25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
32
#define _FORTIFY_SOURCE 2
31
/* Needed by GPGME, specifically gpgme_data_seek() */
34
32
#define _LARGEFILE_SOURCE
35
33
#define _FILE_OFFSET_BITS 64
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
43
#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), asprintf(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
sockaddr_in6, PF_INET6,
49
SOCK_STREAM, INET6_ADDRSTRLEN,
50
uid_t, gid_t, open(), opendir(), DIR */
51
#include <sys/stat.h> /* open() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton(),
55
#include <fcntl.h> /* open() */
56
#include <dirent.h> /* opendir(), struct dirent, readdir() */
57
#include <inttypes.h> /* PRIu16 */
58
#include <assert.h> /* assert() */
59
#include <errno.h> /* perror(), errno */
60
#include <time.h> /* time() */
61
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
62
SIOCSIFFLAGS, if_indextoname(),
63
if_nametoindex(), IF_NAMESIZE */
64
#include <netinet/in.h>
65
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
66
getuid(), getgid(), setuid(),
68
#include <arpa/inet.h> /* inet_pton(), htons */
69
#include <iso646.h> /* not, and */
70
#include <argp.h> /* struct argp_option, error_t, struct
71
argp_state, struct argp,
72
argp_parse(), ARGP_KEY_ARG,
73
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
76
/* All Avahi types, constants and functions
45
79
#include <avahi-core/core.h>
46
80
#include <avahi-core/lookup.h>
47
81
#include <avahi-core/log.h>
49
83
#include <avahi-common/malloc.h>
50
84
#include <avahi-common/error.h>
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
67
#include <errno.h> /* perror() */
87
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
90
init_gnutls_session(),
92
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
93
GNUTLS_OPENPGP_FMT_BASE64 */
96
#include <gpgme.h> /* All GPGME types, constants and
99
GPGME_PROTOCOL_OpenPGP,
73
102
#define BUFFER_SIZE 256
76
const char *certdir = "/conf/conf.d/cryptkeyreq/";
77
const char *certfile = "openpgp-client.txt";
78
const char *certkey = "openpgp-client-key.txt";
105
#define PATHDIR "/conf/conf.d/mandos"
108
#define PATHDIR "/conf/conf.d/mandos"
109
#define SECKEY "seckey.txt"
110
#define PUBKEY "pupkey.txt"
80
112
bool debug = false;
113
static const char mandos_protocol_version[] = "1";
114
const char *argp_program_version = "password-request 1.0";
115
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
117
/* Used for passing in values through the Avahi callback functions */
83
gnutls_session_t session;
119
AvahiSimplePoll *simple_poll;
84
121
gnutls_certificate_credentials_t cred;
122
unsigned int dh_bits;
85
123
gnutls_dh_params_t dh_params;
89
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
90
char **new_packet, const char *homedir){
91
gpgme_data_t dh_crypto, dh_plain;
124
const char *priority;
129
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
130
* "buffer_capacity" is how much is currently allocated,
131
* "buffer_length" is how much is already used.
133
size_t adjustbuffer(char **buffer, size_t buffer_length,
134
size_t buffer_capacity){
135
if (buffer_length + BUFFER_SIZE > buffer_capacity){
136
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
140
buffer_capacity += BUFFER_SIZE;
142
return buffer_capacity;
148
static bool init_gpgme(mandos_context *mc, const char *seckey,
149
const char *pubkey, const char *tempdir){
95
ssize_t new_packet_capacity = 0;
96
ssize_t new_packet_length = 0;
97
152
gpgme_engine_info_t engine_info;
156
* Helper function to insert pub and seckey to the enigne keyring.
158
bool import_key(const char *filename){
160
gpgme_data_t pgp_data;
162
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
168
rc = gpgme_data_new_from_fd(&pgp_data, fd);
169
if (rc != GPG_ERR_NO_ERROR){
170
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
171
gpgme_strsource(rc), gpgme_strerror(rc));
175
rc = gpgme_op_import(mc->ctx, pgp_data);
176
if (rc != GPG_ERR_NO_ERROR){
177
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
178
gpgme_strsource(rc), gpgme_strerror(rc));
182
ret = TEMP_FAILURE_RETRY(close(fd));
186
gpgme_data_release(pgp_data);
100
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
191
fprintf(stderr, "Initialize gpgme\n");
104
195
gpgme_check_version(NULL);
105
196
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
106
197
if (rc != GPG_ERR_NO_ERROR){
107
198
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
108
199
gpgme_strsource(rc), gpgme_strerror(rc));
112
/* Set GPGME home directory */
203
/* Set GPGME home directory for the OpenPGP engine only */
113
204
rc = gpgme_get_engine_info (&engine_info);
114
205
if (rc != GPG_ERR_NO_ERROR){
115
206
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
116
207
gpgme_strsource(rc), gpgme_strerror(rc));
119
210
while(engine_info != NULL){
120
211
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
121
212
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
122
engine_info->file_name, homedir);
213
engine_info->file_name, tempdir);
125
216
engine_info = engine_info->next;
127
218
if(engine_info == NULL){
128
fprintf(stderr, "Could not set home dir to %s\n", homedir);
132
/* Create new GPGME data buffer from packet buffer */
133
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
219
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
223
/* Create new GPGME "context" */
224
rc = gpgme_new(&(mc->ctx));
225
if (rc != GPG_ERR_NO_ERROR){
226
fprintf(stderr, "bad gpgme_new: %s: %s\n",
227
gpgme_strsource(rc), gpgme_strerror(rc));
231
if (not import_key(pubkey) or not import_key(seckey)){
239
* Decrypt OpenPGP data.
240
* Returns -1 on error
242
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
243
const char *cryptotext,
246
gpgme_data_t dh_crypto, dh_plain;
249
size_t plaintext_capacity = 0;
250
ssize_t plaintext_length = 0;
253
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
256
/* Create new GPGME data buffer from memory cryptotext */
257
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
134
259
if (rc != GPG_ERR_NO_ERROR){
135
260
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
136
261
gpgme_strsource(rc), gpgme_strerror(rc));
142
267
if (rc != GPG_ERR_NO_ERROR){
143
268
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
144
269
gpgme_strsource(rc), gpgme_strerror(rc));
148
/* Create new GPGME "context" */
149
rc = gpgme_new(&ctx);
150
if (rc != GPG_ERR_NO_ERROR){
151
fprintf(stderr, "bad gpgme_new: %s: %s\n",
152
gpgme_strsource(rc), gpgme_strerror(rc));
156
/* Decrypt data from the FILE pointer to the plaintext data
158
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
270
gpgme_data_release(dh_crypto);
274
/* Decrypt data from the cryptotext data buffer to the plaintext
276
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
159
277
if (rc != GPG_ERR_NO_ERROR){
160
278
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
161
279
gpgme_strsource(rc), gpgme_strerror(rc));
280
plaintext_length = -1;
282
gpgme_decrypt_result_t result;
283
result = gpgme_op_decrypt_result(mc->ctx);
285
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
287
fprintf(stderr, "Unsupported algorithm: %s\n",
288
result->unsupported_algorithm);
289
fprintf(stderr, "Wrong key usage: %u\n",
290
result->wrong_key_usage);
291
if(result->file_name != NULL){
292
fprintf(stderr, "File name: %s\n", result->file_name);
294
gpgme_recipient_t recipient;
295
recipient = result->recipients;
297
while(recipient != NULL){
298
fprintf(stderr, "Public key algorithm: %s\n",
299
gpgme_pubkey_algo_name(recipient->pubkey_algo));
300
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
301
fprintf(stderr, "Secret key available: %s\n",
302
recipient->status == GPG_ERR_NO_SECKEY
304
recipient = recipient->next;
166
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
170
gpgme_decrypt_result_t result;
171
result = gpgme_op_decrypt_result(ctx);
173
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
175
fprintf(stderr, "Unsupported algorithm: %s\n",
176
result->unsupported_algorithm);
177
fprintf(stderr, "Wrong key usage: %d\n",
178
result->wrong_key_usage);
179
if(result->file_name != NULL){
180
fprintf(stderr, "File name: %s\n", result->file_name);
182
gpgme_recipient_t recipient;
183
recipient = result->recipients;
185
while(recipient != NULL){
186
fprintf(stderr, "Public key algorithm: %s\n",
187
gpgme_pubkey_algo_name(recipient->pubkey_algo));
188
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
189
fprintf(stderr, "Secret key available: %s\n",
190
recipient->status == GPG_ERR_NO_SECKEY
192
recipient = recipient->next;
198
/* Delete the GPGME FILE pointer cryptotext data buffer */
199
gpgme_data_release(dh_crypto);
313
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
201
316
/* Seek back to the beginning of the GPGME plaintext data buffer */
202
317
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
203
318
perror("pgpme_data_seek");
319
plaintext_length = -1;
208
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
209
*new_packet = realloc(*new_packet,
210
(unsigned int)new_packet_capacity
212
if (*new_packet == NULL){
216
new_packet_capacity += BUFFER_SIZE;
325
plaintext_capacity = adjustbuffer(plaintext,
326
(size_t)plaintext_length,
328
if (plaintext_capacity == 0){
329
perror("adjustbuffer");
330
plaintext_length = -1;
219
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
334
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
221
336
/* Print the data, if any */
226
342
perror("gpgme_data_read");
229
new_packet_length += ret;
232
/* FIXME: check characters before printing to screen so to not print
233
terminal control characters */
235
/* fprintf(stderr, "decrypted password is: "); */
236
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
237
/* fprintf(stderr, "\n"); */
343
plaintext_length = -1;
346
plaintext_length += ret;
350
fprintf(stderr, "Decrypted password is: ");
351
for(ssize_t i = 0; i < plaintext_length; i++){
352
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
354
fprintf(stderr, "\n");
359
/* Delete the GPGME cryptotext data buffer */
360
gpgme_data_release(dh_crypto);
240
362
/* Delete the GPGME plaintext data buffer */
241
363
gpgme_data_release(dh_plain);
242
return new_packet_length;
364
return plaintext_length;
245
367
static const char * safer_gnutls_strerror (int value) {
246
const char *ret = gnutls_strerror (value);
368
const char *ret = gnutls_strerror (value); /* Spurious warning */
248
370
ret = "(unknown)";
252
void debuggnutls(__attribute__((unused)) int level,
254
fprintf(stderr, "%s", string);
374
/* GnuTLS log function callback */
375
static void debuggnutls(__attribute__((unused)) int level,
377
fprintf(stderr, "GnuTLS: %s", string);
257
int initgnutls(encrypted_session *es){
380
static int init_gnutls_global(mandos_context *mc,
381
const char *pubkeyfilename,
382
const char *seckeyfilename){
262
386
fprintf(stderr, "Initializing GnuTLS\n");
265
if ((ret = gnutls_global_init ())
266
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
389
ret = gnutls_global_init();
390
if (ret != GNUTLS_E_SUCCESS) {
391
fprintf (stderr, "GnuTLS global_init: %s\n",
392
safer_gnutls_strerror(ret));
397
/* "Use a log level over 10 to enable all debugging options."
272
400
gnutls_global_set_log_level(11);
273
401
gnutls_global_set_log_function(debuggnutls);
276
/* openpgp credentials */
277
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
278
!= GNUTLS_E_SUCCESS) {
279
fprintf (stderr, "memory error: %s\n",
404
/* OpenPGP credentials */
405
gnutls_certificate_allocate_credentials(&mc->cred);
406
if (ret != GNUTLS_E_SUCCESS){
407
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
280
409
safer_gnutls_strerror(ret));
410
gnutls_global_deinit ();
285
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
286
" and keyfile %s as GnuTLS credentials\n", certfile,
415
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
416
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
290
420
ret = gnutls_certificate_set_openpgp_key_file
291
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
421
(mc->cred, pubkeyfilename, seckeyfilename,
422
GNUTLS_OPENPGP_FMT_BASE64);
292
423
if (ret != GNUTLS_E_SUCCESS) {
294
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
296
ret, certfile, certkey);
297
fprintf(stdout, "The Error is: %s\n",
425
"Error[%d] while reading the OpenPGP key pair ('%s',"
426
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
427
fprintf(stderr, "The GnuTLS error is: %s\n",
298
428
safer_gnutls_strerror(ret));
302
//GnuTLS server initialization
303
if ((ret = gnutls_dh_params_init (&es->dh_params))
304
!= GNUTLS_E_SUCCESS) {
305
fprintf (stderr, "Error in dh parameter initialization: %s\n",
306
safer_gnutls_strerror(ret));
310
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
311
!= GNUTLS_E_SUCCESS) {
312
fprintf (stderr, "Error in prime generation: %s\n",
313
safer_gnutls_strerror(ret));
317
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
319
// GnuTLS session creation
320
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
321
!= GNUTLS_E_SUCCESS){
432
/* GnuTLS server initialization */
433
ret = gnutls_dh_params_init(&mc->dh_params);
434
if (ret != GNUTLS_E_SUCCESS) {
435
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
436
" %s\n", safer_gnutls_strerror(ret));
439
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
440
if (ret != GNUTLS_E_SUCCESS) {
441
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
442
safer_gnutls_strerror(ret));
446
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
452
gnutls_certificate_free_credentials(mc->cred);
453
gnutls_global_deinit();
457
static int init_gnutls_session(mandos_context *mc,
458
gnutls_session_t *session){
460
/* GnuTLS session creation */
461
ret = gnutls_init(session, GNUTLS_SERVER);
462
if (ret != GNUTLS_E_SUCCESS){
322
463
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
323
464
safer_gnutls_strerror(ret));
326
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Syntax error at: %s\n", err);
329
fprintf(stderr, "GnuTLS error: %s\n",
330
safer_gnutls_strerror(ret));
469
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
470
if (ret != GNUTLS_E_SUCCESS) {
471
fprintf(stderr, "Syntax error at: %s\n", err);
472
fprintf(stderr, "GnuTLS error: %s\n",
473
safer_gnutls_strerror(ret));
474
gnutls_deinit (*session);
334
if ((ret = gnutls_credentials_set
335
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
336
!= GNUTLS_E_SUCCESS) {
337
fprintf(stderr, "Error setting a credentials set: %s\n",
479
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
481
if (ret != GNUTLS_E_SUCCESS) {
482
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
338
483
safer_gnutls_strerror(ret));
484
gnutls_deinit (*session);
342
488
/* ignore client certificate if any. */
343
gnutls_certificate_server_set_request (es->session,
489
gnutls_certificate_server_set_request (*session,
344
490
GNUTLS_CERT_IGNORE);
346
gnutls_dh_set_prime_bits (es->session, DH_BITS);
492
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
351
void empty_log(__attribute__((unused)) AvahiLogLevel level,
352
__attribute__((unused)) const char *txt){}
497
/* Avahi log function callback */
498
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
499
__attribute__((unused)) const char *txt){}
354
int start_mandos_communication(const char *ip, uint16_t port,
355
unsigned int if_index){
501
/* Called when a Mandos server is found */
502
static int start_mandos_communication(const char *ip, uint16_t port,
503
AvahiIfIndex if_index,
357
struct sockaddr_in6 to;
358
encrypted_session es;
506
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
359
507
char *buffer = NULL;
360
508
char *decrypted_buffer;
361
509
size_t buffer_length = 0;
362
510
size_t buffer_capacity = 0;
363
511
ssize_t decrypted_buffer_size;
366
514
char interface[IF_NAMESIZE];
515
gnutls_session_t session;
517
ret = init_gnutls_session (mc, &session);
369
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
523
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
372
527
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
374
529
perror("socket");
379
if(if_indextoname(if_index, interface) == NULL){
381
perror("if_indextoname");
534
if(if_indextoname((unsigned int)if_index, interface) == NULL){
535
perror("if_indextoname");
386
538
fprintf(stderr, "Binding to interface %s\n", interface);
389
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
541
memset(&to, 0, sizeof(to));
542
to.in6.sin6_family = AF_INET6;
543
/* It would be nice to have a way to detect if we were passed an
544
IPv4 address here. Now we assume an IPv6 address. */
545
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
393
547
perror("inet_pton");
397
551
fprintf(stderr, "Bad address: %s\n", ip);
400
to.sin6_port = htons(port); /* Spurious warning */
554
to.in6.sin6_port = htons(port); /* Spurious warning */
402
to.sin6_scope_id = (uint32_t)if_index;
556
to.in6.sin6_scope_id = (uint32_t)if_index;
405
fprintf(stderr, "Connection to: %s\n", ip);
559
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
561
char addrstr[INET6_ADDRSTRLEN] = "";
562
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
563
sizeof(addrstr)) == NULL){
566
if(strcmp(addrstr, ip) != 0){
567
fprintf(stderr, "Canonical address form: %s\n", addrstr);
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
572
ret = connect(tcp_sd, &to.in, sizeof(to));
410
574
perror("connect");
414
ret = initgnutls (&es);
578
const char *out = mandos_protocol_version;
581
size_t out_size = strlen(out);
582
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
583
out_size - written));
589
written += (size_t)ret;
590
if(written < out_size){
593
if (out == mandos_protocol_version){
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
424
603
fprintf(stderr, "Establishing TLS session with %s\n", ip);
427
ret = gnutls_handshake (es.session);
606
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
609
ret = gnutls_handshake (session);
610
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
429
612
if (ret != GNUTLS_E_SUCCESS){
431
fprintf(stderr, "\n*** Handshake failed ***\n");
614
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
432
615
gnutls_perror (ret);
438
//Retrieve OpenPGP packet that contains the wanted password
621
/* Read OpenPGP packet that contains the wanted password */
441
624
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
452
buffer_capacity += BUFFER_SIZE;
629
buffer_capacity = adjustbuffer(&buffer, buffer_length,
631
if (buffer_capacity == 0){
632
perror("adjustbuffer");
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
637
ret = gnutls_record_recv(session, buffer+buffer_length,
561
746
char ip[AVAHI_ADDRESS_STR_MAX];
562
747
avahi_address_snprint(ip, sizeof(ip), address);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
749
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
750
PRIu16 ") on port %d\n", name, host_name, ip,
567
int ret = start_mandos_communication(ip, port,
568
(unsigned int) interface);
753
int ret = start_mandos_communication(ip, port, interface, mc);
755
avahi_simple_poll_quit(mc->simple_poll);
574
759
avahi_s_service_resolver_free(r);
577
static void browse_callback(
578
AvahiSServiceBrowser *b,
579
AvahiIfIndex interface,
580
AvahiProtocol protocol,
581
AvahiBrowserEvent event,
585
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
588
AvahiServer *s = userdata;
589
assert(b); /* Spurious warning */
591
/* Called whenever a new services becomes available on the LAN or
592
is removed from the LAN */
596
case AVAHI_BROWSER_FAILURE:
598
fprintf(stderr, "(Browser) %s\n",
599
avahi_strerror(avahi_server_errno(server)));
600
avahi_simple_poll_quit(simple_poll);
603
case AVAHI_BROWSER_NEW:
604
/* We ignore the returned resolver object. In the callback
605
function we free it. If the server is terminated before
606
the callback function is called the server will free
607
the resolver for us. */
609
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
611
AVAHI_PROTO_INET6, 0,
612
resolve_callback, s)))
613
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
614
avahi_strerror(avahi_server_errno(s)));
617
case AVAHI_BROWSER_REMOVE:
620
case AVAHI_BROWSER_ALL_FOR_NOW:
621
case AVAHI_BROWSER_CACHE_EXHAUSTED:
762
static void browse_callback( AvahiSServiceBrowser *b,
763
AvahiIfIndex interface,
764
AvahiProtocol protocol,
765
AvahiBrowserEvent event,
769
AVAHI_GCC_UNUSED AvahiLookupResultFlags
772
mandos_context *mc = userdata;
775
/* Called whenever a new services becomes available on the LAN or
776
is removed from the LAN */
780
case AVAHI_BROWSER_FAILURE:
782
fprintf(stderr, "(Avahi browser) %s\n",
783
avahi_strerror(avahi_server_errno(mc->server)));
784
avahi_simple_poll_quit(mc->simple_poll);
787
case AVAHI_BROWSER_NEW:
788
/* We ignore the returned Avahi resolver object. In the callback
789
function we free it. If the Avahi server is terminated before
790
the callback function is called the Avahi server will free the
793
if (!(avahi_s_service_resolver_new(mc->server, interface,
794
protocol, name, type, domain,
795
AVAHI_PROTO_INET6, 0,
796
resolve_callback, mc)))
797
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
798
name, avahi_strerror(avahi_server_errno(mc->server)));
801
case AVAHI_BROWSER_REMOVE:
804
case AVAHI_BROWSER_ALL_FOR_NOW:
805
case AVAHI_BROWSER_CACHE_EXHAUSTED:
807
fprintf(stderr, "No Mandos server found, still searching...\n");
626
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
627
const char *combinepath(const char *first, const char *second){
629
tmp = malloc(strlen(first) + strlen(second) + 2);
635
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
643
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
644
AvahiServerConfig config;
813
int main(int argc, char *argv[]){
645
814
AvahiSServiceBrowser *sb = NULL;
648
int returncode = EXIT_SUCCESS;
817
int exitcode = EXIT_SUCCESS;
649
818
const char *interface = "eth0";
650
819
struct ifreq network;
654
static struct option long_options[] = {
655
{"debug", no_argument, (int *)&debug, 1},
656
{"interface", required_argument, 0, 'i'},
657
{"certdir", required_argument, 0, 'd'},
658
{"certkey", required_argument, 0, 'c'},
659
{"certfile", required_argument, 0, 'k'},
662
int option_index = 0;
663
ret = getopt_long (argc, argv, "i:", long_options,
690
certfile = combinepath(certdir, certfile);
691
if (certfile == NULL){
692
returncode = EXIT_FAILURE;
696
certkey = combinepath(certdir, certkey);
697
if (certkey == NULL){
698
returncode = EXIT_FAILURE;
702
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
705
returncode = EXIT_FAILURE;
708
strcpy(network.ifr_name, interface);
709
ret = ioctl(sd, SIOCGIFFLAGS, &network);
712
perror("ioctl SIOCGIFFLAGS");
713
returncode = EXIT_FAILURE;
716
if((network.ifr_flags & IFF_UP) == 0){
717
network.ifr_flags |= IFF_UP;
718
ret = ioctl(sd, SIOCSIFFLAGS, &network);
720
perror("ioctl SIOCSIFFLAGS");
721
returncode = EXIT_FAILURE;
823
char *connect_to = NULL;
824
char tempdir[] = "/tmp/mandosXXXXXX";
825
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
826
const char *seckey = PATHDIR "/" SECKEY;
827
const char *pubkey = PATHDIR "/" PUBKEY;
829
mandos_context mc = { .simple_poll = NULL, .server = NULL,
830
.dh_bits = 1024, .priority = "SECURE256"
831
":!CTYPE-X.509:+CTYPE-OPENPGP" };
832
bool gnutls_initalized = false;
833
bool pgpme_initalized = false;
836
struct argp_option options[] = {
837
{ .name = "debug", .key = 128,
838
.doc = "Debug mode", .group = 3 },
839
{ .name = "connect", .key = 'c',
840
.arg = "ADDRESS:PORT",
841
.doc = "Connect directly to a specific Mandos server",
843
{ .name = "interface", .key = 'i',
845
.doc = "Interface that will be used to search for Mandos"
848
{ .name = "seckey", .key = 's',
850
.doc = "OpenPGP secret key file base name",
852
{ .name = "pubkey", .key = 'p',
854
.doc = "OpenPGP public key file base name",
856
{ .name = "dh-bits", .key = 129,
858
.doc = "Bit length of the prime number used in the"
859
" Diffie-Hellman key exchange",
861
{ .name = "priority", .key = 130,
863
.doc = "GnuTLS priority string for the TLS handshake",
868
error_t parse_opt (int key, char *arg,
869
struct argp_state *state) {
870
/* Get the INPUT argument from `argp_parse', which we know is
871
a pointer to our plugin list pointer. */
873
case 128: /* --debug */
876
case 'c': /* --connect */
879
case 'i': /* --interface */
882
case 's': /* --seckey */
885
case 'p': /* --pubkey */
888
case 129: /* --dh-bits */
890
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
896
case 130: /* --priority */
904
return ARGP_ERR_UNKNOWN;
909
struct argp argp = { .options = options, .parser = parse_opt,
911
.doc = "Mandos client -- Get and decrypt"
912
" passwords from a Mandos server" };
913
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
914
if (ret == ARGP_ERR_UNKNOWN){
915
fprintf(stderr, "Unknown error while parsing arguments\n");
916
exitcode = EXIT_FAILURE;
921
ret = init_gnutls_global(&mc, pubkey, seckey);
923
fprintf(stderr, "init_gnutls_global failed\n");
924
exitcode = EXIT_FAILURE;
927
gnutls_initalized = true;
930
if(mkdtemp(tempdir) == NULL){
936
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
937
fprintf(stderr, "pgpme_initalized failed\n");
938
exitcode = EXIT_FAILURE;
941
pgpme_initalized = true;
944
/* If the interface is down, bring it up */
946
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
949
exitcode = EXIT_FAILURE;
952
strcpy(network.ifr_name, interface);
953
ret = ioctl(sd, SIOCGIFFLAGS, &network);
955
perror("ioctl SIOCGIFFLAGS");
956
exitcode = EXIT_FAILURE;
959
if((network.ifr_flags & IFF_UP) == 0){
960
network.ifr_flags |= IFF_UP;
961
ret = ioctl(sd, SIOCSIFFLAGS, &network);
963
perror("ioctl SIOCSIFFLAGS");
964
exitcode = EXIT_FAILURE;
968
ret = TEMP_FAILURE_RETRY(close(sd));
987
if_index = (AvahiIfIndex) if_nametoindex(interface);
989
fprintf(stderr, "No such interface: \"%s\"\n", interface);
993
if(connect_to != NULL){
994
/* Connect directly, do not use Zeroconf */
995
/* (Mainly meant for debugging) */
996
char *address = strrchr(connect_to, ':');
998
fprintf(stderr, "No colon in address\n");
999
exitcode = EXIT_FAILURE;
1003
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
1005
perror("Bad port number");
1006
exitcode = EXIT_FAILURE;
1010
address = connect_to;
1011
ret = start_mandos_communication(address, port, if_index, &mc);
1013
exitcode = EXIT_FAILURE;
1015
exitcode = EXIT_SUCCESS;
728
1021
avahi_set_log_function(empty_log);
731
/* Initialize the psuedo-RNG */
1024
/* Initialize the pseudo-RNG for Avahi */
732
1025
srand((unsigned int) time(NULL));
734
/* Allocate main loop object */
735
if (!(simple_poll = avahi_simple_poll_new())) {
736
fprintf(stderr, "Failed to create simple poll object.\n");
737
returncode = EXIT_FAILURE;
741
/* Do not publish any local records */
742
avahi_server_config_init(&config);
743
config.publish_hinfo = 0;
744
config.publish_addresses = 0;
745
config.publish_workstation = 0;
746
config.publish_domain = 0;
748
/* Allocate a new server */
749
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
750
&config, NULL, NULL, &error);
752
/* Free the configuration data */
753
avahi_server_config_free(&config);
755
/* Check if creating the server object succeeded */
757
fprintf(stderr, "Failed to create server: %s\n",
1027
/* Allocate main Avahi loop object */
1028
mc.simple_poll = avahi_simple_poll_new();
1029
if (mc.simple_poll == NULL) {
1030
fprintf(stderr, "Avahi: Failed to create simple poll"
1032
exitcode = EXIT_FAILURE;
1037
AvahiServerConfig config;
1038
/* Do not publish any local Zeroconf records */
1039
avahi_server_config_init(&config);
1040
config.publish_hinfo = 0;
1041
config.publish_addresses = 0;
1042
config.publish_workstation = 0;
1043
config.publish_domain = 0;
1045
/* Allocate a new server */
1046
mc.server = avahi_server_new(avahi_simple_poll_get
1047
(mc.simple_poll), &config, NULL,
1050
/* Free the Avahi configuration data */
1051
avahi_server_config_free(&config);
1054
/* Check if creating the Avahi server object succeeded */
1055
if (mc.server == NULL) {
1056
fprintf(stderr, "Failed to create Avahi server: %s\n",
758
1057
avahi_strerror(error));
759
returncode = EXIT_FAILURE;
1058
exitcode = EXIT_FAILURE;
763
/* Create the service browser */
764
sb = avahi_s_service_browser_new(server,
766
if_nametoindex(interface),
1062
/* Create the Avahi service browser */
1063
sb = avahi_s_service_browser_new(mc.server, if_index,
767
1064
AVAHI_PROTO_INET6,
768
1065
"_mandos._tcp", NULL, 0,
769
browse_callback, server);
1066
browse_callback, &mc);
771
1068
fprintf(stderr, "Failed to create service browser: %s\n",
772
avahi_strerror(avahi_server_errno(server)));
773
returncode = EXIT_FAILURE;
1069
avahi_strerror(avahi_server_errno(mc.server)));
1070
exitcode = EXIT_FAILURE;
777
1074
/* Run the main loop */
780
fprintf(stderr, "Starting avahi loop search\n");
1077
fprintf(stderr, "Starting Avahi loop search\n");
783
avahi_simple_poll_loop(simple_poll);
1080
avahi_simple_poll_loop(mc.simple_poll);
788
1085
fprintf(stderr, "%s exiting\n", argv[0]);
791
1088
/* Cleanup things */
793
1090
avahi_s_service_browser_free(sb);
796
avahi_server_free(server);
799
avahi_simple_poll_free(simple_poll);
1092
if (mc.server != NULL)
1093
avahi_server_free(mc.server);
1095
if (mc.simple_poll != NULL)
1096
avahi_simple_poll_free(mc.simple_poll);
1098
if (gnutls_initalized){
1099
gnutls_certificate_free_credentials(mc.cred);
1100
gnutls_global_deinit ();
1103
if(pgpme_initalized){
1104
gpgme_release(mc.ctx);
1107
/* Removes the temp directory used by GPGME */
1108
if(tempdir[0] != '\0'){
1110
struct dirent *direntry;
1111
d = opendir(tempdir);
1116
direntry = readdir(d);
1117
if(direntry == NULL){
1120
if (direntry->d_type == DT_REG){
1121
char *fullname = NULL;
1122
ret = asprintf(&fullname, "%s/%s", tempdir,
1128
ret = unlink(fullname);
1130
fprintf(stderr, "unlink(\"%s\"): %s",
1131
fullname, strerror(errno));
1137
ret = rmdir(tempdir);