To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 244
- compare with another revision
- download diff
- download tarball
- view history from revision 244
- Committer: Teddy Hogeborn
- Date: 2009-01-10 05:41:16 UTC
- mfrom: (237.2.23 mandos)
- Revision ID: teddy@fukt.bsnet.se-20090110054116-uu1tbhe33sl5zg31
Merge from trunk; fix compilation error on AMD64.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- mandos-clients.conf => clients.conf
- server.py => mandos
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
8
8
* includes the following functions: "resolve_callback",
9
9
* "browse_callback", and parts of "main".
10
10
*
11
* Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
12
* Påhlsson.
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
25
26
* along with this program. If not, see
26
27
* <http://www.gnu.org/licenses/>.
27
28
*
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
29
* Contact the authors at <mandos@fukt.bsnet.se>.
30
30
*/
31
31
32
#define _FORTIFY_SOURCE 2
33
32
/* Needed by GPGME, specifically gpgme_data_seek() */
34
33
#define _LARGEFILE_SOURCE
35
34
#define _FILE_OFFSET_BITS 64
36
35
37
#include <stdio.h>
38
#include <assert.h>
39
#include <stdlib.h>
40
#include <time.h>
41
#include <net/if.h> /* if_nametoindex */
42
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror() */
40
#include <stdint.h> /* uint16_t, uint32_t */
41
#include <stddef.h> /* NULL, size_t, ssize_t */
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
srand() */
44
#include <stdbool.h> /* bool, true */
45
#include <string.h> /* memset(), strcmp(), strlen(),
46
strerror(), asprintf(), strcpy() */
47
#include <sys/ioctl.h> /* ioctl */
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
49
sockaddr_in6, PF_INET6,
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(), DIR */
52
#include <sys/stat.h> /* open() */
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
54
struct in6_addr, inet_pton(),
55
connect() */
56
#include <fcntl.h> /* open() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16 */
59
#include <assert.h> /* assert() */
60
#include <errno.h> /* perror(), errno */
61
#include <time.h> /* time() */
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
63
SIOCSIFFLAGS, if_indextoname(),
64
if_nametoindex(), IF_NAMESIZE */
65
#include <netinet/in.h>
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
67
getuid(), getgid(), setuid(),
68
setgid() */
69
#include <arpa/inet.h> /* inet_pton(), htons */
70
#include <iso646.h> /* not, and */
71
#include <argp.h> /* struct argp_option, error_t, struct
72
argp_state, struct argp,
73
argp_parse(), ARGP_KEY_ARG,
74
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
75
76
/* Avahi */
77
/* All Avahi types, constants and functions
78
Avahi*, avahi_*,
79
AVAHI_* */
43
80
#include <avahi-core/core.h>
44
81
#include <avahi-core/lookup.h>
45
82
#include <avahi-core/log.h>
47
84
#include <avahi-common/malloc.h>
48
85
#include <avahi-common/error.h>
49
86
50
//mandos client part
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
63
64
// gpgme
65
#include <errno.h> /* perror() */
66
#include <gpgme.h>
67
68
// getopt long
69
#include <getopt.h>
87
/* GnuTLS */
88
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
89
functions:
90
gnutls_*
91
init_gnutls_session(),
92
GNUTLS_* */
93
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
94
GNUTLS_OPENPGP_FMT_BASE64 */
95
96
/* GPGME */
97
#include <gpgme.h> /* All GPGME types, constants and
98
functions:
99
gpgme_*
100
GPGME_PROTOCOL_OpenPGP,
101
GPG_ERR_NO_* */
70
102
71
103
#define BUFFER_SIZE 256
72
#define DH_BITS 1024
73
104
74
const char *certdir = "/conf/conf.d/cryptkeyreq/";
75
const char *certfile = "openpgp-client.txt";
76
const char *certkey = "openpgp-client-key.txt";
105
#define PATHDIR "/conf/conf.d/mandos"
106
#define SECKEY "seckey.txt"
107
#define PUBKEY "pubkey.txt"
77
108
78
109
bool debug = false;
110
static const char mandos_protocol_version[] = "1";
111
const char *argp_program_version = "mandos-client " VERSION;
112
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
79
113
114
/* Used for passing in values through the Avahi callback functions */
80
115
typedef struct {
81
gnutls_session_t session;
116
AvahiSimplePoll *simple_poll;
117
AvahiServer *server;
82
118
gnutls_certificate_credentials_t cred;
119
unsigned int dh_bits;
83
120
gnutls_dh_params_t dh_params;
84
} encrypted_session;
85
86
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
89
gpgme_data_t dh_crypto, dh_plain;
121
const char *priority;
90
122
gpgme_ctx_t ctx;
123
} mandos_context;
124
125
/*
126
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
127
* "buffer_capacity" is how much is currently allocated,
128
* "buffer_length" is how much is already used.
129
*/
130
size_t adjustbuffer(char **buffer, size_t buffer_length,
131
size_t buffer_capacity){
132
if (buffer_length + BUFFER_SIZE > buffer_capacity){
133
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
134
if (buffer == NULL){
135
return 0;
136
}
137
buffer_capacity += BUFFER_SIZE;
138
}
139
return buffer_capacity;
140
}
141
142
/*
143
* Initialize GPGME.
144
*/
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
146
const char *pubkey, const char *tempdir){
147
int ret;
91
148
gpgme_error_t rc;
92
ssize_t ret;
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
95
149
gpgme_engine_info_t engine_info;
96
150
151
152
/*
153
* Helper function to insert pub and seckey to the enigne keyring.
154
*/
155
bool import_key(const char *filename){
156
int fd;
157
gpgme_data_t pgp_data;
158
159
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
160
if(fd == -1){
161
perror("open");
162
return false;
163
}
164
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
166
if (rc != GPG_ERR_NO_ERROR){
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
168
gpgme_strsource(rc), gpgme_strerror(rc));
169
return false;
170
}
171
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
175
gpgme_strsource(rc), gpgme_strerror(rc));
176
return false;
177
}
178
179
ret = (int)TEMP_FAILURE_RETRY(close(fd));
180
if(ret == -1){
181
perror("close");
182
}
183
gpgme_data_release(pgp_data);
184
return true;
185
}
186
97
187
if (debug){
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
188
fprintf(stderr, "Initialize gpgme\n");
99
189
}
100
190
101
191
/* Init GPGME */
104
194
if (rc != GPG_ERR_NO_ERROR){
105
195
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
106
196
gpgme_strsource(rc), gpgme_strerror(rc));
107
return -1;
197
return false;
108
198
}
109
199
110
/* Set GPGME home directory */
200
/* Set GPGME home directory for the OpenPGP engine only */
111
201
rc = gpgme_get_engine_info (&engine_info);
112
202
if (rc != GPG_ERR_NO_ERROR){
113
203
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
114
204
gpgme_strsource(rc), gpgme_strerror(rc));
115
return -1;
205
return false;
116
206
}
117
207
while(engine_info != NULL){
118
208
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
119
209
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
120
engine_info->file_name, homedir);
210
engine_info->file_name, tempdir);
121
211
break;
122
212
}
123
213
engine_info = engine_info->next;
124
214
}
125
215
if(engine_info == NULL){
126
fprintf(stderr, "Could not set home dir to %s\n", homedir);
127
return -1;
128
}
129
130
/* Create new GPGME data buffer from packet buffer */
131
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
216
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
217
return false;
218
}
219
220
/* Create new GPGME "context" */
221
rc = gpgme_new(&(mc->ctx));
222
if (rc != GPG_ERR_NO_ERROR){
223
fprintf(stderr, "bad gpgme_new: %s: %s\n",
224
gpgme_strsource(rc), gpgme_strerror(rc));
225
return false;
226
}
227
228
if (not import_key(pubkey) or not import_key(seckey)){
229
return false;
230
}
231
232
return true;
233
}
234
235
/*
236
* Decrypt OpenPGP data.
237
* Returns -1 on error
238
*/
239
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
240
const char *cryptotext,
241
size_t crypto_size,
242
char **plaintext){
243
gpgme_data_t dh_crypto, dh_plain;
244
gpgme_error_t rc;
245
ssize_t ret;
246
size_t plaintext_capacity = 0;
247
ssize_t plaintext_length = 0;
248
249
if (debug){
250
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
251
}
252
253
/* Create new GPGME data buffer from memory cryptotext */
254
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
255
0);
132
256
if (rc != GPG_ERR_NO_ERROR){
133
257
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
134
258
gpgme_strsource(rc), gpgme_strerror(rc));
140
264
if (rc != GPG_ERR_NO_ERROR){
141
265
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
142
266
gpgme_strsource(rc), gpgme_strerror(rc));
143
return -1;
144
}
145
146
/* Create new GPGME "context" */
147
rc = gpgme_new(&ctx);
148
if (rc != GPG_ERR_NO_ERROR){
149
fprintf(stderr, "bad gpgme_new: %s: %s\n",
150
gpgme_strsource(rc), gpgme_strerror(rc));
151
return -1;
152
}
153
154
/* Decrypt data from the FILE pointer to the plaintext data
155
buffer */
156
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
267
gpgme_data_release(dh_crypto);
268
return -1;
269
}
270
271
/* Decrypt data from the cryptotext data buffer to the plaintext
272
data buffer */
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
157
274
if (rc != GPG_ERR_NO_ERROR){
158
275
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
159
276
gpgme_strsource(rc), gpgme_strerror(rc));
160
return -1;
277
plaintext_length = -1;
278
if (debug){
279
gpgme_decrypt_result_t result;
280
result = gpgme_op_decrypt_result(mc->ctx);
281
if (result == NULL){
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
283
} else {
284
fprintf(stderr, "Unsupported algorithm: %s\n",
285
result->unsupported_algorithm);
286
fprintf(stderr, "Wrong key usage: %u\n",
287
result->wrong_key_usage);
288
if(result->file_name != NULL){
289
fprintf(stderr, "File name: %s\n", result->file_name);
290
}
291
gpgme_recipient_t recipient;
292
recipient = result->recipients;
293
if(recipient){
294
while(recipient != NULL){
295
fprintf(stderr, "Public key algorithm: %s\n",
296
gpgme_pubkey_algo_name(recipient->pubkey_algo));
297
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
298
fprintf(stderr, "Secret key available: %s\n",
299
recipient->status == GPG_ERR_NO_SECKEY
300
? "No" : "Yes");
301
recipient = recipient->next;
302
}
303
}
304
}
305
}
306
goto decrypt_end;
161
307
}
162
308
163
309
if(debug){
164
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
165
}
166
167
if (debug){
168
gpgme_decrypt_result_t result;
169
result = gpgme_op_decrypt_result(ctx);
170
if (result == NULL){
171
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
172
} else {
173
fprintf(stderr, "Unsupported algorithm: %s\n",
174
result->unsupported_algorithm);
175
fprintf(stderr, "Wrong key usage: %d\n",
176
result->wrong_key_usage);
177
if(result->file_name != NULL){
178
fprintf(stderr, "File name: %s\n", result->file_name);
179
}
180
gpgme_recipient_t recipient;
181
recipient = result->recipients;
182
if(recipient){
183
while(recipient != NULL){
184
fprintf(stderr, "Public key algorithm: %s\n",
185
gpgme_pubkey_algo_name(recipient->pubkey_algo));
186
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
187
fprintf(stderr, "Secret key available: %s\n",
188
recipient->status == GPG_ERR_NO_SECKEY
189
? "No" : "Yes");
190
recipient = recipient->next;
191
}
192
}
193
}
194
}
195
196
/* Delete the GPGME FILE pointer cryptotext data buffer */
197
gpgme_data_release(dh_crypto);
310
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
311
}
198
312
199
313
/* Seek back to the beginning of the GPGME plaintext data buffer */
200
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
201
202
*new_packet = 0;
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
315
perror("gpgme_data_seek");
316
plaintext_length = -1;
317
goto decrypt_end;
318
}
319
320
*plaintext = NULL;
203
321
while(true){
204
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
205
*new_packet = realloc(*new_packet,
206
(unsigned int)new_packet_capacity
207
+ BUFFER_SIZE);
208
if (*new_packet == NULL){
209
perror("realloc");
210
return -1;
211
}
212
new_packet_capacity += BUFFER_SIZE;
322
plaintext_capacity = adjustbuffer(plaintext,
323
(size_t)plaintext_length,
324
plaintext_capacity);
325
if (plaintext_capacity == 0){
326
perror("adjustbuffer");
327
plaintext_length = -1;
328
goto decrypt_end;
213
329
}
214
330
215
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
331
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
216
332
BUFFER_SIZE);
217
333
/* Print the data, if any */
218
334
if (ret == 0){
335
/* EOF */
219
336
break;
220
337
}
221
338
if(ret < 0){
222
339
perror("gpgme_data_read");
223
return -1;
224
}
225
new_packet_length += ret;
226
}
227
228
/* FIXME: check characters before printing to screen so to not print
229
terminal control characters */
230
/* if(debug){ */
231
/* fprintf(stderr, "decrypted password is: "); */
232
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
233
/* fprintf(stderr, "\n"); */
234
/* } */
340
plaintext_length = -1;
341
goto decrypt_end;
342
}
343
plaintext_length += ret;
344
}
345
346
if(debug){
347
fprintf(stderr, "Decrypted password is: ");
348
for(ssize_t i = 0; i < plaintext_length; i++){
349
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
350
}
351
fprintf(stderr, "\n");
352
}
353
354
decrypt_end:
355
356
/* Delete the GPGME cryptotext data buffer */
357
gpgme_data_release(dh_crypto);
235
358
236
359
/* Delete the GPGME plaintext data buffer */
237
360
gpgme_data_release(dh_plain);
238
return new_packet_length;
361
return plaintext_length;
239
362
}
240
363
241
364
static const char * safer_gnutls_strerror (int value) {
242
const char *ret = gnutls_strerror (value);
365
const char *ret = gnutls_strerror (value); /* Spurious warning */
243
366
if (ret == NULL)
244
367
ret = "(unknown)";
245
368
return ret;
246
369
}
247
370
248
void debuggnutls(__attribute__((unused)) int level,
249
const char* string){
250
fprintf(stderr, "%s", string);
371
/* GnuTLS log function callback */
372
static void debuggnutls(__attribute__((unused)) int level,
373
const char* string){
374
fprintf(stderr, "GnuTLS: %s", string);
251
375
}
252
376
253
int initgnutls(encrypted_session *es){
254
const char *err;
377
static int init_gnutls_global(mandos_context *mc,
378
const char *pubkeyfilename,
379
const char *seckeyfilename){
255
380
int ret;
256
381
257
382
if(debug){
258
383
fprintf(stderr, "Initializing GnuTLS\n");
259
384
}
260
261
if ((ret = gnutls_global_init ())
262
!= GNUTLS_E_SUCCESS) {
263
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
385
386
ret = gnutls_global_init();
387
if (ret != GNUTLS_E_SUCCESS) {
388
fprintf (stderr, "GnuTLS global_init: %s\n",
389
safer_gnutls_strerror(ret));
264
390
return -1;
265
391
}
266
392
267
393
if (debug){
394
/* "Use a log level over 10 to enable all debugging options."
395
* - GnuTLS manual
396
*/
268
397
gnutls_global_set_log_level(11);
269
398
gnutls_global_set_log_function(debuggnutls);
270
399
}
271
400
272
/* openpgp credentials */
273
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
274
!= GNUTLS_E_SUCCESS) {
275
fprintf (stderr, "memory error: %s\n",
401
/* OpenPGP credentials */
402
gnutls_certificate_allocate_credentials(&mc->cred);
403
if (ret != GNUTLS_E_SUCCESS){
404
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
405
warning */
276
406
safer_gnutls_strerror(ret));
407
gnutls_global_deinit ();
277
408
return -1;
278
409
}
279
410
280
411
if(debug){
281
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
282
" and keyfile %s as GnuTLS credentials\n", certfile,
283
certkey);
412
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
413
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
414
seckeyfilename);
284
415
}
285
416
286
417
ret = gnutls_certificate_set_openpgp_key_file
287
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
418
(mc->cred, pubkeyfilename, seckeyfilename,
419
GNUTLS_OPENPGP_FMT_BASE64);
288
420
if (ret != GNUTLS_E_SUCCESS) {
289
fprintf
290
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
291
" '%s')\n",
292
ret, certfile, certkey);
293
fprintf(stdout, "The Error is: %s\n",
421
fprintf(stderr,
422
"Error[%d] while reading the OpenPGP key pair ('%s',"
423
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
424
fprintf(stderr, "The GnuTLS error is: %s\n",
294
425
safer_gnutls_strerror(ret));
295
return -1;
296
}
297
298
//GnuTLS server initialization
299
if ((ret = gnutls_dh_params_init (&es->dh_params))
300
!= GNUTLS_E_SUCCESS) {
301
fprintf (stderr, "Error in dh parameter initialization: %s\n",
302
safer_gnutls_strerror(ret));
303
return -1;
304
}
305
306
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
307
!= GNUTLS_E_SUCCESS) {
308
fprintf (stderr, "Error in prime generation: %s\n",
309
safer_gnutls_strerror(ret));
310
return -1;
311
}
312
313
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
314
315
// GnuTLS session creation
316
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
317
!= GNUTLS_E_SUCCESS){
426
goto globalfail;
427
}
428
429
/* GnuTLS server initialization */
430
ret = gnutls_dh_params_init(&mc->dh_params);
431
if (ret != GNUTLS_E_SUCCESS) {
432
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
433
" %s\n", safer_gnutls_strerror(ret));
434
goto globalfail;
435
}
436
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
437
if (ret != GNUTLS_E_SUCCESS) {
438
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
439
safer_gnutls_strerror(ret));
440
goto globalfail;
441
}
442
443
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
444
445
return 0;
446
447
globalfail:
448
449
gnutls_certificate_free_credentials(mc->cred);
450
gnutls_global_deinit();
451
gnutls_dh_params_deinit(mc->dh_params);
452
return -1;
453
}
454
455
static int init_gnutls_session(mandos_context *mc,
456
gnutls_session_t *session){
457
int ret;
458
/* GnuTLS session creation */
459
ret = gnutls_init(session, GNUTLS_SERVER);
460
if (ret != GNUTLS_E_SUCCESS){
318
461
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
319
462
safer_gnutls_strerror(ret));
320
463
}
321
464
322
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf(stderr, "Syntax error at: %s\n", err);
325
fprintf(stderr, "GnuTLS error: %s\n",
326
safer_gnutls_strerror(ret));
327
return -1;
465
{
466
const char *err;
467
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
468
if (ret != GNUTLS_E_SUCCESS) {
469
fprintf(stderr, "Syntax error at: %s\n", err);
470
fprintf(stderr, "GnuTLS error: %s\n",
471
safer_gnutls_strerror(ret));
472
gnutls_deinit (*session);
473
return -1;
474
}
328
475
}
329
476
330
if ((ret = gnutls_credentials_set
331
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
332
!= GNUTLS_E_SUCCESS) {
333
fprintf(stderr, "Error setting a credentials set: %s\n",
477
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
478
mc->cred);
479
if (ret != GNUTLS_E_SUCCESS) {
480
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
334
481
safer_gnutls_strerror(ret));
482
gnutls_deinit (*session);
335
483
return -1;
336
484
}
337
485
338
486
/* ignore client certificate if any. */
339
gnutls_certificate_server_set_request (es->session,
487
gnutls_certificate_server_set_request (*session,
340
488
GNUTLS_CERT_IGNORE);
341
489
342
gnutls_dh_set_prime_bits (es->session, DH_BITS);
490
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
343
491
344
492
return 0;
345
493
}
346
494
347
void empty_log(__attribute__((unused)) AvahiLogLevel level,
348
__attribute__((unused)) const char *txt){}
495
/* Avahi log function callback */
496
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
497
__attribute__((unused)) const char *txt){}
349
498
350
int start_mandos_communication(const char *ip, uint16_t port,
351
unsigned int if_index){
499
/* Called when a Mandos server is found */
500
static int start_mandos_communication(const char *ip, uint16_t port,
501
AvahiIfIndex if_index,
502
mandos_context *mc){
352
503
int ret, tcp_sd;
353
struct sockaddr_in6 to;
354
encrypted_session es;
504
ssize_t sret;
505
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
355
506
char *buffer = NULL;
356
507
char *decrypted_buffer;
357
508
size_t buffer_length = 0;
358
509
size_t buffer_capacity = 0;
359
510
ssize_t decrypted_buffer_size;
360
size_t written = 0;
511
size_t written;
361
512
int retval = 0;
362
513
char interface[IF_NAMESIZE];
514
gnutls_session_t session;
515
516
ret = init_gnutls_session (mc, &session);
517
if (ret != 0){
518
return -1;
519
}
363
520
364
521
if(debug){
365
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
522
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
523
"\n", ip, port);
366
524
}
367
525
368
526
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
371
529
return -1;
372
530
}
373
531
374
if(if_indextoname(if_index, interface) == NULL){
375
if(debug){
532
if(debug){
533
if(if_indextoname((unsigned int)if_index, interface) == NULL){
376
534
perror("if_indextoname");
535
return -1;
377
536
}
378
return -1;
379
}
380
381
if(debug){
382
537
fprintf(stderr, "Binding to interface %s\n", interface);
383
538
}
384
539
385
memset(&to,0,sizeof(to)); /* Spurious warning */
386
to.sin6_family = AF_INET6;
387
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
540
memset(&to, 0, sizeof(to));
541
to.in6.sin6_family = AF_INET6;
542
/* It would be nice to have a way to detect if we were passed an
543
IPv4 address here. Now we assume an IPv6 address. */
544
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
388
545
if (ret < 0 ){
389
546
perror("inet_pton");
390
547
return -1;
391
}
548
}
392
549
if(ret == 0){
393
550
fprintf(stderr, "Bad address: %s\n", ip);
394
551
return -1;
395
552
}
396
to.sin6_port = htons(port); /* Spurious warning */
553
to.in6.sin6_port = htons(port); /* Spurious warning */
397
554
398
to.sin6_scope_id = (uint32_t)if_index;
555
to.in6.sin6_scope_id = (uint32_t)if_index;
399
556
400
557
if(debug){
401
fprintf(stderr, "Connection to: %s\n", ip);
558
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
559
port);
560
char addrstr[INET6_ADDRSTRLEN] = "";
561
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
562
sizeof(addrstr)) == NULL){
563
perror("inet_ntop");
564
} else {
565
if(strcmp(addrstr, ip) != 0){
566
fprintf(stderr, "Canonical address form: %s\n", addrstr);
567
}
568
}
402
569
}
403
570
404
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
571
ret = connect(tcp_sd, &to.in, sizeof(to));
405
572
if (ret < 0){
406
573
perror("connect");
407
574
return -1;
408
575
}
409
576
410
ret = initgnutls (&es);
411
if (ret != 0){
412
retval = -1;
413
return -1;
577
const char *out = mandos_protocol_version;
578
written = 0;
579
while (true){
580
size_t out_size = strlen(out);
581
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
582
out_size - written));
583
if (ret == -1){
584
perror("write");
585
retval = -1;
586
goto mandos_end;
587
}
588
written += (size_t)ret;
589
if(written < out_size){
590
continue;
591
} else {
592
if (out == mandos_protocol_version){
593
written = 0;
594
out = "\r\n";
595
} else {
596
break;
597
}
598
}
414
599
}
415
600
416
gnutls_transport_set_ptr (es.session,
417
(gnutls_transport_ptr_t) tcp_sd);
418
419
601
if(debug){
420
602
fprintf(stderr, "Establishing TLS session with %s\n", ip);
421
603
}
422
604
423
ret = gnutls_handshake (es.session);
605
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
606
607
do{
608
ret = gnutls_handshake (session);
609
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
424
610
425
611
if (ret != GNUTLS_E_SUCCESS){
426
612
if(debug){
427
fprintf(stderr, "\n*** Handshake failed ***\n");
613
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
428
614
gnutls_perror (ret);
429
615
}
430
616
retval = -1;
431
goto exit;
617
goto mandos_end;
432
618
}
433
619
434
//Retrieve OpenPGP packet that contains the wanted password
620
/* Read OpenPGP packet that contains the wanted password */
435
621
436
622
if(debug){
437
623
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
438
624
ip);
439
625
}
440
626
441
627
while(true){
442
if (buffer_length + BUFFER_SIZE > buffer_capacity){
443
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
444
if (buffer == NULL){
445
perror("realloc");
446
goto exit;
447
}
448
buffer_capacity += BUFFER_SIZE;
628
buffer_capacity = adjustbuffer(&buffer, buffer_length,
629
buffer_capacity);
630
if (buffer_capacity == 0){
631
perror("adjustbuffer");
632
retval = -1;
633
goto mandos_end;
449
634
}
450
635
451
ret = gnutls_record_recv
452
(es.session, buffer+buffer_length, BUFFER_SIZE);
453
if (ret == 0){
636
sret = gnutls_record_recv(session, buffer+buffer_length,
637
BUFFER_SIZE);
638
if (sret == 0){
454
639
break;
455
640
}
456
if (ret < 0){
457
switch(ret){
641
if (sret < 0){
642
switch(sret){
458
643
case GNUTLS_E_INTERRUPTED:
459
644
case GNUTLS_E_AGAIN:
460
645
break;
461
646
case GNUTLS_E_REHANDSHAKE:
462
ret = gnutls_handshake (es.session);
647
do{
648
ret = gnutls_handshake (session);
649
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
463
650
if (ret < 0){
464
fprintf(stderr, "\n*** Handshake failed ***\n");
651
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
465
652
gnutls_perror (ret);
466
653
retval = -1;
467
goto exit;
654
goto mandos_end;
468
655
}
469
656
break;
470
657
default:
471
658
fprintf(stderr, "Unknown error while reading data from"
472
" encrypted session with mandos server\n");
659
" encrypted session with Mandos server\n");
473
660
retval = -1;
474
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
475
goto exit;
661
gnutls_bye (session, GNUTLS_SHUT_RDWR);
662
goto mandos_end;
476
663
}
477
664
} else {
478
buffer_length += (size_t) ret;
665
buffer_length += (size_t) sret;
479
666
}
480
667
}
481
668
669
if(debug){
670
fprintf(stderr, "Closing TLS session\n");
671
}
672
673
gnutls_bye (session, GNUTLS_SHUT_RDWR);
674
482
675
if (buffer_length > 0){
483
decrypted_buffer_size = pgp_packet_decrypt(buffer,
676
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
484
677
buffer_length,
485
&decrypted_buffer,
486
certdir);
678
&decrypted_buffer);
487
679
if (decrypted_buffer_size >= 0){
488
while(written < decrypted_buffer_size){
680
written = 0;
681
while(written < (size_t) decrypted_buffer_size){
489
682
ret = (int)fwrite (decrypted_buffer + written, 1,
490
683
(size_t)decrypted_buffer_size - written,
491
684
stdout);
503
696
} else {
504
697
retval = -1;
505
698
}
506
}
507
508
//shutdown procedure
509
510
if(debug){
511
fprintf(stderr, "Closing TLS session\n");
512
}
513
699
} else {
700
retval = -1;
701
}
702
703
/* Shutdown procedure */
704
705
mandos_end:
514
706
free(buffer);
515
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
516
exit:
517
close(tcp_sd);
518
gnutls_deinit (es.session);
519
gnutls_certificate_free_credentials (es.cred);
520
gnutls_global_deinit ();
707
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
708
if(ret == -1){
709
perror("close");
710
}
711
gnutls_deinit (session);
521
712
return retval;
522
713
}
523
714
524
static AvahiSimplePoll *simple_poll = NULL;
525
static AvahiServer *server = NULL;
526
527
static void resolve_callback(
528
AvahiSServiceResolver *r,
529
AvahiIfIndex interface,
530
AVAHI_GCC_UNUSED AvahiProtocol protocol,
531
AvahiResolverEvent event,
532
const char *name,
533
const char *type,
534
const char *domain,
535
const char *host_name,
536
const AvahiAddress *address,
537
uint16_t port,
538
AVAHI_GCC_UNUSED AvahiStringList *txt,
539
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
540
AVAHI_GCC_UNUSED void* userdata) {
541
542
assert(r); /* Spurious warning */
715
static void resolve_callback(AvahiSServiceResolver *r,
716
AvahiIfIndex interface,
717
AVAHI_GCC_UNUSED AvahiProtocol protocol,
718
AvahiResolverEvent event,
719
const char *name,
720
const char *type,
721
const char *domain,
722
const char *host_name,
723
const AvahiAddress *address,
724
uint16_t port,
725
AVAHI_GCC_UNUSED AvahiStringList *txt,
726
AVAHI_GCC_UNUSED AvahiLookupResultFlags
727
flags,
728
void* userdata) {
729
mandos_context *mc = userdata;
730
assert(r);
543
731
544
732
/* Called whenever a service has been resolved successfully or
545
733
timed out */
547
735
switch (event) {
548
736
default:
549
737
case AVAHI_RESOLVER_FAILURE:
550
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
551
" type '%s' in domain '%s': %s\n", name, type, domain,
552
avahi_strerror(avahi_server_errno(server)));
738
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
739
" of type '%s' in domain '%s': %s\n", name, type, domain,
740
avahi_strerror(avahi_server_errno(mc->server)));
553
741
break;
554
742
555
743
case AVAHI_RESOLVER_FOUND:
557
745
char ip[AVAHI_ADDRESS_STR_MAX];
558
746
avahi_address_snprint(ip, sizeof(ip), address);
559
747
if(debug){
560
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
561
" port %d\n", name, host_name, ip, port);
748
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
749
PRIu16 ") on port %d\n", name, host_name, ip,
750
interface, port);
562
751
}
563
int ret = start_mandos_communication(ip, port,
564
(unsigned int) interface);
752
int ret = start_mandos_communication(ip, port, interface, mc);
565
753
if (ret == 0){
566
exit(EXIT_SUCCESS);
754
avahi_simple_poll_quit(mc->simple_poll);
567
755
}
568
756
}
569
757
}
570
758
avahi_s_service_resolver_free(r);
571
759
}
572
760
573
static void browse_callback(
574
AvahiSServiceBrowser *b,
575
AvahiIfIndex interface,
576
AvahiProtocol protocol,
577
AvahiBrowserEvent event,
578
const char *name,
579
const char *type,
580
const char *domain,
581
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
582
void* userdata) {
583
584
AvahiServer *s = userdata;
585
assert(b); /* Spurious warning */
586
587
/* Called whenever a new services becomes available on the LAN or
588
is removed from the LAN */
589
590
switch (event) {
591
default:
592
case AVAHI_BROWSER_FAILURE:
593
594
fprintf(stderr, "(Browser) %s\n",
595
avahi_strerror(avahi_server_errno(server)));
596
avahi_simple_poll_quit(simple_poll);
597
return;
598
599
case AVAHI_BROWSER_NEW:
600
/* We ignore the returned resolver object. In the callback
601
function we free it. If the server is terminated before
602
the callback function is called the server will free
603
the resolver for us. */
604
605
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
606
type, domain,
607
AVAHI_PROTO_INET6, 0,
608
resolve_callback, s)))
609
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
610
avahi_strerror(avahi_server_errno(s)));
611
break;
612
613
case AVAHI_BROWSER_REMOVE:
614
break;
615
616
case AVAHI_BROWSER_ALL_FOR_NOW:
617
case AVAHI_BROWSER_CACHE_EXHAUSTED:
618
break;
761
static void browse_callback( AvahiSServiceBrowser *b,
762
AvahiIfIndex interface,
763
AvahiProtocol protocol,
764
AvahiBrowserEvent event,
765
const char *name,
766
const char *type,
767
const char *domain,
768
AVAHI_GCC_UNUSED AvahiLookupResultFlags
769
flags,
770
void* userdata) {
771
mandos_context *mc = userdata;
772
assert(b);
773
774
/* Called whenever a new services becomes available on the LAN or
775
is removed from the LAN */
776
777
switch (event) {
778
default:
779
case AVAHI_BROWSER_FAILURE:
780
781
fprintf(stderr, "(Avahi browser) %s\n",
782
avahi_strerror(avahi_server_errno(mc->server)));
783
avahi_simple_poll_quit(mc->simple_poll);
784
return;
785
786
case AVAHI_BROWSER_NEW:
787
/* We ignore the returned Avahi resolver object. In the callback
788
function we free it. If the Avahi server is terminated before
789
the callback function is called the Avahi server will free the
790
resolver for us. */
791
792
if (!(avahi_s_service_resolver_new(mc->server, interface,
793
protocol, name, type, domain,
794
AVAHI_PROTO_INET6, 0,
795
resolve_callback, mc)))
796
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
797
name, avahi_strerror(avahi_server_errno(mc->server)));
798
break;
799
800
case AVAHI_BROWSER_REMOVE:
801
break;
802
803
case AVAHI_BROWSER_ALL_FOR_NOW:
804
case AVAHI_BROWSER_CACHE_EXHAUSTED:
805
if(debug){
806
fprintf(stderr, "No Mandos server found, still searching...\n");
619
807
}
620
}
621
622
/* combinds two strings and returns the malloced new string. som sane checks could/should be added */
623
const char *combinestrings(const char *first, const char *second){
624
char *tmp;
625
tmp = malloc(strlen(first) + strlen(second));
626
if (tmp == NULL){
627
perror("malloc");
628
return NULL;
808
break;
629
809
}
630
strcpy(tmp, first);
631
strcat(tmp, second);
632
return tmp;
633
810
}
634
811
635
636
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
637
AvahiServerConfig config;
812
int main(int argc, char *argv[]){
638
813
AvahiSServiceBrowser *sb = NULL;
639
814
int error;
640
815
int ret;
641
int returncode = EXIT_SUCCESS;
816
int exitcode = EXIT_SUCCESS;
642
817
const char *interface = "eth0";
643
644
while (true){
645
static struct option long_options[] = {
646
{"debug", no_argument, (int *)&debug, 1},
647
{"interface", required_argument, 0, 'i'},
648
{"certdir", required_argument, 0, 'd'},
649
{"certkey", required_argument, 0, 'c'},
650
{"certfile", required_argument, 0, 'k'},
651
{0, 0, 0, 0} };
652
653
int option_index = 0;
654
ret = getopt_long (argc, argv, "i:", long_options,
655
&option_index);
656
657
if (ret == -1){
658
break;
659
}
660
661
switch(ret){
662
case 0:
663
break;
664
case 'i':
665
interface = optarg;
666
break;
667
case 'd':
668
certdir = optarg;
669
break;
670
case 'c':
671
certfile = optarg;
672
break;
673
case 'k':
674
certkey = optarg;
675
break;
676
default:
677
exit(EXIT_FAILURE);
678
}
679
}
680
681
certfile = combinestrings(certdir, certfile);
682
if (certfile == NULL){
683
goto exit;
684
}
685
686
certkey = combinestrings(certdir, certkey);
687
if (certkey == NULL){
688
goto exit;
689
}
690
818
struct ifreq network;
819
int sd;
820
uid_t uid;
821
gid_t gid;
822
char *connect_to = NULL;
823
char tempdir[] = "/tmp/mandosXXXXXX";
824
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
825
const char *seckey = PATHDIR "/" SECKEY;
826
const char *pubkey = PATHDIR "/" PUBKEY;
827
828
mandos_context mc = { .simple_poll = NULL, .server = NULL,
829
.dh_bits = 1024, .priority = "SECURE256"
830
":!CTYPE-X.509:+CTYPE-OPENPGP" };
831
bool gnutls_initalized = false;
832
bool gpgme_initalized = false;
833
834
{
835
struct argp_option options[] = {
836
{ .name = "debug", .key = 128,
837
.doc = "Debug mode", .group = 3 },
838
{ .name = "connect", .key = 'c',
839
.arg = "ADDRESS:PORT",
840
.doc = "Connect directly to a specific Mandos server",
841
.group = 1 },
842
{ .name = "interface", .key = 'i',
843
.arg = "NAME",
844
.doc = "Interface that will be used to search for Mandos"
845
" servers",
846
.group = 1 },
847
{ .name = "seckey", .key = 's',
848
.arg = "FILE",
849
.doc = "OpenPGP secret key file base name",
850
.group = 1 },
851
{ .name = "pubkey", .key = 'p',
852
.arg = "FILE",
853
.doc = "OpenPGP public key file base name",
854
.group = 2 },
855
{ .name = "dh-bits", .key = 129,
856
.arg = "BITS",
857
.doc = "Bit length of the prime number used in the"
858
" Diffie-Hellman key exchange",
859
.group = 2 },
860
{ .name = "priority", .key = 130,
861
.arg = "STRING",
862
.doc = "GnuTLS priority string for the TLS handshake",
863
.group = 1 },
864
{ .name = NULL }
865
};
866
867
error_t parse_opt (int key, char *arg,
868
struct argp_state *state) {
869
/* Get the INPUT argument from `argp_parse', which we know is
870
a pointer to our plugin list pointer. */
871
switch (key) {
872
case 128: /* --debug */
873
debug = true;
874
break;
875
case 'c': /* --connect */
876
connect_to = arg;
877
break;
878
case 'i': /* --interface */
879
interface = arg;
880
break;
881
case 's': /* --seckey */
882
seckey = arg;
883
break;
884
case 'p': /* --pubkey */
885
pubkey = arg;
886
break;
887
case 129: /* --dh-bits */
888
errno = 0;
889
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
890
if (errno){
891
perror("strtol");
892
exit(EXIT_FAILURE);
893
}
894
break;
895
case 130: /* --priority */
896
mc.priority = arg;
897
break;
898
case ARGP_KEY_ARG:
899
argp_usage (state);
900
case ARGP_KEY_END:
901
break;
902
default:
903
return ARGP_ERR_UNKNOWN;
904
}
905
return 0;
906
}
907
908
struct argp argp = { .options = options, .parser = parse_opt,
909
.args_doc = "",
910
.doc = "Mandos client -- Get and decrypt"
911
" passwords from a Mandos server" };
912
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
913
if (ret == ARGP_ERR_UNKNOWN){
914
fprintf(stderr, "Unknown error while parsing arguments\n");
915
exitcode = EXIT_FAILURE;
916
goto end;
917
}
918
}
919
920
/* If the interface is down, bring it up */
921
{
922
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
923
if(sd < 0) {
924
perror("socket");
925
exitcode = EXIT_FAILURE;
926
goto end;
927
}
928
strcpy(network.ifr_name, interface);
929
ret = ioctl(sd, SIOCGIFFLAGS, &network);
930
if(ret == -1){
931
perror("ioctl SIOCGIFFLAGS");
932
exitcode = EXIT_FAILURE;
933
goto end;
934
}
935
if((network.ifr_flags & IFF_UP) == 0){
936
network.ifr_flags |= IFF_UP;
937
ret = ioctl(sd, SIOCSIFFLAGS, &network);
938
if(ret == -1){
939
perror("ioctl SIOCSIFFLAGS");
940
exitcode = EXIT_FAILURE;
941
goto end;
942
}
943
}
944
ret = (int)TEMP_FAILURE_RETRY(close(sd));
945
if(ret == -1){
946
perror("close");
947
}
948
}
949
950
uid = getuid();
951
gid = getgid();
952
953
ret = setuid(uid);
954
if (ret == -1){
955
perror("setuid");
956
}
957
958
setgid(gid);
959
if (ret == -1){
960
perror("setgid");
961
}
962
963
ret = init_gnutls_global(&mc, pubkey, seckey);
964
if (ret == -1){
965
fprintf(stderr, "init_gnutls_global failed\n");
966
exitcode = EXIT_FAILURE;
967
goto end;
968
} else {
969
gnutls_initalized = true;
970
}
971
972
if(mkdtemp(tempdir) == NULL){
973
perror("mkdtemp");
974
tempdir[0] = '\0';
975
goto end;
976
}
977
978
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
979
fprintf(stderr, "gpgme_initalized failed\n");
980
exitcode = EXIT_FAILURE;
981
goto end;
982
} else {
983
gpgme_initalized = true;
984
}
985
986
if_index = (AvahiIfIndex) if_nametoindex(interface);
987
if(if_index == 0){
988
fprintf(stderr, "No such interface: \"%s\"\n", interface);
989
exit(EXIT_FAILURE);
990
}
991
992
if(connect_to != NULL){
993
/* Connect directly, do not use Zeroconf */
994
/* (Mainly meant for debugging) */
995
char *address = strrchr(connect_to, ':');
996
if(address == NULL){
997
fprintf(stderr, "No colon in address\n");
998
exitcode = EXIT_FAILURE;
999
goto end;
1000
}
1001
errno = 0;
1002
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
1003
if(errno){
1004
perror("Bad port number");
1005
exitcode = EXIT_FAILURE;
1006
goto end;
1007
}
1008
*address = '\0';
1009
address = connect_to;
1010
ret = start_mandos_communication(address, port, if_index, &mc);
1011
if(ret < 0){
1012
exitcode = EXIT_FAILURE;
1013
} else {
1014
exitcode = EXIT_SUCCESS;
1015
}
1016
goto end;
1017
}
1018
691
1019
if (not debug){
692
1020
avahi_set_log_function(empty_log);
693
1021
}
694
1022
695
/* Initialize the psuedo-RNG */
1023
/* Initialize the pseudo-RNG for Avahi */
696
1024
srand((unsigned int) time(NULL));
697
698
/* Allocate main loop object */
699
if (!(simple_poll = avahi_simple_poll_new())) {
700
fprintf(stderr, "Failed to create simple poll object.\n");
701
702
goto exit;
703
}
704
705
/* Do not publish any local records */
706
avahi_server_config_init(&config);
707
config.publish_hinfo = 0;
708
config.publish_addresses = 0;
709
config.publish_workstation = 0;
710
config.publish_domain = 0;
711
712
/* Allocate a new server */
713
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
714
&config, NULL, NULL, &error);
715
716
/* Free the configuration data */
717
avahi_server_config_free(&config);
718
719
/* Check if creating the server object succeeded */
720
if (!server) {
721
fprintf(stderr, "Failed to create server: %s\n",
1025
1026
/* Allocate main Avahi loop object */
1027
mc.simple_poll = avahi_simple_poll_new();
1028
if (mc.simple_poll == NULL) {
1029
fprintf(stderr, "Avahi: Failed to create simple poll"
1030
" object.\n");
1031
exitcode = EXIT_FAILURE;
1032
goto end;
1033
}
1034
1035
{
1036
AvahiServerConfig config;
1037
/* Do not publish any local Zeroconf records */
1038
avahi_server_config_init(&config);
1039
config.publish_hinfo = 0;
1040
config.publish_addresses = 0;
1041
config.publish_workstation = 0;
1042
config.publish_domain = 0;
1043
1044
/* Allocate a new server */
1045
mc.server = avahi_server_new(avahi_simple_poll_get
1046
(mc.simple_poll), &config, NULL,
1047
NULL, &error);
1048
1049
/* Free the Avahi configuration data */
1050
avahi_server_config_free(&config);
1051
}
1052
1053
/* Check if creating the Avahi server object succeeded */
1054
if (mc.server == NULL) {
1055
fprintf(stderr, "Failed to create Avahi server: %s\n",
722
1056
avahi_strerror(error));
723
returncode = EXIT_FAILURE;
724
goto exit;
1057
exitcode = EXIT_FAILURE;
1058
goto end;
725
1059
}
726
1060
727
/* Create the service browser */
728
sb = avahi_s_service_browser_new(server,
729
(AvahiIfIndex)
730
if_nametoindex(interface),
1061
/* Create the Avahi service browser */
1062
sb = avahi_s_service_browser_new(mc.server, if_index,
731
1063
AVAHI_PROTO_INET6,
732
1064
"_mandos._tcp", NULL, 0,
733
browse_callback, server);
734
if (!sb) {
1065
browse_callback, &mc);
1066
if (sb == NULL) {
735
1067
fprintf(stderr, "Failed to create service browser: %s\n",
736
avahi_strerror(avahi_server_errno(server)));
737
returncode = EXIT_FAILURE;
738
goto exit;
1068
avahi_strerror(avahi_server_errno(mc.server)));
1069
exitcode = EXIT_FAILURE;
1070
goto end;
739
1071
}
740
1072
741
1073
/* Run the main loop */
742
1074
743
1075
if (debug){
744
fprintf(stderr, "Starting avahi loop search\n");
1076
fprintf(stderr, "Starting Avahi loop search\n");
745
1077
}
746
1078
747
avahi_simple_poll_loop(simple_poll);
748
749
exit:
750
1079
avahi_simple_poll_loop(mc.simple_poll);
1080
1081
end:
1082
751
1083
if (debug){
752
1084
fprintf(stderr, "%s exiting\n", argv[0]);
753
1085
}
754
1086
755
1087
/* Cleanup things */
756
if (sb)
1088
if (sb != NULL)
757
1089
avahi_s_service_browser_free(sb);
758
1090
759
if (server)
760
avahi_server_free(server);
761
762
if (simple_poll)
763
avahi_simple_poll_free(simple_poll);
764
765
return returncode;
1091
if (mc.server != NULL)
1092
avahi_server_free(mc.server);
1093
1094
if (mc.simple_poll != NULL)
1095
avahi_simple_poll_free(mc.simple_poll);
1096
1097
if (gnutls_initalized){
1098
gnutls_certificate_free_credentials(mc.cred);
1099
gnutls_global_deinit ();
1100
gnutls_dh_params_deinit(mc.dh_params);
1101
}
1102
1103
if(gpgme_initalized){
1104
gpgme_release(mc.ctx);
1105
}
1106
1107
/* Removes the temp directory used by GPGME */
1108
if(tempdir[0] != '\0'){
1109
DIR *d;
1110
struct dirent *direntry;
1111
d = opendir(tempdir);
1112
if(d == NULL){
1113
perror("opendir");
1114
} else {
1115
while(true){
1116
direntry = readdir(d);
1117
if(direntry == NULL){
1118
break;
1119
}
1120
if (direntry->d_type == DT_REG){
1121
char *fullname = NULL;
1122
ret = asprintf(&fullname, "%s/%s", tempdir,
1123
direntry->d_name);
1124
if(ret < 0){
1125
perror("asprintf");
1126
continue;
1127
}
1128
ret = unlink(fullname);
1129
if(ret == -1){
1130
fprintf(stderr, "unlink(\"%s\"): %s",
1131
fullname, strerror(errno));
1132
}
1133
free(fullname);
1134
}
1135
}
1136
closedir(d);
1137
}
1138
ret = rmdir(tempdir);
1139
if(ret == -1){
1140
perror("rmdir");
1141
}
1142
}
1143
1144
return exitcode;
766
1145
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0