To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 41
- compare with another revision
- download diff
- download tarball
- view history from revision 41
- Committer: Teddy Hogeborn
- Date: 2008-08-03 21:45:14 UTC
- mfrom: (24.1.13 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080803214514-plvvkrpoitwsrxeg
Merge.
- files modified:
- TODO
added
removed
plugins.d/mandosclient.c
32
32
#define _LARGEFILE_SOURCE
33
33
#define _FILE_OFFSET_BITS 64
34
34
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
35
37
#include <stdio.h>
36
38
#include <assert.h>
37
39
#include <stdlib.h>
38
40
#include <time.h>
39
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
44
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
45
SIOCSIFFLAGS */
40
46
41
47
#include <avahi-core/core.h>
42
48
#include <avahi-core/lookup.h>
45
51
#include <avahi-common/malloc.h>
46
52
#include <avahi-common/error.h>
47
53
48
//mandos client part
54
/* Mandos client part */
49
55
#include <sys/types.h> /* socket(), inet_pton() */
50
56
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
57
struct in6_addr, inet_pton() */
58
64
#include <string.h> /* memset */
59
65
#include <arpa/inet.h> /* inet_pton() */
60
66
#include <iso646.h> /* not */
67
#include <net/if.h> /* IF_NAMESIZE */
61
68
62
// gpgme
69
/* GPGME */
63
70
#include <errno.h> /* perror() */
64
71
#include <gpgme.h>
65
72
66
// getopt long
73
/* getopt_long */
67
74
#include <getopt.h>
68
75
69
76
#define BUFFER_SIZE 256
70
#define DH_BITS 1024
71
77
72
static const char *certdir = "/conf/conf.d/mandos";
73
static const char *certfile = "openpgp-client.txt";
74
static const char *certkey = "openpgp-client-key.txt";
78
static const char *keydir = "/conf/conf.d/mandos";
79
static const char *pubkeyfile = "pubkey.txt";
80
static const char *seckeyfile = "seckey.txt";
75
81
76
82
bool debug = false;
77
83
84
const char mandos_protocol_version[] = "1";
85
86
/* Used for passing in values through all the callback functions */
78
87
typedef struct {
79
gnutls_session_t session;
88
AvahiSimplePoll *simple_poll;
89
AvahiServer *server;
80
90
gnutls_certificate_credentials_t cred;
91
unsigned int dh_bits;
81
92
gnutls_dh_params_t dh_params;
82
} encrypted_session;
83
84
85
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
86
char **new_packet,
93
const char *priority;
94
} mandos_context;
95
96
size_t adjustbuffer(char **buffer, size_t buffer_length,
97
size_t buffer_capacity){
98
if (buffer_length + BUFFER_SIZE > buffer_capacity){
99
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
100
if (buffer == NULL){
101
return 0;
102
}
103
buffer_capacity += BUFFER_SIZE;
104
}
105
return buffer_capacity;
106
}
107
108
/*
109
* Decrypt OpenPGP data using keyrings in HOMEDIR.
110
* Returns -1 on error
111
*/
112
static ssize_t pgp_packet_decrypt (const char *cryptotext,
113
size_t crypto_size,
114
char **plaintext,
87
115
const char *homedir){
88
116
gpgme_data_t dh_crypto, dh_plain;
89
117
gpgme_ctx_t ctx;
90
118
gpgme_error_t rc;
91
119
ssize_t ret;
92
ssize_t new_packet_capacity = 0;
93
ssize_t new_packet_length = 0;
120
size_t plaintext_capacity = 0;
121
ssize_t plaintext_length = 0;
94
122
gpgme_engine_info_t engine_info;
95
123
96
124
if (debug){
97
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
125
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
98
126
}
99
127
100
128
/* Init GPGME */
106
134
return -1;
107
135
}
108
136
109
/* Set GPGME home directory */
137
/* Set GPGME home directory for the OpenPGP engine only */
110
138
rc = gpgme_get_engine_info (&engine_info);
111
139
if (rc != GPG_ERR_NO_ERROR){
112
140
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
122
150
engine_info = engine_info->next;
123
151
}
124
152
if(engine_info == NULL){
125
fprintf(stderr, "Could not set home dir to %s\n", homedir);
153
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
126
154
return -1;
127
155
}
128
156
129
/* Create new GPGME data buffer from packet buffer */
130
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
157
/* Create new GPGME data buffer from memory cryptotext */
158
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
159
0);
131
160
if (rc != GPG_ERR_NO_ERROR){
132
161
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
133
162
gpgme_strsource(rc), gpgme_strerror(rc));
139
168
if (rc != GPG_ERR_NO_ERROR){
140
169
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
141
170
gpgme_strsource(rc), gpgme_strerror(rc));
171
gpgme_data_release(dh_crypto);
142
172
return -1;
143
173
}
144
174
147
177
if (rc != GPG_ERR_NO_ERROR){
148
178
fprintf(stderr, "bad gpgme_new: %s: %s\n",
149
179
gpgme_strsource(rc), gpgme_strerror(rc));
150
return -1;
180
plaintext_length = -1;
181
goto decrypt_end;
151
182
}
152
183
153
/* Decrypt data from the FILE pointer to the plaintext data
154
buffer */
184
/* Decrypt data from the cryptotext data buffer to the plaintext
185
data buffer */
155
186
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
156
187
if (rc != GPG_ERR_NO_ERROR){
157
188
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
158
189
gpgme_strsource(rc), gpgme_strerror(rc));
159
return -1;
190
plaintext_length = -1;
191
goto decrypt_end;
160
192
}
161
193
162
194
if(debug){
163
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
195
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
164
196
}
165
197
166
198
if (debug){
167
199
gpgme_decrypt_result_t result;
168
200
result = gpgme_op_decrypt_result(ctx);
192
224
}
193
225
}
194
226
195
/* Delete the GPGME FILE pointer cryptotext data buffer */
196
gpgme_data_release(dh_crypto);
197
198
227
/* Seek back to the beginning of the GPGME plaintext data buffer */
199
228
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
200
229
perror("pgpme_data_seek");
230
plaintext_length = -1;
231
goto decrypt_end;
201
232
}
202
233
203
*new_packet = 0;
234
*plaintext = NULL;
204
235
while(true){
205
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
206
*new_packet = realloc(*new_packet,
207
(unsigned int)new_packet_capacity
208
+ BUFFER_SIZE);
209
if (*new_packet == NULL){
210
perror("realloc");
211
return -1;
212
}
213
new_packet_capacity += BUFFER_SIZE;
236
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
237
plaintext_capacity);
238
if (plaintext_capacity == 0){
239
perror("adjustbuffer");
240
plaintext_length = -1;
241
goto decrypt_end;
214
242
}
215
243
216
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
244
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
217
245
BUFFER_SIZE);
218
246
/* Print the data, if any */
219
247
if (ret == 0){
248
/* EOF */
220
249
break;
221
250
}
222
251
if(ret < 0){
223
252
perror("gpgme_data_read");
224
return -1;
253
plaintext_length = -1;
254
goto decrypt_end;
225
255
}
226
new_packet_length += ret;
256
plaintext_length += ret;
227
257
}
228
258
229
/* FIXME: check characters before printing to screen so to not print
230
terminal control characters */
231
/* if(debug){ */
232
/* fprintf(stderr, "decrypted password is: "); */
233
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
234
/* fprintf(stderr, "\n"); */
235
/* } */
259
if(debug){
260
fprintf(stderr, "Decrypted password is: ");
261
for(ssize_t i = 0; i < plaintext_length; i++){
262
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
263
}
264
fprintf(stderr, "\n");
265
}
266
267
decrypt_end:
268
269
/* Delete the GPGME cryptotext data buffer */
270
gpgme_data_release(dh_crypto);
236
271
237
272
/* Delete the GPGME plaintext data buffer */
238
273
gpgme_data_release(dh_plain);
239
return new_packet_length;
274
return plaintext_length;
240
275
}
241
276
242
277
static const char * safer_gnutls_strerror (int value) {
246
281
return ret;
247
282
}
248
283
284
/* GnuTLS log function callback */
249
285
static void debuggnutls(__attribute__((unused)) int level,
250
286
const char* string){
251
fprintf(stderr, "%s", string);
287
fprintf(stderr, "GnuTLS: %s", string);
252
288
}
253
289
254
static int initgnutls(encrypted_session *es){
255
const char *err;
290
static int init_gnutls_global(mandos_context *mc){
256
291
int ret;
257
292
258
293
if(debug){
261
296
262
297
if ((ret = gnutls_global_init ())
263
298
!= GNUTLS_E_SUCCESS) {
264
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
299
fprintf (stderr, "GnuTLS global_init: %s\n",
300
safer_gnutls_strerror(ret));
265
301
return -1;
266
302
}
267
303
268
304
if (debug){
305
/* "Use a log level over 10 to enable all debugging options."
306
* - GnuTLS manual
307
*/
269
308
gnutls_global_set_log_level(11);
270
309
gnutls_global_set_log_function(debuggnutls);
271
310
}
272
311
273
/* openpgp credentials */
274
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
312
/* OpenPGP credentials */
313
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
275
314
!= GNUTLS_E_SUCCESS) {
276
fprintf (stderr, "memory error: %s\n",
315
fprintf (stderr, "GnuTLS memory error: %s\n",
277
316
safer_gnutls_strerror(ret));
278
317
return -1;
279
318
}
280
319
281
320
if(debug){
282
321
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
283
" and keyfile %s as GnuTLS credentials\n", certfile,
284
certkey);
322
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
323
seckeyfile);
285
324
}
286
325
287
326
ret = gnutls_certificate_set_openpgp_key_file
288
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
327
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
289
328
if (ret != GNUTLS_E_SUCCESS) {
290
fprintf
291
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
292
" '%s')\n",
293
ret, certfile, certkey);
294
fprintf(stdout, "The Error is: %s\n",
329
fprintf(stderr,
330
"Error[%d] while reading the OpenPGP key pair ('%s',"
331
" '%s')\n", ret, pubkeyfile, seckeyfile);
332
fprintf(stdout, "The GnuTLS error is: %s\n",
295
333
safer_gnutls_strerror(ret));
296
334
return -1;
297
335
}
298
336
299
//GnuTLS server initialization
300
if ((ret = gnutls_dh_params_init (&es->dh_params))
301
!= GNUTLS_E_SUCCESS) {
302
fprintf (stderr, "Error in dh parameter initialization: %s\n",
303
safer_gnutls_strerror(ret));
304
return -1;
305
}
306
307
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
308
!= GNUTLS_E_SUCCESS) {
309
fprintf (stderr, "Error in prime generation: %s\n",
310
safer_gnutls_strerror(ret));
311
return -1;
312
}
313
314
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
315
316
// GnuTLS session creation
317
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
318
!= GNUTLS_E_SUCCESS){
337
/* GnuTLS server initialization */
338
ret = gnutls_dh_params_init(&mc->dh_params);
339
if (ret != GNUTLS_E_SUCCESS) {
340
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
341
" %s\n", safer_gnutls_strerror(ret));
342
return -1;
343
}
344
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
345
if (ret != GNUTLS_E_SUCCESS) {
346
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
347
safer_gnutls_strerror(ret));
348
return -1;
349
}
350
351
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
352
353
return 0;
354
}
355
356
static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
357
int ret;
358
/* GnuTLS session creation */
359
ret = gnutls_init(session, GNUTLS_SERVER);
360
if (ret != GNUTLS_E_SUCCESS){
319
361
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
320
362
safer_gnutls_strerror(ret));
321
363
}
322
364
323
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
324
!= GNUTLS_E_SUCCESS) {
325
fprintf(stderr, "Syntax error at: %s\n", err);
326
fprintf(stderr, "GnuTLS error: %s\n",
327
safer_gnutls_strerror(ret));
328
return -1;
365
{
366
const char *err;
367
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
368
if (ret != GNUTLS_E_SUCCESS) {
369
fprintf(stderr, "Syntax error at: %s\n", err);
370
fprintf(stderr, "GnuTLS error: %s\n",
371
safer_gnutls_strerror(ret));
372
return -1;
373
}
329
374
}
330
375
331
if ((ret = gnutls_credentials_set
332
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
333
!= GNUTLS_E_SUCCESS) {
334
fprintf(stderr, "Error setting a credentials set: %s\n",
376
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
377
mc->cred);
378
if (ret != GNUTLS_E_SUCCESS) {
379
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
335
380
safer_gnutls_strerror(ret));
336
381
return -1;
337
382
}
338
383
339
384
/* ignore client certificate if any. */
340
gnutls_certificate_server_set_request (es->session,
385
gnutls_certificate_server_set_request (*session,
341
386
GNUTLS_CERT_IGNORE);
342
387
343
gnutls_dh_set_prime_bits (es->session, DH_BITS);
388
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
344
389
345
390
return 0;
346
391
}
347
392
393
/* Avahi log function callback */
348
394
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
349
395
__attribute__((unused)) const char *txt){}
350
396
397
/* Called when a Mandos server is found */
351
398
static int start_mandos_communication(const char *ip, uint16_t port,
352
AvahiIfIndex if_index){
399
AvahiIfIndex if_index,
400
mandos_context *mc){
353
401
int ret, tcp_sd;
354
402
struct sockaddr_in6 to;
355
encrypted_session es;
356
403
char *buffer = NULL;
357
404
char *decrypted_buffer;
358
405
size_t buffer_length = 0;
359
406
size_t buffer_capacity = 0;
360
407
ssize_t decrypted_buffer_size;
361
size_t written = 0;
408
size_t written;
362
409
int retval = 0;
363
410
char interface[IF_NAMESIZE];
411
gnutls_session_t session;
412
gnutls_dh_params_t dh_params;
413
414
ret = init_gnutls_session (mc, &session);
415
if (ret != 0){
416
return -1;
417
}
364
418
365
419
if(debug){
366
420
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
372
426
perror("socket");
373
427
return -1;
374
428
}
375
376
if(if_indextoname((unsigned int)if_index, interface) == NULL){
377
if(debug){
429
430
if(debug){
431
if(if_indextoname((unsigned int)if_index, interface) == NULL){
378
432
perror("if_indextoname");
433
return -1;
379
434
}
380
return -1;
381
}
382
383
if(debug){
384
435
fprintf(stderr, "Binding to interface %s\n", interface);
385
436
}
386
437
387
438
memset(&to,0,sizeof(to)); /* Spurious warning */
388
439
to.sin6_family = AF_INET6;
440
/* It would be nice to have a way to detect if we were passed an
441
IPv4 address here. Now we assume an IPv6 address. */
389
442
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
390
443
if (ret < 0 ){
391
444
perror("inet_pton");
392
445
return -1;
393
}
446
}
394
447
if(ret == 0){
395
448
fprintf(stderr, "Bad address: %s\n", ip);
396
449
return -1;
401
454
402
455
if(debug){
403
456
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
404
/* char addrstr[INET6_ADDRSTRLEN]; */
405
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
406
/* sizeof(addrstr)) == NULL){ */
407
/* perror("inet_ntop"); */
408
/* } else { */
409
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
410
/* addrstr, ntohs(to.sin6_port)); */
411
/* } */
457
char addrstr[INET6_ADDRSTRLEN] = "";
458
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
459
sizeof(addrstr)) == NULL){
460
perror("inet_ntop");
461
} else {
462
if(strcmp(addrstr, ip) != 0){
463
fprintf(stderr, "Canonical address form: %s\n", addrstr);
464
}
465
}
412
466
}
413
467
414
468
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
416
470
perror("connect");
417
471
return -1;
418
472
}
419
420
ret = initgnutls (&es);
421
if (ret != 0){
422
retval = -1;
423
return -1;
473
474
const char *out = mandos_protocol_version;
475
written = 0;
476
while (true){
477
size_t out_size = strlen(out);
478
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
479
out_size - written));
480
if (ret == -1){
481
perror("write");
482
retval = -1;
483
goto mandos_end;
484
}
485
written += (size_t)ret;
486
if(written < out_size){
487
continue;
488
} else {
489
if (out == mandos_protocol_version){
490
written = 0;
491
out = "\r\n";
492
} else {
493
break;
494
}
495
}
424
496
}
425
426
gnutls_transport_set_ptr (es.session,
427
(gnutls_transport_ptr_t) tcp_sd);
428
497
429
498
if(debug){
430
499
fprintf(stderr, "Establishing TLS session with %s\n", ip);
431
500
}
432
501
433
ret = gnutls_handshake (es.session);
502
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
503
504
ret = gnutls_handshake (session);
434
505
435
506
if (ret != GNUTLS_E_SUCCESS){
436
507
if(debug){
437
fprintf(stderr, "\n*** Handshake failed ***\n");
508
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
438
509
gnutls_perror (ret);
439
510
}
440
511
retval = -1;
441
goto exit;
512
goto mandos_end;
442
513
}
443
514
444
//Retrieve OpenPGP packet that contains the wanted password
515
/* Read OpenPGP packet that contains the wanted password */
445
516
446
517
if(debug){
447
518
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
449
520
}
450
521
451
522
while(true){
452
if (buffer_length + BUFFER_SIZE > buffer_capacity){
453
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
454
if (buffer == NULL){
455
perror("realloc");
456
goto exit;
457
}
458
buffer_capacity += BUFFER_SIZE;
523
buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);
524
if (buffer_capacity == 0){
525
perror("adjustbuffer");
526
retval = -1;
527
goto mandos_end;
459
528
}
460
529
461
ret = gnutls_record_recv
462
(es.session, buffer+buffer_length, BUFFER_SIZE);
530
ret = gnutls_record_recv(session, buffer+buffer_length,
531
BUFFER_SIZE);
463
532
if (ret == 0){
464
533
break;
465
534
}
469
538
case GNUTLS_E_AGAIN:
470
539
break;
471
540
case GNUTLS_E_REHANDSHAKE:
472
ret = gnutls_handshake (es.session);
541
ret = gnutls_handshake (session);
473
542
if (ret < 0){
474
fprintf(stderr, "\n*** Handshake failed ***\n");
543
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
475
544
gnutls_perror (ret);
476
545
retval = -1;
477
goto exit;
546
goto mandos_end;
478
547
}
479
548
break;
480
549
default:
481
550
fprintf(stderr, "Unknown error while reading data from"
482
" encrypted session with mandos server\n");
551
" encrypted session with Mandos server\n");
483
552
retval = -1;
484
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
485
goto exit;
553
gnutls_bye (session, GNUTLS_SHUT_RDWR);
554
goto mandos_end;
486
555
}
487
556
} else {
488
557
buffer_length += (size_t) ret;
489
558
}
490
559
}
491
560
561
if(debug){
562
fprintf(stderr, "Closing TLS session\n");
563
}
564
565
gnutls_bye (session, GNUTLS_SHUT_RDWR);
566
492
567
if (buffer_length > 0){
493
568
decrypted_buffer_size = pgp_packet_decrypt(buffer,
494
569
buffer_length,
495
570
&decrypted_buffer,
496
certdir);
571
keydir);
497
572
if (decrypted_buffer_size >= 0){
573
written = 0;
498
574
while(written < (size_t) decrypted_buffer_size){
499
575
ret = (int)fwrite (decrypted_buffer + written, 1,
500
576
(size_t)decrypted_buffer_size - written,
514
590
retval = -1;
515
591
}
516
592
}
517
518
//shutdown procedure
519
520
if(debug){
521
fprintf(stderr, "Closing TLS session\n");
522
}
523
593
594
/* Shutdown procedure */
595
596
mandos_end:
524
597
free(buffer);
525
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
526
exit:
527
598
close(tcp_sd);
528
gnutls_deinit (es.session);
529
gnutls_certificate_free_credentials (es.cred);
599
gnutls_deinit (session);
600
gnutls_certificate_free_credentials (mc->cred);
530
601
gnutls_global_deinit ();
531
602
return retval;
532
603
}
533
604
534
static AvahiSimplePoll *simple_poll = NULL;
535
static AvahiServer *server = NULL;
536
537
static void resolve_callback(
538
AvahiSServiceResolver *r,
539
AvahiIfIndex interface,
540
AVAHI_GCC_UNUSED AvahiProtocol protocol,
541
AvahiResolverEvent event,
542
const char *name,
543
const char *type,
544
const char *domain,
545
const char *host_name,
546
const AvahiAddress *address,
547
uint16_t port,
548
AVAHI_GCC_UNUSED AvahiStringList *txt,
549
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
550
AVAHI_GCC_UNUSED void* userdata) {
551
605
static void resolve_callback(AvahiSServiceResolver *r,
606
AvahiIfIndex interface,
607
AVAHI_GCC_UNUSED AvahiProtocol protocol,
608
AvahiResolverEvent event,
609
const char *name,
610
const char *type,
611
const char *domain,
612
const char *host_name,
613
const AvahiAddress *address,
614
uint16_t port,
615
AVAHI_GCC_UNUSED AvahiStringList *txt,
616
AVAHI_GCC_UNUSED AvahiLookupResultFlags
617
flags,
618
void* userdata) {
619
mandos_context *mc = userdata;
552
620
assert(r); /* Spurious warning */
553
621
554
622
/* Called whenever a service has been resolved successfully or
557
625
switch (event) {
558
626
default:
559
627
case AVAHI_RESOLVER_FAILURE:
560
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
561
" type '%s' in domain '%s': %s\n", name, type, domain,
562
avahi_strerror(avahi_server_errno(server)));
628
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
629
" of type '%s' in domain '%s': %s\n", name, type, domain,
630
avahi_strerror(avahi_server_errno(mc->server)));
563
631
break;
564
632
565
633
case AVAHI_RESOLVER_FOUND:
567
635
char ip[AVAHI_ADDRESS_STR_MAX];
568
636
avahi_address_snprint(ip, sizeof(ip), address);
569
637
if(debug){
570
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
571
" port %d\n", name, host_name, ip, port);
638
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"
639
" port %d\n", name, host_name, ip, interface, port);
572
640
}
573
int ret = start_mandos_communication(ip, port, interface);
641
int ret = start_mandos_communication(ip, port, interface, mc);
574
642
if (ret == 0){
575
643
exit(EXIT_SUCCESS);
576
644
}
579
647
avahi_s_service_resolver_free(r);
580
648
}
581
649
582
static void browse_callback(
583
AvahiSServiceBrowser *b,
584
AvahiIfIndex interface,
585
AvahiProtocol protocol,
586
AvahiBrowserEvent event,
587
const char *name,
588
const char *type,
589
const char *domain,
590
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
591
void* userdata) {
592
593
AvahiServer *s = userdata;
594
assert(b); /* Spurious warning */
595
596
/* Called whenever a new services becomes available on the LAN or
597
is removed from the LAN */
598
599
switch (event) {
600
default:
601
case AVAHI_BROWSER_FAILURE:
602
603
fprintf(stderr, "(Browser) %s\n",
604
avahi_strerror(avahi_server_errno(server)));
605
avahi_simple_poll_quit(simple_poll);
606
return;
607
608
case AVAHI_BROWSER_NEW:
609
/* We ignore the returned resolver object. In the callback
610
function we free it. If the server is terminated before
611
the callback function is called the server will free
612
the resolver for us. */
613
614
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
615
type, domain,
616
AVAHI_PROTO_INET6, 0,
617
resolve_callback, s)))
618
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
619
avahi_strerror(avahi_server_errno(s)));
620
break;
621
622
case AVAHI_BROWSER_REMOVE:
623
break;
624
625
case AVAHI_BROWSER_ALL_FOR_NOW:
626
case AVAHI_BROWSER_CACHE_EXHAUSTED:
627
break;
650
static void browse_callback( AvahiSServiceBrowser *b,
651
AvahiIfIndex interface,
652
AvahiProtocol protocol,
653
AvahiBrowserEvent event,
654
const char *name,
655
const char *type,
656
const char *domain,
657
AVAHI_GCC_UNUSED AvahiLookupResultFlags
658
flags,
659
void* userdata) {
660
mandos_context *mc = userdata;
661
assert(b); /* Spurious warning */
662
663
/* Called whenever a new services becomes available on the LAN or
664
is removed from the LAN */
665
666
switch (event) {
667
default:
668
case AVAHI_BROWSER_FAILURE:
669
670
fprintf(stderr, "(Avahi browser) %s\n",
671
avahi_strerror(avahi_server_errno(mc->server)));
672
avahi_simple_poll_quit(mc->simple_poll);
673
return;
674
675
case AVAHI_BROWSER_NEW:
676
/* We ignore the returned Avahi resolver object. In the callback
677
function we free it. If the Avahi server is terminated before
678
the callback function is called the Avahi server will free the
679
resolver for us. */
680
681
if (!(avahi_s_service_resolver_new(mc->server, interface,
682
protocol, name, type, domain,
683
AVAHI_PROTO_INET6, 0,
684
resolve_callback, mc)))
685
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
686
name, avahi_strerror(avahi_server_errno(mc->server)));
687
break;
688
689
case AVAHI_BROWSER_REMOVE:
690
break;
691
692
case AVAHI_BROWSER_ALL_FOR_NOW:
693
case AVAHI_BROWSER_CACHE_EXHAUSTED:
694
if(debug){
695
fprintf(stderr, "No Mandos server found, still searching...\n");
628
696
}
697
break;
698
}
629
699
}
630
700
631
701
/* Combines file name and path and returns the malloced new
638
708
return NULL;
639
709
}
640
710
if(f_len > 0){
641
memcpy(tmp, first, f_len);
711
memcpy(tmp, first, f_len); /* Spurious warning */
642
712
}
643
713
tmp[f_len] = '/';
644
714
if(s_len > 0){
645
memcpy(tmp + f_len + 1, second, s_len);
715
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
646
716
}
647
717
tmp[f_len + 1 + s_len] = '\0';
648
718
return tmp;
649
719
}
650
720
651
721
652
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
653
AvahiServerConfig config;
722
int main(int argc, char *argv[]){
654
723
AvahiSServiceBrowser *sb = NULL;
655
724
int error;
656
725
int ret;
657
int returncode = EXIT_SUCCESS;
658
const char *interface = NULL;
726
int exitcode = EXIT_SUCCESS;
727
const char *interface = "eth0";
728
struct ifreq network;
729
int sd;
730
uid_t uid;
731
gid_t gid;
732
char *connect_to = NULL;
659
733
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
660
char *connect_to = NULL;
661
662
while (true){
663
static struct option long_options[] = {
664
{"debug", no_argument, (int *)&debug, 1},
665
{"connect", required_argument, 0, 'C'},
666
{"interface", required_argument, 0, 'i'},
667
{"certdir", required_argument, 0, 'd'},
668
{"certkey", required_argument, 0, 'c'},
669
{"certfile", required_argument, 0, 'k'},
670
{0, 0, 0, 0} };
671
672
int option_index = 0;
673
ret = getopt_long (argc, argv, "i:", long_options,
674
&option_index);
675
676
if (ret == -1){
677
break;
678
}
679
680
switch(ret){
681
case 0:
682
break;
683
case 'i':
684
interface = optarg;
685
break;
686
case 'C':
687
connect_to = optarg;
688
break;
689
case 'd':
690
certdir = optarg;
691
break;
692
case 'c':
693
certfile = optarg;
694
break;
695
case 'k':
696
certkey = optarg;
697
break;
698
default:
699
exit(EXIT_FAILURE);
700
}
701
}
702
703
certfile = combinepath(certdir, certfile);
704
if (certfile == NULL){
705
perror("combinepath");
706
goto exit;
707
}
708
709
if(interface != NULL){
710
if_index = (AvahiIfIndex) if_nametoindex(interface);
711
if(if_index == 0){
712
fprintf(stderr, "No such interface: \"%s\"\n", interface);
713
exit(EXIT_FAILURE);
714
}
734
mandos_context mc = { .simple_poll = NULL, .server = NULL,
735
.dh_bits = 1024, .priority = "SECURE256"};
736
737
{
738
/* Temporary int to get the address of for getopt_long */
739
int debug_int = debug ? 1 : 0;
740
while (true){
741
struct option long_options[] = {
742
{"debug", no_argument, &debug_int, 1},
743
{"connect", required_argument, NULL, 'c'},
744
{"interface", required_argument, NULL, 'i'},
745
{"keydir", required_argument, NULL, 'd'},
746
{"seckey", required_argument, NULL, 's'},
747
{"pubkey", required_argument, NULL, 'p'},
748
{"dh-bits", required_argument, NULL, 'D'},
749
{"priority", required_argument, NULL, 'P'},
750
{0, 0, 0, 0} };
751
752
int option_index = 0;
753
ret = getopt_long (argc, argv, "i:", long_options,
754
&option_index);
755
756
if (ret == -1){
757
break;
758
}
759
760
switch(ret){
761
case 0:
762
break;
763
case 'i':
764
interface = optarg;
765
break;
766
case 'c':
767
connect_to = optarg;
768
break;
769
case 'd':
770
keydir = optarg;
771
break;
772
case 'p':
773
pubkeyfile = optarg;
774
break;
775
case 's':
776
seckeyfile = optarg;
777
break;
778
case 'D':
779
errno = 0;
780
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
781
if (errno){
782
perror("strtol");
783
exit(EXIT_FAILURE);
784
}
785
break;
786
case 'P':
787
mc.priority = optarg;
788
break;
789
case '?':
790
default:
791
/* getopt_long() has already printed a message about the
792
unrcognized option, so just exit. */
793
exit(EXIT_FAILURE);
794
}
795
}
796
/* Set the global debug flag from the temporary int */
797
debug = debug_int ? true : false;
798
}
799
800
pubkeyfile = combinepath(keydir, pubkeyfile);
801
if (pubkeyfile == NULL){
802
perror("combinepath");
803
exitcode = EXIT_FAILURE;
804
goto end;
805
}
806
807
seckeyfile = combinepath(keydir, seckeyfile);
808
if (seckeyfile == NULL){
809
perror("combinepath");
810
goto end;
811
}
812
813
ret = init_gnutls_global(&mc);
814
if (ret == -1){
815
fprintf(stderr, "init_gnutls_global\n");
816
goto end;
817
}
818
819
uid = getuid();
820
gid = getgid();
821
822
ret = setuid(uid);
823
if (ret == -1){
824
perror("setuid");
825
}
826
827
setgid(gid);
828
if (ret == -1){
829
perror("setgid");
830
}
831
832
if_index = (AvahiIfIndex) if_nametoindex(interface);
833
if(if_index == 0){
834
fprintf(stderr, "No such interface: \"%s\"\n", interface);
835
exit(EXIT_FAILURE);
715
836
}
716
837
717
838
if(connect_to != NULL){
720
841
char *address = strrchr(connect_to, ':');
721
842
if(address == NULL){
722
843
fprintf(stderr, "No colon in address\n");
723
exit(EXIT_FAILURE);
844
exitcode = EXIT_FAILURE;
845
goto end;
724
846
}
725
847
errno = 0;
726
848
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
727
849
if(errno){
728
850
perror("Bad port number");
729
exit(EXIT_FAILURE);
851
exitcode = EXIT_FAILURE;
852
goto end;
730
853
}
731
854
*address = '\0';
732
855
address = connect_to;
733
ret = start_mandos_communication(address, port, if_index);
856
ret = start_mandos_communication(address, port, if_index, &mc);
734
857
if(ret < 0){
735
exit(EXIT_FAILURE);
858
exitcode = EXIT_FAILURE;
736
859
} else {
737
exit(EXIT_SUCCESS);
860
exitcode = EXIT_SUCCESS;
738
861
}
862
goto end;
739
863
}
740
864
741
certkey = combinepath(certdir, certkey);
742
if (certkey == NULL){
743
perror("combinepath");
744
goto exit;
865
/* If the interface is down, bring it up */
866
{
867
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
868
if(sd < 0) {
869
perror("socket");
870
exitcode = EXIT_FAILURE;
871
goto end;
872
}
873
strcpy(network.ifr_name, interface); /* Spurious warning */
874
ret = ioctl(sd, SIOCGIFFLAGS, &network);
875
if(ret == -1){
876
perror("ioctl SIOCGIFFLAGS");
877
exitcode = EXIT_FAILURE;
878
goto end;
879
}
880
if((network.ifr_flags & IFF_UP) == 0){
881
network.ifr_flags |= IFF_UP;
882
ret = ioctl(sd, SIOCSIFFLAGS, &network);
883
if(ret == -1){
884
perror("ioctl SIOCSIFFLAGS");
885
exitcode = EXIT_FAILURE;
886
goto end;
887
}
888
}
889
close(sd);
745
890
}
746
891
747
892
if (not debug){
748
893
avahi_set_log_function(empty_log);
749
894
}
750
895
751
/* Initialize the psuedo-RNG */
896
/* Initialize the pseudo-RNG for Avahi */
752
897
srand((unsigned int) time(NULL));
753
754
/* Allocate main loop object */
755
if (!(simple_poll = avahi_simple_poll_new())) {
756
fprintf(stderr, "Failed to create simple poll object.\n");
757
758
goto exit;
759
}
760
761
/* Do not publish any local records */
762
avahi_server_config_init(&config);
763
config.publish_hinfo = 0;
764
config.publish_addresses = 0;
765
config.publish_workstation = 0;
766
config.publish_domain = 0;
767
768
/* Allocate a new server */
769
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
770
&config, NULL, NULL, &error);
771
772
/* Free the configuration data */
773
avahi_server_config_free(&config);
774
775
/* Check if creating the server object succeeded */
776
if (!server) {
777
fprintf(stderr, "Failed to create server: %s\n",
898
899
/* Allocate main Avahi loop object */
900
mc.simple_poll = avahi_simple_poll_new();
901
if (mc.simple_poll == NULL) {
902
fprintf(stderr, "Avahi: Failed to create simple poll"
903
" object.\n");
904
exitcode = EXIT_FAILURE;
905
goto end;
906
}
907
908
{
909
AvahiServerConfig config;
910
/* Do not publish any local Zeroconf records */
911
avahi_server_config_init(&config);
912
config.publish_hinfo = 0;
913
config.publish_addresses = 0;
914
config.publish_workstation = 0;
915
config.publish_domain = 0;
916
917
/* Allocate a new server */
918
mc.server = avahi_server_new(avahi_simple_poll_get
919
(mc.simple_poll), &config, NULL,
920
NULL, &error);
921
922
/* Free the Avahi configuration data */
923
avahi_server_config_free(&config);
924
}
925
926
/* Check if creating the Avahi server object succeeded */
927
if (mc.server == NULL) {
928
fprintf(stderr, "Failed to create Avahi server: %s\n",
778
929
avahi_strerror(error));
779
returncode = EXIT_FAILURE;
780
goto exit;
930
exitcode = EXIT_FAILURE;
931
goto end;
781
932
}
782
933
783
/* Create the service browser */
784
sb = avahi_s_service_browser_new(server, if_index,
934
/* Create the Avahi service browser */
935
sb = avahi_s_service_browser_new(mc.server, if_index,
785
936
AVAHI_PROTO_INET6,
786
937
"_mandos._tcp", NULL, 0,
787
browse_callback, server);
788
if (!sb) {
938
browse_callback, &mc);
939
if (sb == NULL) {
789
940
fprintf(stderr, "Failed to create service browser: %s\n",
790
avahi_strerror(avahi_server_errno(server)));
791
returncode = EXIT_FAILURE;
792
goto exit;
941
avahi_strerror(avahi_server_errno(mc.server)));
942
exitcode = EXIT_FAILURE;
943
goto end;
793
944
}
794
945
795
946
/* Run the main loop */
796
947
797
948
if (debug){
798
fprintf(stderr, "Starting avahi loop search\n");
949
fprintf(stderr, "Starting Avahi loop search\n");
799
950
}
800
951
801
avahi_simple_poll_loop(simple_poll);
952
avahi_simple_poll_loop(mc.simple_poll);
802
953
803
exit:
954
end:
804
955
805
956
if (debug){
806
957
fprintf(stderr, "%s exiting\n", argv[0]);
807
958
}
808
959
809
960
/* Cleanup things */
810
if (sb)
961
if (sb != NULL)
811
962
avahi_s_service_browser_free(sb);
812
963
813
if (server)
814
avahi_server_free(server);
964
if (mc.server != NULL)
965
avahi_server_free(mc.server);
815
966
816
if (simple_poll)
817
avahi_simple_poll_free(simple_poll);
818
free(certfile);
819
free(certkey);
967
if (mc.simple_poll != NULL)
968
avahi_simple_poll_free(mc.simple_poll);
969
free(pubkeyfile);
970
free(seckeyfile);
820
971
821
return returncode;
972
return exitcode;
822
973
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0