25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
32
#define _FORTIFY_SOURCE 2
31
/* Needed by GPGME, specifically gpgme_data_seek() */
34
32
#define _LARGEFILE_SOURCE
35
33
#define _FILE_OFFSET_BITS 64
41
#include <net/if.h> /* if_nametoindex */
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), asprintf(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
sockaddr_in6, PF_INET6,
49
SOCK_STREAM, INET6_ADDRSTRLEN,
50
uid_t, gid_t, open(), opendir(), DIR */
51
#include <sys/stat.h> /* open() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton(),
55
#include <fcntl.h> /* open() */
56
#include <dirent.h> /* opendir(), struct dirent, readdir() */
57
#include <inttypes.h> /* PRIu16 */
58
#include <assert.h> /* assert() */
59
#include <errno.h> /* perror(), errno */
60
#include <time.h> /* time() */
61
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
62
SIOCSIFFLAGS, if_indextoname(),
63
if_nametoindex(), IF_NAMESIZE */
64
#include <netinet/in.h>
65
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
66
getuid(), getgid(), setuid(),
68
#include <arpa/inet.h> /* inet_pton(), htons */
69
#include <iso646.h> /* not, and */
70
#include <argp.h> /* struct argp_option, error_t, struct
71
argp_state, struct argp,
72
argp_parse(), ARGP_KEY_ARG,
73
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
76
/* All Avahi types, constants and functions
43
79
#include <avahi-core/core.h>
44
80
#include <avahi-core/lookup.h>
45
81
#include <avahi-core/log.h>
47
83
#include <avahi-common/malloc.h>
48
84
#include <avahi-common/error.h>
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
65
#include <errno.h> /* perror() */
87
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
90
init_gnutls_session(),
92
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
93
GNUTLS_OPENPGP_FMT_BASE64 */
96
#include <gpgme.h> /* All GPGME types, constants and
99
GPGME_PROTOCOL_OpenPGP,
71
102
#define BUFFER_SIZE 256
74
const char *certdir = "/conf/conf.d/cryptkeyreq/";
75
const char *certfile = "openpgp-client.txt";
76
const char *certkey = "openpgp-client-key.txt";
105
#define PATHDIR "/conf/conf.d/mandos"
108
#define PATHDIR "/conf/conf.d/mandos"
109
#define SECKEY "seckey.txt"
110
#define PUBKEY "pupkey.txt"
78
112
bool debug = false;
113
static const char mandos_protocol_version[] = "1";
114
const char *argp_program_version = "password-request 1.0";
115
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
117
/* Used for passing in values through the Avahi callback functions */
81
gnutls_session_t session;
119
AvahiSimplePoll *simple_poll;
82
121
gnutls_certificate_credentials_t cred;
122
unsigned int dh_bits;
83
123
gnutls_dh_params_t dh_params;
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
89
gpgme_data_t dh_crypto, dh_plain;
124
const char *priority;
129
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
130
* "buffer_capacity" is how much is currently allocated,
131
* "buffer_length" is how much is already used.
133
size_t adjustbuffer(char **buffer, size_t buffer_length,
134
size_t buffer_capacity){
135
if (buffer_length + BUFFER_SIZE > buffer_capacity){
136
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
140
buffer_capacity += BUFFER_SIZE;
142
return buffer_capacity;
148
static bool init_gpgme(mandos_context *mc, const char *seckey,
149
const char *pubkey, const char *tempdir){
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
95
152
gpgme_engine_info_t engine_info;
156
* Helper function to insert pub and seckey to the enigne keyring.
158
bool import_key(const char *filename){
160
gpgme_data_t pgp_data;
162
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
168
rc = gpgme_data_new_from_fd(&pgp_data, fd);
169
if (rc != GPG_ERR_NO_ERROR){
170
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
171
gpgme_strsource(rc), gpgme_strerror(rc));
175
rc = gpgme_op_import(mc->ctx, pgp_data);
176
if (rc != GPG_ERR_NO_ERROR){
177
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
178
gpgme_strsource(rc), gpgme_strerror(rc));
182
ret = TEMP_FAILURE_RETRY(close(fd));
186
gpgme_data_release(pgp_data);
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
191
fprintf(stderr, "Initialize gpgme\n");
102
195
gpgme_check_version(NULL);
103
196
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
104
197
if (rc != GPG_ERR_NO_ERROR){
105
198
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
106
199
gpgme_strsource(rc), gpgme_strerror(rc));
110
/* Set GPGME home directory */
203
/* Set GPGME home directory for the OpenPGP engine only */
111
204
rc = gpgme_get_engine_info (&engine_info);
112
205
if (rc != GPG_ERR_NO_ERROR){
113
206
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
114
207
gpgme_strsource(rc), gpgme_strerror(rc));
117
210
while(engine_info != NULL){
118
211
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
119
212
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
120
engine_info->file_name, homedir);
213
engine_info->file_name, tempdir);
123
216
engine_info = engine_info->next;
125
218
if(engine_info == NULL){
126
fprintf(stderr, "Could not set home dir to %s\n", homedir);
130
/* Create new GPGME data buffer from packet buffer */
131
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
219
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
223
/* Create new GPGME "context" */
224
rc = gpgme_new(&(mc->ctx));
225
if (rc != GPG_ERR_NO_ERROR){
226
fprintf(stderr, "bad gpgme_new: %s: %s\n",
227
gpgme_strsource(rc), gpgme_strerror(rc));
231
if (not import_key(pubkey) or not import_key(seckey)){
239
* Decrypt OpenPGP data.
240
* Returns -1 on error
242
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
243
const char *cryptotext,
246
gpgme_data_t dh_crypto, dh_plain;
249
size_t plaintext_capacity = 0;
250
ssize_t plaintext_length = 0;
253
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
256
/* Create new GPGME data buffer from memory cryptotext */
257
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
132
259
if (rc != GPG_ERR_NO_ERROR){
133
260
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
134
261
gpgme_strsource(rc), gpgme_strerror(rc));
140
267
if (rc != GPG_ERR_NO_ERROR){
141
268
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
142
269
gpgme_strsource(rc), gpgme_strerror(rc));
146
/* Create new GPGME "context" */
147
rc = gpgme_new(&ctx);
148
if (rc != GPG_ERR_NO_ERROR){
149
fprintf(stderr, "bad gpgme_new: %s: %s\n",
150
gpgme_strsource(rc), gpgme_strerror(rc));
154
/* Decrypt data from the FILE pointer to the plaintext data
156
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
270
gpgme_data_release(dh_crypto);
274
/* Decrypt data from the cryptotext data buffer to the plaintext
276
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
157
277
if (rc != GPG_ERR_NO_ERROR){
158
278
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
159
279
gpgme_strsource(rc), gpgme_strerror(rc));
280
plaintext_length = -1;
282
gpgme_decrypt_result_t result;
283
result = gpgme_op_decrypt_result(mc->ctx);
285
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
287
fprintf(stderr, "Unsupported algorithm: %s\n",
288
result->unsupported_algorithm);
289
fprintf(stderr, "Wrong key usage: %u\n",
290
result->wrong_key_usage);
291
if(result->file_name != NULL){
292
fprintf(stderr, "File name: %s\n", result->file_name);
294
gpgme_recipient_t recipient;
295
recipient = result->recipients;
297
while(recipient != NULL){
298
fprintf(stderr, "Public key algorithm: %s\n",
299
gpgme_pubkey_algo_name(recipient->pubkey_algo));
300
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
301
fprintf(stderr, "Secret key available: %s\n",
302
recipient->status == GPG_ERR_NO_SECKEY
304
recipient = recipient->next;
164
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
168
gpgme_decrypt_result_t result;
169
result = gpgme_op_decrypt_result(ctx);
171
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
173
fprintf(stderr, "Unsupported algorithm: %s\n",
174
result->unsupported_algorithm);
175
fprintf(stderr, "Wrong key usage: %d\n",
176
result->wrong_key_usage);
177
if(result->file_name != NULL){
178
fprintf(stderr, "File name: %s\n", result->file_name);
180
gpgme_recipient_t recipient;
181
recipient = result->recipients;
183
while(recipient != NULL){
184
fprintf(stderr, "Public key algorithm: %s\n",
185
gpgme_pubkey_algo_name(recipient->pubkey_algo));
186
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
187
fprintf(stderr, "Secret key available: %s\n",
188
recipient->status == GPG_ERR_NO_SECKEY
190
recipient = recipient->next;
196
/* Delete the GPGME FILE pointer cryptotext data buffer */
197
gpgme_data_release(dh_crypto);
313
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
199
316
/* Seek back to the beginning of the GPGME plaintext data buffer */
200
317
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
201
318
perror("pgpme_data_seek");
319
plaintext_length = -1;
206
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
207
*new_packet = realloc(*new_packet,
208
(unsigned int)new_packet_capacity
210
if (*new_packet == NULL){
214
new_packet_capacity += BUFFER_SIZE;
325
plaintext_capacity = adjustbuffer(plaintext,
326
(size_t)plaintext_length,
328
if (plaintext_capacity == 0){
329
perror("adjustbuffer");
330
plaintext_length = -1;
217
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
334
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
219
336
/* Print the data, if any */
224
342
perror("gpgme_data_read");
227
new_packet_length += ret;
230
/* FIXME: check characters before printing to screen so to not print
231
terminal control characters */
233
/* fprintf(stderr, "decrypted password is: "); */
234
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
235
/* fprintf(stderr, "\n"); */
343
plaintext_length = -1;
346
plaintext_length += ret;
350
fprintf(stderr, "Decrypted password is: ");
351
for(ssize_t i = 0; i < plaintext_length; i++){
352
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
354
fprintf(stderr, "\n");
359
/* Delete the GPGME cryptotext data buffer */
360
gpgme_data_release(dh_crypto);
238
362
/* Delete the GPGME plaintext data buffer */
239
363
gpgme_data_release(dh_plain);
240
return new_packet_length;
364
return plaintext_length;
243
367
static const char * safer_gnutls_strerror (int value) {
244
const char *ret = gnutls_strerror (value);
368
const char *ret = gnutls_strerror (value); /* Spurious warning */
246
370
ret = "(unknown)";
250
void debuggnutls(__attribute__((unused)) int level,
252
fprintf(stderr, "%s", string);
374
/* GnuTLS log function callback */
375
static void debuggnutls(__attribute__((unused)) int level,
377
fprintf(stderr, "GnuTLS: %s", string);
255
int initgnutls(encrypted_session *es){
380
static int init_gnutls_global(mandos_context *mc,
381
const char *pubkeyfilename,
382
const char *seckeyfilename){
260
386
fprintf(stderr, "Initializing GnuTLS\n");
263
if ((ret = gnutls_global_init ())
264
!= GNUTLS_E_SUCCESS) {
265
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
389
ret = gnutls_global_init();
390
if (ret != GNUTLS_E_SUCCESS) {
391
fprintf (stderr, "GnuTLS global_init: %s\n",
392
safer_gnutls_strerror(ret));
397
/* "Use a log level over 10 to enable all debugging options."
270
400
gnutls_global_set_log_level(11);
271
401
gnutls_global_set_log_function(debuggnutls);
274
/* openpgp credentials */
275
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
276
!= GNUTLS_E_SUCCESS) {
277
fprintf (stderr, "memory error: %s\n",
404
/* OpenPGP credentials */
405
gnutls_certificate_allocate_credentials(&mc->cred);
406
if (ret != GNUTLS_E_SUCCESS){
407
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
278
409
safer_gnutls_strerror(ret));
410
gnutls_global_deinit ();
283
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
284
" and keyfile %s as GnuTLS credentials\n", certfile,
415
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
416
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
288
420
ret = gnutls_certificate_set_openpgp_key_file
289
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
421
(mc->cred, pubkeyfilename, seckeyfilename,
422
GNUTLS_OPENPGP_FMT_BASE64);
290
423
if (ret != GNUTLS_E_SUCCESS) {
292
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
294
ret, certfile, certkey);
295
fprintf(stdout, "The Error is: %s\n",
425
"Error[%d] while reading the OpenPGP key pair ('%s',"
426
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
427
fprintf(stderr, "The GnuTLS error is: %s\n",
296
428
safer_gnutls_strerror(ret));
300
//GnuTLS server initialization
301
if ((ret = gnutls_dh_params_init (&es->dh_params))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in dh parameter initialization: %s\n",
304
safer_gnutls_strerror(ret));
308
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
309
!= GNUTLS_E_SUCCESS) {
310
fprintf (stderr, "Error in prime generation: %s\n",
311
safer_gnutls_strerror(ret));
315
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
317
// GnuTLS session creation
318
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
319
!= GNUTLS_E_SUCCESS){
432
/* GnuTLS server initialization */
433
ret = gnutls_dh_params_init(&mc->dh_params);
434
if (ret != GNUTLS_E_SUCCESS) {
435
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
436
" %s\n", safer_gnutls_strerror(ret));
439
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
440
if (ret != GNUTLS_E_SUCCESS) {
441
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
442
safer_gnutls_strerror(ret));
446
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
452
gnutls_certificate_free_credentials(mc->cred);
453
gnutls_global_deinit();
457
static int init_gnutls_session(mandos_context *mc,
458
gnutls_session_t *session){
460
/* GnuTLS session creation */
461
ret = gnutls_init(session, GNUTLS_SERVER);
462
if (ret != GNUTLS_E_SUCCESS){
320
463
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
321
464
safer_gnutls_strerror(ret));
324
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
325
!= GNUTLS_E_SUCCESS) {
326
fprintf(stderr, "Syntax error at: %s\n", err);
327
fprintf(stderr, "GnuTLS error: %s\n",
328
safer_gnutls_strerror(ret));
469
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
470
if (ret != GNUTLS_E_SUCCESS) {
471
fprintf(stderr, "Syntax error at: %s\n", err);
472
fprintf(stderr, "GnuTLS error: %s\n",
473
safer_gnutls_strerror(ret));
474
gnutls_deinit (*session);
332
if ((ret = gnutls_credentials_set
333
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
334
!= GNUTLS_E_SUCCESS) {
335
fprintf(stderr, "Error setting a credentials set: %s\n",
479
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
481
if (ret != GNUTLS_E_SUCCESS) {
482
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
336
483
safer_gnutls_strerror(ret));
484
gnutls_deinit (*session);
340
488
/* ignore client certificate if any. */
341
gnutls_certificate_server_set_request (es->session,
489
gnutls_certificate_server_set_request (*session,
342
490
GNUTLS_CERT_IGNORE);
344
gnutls_dh_set_prime_bits (es->session, DH_BITS);
492
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
349
void empty_log(__attribute__((unused)) AvahiLogLevel level,
350
__attribute__((unused)) const char *txt){}
497
/* Avahi log function callback */
498
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
499
__attribute__((unused)) const char *txt){}
352
int start_mandos_communication(const char *ip, uint16_t port,
353
unsigned int if_index){
501
/* Called when a Mandos server is found */
502
static int start_mandos_communication(const char *ip, uint16_t port,
503
AvahiIfIndex if_index,
355
struct sockaddr_in6 to;
356
encrypted_session es;
506
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
357
507
char *buffer = NULL;
358
508
char *decrypted_buffer;
359
509
size_t buffer_length = 0;
360
510
size_t buffer_capacity = 0;
361
511
ssize_t decrypted_buffer_size;
364
514
char interface[IF_NAMESIZE];
515
gnutls_session_t session;
517
ret = init_gnutls_session (mc, &session);
367
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
523
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
370
527
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
376
if(if_indextoname(if_index, interface) == NULL){
534
if(if_indextoname((unsigned int)if_index, interface) == NULL){
378
535
perror("if_indextoname");
384
538
fprintf(stderr, "Binding to interface %s\n", interface);
387
memset(&to,0,sizeof(to)); /* Spurious warning */
388
to.sin6_family = AF_INET6;
389
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
541
memset(&to, 0, sizeof(to));
542
to.in6.sin6_family = AF_INET6;
543
/* It would be nice to have a way to detect if we were passed an
544
IPv4 address here. Now we assume an IPv6 address. */
545
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
391
547
perror("inet_pton");
395
551
fprintf(stderr, "Bad address: %s\n", ip);
398
to.sin6_port = htons(port); /* Spurious warning */
554
to.in6.sin6_port = htons(port); /* Spurious warning */
400
to.sin6_scope_id = (uint32_t)if_index;
556
to.in6.sin6_scope_id = (uint32_t)if_index;
403
fprintf(stderr, "Connection to: %s\n", ip);
559
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
561
char addrstr[INET6_ADDRSTRLEN] = "";
562
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
563
sizeof(addrstr)) == NULL){
566
if(strcmp(addrstr, ip) != 0){
567
fprintf(stderr, "Canonical address form: %s\n", addrstr);
406
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
572
ret = connect(tcp_sd, &to.in, sizeof(to));
408
574
perror("connect");
412
ret = initgnutls (&es);
578
const char *out = mandos_protocol_version;
581
size_t out_size = strlen(out);
582
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
583
out_size - written));
589
written += (size_t)ret;
590
if(written < out_size){
593
if (out == mandos_protocol_version){
418
gnutls_transport_set_ptr (es.session,
419
(gnutls_transport_ptr_t) tcp_sd);
422
603
fprintf(stderr, "Establishing TLS session with %s\n", ip);
425
ret = gnutls_handshake (es.session);
606
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
609
ret = gnutls_handshake (session);
610
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
427
612
if (ret != GNUTLS_E_SUCCESS){
429
fprintf(stderr, "\n*** Handshake failed ***\n");
614
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
430
615
gnutls_perror (ret);
436
//Retrieve OpenPGP packet that contains the wanted password
621
/* Read OpenPGP packet that contains the wanted password */
439
624
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
444
if (buffer_length + BUFFER_SIZE > buffer_capacity){
445
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
450
buffer_capacity += BUFFER_SIZE;
629
buffer_capacity = adjustbuffer(&buffer, buffer_length,
631
if (buffer_capacity == 0){
632
perror("adjustbuffer");
453
ret = gnutls_record_recv
454
(es.session, buffer+buffer_length, BUFFER_SIZE);
637
ret = gnutls_record_recv(session, buffer+buffer_length,
559
746
char ip[AVAHI_ADDRESS_STR_MAX];
560
747
avahi_address_snprint(ip, sizeof(ip), address);
562
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
563
" port %d\n", name, host_name, ip, port);
749
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
750
PRIu16 ") on port %d\n", name, host_name, ip,
565
int ret = start_mandos_communication(ip, port,
566
(unsigned int) interface);
753
int ret = start_mandos_communication(ip, port, interface, mc);
755
avahi_simple_poll_quit(mc->simple_poll);
572
759
avahi_s_service_resolver_free(r);
575
static void browse_callback(
576
AvahiSServiceBrowser *b,
577
AvahiIfIndex interface,
578
AvahiProtocol protocol,
579
AvahiBrowserEvent event,
583
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
586
AvahiServer *s = userdata;
587
assert(b); /* Spurious warning */
589
/* Called whenever a new services becomes available on the LAN or
590
is removed from the LAN */
594
case AVAHI_BROWSER_FAILURE:
596
fprintf(stderr, "(Browser) %s\n",
597
avahi_strerror(avahi_server_errno(server)));
598
avahi_simple_poll_quit(simple_poll);
601
case AVAHI_BROWSER_NEW:
602
/* We ignore the returned resolver object. In the callback
603
function we free it. If the server is terminated before
604
the callback function is called the server will free
605
the resolver for us. */
607
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
609
AVAHI_PROTO_INET6, 0,
610
resolve_callback, s)))
611
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
612
avahi_strerror(avahi_server_errno(s)));
615
case AVAHI_BROWSER_REMOVE:
618
case AVAHI_BROWSER_ALL_FOR_NOW:
619
case AVAHI_BROWSER_CACHE_EXHAUSTED:
762
static void browse_callback( AvahiSServiceBrowser *b,
763
AvahiIfIndex interface,
764
AvahiProtocol protocol,
765
AvahiBrowserEvent event,
769
AVAHI_GCC_UNUSED AvahiLookupResultFlags
772
mandos_context *mc = userdata;
775
/* Called whenever a new services becomes available on the LAN or
776
is removed from the LAN */
780
case AVAHI_BROWSER_FAILURE:
782
fprintf(stderr, "(Avahi browser) %s\n",
783
avahi_strerror(avahi_server_errno(mc->server)));
784
avahi_simple_poll_quit(mc->simple_poll);
787
case AVAHI_BROWSER_NEW:
788
/* We ignore the returned Avahi resolver object. In the callback
789
function we free it. If the Avahi server is terminated before
790
the callback function is called the Avahi server will free the
793
if (!(avahi_s_service_resolver_new(mc->server, interface,
794
protocol, name, type, domain,
795
AVAHI_PROTO_INET6, 0,
796
resolve_callback, mc)))
797
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
798
name, avahi_strerror(avahi_server_errno(mc->server)));
801
case AVAHI_BROWSER_REMOVE:
804
case AVAHI_BROWSER_ALL_FOR_NOW:
805
case AVAHI_BROWSER_CACHE_EXHAUSTED:
807
fprintf(stderr, "No Mandos server found, still searching...\n");
624
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
625
const char *combinepath(const char *first, const char *second){
627
tmp = malloc(strlen(first) + strlen(second) + 2);
633
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
641
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
642
AvahiServerConfig config;
813
int main(int argc, char *argv[]){
643
814
AvahiSServiceBrowser *sb = NULL;
646
int returncode = EXIT_SUCCESS;
817
int exitcode = EXIT_SUCCESS;
647
818
const char *interface = "eth0";
650
static struct option long_options[] = {
651
{"debug", no_argument, (int *)&debug, 1},
652
{"interface", required_argument, 0, 'i'},
653
{"certdir", required_argument, 0, 'd'},
654
{"certkey", required_argument, 0, 'c'},
655
{"certfile", required_argument, 0, 'k'},
658
int option_index = 0;
659
ret = getopt_long (argc, argv, "i:", long_options,
819
struct ifreq network;
823
char *connect_to = NULL;
824
char tempdir[] = "/tmp/mandosXXXXXX";
825
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
826
const char *seckey = PATHDIR "/" SECKEY;
827
const char *pubkey = PATHDIR "/" PUBKEY;
829
mandos_context mc = { .simple_poll = NULL, .server = NULL,
830
.dh_bits = 1024, .priority = "SECURE256"
831
":!CTYPE-X.509:+CTYPE-OPENPGP" };
832
bool gnutls_initalized = false;
833
bool pgpme_initalized = false;
836
struct argp_option options[] = {
837
{ .name = "debug", .key = 128,
838
.doc = "Debug mode", .group = 3 },
839
{ .name = "connect", .key = 'c',
840
.arg = "ADDRESS:PORT",
841
.doc = "Connect directly to a specific Mandos server",
843
{ .name = "interface", .key = 'i',
845
.doc = "Interface that will be used to search for Mandos"
848
{ .name = "seckey", .key = 's',
850
.doc = "OpenPGP secret key file base name",
852
{ .name = "pubkey", .key = 'p',
854
.doc = "OpenPGP public key file base name",
856
{ .name = "dh-bits", .key = 129,
858
.doc = "Bit length of the prime number used in the"
859
" Diffie-Hellman key exchange",
861
{ .name = "priority", .key = 130,
863
.doc = "GnuTLS priority string for the TLS handshake",
868
error_t parse_opt (int key, char *arg,
869
struct argp_state *state) {
870
/* Get the INPUT argument from `argp_parse', which we know is
871
a pointer to our plugin list pointer. */
873
case 128: /* --debug */
876
case 'c': /* --connect */
879
case 'i': /* --interface */
882
case 's': /* --seckey */
885
case 'p': /* --pubkey */
888
case 129: /* --dh-bits */
890
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
896
case 130: /* --priority */
904
return ARGP_ERR_UNKNOWN;
909
struct argp argp = { .options = options, .parser = parse_opt,
911
.doc = "Mandos client -- Get and decrypt"
912
" passwords from a Mandos server" };
913
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
914
if (ret == ARGP_ERR_UNKNOWN){
915
fprintf(stderr, "Unknown error while parsing arguments\n");
916
exitcode = EXIT_FAILURE;
921
ret = init_gnutls_global(&mc, pubkey, seckey);
923
fprintf(stderr, "init_gnutls_global failed\n");
924
exitcode = EXIT_FAILURE;
927
gnutls_initalized = true;
686
certfile = combinepath(certdir, certfile);
687
if (certfile == NULL){
691
certkey = combinepath(certdir, certkey);
692
if (certkey == NULL){
930
if(mkdtemp(tempdir) == NULL){
936
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
937
fprintf(stderr, "pgpme_initalized failed\n");
938
exitcode = EXIT_FAILURE;
941
pgpme_initalized = true;
944
/* If the interface is down, bring it up */
946
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
949
exitcode = EXIT_FAILURE;
952
strcpy(network.ifr_name, interface);
953
ret = ioctl(sd, SIOCGIFFLAGS, &network);
955
perror("ioctl SIOCGIFFLAGS");
956
exitcode = EXIT_FAILURE;
959
if((network.ifr_flags & IFF_UP) == 0){
960
network.ifr_flags |= IFF_UP;
961
ret = ioctl(sd, SIOCSIFFLAGS, &network);
963
perror("ioctl SIOCSIFFLAGS");
964
exitcode = EXIT_FAILURE;
968
ret = TEMP_FAILURE_RETRY(close(sd));
987
if_index = (AvahiIfIndex) if_nametoindex(interface);
989
fprintf(stderr, "No such interface: \"%s\"\n", interface);
993
if(connect_to != NULL){
994
/* Connect directly, do not use Zeroconf */
995
/* (Mainly meant for debugging) */
996
char *address = strrchr(connect_to, ':');
998
fprintf(stderr, "No colon in address\n");
999
exitcode = EXIT_FAILURE;
1003
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
1005
perror("Bad port number");
1006
exitcode = EXIT_FAILURE;
1010
address = connect_to;
1011
ret = start_mandos_communication(address, port, if_index, &mc);
1013
exitcode = EXIT_FAILURE;
1015
exitcode = EXIT_SUCCESS;
697
1021
avahi_set_log_function(empty_log);
700
/* Initialize the psuedo-RNG */
1024
/* Initialize the pseudo-RNG for Avahi */
701
1025
srand((unsigned int) time(NULL));
703
/* Allocate main loop object */
704
if (!(simple_poll = avahi_simple_poll_new())) {
705
fprintf(stderr, "Failed to create simple poll object.\n");
710
/* Do not publish any local records */
711
avahi_server_config_init(&config);
712
config.publish_hinfo = 0;
713
config.publish_addresses = 0;
714
config.publish_workstation = 0;
715
config.publish_domain = 0;
717
/* Allocate a new server */
718
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
719
&config, NULL, NULL, &error);
721
/* Free the configuration data */
722
avahi_server_config_free(&config);
724
/* Check if creating the server object succeeded */
726
fprintf(stderr, "Failed to create server: %s\n",
1027
/* Allocate main Avahi loop object */
1028
mc.simple_poll = avahi_simple_poll_new();
1029
if (mc.simple_poll == NULL) {
1030
fprintf(stderr, "Avahi: Failed to create simple poll"
1032
exitcode = EXIT_FAILURE;
1037
AvahiServerConfig config;
1038
/* Do not publish any local Zeroconf records */
1039
avahi_server_config_init(&config);
1040
config.publish_hinfo = 0;
1041
config.publish_addresses = 0;
1042
config.publish_workstation = 0;
1043
config.publish_domain = 0;
1045
/* Allocate a new server */
1046
mc.server = avahi_server_new(avahi_simple_poll_get
1047
(mc.simple_poll), &config, NULL,
1050
/* Free the Avahi configuration data */
1051
avahi_server_config_free(&config);
1054
/* Check if creating the Avahi server object succeeded */
1055
if (mc.server == NULL) {
1056
fprintf(stderr, "Failed to create Avahi server: %s\n",
727
1057
avahi_strerror(error));
728
returncode = EXIT_FAILURE;
1058
exitcode = EXIT_FAILURE;
732
/* Create the service browser */
733
sb = avahi_s_service_browser_new(server,
735
if_nametoindex(interface),
1062
/* Create the Avahi service browser */
1063
sb = avahi_s_service_browser_new(mc.server, if_index,
736
1064
AVAHI_PROTO_INET6,
737
1065
"_mandos._tcp", NULL, 0,
738
browse_callback, server);
1066
browse_callback, &mc);
740
1068
fprintf(stderr, "Failed to create service browser: %s\n",
741
avahi_strerror(avahi_server_errno(server)));
742
returncode = EXIT_FAILURE;
1069
avahi_strerror(avahi_server_errno(mc.server)));
1070
exitcode = EXIT_FAILURE;
746
1074
/* Run the main loop */
749
fprintf(stderr, "Starting avahi loop search\n");
1077
fprintf(stderr, "Starting Avahi loop search\n");
752
avahi_simple_poll_loop(simple_poll);
1080
avahi_simple_poll_loop(mc.simple_poll);
757
1085
fprintf(stderr, "%s exiting\n", argv[0]);
760
1088
/* Cleanup things */
762
1090
avahi_s_service_browser_free(sb);
765
avahi_server_free(server);
768
avahi_simple_poll_free(simple_poll);
1092
if (mc.server != NULL)
1093
avahi_server_free(mc.server);
1095
if (mc.simple_poll != NULL)
1096
avahi_simple_poll_free(mc.simple_poll);
1098
if (gnutls_initalized){
1099
gnutls_certificate_free_credentials(mc.cred);
1100
gnutls_global_deinit ();
1103
if(pgpme_initalized){
1104
gpgme_release(mc.ctx);
1107
/* Removes the temp directory used by GPGME */
1108
if(tempdir[0] != '\0'){
1110
struct dirent *direntry;
1111
d = opendir(tempdir);
1116
direntry = readdir(d);
1117
if(direntry == NULL){
1120
if (direntry->d_type == DT_REG){
1121
char *fullname = NULL;
1122
ret = asprintf(&fullname, "%s/%s", tempdir,
1128
ret = unlink(fullname);
1130
fprintf(stderr, "unlink(\"%s\"): %s",
1131
fullname, strerror(errno));
1137
ret = rmdir(tempdir);