To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 41
- compare with another revision
- download diff
- download tarball
- view history from revision 41
- Committer: Teddy Hogeborn
- Date: 2008-08-03 21:45:14 UTC
- mfrom: (24.1.13 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080803214514-plvvkrpoitwsrxeg
Merge.
- files added:
- ca.pem
- files removed:
- initramfs-tools-hook
- files renamed:
- mandos-client.c => plugbasedclient.c
- plugins.d/password-request.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
34
34
35
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
36
37
#include <stdio.h> /* fprintf(), stderr, fwrite(), stdout,
38
ferror() */
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
42
srand() */
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), memcpy(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
sockaddr_in6, PF_INET6,
49
SOCK_STREAM, INET6_ADDRSTRLEN,
50
uid_t, gid_t */
51
#include <inttypes.h> /* PRIu16 */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton(),
54
connect() */
55
#include <assert.h> /* assert() */
56
#include <errno.h> /* perror(), errno */
57
#include <time.h> /* time() */
37
#include <stdio.h>
38
#include <assert.h>
39
#include <stdlib.h>
40
#include <time.h>
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
58
44
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
59
SIOCSIFFLAGS, if_indextoname(),
60
if_nametoindex(), IF_NAMESIZE */
61
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
62
getuid(), getgid(), setuid(),
63
setgid() */
64
#include <netinet/in.h>
65
#include <arpa/inet.h> /* inet_pton(), htons */
66
#include <iso646.h> /* not, and */
67
#include <argp.h> /* struct argp_option, error_t, struct
68
argp_state, struct argp,
69
argp_parse(), ARGP_KEY_ARG,
70
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
45
SIOCSIFFLAGS */
71
46
72
/* Avahi */
73
/* All Avahi types, constants and functions
74
Avahi*, avahi_*,
75
AVAHI_* */
76
47
#include <avahi-core/core.h>
77
48
#include <avahi-core/lookup.h>
78
49
#include <avahi-core/log.h>
80
51
#include <avahi-common/malloc.h>
81
52
#include <avahi-common/error.h>
82
53
83
/* GnuTLS */
84
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and functions
85
gnutls_*
86
init_gnutls_session(),
87
GNUTLS_* */
88
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
89
GNUTLS_OPENPGP_FMT_BASE64 */
54
/* Mandos client part */
55
#include <sys/types.h> /* socket(), inet_pton() */
56
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
57
struct in6_addr, inet_pton() */
58
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
59
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
60
61
#include <unistd.h> /* close() */
62
#include <netinet/in.h>
63
#include <stdbool.h> /* true */
64
#include <string.h> /* memset */
65
#include <arpa/inet.h> /* inet_pton() */
66
#include <iso646.h> /* not */
67
#include <net/if.h> /* IF_NAMESIZE */
90
68
91
69
/* GPGME */
92
#include <gpgme.h> /* All GPGME types, constants and functions
93
gpgme_*
94
GPGME_PROTOCOL_OpenPGP,
95
GPG_ERR_NO_* */
70
#include <errno.h> /* perror() */
71
#include <gpgme.h>
72
73
/* getopt_long */
74
#include <getopt.h>
96
75
97
76
#define BUFFER_SIZE 256
98
77
78
static const char *keydir = "/conf/conf.d/mandos";
79
static const char *pubkeyfile = "pubkey.txt";
80
static const char *seckeyfile = "seckey.txt";
81
99
82
bool debug = false;
100
static const char *keydir = "/conf/conf.d/mandos";
101
static const char mandos_protocol_version[] = "1";
102
const char *argp_program_version = "password-request 1.0";
103
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
104
105
/* Used for passing in values through the Avahi callback functions */
83
84
const char mandos_protocol_version[] = "1";
85
86
/* Used for passing in values through all the callback functions */
106
87
typedef struct {
107
88
AvahiSimplePoll *simple_poll;
108
89
AvahiServer *server;
112
93
const char *priority;
113
94
} mandos_context;
114
95
115
/*
116
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
117
* "buffer_capacity" is how much is currently allocated,
118
* "buffer_length" is how much is already used.
119
*/
120
96
size_t adjustbuffer(char **buffer, size_t buffer_length,
121
97
size_t buffer_capacity){
122
98
if (buffer_length + BUFFER_SIZE > buffer_capacity){
227
203
} else {
228
204
fprintf(stderr, "Unsupported algorithm: %s\n",
229
205
result->unsupported_algorithm);
230
fprintf(stderr, "Wrong key usage: %u\n",
206
fprintf(stderr, "Wrong key usage: %d\n",
231
207
result->wrong_key_usage);
232
208
if(result->file_name != NULL){
233
209
fprintf(stderr, "File name: %s\n", result->file_name);
257
233
258
234
*plaintext = NULL;
259
235
while(true){
260
plaintext_capacity = adjustbuffer(plaintext,
261
(size_t)plaintext_length,
236
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
262
237
plaintext_capacity);
263
238
if (plaintext_capacity == 0){
264
239
perror("adjustbuffer");
312
287
fprintf(stderr, "GnuTLS: %s", string);
313
288
}
314
289
315
static int init_gnutls_global(mandos_context *mc,
316
const char *pubkeyfile,
317
const char *seckeyfile){
290
static int init_gnutls_global(mandos_context *mc){
318
291
int ret;
319
292
320
293
if(debug){
321
294
fprintf(stderr, "Initializing GnuTLS\n");
322
295
}
323
324
ret = gnutls_global_init();
325
if (ret != GNUTLS_E_SUCCESS) {
296
297
if ((ret = gnutls_global_init ())
298
!= GNUTLS_E_SUCCESS) {
326
299
fprintf (stderr, "GnuTLS global_init: %s\n",
327
300
safer_gnutls_strerror(ret));
328
301
return -1;
337
310
}
338
311
339
312
/* OpenPGP credentials */
340
gnutls_certificate_allocate_credentials(&mc->cred);
341
if (ret != GNUTLS_E_SUCCESS){
313
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
314
!= GNUTLS_E_SUCCESS) {
342
315
fprintf (stderr, "GnuTLS memory error: %s\n",
343
316
safer_gnutls_strerror(ret));
344
gnutls_global_deinit ();
345
317
return -1;
346
318
}
347
319
359
331
" '%s')\n", ret, pubkeyfile, seckeyfile);
360
332
fprintf(stdout, "The GnuTLS error is: %s\n",
361
333
safer_gnutls_strerror(ret));
362
goto globalfail;
334
return -1;
363
335
}
364
336
365
337
/* GnuTLS server initialization */
367
339
if (ret != GNUTLS_E_SUCCESS) {
368
340
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
369
341
" %s\n", safer_gnutls_strerror(ret));
370
goto globalfail;
342
return -1;
371
343
}
372
344
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
373
345
if (ret != GNUTLS_E_SUCCESS) {
374
346
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
375
347
safer_gnutls_strerror(ret));
376
goto globalfail;
348
return -1;
377
349
}
378
350
379
351
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
380
352
381
353
return 0;
382
383
globalfail:
384
385
gnutls_certificate_free_credentials(mc->cred);
386
gnutls_global_deinit();
387
return -1;
388
389
354
}
390
355
391
static int init_gnutls_session(mandos_context *mc,
392
gnutls_session_t *session){
356
static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
393
357
int ret;
394
358
/* GnuTLS session creation */
395
359
ret = gnutls_init(session, GNUTLS_SERVER);
405
369
fprintf(stderr, "Syntax error at: %s\n", err);
406
370
fprintf(stderr, "GnuTLS error: %s\n",
407
371
safer_gnutls_strerror(ret));
408
gnutls_deinit (*session);
409
372
return -1;
410
373
}
411
374
}
415
378
if (ret != GNUTLS_E_SUCCESS) {
416
379
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
417
380
safer_gnutls_strerror(ret));
418
gnutls_deinit (*session);
419
381
return -1;
420
382
}
421
383
437
399
AvahiIfIndex if_index,
438
400
mandos_context *mc){
439
401
int ret, tcp_sd;
440
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
402
struct sockaddr_in6 to;
441
403
char *buffer = NULL;
442
404
char *decrypted_buffer;
443
405
size_t buffer_length = 0;
447
409
int retval = 0;
448
410
char interface[IF_NAMESIZE];
449
411
gnutls_session_t session;
412
gnutls_dh_params_t dh_params;
450
413
451
414
ret = init_gnutls_session (mc, &session);
452
415
if (ret != 0){
454
417
}
455
418
456
419
if(debug){
457
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
458
"\n", ip, port);
420
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
421
ip, port);
459
422
}
460
423
461
424
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
473
436
}
474
437
475
438
memset(&to,0,sizeof(to)); /* Spurious warning */
476
to.in6.sin6_family = AF_INET6;
439
to.sin6_family = AF_INET6;
477
440
/* It would be nice to have a way to detect if we were passed an
478
441
IPv4 address here. Now we assume an IPv6 address. */
479
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
442
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
480
443
if (ret < 0 ){
481
444
perror("inet_pton");
482
445
return -1;
485
448
fprintf(stderr, "Bad address: %s\n", ip);
486
449
return -1;
487
450
}
488
to.in6.sin6_port = htons(port); /* Spurious warning */
451
to.sin6_port = htons(port); /* Spurious warning */
489
452
490
to.in6.sin6_scope_id = (uint32_t)if_index;
453
to.sin6_scope_id = (uint32_t)if_index;
491
454
492
455
if(debug){
493
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
494
port);
456
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
495
457
char addrstr[INET6_ADDRSTRLEN] = "";
496
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
458
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
497
459
sizeof(addrstr)) == NULL){
498
460
perror("inet_ntop");
499
461
} else {
503
465
}
504
466
}
505
467
506
ret = connect(tcp_sd, &to.in, sizeof(to));
468
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
507
469
if (ret < 0){
508
470
perror("connect");
509
471
return -1;
538
500
}
539
501
540
502
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
541
542
do{
543
ret = gnutls_handshake (session);
544
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
503
504
ret = gnutls_handshake (session);
545
505
546
506
if (ret != GNUTLS_E_SUCCESS){
547
507
if(debug){
560
520
}
561
521
562
522
while(true){
563
buffer_capacity = adjustbuffer(&buffer, buffer_length,
564
buffer_capacity);
523
buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);
565
524
if (buffer_capacity == 0){
566
525
perror("adjustbuffer");
567
526
retval = -1;
579
538
case GNUTLS_E_AGAIN:
580
539
break;
581
540
case GNUTLS_E_REHANDSHAKE:
582
do{
583
ret = gnutls_handshake (session);
584
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
541
ret = gnutls_handshake (session);
585
542
if (ret < 0){
586
543
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
587
544
gnutls_perror (ret);
640
597
free(buffer);
641
598
close(tcp_sd);
642
599
gnutls_deinit (session);
600
gnutls_certificate_free_credentials (mc->cred);
601
gnutls_global_deinit ();
643
602
return retval;
644
603
}
645
604
676
635
char ip[AVAHI_ADDRESS_STR_MAX];
677
636
avahi_address_snprint(ip, sizeof(ip), address);
678
637
if(debug){
679
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
680
PRIu16 ") on port %d\n", name, host_name, ip,
681
interface, port);
638
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"
639
" port %d\n", name, host_name, ip, interface, port);
682
640
}
683
641
int ret = start_mandos_communication(ip, port, interface, mc);
684
642
if (ret == 0){
773
731
gid_t gid;
774
732
char *connect_to = NULL;
775
733
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
776
const char *pubkeyfile = "pubkey.txt";
777
const char *seckeyfile = "seckey.txt";
778
734
mandos_context mc = { .simple_poll = NULL, .server = NULL,
779
735
.dh_bits = 1024, .priority = "SECURE256"};
780
bool gnutls_initalized = false;
781
736
782
737
{
783
struct argp_option options[] = {
784
{ .name = "debug", .key = 128,
785
.doc = "Debug mode", .group = 3 },
786
{ .name = "connect", .key = 'c',
787
.arg = "IP",
788
.doc = "Connect directly to a sepcified mandos server",
789
.group = 1 },
790
{ .name = "interface", .key = 'i',
791
.arg = "INTERFACE",
792
.doc = "Interface that Avahi will conntect through",
793
.group = 1 },
794
{ .name = "keydir", .key = 'd',
795
.arg = "KEYDIR",
796
.doc = "Directory where the openpgp keyring is",
797
.group = 1 },
798
{ .name = "seckey", .key = 's',
799
.arg = "SECKEY",
800
.doc = "Secret openpgp key for gnutls authentication",
801
.group = 1 },
802
{ .name = "pubkey", .key = 'p',
803
.arg = "PUBKEY",
804
.doc = "Public openpgp key for gnutls authentication",
805
.group = 2 },
806
{ .name = "dh-bits", .key = 129,
807
.arg = "BITS",
808
.doc = "dh-bits to use in gnutls communication",
809
.group = 2 },
810
{ .name = "priority", .key = 130,
811
.arg = "PRIORITY",
812
.doc = "GNUTLS priority", .group = 1 },
813
{ .name = NULL }
814
};
815
816
817
error_t parse_opt (int key, char *arg,
818
struct argp_state *state) {
819
/* Get the INPUT argument from `argp_parse', which we know is
820
a pointer to our plugin list pointer. */
821
switch (key) {
822
case 128:
823
debug = true;
738
/* Temporary int to get the address of for getopt_long */
739
int debug_int = debug ? 1 : 0;
740
while (true){
741
struct option long_options[] = {
742
{"debug", no_argument, &debug_int, 1},
743
{"connect", required_argument, NULL, 'c'},
744
{"interface", required_argument, NULL, 'i'},
745
{"keydir", required_argument, NULL, 'd'},
746
{"seckey", required_argument, NULL, 's'},
747
{"pubkey", required_argument, NULL, 'p'},
748
{"dh-bits", required_argument, NULL, 'D'},
749
{"priority", required_argument, NULL, 'P'},
750
{0, 0, 0, 0} };
751
752
int option_index = 0;
753
ret = getopt_long (argc, argv, "i:", long_options,
754
&option_index);
755
756
if (ret == -1){
757
break;
758
}
759
760
switch(ret){
761
case 0:
762
break;
763
case 'i':
764
interface = optarg;
824
765
break;
825
766
case 'c':
826
connect_to = arg;
827
break;
828
case 'i':
829
interface = arg;
767
connect_to = optarg;
830
768
break;
831
769
case 'd':
832
keydir = arg;
770
keydir = optarg;
771
break;
772
case 'p':
773
pubkeyfile = optarg;
833
774
break;
834
775
case 's':
835
seckeyfile = arg;
836
break;
837
case 'p':
838
pubkeyfile = arg;
839
break;
840
case 129:
776
seckeyfile = optarg;
777
break;
778
case 'D':
841
779
errno = 0;
842
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
780
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
843
781
if (errno){
844
782
perror("strtol");
845
783
exit(EXIT_FAILURE);
846
784
}
847
785
break;
848
case 130:
849
mc.priority = arg;
850
break;
851
case ARGP_KEY_ARG:
852
argp_usage (state);
853
break;
854
case ARGP_KEY_END:
855
break;
786
case 'P':
787
mc.priority = optarg;
788
break;
789
case '?':
856
790
default:
857
return ARGP_ERR_UNKNOWN;
791
/* getopt_long() has already printed a message about the
792
unrcognized option, so just exit. */
793
exit(EXIT_FAILURE);
858
794
}
859
return 0;
860
}
861
862
struct argp argp = { .options = options, .parser = parse_opt,
863
.args_doc = "",
864
.doc = "Mandos client -- Get and decrypt"
865
" passwords from mandos server" };
866
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
867
if (ret == ARGP_ERR_UNKNOWN){
868
fprintf(stderr, "Unknown error while parsing arguments\n");
869
exitcode = EXIT_FAILURE;
870
goto end;
871
}
795
}
796
/* Set the global debug flag from the temporary int */
797
debug = debug_int ? true : false;
872
798
}
873
799
874
800
pubkeyfile = combinepath(keydir, pubkeyfile);
875
801
if (pubkeyfile == NULL){
876
802
perror("combinepath");
881
807
seckeyfile = combinepath(keydir, seckeyfile);
882
808
if (seckeyfile == NULL){
883
809
perror("combinepath");
884
exitcode = EXIT_FAILURE;
885
810
goto end;
886
811
}
887
812
888
ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);
813
ret = init_gnutls_global(&mc);
889
814
if (ret == -1){
890
fprintf(stderr, "init_gnutls_global failed\n");
891
exitcode = EXIT_FAILURE;
815
fprintf(stderr, "init_gnutls_global\n");
892
816
goto end;
893
} else {
894
gnutls_initalized = true;
895
}
896
897
/* If the interface is down, bring it up */
898
{
899
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
900
if(sd < 0) {
901
perror("socket");
902
exitcode = EXIT_FAILURE;
903
goto end;
904
}
905
strcpy(network.ifr_name, interface); /* Spurious warning */
906
ret = ioctl(sd, SIOCGIFFLAGS, &network);
907
if(ret == -1){
908
perror("ioctl SIOCGIFFLAGS");
909
exitcode = EXIT_FAILURE;
910
goto end;
911
}
912
if((network.ifr_flags & IFF_UP) == 0){
913
network.ifr_flags |= IFF_UP;
914
ret = ioctl(sd, SIOCSIFFLAGS, &network);
915
if(ret == -1){
916
perror("ioctl SIOCSIFFLAGS");
917
exitcode = EXIT_FAILURE;
918
goto end;
919
}
920
}
921
close(sd);
922
}
923
817
}
818
924
819
uid = getuid();
925
820
gid = getgid();
926
821
927
822
ret = setuid(uid);
928
823
if (ret == -1){
929
824
perror("setuid");
967
862
goto end;
968
863
}
969
864
865
/* If the interface is down, bring it up */
866
{
867
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
868
if(sd < 0) {
869
perror("socket");
870
exitcode = EXIT_FAILURE;
871
goto end;
872
}
873
strcpy(network.ifr_name, interface); /* Spurious warning */
874
ret = ioctl(sd, SIOCGIFFLAGS, &network);
875
if(ret == -1){
876
perror("ioctl SIOCGIFFLAGS");
877
exitcode = EXIT_FAILURE;
878
goto end;
879
}
880
if((network.ifr_flags & IFF_UP) == 0){
881
network.ifr_flags |= IFF_UP;
882
ret = ioctl(sd, SIOCSIFFLAGS, &network);
883
if(ret == -1){
884
perror("ioctl SIOCSIFFLAGS");
885
exitcode = EXIT_FAILURE;
886
goto end;
887
}
888
}
889
close(sd);
890
}
891
970
892
if (not debug){
971
893
avahi_set_log_function(empty_log);
972
894
}
1046
968
avahi_simple_poll_free(mc.simple_poll);
1047
969
free(pubkeyfile);
1048
970
free(seckeyfile);
1049
1050
if (gnutls_initalized){
1051
gnutls_certificate_free_credentials(mc.cred);
1052
gnutls_global_deinit ();
1053
}
1054
971
1055
972
return exitcode;
1056
973
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0