To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 256
- compare with another revision
- download diff
- download tarball
- view history from revision 256
- Committer: Teddy Hogeborn
- Date: 2009-05-17 00:50:09 UTC
- Revision ID: teddy@fukt.bsnet.se-20090517005009-c0iptxampo6nf177
* initramfs-tools-hook-conf: Security bug fix: Add code to handle
being called by "mkinitramfs-kpkg"
instead of "update-initramfs".
being called by "mkinitramfs-kpkg"
instead of "update-initramfs".
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
29
30
*/
30
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
32
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
33
37
#define _FILE_OFFSET_BITS 64
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
41
SIOCSIFFLAGS */
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
42
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
44
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), setuid(),
75
setgid() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sigaction,
84
sig_atomic_t */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
90
/* Avahi */
91
/* All Avahi types, constants and functions
92
Avahi*, avahi_*,
93
AVAHI_* */
45
94
#include <avahi-core/core.h>
46
95
#include <avahi-core/lookup.h>
47
96
#include <avahi-core/log.h>
49
98
#include <avahi-common/malloc.h>
50
99
#include <avahi-common/error.h>
51
100
52
//mandos client part
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
58
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
65
66
// gpgme
67
#include <errno.h> /* perror() */
68
#include <gpgme.h>
69
70
// getopt_long
71
#include <getopt.h>
101
/* GnuTLS */
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
103
functions:
104
gnutls_*
105
init_gnutls_session(),
106
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
110
111
/* GPGME */
112
#include <gpgme.h> /* All GPGME types, constants and
113
functions:
114
gpgme_*
115
GPGME_PROTOCOL_OpenPGP,
116
GPG_ERR_NO_* */
72
117
73
118
#define BUFFER_SIZE 256
74
119
75
static const char *keydir = "/conf/conf.d/mandos";
76
static const char *pubkeyfile = "pubkey.txt";
77
static const char *seckeyfile = "seckey.txt";
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
78
123
79
124
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
80
128
81
/* Used for passing in values through all the callback functions */
129
/* Used for passing in values through the Avahi callback functions */
82
130
typedef struct {
83
131
AvahiSimplePoll *simple_poll;
84
132
AvahiServer *server;
85
133
gnutls_certificate_credentials_t cred;
86
134
unsigned int dh_bits;
135
gnutls_dh_params_t dh_params;
87
136
const char *priority;
137
gpgme_ctx_t ctx;
88
138
} mandos_context;
89
139
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
/*
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
* bytes. "buffer_capacity" is how much is currently allocated,
148
* "buffer_length" is how much is already used.
149
*/
150
size_t incbuffer(char **buffer, size_t buffer_length,
151
size_t buffer_capacity){
152
if(buffer_length + BUFFER_SIZE > buffer_capacity){
153
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
154
if(buffer == NULL){
155
return 0;
156
}
157
buffer_capacity += BUFFER_SIZE;
158
}
159
return buffer_capacity;
160
}
161
90
162
/*
91
* Decrypt OpenPGP data using keyrings in HOMEDIR.
92
* Returns -1 on error
163
* Initialize GPGME.
93
164
*/
94
static ssize_t pgp_packet_decrypt (const char *cryptotext,
95
size_t crypto_size,
96
char **plaintext,
97
const char *homedir){
98
gpgme_data_t dh_crypto, dh_plain;
99
gpgme_ctx_t ctx;
165
static bool init_gpgme(const char *seckey,
166
const char *pubkey, const char *tempdir){
167
int ret;
100
168
gpgme_error_t rc;
101
ssize_t ret;
102
ssize_t plaintext_capacity = 0;
103
ssize_t plaintext_length = 0;
104
169
gpgme_engine_info_t engine_info;
105
170
106
if (debug){
107
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
171
172
/*
173
* Helper function to insert pub and seckey to the engine keyring.
174
*/
175
bool import_key(const char *filename){
176
int fd;
177
gpgme_data_t pgp_data;
178
179
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
180
if(fd == -1){
181
perror("open");
182
return false;
183
}
184
185
rc = gpgme_data_new_from_fd(&pgp_data, fd);
186
if(rc != GPG_ERR_NO_ERROR){
187
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
188
gpgme_strsource(rc), gpgme_strerror(rc));
189
return false;
190
}
191
192
rc = gpgme_op_import(mc.ctx, pgp_data);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
196
return false;
197
}
198
199
ret = (int)TEMP_FAILURE_RETRY(close(fd));
200
if(ret == -1){
201
perror("close");
202
}
203
gpgme_data_release(pgp_data);
204
return true;
205
}
206
207
if(debug){
208
fprintf(stderr, "Initializing GPGME\n");
108
209
}
109
210
110
211
/* Init GPGME */
111
212
gpgme_check_version(NULL);
112
213
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
113
if (rc != GPG_ERR_NO_ERROR){
214
if(rc != GPG_ERR_NO_ERROR){
114
215
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
115
216
gpgme_strsource(rc), gpgme_strerror(rc));
116
return -1;
217
return false;
117
218
}
118
219
119
/* Set GPGME home directory for the OpenPGP engine only */
120
rc = gpgme_get_engine_info (&engine_info);
121
if (rc != GPG_ERR_NO_ERROR){
220
/* Set GPGME home directory for the OpenPGP engine only */
221
rc = gpgme_get_engine_info(&engine_info);
222
if(rc != GPG_ERR_NO_ERROR){
122
223
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
123
224
gpgme_strsource(rc), gpgme_strerror(rc));
124
return -1;
225
return false;
125
226
}
126
227
while(engine_info != NULL){
127
228
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
128
229
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
129
engine_info->file_name, homedir);
230
engine_info->file_name, tempdir);
130
231
break;
131
232
}
132
233
engine_info = engine_info->next;
133
234
}
134
235
if(engine_info == NULL){
135
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
136
return -1;
236
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
237
return false;
238
}
239
240
/* Create new GPGME "context" */
241
rc = gpgme_new(&(mc.ctx));
242
if(rc != GPG_ERR_NO_ERROR){
243
fprintf(stderr, "bad gpgme_new: %s: %s\n",
244
gpgme_strsource(rc), gpgme_strerror(rc));
245
return false;
246
}
247
248
if(not import_key(pubkey) or not import_key(seckey)){
249
return false;
250
}
251
252
return true;
253
}
254
255
/*
256
* Decrypt OpenPGP data.
257
* Returns -1 on error
258
*/
259
static ssize_t pgp_packet_decrypt(const char *cryptotext,
260
size_t crypto_size,
261
char **plaintext){
262
gpgme_data_t dh_crypto, dh_plain;
263
gpgme_error_t rc;
264
ssize_t ret;
265
size_t plaintext_capacity = 0;
266
ssize_t plaintext_length = 0;
267
268
if(debug){
269
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
137
270
}
138
271
139
272
/* Create new GPGME data buffer from memory cryptotext */
140
273
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
141
274
0);
142
if (rc != GPG_ERR_NO_ERROR){
275
if(rc != GPG_ERR_NO_ERROR){
143
276
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
144
277
gpgme_strsource(rc), gpgme_strerror(rc));
145
278
return -1;
147
280
148
281
/* Create new empty GPGME data buffer for the plaintext */
149
282
rc = gpgme_data_new(&dh_plain);
150
if (rc != GPG_ERR_NO_ERROR){
283
if(rc != GPG_ERR_NO_ERROR){
151
284
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
152
285
gpgme_strsource(rc), gpgme_strerror(rc));
153
286
gpgme_data_release(dh_crypto);
154
287
return -1;
155
288
}
156
289
157
/* Create new GPGME "context" */
158
rc = gpgme_new(&ctx);
159
if (rc != GPG_ERR_NO_ERROR){
160
fprintf(stderr, "bad gpgme_new: %s: %s\n",
161
gpgme_strsource(rc), gpgme_strerror(rc));
162
plaintext_length = -1;
163
goto decrypt_end;
164
}
165
166
290
/* Decrypt data from the cryptotext data buffer to the plaintext
167
291
data buffer */
168
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
169
if (rc != GPG_ERR_NO_ERROR){
292
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
293
if(rc != GPG_ERR_NO_ERROR){
170
294
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
171
295
gpgme_strsource(rc), gpgme_strerror(rc));
172
296
plaintext_length = -1;
297
if(debug){
298
gpgme_decrypt_result_t result;
299
result = gpgme_op_decrypt_result(mc.ctx);
300
if(result == NULL){
301
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
302
} else {
303
fprintf(stderr, "Unsupported algorithm: %s\n",
304
result->unsupported_algorithm);
305
fprintf(stderr, "Wrong key usage: %u\n",
306
result->wrong_key_usage);
307
if(result->file_name != NULL){
308
fprintf(stderr, "File name: %s\n", result->file_name);
309
}
310
gpgme_recipient_t recipient;
311
recipient = result->recipients;
312
if(recipient){
313
while(recipient != NULL){
314
fprintf(stderr, "Public key algorithm: %s\n",
315
gpgme_pubkey_algo_name(recipient->pubkey_algo));
316
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
317
fprintf(stderr, "Secret key available: %s\n",
318
recipient->status == GPG_ERR_NO_SECKEY
319
? "No" : "Yes");
320
recipient = recipient->next;
321
}
322
}
323
}
324
}
173
325
goto decrypt_end;
174
326
}
175
327
177
329
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
178
330
}
179
331
180
if (debug){
181
gpgme_decrypt_result_t result;
182
result = gpgme_op_decrypt_result(ctx);
183
if (result == NULL){
184
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
185
} else {
186
fprintf(stderr, "Unsupported algorithm: %s\n",
187
result->unsupported_algorithm);
188
fprintf(stderr, "Wrong key usage: %d\n",
189
result->wrong_key_usage);
190
if(result->file_name != NULL){
191
fprintf(stderr, "File name: %s\n", result->file_name);
192
}
193
gpgme_recipient_t recipient;
194
recipient = result->recipients;
195
if(recipient){
196
while(recipient != NULL){
197
fprintf(stderr, "Public key algorithm: %s\n",
198
gpgme_pubkey_algo_name(recipient->pubkey_algo));
199
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
200
fprintf(stderr, "Secret key available: %s\n",
201
recipient->status == GPG_ERR_NO_SECKEY
202
? "No" : "Yes");
203
recipient = recipient->next;
204
}
205
}
206
}
207
}
208
209
332
/* Seek back to the beginning of the GPGME plaintext data buffer */
210
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
211
perror("pgpme_data_seek");
333
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
334
perror("gpgme_data_seek");
212
335
plaintext_length = -1;
213
336
goto decrypt_end;
214
337
}
215
338
216
339
*plaintext = NULL;
217
340
while(true){
218
if (plaintext_length + BUFFER_SIZE > plaintext_capacity){
219
*plaintext = realloc(*plaintext,
220
(unsigned int)plaintext_capacity
221
+ BUFFER_SIZE);
222
if (*plaintext == NULL){
223
perror("realloc");
341
plaintext_capacity = incbuffer(plaintext,
342
(size_t)plaintext_length,
343
plaintext_capacity);
344
if(plaintext_capacity == 0){
345
perror("incbuffer");
224
346
plaintext_length = -1;
225
347
goto decrypt_end;
226
}
227
plaintext_capacity += BUFFER_SIZE;
228
348
}
229
349
230
350
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
231
351
BUFFER_SIZE);
232
352
/* Print the data, if any */
233
if (ret == 0){
353
if(ret == 0){
234
354
/* EOF */
235
355
break;
236
356
}
241
361
}
242
362
plaintext_length += ret;
243
363
}
244
364
245
365
if(debug){
246
366
fprintf(stderr, "Decrypted password is: ");
247
for(size_t i = 0; i < plaintext_length; i++){
367
for(ssize_t i = 0; i < plaintext_length; i++){
248
368
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
249
369
}
250
370
fprintf(stderr, "\n");
260
380
return plaintext_length;
261
381
}
262
382
263
static const char * safer_gnutls_strerror (int value) {
264
const char *ret = gnutls_strerror (value);
265
if (ret == NULL)
383
static const char * safer_gnutls_strerror(int value){
384
const char *ret = gnutls_strerror(value); /* Spurious warning from
385
-Wunreachable-code */
386
if(ret == NULL)
266
387
ret = "(unknown)";
267
388
return ret;
268
389
}
269
390
391
/* GnuTLS log function callback */
270
392
static void debuggnutls(__attribute__((unused)) int level,
271
393
const char* string){
272
fprintf(stderr, "%s", string);
394
fprintf(stderr, "GnuTLS: %s", string);
273
395
}
274
396
275
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
276
gnutls_dh_params_t *dh_params){
277
const char *err;
397
static int init_gnutls_global(const char *pubkeyfilename,
398
const char *seckeyfilename){
278
399
int ret;
279
400
280
401
if(debug){
281
402
fprintf(stderr, "Initializing GnuTLS\n");
282
403
}
283
284
if ((ret = gnutls_global_init ())
285
!= GNUTLS_E_SUCCESS) {
286
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
404
405
ret = gnutls_global_init();
406
if(ret != GNUTLS_E_SUCCESS){
407
fprintf(stderr, "GnuTLS global_init: %s\n",
408
safer_gnutls_strerror(ret));
287
409
return -1;
288
410
}
289
411
290
if (debug){
412
if(debug){
413
/* "Use a log level over 10 to enable all debugging options."
414
* - GnuTLS manual
415
*/
291
416
gnutls_global_set_log_level(11);
292
417
gnutls_global_set_log_function(debuggnutls);
293
418
}
294
419
295
/* openpgp credentials */
296
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
297
!= GNUTLS_E_SUCCESS) {
298
fprintf (stderr, "memory error: %s\n",
299
safer_gnutls_strerror(ret));
420
/* OpenPGP credentials */
421
gnutls_certificate_allocate_credentials(&mc.cred);
422
if(ret != GNUTLS_E_SUCCESS){
423
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
424
from
425
-Wunreachable-code
426
*/
427
safer_gnutls_strerror(ret));
428
gnutls_global_deinit();
300
429
return -1;
301
430
}
302
431
303
432
if(debug){
304
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
305
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
306
seckeyfile);
433
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
434
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
435
seckeyfilename);
307
436
}
308
437
309
438
ret = gnutls_certificate_set_openpgp_key_file
310
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
311
if (ret != GNUTLS_E_SUCCESS) {
312
fprintf
313
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
314
" '%s')\n",
315
ret, pubkeyfile, seckeyfile);
316
fprintf(stdout, "The Error is: %s\n",
317
safer_gnutls_strerror(ret));
318
return -1;
319
}
320
321
//GnuTLS server initialization
322
if ((ret = gnutls_dh_params_init(dh_params))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf (stderr, "Error in dh parameter initialization: %s\n",
325
safer_gnutls_strerror(ret));
326
return -1;
327
}
328
329
if ((ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits))
330
!= GNUTLS_E_SUCCESS) {
331
fprintf (stderr, "Error in prime generation: %s\n",
332
safer_gnutls_strerror(ret));
333
return -1;
334
}
335
336
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
337
338
// GnuTLS session creation
339
if ((ret = gnutls_init(session, GNUTLS_SERVER))
340
!= GNUTLS_E_SUCCESS){
439
(mc.cred, pubkeyfilename, seckeyfilename,
440
GNUTLS_OPENPGP_FMT_BASE64);
441
if(ret != GNUTLS_E_SUCCESS){
442
fprintf(stderr,
443
"Error[%d] while reading the OpenPGP key pair ('%s',"
444
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
445
fprintf(stderr, "The GnuTLS error is: %s\n",
446
safer_gnutls_strerror(ret));
447
goto globalfail;
448
}
449
450
/* GnuTLS server initialization */
451
ret = gnutls_dh_params_init(&mc.dh_params);
452
if(ret != GNUTLS_E_SUCCESS){
453
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
454
" %s\n", safer_gnutls_strerror(ret));
455
goto globalfail;
456
}
457
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
458
if(ret != GNUTLS_E_SUCCESS){
459
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
460
safer_gnutls_strerror(ret));
461
goto globalfail;
462
}
463
464
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
465
466
return 0;
467
468
globalfail:
469
470
gnutls_certificate_free_credentials(mc.cred);
471
gnutls_global_deinit();
472
gnutls_dh_params_deinit(mc.dh_params);
473
return -1;
474
}
475
476
static int init_gnutls_session(gnutls_session_t *session){
477
int ret;
478
/* GnuTLS session creation */
479
ret = gnutls_init(session, GNUTLS_SERVER);
480
if(ret != GNUTLS_E_SUCCESS){
341
481
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
342
482
safer_gnutls_strerror(ret));
343
483
}
344
484
345
if ((ret = gnutls_priority_set_direct(*session, mc->priority, &err))
346
!= GNUTLS_E_SUCCESS) {
347
fprintf(stderr, "Syntax error at: %s\n", err);
348
fprintf(stderr, "GnuTLS error: %s\n",
349
safer_gnutls_strerror(ret));
350
return -1;
485
{
486
const char *err;
487
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
488
if(ret != GNUTLS_E_SUCCESS){
489
fprintf(stderr, "Syntax error at: %s\n", err);
490
fprintf(stderr, "GnuTLS error: %s\n",
491
safer_gnutls_strerror(ret));
492
gnutls_deinit(*session);
493
return -1;
494
}
351
495
}
352
496
353
if ((ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
354
mc->cred))
355
!= GNUTLS_E_SUCCESS) {
356
fprintf(stderr, "Error setting a credentials set: %s\n",
497
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
498
mc.cred);
499
if(ret != GNUTLS_E_SUCCESS){
500
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
357
501
safer_gnutls_strerror(ret));
502
gnutls_deinit(*session);
358
503
return -1;
359
504
}
360
505
361
506
/* ignore client certificate if any. */
362
gnutls_certificate_server_set_request (*session,
363
GNUTLS_CERT_IGNORE);
507
gnutls_certificate_server_set_request(*session,
508
GNUTLS_CERT_IGNORE);
364
509
365
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
510
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
366
511
367
512
return 0;
368
513
}
369
514
515
/* Avahi log function callback */
370
516
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
371
517
__attribute__((unused)) const char *txt){}
372
518
519
/* Called when a Mandos server is found */
373
520
static int start_mandos_communication(const char *ip, uint16_t port,
374
521
AvahiIfIndex if_index,
375
mandos_context *mc){
522
int af){
376
523
int ret, tcp_sd;
377
struct sockaddr_in6 to;
524
ssize_t sret;
525
union {
526
struct sockaddr_in in;
527
struct sockaddr_in6 in6;
528
} to;
378
529
char *buffer = NULL;
379
530
char *decrypted_buffer;
380
531
size_t buffer_length = 0;
381
532
size_t buffer_capacity = 0;
382
533
ssize_t decrypted_buffer_size;
383
size_t written = 0;
534
size_t written;
384
535
int retval = 0;
385
char interface[IF_NAMESIZE];
386
536
gnutls_session_t session;
387
gnutls_dh_params_t dh_params;
537
int pf; /* Protocol family */
538
539
switch(af){
540
case AF_INET6:
541
pf = PF_INET6;
542
break;
543
case AF_INET:
544
pf = PF_INET;
545
break;
546
default:
547
fprintf(stderr, "Bad address family: %d\n", af);
548
return -1;
549
}
550
551
ret = init_gnutls_session(&session);
552
if(ret != 0){
553
return -1;
554
}
388
555
389
556
if(debug){
390
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
391
ip, port);
557
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
558
"\n", ip, port);
392
559
}
393
560
394
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
395
if(tcp_sd < 0) {
561
tcp_sd = socket(pf, SOCK_STREAM, 0);
562
if(tcp_sd < 0){
396
563
perror("socket");
397
564
return -1;
398
565
}
399
400
if(debug){
401
if(if_indextoname((unsigned int)if_index, interface) == NULL){
402
perror("if_indextoname");
403
return -1;
404
}
405
fprintf(stderr, "Binding to interface %s\n", interface);
406
}
407
566
408
memset(&to,0,sizeof(to)); /* Spurious warning */
409
to.sin6_family = AF_INET6;
410
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
411
if (ret < 0 ){
567
memset(&to, 0, sizeof(to));
568
if(af == AF_INET6){
569
to.in6.sin6_family = (uint16_t)af;
570
ret = inet_pton(af, ip, &to.in6.sin6_addr);
571
} else { /* IPv4 */
572
to.in.sin_family = (sa_family_t)af;
573
ret = inet_pton(af, ip, &to.in.sin_addr);
574
}
575
if(ret < 0 ){
412
576
perror("inet_pton");
413
577
return -1;
414
578
}
416
580
fprintf(stderr, "Bad address: %s\n", ip);
417
581
return -1;
418
582
}
419
to.sin6_port = htons(port); /* Spurious warning */
420
421
to.sin6_scope_id = (uint32_t)if_index;
583
if(af == AF_INET6){
584
to.in6.sin6_port = htons(port); /* Spurious warnings from
585
-Wconversion and
586
-Wunreachable-code */
587
588
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
589
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
590
-Wunreachable-code*/
591
if(if_index == AVAHI_IF_UNSPEC){
592
fprintf(stderr, "An IPv6 link-local address is incomplete"
593
" without a network interface\n");
594
return -1;
595
}
596
/* Set the network interface number as scope */
597
to.in6.sin6_scope_id = (uint32_t)if_index;
598
}
599
} else {
600
to.in.sin_port = htons(port); /* Spurious warnings from
601
-Wconversion and
602
-Wunreachable-code */
603
}
422
604
423
605
if(debug){
424
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
425
char addrstr[INET6_ADDRSTRLEN] = "";
426
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
427
sizeof(addrstr)) == NULL){
606
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
607
char interface[IF_NAMESIZE];
608
if(if_indextoname((unsigned int)if_index, interface) == NULL){
609
perror("if_indextoname");
610
} else {
611
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
612
ip, interface, port);
613
}
614
} else {
615
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
616
port);
617
}
618
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
619
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
620
const char *pcret;
621
if(af == AF_INET6){
622
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
623
sizeof(addrstr));
624
} else {
625
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
626
sizeof(addrstr));
627
}
628
if(pcret == NULL){
428
629
perror("inet_ntop");
429
630
} else {
430
631
if(strcmp(addrstr, ip) != 0){
433
634
}
434
635
}
435
636
436
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
437
if (ret < 0){
637
if(af == AF_INET6){
638
ret = connect(tcp_sd, &to.in6, sizeof(to));
639
} else {
640
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
641
}
642
if(ret < 0){
438
643
perror("connect");
439
644
return -1;
440
645
}
441
646
442
ret = initgnutls (mc, &session, &dh_params);
443
if (ret != 0){
444
retval = -1;
445
return -1;
647
const char *out = mandos_protocol_version;
648
written = 0;
649
while(true){
650
size_t out_size = strlen(out);
651
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
652
out_size - written));
653
if(ret == -1){
654
perror("write");
655
retval = -1;
656
goto mandos_end;
657
}
658
written += (size_t)ret;
659
if(written < out_size){
660
continue;
661
} else {
662
if(out == mandos_protocol_version){
663
written = 0;
664
out = "\r\n";
665
} else {
666
break;
667
}
668
}
446
669
}
447
670
448
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
449
450
671
if(debug){
451
672
fprintf(stderr, "Establishing TLS session with %s\n", ip);
452
673
}
453
674
454
ret = gnutls_handshake (session);
455
456
if (ret != GNUTLS_E_SUCCESS){
675
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
676
677
do{
678
ret = gnutls_handshake(session);
679
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
680
681
if(ret != GNUTLS_E_SUCCESS){
457
682
if(debug){
458
fprintf(stderr, "\n*** Handshake failed ***\n");
459
gnutls_perror (ret);
683
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
684
gnutls_perror(ret);
460
685
}
461
686
retval = -1;
462
goto exit;
687
goto mandos_end;
463
688
}
464
689
465
//Retrieve OpenPGP packet that contains the wanted password
690
/* Read OpenPGP packet that contains the wanted password */
466
691
467
692
if(debug){
468
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
693
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
469
694
ip);
470
695
}
471
696
472
697
while(true){
473
if (buffer_length + BUFFER_SIZE > buffer_capacity){
474
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
475
if (buffer == NULL){
476
perror("realloc");
477
goto exit;
478
}
479
buffer_capacity += BUFFER_SIZE;
698
buffer_capacity = incbuffer(&buffer, buffer_length,
699
buffer_capacity);
700
if(buffer_capacity == 0){
701
perror("incbuffer");
702
retval = -1;
703
goto mandos_end;
480
704
}
481
705
482
ret = gnutls_record_recv(session, buffer+buffer_length,
483
BUFFER_SIZE);
484
if (ret == 0){
706
sret = gnutls_record_recv(session, buffer+buffer_length,
707
BUFFER_SIZE);
708
if(sret == 0){
485
709
break;
486
710
}
487
if (ret < 0){
488
switch(ret){
711
if(sret < 0){
712
switch(sret){
489
713
case GNUTLS_E_INTERRUPTED:
490
714
case GNUTLS_E_AGAIN:
491
715
break;
492
716
case GNUTLS_E_REHANDSHAKE:
493
ret = gnutls_handshake (session);
494
if (ret < 0){
495
fprintf(stderr, "\n*** Handshake failed ***\n");
496
gnutls_perror (ret);
717
do{
718
ret = gnutls_handshake(session);
719
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
720
if(ret < 0){
721
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
722
gnutls_perror(ret);
497
723
retval = -1;
498
goto exit;
724
goto mandos_end;
499
725
}
500
726
break;
501
727
default:
502
728
fprintf(stderr, "Unknown error while reading data from"
503
" encrypted session with mandos server\n");
729
" encrypted session with Mandos server\n");
504
730
retval = -1;
505
gnutls_bye (session, GNUTLS_SHUT_RDWR);
506
goto exit;
731
gnutls_bye(session, GNUTLS_SHUT_RDWR);
732
goto mandos_end;
507
733
}
508
734
} else {
509
buffer_length += (size_t) ret;
735
buffer_length += (size_t) sret;
510
736
}
511
737
}
512
738
513
if (buffer_length > 0){
739
if(debug){
740
fprintf(stderr, "Closing TLS session\n");
741
}
742
743
gnutls_bye(session, GNUTLS_SHUT_RDWR);
744
745
if(buffer_length > 0){
514
746
decrypted_buffer_size = pgp_packet_decrypt(buffer,
515
747
buffer_length,
516
&decrypted_buffer,
517
keydir);
518
if (decrypted_buffer_size >= 0){
748
&decrypted_buffer);
749
if(decrypted_buffer_size >= 0){
750
written = 0;
519
751
while(written < (size_t) decrypted_buffer_size){
520
ret = (int)fwrite (decrypted_buffer + written, 1,
521
(size_t)decrypted_buffer_size - written,
522
stdout);
752
ret = (int)fwrite(decrypted_buffer + written, 1,
753
(size_t)decrypted_buffer_size - written,
754
stdout);
523
755
if(ret == 0 and ferror(stdout)){
524
756
if(debug){
525
757
fprintf(stderr, "Error writing encrypted data: %s\n",
534
766
} else {
535
767
retval = -1;
536
768
}
537
}
538
539
//shutdown procedure
540
541
if(debug){
542
fprintf(stderr, "Closing TLS session\n");
543
}
544
769
} else {
770
retval = -1;
771
}
772
773
/* Shutdown procedure */
774
775
mandos_end:
545
776
free(buffer);
546
gnutls_bye (session, GNUTLS_SHUT_RDWR);
547
exit:
548
close(tcp_sd);
549
gnutls_deinit (session);
550
gnutls_certificate_free_credentials (mc->cred);
551
gnutls_global_deinit ();
777
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
778
if(ret == -1){
779
perror("close");
780
}
781
gnutls_deinit(session);
552
782
return retval;
553
783
}
554
784
555
785
static void resolve_callback(AvahiSServiceResolver *r,
556
786
AvahiIfIndex interface,
557
AVAHI_GCC_UNUSED AvahiProtocol protocol,
787
AvahiProtocol proto,
558
788
AvahiResolverEvent event,
559
789
const char *name,
560
790
const char *type,
565
795
AVAHI_GCC_UNUSED AvahiStringList *txt,
566
796
AVAHI_GCC_UNUSED AvahiLookupResultFlags
567
797
flags,
568
void* userdata) {
569
mandos_context *mc = userdata;
570
assert(r); /* Spurious warning */
798
AVAHI_GCC_UNUSED void* userdata){
799
assert(r);
571
800
572
801
/* Called whenever a service has been resolved successfully or
573
802
timed out */
574
803
575
switch (event) {
804
switch(event){
576
805
default:
577
806
case AVAHI_RESOLVER_FAILURE:
578
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
579
" type '%s' in domain '%s': %s\n", name, type, domain,
580
avahi_strerror(avahi_server_errno(mc->server)));
807
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
808
" of type '%s' in domain '%s': %s\n", name, type, domain,
809
avahi_strerror(avahi_server_errno(mc.server)));
581
810
break;
582
811
583
812
case AVAHI_RESOLVER_FOUND:
585
814
char ip[AVAHI_ADDRESS_STR_MAX];
586
815
avahi_address_snprint(ip, sizeof(ip), address);
587
816
if(debug){
588
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
589
" port %d\n", name, host_name, ip, port);
817
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
818
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
819
ip, (intmax_t)interface, port);
590
820
}
591
int ret = start_mandos_communication(ip, port, interface, mc);
592
if (ret == 0){
593
exit(EXIT_SUCCESS);
821
int ret = start_mandos_communication(ip, port, interface,
822
avahi_proto_to_af(proto));
823
if(ret == 0){
824
avahi_simple_poll_quit(mc.simple_poll);
594
825
}
595
826
}
596
827
}
597
828
avahi_s_service_resolver_free(r);
598
829
}
599
830
600
static void browse_callback( AvahiSServiceBrowser *b,
601
AvahiIfIndex interface,
602
AvahiProtocol protocol,
603
AvahiBrowserEvent event,
604
const char *name,
605
const char *type,
606
const char *domain,
607
AVAHI_GCC_UNUSED AvahiLookupResultFlags
608
flags,
609
void* userdata) {
610
mandos_context *mc = userdata;
611
assert(b); /* Spurious warning */
831
static void browse_callback(AvahiSServiceBrowser *b,
832
AvahiIfIndex interface,
833
AvahiProtocol protocol,
834
AvahiBrowserEvent event,
835
const char *name,
836
const char *type,
837
const char *domain,
838
AVAHI_GCC_UNUSED AvahiLookupResultFlags
839
flags,
840
AVAHI_GCC_UNUSED void* userdata){
841
assert(b);
612
842
613
843
/* Called whenever a new services becomes available on the LAN or
614
844
is removed from the LAN */
615
845
616
switch (event) {
846
switch(event){
617
847
default:
618
848
case AVAHI_BROWSER_FAILURE:
619
849
620
fprintf(stderr, "(Browser) %s\n",
621
avahi_strerror(avahi_server_errno(mc->server)));
622
avahi_simple_poll_quit(mc->simple_poll);
850
fprintf(stderr, "(Avahi browser) %s\n",
851
avahi_strerror(avahi_server_errno(mc.server)));
852
avahi_simple_poll_quit(mc.simple_poll);
623
853
return;
624
854
625
855
case AVAHI_BROWSER_NEW:
626
/* We ignore the returned resolver object. In the callback
627
function we free it. If the server is terminated before
628
the callback function is called the server will free
629
the resolver for us. */
856
/* We ignore the returned Avahi resolver object. In the callback
857
function we free it. If the Avahi server is terminated before
858
the callback function is called the Avahi server will free the
859
resolver for us. */
630
860
631
if (!(avahi_s_service_resolver_new(mc->server, interface,
632
protocol, name, type, domain,
633
AVAHI_PROTO_INET6, 0,
634
resolve_callback, mc)))
635
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
636
avahi_strerror(avahi_server_errno(mc->server)));
861
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
862
name, type, domain, protocol, 0,
863
resolve_callback, NULL) == NULL)
864
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
865
name, avahi_strerror(avahi_server_errno(mc.server)));
637
866
break;
638
867
639
868
case AVAHI_BROWSER_REMOVE:
641
870
642
871
case AVAHI_BROWSER_ALL_FOR_NOW:
643
872
case AVAHI_BROWSER_CACHE_EXHAUSTED:
873
if(debug){
874
fprintf(stderr, "No Mandos server found, still searching...\n");
875
}
644
876
break;
645
877
}
646
878
}
647
879
648
/* Combines file name and path and returns the malloced new
649
string. some sane checks could/should be added */
650
static const char *combinepath(const char *first, const char *second){
651
size_t f_len = strlen(first);
652
size_t s_len = strlen(second);
653
char *tmp = malloc(f_len + s_len + 2);
654
if (tmp == NULL){
655
return NULL;
656
}
657
if(f_len > 0){
658
memcpy(tmp, first, f_len); /* Spurious warning */
659
}
660
tmp[f_len] = '/';
661
if(s_len > 0){
662
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
663
}
664
tmp[f_len + 1 + s_len] = '\0';
665
return tmp;
880
sig_atomic_t quit_now = 0;
881
882
/* stop main loop after sigterm has been called */
883
static void handle_sigterm(__attribute__((unused)) int sig){
884
if(quit_now){
885
return;
886
}
887
quit_now = 1;
888
int old_errno = errno;
889
if(mc.simple_poll != NULL){
890
avahi_simple_poll_quit(mc.simple_poll);
891
}
892
errno = old_errno;
666
893
}
667
894
668
669
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
670
AvahiServerConfig config;
671
AvahiSServiceBrowser *sb = NULL;
672
int error;
673
int ret;
674
int debug_int;
675
int returncode = EXIT_SUCCESS;
676
const char *interface = "eth0";
677
struct ifreq network;
678
int sd;
679
char *connect_to = NULL;
680
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
681
mandos_context mc = { .simple_poll = NULL, .server = NULL,
682
.dh_bits = 1024, .priority = "SECURE256"};
895
int main(int argc, char *argv[]){
896
AvahiSServiceBrowser *sb = NULL;
897
int error;
898
int ret;
899
intmax_t tmpmax;
900
char *tmp;
901
int exitcode = EXIT_SUCCESS;
902
const char *interface = "eth0";
903
struct ifreq network;
904
int sd;
905
uid_t uid;
906
gid_t gid;
907
char *connect_to = NULL;
908
char tempdir[] = "/tmp/mandosXXXXXX";
909
bool tempdir_created = false;
910
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
911
const char *seckey = PATHDIR "/" SECKEY;
912
const char *pubkey = PATHDIR "/" PUBKEY;
913
914
bool gnutls_initialized = false;
915
bool gpgme_initialized = false;
916
float delay = 2.5f;
917
918
struct sigaction old_sigterm_action;
919
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
920
921
{
922
struct argp_option options[] = {
923
{ .name = "debug", .key = 128,
924
.doc = "Debug mode", .group = 3 },
925
{ .name = "connect", .key = 'c',
926
.arg = "ADDRESS:PORT",
927
.doc = "Connect directly to a specific Mandos server",
928
.group = 1 },
929
{ .name = "interface", .key = 'i',
930
.arg = "NAME",
931
.doc = "Network interface that will be used to search for"
932
" Mandos servers",
933
.group = 1 },
934
{ .name = "seckey", .key = 's',
935
.arg = "FILE",
936
.doc = "OpenPGP secret key file base name",
937
.group = 1 },
938
{ .name = "pubkey", .key = 'p',
939
.arg = "FILE",
940
.doc = "OpenPGP public key file base name",
941
.group = 2 },
942
{ .name = "dh-bits", .key = 129,
943
.arg = "BITS",
944
.doc = "Bit length of the prime number used in the"
945
" Diffie-Hellman key exchange",
946
.group = 2 },
947
{ .name = "priority", .key = 130,
948
.arg = "STRING",
949
.doc = "GnuTLS priority string for the TLS handshake",
950
.group = 1 },
951
{ .name = "delay", .key = 131,
952
.arg = "SECONDS",
953
.doc = "Maximum delay to wait for interface startup",
954
.group = 2 },
955
{ .name = NULL }
956
};
683
957
684
debug_int = debug ? 1 : 0;
685
while (true){
686
struct option long_options[] = {
687
{"debug", no_argument, &debug_int, 1},
688
{"connect", required_argument, NULL, 'c'},
689
{"interface", required_argument, NULL, 'i'},
690
{"keydir", required_argument, NULL, 'd'},
691
{"seckey", required_argument, NULL, 's'},
692
{"pubkey", required_argument, NULL, 'p'},
693
{"dh-bits", required_argument, NULL, 'D'},
694
{"priority", required_argument, NULL, 'P'},
695
{0, 0, 0, 0} };
696
697
int option_index = 0;
698
ret = getopt_long (argc, argv, "i:", long_options,
699
&option_index);
700
701
if (ret == -1){
702
break;
703
}
704
705
switch(ret){
706
case 0:
707
break;
708
case 'i':
709
interface = optarg;
710
break;
711
case 'c':
712
connect_to = optarg;
713
break;
714
case 'd':
715
keydir = optarg;
716
break;
717
case 'p':
718
pubkeyfile = optarg;
719
break;
720
case 's':
721
seckeyfile = optarg;
722
break;
723
case 'D':
724
errno = 0;
725
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
726
if (errno){
727
perror("strtol");
728
exit(EXIT_FAILURE);
729
}
730
break;
731
case 'P':
732
mc.priority = optarg;
733
break;
734
case '?':
958
error_t parse_opt(int key, char *arg,
959
struct argp_state *state){
960
switch(key){
961
case 128: /* --debug */
962
debug = true;
963
break;
964
case 'c': /* --connect */
965
connect_to = arg;
966
break;
967
case 'i': /* --interface */
968
interface = arg;
969
break;
970
case 's': /* --seckey */
971
seckey = arg;
972
break;
973
case 'p': /* --pubkey */
974
pubkey = arg;
975
break;
976
case 129: /* --dh-bits */
977
errno = 0;
978
tmpmax = strtoimax(arg, &tmp, 10);
979
if(errno != 0 or tmp == arg or *tmp != '\0'
980
or tmpmax != (typeof(mc.dh_bits))tmpmax){
981
fprintf(stderr, "Bad number of DH bits\n");
982
exit(EXIT_FAILURE);
983
}
984
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
985
break;
986
case 130: /* --priority */
987
mc.priority = arg;
988
break;
989
case 131: /* --delay */
990
errno = 0;
991
delay = strtof(arg, &tmp);
992
if(errno != 0 or tmp == arg or *tmp != '\0'){
993
fprintf(stderr, "Bad delay\n");
994
exit(EXIT_FAILURE);
995
}
996
break;
997
case ARGP_KEY_ARG:
998
argp_usage(state);
999
case ARGP_KEY_END:
1000
break;
735
1001
default:
736
exit(EXIT_FAILURE);
737
}
738
}
739
debug = debug_int ? true : false;
740
741
pubkeyfile = combinepath(keydir, pubkeyfile);
742
if (pubkeyfile == NULL){
743
perror("combinepath");
744
returncode = EXIT_FAILURE;
745
goto exit;
746
}
747
748
seckeyfile = combinepath(keydir, seckeyfile);
749
if (seckeyfile == NULL){
750
perror("combinepath");
751
goto exit;
752
}
753
754
if_index = (AvahiIfIndex) if_nametoindex(interface);
755
if(if_index == 0){
756
fprintf(stderr, "No such interface: \"%s\"\n", interface);
757
exit(EXIT_FAILURE);
758
}
759
760
if(connect_to != NULL){
761
/* Connect directly, do not use Zeroconf */
762
/* (Mainly meant for debugging) */
763
char *address = strrchr(connect_to, ':');
764
if(address == NULL){
765
fprintf(stderr, "No colon in address\n");
766
exit(EXIT_FAILURE);
767
}
768
errno = 0;
769
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
770
if(errno){
771
perror("Bad port number");
772
exit(EXIT_FAILURE);
773
}
774
*address = '\0';
775
address = connect_to;
776
ret = start_mandos_communication(address, port, if_index, &mc);
777
if(ret < 0){
778
exit(EXIT_FAILURE);
779
} else {
780
exit(EXIT_SUCCESS);
781
}
782
}
1002
return ARGP_ERR_UNKNOWN;
1003
}
1004
return 0;
1005
}
1006
1007
struct argp argp = { .options = options, .parser = parse_opt,
1008
.args_doc = "",
1009
.doc = "Mandos client -- Get and decrypt"
1010
" passwords from a Mandos server" };
1011
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1012
if(ret == ARGP_ERR_UNKNOWN){
1013
fprintf(stderr, "Unknown error while parsing arguments\n");
1014
exitcode = EXIT_FAILURE;
1015
goto end;
1016
}
1017
}
1018
1019
if(not debug){
1020
avahi_set_log_function(empty_log);
1021
}
1022
1023
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1024
from the signal handler */
1025
/* Initialize the pseudo-RNG for Avahi */
1026
srand((unsigned int) time(NULL));
1027
mc.simple_poll = avahi_simple_poll_new();
1028
if(mc.simple_poll == NULL){
1029
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1030
exitcode = EXIT_FAILURE;
1031
goto end;
1032
}
1033
1034
sigemptyset(&sigterm_action.sa_mask);
1035
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1036
if(ret == -1){
1037
perror("sigaddset");
1038
exitcode = EXIT_FAILURE;
1039
goto end;
1040
}
1041
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1042
if(ret == -1){
1043
perror("sigaddset");
1044
exitcode = EXIT_FAILURE;
1045
goto end;
1046
}
1047
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1048
if(ret == -1){
1049
perror("sigaddset");
1050
exitcode = EXIT_FAILURE;
1051
goto end;
1052
}
1053
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1054
if(ret == -1){
1055
perror("sigaction");
1056
exitcode = EXIT_FAILURE;
1057
goto end;
1058
}
1059
1060
/* If the interface is down, bring it up */
1061
if(interface[0] != '\0'){
1062
#ifdef __linux__
1063
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1064
messages to mess up the prompt */
1065
ret = klogctl(8, NULL, 5);
1066
bool restore_loglevel = true;
1067
if(ret == -1){
1068
restore_loglevel = false;
1069
perror("klogctl");
1070
}
1071
#endif /* __linux__ */
783
1072
784
1073
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
785
if(sd < 0) {
1074
if(sd < 0){
786
1075
perror("socket");
787
returncode = EXIT_FAILURE;
788
goto exit;
1076
exitcode = EXIT_FAILURE;
1077
#ifdef __linux__
1078
if(restore_loglevel){
1079
ret = klogctl(7, NULL, 0);
1080
if(ret == -1){
1081
perror("klogctl");
1082
}
1083
}
1084
#endif /* __linux__ */
1085
goto end;
789
1086
}
790
strcpy(network.ifr_name, interface); /* Spurious warning */
1087
strcpy(network.ifr_name, interface);
791
1088
ret = ioctl(sd, SIOCGIFFLAGS, &network);
792
1089
if(ret == -1){
793
794
1090
perror("ioctl SIOCGIFFLAGS");
795
returncode = EXIT_FAILURE;
796
goto exit;
1091
#ifdef __linux__
1092
if(restore_loglevel){
1093
ret = klogctl(7, NULL, 0);
1094
if(ret == -1){
1095
perror("klogctl");
1096
}
1097
}
1098
#endif /* __linux__ */
1099
exitcode = EXIT_FAILURE;
1100
goto end;
797
1101
}
798
1102
if((network.ifr_flags & IFF_UP) == 0){
799
1103
network.ifr_flags |= IFF_UP;
800
1104
ret = ioctl(sd, SIOCSIFFLAGS, &network);
801
1105
if(ret == -1){
802
1106
perror("ioctl SIOCSIFFLAGS");
803
returncode = EXIT_FAILURE;
804
goto exit;
805
}
806
}
807
close(sd);
808
809
if (not debug){
810
avahi_set_log_function(empty_log);
811
}
812
813
/* Initialize the psuedo-RNG */
814
srand((unsigned int) time(NULL));
815
816
/* Allocate main loop object */
817
if (!(mc.simple_poll = avahi_simple_poll_new())) {
818
fprintf(stderr, "Failed to create simple poll object.\n");
819
returncode = EXIT_FAILURE;
820
goto exit;
821
}
822
823
/* Do not publish any local records */
1107
exitcode = EXIT_FAILURE;
1108
#ifdef __linux__
1109
if(restore_loglevel){
1110
ret = klogctl(7, NULL, 0);
1111
if(ret == -1){
1112
perror("klogctl");
1113
}
1114
}
1115
#endif /* __linux__ */
1116
goto end;
1117
}
1118
}
1119
/* sleep checking until interface is running */
1120
for(int i=0; i < delay * 4; i++){
1121
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1122
if(ret == -1){
1123
perror("ioctl SIOCGIFFLAGS");
1124
} else if(network.ifr_flags & IFF_RUNNING){
1125
break;
1126
}
1127
struct timespec sleeptime = { .tv_nsec = 250000000 };
1128
ret = nanosleep(&sleeptime, NULL);
1129
if(ret == -1 and errno != EINTR){
1130
perror("nanosleep");
1131
}
1132
}
1133
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1134
if(ret == -1){
1135
perror("close");
1136
}
1137
#ifdef __linux__
1138
if(restore_loglevel){
1139
/* Restores kernel loglevel to default */
1140
ret = klogctl(7, NULL, 0);
1141
if(ret == -1){
1142
perror("klogctl");
1143
}
1144
}
1145
#endif /* __linux__ */
1146
}
1147
1148
uid = getuid();
1149
gid = getgid();
1150
1151
errno = 0;
1152
setgid(gid);
1153
if(ret == -1){
1154
perror("setgid");
1155
}
1156
1157
ret = setuid(uid);
1158
if(ret == -1){
1159
perror("setuid");
1160
}
1161
1162
ret = init_gnutls_global(pubkey, seckey);
1163
if(ret == -1){
1164
fprintf(stderr, "init_gnutls_global failed\n");
1165
exitcode = EXIT_FAILURE;
1166
goto end;
1167
} else {
1168
gnutls_initialized = true;
1169
}
1170
1171
if(mkdtemp(tempdir) == NULL){
1172
perror("mkdtemp");
1173
goto end;
1174
}
1175
tempdir_created = true;
1176
1177
if(not init_gpgme(pubkey, seckey, tempdir)){
1178
fprintf(stderr, "init_gpgme failed\n");
1179
exitcode = EXIT_FAILURE;
1180
goto end;
1181
} else {
1182
gpgme_initialized = true;
1183
}
1184
1185
if(interface[0] != '\0'){
1186
if_index = (AvahiIfIndex) if_nametoindex(interface);
1187
if(if_index == 0){
1188
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1189
exitcode = EXIT_FAILURE;
1190
goto end;
1191
}
1192
}
1193
1194
if(connect_to != NULL){
1195
/* Connect directly, do not use Zeroconf */
1196
/* (Mainly meant for debugging) */
1197
char *address = strrchr(connect_to, ':');
1198
if(address == NULL){
1199
fprintf(stderr, "No colon in address\n");
1200
exitcode = EXIT_FAILURE;
1201
goto end;
1202
}
1203
uint16_t port;
1204
errno = 0;
1205
tmpmax = strtoimax(address+1, &tmp, 10);
1206
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1207
or tmpmax != (uint16_t)tmpmax){
1208
fprintf(stderr, "Bad port number\n");
1209
exitcode = EXIT_FAILURE;
1210
goto end;
1211
}
1212
port = (uint16_t)tmpmax;
1213
*address = '\0';
1214
address = connect_to;
1215
/* Colon in address indicates IPv6 */
1216
int af;
1217
if(strchr(address, ':') != NULL){
1218
af = AF_INET6;
1219
} else {
1220
af = AF_INET;
1221
}
1222
ret = start_mandos_communication(address, port, if_index, af);
1223
if(ret < 0){
1224
exitcode = EXIT_FAILURE;
1225
} else {
1226
exitcode = EXIT_SUCCESS;
1227
}
1228
goto end;
1229
}
1230
1231
{
1232
AvahiServerConfig config;
1233
/* Do not publish any local Zeroconf records */
824
1234
avahi_server_config_init(&config);
825
1235
config.publish_hinfo = 0;
826
1236
config.publish_addresses = 0;
827
1237
config.publish_workstation = 0;
828
1238
config.publish_domain = 0;
829
1239
830
1240
/* Allocate a new server */
831
mc.server=avahi_server_new(avahi_simple_poll_get(mc.simple_poll),
832
&config, NULL, NULL, &error);
1241
mc.server = avahi_server_new(avahi_simple_poll_get
1242
(mc.simple_poll), &config, NULL,
1243
NULL, &error);
833
1244
834
/* Free the configuration data */
1245
/* Free the Avahi configuration data */
835
1246
avahi_server_config_free(&config);
836
837
/* Check if creating the server object succeeded */
838
if (!mc.server) {
839
fprintf(stderr, "Failed to create server: %s\n",
840
avahi_strerror(error));
841
returncode = EXIT_FAILURE;
842
goto exit;
843
}
844
845
/* Create the service browser */
846
sb = avahi_s_service_browser_new(mc.server, if_index,
847
AVAHI_PROTO_INET6,
848
"_mandos._tcp", NULL, 0,
849
browse_callback, &mc);
850
if (!sb) {
851
fprintf(stderr, "Failed to create service browser: %s\n",
852
avahi_strerror(avahi_server_errno(mc.server)));
853
returncode = EXIT_FAILURE;
854
goto exit;
855
}
856
857
/* Run the main loop */
858
859
if (debug){
860
fprintf(stderr, "Starting avahi loop search\n");
861
}
862
863
avahi_simple_poll_loop(mc.simple_poll);
864
865
exit:
866
867
if (debug){
868
fprintf(stderr, "%s exiting\n", argv[0]);
869
}
870
871
/* Cleanup things */
872
if (sb)
873
avahi_s_service_browser_free(sb);
874
875
if (mc.server)
876
avahi_server_free(mc.server);
877
878
if (mc.simple_poll)
879
avahi_simple_poll_free(mc.simple_poll);
880
free(pubkeyfile);
881
free(seckeyfile);
882
883
return returncode;
1247
}
1248
1249
/* Check if creating the Avahi server object succeeded */
1250
if(mc.server == NULL){
1251
fprintf(stderr, "Failed to create Avahi server: %s\n",
1252
avahi_strerror(error));
1253
exitcode = EXIT_FAILURE;
1254
goto end;
1255
}
1256
1257
/* Create the Avahi service browser */
1258
sb = avahi_s_service_browser_new(mc.server, if_index,
1259
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1260
NULL, 0, browse_callback, NULL);
1261
if(sb == NULL){
1262
fprintf(stderr, "Failed to create service browser: %s\n",
1263
avahi_strerror(avahi_server_errno(mc.server)));
1264
exitcode = EXIT_FAILURE;
1265
goto end;
1266
}
1267
1268
/* Run the main loop */
1269
1270
if(debug){
1271
fprintf(stderr, "Starting Avahi loop search\n");
1272
}
1273
1274
avahi_simple_poll_loop(mc.simple_poll);
1275
1276
end:
1277
1278
if(debug){
1279
fprintf(stderr, "%s exiting\n", argv[0]);
1280
}
1281
1282
/* Cleanup things */
1283
if(sb != NULL)
1284
avahi_s_service_browser_free(sb);
1285
1286
if(mc.server != NULL)
1287
avahi_server_free(mc.server);
1288
1289
if(mc.simple_poll != NULL)
1290
avahi_simple_poll_free(mc.simple_poll);
1291
1292
if(gnutls_initialized){
1293
gnutls_certificate_free_credentials(mc.cred);
1294
gnutls_global_deinit();
1295
gnutls_dh_params_deinit(mc.dh_params);
1296
}
1297
1298
if(gpgme_initialized){
1299
gpgme_release(mc.ctx);
1300
}
1301
1302
/* Removes the temp directory used by GPGME */
1303
if(tempdir_created){
1304
DIR *d;
1305
struct dirent *direntry;
1306
d = opendir(tempdir);
1307
if(d == NULL){
1308
if(errno != ENOENT){
1309
perror("opendir");
1310
}
1311
} else {
1312
while(true){
1313
direntry = readdir(d);
1314
if(direntry == NULL){
1315
break;
1316
}
1317
/* Skip "." and ".." */
1318
if(direntry->d_name[0] == '.'
1319
and (direntry->d_name[1] == '\0'
1320
or (direntry->d_name[1] == '.'
1321
and direntry->d_name[2] == '\0'))){
1322
continue;
1323
}
1324
char *fullname = NULL;
1325
ret = asprintf(&fullname, "%s/%s", tempdir,
1326
direntry->d_name);
1327
if(ret < 0){
1328
perror("asprintf");
1329
continue;
1330
}
1331
ret = remove(fullname);
1332
if(ret == -1){
1333
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1334
strerror(errno));
1335
}
1336
free(fullname);
1337
}
1338
closedir(d);
1339
}
1340
ret = rmdir(tempdir);
1341
if(ret == -1 and errno != ENOENT){
1342
perror("rmdir");
1343
}
1344
}
1345
1346
return exitcode;
884
1347
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0