1
/* -*- coding: utf-8 -*- */
3
* Mandos client - get and decrypt data from a Mandos server
5
* This program is partly derived from an example program for an Avahi
6
* service browser, downloaded from
7
* <http://avahi.org/browser/examples/core-browse-services.c>. This
8
* includes the following functions: "resolve_callback",
9
* "browse_callback", and parts of "main".
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
* This program is free software: you can redistribute it and/or
15
* modify it under the terms of the GNU General Public License as
16
* published by the Free Software Foundation, either version 3 of the
17
* License, or (at your option) any later version.
19
* This program is distributed in the hope that it will be useful, but
20
* WITHOUT ANY WARRANTY; without even the implied warranty of
21
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
22
* General Public License for more details.
24
* You should have received a copy of the GNU General Public License
25
* along with this program. If not, see
26
* <http://www.gnu.org/licenses/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
31
/* Needed by GPGME, specifically gpgme_data_seek() */
32
#define _LARGEFILE_SOURCE
33
#define _FILE_OFFSET_BITS 64
39
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
42
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
45
#include <avahi-core/core.h>
46
#include <avahi-core/lookup.h>
47
#include <avahi-core/log.h>
48
#include <avahi-common/simple-watch.h>
49
#include <avahi-common/malloc.h>
50
#include <avahi-common/error.h>
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
67
#include <errno.h> /* perror() */
73
#define BUFFER_SIZE 256
75
static const char *keydir = "/conf/conf.d/mandos";
76
static const char *pubkeyfile = "pubkey.txt";
77
static const char *seckeyfile = "seckey.txt";
81
/* Used for passing in values through all the callback functions */
83
AvahiSimplePoll *simple_poll;
85
gnutls_certificate_credentials_t cred;
91
* Decrypt OpenPGP data using keyrings in HOMEDIR.
94
static ssize_t pgp_packet_decrypt (const char *cryptotext,
98
gpgme_data_t dh_crypto, dh_plain;
102
ssize_t plaintext_capacity = 0;
103
ssize_t plaintext_length = 0;
104
gpgme_engine_info_t engine_info;
107
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
111
gpgme_check_version(NULL);
112
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
113
if (rc != GPG_ERR_NO_ERROR){
114
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
115
gpgme_strsource(rc), gpgme_strerror(rc));
119
/* Set GPGME home directory for the OpenPGP engine only */
120
rc = gpgme_get_engine_info (&engine_info);
121
if (rc != GPG_ERR_NO_ERROR){
122
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
123
gpgme_strsource(rc), gpgme_strerror(rc));
126
while(engine_info != NULL){
127
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
128
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
129
engine_info->file_name, homedir);
132
engine_info = engine_info->next;
134
if(engine_info == NULL){
135
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
139
/* Create new GPGME data buffer from memory cryptotext */
140
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
142
if (rc != GPG_ERR_NO_ERROR){
143
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
144
gpgme_strsource(rc), gpgme_strerror(rc));
148
/* Create new empty GPGME data buffer for the plaintext */
149
rc = gpgme_data_new(&dh_plain);
150
if (rc != GPG_ERR_NO_ERROR){
151
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
152
gpgme_strsource(rc), gpgme_strerror(rc));
153
gpgme_data_release(dh_crypto);
157
/* Create new GPGME "context" */
158
rc = gpgme_new(&ctx);
159
if (rc != GPG_ERR_NO_ERROR){
160
fprintf(stderr, "bad gpgme_new: %s: %s\n",
161
gpgme_strsource(rc), gpgme_strerror(rc));
162
plaintext_length = -1;
166
/* Decrypt data from the cryptotext data buffer to the plaintext
168
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
169
if (rc != GPG_ERR_NO_ERROR){
170
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
171
gpgme_strsource(rc), gpgme_strerror(rc));
172
plaintext_length = -1;
177
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
181
gpgme_decrypt_result_t result;
182
result = gpgme_op_decrypt_result(ctx);
184
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
186
fprintf(stderr, "Unsupported algorithm: %s\n",
187
result->unsupported_algorithm);
188
fprintf(stderr, "Wrong key usage: %d\n",
189
result->wrong_key_usage);
190
if(result->file_name != NULL){
191
fprintf(stderr, "File name: %s\n", result->file_name);
193
gpgme_recipient_t recipient;
194
recipient = result->recipients;
196
while(recipient != NULL){
197
fprintf(stderr, "Public key algorithm: %s\n",
198
gpgme_pubkey_algo_name(recipient->pubkey_algo));
199
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
200
fprintf(stderr, "Secret key available: %s\n",
201
recipient->status == GPG_ERR_NO_SECKEY
203
recipient = recipient->next;
209
/* Seek back to the beginning of the GPGME plaintext data buffer */
210
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
211
perror("pgpme_data_seek");
212
plaintext_length = -1;
218
if (plaintext_length + BUFFER_SIZE > plaintext_capacity){
219
*plaintext = realloc(*plaintext,
220
(unsigned int)plaintext_capacity
222
if (*plaintext == NULL){
224
plaintext_length = -1;
227
plaintext_capacity += BUFFER_SIZE;
230
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
232
/* Print the data, if any */
238
perror("gpgme_data_read");
239
plaintext_length = -1;
242
plaintext_length += ret;
246
fprintf(stderr, "Decrypted password is: ");
247
for(size_t i = 0; i < plaintext_length; i++){
248
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
250
fprintf(stderr, "\n");
255
/* Delete the GPGME cryptotext data buffer */
256
gpgme_data_release(dh_crypto);
258
/* Delete the GPGME plaintext data buffer */
259
gpgme_data_release(dh_plain);
260
return plaintext_length;
263
static const char * safer_gnutls_strerror (int value) {
264
const char *ret = gnutls_strerror (value);
270
static void debuggnutls(__attribute__((unused)) int level,
272
fprintf(stderr, "%s", string);
275
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
276
gnutls_dh_params_t *dh_params){
281
fprintf(stderr, "Initializing GnuTLS\n");
284
if ((ret = gnutls_global_init ())
285
!= GNUTLS_E_SUCCESS) {
286
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
291
gnutls_global_set_log_level(11);
292
gnutls_global_set_log_function(debuggnutls);
295
/* openpgp credentials */
296
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
297
!= GNUTLS_E_SUCCESS) {
298
fprintf (stderr, "memory error: %s\n",
299
safer_gnutls_strerror(ret));
304
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
305
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
309
ret = gnutls_certificate_set_openpgp_key_file
310
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
311
if (ret != GNUTLS_E_SUCCESS) {
313
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
315
ret, pubkeyfile, seckeyfile);
316
fprintf(stdout, "The Error is: %s\n",
317
safer_gnutls_strerror(ret));
321
//GnuTLS server initialization
322
if ((ret = gnutls_dh_params_init(dh_params))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf (stderr, "Error in dh parameter initialization: %s\n",
325
safer_gnutls_strerror(ret));
329
if ((ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits))
330
!= GNUTLS_E_SUCCESS) {
331
fprintf (stderr, "Error in prime generation: %s\n",
332
safer_gnutls_strerror(ret));
336
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
338
// GnuTLS session creation
339
if ((ret = gnutls_init(session, GNUTLS_SERVER))
340
!= GNUTLS_E_SUCCESS){
341
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
342
safer_gnutls_strerror(ret));
345
if ((ret = gnutls_priority_set_direct(*session, mc->priority, &err))
346
!= GNUTLS_E_SUCCESS) {
347
fprintf(stderr, "Syntax error at: %s\n", err);
348
fprintf(stderr, "GnuTLS error: %s\n",
349
safer_gnutls_strerror(ret));
353
if ((ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
355
!= GNUTLS_E_SUCCESS) {
356
fprintf(stderr, "Error setting a credentials set: %s\n",
357
safer_gnutls_strerror(ret));
361
/* ignore client certificate if any. */
362
gnutls_certificate_server_set_request (*session,
365
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
370
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
371
__attribute__((unused)) const char *txt){}
373
static int start_mandos_communication(const char *ip, uint16_t port,
374
AvahiIfIndex if_index,
377
struct sockaddr_in6 to;
379
char *decrypted_buffer;
380
size_t buffer_length = 0;
381
size_t buffer_capacity = 0;
382
ssize_t decrypted_buffer_size;
385
char interface[IF_NAMESIZE];
386
gnutls_session_t session;
387
gnutls_dh_params_t dh_params;
390
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
394
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
401
if(if_indextoname((unsigned int)if_index, interface) == NULL){
402
perror("if_indextoname");
405
fprintf(stderr, "Binding to interface %s\n", interface);
408
memset(&to,0,sizeof(to)); /* Spurious warning */
409
to.sin6_family = AF_INET6;
410
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
416
fprintf(stderr, "Bad address: %s\n", ip);
419
to.sin6_port = htons(port); /* Spurious warning */
421
to.sin6_scope_id = (uint32_t)if_index;
424
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
425
char addrstr[INET6_ADDRSTRLEN] = "";
426
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
427
sizeof(addrstr)) == NULL){
430
if(strcmp(addrstr, ip) != 0){
431
fprintf(stderr, "Canonical address form: %s\n", addrstr);
436
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
442
ret = initgnutls (mc, &session, &dh_params);
448
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
451
fprintf(stderr, "Establishing TLS session with %s\n", ip);
454
ret = gnutls_handshake (session);
456
if (ret != GNUTLS_E_SUCCESS){
458
fprintf(stderr, "\n*** Handshake failed ***\n");
465
//Retrieve OpenPGP packet that contains the wanted password
468
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
473
if (buffer_length + BUFFER_SIZE > buffer_capacity){
474
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
479
buffer_capacity += BUFFER_SIZE;
482
ret = gnutls_record_recv(session, buffer+buffer_length,
489
case GNUTLS_E_INTERRUPTED:
492
case GNUTLS_E_REHANDSHAKE:
493
ret = gnutls_handshake (session);
495
fprintf(stderr, "\n*** Handshake failed ***\n");
502
fprintf(stderr, "Unknown error while reading data from"
503
" encrypted session with mandos server\n");
505
gnutls_bye (session, GNUTLS_SHUT_RDWR);
509
buffer_length += (size_t) ret;
513
if (buffer_length > 0){
514
decrypted_buffer_size = pgp_packet_decrypt(buffer,
518
if (decrypted_buffer_size >= 0){
519
while(written < (size_t) decrypted_buffer_size){
520
ret = (int)fwrite (decrypted_buffer + written, 1,
521
(size_t)decrypted_buffer_size - written,
523
if(ret == 0 and ferror(stdout)){
525
fprintf(stderr, "Error writing encrypted data: %s\n",
531
written += (size_t)ret;
533
free(decrypted_buffer);
542
fprintf(stderr, "Closing TLS session\n");
546
gnutls_bye (session, GNUTLS_SHUT_RDWR);
549
gnutls_deinit (session);
550
gnutls_certificate_free_credentials (mc->cred);
551
gnutls_global_deinit ();
555
static void resolve_callback(AvahiSServiceResolver *r,
556
AvahiIfIndex interface,
557
AVAHI_GCC_UNUSED AvahiProtocol protocol,
558
AvahiResolverEvent event,
562
const char *host_name,
563
const AvahiAddress *address,
565
AVAHI_GCC_UNUSED AvahiStringList *txt,
566
AVAHI_GCC_UNUSED AvahiLookupResultFlags
569
mandos_context *mc = userdata;
570
assert(r); /* Spurious warning */
572
/* Called whenever a service has been resolved successfully or
577
case AVAHI_RESOLVER_FAILURE:
578
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
579
" type '%s' in domain '%s': %s\n", name, type, domain,
580
avahi_strerror(avahi_server_errno(mc->server)));
583
case AVAHI_RESOLVER_FOUND:
585
char ip[AVAHI_ADDRESS_STR_MAX];
586
avahi_address_snprint(ip, sizeof(ip), address);
588
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
589
" port %d\n", name, host_name, ip, port);
591
int ret = start_mandos_communication(ip, port, interface, mc);
597
avahi_s_service_resolver_free(r);
600
static void browse_callback( AvahiSServiceBrowser *b,
601
AvahiIfIndex interface,
602
AvahiProtocol protocol,
603
AvahiBrowserEvent event,
607
AVAHI_GCC_UNUSED AvahiLookupResultFlags
610
mandos_context *mc = userdata;
611
assert(b); /* Spurious warning */
613
/* Called whenever a new services becomes available on the LAN or
614
is removed from the LAN */
618
case AVAHI_BROWSER_FAILURE:
620
fprintf(stderr, "(Browser) %s\n",
621
avahi_strerror(avahi_server_errno(mc->server)));
622
avahi_simple_poll_quit(mc->simple_poll);
625
case AVAHI_BROWSER_NEW:
626
/* We ignore the returned resolver object. In the callback
627
function we free it. If the server is terminated before
628
the callback function is called the server will free
629
the resolver for us. */
631
if (!(avahi_s_service_resolver_new(mc->server, interface,
632
protocol, name, type, domain,
633
AVAHI_PROTO_INET6, 0,
634
resolve_callback, mc)))
635
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
636
avahi_strerror(avahi_server_errno(mc->server)));
639
case AVAHI_BROWSER_REMOVE:
642
case AVAHI_BROWSER_ALL_FOR_NOW:
643
case AVAHI_BROWSER_CACHE_EXHAUSTED:
648
/* Combines file name and path and returns the malloced new
649
string. some sane checks could/should be added */
650
static const char *combinepath(const char *first, const char *second){
651
size_t f_len = strlen(first);
652
size_t s_len = strlen(second);
653
char *tmp = malloc(f_len + s_len + 2);
658
memcpy(tmp, first, f_len); /* Spurious warning */
662
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
664
tmp[f_len + 1 + s_len] = '\0';
669
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
670
AvahiServerConfig config;
671
AvahiSServiceBrowser *sb = NULL;
675
int returncode = EXIT_SUCCESS;
676
const char *interface = "eth0";
677
struct ifreq network;
679
char *connect_to = NULL;
680
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
681
mandos_context mc = { .simple_poll = NULL, .server = NULL,
682
.dh_bits = 1024, .priority = "SECURE256"};
684
debug_int = debug ? 1 : 0;
686
struct option long_options[] = {
687
{"debug", no_argument, &debug_int, 1},
688
{"connect", required_argument, NULL, 'c'},
689
{"interface", required_argument, NULL, 'i'},
690
{"keydir", required_argument, NULL, 'd'},
691
{"seckey", required_argument, NULL, 's'},
692
{"pubkey", required_argument, NULL, 'p'},
693
{"dh-bits", required_argument, NULL, 'D'},
694
{"priority", required_argument, NULL, 'P'},
697
int option_index = 0;
698
ret = getopt_long (argc, argv, "i:", long_options,
725
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
732
mc.priority = optarg;
739
debug = debug_int ? true : false;
741
pubkeyfile = combinepath(keydir, pubkeyfile);
742
if (pubkeyfile == NULL){
743
perror("combinepath");
744
returncode = EXIT_FAILURE;
748
seckeyfile = combinepath(keydir, seckeyfile);
749
if (seckeyfile == NULL){
750
perror("combinepath");
754
if_index = (AvahiIfIndex) if_nametoindex(interface);
756
fprintf(stderr, "No such interface: \"%s\"\n", interface);
760
if(connect_to != NULL){
761
/* Connect directly, do not use Zeroconf */
762
/* (Mainly meant for debugging) */
763
char *address = strrchr(connect_to, ':');
765
fprintf(stderr, "No colon in address\n");
769
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
771
perror("Bad port number");
775
address = connect_to;
776
ret = start_mandos_communication(address, port, if_index, &mc);
784
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
787
returncode = EXIT_FAILURE;
790
strcpy(network.ifr_name, interface); /* Spurious warning */
791
ret = ioctl(sd, SIOCGIFFLAGS, &network);
794
perror("ioctl SIOCGIFFLAGS");
795
returncode = EXIT_FAILURE;
798
if((network.ifr_flags & IFF_UP) == 0){
799
network.ifr_flags |= IFF_UP;
800
ret = ioctl(sd, SIOCSIFFLAGS, &network);
802
perror("ioctl SIOCSIFFLAGS");
803
returncode = EXIT_FAILURE;
810
avahi_set_log_function(empty_log);
813
/* Initialize the psuedo-RNG */
814
srand((unsigned int) time(NULL));
816
/* Allocate main loop object */
817
if (!(mc.simple_poll = avahi_simple_poll_new())) {
818
fprintf(stderr, "Failed to create simple poll object.\n");
819
returncode = EXIT_FAILURE;
823
/* Do not publish any local records */
824
avahi_server_config_init(&config);
825
config.publish_hinfo = 0;
826
config.publish_addresses = 0;
827
config.publish_workstation = 0;
828
config.publish_domain = 0;
830
/* Allocate a new server */
831
mc.server=avahi_server_new(avahi_simple_poll_get(mc.simple_poll),
832
&config, NULL, NULL, &error);
834
/* Free the configuration data */
835
avahi_server_config_free(&config);
837
/* Check if creating the server object succeeded */
839
fprintf(stderr, "Failed to create server: %s\n",
840
avahi_strerror(error));
841
returncode = EXIT_FAILURE;
845
/* Create the service browser */
846
sb = avahi_s_service_browser_new(mc.server, if_index,
848
"_mandos._tcp", NULL, 0,
849
browse_callback, &mc);
851
fprintf(stderr, "Failed to create service browser: %s\n",
852
avahi_strerror(avahi_server_errno(mc.server)));
853
returncode = EXIT_FAILURE;
857
/* Run the main loop */
860
fprintf(stderr, "Starting avahi loop search\n");
863
avahi_simple_poll_loop(mc.simple_poll);
868
fprintf(stderr, "%s exiting\n", argv[0]);
873
avahi_s_service_browser_free(sb);
876
avahi_server_free(mc.server);
879
avahi_simple_poll_free(mc.simple_poll);