpgp_key_file
357
(mc->cred, pubkeyfilename, seckeyfilename,
358
GNUTLS_OPENPGP_FMT_BASE64);
287
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
359
288
if (ret != GNUTLS_E_SUCCESS) {
361
"Error[%d] while reading the OpenPGP key pair ('%s',"
362
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
363
fprintf(stdout, "The GnuTLS error is: %s\n",
290
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
292
ret, certfile, certkey);
293
fprintf(stdout, "The Error is: %s\n",
364
294
safer_gnutls_strerror(ret));
368
/* GnuTLS server initialization */
369
ret = gnutls_dh_params_init(&mc->dh_params);
370
if (ret != GNUTLS_E_SUCCESS) {
371
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
372
" %s\n", safer_gnutls_strerror(ret));
375
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
376
if (ret != GNUTLS_E_SUCCESS) {
377
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
378
safer_gnutls_strerror(ret));
382
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
388
gnutls_certificate_free_credentials(mc->cred);
389
gnutls_global_deinit();
394
static int init_gnutls_session(mandos_context *mc,
395
gnutls_session_t *session){
397
/* GnuTLS session creation */
398
ret = gnutls_init(session, GNUTLS_SERVER);
399
if (ret != GNUTLS_E_SUCCESS){
298
//GnuTLS server initialization
299
if ((ret = gnutls_dh_params_init (&es->dh_params))
300
!= GNUTLS_E_SUCCESS) {
301
fprintf (stderr, "Error in dh parameter initialization: %s\n",
302
safer_gnutls_strerror(ret));
306
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
307
!= GNUTLS_E_SUCCESS) {
308
fprintf (stderr, "Error in prime generation: %s\n",
309
safer_gnutls_strerror(ret));
313
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
315
// GnuTLS session creation
316
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
317
!= GNUTLS_E_SUCCESS){
400
318
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
401
319
safer_gnutls_strerror(ret));
406
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
407
if (ret != GNUTLS_E_SUCCESS) {
408
fprintf(stderr, "Syntax error at: %s\n", err);
409
fprintf(stderr, "GnuTLS error: %s\n",
410
safer_gnutls_strerror(ret));
411
gnutls_deinit (*session);
322
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf(stderr, "Syntax error at: %s\n", err);
325
fprintf(stderr, "GnuTLS error: %s\n",
326
safer_gnutls_strerror(ret));
416
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
418
if (ret != GNUTLS_E_SUCCESS) {
419
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
330
if ((ret = gnutls_credentials_set
331
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
332
!= GNUTLS_E_SUCCESS) {
333
fprintf(stderr, "Error setting a credentials set: %s\n",
420
334
safer_gnutls_strerror(ret));
421
gnutls_deinit (*session);
425
338
/* ignore client certificate if any. */
426
gnutls_certificate_server_set_request (*session,
339
gnutls_certificate_server_set_request (es->session,
427
340
GNUTLS_CERT_IGNORE);
429
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
342
gnutls_dh_set_prime_bits (es->session, DH_BITS);
434
/* Avahi log function callback */
435
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
436
__attribute__((unused)) const char *txt){}
347
void empty_log(__attribute__((unused)) AvahiLogLevel level,
348
__attribute__((unused)) const char *txt){}
438
/* Called when a Mandos server is found */
439
static int start_mandos_communication(const char *ip, uint16_t port,
440
AvahiIfIndex if_index,
350
int start_mandos_communication(const char *ip, uint16_t port,
351
unsigned int if_index){
443
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
353
struct sockaddr_in6 to;
354
encrypted_session es;
444
355
char *buffer = NULL;
445
356
char *decrypted_buffer;
446
357
size_t buffer_length = 0;
447
358
size_t buffer_capacity = 0;
448
359
ssize_t decrypted_buffer_size;
451
362
char interface[IF_NAMESIZE];
452
gnutls_session_t session;
454
ret = init_gnutls_session (mc, &session);
460
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
365
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
464
368
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
466
370
perror("socket");
471
if(if_indextoname((unsigned int)if_index, interface) == NULL){
374
if(if_indextoname(if_index, interface) == NULL){
472
376
perror("if_indextoname");
475
382
fprintf(stderr, "Binding to interface %s\n", interface);
478
memset(&to, 0, sizeof(to));
479
to.in6.sin6_family = AF_INET6;
480
/* It would be nice to have a way to detect if we were passed an
481
IPv4 address here. Now we assume an IPv6 address. */
482
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
385
memset(&to,0,sizeof(to)); /* Spurious warning */
386
to.sin6_family = AF_INET6;
387
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
484
389
perror("inet_pton");
488
393
fprintf(stderr, "Bad address: %s\n", ip);
491
to.in6.sin6_port = htons(port); /* Spurious warning */
396
to.sin6_port = htons(port); /* Spurious warning */
493
to.in6.sin6_scope_id = (uint32_t)if_index;
398
to.sin6_scope_id = (uint32_t)if_index;
496
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
498
char addrstr[INET6_ADDRSTRLEN] = "";
499
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
500
sizeof(addrstr)) == NULL){
503
if(strcmp(addrstr, ip) != 0){
504
fprintf(stderr, "Canonical address form: %s\n", addrstr);
401
fprintf(stderr, "Connection to: %s\n", ip);
509
ret = connect(tcp_sd, &to.in, sizeof(to));
404
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
511
406
perror("connect");
515
const char *out = mandos_protocol_version;
518
size_t out_size = strlen(out);
519
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
520
out_size - written));
526
written += (size_t)ret;
527
if(written < out_size){
530
if (out == mandos_protocol_version){
410
ret = initgnutls (&es);
416
gnutls_transport_set_ptr (es.session,
417
(gnutls_transport_ptr_t) tcp_sd);
540
420
fprintf(stderr, "Establishing TLS session with %s\n", ip);
543
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
546
ret = gnutls_handshake (session);
547
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
423
ret = gnutls_handshake (es.session);
549
425
if (ret != GNUTLS_E_SUCCESS){
551
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
427
fprintf(stderr, "\n*** Handshake failed ***\n");
552
428
gnutls_perror (ret);
558
/* Read OpenPGP packet that contains the wanted password */
434
//Retrieve OpenPGP packet that contains the wanted password
561
437
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
681
557
char ip[AVAHI_ADDRESS_STR_MAX];
682
558
avahi_address_snprint(ip, sizeof(ip), address);
684
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
685
PRIu16 ") on port %d\n", name, host_name, ip,
560
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
561
" port %d\n", name, host_name, ip, port);
688
int ret = start_mandos_communication(ip, port, interface, mc);
563
int ret = start_mandos_communication(ip, port,
564
(unsigned int) interface);
690
avahi_simple_poll_quit(mc->simple_poll);
694
570
avahi_s_service_resolver_free(r);
697
static void browse_callback( AvahiSServiceBrowser *b,
698
AvahiIfIndex interface,
699
AvahiProtocol protocol,
700
AvahiBrowserEvent event,
704
AVAHI_GCC_UNUSED AvahiLookupResultFlags
707
mandos_context *mc = userdata;
710
/* Called whenever a new services becomes available on the LAN or
711
is removed from the LAN */
715
case AVAHI_BROWSER_FAILURE:
717
fprintf(stderr, "(Avahi browser) %s\n",
718
avahi_strerror(avahi_server_errno(mc->server)));
719
avahi_simple_poll_quit(mc->simple_poll);
722
case AVAHI_BROWSER_NEW:
723
/* We ignore the returned Avahi resolver object. In the callback
724
function we free it. If the Avahi server is terminated before
725
the callback function is called the Avahi server will free the
728
if (!(avahi_s_service_resolver_new(mc->server, interface,
729
protocol, name, type, domain,
730
AVAHI_PROTO_INET6, 0,
731
resolve_callback, mc)))
732
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
733
name, avahi_strerror(avahi_server_errno(mc->server)));
736
case AVAHI_BROWSER_REMOVE:
739
case AVAHI_BROWSER_ALL_FOR_NOW:
740
case AVAHI_BROWSER_CACHE_EXHAUSTED:
742
fprintf(stderr, "No Mandos server found, still searching...\n");
573
static void browse_callback(
574
AvahiSServiceBrowser *b,
575
AvahiIfIndex interface,
576
AvahiProtocol protocol,
577
AvahiBrowserEvent event,
581
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
584
AvahiServer *s = userdata;
585
assert(b); /* Spurious warning */
587
/* Called whenever a new services becomes available on the LAN or
588
is removed from the LAN */
592
case AVAHI_BROWSER_FAILURE:
594
fprintf(stderr, "(Browser) %s\n",
595
avahi_strerror(avahi_server_errno(server)));
596
avahi_simple_poll_quit(simple_poll);
599
case AVAHI_BROWSER_NEW:
600
/* We ignore the returned resolver object. In the callback
601
function we free it. If the server is terminated before
602
the callback function is called the server will free
603
the resolver for us. */
605
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
607
AVAHI_PROTO_INET6, 0,
608
resolve_callback, s)))
609
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
610
avahi_strerror(avahi_server_errno(s)));
613
case AVAHI_BROWSER_REMOVE:
616
case AVAHI_BROWSER_ALL_FOR_NOW:
617
case AVAHI_BROWSER_CACHE_EXHAUSTED:
748
/* Combines file name and path and returns the malloced new
749
string. some sane checks could/should be added */
750
static char *combinepath(const char *first, const char *second){
622
/* combinds two strings and returns the malloced new string. som sane checks could/should be added */
623
const char *combinestrings(const char *first, const char *second){
752
int ret = asprintf(&tmp, "%s/%s", first, second);
625
tmp = malloc(strlen(first) + strlen(second));
760
int main(int argc, char *argv[]){
636
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
637
AvahiServerConfig config;
761
638
AvahiSServiceBrowser *sb = NULL;
764
int exitcode = EXIT_SUCCESS;
641
int returncode = EXIT_SUCCESS;
765
642
const char *interface = "eth0";
766
struct ifreq network;
770
char *connect_to = NULL;
771
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
772
char *pubkeyfilename = NULL;
773
char *seckeyfilename = NULL;
774
const char *pubkeyname = "pubkey.txt";
775
const char *seckeyname = "seckey.txt";
776
mandos_context mc = { .simple_poll = NULL, .server = NULL,
777
.dh_bits = 1024, .priority = "SECURE256"};
778
bool gnutls_initalized = false;
781
struct argp_option options[] = {
782
{ .name = "debug", .key = 128,
783
.doc = "Debug mode", .group = 3 },
784
{ .name = "connect", .key = 'c',
786
.doc = "Connect directly to a sepcified mandos server",
788
{ .name = "interface", .key = 'i',
790
.doc = "Interface that Avahi will conntect through",
792
{ .name = "keydir", .key = 'd',
794
.doc = "Directory where the openpgp keyring is",
796
{ .name = "seckey", .key = 's',
798
.doc = "Secret openpgp key for gnutls authentication",
800
{ .name = "pubkey", .key = 'p',
802
.doc = "Public openpgp key for gnutls authentication",
804
{ .name = "dh-bits", .key = 129,
806
.doc = "dh-bits to use in gnutls communication",
808
{ .name = "priority", .key = 130,
810
.doc = "GNUTLS priority", .group = 1 },
815
error_t parse_opt (int key, char *arg,
816
struct argp_state *state) {
817
/* Get the INPUT argument from `argp_parse', which we know is
818
a pointer to our plugin list pointer. */
840
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
854
return ARGP_ERR_UNKNOWN;
859
struct argp argp = { .options = options, .parser = parse_opt,
861
.doc = "Mandos client -- Get and decrypt"
862
" passwords from mandos server" };
863
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
864
if (ret == ARGP_ERR_UNKNOWN){
865
fprintf(stderr, "Unknown error while parsing arguments\n");
866
exitcode = EXIT_FAILURE;
871
pubkeyfilename = combinepath(keydir, pubkeyname);
872
if (pubkeyfilename == NULL){
873
perror("combinepath");
874
exitcode = EXIT_FAILURE;
878
seckeyfilename = combinepath(keydir, seckeyname);
879
if (seckeyfilename == NULL){
880
perror("combinepath");
881
exitcode = EXIT_FAILURE;
885
ret = init_gnutls_global(&mc, pubkeyfilename, seckeyfilename);
887
fprintf(stderr, "init_gnutls_global failed\n");
888
exitcode = EXIT_FAILURE;
891
gnutls_initalized = true;
894
/* If the interface is down, bring it up */
896
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
899
exitcode = EXIT_FAILURE;
902
strcpy(network.ifr_name, interface);
903
ret = ioctl(sd, SIOCGIFFLAGS, &network);
905
perror("ioctl SIOCGIFFLAGS");
906
exitcode = EXIT_FAILURE;
909
if((network.ifr_flags & IFF_UP) == 0){
910
network.ifr_flags |= IFF_UP;
911
ret = ioctl(sd, SIOCSIFFLAGS, &network);
913
perror("ioctl SIOCSIFFLAGS");
914
exitcode = EXIT_FAILURE;
934
if_index = (AvahiIfIndex) if_nametoindex(interface);
936
fprintf(stderr, "No such interface: \"%s\"\n", interface);
940
if(connect_to != NULL){
941
/* Connect directly, do not use Zeroconf */
942
/* (Mainly meant for debugging) */
943
char *address = strrchr(connect_to, ':');
945
fprintf(stderr, "No colon in address\n");
946
exitcode = EXIT_FAILURE;
950
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
952
perror("Bad port number");
953
exitcode = EXIT_FAILURE;
957
address = connect_to;
958
ret = start_mandos_communication(address, port, if_index, &mc);
960
exitcode = EXIT_FAILURE;
962
exitcode = EXIT_SUCCESS;
645
static struct option long_options[] = {
646
{"debug", no_argument, (int *)&debug, 1},
647
{"interface", required_argument, 0, 'i'},
648
{"certdir", required_argument, 0, 'd'},
649
{"certkey", required_argument, 0, 'c'},
650
{"certfile", required_argument, 0, 'k'},
653
int option_index = 0;
654
ret = getopt_long (argc, argv, "i:", long_options,
681
certfile = combinestrings(certdir, certfile);
682
if (certfile == NULL){
686
certkey = combinestrings(certdir, certkey);
687
if (certkey == NULL){
968
692
avahi_set_log_function(empty_log);
971
/* Initialize the pseudo-RNG for Avahi */
695
/* Initialize the psuedo-RNG */
972
696
srand((unsigned int) time(NULL));
974
/* Allocate main Avahi loop object */
975
mc.simple_poll = avahi_simple_poll_new();
976
if (mc.simple_poll == NULL) {
977
fprintf(stderr, "Avahi: Failed to create simple poll"
979
exitcode = EXIT_FAILURE;
984
AvahiServerConfig config;
985
/* Do not publish any local Zeroconf records */
986
avahi_server_config_init(&config);
987
config.publish_hinfo = 0;
988
config.publish_addresses = 0;
989
config.publish_workstation = 0;
990
config.publish_domain = 0;
992
/* Allocate a new server */
993
mc.server = avahi_server_new(avahi_simple_poll_get
994
(mc.simple_poll), &config, NULL,
997
/* Free the Avahi configuration data */
998
avahi_server_config_free(&config);
1001
/* Check if creating the Avahi server object succeeded */
1002
if (mc.server == NULL) {
1003
fprintf(stderr, "Failed to create Avahi server: %s\n",
698
/* Allocate main loop object */
699
if (!(simple_poll = avahi_simple_poll_new())) {
700
fprintf(stderr, "Failed to create simple poll object.\n");
705
/* Do not publish any local records */
706
avahi_server_config_init(&config);
707
config.publish_hinfo = 0;
708
config.publish_addresses = 0;
709
config.publish_workstation = 0;
710
config.publish_domain = 0;
712
/* Allocate a new server */
713
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
714
&config, NULL, NULL, &error);
716
/* Free the configuration data */
717
avahi_server_config_free(&config);
719
/* Check if creating the server object succeeded */
721
fprintf(stderr, "Failed to create server: %s\n",
1004
722
avahi_strerror(error));
1005
exitcode = EXIT_FAILURE;
723
returncode = EXIT_FAILURE;
1009
/* Create the Avahi service browser */
1010
sb = avahi_s_service_browser_new(mc.server, if_index,
727
/* Create the service browser */
728
sb = avahi_s_service_browser_new(server,
730
if_nametoindex(interface),
1011
731
AVAHI_PROTO_INET6,
1012
732
"_mandos._tcp", NULL, 0,
1013
browse_callback, &mc);
733
browse_callback, server);
1015
735
fprintf(stderr, "Failed to create service browser: %s\n",
1016
avahi_strerror(avahi_server_errno(mc.server)));
1017
exitcode = EXIT_FAILURE;
736
avahi_strerror(avahi_server_errno(server)));
737
returncode = EXIT_FAILURE;
1021
741
/* Run the main loop */
1024
fprintf(stderr, "Starting Avahi loop search\n");
744
fprintf(stderr, "Starting avahi loop search\n");
1027
avahi_simple_poll_loop(mc.simple_poll);
747
avahi_simple_poll_loop(simple_poll);
1032
752
fprintf(stderr, "%s exiting\n", argv[0]);
1035
755
/* Cleanup things */
1037
757
avahi_s_service_browser_free(sb);
1039
if (mc.server != NULL)
1040
avahi_server_free(mc.server);
1042
if (mc.simple_poll != NULL)
1043
avahi_simple_poll_free(mc.simple_poll);
1044
free(pubkeyfilename);
1045
free(seckeyfilename);
1047
if (gnutls_initalized){
1048
gnutls_certificate_free_credentials(mc.cred);
1049
gnutls_global_deinit ();
760
avahi_server_free(server);
763
avahi_simple_poll_free(simple_poll);