To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 30
- compare with another revision
- download diff
- download tarball
- view history from revision 30
- Committer: Teddy Hogeborn
- Date: 2008-07-31 19:51:44 UTC
- mfrom: (24.1.5 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080731195144-yb37wz2sr1e6b3m4
Merge.
- files added:
- ca.pem
- files removed:
- .bzrignore
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/password-request.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
27
27
*
28
* Contact the authors at <mandos@fukt.bsnet.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
29
30
*/
30
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
32
33
#define _LARGEFILE_SOURCE
33
34
#define _FILE_OFFSET_BITS 64
34
35
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
36
37
#include <stdio.h> /* fprintf(), stderr, fwrite(),
38
stdout, ferror() */
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
42
srand() */
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), asprintf(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
sockaddr_in6, PF_INET6,
49
SOCK_STREAM, INET6_ADDRSTRLEN,
50
uid_t, gid_t, open(), opendir(), DIR */
51
#include <sys/stat.h> /* open() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton(),
54
connect() */
55
#include <fcntl.h> /* open() */
56
#include <dirent.h> /* opendir(), struct dirent, readdir() */
57
#include <inttypes.h> /* PRIu16 */
58
#include <assert.h> /* assert() */
59
#include <errno.h> /* perror(), errno */
60
#include <time.h> /* time() */
61
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
62
SIOCSIFFLAGS, if_indextoname(),
63
if_nametoindex(), IF_NAMESIZE */
64
#include <netinet/in.h>
65
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
66
getuid(), getgid(), setuid(),
67
setgid() */
68
#include <arpa/inet.h> /* inet_pton(), htons */
69
#include <iso646.h> /* not, and */
70
#include <argp.h> /* struct argp_option, error_t, struct
71
argp_state, struct argp,
72
argp_parse(), ARGP_KEY_ARG,
73
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
74
75
/* Avahi */
76
/* All Avahi types, constants and functions
77
Avahi*, avahi_*,
78
AVAHI_* */
36
#include <stdio.h>
37
#include <assert.h>
38
#include <stdlib.h>
39
#include <time.h>
40
#include <net/if.h> /* if_nametoindex */
41
79
42
#include <avahi-core/core.h>
80
43
#include <avahi-core/lookup.h>
81
44
#include <avahi-core/log.h>
83
46
#include <avahi-common/malloc.h>
84
47
#include <avahi-common/error.h>
85
48
86
/* GnuTLS */
87
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
88
functions:
89
gnutls_*
90
init_gnutls_session(),
91
GNUTLS_* */
92
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
93
GNUTLS_OPENPGP_FMT_BASE64 */
94
95
/* GPGME */
96
#include <gpgme.h> /* All GPGME types, constants and
97
functions:
98
gpgme_*
99
GPGME_PROTOCOL_OpenPGP,
100
GPG_ERR_NO_* */
49
//mandos client part
50
#include <sys/types.h> /* socket(), inet_pton() */
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
52
struct in6_addr, inet_pton() */
53
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
54
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
55
56
#include <unistd.h> /* close() */
57
#include <netinet/in.h>
58
#include <stdbool.h> /* true */
59
#include <string.h> /* memset */
60
#include <arpa/inet.h> /* inet_pton() */
61
#include <iso646.h> /* not */
62
63
// gpgme
64
#include <errno.h> /* perror() */
65
#include <gpgme.h>
66
67
// getopt long
68
#include <getopt.h>
101
69
102
70
#define BUFFER_SIZE 256
103
104
/*
105
#define PATHDIR "/conf/conf.d/mandos"
106
*/
107
108
#define PATHDIR "/conf/conf.d/mandos"
109
#define SECKEY "seckey.txt"
110
#define PUBKEY "pupkey.txt"
71
#define DH_BITS 1024
72
73
const char *certdir = "/conf/conf.d/cryptkeyreq/";
74
const char *certfile = "openpgp-client.txt";
75
const char *certkey = "openpgp-client-key.txt";
111
76
112
77
bool debug = false;
113
static const char mandos_protocol_version[] = "1";
114
const char *argp_program_version = "password-request 1.0";
115
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
116
78
117
/* Used for passing in values through the Avahi callback functions */
118
79
typedef struct {
119
AvahiSimplePoll *simple_poll;
120
AvahiServer *server;
80
gnutls_session_t session;
121
81
gnutls_certificate_credentials_t cred;
122
unsigned int dh_bits;
123
82
gnutls_dh_params_t dh_params;
124
const char *priority;
83
} encrypted_session;
84
85
86
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
87
char **new_packet, const char *homedir){
88
gpgme_data_t dh_crypto, dh_plain;
125
89
gpgme_ctx_t ctx;
126
} mandos_context;
127
128
/*
129
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
130
* "buffer_capacity" is how much is currently allocated,
131
* "buffer_length" is how much is already used.
132
*/
133
size_t adjustbuffer(char **buffer, size_t buffer_length,
134
size_t buffer_capacity){
135
if (buffer_length + BUFFER_SIZE > buffer_capacity){
136
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
137
if (buffer == NULL){
138
return 0;
139
}
140
buffer_capacity += BUFFER_SIZE;
141
}
142
return buffer_capacity;
143
}
144
145
/*
146
* Initialize GPGME.
147
*/
148
static bool init_gpgme(mandos_context *mc, const char *seckey,
149
const char *pubkey, const char *tempdir){
150
int ret;
151
90
gpgme_error_t rc;
91
ssize_t ret;
92
ssize_t new_packet_capacity = 0;
93
ssize_t new_packet_length = 0;
152
94
gpgme_engine_info_t engine_info;
153
95
154
155
/*
156
* Helper function to insert pub and seckey to the enigne keyring.
157
*/
158
bool import_key(const char *filename){
159
int fd;
160
gpgme_data_t pgp_data;
161
162
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
163
if(fd == -1){
164
perror("open");
165
return false;
166
}
167
168
rc = gpgme_data_new_from_fd(&pgp_data, fd);
169
if (rc != GPG_ERR_NO_ERROR){
170
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
171
gpgme_strsource(rc), gpgme_strerror(rc));
172
return false;
173
}
174
175
rc = gpgme_op_import(mc->ctx, pgp_data);
176
if (rc != GPG_ERR_NO_ERROR){
177
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
178
gpgme_strsource(rc), gpgme_strerror(rc));
179
return false;
180
}
181
182
ret = TEMP_FAILURE_RETRY(close(fd));
183
if(ret == -1){
184
perror("close");
185
}
186
gpgme_data_release(pgp_data);
187
return true;
188
}
189
190
96
if (debug){
191
fprintf(stderr, "Initialize gpgme\n");
97
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
192
98
}
193
99
194
100
/* Init GPGME */
195
101
gpgme_check_version(NULL);
196
102
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
197
103
if (rc != GPG_ERR_NO_ERROR){
198
104
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
199
105
gpgme_strsource(rc), gpgme_strerror(rc));
200
return false;
106
return -1;
201
107
}
202
203
/* Set GPGME home directory for the OpenPGP engine only */
108
109
/* Set GPGME home directory */
204
110
rc = gpgme_get_engine_info (&engine_info);
205
111
if (rc != GPG_ERR_NO_ERROR){
206
112
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
207
113
gpgme_strsource(rc), gpgme_strerror(rc));
208
return false;
114
return -1;
209
115
}
210
116
while(engine_info != NULL){
211
117
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
212
118
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
213
engine_info->file_name, tempdir);
119
engine_info->file_name, homedir);
214
120
break;
215
121
}
216
122
engine_info = engine_info->next;
217
123
}
218
124
if(engine_info == NULL){
219
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
220
return false;
221
}
222
223
/* Create new GPGME "context" */
224
rc = gpgme_new(&(mc->ctx));
225
if (rc != GPG_ERR_NO_ERROR){
226
fprintf(stderr, "bad gpgme_new: %s: %s\n",
227
gpgme_strsource(rc), gpgme_strerror(rc));
228
return false;
229
}
230
231
if (not import_key(pubkey) or not import_key(seckey)){
232
return false;
233
}
234
235
return true;
236
}
237
238
/*
239
* Decrypt OpenPGP data.
240
* Returns -1 on error
241
*/
242
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
243
const char *cryptotext,
244
size_t crypto_size,
245
char **plaintext){
246
gpgme_data_t dh_crypto, dh_plain;
247
gpgme_error_t rc;
248
ssize_t ret;
249
size_t plaintext_capacity = 0;
250
ssize_t plaintext_length = 0;
251
252
if (debug){
253
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
254
}
255
256
/* Create new GPGME data buffer from memory cryptotext */
257
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
258
0);
125
fprintf(stderr, "Could not set home dir to %s\n", homedir);
126
return -1;
127
}
128
129
/* Create new GPGME data buffer from packet buffer */
130
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
259
131
if (rc != GPG_ERR_NO_ERROR){
260
132
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
261
133
gpgme_strsource(rc), gpgme_strerror(rc));
267
139
if (rc != GPG_ERR_NO_ERROR){
268
140
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
269
141
gpgme_strsource(rc), gpgme_strerror(rc));
270
gpgme_data_release(dh_crypto);
271
return -1;
272
}
273
274
/* Decrypt data from the cryptotext data buffer to the plaintext
275
data buffer */
276
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
142
return -1;
143
}
144
145
/* Create new GPGME "context" */
146
rc = gpgme_new(&ctx);
147
if (rc != GPG_ERR_NO_ERROR){
148
fprintf(stderr, "bad gpgme_new: %s: %s\n",
149
gpgme_strsource(rc), gpgme_strerror(rc));
150
return -1;
151
}
152
153
/* Decrypt data from the FILE pointer to the plaintext data
154
buffer */
155
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
277
156
if (rc != GPG_ERR_NO_ERROR){
278
157
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
279
158
gpgme_strsource(rc), gpgme_strerror(rc));
280
plaintext_length = -1;
281
if (debug){
282
gpgme_decrypt_result_t result;
283
result = gpgme_op_decrypt_result(mc->ctx);
284
if (result == NULL){
285
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
286
} else {
287
fprintf(stderr, "Unsupported algorithm: %s\n",
288
result->unsupported_algorithm);
289
fprintf(stderr, "Wrong key usage: %u\n",
290
result->wrong_key_usage);
291
if(result->file_name != NULL){
292
fprintf(stderr, "File name: %s\n", result->file_name);
293
}
294
gpgme_recipient_t recipient;
295
recipient = result->recipients;
296
if(recipient){
297
while(recipient != NULL){
298
fprintf(stderr, "Public key algorithm: %s\n",
299
gpgme_pubkey_algo_name(recipient->pubkey_algo));
300
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
301
fprintf(stderr, "Secret key available: %s\n",
302
recipient->status == GPG_ERR_NO_SECKEY
303
? "No" : "Yes");
304
recipient = recipient->next;
305
}
159
return -1;
160
}
161
162
if(debug){
163
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
164
}
165
166
if (debug){
167
gpgme_decrypt_result_t result;
168
result = gpgme_op_decrypt_result(ctx);
169
if (result == NULL){
170
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
171
} else {
172
fprintf(stderr, "Unsupported algorithm: %s\n",
173
result->unsupported_algorithm);
174
fprintf(stderr, "Wrong key usage: %d\n",
175
result->wrong_key_usage);
176
if(result->file_name != NULL){
177
fprintf(stderr, "File name: %s\n", result->file_name);
178
}
179
gpgme_recipient_t recipient;
180
recipient = result->recipients;
181
if(recipient){
182
while(recipient != NULL){
183
fprintf(stderr, "Public key algorithm: %s\n",
184
gpgme_pubkey_algo_name(recipient->pubkey_algo));
185
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
186
fprintf(stderr, "Secret key available: %s\n",
187
recipient->status == GPG_ERR_NO_SECKEY
188
? "No" : "Yes");
189
recipient = recipient->next;
306
190
}
307
191
}
308
192
}
309
goto decrypt_end;
310
193
}
311
194
312
if(debug){
313
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
314
}
195
/* Delete the GPGME FILE pointer cryptotext data buffer */
196
gpgme_data_release(dh_crypto);
315
197
316
198
/* Seek back to the beginning of the GPGME plaintext data buffer */
317
199
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
318
200
perror("pgpme_data_seek");
319
plaintext_length = -1;
320
goto decrypt_end;
321
201
}
322
202
323
*plaintext = NULL;
203
*new_packet = 0;
324
204
while(true){
325
plaintext_capacity = adjustbuffer(plaintext,
326
(size_t)plaintext_length,
327
plaintext_capacity);
328
if (plaintext_capacity == 0){
329
perror("adjustbuffer");
330
plaintext_length = -1;
331
goto decrypt_end;
205
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
206
*new_packet = realloc(*new_packet,
207
(unsigned int)new_packet_capacity
208
+ BUFFER_SIZE);
209
if (*new_packet == NULL){
210
perror("realloc");
211
return -1;
212
}
213
new_packet_capacity += BUFFER_SIZE;
332
214
}
333
215
334
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
216
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
335
217
BUFFER_SIZE);
336
218
/* Print the data, if any */
337
219
if (ret == 0){
338
/* EOF */
339
220
break;
340
221
}
341
222
if(ret < 0){
342
223
perror("gpgme_data_read");
343
plaintext_length = -1;
344
goto decrypt_end;
345
}
346
plaintext_length += ret;
347
}
348
349
if(debug){
350
fprintf(stderr, "Decrypted password is: ");
351
for(ssize_t i = 0; i < plaintext_length; i++){
352
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
353
}
354
fprintf(stderr, "\n");
355
}
356
357
decrypt_end:
358
359
/* Delete the GPGME cryptotext data buffer */
360
gpgme_data_release(dh_crypto);
224
return -1;
225
}
226
new_packet_length += ret;
227
}
228
229
/* FIXME: check characters before printing to screen so to not print
230
terminal control characters */
231
/* if(debug){ */
232
/* fprintf(stderr, "decrypted password is: "); */
233
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
234
/* fprintf(stderr, "\n"); */
235
/* } */
361
236
362
237
/* Delete the GPGME plaintext data buffer */
363
238
gpgme_data_release(dh_plain);
364
return plaintext_length;
239
return new_packet_length;
365
240
}
366
241
367
242
static const char * safer_gnutls_strerror (int value) {
368
const char *ret = gnutls_strerror (value); /* Spurious warning */
243
const char *ret = gnutls_strerror (value);
369
244
if (ret == NULL)
370
245
ret = "(unknown)";
371
246
return ret;
372
247
}
373
248
374
/* GnuTLS log function callback */
375
static void debuggnutls(__attribute__((unused)) int level,
376
const char* string){
377
fprintf(stderr, "GnuTLS: %s", string);
249
void debuggnutls(__attribute__((unused)) int level,
250
const char* string){
251
fprintf(stderr, "%s", string);
378
252
}
379
253
380
static int init_gnutls_global(mandos_context *mc,
381
const char *pubkeyfilename,
382
const char *seckeyfilename){
254
int initgnutls(encrypted_session *es){
255
const char *err;
383
256
int ret;
384
257
385
258
if(debug){
386
259
fprintf(stderr, "Initializing GnuTLS\n");
387
260
}
388
389
ret = gnutls_global_init();
390
if (ret != GNUTLS_E_SUCCESS) {
391
fprintf (stderr, "GnuTLS global_init: %s\n",
392
safer_gnutls_strerror(ret));
261
262
if ((ret = gnutls_global_init ())
263
!= GNUTLS_E_SUCCESS) {
264
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
393
265
return -1;
394
266
}
395
267
396
268
if (debug){
397
/* "Use a log level over 10 to enable all debugging options."
398
* - GnuTLS manual
399
*/
400
269
gnutls_global_set_log_level(11);
401
270
gnutls_global_set_log_function(debuggnutls);
402
271
}
403
272
404
/* OpenPGP credentials */
405
gnutls_certificate_allocate_credentials(&mc->cred);
406
if (ret != GNUTLS_E_SUCCESS){
407
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
408
warning */
273
/* openpgp credentials */
274
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
275
!= GNUTLS_E_SUCCESS) {
276
fprintf (stderr, "memory error: %s\n",
409
277
safer_gnutls_strerror(ret));
410
gnutls_global_deinit ();
411
278
return -1;
412
279
}
413
280
414
281
if(debug){
415
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
416
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
417
seckeyfilename);
282
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
283
" and keyfile %s as GnuTLS credentials\n", certfile,
284
certkey);
418
285
}
419
286
420
287
ret = gnutls_certificate_set_openpgp_key_file
421
(mc->cred, pubkeyfilename, seckeyfilename,
422
GNUTLS_OPENPGP_FMT_BASE64);
288
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
423
289
if (ret != GNUTLS_E_SUCCESS) {
424
fprintf(stderr,
425
"Error[%d] while reading the OpenPGP key pair ('%s',"
426
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
427
fprintf(stderr, "The GnuTLS error is: %s\n",
290
fprintf
291
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
292
" '%s')\n",
293
ret, certfile, certkey);
294
fprintf(stdout, "The Error is: %s\n",
428
295
safer_gnutls_strerror(ret));
429
goto globalfail;
430
}
431
432
/* GnuTLS server initialization */
433
ret = gnutls_dh_params_init(&mc->dh_params);
434
if (ret != GNUTLS_E_SUCCESS) {
435
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
436
" %s\n", safer_gnutls_strerror(ret));
437
goto globalfail;
438
}
439
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
440
if (ret != GNUTLS_E_SUCCESS) {
441
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
442
safer_gnutls_strerror(ret));
443
goto globalfail;
444
}
445
446
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
447
448
return 0;
449
450
globalfail:
451
452
gnutls_certificate_free_credentials(mc->cred);
453
gnutls_global_deinit();
454
return -1;
455
}
456
457
static int init_gnutls_session(mandos_context *mc,
458
gnutls_session_t *session){
459
int ret;
460
/* GnuTLS session creation */
461
ret = gnutls_init(session, GNUTLS_SERVER);
462
if (ret != GNUTLS_E_SUCCESS){
296
return -1;
297
}
298
299
//GnuTLS server initialization
300
if ((ret = gnutls_dh_params_init (&es->dh_params))
301
!= GNUTLS_E_SUCCESS) {
302
fprintf (stderr, "Error in dh parameter initialization: %s\n",
303
safer_gnutls_strerror(ret));
304
return -1;
305
}
306
307
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
308
!= GNUTLS_E_SUCCESS) {
309
fprintf (stderr, "Error in prime generation: %s\n",
310
safer_gnutls_strerror(ret));
311
return -1;
312
}
313
314
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
315
316
// GnuTLS session creation
317
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
318
!= GNUTLS_E_SUCCESS){
463
319
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
464
320
safer_gnutls_strerror(ret));
465
321
}
466
322
467
{
468
const char *err;
469
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
470
if (ret != GNUTLS_E_SUCCESS) {
471
fprintf(stderr, "Syntax error at: %s\n", err);
472
fprintf(stderr, "GnuTLS error: %s\n",
473
safer_gnutls_strerror(ret));
474
gnutls_deinit (*session);
475
return -1;
476
}
323
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
324
!= GNUTLS_E_SUCCESS) {
325
fprintf(stderr, "Syntax error at: %s\n", err);
326
fprintf(stderr, "GnuTLS error: %s\n",
327
safer_gnutls_strerror(ret));
328
return -1;
477
329
}
478
330
479
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
480
mc->cred);
481
if (ret != GNUTLS_E_SUCCESS) {
482
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
331
if ((ret = gnutls_credentials_set
332
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
333
!= GNUTLS_E_SUCCESS) {
334
fprintf(stderr, "Error setting a credentials set: %s\n",
483
335
safer_gnutls_strerror(ret));
484
gnutls_deinit (*session);
485
336
return -1;
486
337
}
487
338
488
339
/* ignore client certificate if any. */
489
gnutls_certificate_server_set_request (*session,
340
gnutls_certificate_server_set_request (es->session,
490
341
GNUTLS_CERT_IGNORE);
491
342
492
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
343
gnutls_dh_set_prime_bits (es->session, DH_BITS);
493
344
494
345
return 0;
495
346
}
496
347
497
/* Avahi log function callback */
498
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
499
__attribute__((unused)) const char *txt){}
348
void empty_log(__attribute__((unused)) AvahiLogLevel level,
349
__attribute__((unused)) const char *txt){}
500
350
501
/* Called when a Mandos server is found */
502
static int start_mandos_communication(const char *ip, uint16_t port,
503
AvahiIfIndex if_index,
504
mandos_context *mc){
351
int start_mandos_communication(const char *ip, uint16_t port,
352
AvahiIfIndex if_index){
505
353
int ret, tcp_sd;
506
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
354
struct sockaddr_in6 to;
355
encrypted_session es;
507
356
char *buffer = NULL;
508
357
char *decrypted_buffer;
509
358
size_t buffer_length = 0;
510
359
size_t buffer_capacity = 0;
511
360
ssize_t decrypted_buffer_size;
512
size_t written;
361
size_t written = 0;
513
362
int retval = 0;
514
363
char interface[IF_NAMESIZE];
515
gnutls_session_t session;
516
517
ret = init_gnutls_session (mc, &session);
518
if (ret != 0){
519
return -1;
520
}
521
364
522
365
if(debug){
523
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
524
"\n", ip, port);
366
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
367
ip, port);
525
368
}
526
369
527
370
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
530
373
return -1;
531
374
}
532
375
533
if(debug){
534
if(if_indextoname((unsigned int)if_index, interface) == NULL){
376
if(if_indextoname((unsigned int)if_index, interface) == NULL){
377
if(debug){
535
378
perror("if_indextoname");
536
return -1;
537
379
}
380
return -1;
381
}
382
383
if(debug){
538
384
fprintf(stderr, "Binding to interface %s\n", interface);
539
385
}
540
386
541
memset(&to, 0, sizeof(to));
542
to.in6.sin6_family = AF_INET6;
543
/* It would be nice to have a way to detect if we were passed an
544
IPv4 address here. Now we assume an IPv6 address. */
545
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
387
memset(&to,0,sizeof(to)); /* Spurious warning */
388
to.sin6_family = AF_INET6;
389
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
546
390
if (ret < 0 ){
547
391
perror("inet_pton");
548
392
return -1;
549
}
393
}
550
394
if(ret == 0){
551
395
fprintf(stderr, "Bad address: %s\n", ip);
552
396
return -1;
553
397
}
554
to.in6.sin6_port = htons(port); /* Spurious warning */
398
to.sin6_port = htons(port); /* Spurious warning */
555
399
556
to.in6.sin6_scope_id = (uint32_t)if_index;
400
to.sin6_scope_id = (uint32_t)if_index;
557
401
558
402
if(debug){
559
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
560
port);
561
char addrstr[INET6_ADDRSTRLEN] = "";
562
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
563
sizeof(addrstr)) == NULL){
564
perror("inet_ntop");
565
} else {
566
if(strcmp(addrstr, ip) != 0){
567
fprintf(stderr, "Canonical address form: %s\n", addrstr);
568
}
569
}
403
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
404
/* char addrstr[INET6_ADDRSTRLEN]; */
405
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
406
/* sizeof(addrstr)) == NULL){ */
407
/* perror("inet_ntop"); */
408
/* } else { */
409
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
410
/* addrstr, ntohs(to.sin6_port)); */
411
/* } */
570
412
}
571
413
572
ret = connect(tcp_sd, &to.in, sizeof(to));
414
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
573
415
if (ret < 0){
574
416
perror("connect");
575
417
return -1;
576
418
}
577
419
578
const char *out = mandos_protocol_version;
579
written = 0;
580
while (true){
581
size_t out_size = strlen(out);
582
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
583
out_size - written));
584
if (ret == -1){
585
perror("write");
586
retval = -1;
587
goto mandos_end;
588
}
589
written += (size_t)ret;
590
if(written < out_size){
591
continue;
592
} else {
593
if (out == mandos_protocol_version){
594
written = 0;
595
out = "\r\n";
596
} else {
597
break;
598
}
599
}
420
ret = initgnutls (&es);
421
if (ret != 0){
422
retval = -1;
423
return -1;
600
424
}
601
425
426
gnutls_transport_set_ptr (es.session,
427
(gnutls_transport_ptr_t) tcp_sd);
428
602
429
if(debug){
603
430
fprintf(stderr, "Establishing TLS session with %s\n", ip);
604
431
}
605
432
606
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
607
608
do{
609
ret = gnutls_handshake (session);
610
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
433
ret = gnutls_handshake (es.session);
611
434
612
435
if (ret != GNUTLS_E_SUCCESS){
613
436
if(debug){
614
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
437
fprintf(stderr, "\n*** Handshake failed ***\n");
615
438
gnutls_perror (ret);
616
439
}
617
440
retval = -1;
618
goto mandos_end;
441
goto exit;
619
442
}
620
443
621
/* Read OpenPGP packet that contains the wanted password */
444
//Retrieve OpenPGP packet that contains the wanted password
622
445
623
446
if(debug){
624
447
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
625
448
ip);
626
449
}
627
450
628
451
while(true){
629
buffer_capacity = adjustbuffer(&buffer, buffer_length,
630
buffer_capacity);
631
if (buffer_capacity == 0){
632
perror("adjustbuffer");
633
retval = -1;
634
goto mandos_end;
452
if (buffer_length + BUFFER_SIZE > buffer_capacity){
453
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
454
if (buffer == NULL){
455
perror("realloc");
456
goto exit;
457
}
458
buffer_capacity += BUFFER_SIZE;
635
459
}
636
460
637
ret = gnutls_record_recv(session, buffer+buffer_length,
638
BUFFER_SIZE);
461
ret = gnutls_record_recv
462
(es.session, buffer+buffer_length, BUFFER_SIZE);
639
463
if (ret == 0){
640
464
break;
641
465
}
645
469
case GNUTLS_E_AGAIN:
646
470
break;
647
471
case GNUTLS_E_REHANDSHAKE:
648
do{
649
ret = gnutls_handshake (session);
650
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
472
ret = gnutls_handshake (es.session);
651
473
if (ret < 0){
652
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
474
fprintf(stderr, "\n*** Handshake failed ***\n");
653
475
gnutls_perror (ret);
654
476
retval = -1;
655
goto mandos_end;
477
goto exit;
656
478
}
657
479
break;
658
480
default:
659
481
fprintf(stderr, "Unknown error while reading data from"
660
" encrypted session with Mandos server\n");
482
" encrypted session with mandos server\n");
661
483
retval = -1;
662
gnutls_bye (session, GNUTLS_SHUT_RDWR);
663
goto mandos_end;
484
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
485
goto exit;
664
486
}
665
487
} else {
666
488
buffer_length += (size_t) ret;
667
489
}
668
490
}
669
491
670
if(debug){
671
fprintf(stderr, "Closing TLS session\n");
672
}
673
674
gnutls_bye (session, GNUTLS_SHUT_RDWR);
675
676
492
if (buffer_length > 0){
677
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
493
decrypted_buffer_size = pgp_packet_decrypt(buffer,
678
494
buffer_length,
679
&decrypted_buffer);
495
&decrypted_buffer,
496
certdir);
680
497
if (decrypted_buffer_size >= 0){
681
written = 0;
682
498
while(written < (size_t) decrypted_buffer_size){
683
499
ret = (int)fwrite (decrypted_buffer + written, 1,
684
500
(size_t)decrypted_buffer_size - written,
697
513
} else {
698
514
retval = -1;
699
515
}
700
} else {
701
retval = -1;
702
}
703
704
/* Shutdown procedure */
705
706
mandos_end:
516
}
517
518
//shutdown procedure
519
520
if(debug){
521
fprintf(stderr, "Closing TLS session\n");
522
}
523
707
524
free(buffer);
708
ret = TEMP_FAILURE_RETRY(close(tcp_sd));
709
if(ret == -1){
710
perror("close");
711
}
712
gnutls_deinit (session);
525
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
526
exit:
527
close(tcp_sd);
528
gnutls_deinit (es.session);
529
gnutls_certificate_free_credentials (es.cred);
530
gnutls_global_deinit ();
713
531
return retval;
714
532
}
715
533
716
static void resolve_callback(AvahiSServiceResolver *r,
717
AvahiIfIndex interface,
718
AVAHI_GCC_UNUSED AvahiProtocol protocol,
719
AvahiResolverEvent event,
720
const char *name,
721
const char *type,
722
const char *domain,
723
const char *host_name,
724
const AvahiAddress *address,
725
uint16_t port,
726
AVAHI_GCC_UNUSED AvahiStringList *txt,
727
AVAHI_GCC_UNUSED AvahiLookupResultFlags
728
flags,
729
void* userdata) {
730
mandos_context *mc = userdata;
731
assert(r);
534
static AvahiSimplePoll *simple_poll = NULL;
535
static AvahiServer *server = NULL;
536
537
static void resolve_callback(
538
AvahiSServiceResolver *r,
539
AvahiIfIndex interface,
540
AVAHI_GCC_UNUSED AvahiProtocol protocol,
541
AvahiResolverEvent event,
542
const char *name,
543
const char *type,
544
const char *domain,
545
const char *host_name,
546
const AvahiAddress *address,
547
uint16_t port,
548
AVAHI_GCC_UNUSED AvahiStringList *txt,
549
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
550
AVAHI_GCC_UNUSED void* userdata) {
551
552
assert(r); /* Spurious warning */
732
553
733
554
/* Called whenever a service has been resolved successfully or
734
555
timed out */
736
557
switch (event) {
737
558
default:
738
559
case AVAHI_RESOLVER_FAILURE:
739
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
740
" of type '%s' in domain '%s': %s\n", name, type, domain,
741
avahi_strerror(avahi_server_errno(mc->server)));
560
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
561
" type '%s' in domain '%s': %s\n", name, type, domain,
562
avahi_strerror(avahi_server_errno(server)));
742
563
break;
743
564
744
565
case AVAHI_RESOLVER_FOUND:
746
567
char ip[AVAHI_ADDRESS_STR_MAX];
747
568
avahi_address_snprint(ip, sizeof(ip), address);
748
569
if(debug){
749
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
750
PRIu16 ") on port %d\n", name, host_name, ip,
751
interface, port);
570
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
571
" port %d\n", name, host_name, ip, port);
752
572
}
753
int ret = start_mandos_communication(ip, port, interface, mc);
573
int ret = start_mandos_communication(ip, port, interface);
754
574
if (ret == 0){
755
avahi_simple_poll_quit(mc->simple_poll);
575
exit(EXIT_SUCCESS);
756
576
}
757
577
}
758
578
}
759
579
avahi_s_service_resolver_free(r);
760
580
}
761
581
762
static void browse_callback( AvahiSServiceBrowser *b,
763
AvahiIfIndex interface,
764
AvahiProtocol protocol,
765
AvahiBrowserEvent event,
766
const char *name,
767
const char *type,
768
const char *domain,
769
AVAHI_GCC_UNUSED AvahiLookupResultFlags
770
flags,
771
void* userdata) {
772
mandos_context *mc = userdata;
773
assert(b);
774
775
/* Called whenever a new services becomes available on the LAN or
776
is removed from the LAN */
777
778
switch (event) {
779
default:
780
case AVAHI_BROWSER_FAILURE:
781
782
fprintf(stderr, "(Avahi browser) %s\n",
783
avahi_strerror(avahi_server_errno(mc->server)));
784
avahi_simple_poll_quit(mc->simple_poll);
785
return;
786
787
case AVAHI_BROWSER_NEW:
788
/* We ignore the returned Avahi resolver object. In the callback
789
function we free it. If the Avahi server is terminated before
790
the callback function is called the Avahi server will free the
791
resolver for us. */
792
793
if (!(avahi_s_service_resolver_new(mc->server, interface,
794
protocol, name, type, domain,
795
AVAHI_PROTO_INET6, 0,
796
resolve_callback, mc)))
797
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
798
name, avahi_strerror(avahi_server_errno(mc->server)));
799
break;
800
801
case AVAHI_BROWSER_REMOVE:
802
break;
803
804
case AVAHI_BROWSER_ALL_FOR_NOW:
805
case AVAHI_BROWSER_CACHE_EXHAUSTED:
806
if(debug){
807
fprintf(stderr, "No Mandos server found, still searching...\n");
582
static void browse_callback(
583
AvahiSServiceBrowser *b,
584
AvahiIfIndex interface,
585
AvahiProtocol protocol,
586
AvahiBrowserEvent event,
587
const char *name,
588
const char *type,
589
const char *domain,
590
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
591
void* userdata) {
592
593
AvahiServer *s = userdata;
594
assert(b); /* Spurious warning */
595
596
/* Called whenever a new services becomes available on the LAN or
597
is removed from the LAN */
598
599
switch (event) {
600
default:
601
case AVAHI_BROWSER_FAILURE:
602
603
fprintf(stderr, "(Browser) %s\n",
604
avahi_strerror(avahi_server_errno(server)));
605
avahi_simple_poll_quit(simple_poll);
606
return;
607
608
case AVAHI_BROWSER_NEW:
609
/* We ignore the returned resolver object. In the callback
610
function we free it. If the server is terminated before
611
the callback function is called the server will free
612
the resolver for us. */
613
614
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
615
type, domain,
616
AVAHI_PROTO_INET6, 0,
617
resolve_callback, s)))
618
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
619
avahi_strerror(avahi_server_errno(s)));
620
break;
621
622
case AVAHI_BROWSER_REMOVE:
623
break;
624
625
case AVAHI_BROWSER_ALL_FOR_NOW:
626
case AVAHI_BROWSER_CACHE_EXHAUSTED:
627
break;
808
628
}
809
break;
810
}
811
}
812
813
int main(int argc, char *argv[]){
629
}
630
631
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
632
const char *combinepath(const char *first, const char *second){
633
char *tmp;
634
tmp = malloc(strlen(first) + strlen(second) + 2);
635
if (tmp == NULL){
636
perror("malloc");
637
return NULL;
638
}
639
strcpy(tmp, first);
640
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
641
strcat(tmp, "/");
642
}
643
strcat(tmp, second);
644
return tmp;
645
}
646
647
648
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
649
AvahiServerConfig config;
814
650
AvahiSServiceBrowser *sb = NULL;
815
651
int error;
816
652
int ret;
817
int exitcode = EXIT_SUCCESS;
818
const char *interface = "eth0";
819
struct ifreq network;
820
int sd;
821
uid_t uid;
822
gid_t gid;
653
int returncode = EXIT_SUCCESS;
654
const char *interface = NULL;
655
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
823
656
char *connect_to = NULL;
824
char tempdir[] = "/tmp/mandosXXXXXX";
825
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
826
const char *seckey = PATHDIR "/" SECKEY;
827
const char *pubkey = PATHDIR "/" PUBKEY;
828
829
mandos_context mc = { .simple_poll = NULL, .server = NULL,
830
.dh_bits = 1024, .priority = "SECURE256"
831
":!CTYPE-X.509:+CTYPE-OPENPGP" };
832
bool gnutls_initalized = false;
833
bool pgpme_initalized = false;
834
835
{
836
struct argp_option options[] = {
837
{ .name = "debug", .key = 128,
838
.doc = "Debug mode", .group = 3 },
839
{ .name = "connect", .key = 'c',
840
.arg = "ADDRESS:PORT",
841
.doc = "Connect directly to a specific Mandos server",
842
.group = 1 },
843
{ .name = "interface", .key = 'i',
844
.arg = "NAME",
845
.doc = "Interface that will be used to search for Mandos"
846
" servers",
847
.group = 1 },
848
{ .name = "seckey", .key = 's',
849
.arg = "FILE",
850
.doc = "OpenPGP secret key file base name",
851
.group = 1 },
852
{ .name = "pubkey", .key = 'p',
853
.arg = "FILE",
854
.doc = "OpenPGP public key file base name",
855
.group = 2 },
856
{ .name = "dh-bits", .key = 129,
857
.arg = "BITS",
858
.doc = "Bit length of the prime number used in the"
859
" Diffie-Hellman key exchange",
860
.group = 2 },
861
{ .name = "priority", .key = 130,
862
.arg = "STRING",
863
.doc = "GnuTLS priority string for the TLS handshake",
864
.group = 1 },
865
{ .name = NULL }
866
};
867
868
error_t parse_opt (int key, char *arg,
869
struct argp_state *state) {
870
/* Get the INPUT argument from `argp_parse', which we know is
871
a pointer to our plugin list pointer. */
872
switch (key) {
873
case 128: /* --debug */
874
debug = true;
875
break;
876
case 'c': /* --connect */
877
connect_to = arg;
878
break;
879
case 'i': /* --interface */
880
interface = arg;
881
break;
882
case 's': /* --seckey */
883
seckey = arg;
884
break;
885
case 'p': /* --pubkey */
886
pubkey = arg;
887
break;
888
case 129: /* --dh-bits */
889
errno = 0;
890
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
891
if (errno){
892
perror("strtol");
893
exit(EXIT_FAILURE);
894
}
895
break;
896
case 130: /* --priority */
897
mc.priority = arg;
898
break;
899
case ARGP_KEY_ARG:
900
argp_usage (state);
901
case ARGP_KEY_END:
902
break;
903
default:
904
return ARGP_ERR_UNKNOWN;
905
}
906
return 0;
907
}
908
909
struct argp argp = { .options = options, .parser = parse_opt,
910
.args_doc = "",
911
.doc = "Mandos client -- Get and decrypt"
912
" passwords from a Mandos server" };
913
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
914
if (ret == ARGP_ERR_UNKNOWN){
915
fprintf(stderr, "Unknown error while parsing arguments\n");
916
exitcode = EXIT_FAILURE;
917
goto end;
918
}
919
}
920
921
ret = init_gnutls_global(&mc, pubkey, seckey);
922
if (ret == -1){
923
fprintf(stderr, "init_gnutls_global failed\n");
924
exitcode = EXIT_FAILURE;
925
goto end;
926
} else {
927
gnutls_initalized = true;
657
658
while (true){
659
static struct option long_options[] = {
660
{"debug", no_argument, (int *)&debug, 1},
661
{"connect", required_argument, 0, 'C'},
662
{"interface", required_argument, 0, 'i'},
663
{"certdir", required_argument, 0, 'd'},
664
{"certkey", required_argument, 0, 'c'},
665
{"certfile", required_argument, 0, 'k'},
666
{0, 0, 0, 0} };
667
668
int option_index = 0;
669
ret = getopt_long (argc, argv, "i:", long_options,
670
&option_index);
671
672
if (ret == -1){
673
break;
674
}
675
676
switch(ret){
677
case 0:
678
break;
679
case 'i':
680
interface = optarg;
681
break;
682
case 'C':
683
connect_to = optarg;
684
break;
685
case 'd':
686
certdir = optarg;
687
break;
688
case 'c':
689
certfile = optarg;
690
break;
691
case 'k':
692
certkey = optarg;
693
break;
694
default:
695
exit(EXIT_FAILURE);
696
}
928
697
}
929
698
930
if(mkdtemp(tempdir) == NULL){
931
perror("mkdtemp");
932
tempdir[0] = '\0';
933
goto end;
934
}
935
936
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
937
fprintf(stderr, "pgpme_initalized failed\n");
938
exitcode = EXIT_FAILURE;
939
goto end;
940
} else {
941
pgpme_initalized = true;
942
}
943
944
/* If the interface is down, bring it up */
945
{
946
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
947
if(sd < 0) {
948
perror("socket");
949
exitcode = EXIT_FAILURE;
950
goto end;
951
}
952
strcpy(network.ifr_name, interface);
953
ret = ioctl(sd, SIOCGIFFLAGS, &network);
954
if(ret == -1){
955
perror("ioctl SIOCGIFFLAGS");
956
exitcode = EXIT_FAILURE;
957
goto end;
958
}
959
if((network.ifr_flags & IFF_UP) == 0){
960
network.ifr_flags |= IFF_UP;
961
ret = ioctl(sd, SIOCSIFFLAGS, &network);
962
if(ret == -1){
963
perror("ioctl SIOCSIFFLAGS");
964
exitcode = EXIT_FAILURE;
965
goto end;
966
}
967
}
968
ret = TEMP_FAILURE_RETRY(close(sd));
969
if(ret == -1){
970
perror("close");
971
}
972
}
973
974
uid = getuid();
975
gid = getgid();
976
977
ret = setuid(uid);
978
if (ret == -1){
979
perror("setuid");
980
}
981
982
setgid(gid);
983
if (ret == -1){
984
perror("setgid");
985
}
986
987
if_index = (AvahiIfIndex) if_nametoindex(interface);
988
if(if_index == 0){
989
fprintf(stderr, "No such interface: \"%s\"\n", interface);
990
exit(EXIT_FAILURE);
699
certfile = combinepath(certdir, certfile);
700
if (certfile == NULL){
701
goto exit;
702
}
703
704
if(interface != NULL){
705
if_index = (AvahiIfIndex) if_nametoindex(interface);
706
if(if_index == 0){
707
fprintf(stderr, "No such interface: \"%s\"\n", interface);
708
exit(EXIT_FAILURE);
709
}
991
710
}
992
711
993
712
if(connect_to != NULL){
996
715
char *address = strrchr(connect_to, ':');
997
716
if(address == NULL){
998
717
fprintf(stderr, "No colon in address\n");
999
exitcode = EXIT_FAILURE;
1000
goto end;
718
exit(EXIT_FAILURE);
1001
719
}
1002
720
errno = 0;
1003
721
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
1004
722
if(errno){
1005
723
perror("Bad port number");
1006
exitcode = EXIT_FAILURE;
1007
goto end;
724
exit(EXIT_FAILURE);
1008
725
}
1009
726
*address = '\0';
1010
727
address = connect_to;
1011
ret = start_mandos_communication(address, port, if_index, &mc);
728
ret = start_mandos_communication(address, port, if_index);
1012
729
if(ret < 0){
1013
exitcode = EXIT_FAILURE;
730
exit(EXIT_FAILURE);
1014
731
} else {
1015
exitcode = EXIT_SUCCESS;
732
exit(EXIT_SUCCESS);
1016
733
}
1017
goto end;
734
}
735
736
certkey = combinepath(certdir, certkey);
737
if (certkey == NULL){
738
goto exit;
1018
739
}
1019
740
1020
741
if (not debug){
1021
742
avahi_set_log_function(empty_log);
1022
743
}
1023
744
1024
/* Initialize the pseudo-RNG for Avahi */
745
/* Initialize the psuedo-RNG */
1025
746
srand((unsigned int) time(NULL));
1026
1027
/* Allocate main Avahi loop object */
1028
mc.simple_poll = avahi_simple_poll_new();
1029
if (mc.simple_poll == NULL) {
1030
fprintf(stderr, "Avahi: Failed to create simple poll"
1031
" object.\n");
1032
exitcode = EXIT_FAILURE;
1033
goto end;
1034
}
1035
1036
{
1037
AvahiServerConfig config;
1038
/* Do not publish any local Zeroconf records */
1039
avahi_server_config_init(&config);
1040
config.publish_hinfo = 0;
1041
config.publish_addresses = 0;
1042
config.publish_workstation = 0;
1043
config.publish_domain = 0;
1044
1045
/* Allocate a new server */
1046
mc.server = avahi_server_new(avahi_simple_poll_get
1047
(mc.simple_poll), &config, NULL,
1048
NULL, &error);
1049
1050
/* Free the Avahi configuration data */
1051
avahi_server_config_free(&config);
1052
}
1053
1054
/* Check if creating the Avahi server object succeeded */
1055
if (mc.server == NULL) {
1056
fprintf(stderr, "Failed to create Avahi server: %s\n",
747
748
/* Allocate main loop object */
749
if (!(simple_poll = avahi_simple_poll_new())) {
750
fprintf(stderr, "Failed to create simple poll object.\n");
751
752
goto exit;
753
}
754
755
/* Do not publish any local records */
756
avahi_server_config_init(&config);
757
config.publish_hinfo = 0;
758
config.publish_addresses = 0;
759
config.publish_workstation = 0;
760
config.publish_domain = 0;
761
762
/* Allocate a new server */
763
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
764
&config, NULL, NULL, &error);
765
766
/* Free the configuration data */
767
avahi_server_config_free(&config);
768
769
/* Check if creating the server object succeeded */
770
if (!server) {
771
fprintf(stderr, "Failed to create server: %s\n",
1057
772
avahi_strerror(error));
1058
exitcode = EXIT_FAILURE;
1059
goto end;
773
returncode = EXIT_FAILURE;
774
goto exit;
1060
775
}
1061
776
1062
/* Create the Avahi service browser */
1063
sb = avahi_s_service_browser_new(mc.server, if_index,
777
/* Create the service browser */
778
sb = avahi_s_service_browser_new(server, if_index,
1064
779
AVAHI_PROTO_INET6,
1065
780
"_mandos._tcp", NULL, 0,
1066
browse_callback, &mc);
1067
if (sb == NULL) {
781
browse_callback, server);
782
if (!sb) {
1068
783
fprintf(stderr, "Failed to create service browser: %s\n",
1069
avahi_strerror(avahi_server_errno(mc.server)));
1070
exitcode = EXIT_FAILURE;
1071
goto end;
784
avahi_strerror(avahi_server_errno(server)));
785
returncode = EXIT_FAILURE;
786
goto exit;
1072
787
}
1073
788
1074
789
/* Run the main loop */
1075
790
1076
791
if (debug){
1077
fprintf(stderr, "Starting Avahi loop search\n");
792
fprintf(stderr, "Starting avahi loop search\n");
1078
793
}
1079
794
1080
avahi_simple_poll_loop(mc.simple_poll);
1081
1082
end:
1083
795
avahi_simple_poll_loop(simple_poll);
796
797
exit:
798
1084
799
if (debug){
1085
800
fprintf(stderr, "%s exiting\n", argv[0]);
1086
801
}
1087
802
1088
803
/* Cleanup things */
1089
if (sb != NULL)
804
if (sb)
1090
805
avahi_s_service_browser_free(sb);
1091
806
1092
if (mc.server != NULL)
1093
avahi_server_free(mc.server);
1094
1095
if (mc.simple_poll != NULL)
1096
avahi_simple_poll_free(mc.simple_poll);
1097
1098
if (gnutls_initalized){
1099
gnutls_certificate_free_credentials(mc.cred);
1100
gnutls_global_deinit ();
1101
}
1102
1103
if(pgpme_initalized){
1104
gpgme_release(mc.ctx);
1105
}
1106
1107
/* Removes the temp directory used by GPGME */
1108
if(tempdir[0] != '\0'){
1109
DIR *d;
1110
struct dirent *direntry;
1111
d = opendir(tempdir);
1112
if(d == NULL){
1113
perror("opendir");
1114
} else {
1115
while(true){
1116
direntry = readdir(d);
1117
if(direntry == NULL){
1118
break;
1119
}
1120
if (direntry->d_type == DT_REG){
1121
char *fullname = NULL;
1122
ret = asprintf(&fullname, "%s/%s", tempdir,
1123
direntry->d_name);
1124
if(ret < 0){
1125
perror("asprintf");
1126
continue;
1127
}
1128
ret = unlink(fullname);
1129
if(ret == -1){
1130
fprintf(stderr, "unlink(\"%s\"): %s",
1131
fullname, strerror(errno));
1132
}
1133
free(fullname);
1134
}
1135
}
1136
}
1137
ret = rmdir(tempdir);
1138
if(ret == -1){
1139
perror("rmdir");
1140
}
1141
}
1142
1143
return exitcode;
807
if (server)
808
avahi_server_free(server);
809
810
if (simple_poll)
811
avahi_simple_poll_free(simple_poll);
812
free(certfile);
813
free(certkey);
814
815
return returncode;
1144
816
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0