To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 174
- compare with another revision
- download diff
- download tarball
- view history from revision 174
- Committer: Teddy Hogeborn
- Date: 2008-09-06 17:24:58 UTC
- Revision ID: teddy@fukt.bsnet.se-20080906172458-2x5wlfkn7oqckt1y
* legalnotice.xml: Copy DocBook 4.4-formatted text from
<http://www.gnu.org/licenses/gpl-3.0.dbk>.
<http://www.gnu.org/licenses/gpl-3.0.dbk>.
- files added:
- .bzrignore
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
32
32
#define _LARGEFILE_SOURCE
33
33
#define _FILE_OFFSET_BITS 64
34
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
41
#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
42
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
36
37
#include <stdio.h> /* fprintf(), stderr, fwrite(),
38
stdout, ferror() */
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
42
srand() */
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), asprintf(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
sockaddr_in6, PF_INET6,
49
SOCK_STREAM, INET6_ADDRSTRLEN,
50
uid_t, gid_t, open(), opendir(), DIR */
51
#include <sys/stat.h> /* open() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton(),
54
connect() */
55
#include <fcntl.h> /* open() */
56
#include <dirent.h> /* opendir(), struct dirent, readdir() */
57
#include <inttypes.h> /* PRIu16 */
58
#include <assert.h> /* assert() */
59
#include <errno.h> /* perror(), errno */
60
#include <time.h> /* time() */
61
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
62
SIOCSIFFLAGS, if_indextoname(),
63
if_nametoindex(), IF_NAMESIZE */
64
#include <netinet/in.h>
65
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
66
getuid(), getgid(), setuid(),
67
setgid() */
68
#include <arpa/inet.h> /* inet_pton(), htons */
69
#include <iso646.h> /* not, and */
70
#include <argp.h> /* struct argp_option, error_t, struct
71
argp_state, struct argp,
72
argp_parse(), ARGP_KEY_ARG,
73
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
74
75
/* Avahi */
76
/* All Avahi types, constants and functions
77
Avahi*, avahi_*,
78
AVAHI_* */
43
79
#include <avahi-core/core.h>
44
80
#include <avahi-core/lookup.h>
45
81
#include <avahi-core/log.h>
47
83
#include <avahi-common/malloc.h>
48
84
#include <avahi-common/error.h>
49
85
50
//mandos client part
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
63
64
// gpgme
65
#include <errno.h> /* perror() */
66
#include <gpgme.h>
67
68
// getopt long
69
#include <getopt.h>
86
/* GnuTLS */
87
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
88
functions:
89
gnutls_*
90
init_gnutls_session(),
91
GNUTLS_* */
92
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
93
GNUTLS_OPENPGP_FMT_BASE64 */
94
95
/* GPGME */
96
#include <gpgme.h> /* All GPGME types, constants and
97
functions:
98
gpgme_*
99
GPGME_PROTOCOL_OpenPGP,
100
GPG_ERR_NO_* */
70
101
71
102
#define BUFFER_SIZE 256
72
#define DH_BITS 1024
73
74
static const char *certdir = "/conf/conf.d/mandos";
75
static const char *certfile = "openpgp-client.txt";
76
static const char *certkey = "openpgp-client-key.txt";
103
104
/*
105
#define PATHDIR "/conf/conf.d/mandos"
106
*/
107
108
#define PATHDIR "/conf/conf.d/mandos"
109
#define SECKEY "seckey.txt"
110
#define PUBKEY "pubkey.txt"
77
111
78
112
bool debug = false;
113
static const char mandos_protocol_version[] = "1";
114
const char *argp_program_version = "mandos-client 1.0";
115
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
79
116
117
/* Used for passing in values through the Avahi callback functions */
80
118
typedef struct {
81
119
AvahiSimplePoll *simple_poll;
82
120
AvahiServer *server;
83
121
gnutls_certificate_credentials_t cred;
84
122
unsigned int dh_bits;
123
gnutls_dh_params_t dh_params;
85
124
const char *priority;
125
gpgme_ctx_t ctx;
86
126
} mandos_context;
87
127
88
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
89
char **new_packet,
90
const char *homedir){
91
gpgme_data_t dh_crypto, dh_plain;
92
gpgme_ctx_t ctx;
128
/*
129
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
130
* "buffer_capacity" is how much is currently allocated,
131
* "buffer_length" is how much is already used.
132
*/
133
size_t adjustbuffer(char **buffer, size_t buffer_length,
134
size_t buffer_capacity){
135
if (buffer_length + BUFFER_SIZE > buffer_capacity){
136
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
137
if (buffer == NULL){
138
return 0;
139
}
140
buffer_capacity += BUFFER_SIZE;
141
}
142
return buffer_capacity;
143
}
144
145
/*
146
* Initialize GPGME.
147
*/
148
static bool init_gpgme(mandos_context *mc, const char *seckey,
149
const char *pubkey, const char *tempdir){
150
int ret;
93
151
gpgme_error_t rc;
94
ssize_t ret;
95
ssize_t new_packet_capacity = 0;
96
ssize_t new_packet_length = 0;
97
152
gpgme_engine_info_t engine_info;
98
153
154
155
/*
156
* Helper function to insert pub and seckey to the enigne keyring.
157
*/
158
bool import_key(const char *filename){
159
int fd;
160
gpgme_data_t pgp_data;
161
162
fd = TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
163
if(fd == -1){
164
perror("open");
165
return false;
166
}
167
168
rc = gpgme_data_new_from_fd(&pgp_data, fd);
169
if (rc != GPG_ERR_NO_ERROR){
170
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
171
gpgme_strsource(rc), gpgme_strerror(rc));
172
return false;
173
}
174
175
rc = gpgme_op_import(mc->ctx, pgp_data);
176
if (rc != GPG_ERR_NO_ERROR){
177
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
178
gpgme_strsource(rc), gpgme_strerror(rc));
179
return false;
180
}
181
182
ret = TEMP_FAILURE_RETRY(close(fd));
183
if(ret == -1){
184
perror("close");
185
}
186
gpgme_data_release(pgp_data);
187
return true;
188
}
189
99
190
if (debug){
100
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
191
fprintf(stderr, "Initialize gpgme\n");
101
192
}
102
193
103
194
/* Init GPGME */
106
197
if (rc != GPG_ERR_NO_ERROR){
107
198
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
108
199
gpgme_strsource(rc), gpgme_strerror(rc));
109
return -1;
200
return false;
110
201
}
111
202
112
/* Set GPGME home directory */
203
/* Set GPGME home directory for the OpenPGP engine only */
113
204
rc = gpgme_get_engine_info (&engine_info);
114
205
if (rc != GPG_ERR_NO_ERROR){
115
206
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
116
207
gpgme_strsource(rc), gpgme_strerror(rc));
117
return -1;
208
return false;
118
209
}
119
210
while(engine_info != NULL){
120
211
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
121
212
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
122
engine_info->file_name, homedir);
213
engine_info->file_name, tempdir);
123
214
break;
124
215
}
125
216
engine_info = engine_info->next;
126
217
}
127
218
if(engine_info == NULL){
128
fprintf(stderr, "Could not set home dir to %s\n", homedir);
129
return -1;
130
}
131
132
/* Create new GPGME data buffer from packet buffer */
133
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
219
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
220
return false;
221
}
222
223
/* Create new GPGME "context" */
224
rc = gpgme_new(&(mc->ctx));
225
if (rc != GPG_ERR_NO_ERROR){
226
fprintf(stderr, "bad gpgme_new: %s: %s\n",
227
gpgme_strsource(rc), gpgme_strerror(rc));
228
return false;
229
}
230
231
if (not import_key(pubkey) or not import_key(seckey)){
232
return false;
233
}
234
235
return true;
236
}
237
238
/*
239
* Decrypt OpenPGP data.
240
* Returns -1 on error
241
*/
242
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
243
const char *cryptotext,
244
size_t crypto_size,
245
char **plaintext){
246
gpgme_data_t dh_crypto, dh_plain;
247
gpgme_error_t rc;
248
ssize_t ret;
249
size_t plaintext_capacity = 0;
250
ssize_t plaintext_length = 0;
251
252
if (debug){
253
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
254
}
255
256
/* Create new GPGME data buffer from memory cryptotext */
257
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
258
0);
134
259
if (rc != GPG_ERR_NO_ERROR){
135
260
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
136
261
gpgme_strsource(rc), gpgme_strerror(rc));
142
267
if (rc != GPG_ERR_NO_ERROR){
143
268
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
144
269
gpgme_strsource(rc), gpgme_strerror(rc));
145
return -1;
146
}
147
148
/* Create new GPGME "context" */
149
rc = gpgme_new(&ctx);
150
if (rc != GPG_ERR_NO_ERROR){
151
fprintf(stderr, "bad gpgme_new: %s: %s\n",
152
gpgme_strsource(rc), gpgme_strerror(rc));
153
return -1;
154
}
155
156
/* Decrypt data from the FILE pointer to the plaintext data
157
buffer */
158
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
270
gpgme_data_release(dh_crypto);
271
return -1;
272
}
273
274
/* Decrypt data from the cryptotext data buffer to the plaintext
275
data buffer */
276
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
159
277
if (rc != GPG_ERR_NO_ERROR){
160
278
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
161
279
gpgme_strsource(rc), gpgme_strerror(rc));
162
return -1;
280
plaintext_length = -1;
281
if (debug){
282
gpgme_decrypt_result_t result;
283
result = gpgme_op_decrypt_result(mc->ctx);
284
if (result == NULL){
285
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
286
} else {
287
fprintf(stderr, "Unsupported algorithm: %s\n",
288
result->unsupported_algorithm);
289
fprintf(stderr, "Wrong key usage: %u\n",
290
result->wrong_key_usage);
291
if(result->file_name != NULL){
292
fprintf(stderr, "File name: %s\n", result->file_name);
293
}
294
gpgme_recipient_t recipient;
295
recipient = result->recipients;
296
if(recipient){
297
while(recipient != NULL){
298
fprintf(stderr, "Public key algorithm: %s\n",
299
gpgme_pubkey_algo_name(recipient->pubkey_algo));
300
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
301
fprintf(stderr, "Secret key available: %s\n",
302
recipient->status == GPG_ERR_NO_SECKEY
303
? "No" : "Yes");
304
recipient = recipient->next;
305
}
306
}
307
}
308
}
309
goto decrypt_end;
163
310
}
164
311
165
312
if(debug){
166
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
167
}
168
169
if (debug){
170
gpgme_decrypt_result_t result;
171
result = gpgme_op_decrypt_result(ctx);
172
if (result == NULL){
173
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
174
} else {
175
fprintf(stderr, "Unsupported algorithm: %s\n",
176
result->unsupported_algorithm);
177
fprintf(stderr, "Wrong key usage: %d\n",
178
result->wrong_key_usage);
179
if(result->file_name != NULL){
180
fprintf(stderr, "File name: %s\n", result->file_name);
181
}
182
gpgme_recipient_t recipient;
183
recipient = result->recipients;
184
if(recipient){
185
while(recipient != NULL){
186
fprintf(stderr, "Public key algorithm: %s\n",
187
gpgme_pubkey_algo_name(recipient->pubkey_algo));
188
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
189
fprintf(stderr, "Secret key available: %s\n",
190
recipient->status == GPG_ERR_NO_SECKEY
191
? "No" : "Yes");
192
recipient = recipient->next;
193
}
194
}
195
}
196
}
197
198
/* Delete the GPGME FILE pointer cryptotext data buffer */
199
gpgme_data_release(dh_crypto);
313
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
314
}
200
315
201
316
/* Seek back to the beginning of the GPGME plaintext data buffer */
202
317
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
203
318
perror("pgpme_data_seek");
319
plaintext_length = -1;
320
goto decrypt_end;
204
321
}
205
322
206
*new_packet = 0;
323
*plaintext = NULL;
207
324
while(true){
208
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
209
*new_packet = realloc(*new_packet,
210
(unsigned int)new_packet_capacity
211
+ BUFFER_SIZE);
212
if (*new_packet == NULL){
213
perror("realloc");
214
return -1;
215
}
216
new_packet_capacity += BUFFER_SIZE;
325
plaintext_capacity = adjustbuffer(plaintext,
326
(size_t)plaintext_length,
327
plaintext_capacity);
328
if (plaintext_capacity == 0){
329
perror("adjustbuffer");
330
plaintext_length = -1;
331
goto decrypt_end;
217
332
}
218
333
219
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
334
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
220
335
BUFFER_SIZE);
221
336
/* Print the data, if any */
222
337
if (ret == 0){
338
/* EOF */
223
339
break;
224
340
}
225
341
if(ret < 0){
226
342
perror("gpgme_data_read");
227
return -1;
228
}
229
new_packet_length += ret;
230
}
231
232
/* FIXME: check characters before printing to screen so to not print
233
terminal control characters */
234
/* if(debug){ */
235
/* fprintf(stderr, "decrypted password is: "); */
236
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
237
/* fprintf(stderr, "\n"); */
238
/* } */
343
plaintext_length = -1;
344
goto decrypt_end;
345
}
346
plaintext_length += ret;
347
}
348
349
if(debug){
350
fprintf(stderr, "Decrypted password is: ");
351
for(ssize_t i = 0; i < plaintext_length; i++){
352
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
353
}
354
fprintf(stderr, "\n");
355
}
356
357
decrypt_end:
358
359
/* Delete the GPGME cryptotext data buffer */
360
gpgme_data_release(dh_crypto);
239
361
240
362
/* Delete the GPGME plaintext data buffer */
241
363
gpgme_data_release(dh_plain);
242
return new_packet_length;
364
return plaintext_length;
243
365
}
244
366
245
367
static const char * safer_gnutls_strerror (int value) {
246
const char *ret = gnutls_strerror (value);
368
const char *ret = gnutls_strerror (value); /* Spurious warning */
247
369
if (ret == NULL)
248
370
ret = "(unknown)";
249
371
return ret;
250
372
}
251
373
374
/* GnuTLS log function callback */
252
375
static void debuggnutls(__attribute__((unused)) int level,
253
376
const char* string){
254
fprintf(stderr, "%s", string);
377
fprintf(stderr, "GnuTLS: %s", string);
255
378
}
256
379
257
static int initgnutls(mandos_context *mc){
258
const char *err;
380
static int init_gnutls_global(mandos_context *mc,
381
const char *pubkeyfilename,
382
const char *seckeyfilename){
259
383
int ret;
260
384
261
385
if(debug){
262
386
fprintf(stderr, "Initializing GnuTLS\n");
263
387
}
264
265
if ((ret = gnutls_global_init ())
266
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
388
389
ret = gnutls_global_init();
390
if (ret != GNUTLS_E_SUCCESS) {
391
fprintf (stderr, "GnuTLS global_init: %s\n",
392
safer_gnutls_strerror(ret));
268
393
return -1;
269
394
}
270
395
271
396
if (debug){
397
/* "Use a log level over 10 to enable all debugging options."
398
* - GnuTLS manual
399
*/
272
400
gnutls_global_set_log_level(11);
273
401
gnutls_global_set_log_function(debuggnutls);
274
402
}
275
403
276
/* openpgp credentials */
277
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
278
!= GNUTLS_E_SUCCESS) {
279
fprintf (stderr, "memory error: %s\n",
404
/* OpenPGP credentials */
405
gnutls_certificate_allocate_credentials(&mc->cred);
406
if (ret != GNUTLS_E_SUCCESS){
407
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
408
warning */
280
409
safer_gnutls_strerror(ret));
410
gnutls_global_deinit ();
281
411
return -1;
282
412
}
283
413
284
414
if(debug){
285
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
286
" and keyfile %s as GnuTLS credentials\n", certfile,
287
certkey);
415
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
416
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
417
seckeyfilename);
288
418
}
289
419
290
420
ret = gnutls_certificate_set_openpgp_key_file
291
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
421
(mc->cred, pubkeyfilename, seckeyfilename,
422
GNUTLS_OPENPGP_FMT_BASE64);
292
423
if (ret != GNUTLS_E_SUCCESS) {
293
fprintf
294
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
295
" '%s')\n",
296
ret, certfile, certkey);
297
fprintf(stdout, "The Error is: %s\n",
424
fprintf(stderr,
425
"Error[%d] while reading the OpenPGP key pair ('%s',"
426
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
427
fprintf(stderr, "The GnuTLS error is: %s\n",
298
428
safer_gnutls_strerror(ret));
299
return -1;
300
}
301
302
//GnuTLS server initialization
303
if ((ret = gnutls_dh_params_init (&es->dh_params))
304
!= GNUTLS_E_SUCCESS) {
305
fprintf (stderr, "Error in dh parameter initialization: %s\n",
306
safer_gnutls_strerror(ret));
307
return -1;
308
}
309
310
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
311
!= GNUTLS_E_SUCCESS) {
312
fprintf (stderr, "Error in prime generation: %s\n",
313
safer_gnutls_strerror(ret));
314
return -1;
315
}
316
317
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
318
319
// GnuTLS session creation
320
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
321
!= GNUTLS_E_SUCCESS){
429
goto globalfail;
430
}
431
432
/* GnuTLS server initialization */
433
ret = gnutls_dh_params_init(&mc->dh_params);
434
if (ret != GNUTLS_E_SUCCESS) {
435
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
436
" %s\n", safer_gnutls_strerror(ret));
437
goto globalfail;
438
}
439
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
440
if (ret != GNUTLS_E_SUCCESS) {
441
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
442
safer_gnutls_strerror(ret));
443
goto globalfail;
444
}
445
446
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
447
448
return 0;
449
450
globalfail:
451
452
gnutls_certificate_free_credentials(mc->cred);
453
gnutls_global_deinit();
454
return -1;
455
}
456
457
static int init_gnutls_session(mandos_context *mc,
458
gnutls_session_t *session){
459
int ret;
460
/* GnuTLS session creation */
461
ret = gnutls_init(session, GNUTLS_SERVER);
462
if (ret != GNUTLS_E_SUCCESS){
322
463
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
323
464
safer_gnutls_strerror(ret));
324
465
}
325
466
326
if ((ret = gnutls_priority_set_direct (es->session, mc->priority, &err))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Syntax error at: %s\n", err);
329
fprintf(stderr, "GnuTLS error: %s\n",
330
safer_gnutls_strerror(ret));
331
return -1;
467
{
468
const char *err;
469
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
470
if (ret != GNUTLS_E_SUCCESS) {
471
fprintf(stderr, "Syntax error at: %s\n", err);
472
fprintf(stderr, "GnuTLS error: %s\n",
473
safer_gnutls_strerror(ret));
474
gnutls_deinit (*session);
475
return -1;
476
}
332
477
}
333
478
334
if ((ret = gnutls_credentials_set
335
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
336
!= GNUTLS_E_SUCCESS) {
337
fprintf(stderr, "Error setting a credentials set: %s\n",
479
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
480
mc->cred);
481
if (ret != GNUTLS_E_SUCCESS) {
482
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
338
483
safer_gnutls_strerror(ret));
484
gnutls_deinit (*session);
339
485
return -1;
340
486
}
341
487
342
488
/* ignore client certificate if any. */
343
gnutls_certificate_server_set_request (es->session,
489
gnutls_certificate_server_set_request (*session,
344
490
GNUTLS_CERT_IGNORE);
345
491
346
gnutls_dh_set_prime_bits (es->session, DH_BITS);
492
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
347
493
348
494
return 0;
349
495
}
350
496
497
/* Avahi log function callback */
351
498
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
352
499
__attribute__((unused)) const char *txt){}
353
500
501
/* Called when a Mandos server is found */
354
502
static int start_mandos_communication(const char *ip, uint16_t port,
355
503
AvahiIfIndex if_index,
356
504
mandos_context *mc){
357
505
int ret, tcp_sd;
358
struct sockaddr_in6 to;
359
encrypted_session es;
506
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
360
507
char *buffer = NULL;
361
508
char *decrypted_buffer;
362
509
size_t buffer_length = 0;
363
510
size_t buffer_capacity = 0;
364
511
ssize_t decrypted_buffer_size;
365
size_t written = 0;
512
size_t written;
366
513
int retval = 0;
367
514
char interface[IF_NAMESIZE];
515
gnutls_session_t session;
516
517
ret = init_gnutls_session (mc, &session);
518
if (ret != 0){
519
return -1;
520
}
368
521
369
522
if(debug){
370
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
371
ip, port);
523
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
524
"\n", ip, port);
372
525
}
373
526
374
527
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
376
529
perror("socket");
377
530
return -1;
378
531
}
379
532
380
533
if(debug){
381
534
if(if_indextoname((unsigned int)if_index, interface) == NULL){
382
if(debug){
383
perror("if_indextoname");
384
}
535
perror("if_indextoname");
385
536
return -1;
386
537
}
387
388
538
fprintf(stderr, "Binding to interface %s\n", interface);
389
539
}
390
540
391
memset(&to,0,sizeof(to)); /* Spurious warning */
392
to.sin6_family = AF_INET6;
393
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
541
memset(&to, 0, sizeof(to));
542
to.in6.sin6_family = AF_INET6;
543
/* It would be nice to have a way to detect if we were passed an
544
IPv4 address here. Now we assume an IPv6 address. */
545
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
394
546
if (ret < 0 ){
395
547
perror("inet_pton");
396
548
return -1;
397
}
549
}
398
550
if(ret == 0){
399
551
fprintf(stderr, "Bad address: %s\n", ip);
400
552
return -1;
401
553
}
402
to.sin6_port = htons(port); /* Spurious warning */
554
to.in6.sin6_port = htons(port); /* Spurious warning */
403
555
404
to.sin6_scope_id = (uint32_t)if_index;
556
to.in6.sin6_scope_id = (uint32_t)if_index;
405
557
406
558
if(debug){
407
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
408
/* char addrstr[INET6_ADDRSTRLEN]; */
409
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
410
/* sizeof(addrstr)) == NULL){ */
411
/* perror("inet_ntop"); */
412
/* } else { */
413
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
414
/* addrstr, ntohs(to.sin6_port)); */
415
/* } */
559
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
560
port);
561
char addrstr[INET6_ADDRSTRLEN] = "";
562
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
563
sizeof(addrstr)) == NULL){
564
perror("inet_ntop");
565
} else {
566
if(strcmp(addrstr, ip) != 0){
567
fprintf(stderr, "Canonical address form: %s\n", addrstr);
568
}
569
}
416
570
}
417
571
418
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
572
ret = connect(tcp_sd, &to.in, sizeof(to));
419
573
if (ret < 0){
420
574
perror("connect");
421
575
return -1;
422
576
}
423
577
424
ret = initgnutls (&es);
425
if (ret != 0){
426
retval = -1;
427
return -1;
578
const char *out = mandos_protocol_version;
579
written = 0;
580
while (true){
581
size_t out_size = strlen(out);
582
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
583
out_size - written));
584
if (ret == -1){
585
perror("write");
586
retval = -1;
587
goto mandos_end;
588
}
589
written += (size_t)ret;
590
if(written < out_size){
591
continue;
592
} else {
593
if (out == mandos_protocol_version){
594
written = 0;
595
out = "\r\n";
596
} else {
597
break;
598
}
599
}
428
600
}
429
601
430
gnutls_transport_set_ptr (es.session,
431
(gnutls_transport_ptr_t) tcp_sd);
432
433
602
if(debug){
434
603
fprintf(stderr, "Establishing TLS session with %s\n", ip);
435
604
}
436
605
437
ret = gnutls_handshake (es.session);
606
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
607
608
do{
609
ret = gnutls_handshake (session);
610
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
438
611
439
612
if (ret != GNUTLS_E_SUCCESS){
440
613
if(debug){
441
fprintf(stderr, "\n*** Handshake failed ***\n");
614
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
442
615
gnutls_perror (ret);
443
616
}
444
617
retval = -1;
445
goto exit;
618
goto mandos_end;
446
619
}
447
620
448
//Retrieve OpenPGP packet that contains the wanted password
621
/* Read OpenPGP packet that contains the wanted password */
449
622
450
623
if(debug){
451
624
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
452
625
ip);
453
626
}
454
627
455
628
while(true){
456
if (buffer_length + BUFFER_SIZE > buffer_capacity){
457
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
458
if (buffer == NULL){
459
perror("realloc");
460
goto exit;
461
}
462
buffer_capacity += BUFFER_SIZE;
629
buffer_capacity = adjustbuffer(&buffer, buffer_length,
630
buffer_capacity);
631
if (buffer_capacity == 0){
632
perror("adjustbuffer");
633
retval = -1;
634
goto mandos_end;
463
635
}
464
636
465
ret = gnutls_record_recv
466
(es.session, buffer+buffer_length, BUFFER_SIZE);
637
ret = gnutls_record_recv(session, buffer+buffer_length,
638
BUFFER_SIZE);
467
639
if (ret == 0){
468
640
break;
469
641
}
473
645
case GNUTLS_E_AGAIN:
474
646
break;
475
647
case GNUTLS_E_REHANDSHAKE:
476
ret = gnutls_handshake (es.session);
648
do{
649
ret = gnutls_handshake (session);
650
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
477
651
if (ret < 0){
478
fprintf(stderr, "\n*** Handshake failed ***\n");
652
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
479
653
gnutls_perror (ret);
480
654
retval = -1;
481
goto exit;
655
goto mandos_end;
482
656
}
483
657
break;
484
658
default:
485
659
fprintf(stderr, "Unknown error while reading data from"
486
" encrypted session with mandos server\n");
660
" encrypted session with Mandos server\n");
487
661
retval = -1;
488
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
489
goto exit;
662
gnutls_bye (session, GNUTLS_SHUT_RDWR);
663
goto mandos_end;
490
664
}
491
665
} else {
492
666
buffer_length += (size_t) ret;
493
667
}
494
668
}
495
669
670
if(debug){
671
fprintf(stderr, "Closing TLS session\n");
672
}
673
674
gnutls_bye (session, GNUTLS_SHUT_RDWR);
675
496
676
if (buffer_length > 0){
497
decrypted_buffer_size = pgp_packet_decrypt(buffer,
677
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
498
678
buffer_length,
499
&decrypted_buffer,
500
certdir);
679
&decrypted_buffer);
501
680
if (decrypted_buffer_size >= 0){
681
written = 0;
502
682
while(written < (size_t) decrypted_buffer_size){
503
683
ret = (int)fwrite (decrypted_buffer + written, 1,
504
684
(size_t)decrypted_buffer_size - written,
517
697
} else {
518
698
retval = -1;
519
699
}
520
}
521
522
//shutdown procedure
523
524
if(debug){
525
fprintf(stderr, "Closing TLS session\n");
526
}
527
700
} else {
701
retval = -1;
702
}
703
704
/* Shutdown procedure */
705
706
mandos_end:
528
707
free(buffer);
529
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
530
exit:
531
close(tcp_sd);
532
gnutls_deinit (es.session);
533
gnutls_certificate_free_credentials (es.cred);
534
gnutls_global_deinit ();
708
ret = TEMP_FAILURE_RETRY(close(tcp_sd));
709
if(ret == -1){
710
perror("close");
711
}
712
gnutls_deinit (session);
535
713
return retval;
536
714
}
537
715
538
static void resolve_callback( AvahiSServiceResolver *r,
539
AvahiIfIndex interface,
540
AVAHI_GCC_UNUSED AvahiProtocol protocol,
541
AvahiResolverEvent event,
542
const char *name,
543
const char *type,
544
const char *domain,
545
const char *host_name,
546
const AvahiAddress *address,
547
uint16_t port,
548
AVAHI_GCC_UNUSED AvahiStringList *txt,
549
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
550
AVAHI_GCC_UNUSED void* userdata) {
716
static void resolve_callback(AvahiSServiceResolver *r,
717
AvahiIfIndex interface,
718
AVAHI_GCC_UNUSED AvahiProtocol protocol,
719
AvahiResolverEvent event,
720
const char *name,
721
const char *type,
722
const char *domain,
723
const char *host_name,
724
const AvahiAddress *address,
725
uint16_t port,
726
AVAHI_GCC_UNUSED AvahiStringList *txt,
727
AVAHI_GCC_UNUSED AvahiLookupResultFlags
728
flags,
729
void* userdata) {
551
730
mandos_context *mc = userdata;
552
assert(r); /* Spurious warning */
731
assert(r);
553
732
554
733
/* Called whenever a service has been resolved successfully or
555
734
timed out */
557
736
switch (event) {
558
737
default:
559
738
case AVAHI_RESOLVER_FAILURE:
560
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
561
" type '%s' in domain '%s': %s\n", name, type, domain,
739
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
740
" of type '%s' in domain '%s': %s\n", name, type, domain,
562
741
avahi_strerror(avahi_server_errno(mc->server)));
563
742
break;
564
743
567
746
char ip[AVAHI_ADDRESS_STR_MAX];
568
747
avahi_address_snprint(ip, sizeof(ip), address);
569
748
if(debug){
570
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
571
" port %d\n", name, host_name, ip, port);
749
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
750
PRIu16 ") on port %d\n", name, host_name, ip,
751
interface, port);
572
752
}
573
753
int ret = start_mandos_communication(ip, port, interface, mc);
574
754
if (ret == 0){
575
exit(EXIT_SUCCESS);
755
avahi_simple_poll_quit(mc->simple_poll);
576
756
}
577
757
}
578
758
}
586
766
const char *name,
587
767
const char *type,
588
768
const char *domain,
589
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
769
AVAHI_GCC_UNUSED AvahiLookupResultFlags
770
flags,
590
771
void* userdata) {
591
772
mandos_context *mc = userdata;
592
assert(b); /* Spurious warning */
773
assert(b);
593
774
594
775
/* Called whenever a new services becomes available on the LAN or
595
776
is removed from the LAN */
597
778
switch (event) {
598
779
default:
599
780
case AVAHI_BROWSER_FAILURE:
600
601
fprintf(stderr, "(Browser) %s\n",
781
782
fprintf(stderr, "(Avahi browser) %s\n",
602
783
avahi_strerror(avahi_server_errno(mc->server)));
603
784
avahi_simple_poll_quit(mc->simple_poll);
604
785
return;
605
786
606
787
case AVAHI_BROWSER_NEW:
607
/* We ignore the returned resolver object. In the callback
608
function we free it. If the server is terminated before
609
the callback function is called the server will free
610
the resolver for us. */
611
612
if (!(avahi_s_service_resolver_new(mc->server, interface, protocol, name,
613
type, domain,
788
/* We ignore the returned Avahi resolver object. In the callback
789
function we free it. If the Avahi server is terminated before
790
the callback function is called the Avahi server will free the
791
resolver for us. */
792
793
if (!(avahi_s_service_resolver_new(mc->server, interface,
794
protocol, name, type, domain,
614
795
AVAHI_PROTO_INET6, 0,
615
796
resolve_callback, mc)))
616
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
617
avahi_strerror(avahi_server_errno(s)));
797
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
798
name, avahi_strerror(avahi_server_errno(mc->server)));
618
799
break;
619
800
620
801
case AVAHI_BROWSER_REMOVE:
621
802
break;
622
803
623
804
case AVAHI_BROWSER_ALL_FOR_NOW:
624
805
case AVAHI_BROWSER_CACHE_EXHAUSTED:
806
if(debug){
807
fprintf(stderr, "No Mandos server found, still searching...\n");
808
}
625
809
break;
626
810
}
627
811
}
628
812
629
/* Combines file name and path and returns the malloced new
630
string. some sane checks could/should be added */
631
static const char *combinepath(const char *first, const char *second){
632
size_t f_len = strlen(first);
633
size_t s_len = strlen(second);
634
char *tmp = malloc(f_len + s_len + 2);
635
if (tmp == NULL){
636
return NULL;
637
}
638
if(f_len > 0){
639
memcpy(tmp, first, f_len);
640
}
641
tmp[f_len] = '/';
642
if(s_len > 0){
643
memcpy(tmp + f_len + 1, second, s_len);
644
}
645
tmp[f_len + 1 + s_len] = '\0';
646
return tmp;
647
}
648
649
650
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
651
AvahiServerConfig config;
813
int main(int argc, char *argv[]){
652
814
AvahiSServiceBrowser *sb = NULL;
653
815
int error;
654
816
int ret;
655
int returncode = EXIT_SUCCESS;
817
int exitcode = EXIT_SUCCESS;
656
818
const char *interface = "eth0";
657
819
struct ifreq network;
658
820
int sd;
821
uid_t uid;
822
gid_t gid;
659
823
char *connect_to = NULL;
824
char tempdir[] = "/tmp/mandosXXXXXX";
660
825
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
826
const char *seckey = PATHDIR "/" SECKEY;
827
const char *pubkey = PATHDIR "/" PUBKEY;
828
661
829
mandos_context mc = { .simple_poll = NULL, .server = NULL,
662
.dh_bits = 2048, .priority = "SECURE256"};
830
.dh_bits = 1024, .priority = "SECURE256"
831
":!CTYPE-X.509:+CTYPE-OPENPGP" };
832
bool gnutls_initalized = false;
833
bool pgpme_initalized = false;
663
834
664
while (true){
665
static struct option long_options[] = {
666
{"debug", no_argument, (int *)&debug, 1},
667
{"connect", required_argument, 0, 'C'},
668
{"interface", required_argument, 0, 'i'},
669
{"certdir", required_argument, 0, 'd'},
670
{"certkey", required_argument, 0, 'c'},
671
{"certfile", required_argument, 0, 'k'},
672
{"dh_bits", required_argument, 0, 'D'},
673
{"priority", required_argument, 0, 'p'},
674
{0, 0, 0, 0} };
675
676
int option_index = 0;
677
ret = getopt_long (argc, argv, "i:", long_options,
678
&option_index);
679
680
if (ret == -1){
681
break;
682
}
683
684
switch(ret){
685
case 0:
686
break;
687
case 'i':
688
interface = optarg;
689
break;
690
case 'C':
691
connect_to = optarg;
692
break;
693
case 'd':
694
certdir = optarg;
695
break;
696
case 'c':
697
certfile = optarg;
698
break;
699
case 'k':
700
certkey = optarg;
701
break;
702
case 'D':
703
{
704
long int tmp;
835
{
836
struct argp_option options[] = {
837
{ .name = "debug", .key = 128,
838
.doc = "Debug mode", .group = 3 },
839
{ .name = "connect", .key = 'c',
840
.arg = "ADDRESS:PORT",
841
.doc = "Connect directly to a specific Mandos server",
842
.group = 1 },
843
{ .name = "interface", .key = 'i',
844
.arg = "NAME",
845
.doc = "Interface that will be used to search for Mandos"
846
" servers",
847
.group = 1 },
848
{ .name = "seckey", .key = 's',
849
.arg = "FILE",
850
.doc = "OpenPGP secret key file base name",
851
.group = 1 },
852
{ .name = "pubkey", .key = 'p',
853
.arg = "FILE",
854
.doc = "OpenPGP public key file base name",
855
.group = 2 },
856
{ .name = "dh-bits", .key = 129,
857
.arg = "BITS",
858
.doc = "Bit length of the prime number used in the"
859
" Diffie-Hellman key exchange",
860
.group = 2 },
861
{ .name = "priority", .key = 130,
862
.arg = "STRING",
863
.doc = "GnuTLS priority string for the TLS handshake",
864
.group = 1 },
865
{ .name = NULL }
866
};
867
868
error_t parse_opt (int key, char *arg,
869
struct argp_state *state) {
870
/* Get the INPUT argument from `argp_parse', which we know is
871
a pointer to our plugin list pointer. */
872
switch (key) {
873
case 128: /* --debug */
874
debug = true;
875
break;
876
case 'c': /* --connect */
877
connect_to = arg;
878
break;
879
case 'i': /* --interface */
880
interface = arg;
881
break;
882
case 's': /* --seckey */
883
seckey = arg;
884
break;
885
case 'p': /* --pubkey */
886
pubkey = arg;
887
break;
888
case 129: /* --dh-bits */
705
889
errno = 0;
706
tmp = strtol(optarg, NULL, 10);
707
if (errno == ERANGE){
890
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
891
if (errno){
708
892
perror("strtol");
709
893
exit(EXIT_FAILURE);
710
894
}
711
mc.dh_bits = tmp;
712
}
713
break;
714
case 'p':
715
mc.priority = optarg;
716
break;
717
default:
718
exit(EXIT_FAILURE);
719
}
720
}
721
722
certfile = combinepath(certdir, certfile);
723
if (certfile == NULL){
724
perror("combinepath");
725
returncode = EXIT_FAILURE;
726
goto exit;
727
}
728
729
certkey = combinepath(certdir, certkey);
730
if (certkey == NULL){
731
perror("combinepath");
732
returncode = EXIT_FAILURE;
733
goto exit;
895
break;
896
case 130: /* --priority */
897
mc.priority = arg;
898
break;
899
case ARGP_KEY_ARG:
900
argp_usage (state);
901
case ARGP_KEY_END:
902
break;
903
default:
904
return ARGP_ERR_UNKNOWN;
905
}
906
return 0;
907
}
908
909
struct argp argp = { .options = options, .parser = parse_opt,
910
.args_doc = "",
911
.doc = "Mandos client -- Get and decrypt"
912
" passwords from a Mandos server" };
913
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
914
if (ret == ARGP_ERR_UNKNOWN){
915
fprintf(stderr, "Unknown error while parsing arguments\n");
916
exitcode = EXIT_FAILURE;
917
goto end;
918
}
919
}
920
921
/* If the interface is down, bring it up */
922
{
923
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
924
if(sd < 0) {
925
perror("socket");
926
exitcode = EXIT_FAILURE;
927
goto end;
928
}
929
strcpy(network.ifr_name, interface);
930
ret = ioctl(sd, SIOCGIFFLAGS, &network);
931
if(ret == -1){
932
perror("ioctl SIOCGIFFLAGS");
933
exitcode = EXIT_FAILURE;
934
goto end;
935
}
936
if((network.ifr_flags & IFF_UP) == 0){
937
network.ifr_flags |= IFF_UP;
938
ret = ioctl(sd, SIOCSIFFLAGS, &network);
939
if(ret == -1){
940
perror("ioctl SIOCSIFFLAGS");
941
exitcode = EXIT_FAILURE;
942
goto end;
943
}
944
}
945
ret = TEMP_FAILURE_RETRY(close(sd));
946
if(ret == -1){
947
perror("close");
948
}
949
}
950
951
uid = getuid();
952
gid = getgid();
953
954
ret = setuid(uid);
955
if (ret == -1){
956
perror("setuid");
957
}
958
959
setgid(gid);
960
if (ret == -1){
961
perror("setgid");
962
}
963
964
ret = init_gnutls_global(&mc, pubkey, seckey);
965
if (ret == -1){
966
fprintf(stderr, "init_gnutls_global failed\n");
967
exitcode = EXIT_FAILURE;
968
goto end;
969
} else {
970
gnutls_initalized = true;
971
}
972
973
if(mkdtemp(tempdir) == NULL){
974
perror("mkdtemp");
975
tempdir[0] = '\0';
976
goto end;
977
}
978
979
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
980
fprintf(stderr, "pgpme_initalized failed\n");
981
exitcode = EXIT_FAILURE;
982
goto end;
983
} else {
984
pgpme_initalized = true;
734
985
}
735
986
736
987
if_index = (AvahiIfIndex) if_nametoindex(interface);
745
996
char *address = strrchr(connect_to, ':');
746
997
if(address == NULL){
747
998
fprintf(stderr, "No colon in address\n");
748
exit(EXIT_FAILURE);
999
exitcode = EXIT_FAILURE;
1000
goto end;
749
1001
}
750
1002
errno = 0;
751
1003
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
752
1004
if(errno){
753
1005
perror("Bad port number");
754
exit(EXIT_FAILURE);
1006
exitcode = EXIT_FAILURE;
1007
goto end;
755
1008
}
756
1009
*address = '\0';
757
1010
address = connect_to;
758
ret = start_mandos_communication(address, port, if_index);
1011
ret = start_mandos_communication(address, port, if_index, &mc);
759
1012
if(ret < 0){
760
exit(EXIT_FAILURE);
1013
exitcode = EXIT_FAILURE;
761
1014
} else {
762
exit(EXIT_SUCCESS);
763
}
764
}
765
766
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
767
if(sd < 0) {
768
perror("socket");
769
returncode = EXIT_FAILURE;
770
goto exit;
771
}
772
strcpy(network.ifr_name, interface);
773
ret = ioctl(sd, SIOCGIFFLAGS, &network);
774
if(ret == -1){
775
776
perror("ioctl SIOCGIFFLAGS");
777
returncode = EXIT_FAILURE;
778
goto exit;
779
}
780
if((network.ifr_flags & IFF_UP) == 0){
781
network.ifr_flags |= IFF_UP;
782
ret = ioctl(sd, SIOCSIFFLAGS, &network);
783
if(ret == -1){
784
perror("ioctl SIOCSIFFLAGS");
785
returncode = EXIT_FAILURE;
786
goto exit;
787
}
788
}
789
close(sd);
1015
exitcode = EXIT_SUCCESS;
1016
}
1017
goto end;
1018
}
790
1019
791
1020
if (not debug){
792
1021
avahi_set_log_function(empty_log);
793
1022
}
794
1023
795
/* Initialize the psuedo-RNG */
1024
/* Initialize the pseudo-RNG for Avahi */
796
1025
srand((unsigned int) time(NULL));
797
798
/* Allocate main loop object */
799
if (!(mc.simple_poll = avahi_simple_poll_new())) {
800
fprintf(stderr, "Failed to create simple poll object.\n");
801
returncode = EXIT_FAILURE;
802
goto exit;
803
}
804
805
/* Do not publish any local records */
806
avahi_server_config_init(&config);
807
config.publish_hinfo = 0;
808
config.publish_addresses = 0;
809
config.publish_workstation = 0;
810
config.publish_domain = 0;
811
812
/* Allocate a new server */
813
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
814
&config, NULL, NULL, &error);
815
816
/* Free the configuration data */
817
avahi_server_config_free(&config);
818
819
/* Check if creating the server object succeeded */
820
if (!mc.server) {
821
fprintf(stderr, "Failed to create server: %s\n",
1026
1027
/* Allocate main Avahi loop object */
1028
mc.simple_poll = avahi_simple_poll_new();
1029
if (mc.simple_poll == NULL) {
1030
fprintf(stderr, "Avahi: Failed to create simple poll"
1031
" object.\n");
1032
exitcode = EXIT_FAILURE;
1033
goto end;
1034
}
1035
1036
{
1037
AvahiServerConfig config;
1038
/* Do not publish any local Zeroconf records */
1039
avahi_server_config_init(&config);
1040
config.publish_hinfo = 0;
1041
config.publish_addresses = 0;
1042
config.publish_workstation = 0;
1043
config.publish_domain = 0;
1044
1045
/* Allocate a new server */
1046
mc.server = avahi_server_new(avahi_simple_poll_get
1047
(mc.simple_poll), &config, NULL,
1048
NULL, &error);
1049
1050
/* Free the Avahi configuration data */
1051
avahi_server_config_free(&config);
1052
}
1053
1054
/* Check if creating the Avahi server object succeeded */
1055
if (mc.server == NULL) {
1056
fprintf(stderr, "Failed to create Avahi server: %s\n",
822
1057
avahi_strerror(error));
823
returncode = EXIT_FAILURE;
824
goto exit;
1058
exitcode = EXIT_FAILURE;
1059
goto end;
825
1060
}
826
1061
827
/* Create the service browser */
1062
/* Create the Avahi service browser */
828
1063
sb = avahi_s_service_browser_new(mc.server, if_index,
829
1064
AVAHI_PROTO_INET6,
830
1065
"_mandos._tcp", NULL, 0,
831
1066
browse_callback, &mc);
832
if (!sb) {
1067
if (sb == NULL) {
833
1068
fprintf(stderr, "Failed to create service browser: %s\n",
834
1069
avahi_strerror(avahi_server_errno(mc.server)));
835
returncode = EXIT_FAILURE;
836
goto exit;
1070
exitcode = EXIT_FAILURE;
1071
goto end;
837
1072
}
838
1073
839
1074
/* Run the main loop */
840
1075
841
1076
if (debug){
842
fprintf(stderr, "Starting avahi loop search\n");
1077
fprintf(stderr, "Starting Avahi loop search\n");
843
1078
}
844
1079
845
avahi_simple_poll_loop(simple_poll);
846
847
exit:
848
1080
avahi_simple_poll_loop(mc.simple_poll);
1081
1082
end:
1083
849
1084
if (debug){
850
1085
fprintf(stderr, "%s exiting\n", argv[0]);
851
1086
}
852
1087
853
1088
/* Cleanup things */
854
if (sb)
1089
if (sb != NULL)
855
1090
avahi_s_service_browser_free(sb);
856
1091
857
if (mc.server)
1092
if (mc.server != NULL)
858
1093
avahi_server_free(mc.server);
859
860
if (simple_poll)
861
avahi_simple_poll_free(simple_poll);
862
free(certfile);
863
free(certkey);
864
865
return returncode;
1094
1095
if (mc.simple_poll != NULL)
1096
avahi_simple_poll_free(mc.simple_poll);
1097
1098
if (gnutls_initalized){
1099
gnutls_certificate_free_credentials(mc.cred);
1100
gnutls_global_deinit ();
1101
}
1102
1103
if(pgpme_initalized){
1104
gpgme_release(mc.ctx);
1105
}
1106
1107
/* Removes the temp directory used by GPGME */
1108
if(tempdir[0] != '\0'){
1109
DIR *d;
1110
struct dirent *direntry;
1111
d = opendir(tempdir);
1112
if(d == NULL){
1113
perror("opendir");
1114
} else {
1115
while(true){
1116
direntry = readdir(d);
1117
if(direntry == NULL){
1118
break;
1119
}
1120
if (direntry->d_type == DT_REG){
1121
char *fullname = NULL;
1122
ret = asprintf(&fullname, "%s/%s", tempdir,
1123
direntry->d_name);
1124
if(ret < 0){
1125
perror("asprintf");
1126
continue;
1127
}
1128
ret = unlink(fullname);
1129
if(ret == -1){
1130
fprintf(stderr, "unlink(\"%s\"): %s",
1131
fullname, strerror(errno));
1132
}
1133
free(fullname);
1134
}
1135
}
1136
}
1137
ret = rmdir(tempdir);
1138
if(ret == -1){
1139
perror("rmdir");
1140
}
1141
}
1142
1143
return exitcode;
866
1144
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0