To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 37
- compare with another revision
- download diff
- download tarball
- view history from revision 37
- Committer: Teddy Hogeborn
- Date: 2008-08-02 21:06:12 UTC
- Revision ID: teddy@fukt.bsnet.se-20080802210612-4c1waup4z0f66ya7
Non-tested commit for merge purposes.
* plugbasedclient.c (getplugin, addargument, set_cloexec): Made static.
* plugins.d/passprompt.c (termination_handler): Made static.
* plugbasedclient.c (getplugin, addargument, set_cloexec): Made static.
* plugins.d/passprompt.c (termination_handler): Made static.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
30
29
*/
31
30
32
31
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
32
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
33
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), setuid(),
75
setgid() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
90
/* Avahi */
91
/* All Avahi types, constants and functions
92
Avahi*, avahi_*,
93
AVAHI_* */
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
94
41
#include <avahi-core/core.h>
95
42
#include <avahi-core/lookup.h>
96
43
#include <avahi-core/log.h>
98
45
#include <avahi-common/malloc.h>
99
46
#include <avahi-common/error.h>
100
47
101
/* GnuTLS */
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
103
functions:
104
gnutls_*
105
init_gnutls_session(),
106
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
110
111
/* GPGME */
112
#include <gpgme.h> /* All GPGME types, constants and
113
functions:
114
gpgme_*
115
GPGME_PROTOCOL_OpenPGP,
116
GPG_ERR_NO_* */
48
//mandos client part
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
// getopt_long
67
#include <getopt.h>
117
68
118
69
#define BUFFER_SIZE 256
119
70
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
71
static int dh_bits = 1024;
72
73
static const char *keydir = "/conf/conf.d/mandos";
74
static const char *pubkeyfile = "pubkey.txt";
75
static const char *seckeyfile = "seckey.txt";
123
76
124
77
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
128
78
129
/* Used for passing in values through the Avahi callback functions */
79
/* Used for */
130
80
typedef struct {
131
AvahiSimplePoll *simple_poll;
132
AvahiServer *server;
81
gnutls_session_t session;
133
82
gnutls_certificate_credentials_t cred;
134
unsigned int dh_bits;
135
83
gnutls_dh_params_t dh_params;
136
const char *priority;
84
} encrypted_session;
85
86
87
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet,
89
const char *homedir){
90
gpgme_data_t dh_crypto, dh_plain;
137
91
gpgme_ctx_t ctx;
138
} mandos_context;
139
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
/*
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
* bytes. "buffer_capacity" is how much is currently allocated,
148
* "buffer_length" is how much is already used.
149
*/
150
size_t incbuffer(char **buffer, size_t buffer_length,
151
size_t buffer_capacity){
152
if(buffer_length + BUFFER_SIZE > buffer_capacity){
153
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
154
if(buffer == NULL){
155
return 0;
156
}
157
buffer_capacity += BUFFER_SIZE;
158
}
159
return buffer_capacity;
160
}
161
162
/*
163
* Initialize GPGME.
164
*/
165
static bool init_gpgme(const char *seckey,
166
const char *pubkey, const char *tempdir){
167
int ret;
168
92
gpgme_error_t rc;
93
ssize_t ret;
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
169
96
gpgme_engine_info_t engine_info;
170
171
172
/*
173
* Helper function to insert pub and seckey to the engine keyring.
174
*/
175
bool import_key(const char *filename){
176
int fd;
177
gpgme_data_t pgp_data;
178
179
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
180
if(fd == -1){
181
perror("open");
182
return false;
183
}
184
185
rc = gpgme_data_new_from_fd(&pgp_data, fd);
186
if(rc != GPG_ERR_NO_ERROR){
187
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
188
gpgme_strsource(rc), gpgme_strerror(rc));
189
return false;
190
}
191
192
rc = gpgme_op_import(mc.ctx, pgp_data);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
196
return false;
197
}
198
199
ret = (int)TEMP_FAILURE_RETRY(close(fd));
200
if(ret == -1){
201
perror("close");
202
}
203
gpgme_data_release(pgp_data);
204
return true;
205
}
206
207
if(debug){
208
fprintf(stderr, "Initializing GPGME\n");
97
98
if (debug){
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
209
100
}
210
101
211
102
/* Init GPGME */
212
103
gpgme_check_version(NULL);
213
104
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
214
if(rc != GPG_ERR_NO_ERROR){
105
if (rc != GPG_ERR_NO_ERROR){
215
106
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
216
107
gpgme_strsource(rc), gpgme_strerror(rc));
217
return false;
108
return -1;
218
109
}
219
110
220
/* Set GPGME home directory for the OpenPGP engine only */
221
rc = gpgme_get_engine_info(&engine_info);
222
if(rc != GPG_ERR_NO_ERROR){
111
/* Set GPGME home directory */
112
rc = gpgme_get_engine_info (&engine_info);
113
if (rc != GPG_ERR_NO_ERROR){
223
114
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
224
115
gpgme_strsource(rc), gpgme_strerror(rc));
225
return false;
116
return -1;
226
117
}
227
118
while(engine_info != NULL){
228
119
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
229
120
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
230
engine_info->file_name, tempdir);
121
engine_info->file_name, homedir);
231
122
break;
232
123
}
233
124
engine_info = engine_info->next;
234
125
}
235
126
if(engine_info == NULL){
236
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
237
return false;
238
}
239
240
/* Create new GPGME "context" */
241
rc = gpgme_new(&(mc.ctx));
242
if(rc != GPG_ERR_NO_ERROR){
243
fprintf(stderr, "bad gpgme_new: %s: %s\n",
244
gpgme_strsource(rc), gpgme_strerror(rc));
245
return false;
246
}
247
248
if(not import_key(pubkey) or not import_key(seckey)){
249
return false;
250
}
251
252
return true;
253
}
254
255
/*
256
* Decrypt OpenPGP data.
257
* Returns -1 on error
258
*/
259
static ssize_t pgp_packet_decrypt(const char *cryptotext,
260
size_t crypto_size,
261
char **plaintext){
262
gpgme_data_t dh_crypto, dh_plain;
263
gpgme_error_t rc;
264
ssize_t ret;
265
size_t plaintext_capacity = 0;
266
ssize_t plaintext_length = 0;
267
268
if(debug){
269
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
270
}
271
272
/* Create new GPGME data buffer from memory cryptotext */
273
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
274
0);
275
if(rc != GPG_ERR_NO_ERROR){
127
fprintf(stderr, "Could not set home dir to %s\n", homedir);
128
return -1;
129
}
130
131
/* Create new GPGME data buffer from packet buffer */
132
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
133
if (rc != GPG_ERR_NO_ERROR){
276
134
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
277
135
gpgme_strsource(rc), gpgme_strerror(rc));
278
136
return -1;
280
138
281
139
/* Create new empty GPGME data buffer for the plaintext */
282
140
rc = gpgme_data_new(&dh_plain);
283
if(rc != GPG_ERR_NO_ERROR){
141
if (rc != GPG_ERR_NO_ERROR){
284
142
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
285
143
gpgme_strsource(rc), gpgme_strerror(rc));
286
gpgme_data_release(dh_crypto);
287
return -1;
288
}
289
290
/* Decrypt data from the cryptotext data buffer to the plaintext
291
data buffer */
292
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
293
if(rc != GPG_ERR_NO_ERROR){
144
return -1;
145
}
146
147
/* Create new GPGME "context" */
148
rc = gpgme_new(&ctx);
149
if (rc != GPG_ERR_NO_ERROR){
150
fprintf(stderr, "bad gpgme_new: %s: %s\n",
151
gpgme_strsource(rc), gpgme_strerror(rc));
152
return -1;
153
}
154
155
/* Decrypt data from the FILE pointer to the plaintext data
156
buffer */
157
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
158
if (rc != GPG_ERR_NO_ERROR){
294
159
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
295
160
gpgme_strsource(rc), gpgme_strerror(rc));
296
plaintext_length = -1;
297
if(debug){
298
gpgme_decrypt_result_t result;
299
result = gpgme_op_decrypt_result(mc.ctx);
300
if(result == NULL){
301
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
302
} else {
303
fprintf(stderr, "Unsupported algorithm: %s\n",
304
result->unsupported_algorithm);
305
fprintf(stderr, "Wrong key usage: %u\n",
306
result->wrong_key_usage);
307
if(result->file_name != NULL){
308
fprintf(stderr, "File name: %s\n", result->file_name);
309
}
310
gpgme_recipient_t recipient;
311
recipient = result->recipients;
161
return -1;
162
}
163
164
if(debug){
165
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
166
}
167
168
if (debug){
169
gpgme_decrypt_result_t result;
170
result = gpgme_op_decrypt_result(ctx);
171
if (result == NULL){
172
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
173
} else {
174
fprintf(stderr, "Unsupported algorithm: %s\n",
175
result->unsupported_algorithm);
176
fprintf(stderr, "Wrong key usage: %d\n",
177
result->wrong_key_usage);
178
if(result->file_name != NULL){
179
fprintf(stderr, "File name: %s\n", result->file_name);
180
}
181
gpgme_recipient_t recipient;
182
recipient = result->recipients;
183
if(recipient){
312
184
while(recipient != NULL){
313
185
fprintf(stderr, "Public key algorithm: %s\n",
314
186
gpgme_pubkey_algo_name(recipient->pubkey_algo));
320
192
}
321
193
}
322
194
}
323
goto decrypt_end;
324
195
}
325
196
326
if(debug){
327
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
328
}
197
/* Delete the GPGME FILE pointer cryptotext data buffer */
198
gpgme_data_release(dh_crypto);
329
199
330
200
/* Seek back to the beginning of the GPGME plaintext data buffer */
331
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
332
perror("gpgme_data_seek");
333
plaintext_length = -1;
334
goto decrypt_end;
201
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
202
perror("pgpme_data_seek");
335
203
}
336
204
337
*plaintext = NULL;
205
*new_packet = 0;
338
206
while(true){
339
plaintext_capacity = incbuffer(plaintext,
340
(size_t)plaintext_length,
341
plaintext_capacity);
342
if(plaintext_capacity == 0){
343
perror("incbuffer");
344
plaintext_length = -1;
345
goto decrypt_end;
207
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
208
*new_packet = realloc(*new_packet,
209
(unsigned int)new_packet_capacity
210
+ BUFFER_SIZE);
211
if (*new_packet == NULL){
212
perror("realloc");
213
return -1;
214
}
215
new_packet_capacity += BUFFER_SIZE;
346
216
}
347
217
348
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
218
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
349
219
BUFFER_SIZE);
350
220
/* Print the data, if any */
351
if(ret == 0){
352
/* EOF */
221
if (ret == 0){
353
222
break;
354
223
}
355
224
if(ret < 0){
356
225
perror("gpgme_data_read");
357
plaintext_length = -1;
358
goto decrypt_end;
359
}
360
plaintext_length += ret;
361
}
362
363
if(debug){
364
fprintf(stderr, "Decrypted password is: ");
365
for(ssize_t i = 0; i < plaintext_length; i++){
366
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
367
}
368
fprintf(stderr, "\n");
369
}
370
371
decrypt_end:
372
373
/* Delete the GPGME cryptotext data buffer */
374
gpgme_data_release(dh_crypto);
226
return -1;
227
}
228
new_packet_length += ret;
229
}
230
231
/* FIXME: check characters before printing to screen so to not print
232
terminal control characters */
233
/* if(debug){ */
234
/* fprintf(stderr, "decrypted password is: "); */
235
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
236
/* fprintf(stderr, "\n"); */
237
/* } */
375
238
376
239
/* Delete the GPGME plaintext data buffer */
377
240
gpgme_data_release(dh_plain);
378
return plaintext_length;
241
return new_packet_length;
379
242
}
380
243
381
static const char * safer_gnutls_strerror(int value){
382
const char *ret = gnutls_strerror(value); /* Spurious warning from
383
-Wunreachable-code */
384
if(ret == NULL)
244
static const char * safer_gnutls_strerror (int value) {
245
const char *ret = gnutls_strerror (value);
246
if (ret == NULL)
385
247
ret = "(unknown)";
386
248
return ret;
387
249
}
388
250
389
/* GnuTLS log function callback */
390
251
static void debuggnutls(__attribute__((unused)) int level,
391
252
const char* string){
392
fprintf(stderr, "GnuTLS: %s", string);
253
fprintf(stderr, "%s", string);
393
254
}
394
255
395
static int init_gnutls_global(const char *pubkeyfilename,
396
const char *seckeyfilename){
256
static int initgnutls(encrypted_session *es){
257
const char *err;
397
258
int ret;
398
259
399
260
if(debug){
400
261
fprintf(stderr, "Initializing GnuTLS\n");
401
262
}
402
403
ret = gnutls_global_init();
404
if(ret != GNUTLS_E_SUCCESS){
405
fprintf(stderr, "GnuTLS global_init: %s\n",
406
safer_gnutls_strerror(ret));
263
264
if ((ret = gnutls_global_init ())
265
!= GNUTLS_E_SUCCESS) {
266
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
407
267
return -1;
408
268
}
409
410
if(debug){
411
/* "Use a log level over 10 to enable all debugging options."
412
* - GnuTLS manual
413
*/
269
270
if (debug){
414
271
gnutls_global_set_log_level(11);
415
272
gnutls_global_set_log_function(debuggnutls);
416
273
}
417
274
418
/* OpenPGP credentials */
419
gnutls_certificate_allocate_credentials(&mc.cred);
420
if(ret != GNUTLS_E_SUCCESS){
421
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
422
from
423
-Wunreachable-code
424
*/
425
safer_gnutls_strerror(ret));
426
gnutls_global_deinit();
275
/* openpgp credentials */
276
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
277
!= GNUTLS_E_SUCCESS) {
278
fprintf (stderr, "memory error: %s\n",
279
safer_gnutls_strerror(ret));
427
280
return -1;
428
281
}
429
282
430
283
if(debug){
431
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
432
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
433
seckeyfilename);
284
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
285
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
286
seckeyfile);
434
287
}
435
288
436
289
ret = gnutls_certificate_set_openpgp_key_file
437
(mc.cred, pubkeyfilename, seckeyfilename,
438
GNUTLS_OPENPGP_FMT_BASE64);
439
if(ret != GNUTLS_E_SUCCESS){
440
fprintf(stderr,
441
"Error[%d] while reading the OpenPGP key pair ('%s',"
442
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
443
fprintf(stderr, "The GnuTLS error is: %s\n",
444
safer_gnutls_strerror(ret));
445
goto globalfail;
446
}
447
448
/* GnuTLS server initialization */
449
ret = gnutls_dh_params_init(&mc.dh_params);
450
if(ret != GNUTLS_E_SUCCESS){
451
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
452
" %s\n", safer_gnutls_strerror(ret));
453
goto globalfail;
454
}
455
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
456
if(ret != GNUTLS_E_SUCCESS){
457
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
458
safer_gnutls_strerror(ret));
459
goto globalfail;
460
}
461
462
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
463
464
return 0;
465
466
globalfail:
467
468
gnutls_certificate_free_credentials(mc.cred);
469
gnutls_global_deinit();
470
gnutls_dh_params_deinit(mc.dh_params);
471
return -1;
472
}
473
474
static int init_gnutls_session(gnutls_session_t *session){
475
int ret;
476
/* GnuTLS session creation */
477
ret = gnutls_init(session, GNUTLS_SERVER);
478
if(ret != GNUTLS_E_SUCCESS){
290
(es->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
291
if (ret != GNUTLS_E_SUCCESS) {
292
fprintf
293
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
294
" '%s')\n",
295
ret, pubkeyfile, seckeyfile);
296
fprintf(stdout, "The Error is: %s\n",
297
safer_gnutls_strerror(ret));
298
return -1;
299
}
300
301
//GnuTLS server initialization
302
if ((ret = gnutls_dh_params_init (&es->dh_params))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in dh parameter initialization: %s\n",
305
safer_gnutls_strerror(ret));
306
return -1;
307
}
308
309
if ((ret = gnutls_dh_params_generate2 (es->dh_params, dh_bits))
310
!= GNUTLS_E_SUCCESS) {
311
fprintf (stderr, "Error in prime generation: %s\n",
312
safer_gnutls_strerror(ret));
313
return -1;
314
}
315
316
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
317
318
// GnuTLS session creation
319
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
320
!= GNUTLS_E_SUCCESS){
479
321
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
480
322
safer_gnutls_strerror(ret));
481
323
}
482
324
483
{
484
const char *err;
485
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
486
if(ret != GNUTLS_E_SUCCESS){
487
fprintf(stderr, "Syntax error at: %s\n", err);
488
fprintf(stderr, "GnuTLS error: %s\n",
489
safer_gnutls_strerror(ret));
490
gnutls_deinit(*session);
491
return -1;
492
}
325
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
326
!= GNUTLS_E_SUCCESS) {
327
fprintf(stderr, "Syntax error at: %s\n", err);
328
fprintf(stderr, "GnuTLS error: %s\n",
329
safer_gnutls_strerror(ret));
330
return -1;
493
331
}
494
332
495
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
496
mc.cred);
497
if(ret != GNUTLS_E_SUCCESS){
498
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
333
if ((ret = gnutls_credentials_set
334
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
335
!= GNUTLS_E_SUCCESS) {
336
fprintf(stderr, "Error setting a credentials set: %s\n",
499
337
safer_gnutls_strerror(ret));
500
gnutls_deinit(*session);
501
338
return -1;
502
339
}
503
340
504
341
/* ignore client certificate if any. */
505
gnutls_certificate_server_set_request(*session,
506
GNUTLS_CERT_IGNORE);
342
gnutls_certificate_server_set_request (es->session,
343
GNUTLS_CERT_IGNORE);
507
344
508
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
345
gnutls_dh_set_prime_bits (es->session, dh_bits);
509
346
510
347
return 0;
511
348
}
512
349
513
/* Avahi log function callback */
514
350
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
515
351
__attribute__((unused)) const char *txt){}
516
352
517
sig_atomic_t quit_now = 0;
518
int signal_received = 0;
519
520
/* Called when a Mandos server is found */
521
353
static int start_mandos_communication(const char *ip, uint16_t port,
522
AvahiIfIndex if_index,
523
int af){
524
int ret, tcp_sd = -1;
525
ssize_t sret;
526
union {
527
struct sockaddr_in in;
528
struct sockaddr_in6 in6;
529
} to;
354
AvahiIfIndex if_index){
355
int ret, tcp_sd;
356
struct sockaddr_in6 to;
357
encrypted_session es;
530
358
char *buffer = NULL;
531
359
char *decrypted_buffer;
532
360
size_t buffer_length = 0;
533
361
size_t buffer_capacity = 0;
534
362
ssize_t decrypted_buffer_size;
535
size_t written;
363
size_t written = 0;
536
364
int retval = 0;
537
gnutls_session_t session;
538
int pf; /* Protocol family */
539
540
if(quit_now){
541
return -1;
542
}
543
544
switch(af){
545
case AF_INET6:
546
pf = PF_INET6;
547
break;
548
case AF_INET:
549
pf = PF_INET;
550
break;
551
default:
552
fprintf(stderr, "Bad address family: %d\n", af);
553
return -1;
554
}
555
556
ret = init_gnutls_session(&session);
557
if(ret != 0){
558
return -1;
559
}
365
char interface[IF_NAMESIZE];
560
366
561
367
if(debug){
562
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
563
"\n", ip, port);
368
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
369
ip, port);
564
370
}
565
371
566
tcp_sd = socket(pf, SOCK_STREAM, 0);
567
if(tcp_sd < 0){
372
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
373
if(tcp_sd < 0) {
568
374
perror("socket");
569
retval = -1;
570
goto mandos_end;
571
}
572
573
if(quit_now){
574
goto mandos_end;
575
}
576
577
memset(&to, 0, sizeof(to));
578
if(af == AF_INET6){
579
to.in6.sin6_family = (sa_family_t)af;
580
ret = inet_pton(af, ip, &to.in6.sin6_addr);
581
} else { /* IPv4 */
582
to.in.sin_family = (sa_family_t)af;
583
ret = inet_pton(af, ip, &to.in.sin_addr);
584
}
585
if(ret < 0 ){
375
return -1;
376
}
377
378
if(if_indextoname((unsigned int)if_index, interface) == NULL){
379
if(debug){
380
perror("if_indextoname");
381
}
382
return -1;
383
}
384
385
if(debug){
386
fprintf(stderr, "Binding to interface %s\n", interface);
387
}
388
389
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
392
if (ret < 0 ){
586
393
perror("inet_pton");
587
retval = -1;
588
goto mandos_end;
589
}
394
return -1;
395
}
590
396
if(ret == 0){
591
397
fprintf(stderr, "Bad address: %s\n", ip);
592
retval = -1;
593
goto mandos_end;
594
}
595
if(af == AF_INET6){
596
to.in6.sin6_port = htons(port); /* Spurious warnings from
597
-Wconversion and
598
-Wunreachable-code */
599
600
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
601
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
602
-Wunreachable-code*/
603
if(if_index == AVAHI_IF_UNSPEC){
604
fprintf(stderr, "An IPv6 link-local address is incomplete"
605
" without a network interface\n");
606
retval = -1;
607
goto mandos_end;
608
}
609
/* Set the network interface number as scope */
610
to.in6.sin6_scope_id = (uint32_t)if_index;
611
}
612
} else {
613
to.in.sin_port = htons(port); /* Spurious warnings from
614
-Wconversion and
615
-Wunreachable-code */
616
}
398
return -1;
399
}
400
to.sin6_port = htons(port); /* Spurious warning */
617
401
618
if(quit_now){
619
goto mandos_end;
620
}
402
to.sin6_scope_id = (uint32_t)if_index;
621
403
622
404
if(debug){
623
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
624
char interface[IF_NAMESIZE];
625
if(if_indextoname((unsigned int)if_index, interface) == NULL){
626
perror("if_indextoname");
627
} else {
628
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
629
ip, interface, port);
630
}
631
} else {
632
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
633
port);
634
}
635
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
636
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
637
const char *pcret;
638
if(af == AF_INET6){
639
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
640
sizeof(addrstr));
641
} else {
642
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
643
sizeof(addrstr));
644
}
645
if(pcret == NULL){
405
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
406
char addrstr[INET6_ADDRSTRLEN] = "";
407
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
408
sizeof(addrstr)) == NULL){
646
409
perror("inet_ntop");
647
410
} else {
648
411
if(strcmp(addrstr, ip) != 0){
649
fprintf(stderr, "Canonical address form: %s\n", addrstr);
412
fprintf(stderr, "Canonical address form: %s\n",
413
addrstr, ntohs(to.sin6_port));
650
414
}
651
415
}
652
416
}
653
417
654
if(quit_now){
655
goto mandos_end;
656
}
657
658
if(af == AF_INET6){
659
ret = connect(tcp_sd, &to.in6, sizeof(to));
660
} else {
661
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
662
}
663
if(ret < 0){
418
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
419
if (ret < 0){
664
420
perror("connect");
421
return -1;
422
}
423
424
ret = initgnutls (&es);
425
if (ret != 0){
665
426
retval = -1;
666
goto mandos_end;
667
}
668
669
if(quit_now){
670
goto mandos_end;
671
}
672
673
const char *out = mandos_protocol_version;
674
written = 0;
675
while(true){
676
size_t out_size = strlen(out);
677
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
678
out_size - written));
679
if(ret == -1){
680
perror("write");
681
retval = -1;
682
goto mandos_end;
683
}
684
written += (size_t)ret;
685
if(written < out_size){
686
continue;
687
} else {
688
if(out == mandos_protocol_version){
689
written = 0;
690
out = "\r\n";
691
} else {
692
break;
693
}
694
}
695
696
if(quit_now){
697
goto mandos_end;
698
}
699
}
427
return -1;
428
}
429
430
gnutls_transport_set_ptr (es.session,
431
(gnutls_transport_ptr_t) tcp_sd);
700
432
701
433
if(debug){
702
434
fprintf(stderr, "Establishing TLS session with %s\n", ip);
703
435
}
704
436
705
if(quit_now){
706
goto mandos_end;
707
}
708
709
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
710
711
if(quit_now){
712
goto mandos_end;
713
}
714
715
do{
716
ret = gnutls_handshake(session);
717
if(quit_now){
718
goto mandos_end;
719
}
720
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
721
722
if(ret != GNUTLS_E_SUCCESS){
437
ret = gnutls_handshake (es.session);
438
439
if (ret != GNUTLS_E_SUCCESS){
723
440
if(debug){
724
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
725
gnutls_perror(ret);
441
fprintf(stderr, "\n*** Handshake failed ***\n");
442
gnutls_perror (ret);
726
443
}
727
444
retval = -1;
728
goto mandos_end;
445
goto exit;
729
446
}
730
447
731
/* Read OpenPGP packet that contains the wanted password */
448
//Retrieve OpenPGP packet that contains the wanted password
732
449
733
450
if(debug){
734
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
451
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
735
452
ip);
736
453
}
737
454
738
455
while(true){
739
740
if(quit_now){
741
goto mandos_end;
742
}
743
744
buffer_capacity = incbuffer(&buffer, buffer_length,
745
buffer_capacity);
746
if(buffer_capacity == 0){
747
perror("incbuffer");
748
retval = -1;
749
goto mandos_end;
750
}
751
752
if(quit_now){
753
goto mandos_end;
754
}
755
756
sret = gnutls_record_recv(session, buffer+buffer_length,
757
BUFFER_SIZE);
758
if(sret == 0){
456
if (buffer_length + BUFFER_SIZE > buffer_capacity){
457
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
458
if (buffer == NULL){
459
perror("realloc");
460
goto exit;
461
}
462
buffer_capacity += BUFFER_SIZE;
463
}
464
465
ret = gnutls_record_recv
466
(es.session, buffer+buffer_length, BUFFER_SIZE);
467
if (ret == 0){
759
468
break;
760
469
}
761
if(sret < 0){
762
switch(sret){
470
if (ret < 0){
471
switch(ret){
763
472
case GNUTLS_E_INTERRUPTED:
764
473
case GNUTLS_E_AGAIN:
765
474
break;
766
475
case GNUTLS_E_REHANDSHAKE:
767
do{
768
ret = gnutls_handshake(session);
769
770
if(quit_now){
771
goto mandos_end;
772
}
773
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
774
if(ret < 0){
775
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
776
gnutls_perror(ret);
476
ret = gnutls_handshake (es.session);
477
if (ret < 0){
478
fprintf(stderr, "\n*** Handshake failed ***\n");
479
gnutls_perror (ret);
777
480
retval = -1;
778
goto mandos_end;
481
goto exit;
779
482
}
780
483
break;
781
484
default:
782
485
fprintf(stderr, "Unknown error while reading data from"
783
" encrypted session with Mandos server\n");
486
" encrypted session with mandos server\n");
784
487
retval = -1;
785
gnutls_bye(session, GNUTLS_SHUT_RDWR);
786
goto mandos_end;
488
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
489
goto exit;
787
490
}
788
491
} else {
789
buffer_length += (size_t) sret;
492
buffer_length += (size_t) ret;
790
493
}
791
494
}
792
495
793
if(debug){
794
fprintf(stderr, "Closing TLS session\n");
795
}
796
797
if(quit_now){
798
goto mandos_end;
799
}
800
801
gnutls_bye(session, GNUTLS_SHUT_RDWR);
802
803
if(quit_now){
804
goto mandos_end;
805
}
806
807
if(buffer_length > 0){
496
if (buffer_length > 0){
808
497
decrypted_buffer_size = pgp_packet_decrypt(buffer,
809
498
buffer_length,
810
&decrypted_buffer);
811
if(decrypted_buffer_size >= 0){
812
written = 0;
499
&decrypted_buffer,
500
keydir);
501
if (decrypted_buffer_size >= 0){
813
502
while(written < (size_t) decrypted_buffer_size){
814
if(quit_now){
815
goto mandos_end;
816
}
817
818
ret = (int)fwrite(decrypted_buffer + written, 1,
819
(size_t)decrypted_buffer_size - written,
820
stdout);
503
ret = (int)fwrite (decrypted_buffer + written, 1,
504
(size_t)decrypted_buffer_size - written,
505
stdout);
821
506
if(ret == 0 and ferror(stdout)){
822
507
if(debug){
823
508
fprintf(stderr, "Error writing encrypted data: %s\n",
832
517
} else {
833
518
retval = -1;
834
519
}
835
} else {
836
retval = -1;
837
}
838
839
/* Shutdown procedure */
840
841
mandos_end:
520
}
521
522
//shutdown procedure
523
524
if(debug){
525
fprintf(stderr, "Closing TLS session\n");
526
}
527
842
528
free(buffer);
843
if(tcp_sd >= 0){
844
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
845
}
846
if(ret == -1){
847
perror("close");
848
}
849
gnutls_deinit(session);
850
if(quit_now){
851
retval = -1;
852
}
529
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
530
exit:
531
close(tcp_sd);
532
gnutls_deinit (es.session);
533
gnutls_certificate_free_credentials (es.cred);
534
gnutls_global_deinit ();
853
535
return retval;
854
536
}
855
537
856
static void resolve_callback(AvahiSServiceResolver *r,
857
AvahiIfIndex interface,
858
AvahiProtocol proto,
859
AvahiResolverEvent event,
860
const char *name,
861
const char *type,
862
const char *domain,
863
const char *host_name,
864
const AvahiAddress *address,
865
uint16_t port,
866
AVAHI_GCC_UNUSED AvahiStringList *txt,
867
AVAHI_GCC_UNUSED AvahiLookupResultFlags
868
flags,
869
AVAHI_GCC_UNUSED void* userdata){
870
assert(r);
538
static AvahiSimplePoll *simple_poll = NULL;
539
static AvahiServer *server = NULL;
540
541
static void resolve_callback(
542
AvahiSServiceResolver *r,
543
AvahiIfIndex interface,
544
AVAHI_GCC_UNUSED AvahiProtocol protocol,
545
AvahiResolverEvent event,
546
const char *name,
547
const char *type,
548
const char *domain,
549
const char *host_name,
550
const AvahiAddress *address,
551
uint16_t port,
552
AVAHI_GCC_UNUSED AvahiStringList *txt,
553
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
554
AVAHI_GCC_UNUSED void* userdata) {
555
556
assert(r); /* Spurious warning */
871
557
872
558
/* Called whenever a service has been resolved successfully or
873
559
timed out */
874
560
875
if(quit_now){
876
return;
877
}
878
879
switch(event){
561
switch (event) {
880
562
default:
881
563
case AVAHI_RESOLVER_FAILURE:
882
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
883
" of type '%s' in domain '%s': %s\n", name, type, domain,
884
avahi_strerror(avahi_server_errno(mc.server)));
564
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
565
" type '%s' in domain '%s': %s\n", name, type, domain,
566
avahi_strerror(avahi_server_errno(server)));
885
567
break;
886
568
887
569
case AVAHI_RESOLVER_FOUND:
889
571
char ip[AVAHI_ADDRESS_STR_MAX];
890
572
avahi_address_snprint(ip, sizeof(ip), address);
891
573
if(debug){
892
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
893
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
894
ip, (intmax_t)interface, port);
574
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
575
" port %d\n", name, host_name, ip, port);
895
576
}
896
int ret = start_mandos_communication(ip, port, interface,
897
avahi_proto_to_af(proto));
898
if(ret == 0){
899
avahi_simple_poll_quit(mc.simple_poll);
577
int ret = start_mandos_communication(ip, port, interface);
578
if (ret == 0){
579
exit(EXIT_SUCCESS);
900
580
}
901
581
}
902
582
}
903
583
avahi_s_service_resolver_free(r);
904
584
}
905
585
906
static void browse_callback(AvahiSServiceBrowser *b,
907
AvahiIfIndex interface,
908
AvahiProtocol protocol,
909
AvahiBrowserEvent event,
910
const char *name,
911
const char *type,
912
const char *domain,
913
AVAHI_GCC_UNUSED AvahiLookupResultFlags
914
flags,
915
AVAHI_GCC_UNUSED void* userdata){
916
assert(b);
917
918
/* Called whenever a new services becomes available on the LAN or
919
is removed from the LAN */
920
921
if(quit_now){
922
return;
923
}
924
925
switch(event){
926
default:
927
case AVAHI_BROWSER_FAILURE:
928
929
fprintf(stderr, "(Avahi browser) %s\n",
930
avahi_strerror(avahi_server_errno(mc.server)));
931
avahi_simple_poll_quit(mc.simple_poll);
932
return;
933
934
case AVAHI_BROWSER_NEW:
935
/* We ignore the returned Avahi resolver object. In the callback
936
function we free it. If the Avahi server is terminated before
937
the callback function is called the Avahi server will free the
938
resolver for us. */
939
940
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
941
name, type, domain, protocol, 0,
942
resolve_callback, NULL) == NULL)
943
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
944
name, avahi_strerror(avahi_server_errno(mc.server)));
945
break;
946
947
case AVAHI_BROWSER_REMOVE:
948
break;
949
950
case AVAHI_BROWSER_ALL_FOR_NOW:
951
case AVAHI_BROWSER_CACHE_EXHAUSTED:
952
if(debug){
953
fprintf(stderr, "No Mandos server found, still searching...\n");
954
}
955
break;
956
}
957
}
958
959
/* stop main loop after sigterm has been called */
960
static void handle_sigterm(int sig){
961
if(quit_now){
962
return;
963
}
964
quit_now = 1;
965
signal_received = sig;
966
int old_errno = errno;
967
if(mc.simple_poll != NULL){
968
avahi_simple_poll_quit(mc.simple_poll);
969
}
970
errno = old_errno;
971
}
972
973
int main(int argc, char *argv[]){
974
AvahiSServiceBrowser *sb = NULL;
975
int error;
976
int ret;
977
intmax_t tmpmax;
978
char *tmp;
979
int exitcode = EXIT_SUCCESS;
980
const char *interface = "eth0";
981
struct ifreq network;
982
int sd = -1;
983
bool take_down_interface = false;
984
uid_t uid;
985
gid_t gid;
986
char *connect_to = NULL;
987
char tempdir[] = "/tmp/mandosXXXXXX";
988
bool tempdir_created = false;
989
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
990
const char *seckey = PATHDIR "/" SECKEY;
991
const char *pubkey = PATHDIR "/" PUBKEY;
992
993
bool gnutls_initialized = false;
994
bool gpgme_initialized = false;
995
float delay = 2.5f;
996
997
struct sigaction old_sigterm_action;
998
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
999
1000
{
1001
struct argp_option options[] = {
1002
{ .name = "debug", .key = 128,
1003
.doc = "Debug mode", .group = 3 },
1004
{ .name = "connect", .key = 'c',
1005
.arg = "ADDRESS:PORT",
1006
.doc = "Connect directly to a specific Mandos server",
1007
.group = 1 },
1008
{ .name = "interface", .key = 'i',
1009
.arg = "NAME",
1010
.doc = "Network interface that will be used to search for"
1011
" Mandos servers",
1012
.group = 1 },
1013
{ .name = "seckey", .key = 's',
1014
.arg = "FILE",
1015
.doc = "OpenPGP secret key file base name",
1016
.group = 1 },
1017
{ .name = "pubkey", .key = 'p',
1018
.arg = "FILE",
1019
.doc = "OpenPGP public key file base name",
1020
.group = 2 },
1021
{ .name = "dh-bits", .key = 129,
1022
.arg = "BITS",
1023
.doc = "Bit length of the prime number used in the"
1024
" Diffie-Hellman key exchange",
1025
.group = 2 },
1026
{ .name = "priority", .key = 130,
1027
.arg = "STRING",
1028
.doc = "GnuTLS priority string for the TLS handshake",
1029
.group = 1 },
1030
{ .name = "delay", .key = 131,
1031
.arg = "SECONDS",
1032
.doc = "Maximum delay to wait for interface startup",
1033
.group = 2 },
1034
{ .name = NULL }
1035
};
1036
1037
error_t parse_opt(int key, char *arg,
1038
struct argp_state *state){
1039
switch(key){
1040
case 128: /* --debug */
1041
debug = true;
1042
break;
1043
case 'c': /* --connect */
1044
connect_to = arg;
1045
break;
1046
case 'i': /* --interface */
1047
interface = arg;
1048
break;
1049
case 's': /* --seckey */
1050
seckey = arg;
1051
break;
1052
case 'p': /* --pubkey */
1053
pubkey = arg;
1054
break;
1055
case 129: /* --dh-bits */
1056
errno = 0;
1057
tmpmax = strtoimax(arg, &tmp, 10);
1058
if(errno != 0 or tmp == arg or *tmp != '\0'
1059
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1060
fprintf(stderr, "Bad number of DH bits\n");
1061
exit(EXIT_FAILURE);
1062
}
1063
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1064
break;
1065
case 130: /* --priority */
1066
mc.priority = arg;
1067
break;
1068
case 131: /* --delay */
1069
errno = 0;
1070
delay = strtof(arg, &tmp);
1071
if(errno != 0 or tmp == arg or *tmp != '\0'){
1072
fprintf(stderr, "Bad delay\n");
1073
exit(EXIT_FAILURE);
1074
}
1075
break;
1076
case ARGP_KEY_ARG:
1077
argp_usage(state);
1078
case ARGP_KEY_END:
1079
break;
1080
default:
1081
return ARGP_ERR_UNKNOWN;
1082
}
1083
return 0;
1084
}
1085
1086
struct argp argp = { .options = options, .parser = parse_opt,
1087
.args_doc = "",
1088
.doc = "Mandos client -- Get and decrypt"
1089
" passwords from a Mandos server" };
1090
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1091
if(ret == ARGP_ERR_UNKNOWN){
1092
fprintf(stderr, "Unknown error while parsing arguments\n");
1093
exitcode = EXIT_FAILURE;
1094
goto end;
1095
}
1096
}
1097
1098
if(not debug){
1099
avahi_set_log_function(empty_log);
1100
}
1101
1102
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1103
from the signal handler */
1104
/* Initialize the pseudo-RNG for Avahi */
1105
srand((unsigned int) time(NULL));
1106
mc.simple_poll = avahi_simple_poll_new();
1107
if(mc.simple_poll == NULL){
1108
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1109
exitcode = EXIT_FAILURE;
1110
goto end;
1111
}
1112
1113
sigemptyset(&sigterm_action.sa_mask);
1114
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1115
if(ret == -1){
1116
perror("sigaddset");
1117
exitcode = EXIT_FAILURE;
1118
goto end;
1119
}
1120
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1121
if(ret == -1){
1122
perror("sigaddset");
1123
exitcode = EXIT_FAILURE;
1124
goto end;
1125
}
1126
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1127
if(ret == -1){
1128
perror("sigaddset");
1129
exitcode = EXIT_FAILURE;
1130
goto end;
1131
}
1132
/* Need to check if the handler is SIG_IGN before handling:
1133
| [[info:libc:Initial Signal Actions]] |
1134
| [[info:libc:Basic Signal Handling]] |
1135
*/
1136
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1137
if(ret == -1){
1138
perror("sigaction");
1139
return EXIT_FAILURE;
1140
}
1141
if(old_sigterm_action.sa_handler != SIG_IGN){
1142
ret = sigaction(SIGINT, &sigterm_action, NULL);
1143
if(ret == -1){
1144
perror("sigaction");
1145
exitcode = EXIT_FAILURE;
1146
goto end;
1147
}
1148
}
1149
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1150
if(ret == -1){
1151
perror("sigaction");
1152
return EXIT_FAILURE;
1153
}
1154
if(old_sigterm_action.sa_handler != SIG_IGN){
1155
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1156
if(ret == -1){
1157
perror("sigaction");
1158
exitcode = EXIT_FAILURE;
1159
goto end;
1160
}
1161
}
1162
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1163
if(ret == -1){
1164
perror("sigaction");
1165
return EXIT_FAILURE;
1166
}
1167
if(old_sigterm_action.sa_handler != SIG_IGN){
1168
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1169
if(ret == -1){
1170
perror("sigaction");
1171
exitcode = EXIT_FAILURE;
1172
goto end;
1173
}
1174
}
1175
1176
/* If the interface is down, bring it up */
1177
if(interface[0] != '\0'){
1178
if_index = (AvahiIfIndex) if_nametoindex(interface);
1179
if(if_index == 0){
1180
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1181
exitcode = EXIT_FAILURE;
1182
goto end;
1183
}
1184
1185
if(quit_now){
1186
goto end;
1187
}
1188
1189
#ifdef __linux__
1190
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1191
messages to mess up the prompt */
1192
ret = klogctl(8, NULL, 5);
1193
bool restore_loglevel = true;
1194
if(ret == -1){
1195
restore_loglevel = false;
1196
perror("klogctl");
1197
}
1198
#endif /* __linux__ */
1199
1200
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1201
if(sd < 0){
1202
perror("socket");
1203
exitcode = EXIT_FAILURE;
1204
#ifdef __linux__
1205
if(restore_loglevel){
1206
ret = klogctl(7, NULL, 0);
1207
if(ret == -1){
1208
perror("klogctl");
1209
}
1210
}
1211
#endif /* __linux__ */
1212
goto end;
1213
}
1214
strcpy(network.ifr_name, interface);
1215
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1216
if(ret == -1){
1217
perror("ioctl SIOCGIFFLAGS");
1218
#ifdef __linux__
1219
if(restore_loglevel){
1220
ret = klogctl(7, NULL, 0);
1221
if(ret == -1){
1222
perror("klogctl");
1223
}
1224
}
1225
#endif /* __linux__ */
1226
exitcode = EXIT_FAILURE;
1227
goto end;
1228
}
1229
if((network.ifr_flags & IFF_UP) == 0){
1230
network.ifr_flags |= IFF_UP;
1231
take_down_interface = true;
1232
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1233
if(ret == -1){
1234
take_down_interface = false;
1235
perror("ioctl SIOCSIFFLAGS");
1236
exitcode = EXIT_FAILURE;
1237
#ifdef __linux__
1238
if(restore_loglevel){
1239
ret = klogctl(7, NULL, 0);
1240
if(ret == -1){
1241
perror("klogctl");
1242
}
1243
}
1244
#endif /* __linux__ */
1245
goto end;
1246
}
1247
}
1248
/* sleep checking until interface is running */
1249
for(int i=0; i < delay * 4; i++){
1250
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1251
if(ret == -1){
1252
perror("ioctl SIOCGIFFLAGS");
1253
} else if(network.ifr_flags & IFF_RUNNING){
1254
break;
1255
}
1256
struct timespec sleeptime = { .tv_nsec = 250000000 };
1257
ret = nanosleep(&sleeptime, NULL);
1258
if(ret == -1 and errno != EINTR){
1259
perror("nanosleep");
1260
}
1261
}
1262
if(not take_down_interface){
1263
/* We won't need the socket anymore */
1264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1265
if(ret == -1){
1266
perror("close");
1267
}
1268
}
1269
#ifdef __linux__
1270
if(restore_loglevel){
1271
/* Restores kernel loglevel to default */
1272
ret = klogctl(7, NULL, 0);
1273
if(ret == -1){
1274
perror("klogctl");
1275
}
1276
}
1277
#endif /* __linux__ */
1278
}
1279
1280
if(quit_now){
1281
goto end;
1282
}
1283
1284
uid = getuid();
1285
gid = getgid();
1286
1287
errno = 0;
1288
setgid(gid);
1289
if(ret == -1){
1290
perror("setgid");
1291
}
1292
1293
ret = setuid(uid);
1294
if(ret == -1){
1295
perror("setuid");
1296
}
1297
1298
if(quit_now){
1299
goto end;
1300
}
1301
1302
ret = init_gnutls_global(pubkey, seckey);
1303
if(ret == -1){
1304
fprintf(stderr, "init_gnutls_global failed\n");
1305
exitcode = EXIT_FAILURE;
1306
goto end;
1307
} else {
1308
gnutls_initialized = true;
1309
}
1310
1311
if(quit_now){
1312
goto end;
1313
}
1314
1315
tempdir_created = true;
1316
if(mkdtemp(tempdir) == NULL){
1317
tempdir_created = false;
1318
perror("mkdtemp");
1319
goto end;
1320
}
1321
1322
if(quit_now){
1323
goto end;
1324
}
1325
1326
if(not init_gpgme(pubkey, seckey, tempdir)){
1327
fprintf(stderr, "init_gpgme failed\n");
1328
exitcode = EXIT_FAILURE;
1329
goto end;
1330
} else {
1331
gpgme_initialized = true;
1332
}
1333
1334
if(quit_now){
1335
goto end;
1336
}
1337
1338
if(connect_to != NULL){
1339
/* Connect directly, do not use Zeroconf */
1340
/* (Mainly meant for debugging) */
1341
char *address = strrchr(connect_to, ':');
1342
if(address == NULL){
1343
fprintf(stderr, "No colon in address\n");
1344
exitcode = EXIT_FAILURE;
1345
goto end;
1346
}
1347
1348
if(quit_now){
1349
goto end;
1350
}
1351
1352
uint16_t port;
1353
errno = 0;
1354
tmpmax = strtoimax(address+1, &tmp, 10);
1355
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1356
or tmpmax != (uint16_t)tmpmax){
1357
fprintf(stderr, "Bad port number\n");
1358
exitcode = EXIT_FAILURE;
1359
goto end;
1360
}
1361
1362
if(quit_now){
1363
goto end;
1364
}
1365
1366
port = (uint16_t)tmpmax;
1367
*address = '\0';
1368
address = connect_to;
1369
/* Colon in address indicates IPv6 */
1370
int af;
1371
if(strchr(address, ':') != NULL){
1372
af = AF_INET6;
1373
} else {
1374
af = AF_INET;
1375
}
1376
1377
if(quit_now){
1378
goto end;
1379
}
1380
1381
ret = start_mandos_communication(address, port, if_index, af);
1382
if(ret < 0){
1383
exitcode = EXIT_FAILURE;
1384
} else {
1385
exitcode = EXIT_SUCCESS;
1386
}
1387
goto end;
1388
}
1389
1390
if(quit_now){
1391
goto end;
1392
}
1393
1394
{
586
static void browse_callback(
587
AvahiSServiceBrowser *b,
588
AvahiIfIndex interface,
589
AvahiProtocol protocol,
590
AvahiBrowserEvent event,
591
const char *name,
592
const char *type,
593
const char *domain,
594
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
595
void* userdata) {
596
597
AvahiServer *s = userdata;
598
assert(b); /* Spurious warning */
599
600
/* Called whenever a new services becomes available on the LAN or
601
is removed from the LAN */
602
603
switch (event) {
604
default:
605
case AVAHI_BROWSER_FAILURE:
606
607
fprintf(stderr, "(Browser) %s\n",
608
avahi_strerror(avahi_server_errno(server)));
609
avahi_simple_poll_quit(simple_poll);
610
return;
611
612
case AVAHI_BROWSER_NEW:
613
/* We ignore the returned resolver object. In the callback
614
function we free it. If the server is terminated before
615
the callback function is called the server will free
616
the resolver for us. */
617
618
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
619
type, domain,
620
AVAHI_PROTO_INET6, 0,
621
resolve_callback, s)))
622
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
623
avahi_strerror(avahi_server_errno(s)));
624
break;
625
626
case AVAHI_BROWSER_REMOVE:
627
break;
628
629
case AVAHI_BROWSER_ALL_FOR_NOW:
630
case AVAHI_BROWSER_CACHE_EXHAUSTED:
631
break;
632
}
633
}
634
635
/* Combines file name and path and returns the malloced new
636
string. some sane checks could/should be added */
637
static const char *combinepath(const char *first, const char *second){
638
size_t f_len = strlen(first);
639
size_t s_len = strlen(second);
640
char *tmp = malloc(f_len + s_len + 2);
641
if (tmp == NULL){
642
return NULL;
643
}
644
if(f_len > 0){
645
memcpy(tmp, first, f_len);
646
}
647
tmp[f_len] = '/';
648
if(s_len > 0){
649
memcpy(tmp + f_len + 1, second, s_len);
650
}
651
tmp[f_len + 1 + s_len] = '\0';
652
return tmp;
653
}
654
655
656
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1395
657
AvahiServerConfig config;
1396
/* Do not publish any local Zeroconf records */
658
AvahiSServiceBrowser *sb = NULL;
659
int error;
660
int ret;
661
int debug_int = 0;
662
int returncode = EXIT_SUCCESS;
663
const char *interface = NULL;
664
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
665
char *connect_to = NULL;
666
667
debug_int = debug ? 1 : 0;
668
while (true){
669
static struct option long_options[] = {
670
{"debug", no_argument, &debug_int, 1},
671
{"connect", required_argument, NULL, 'C'},
672
{"interface", required_argument, NULL, 'i'},
673
{"keydir", required_argument, NULL, 'd'},
674
{"seckey", required_argument, NULL, 'c'},
675
{"pubkey", required_argument, NULL, 'k'},
676
{"dh-bits", required_argument, NULL, 'D'},
677
{0, 0, 0, 0} };
678
679
int option_index = 0;
680
ret = getopt_long (argc, argv, "i:", long_options,
681
&option_index);
682
683
if (ret == -1){
684
break;
685
}
686
687
switch(ret){
688
case 0:
689
break;
690
case 'i':
691
interface = optarg;
692
break;
693
case 'C':
694
connect_to = optarg;
695
break;
696
case 'd':
697
keydir = optarg;
698
break;
699
case 'c':
700
pubkeyfile = optarg;
701
break;
702
case 'k':
703
seckeyfile = optarg;
704
break;
705
case 'D':
706
dh_bits = atoi(optarg);
707
break;
708
case '?':
709
break
710
default:
711
exit(EXIT_FAILURE);
712
}
713
}
714
debug = debug_int ? true : false;
715
716
pubkeyfile = combinepath(keydir, pubkeyfile);
717
if (pubkeyfile == NULL){
718
perror("combinepath");
719
goto exit;
720
}
721
722
if(interface != NULL){
723
if_index = (AvahiIfIndex) if_nametoindex(interface);
724
if(if_index == 0){
725
fprintf(stderr, "No such interface: \"%s\"\n", interface);
726
exit(EXIT_FAILURE);
727
}
728
}
729
730
if(connect_to != NULL){
731
/* Connect directly, do not use Zeroconf */
732
/* (Mainly meant for debugging) */
733
char *address = strrchr(connect_to, ':');
734
if(address == NULL){
735
fprintf(stderr, "No colon in address\n");
736
exit(EXIT_FAILURE);
737
}
738
errno = 0;
739
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
740
if(errno){
741
perror("Bad port number");
742
exit(EXIT_FAILURE);
743
}
744
*address = '\0';
745
address = connect_to;
746
ret = start_mandos_communication(address, port, if_index);
747
if(ret < 0){
748
exit(EXIT_FAILURE);
749
} else {
750
exit(EXIT_SUCCESS);
751
}
752
}
753
754
seckeyfile = combinepath(keydir, seckeyfile);
755
if (seckeyfile == NULL){
756
perror("combinepath");
757
goto exit;
758
}
759
760
if (not debug){
761
avahi_set_log_function(empty_log);
762
}
763
764
/* Initialize the psuedo-RNG */
765
srand((unsigned int) time(NULL));
766
767
/* Allocate main loop object */
768
if (!(simple_poll = avahi_simple_poll_new())) {
769
fprintf(stderr, "Failed to create simple poll object.\n");
770
771
goto exit;
772
}
773
774
/* Do not publish any local records */
1397
775
avahi_server_config_init(&config);
1398
776
config.publish_hinfo = 0;
1399
777
config.publish_addresses = 0;
1400
778
config.publish_workstation = 0;
1401
779
config.publish_domain = 0;
1402
780
1403
781
/* Allocate a new server */
1404
mc.server = avahi_server_new(avahi_simple_poll_get
1405
(mc.simple_poll), &config, NULL,
1406
NULL, &error);
1407
1408
/* Free the Avahi configuration data */
782
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
783
&config, NULL, NULL, &error);
784
785
/* Free the configuration data */
1409
786
avahi_server_config_free(&config);
1410
}
1411
1412
/* Check if creating the Avahi server object succeeded */
1413
if(mc.server == NULL){
1414
fprintf(stderr, "Failed to create Avahi server: %s\n",
1415
avahi_strerror(error));
1416
exitcode = EXIT_FAILURE;
1417
goto end;
1418
}
1419
1420
if(quit_now){
1421
goto end;
1422
}
1423
1424
/* Create the Avahi service browser */
1425
sb = avahi_s_service_browser_new(mc.server, if_index,
1426
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1427
NULL, 0, browse_callback, NULL);
1428
if(sb == NULL){
1429
fprintf(stderr, "Failed to create service browser: %s\n",
1430
avahi_strerror(avahi_server_errno(mc.server)));
1431
exitcode = EXIT_FAILURE;
1432
goto end;
1433
}
1434
1435
if(quit_now){
1436
goto end;
1437
}
1438
1439
/* Run the main loop */
1440
1441
if(debug){
1442
fprintf(stderr, "Starting Avahi loop search\n");
1443
}
1444
1445
avahi_simple_poll_loop(mc.simple_poll);
1446
1447
end:
1448
1449
if(debug){
1450
fprintf(stderr, "%s exiting\n", argv[0]);
1451
}
1452
1453
/* Cleanup things */
1454
if(sb != NULL)
1455
avahi_s_service_browser_free(sb);
1456
1457
if(mc.server != NULL)
1458
avahi_server_free(mc.server);
1459
1460
if(mc.simple_poll != NULL)
1461
avahi_simple_poll_free(mc.simple_poll);
1462
1463
if(gnutls_initialized){
1464
gnutls_certificate_free_credentials(mc.cred);
1465
gnutls_global_deinit();
1466
gnutls_dh_params_deinit(mc.dh_params);
1467
}
1468
1469
if(gpgme_initialized){
1470
gpgme_release(mc.ctx);
1471
}
1472
1473
/* Take down the network interface */
1474
if(take_down_interface){
1475
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1476
if(ret == -1){
1477
perror("ioctl SIOCGIFFLAGS");
1478
} else if(network.ifr_flags & IFF_UP) {
1479
network.ifr_flags &= ~IFF_UP; /* clear flag */
1480
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1481
if(ret == -1){
1482
perror("ioctl SIOCSIFFLAGS");
1483
}
1484
}
1485
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1486
if(ret == -1){
1487
perror("close");
1488
}
1489
}
1490
1491
/* Removes the temp directory used by GPGME */
1492
if(tempdir_created){
1493
DIR *d;
1494
struct dirent *direntry;
1495
d = opendir(tempdir);
1496
if(d == NULL){
1497
if(errno != ENOENT){
1498
perror("opendir");
1499
}
1500
} else {
1501
while(true){
1502
direntry = readdir(d);
1503
if(direntry == NULL){
1504
break;
1505
}
1506
/* Skip "." and ".." */
1507
if(direntry->d_name[0] == '.'
1508
and (direntry->d_name[1] == '\0'
1509
or (direntry->d_name[1] == '.'
1510
and direntry->d_name[2] == '\0'))){
1511
continue;
1512
}
1513
char *fullname = NULL;
1514
ret = asprintf(&fullname, "%s/%s", tempdir,
1515
direntry->d_name);
1516
if(ret < 0){
1517
perror("asprintf");
1518
continue;
1519
}
1520
ret = remove(fullname);
1521
if(ret == -1){
1522
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1523
strerror(errno));
1524
}
1525
free(fullname);
1526
}
1527
closedir(d);
1528
}
1529
ret = rmdir(tempdir);
1530
if(ret == -1 and errno != ENOENT){
1531
perror("rmdir");
1532
}
1533
}
1534
1535
if(quit_now){
1536
sigemptyset(&old_sigterm_action.sa_mask);
1537
old_sigterm_action.sa_handler = SIG_DFL;
1538
ret = sigaction(signal_received, &old_sigterm_action, NULL);
1539
if(ret == -1){
1540
perror("sigaction");
1541
}
1542
raise(signal_received);
1543
}
1544
1545
return exitcode;
787
788
/* Check if creating the server object succeeded */
789
if (!server) {
790
fprintf(stderr, "Failed to create server: %s\n",
791
avahi_strerror(error));
792
returncode = EXIT_FAILURE;
793
goto exit;
794
}
795
796
/* Create the service browser */
797
sb = avahi_s_service_browser_new(server, if_index,
798
AVAHI_PROTO_INET6,
799
"_mandos._tcp", NULL, 0,
800
browse_callback, server);
801
if (!sb) {
802
fprintf(stderr, "Failed to create service browser: %s\n",
803
avahi_strerror(avahi_server_errno(server)));
804
returncode = EXIT_FAILURE;
805
goto exit;
806
}
807
808
/* Run the main loop */
809
810
if (debug){
811
fprintf(stderr, "Starting avahi loop search\n");
812
}
813
814
avahi_simple_poll_loop(simple_poll);
815
816
exit:
817
818
if (debug){
819
fprintf(stderr, "%s exiting\n", argv[0]);
820
}
821
822
/* Cleanup things */
823
if (sb)
824
avahi_s_service_browser_free(sb);
825
826
if (server)
827
avahi_server_free(server);
828
829
if (simple_poll)
830
avahi_simple_poll_free(simple_poll);
831
free(pubkeyfile);
832
free(seckeyfile);
833
834
return returncode;
1546
835
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0