269
116
/* Create new empty GPGME data buffer for the plaintext */
270
117
rc = gpgme_data_new(&dh_plain);
271
if(rc != GPG_ERR_NO_ERROR){
118
if (rc != GPG_ERR_NO_ERROR){
272
119
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
273
120
gpgme_strsource(rc), gpgme_strerror(rc));
274
gpgme_data_release(dh_crypto);
278
/* Decrypt data from the cryptotext data buffer to the plaintext
280
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
281
if(rc != GPG_ERR_NO_ERROR){
124
/* Create new GPGME "context" */
125
rc = gpgme_new(&ctx);
126
if (rc != GPG_ERR_NO_ERROR){
127
fprintf(stderr, "bad gpgme_new: %s: %s\n",
128
gpgme_strsource(rc), gpgme_strerror(rc));
132
/* Decrypt data from the FILE pointer to the plaintext data buffer */
133
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
134
if (rc != GPG_ERR_NO_ERROR){
282
135
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
283
136
gpgme_strsource(rc), gpgme_strerror(rc));
284
plaintext_length = -1;
286
gpgme_decrypt_result_t result;
287
result = gpgme_op_decrypt_result(mc->ctx);
289
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
291
fprintf(stderr, "Unsupported algorithm: %s\n",
292
result->unsupported_algorithm);
293
fprintf(stderr, "Wrong key usage: %u\n",
294
result->wrong_key_usage);
295
if(result->file_name != NULL){
296
fprintf(stderr, "File name: %s\n", result->file_name);
298
gpgme_recipient_t recipient;
299
recipient = result->recipients;
301
while(recipient != NULL){
302
fprintf(stderr, "Public key algorithm: %s\n",
303
gpgme_pubkey_algo_name(recipient->pubkey_algo));
304
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
305
fprintf(stderr, "Secret key available: %s\n",
306
recipient->status == GPG_ERR_NO_SECKEY
308
recipient = recipient->next;
141
fprintf(stderr, "decryption of gpg packet succeeded\n");
145
gpgme_decrypt_result_t result;
146
result = gpgme_op_decrypt_result(ctx);
148
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
150
fprintf(stderr, "Unsupported algorithm: %s\n", result->unsupported_algorithm);
151
fprintf(stderr, "Wrong key usage: %d\n", result->wrong_key_usage);
152
if(result->file_name != NULL){
153
fprintf(stderr, "File name: %s\n", result->file_name);
155
gpgme_recipient_t recipient;
156
recipient = result->recipients;
158
while(recipient != NULL){
159
fprintf(stderr, "Public key algorithm: %s\n",
160
gpgme_pubkey_algo_name(recipient->pubkey_algo));
161
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
162
fprintf(stderr, "Secret key available: %s\n",
163
recipient->status == GPG_ERR_NO_SECKEY ? "No" : "Yes");
164
recipient = recipient->next;
317
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
170
/* Delete the GPGME FILE pointer cryptotext data buffer */
171
gpgme_data_release(dh_crypto);
320
173
/* Seek back to the beginning of the GPGME plaintext data buffer */
321
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
322
perror("gpgme_data_seek");
323
plaintext_length = -1;
174
gpgme_data_seek(dh_plain, 0, SEEK_SET);
329
plaintext_capacity = adjustbuffer(plaintext,
330
(size_t)plaintext_length,
332
if(plaintext_capacity == 0){
333
perror("adjustbuffer");
334
plaintext_length = -1;
178
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
179
*new_packet = realloc(*new_packet, new_packet_capacity + BUFFER_SIZE);
180
if (*new_packet == NULL){
184
new_packet_capacity += BUFFER_SIZE;
338
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
187
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length, BUFFER_SIZE);
340
188
/* Print the data, if any */
190
/* If password is empty, then a incorrect error will be printed */
346
194
perror("gpgme_data_read");
347
plaintext_length = -1;
350
plaintext_length += ret;
197
new_packet_length += ret;
354
fprintf(stderr, "Decrypted password is: ");
355
for(ssize_t i = 0; i < plaintext_length; i++){
356
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
358
fprintf(stderr, "\n");
201
fprintf(stderr, "decrypted password is: %s\n", *new_packet);
363
/* Delete the GPGME cryptotext data buffer */
364
gpgme_data_release(dh_crypto);
366
/* Delete the GPGME plaintext data buffer */
204
/* Delete the GPGME plaintext data buffer */
367
205
gpgme_data_release(dh_plain);
368
return plaintext_length;
206
return new_packet_length;
371
static const char * safer_gnutls_strerror(int value){
372
const char *ret = gnutls_strerror(value); /* Spurious warning from
373
-Wunreachable-code */
209
static const char * safer_gnutls_strerror (int value) {
210
const char *ret = gnutls_strerror (value);
375
212
ret = "(unknown)";
379
/* GnuTLS log function callback */
380
static void debuggnutls(__attribute__((unused)) int level,
382
fprintf(stderr, "GnuTLS: %s", string);
216
void debuggnutls(int level, const char* string){
217
fprintf(stderr, "%s", string);
385
static int init_gnutls_global(mandos_context *mc,
386
const char *pubkeyfilename,
387
const char *seckeyfilename){
220
int initgnutls(encrypted_session *es){
391
fprintf(stderr, "Initializing GnuTLS\n");
225
fprintf(stderr, "Initializing gnutls\n");
394
ret = gnutls_global_init();
395
if(ret != GNUTLS_E_SUCCESS){
396
fprintf(stderr, "GnuTLS global_init: %s\n",
397
safer_gnutls_strerror(ret));
229
if ((ret = gnutls_global_init ())
230
!= GNUTLS_E_SUCCESS) {
231
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
402
/* "Use a log level over 10 to enable all debugging options."
405
236
gnutls_global_set_log_level(11);
406
237
gnutls_global_set_log_function(debuggnutls);
409
/* OpenPGP credentials */
410
gnutls_certificate_allocate_credentials(&mc->cred);
411
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
416
safer_gnutls_strerror(ret));
417
gnutls_global_deinit();
241
/* openpgp credentials */
242
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
243
!= GNUTLS_E_SUCCESS) {
244
fprintf (stderr, "memory error: %s\n", safer_gnutls_strerror(ret));
422
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
423
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
249
fprintf(stderr, "Attempting to use openpgp certificate %s"
250
" and keyfile %s as gnutls credentials\n", CERTFILE, KEYFILE);
427
253
ret = gnutls_certificate_set_openpgp_key_file
428
(mc->cred, pubkeyfilename, seckeyfilename,
429
GNUTLS_OPENPGP_FMT_BASE64);
430
if(ret != GNUTLS_E_SUCCESS){
432
"Error[%d] while reading the OpenPGP key pair ('%s',"
433
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
434
fprintf(stderr, "The GnuTLS error is: %s\n",
435
safer_gnutls_strerror(ret));
439
/* GnuTLS server initialization */
440
ret = gnutls_dh_params_init(&mc->dh_params);
441
if(ret != GNUTLS_E_SUCCESS){
442
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
443
" %s\n", safer_gnutls_strerror(ret));
446
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
447
if(ret != GNUTLS_E_SUCCESS){
448
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
449
safer_gnutls_strerror(ret));
453
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
459
gnutls_certificate_free_credentials(mc->cred);
460
gnutls_global_deinit();
461
gnutls_dh_params_deinit(mc->dh_params);
465
static int init_gnutls_session(mandos_context *mc,
466
gnutls_session_t *session){
468
/* GnuTLS session creation */
469
ret = gnutls_init(session, GNUTLS_SERVER);
470
if(ret != GNUTLS_E_SUCCESS){
471
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
472
safer_gnutls_strerror(ret));
477
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
478
if(ret != GNUTLS_E_SUCCESS){
479
fprintf(stderr, "Syntax error at: %s\n", err);
480
fprintf(stderr, "GnuTLS error: %s\n",
481
safer_gnutls_strerror(ret));
482
gnutls_deinit(*session);
487
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
489
if(ret != GNUTLS_E_SUCCESS){
490
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
491
safer_gnutls_strerror(ret));
492
gnutls_deinit(*session);
254
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
255
if (ret != GNUTLS_E_SUCCESS) {
257
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s', '%s')\n",
258
ret, CERTFILE, KEYFILE);
259
fprintf(stdout, "The Error is: %s\n",
260
safer_gnutls_strerror(ret));
264
//Gnutls server initialization
265
if ((ret = gnutls_dh_params_init (&es->dh_params))
266
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "Error in dh parameter initialization: %s\n",
268
safer_gnutls_strerror(ret));
272
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
273
!= GNUTLS_E_SUCCESS) {
274
fprintf (stderr, "Error in prime generation: %s\n",
275
safer_gnutls_strerror(ret));
279
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
281
// Gnutls session creation
282
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
283
!= GNUTLS_E_SUCCESS){
284
fprintf(stderr, "Error in gnutls session initialization: %s\n",
285
safer_gnutls_strerror(ret));
288
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
289
!= GNUTLS_E_SUCCESS) {
290
fprintf(stderr, "Syntax error at: %s\n", err);
291
fprintf(stderr, "Gnutls error: %s\n",
292
safer_gnutls_strerror(ret));
296
if ((ret = gnutls_credentials_set
297
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
298
!= GNUTLS_E_SUCCESS) {
299
fprintf(stderr, "Error setting a credentials set: %s\n",
300
safer_gnutls_strerror(ret));
496
304
/* ignore client certificate if any. */
497
gnutls_certificate_server_set_request(*session,
305
gnutls_certificate_server_set_request (es->session, GNUTLS_CERT_IGNORE);
500
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
307
gnutls_dh_set_prime_bits (es->session, DH_BITS);
505
/* Avahi log function callback */
506
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
507
__attribute__((unused)) const char *txt){}
312
void empty_log(AvahiLogLevel level, const char *txt){}
509
/* Called when a Mandos server is found */
510
static int start_mandos_communication(const char *ip, uint16_t port,
511
AvahiIfIndex if_index,
314
int start_mandos_communication(char *ip, uint16_t port){
515
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
316
struct sockaddr_in6 to;
317
encrypted_session es;
516
318
char *buffer = NULL;
517
319
char *decrypted_buffer;
518
320
size_t buffer_length = 0;
519
321
size_t buffer_capacity = 0;
520
322
ssize_t decrypted_buffer_size;
523
char interface[IF_NAMESIZE];
524
gnutls_session_t session;
526
ret = init_gnutls_session(mc, &session);
324
const char interface[] = "eth0";
532
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
327
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
536
330
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
538
332
perror("socket");
543
if(if_indextoname((unsigned int)if_index, interface) == NULL){
544
perror("if_indextoname");
547
337
fprintf(stderr, "Binding to interface %s\n", interface);
340
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
342
perror("setsockopt bindtodevice");
550
memset(&to, 0, sizeof(to));
551
to.in6.sin6_family = AF_INET6;
552
/* It would be nice to have a way to detect if we were passed an
553
IPv4 address here. Now we assume an IPv6 address. */
554
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
346
memset(&to,0,sizeof(to));
347
to.sin6_family = AF_INET6;
348
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
556
350
perror("inet_pton");
560
354
fprintf(stderr, "Bad address: %s\n", ip);
563
to.in6.sin6_port = htons(port); /* Spurious warnings from
565
-Wunreachable-code */
567
to.in6.sin6_scope_id = (uint32_t)if_index;
357
to.sin6_port = htons(port);
358
to.sin6_scope_id = if_nametoindex(interface);
570
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
572
char addrstr[INET6_ADDRSTRLEN] = "";
573
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
574
sizeof(addrstr)) == NULL){
577
if(strcmp(addrstr, ip) != 0){
578
fprintf(stderr, "Canonical address form: %s\n", addrstr);
361
fprintf(stderr, "Connection to: %s\n", ip);
583
ret = connect(tcp_sd, &to.in, sizeof(to));
364
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
585
366
perror("connect");
589
const char *out = mandos_protocol_version;
370
ret = initgnutls (&es);
377
gnutls_transport_set_ptr (es.session, (gnutls_transport_ptr_t) tcp_sd);
380
fprintf(stderr, "Establishing tls session with %s\n", ip);
384
ret = gnutls_handshake (es.session);
386
if (ret != GNUTLS_E_SUCCESS){
387
fprintf(stderr, "\n*** Handshake failed ***\n");
393
//Retrieve gpg packet that contains the wanted password
396
fprintf(stderr, "Retrieving pgp encrypted password from %s\n", ip);
592
size_t out_size = strlen(out);
593
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
594
out_size - written));
600
written += (size_t)ret;
601
if(written < out_size){
604
if(out == mandos_protocol_version){
400
if (buffer_length + BUFFER_SIZE > buffer_capacity){
401
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
614
fprintf(stderr, "Establishing TLS session with %s\n", ip);
617
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
620
ret = gnutls_handshake(session);
621
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
623
if(ret != GNUTLS_E_SUCCESS){
625
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
632
/* Read OpenPGP packet that contains the wanted password */
635
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
640
buffer_capacity = adjustbuffer(&buffer, buffer_length,
642
if(buffer_capacity == 0){
643
perror("adjustbuffer");
406
buffer_capacity += BUFFER_SIZE;
648
sret = gnutls_record_recv(session, buffer+buffer_length,
409
ret = gnutls_record_recv
410
(es.session, buffer+buffer_length, BUFFER_SIZE);
655
416
case GNUTLS_E_INTERRUPTED:
656
417
case GNUTLS_E_AGAIN:
658
419
case GNUTLS_E_REHANDSHAKE:
660
ret = gnutls_handshake(session);
661
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
663
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
420
ret = gnutls_handshake (es.session);
422
fprintf(stderr, "\n*** Handshake failed ***\n");
670
fprintf(stderr, "Unknown error while reading data from"
671
" encrypted session with Mandos server\n");
429
fprintf(stderr, "Unknown error while reading data from encrypted session with mandos server\n");
673
gnutls_bye(session, GNUTLS_SHUT_RDWR);
431
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
677
buffer_length += (size_t) sret;
435
buffer_length += ret;
682
fprintf(stderr, "Closing TLS session\n");
685
gnutls_bye(session, GNUTLS_SHUT_RDWR);
687
if(buffer_length > 0){
688
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
691
if(decrypted_buffer_size >= 0){
693
while(written < (size_t) decrypted_buffer_size){
694
ret = (int)fwrite(decrypted_buffer + written, 1,
695
(size_t)decrypted_buffer_size - written,
697
if(ret == 0 and ferror(stdout)){
699
fprintf(stderr, "Error writing encrypted data: %s\n",
705
written += (size_t)ret;
439
if (buffer_length > 0){
440
if ((decrypted_buffer_size = gpg_packet_decrypt(buffer, buffer_length, &decrypted_buffer, CERT_ROOT)) >= 0){
441
fwrite (decrypted_buffer, 1, decrypted_buffer_size, stdout);
707
442
free(decrypted_buffer);
715
/* Shutdown procedure */
451
fprintf(stderr, "Closing tls session\n");
719
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
723
gnutls_deinit(session);
455
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
458
gnutls_deinit (es.session);
459
gnutls_certificate_free_credentials (es.cred);
460
gnutls_global_deinit ();
727
static void resolve_callback(AvahiSServiceResolver *r,
728
AvahiIfIndex interface,
729
AVAHI_GCC_UNUSED AvahiProtocol protocol,
730
AvahiResolverEvent event,
734
const char *host_name,
735
const AvahiAddress *address,
737
AVAHI_GCC_UNUSED AvahiStringList *txt,
738
AVAHI_GCC_UNUSED AvahiLookupResultFlags
741
mandos_context *mc = userdata;
744
/* Called whenever a service has been resolved successfully or
749
case AVAHI_RESOLVER_FAILURE:
750
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
751
" of type '%s' in domain '%s': %s\n", name, type, domain,
752
avahi_strerror(avahi_server_errno(mc->server)));
755
case AVAHI_RESOLVER_FOUND:
757
char ip[AVAHI_ADDRESS_STR_MAX];
758
avahi_address_snprint(ip, sizeof(ip), address);
760
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
761
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
762
ip, (intmax_t)interface, port);
764
int ret = start_mandos_communication(ip, port, interface, mc);
766
avahi_simple_poll_quit(mc->simple_poll);
770
avahi_s_service_resolver_free(r);
773
static void browse_callback(AvahiSServiceBrowser *b,
774
AvahiIfIndex interface,
775
AvahiProtocol protocol,
776
AvahiBrowserEvent event,
780
AVAHI_GCC_UNUSED AvahiLookupResultFlags
783
mandos_context *mc = userdata;
786
/* Called whenever a new services becomes available on the LAN or
787
is removed from the LAN */
791
case AVAHI_BROWSER_FAILURE:
793
fprintf(stderr, "(Avahi browser) %s\n",
794
avahi_strerror(avahi_server_errno(mc->server)));
795
avahi_simple_poll_quit(mc->simple_poll);
798
case AVAHI_BROWSER_NEW:
799
/* We ignore the returned Avahi resolver object. In the callback
800
function we free it. If the Avahi server is terminated before
801
the callback function is called the Avahi server will free the
804
if(!(avahi_s_service_resolver_new(mc->server, interface,
805
protocol, name, type, domain,
806
AVAHI_PROTO_INET6, 0,
807
resolve_callback, mc)))
808
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
809
name, avahi_strerror(avahi_server_errno(mc->server)));
812
case AVAHI_BROWSER_REMOVE:
815
case AVAHI_BROWSER_ALL_FOR_NOW:
816
case AVAHI_BROWSER_CACHE_EXHAUSTED:
818
fprintf(stderr, "No Mandos server found, still searching...\n");
824
int main(int argc, char *argv[]){
825
AvahiSServiceBrowser *sb = NULL;
830
int exitcode = EXIT_SUCCESS;
831
const char *interface = "eth0";
832
struct ifreq network;
836
char *connect_to = NULL;
837
char tempdir[] = "/tmp/mandosXXXXXX";
838
bool tempdir_created = false;
839
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
840
const char *seckey = PATHDIR "/" SECKEY;
841
const char *pubkey = PATHDIR "/" PUBKEY;
843
mandos_context mc = { .simple_poll = NULL, .server = NULL,
844
.dh_bits = 1024, .priority = "SECURE256"
845
":!CTYPE-X.509:+CTYPE-OPENPGP" };
846
bool gnutls_initialized = false;
847
bool gpgme_initialized = false;
851
struct argp_option options[] = {
852
{ .name = "debug", .key = 128,
853
.doc = "Debug mode", .group = 3 },
854
{ .name = "connect", .key = 'c',
855
.arg = "ADDRESS:PORT",
856
.doc = "Connect directly to a specific Mandos server",
858
{ .name = "interface", .key = 'i',
860
.doc = "Interface that will be used to search for Mandos"
863
{ .name = "seckey", .key = 's',
865
.doc = "OpenPGP secret key file base name",
867
{ .name = "pubkey", .key = 'p',
869
.doc = "OpenPGP public key file base name",
871
{ .name = "dh-bits", .key = 129,
873
.doc = "Bit length of the prime number used in the"
874
" Diffie-Hellman key exchange",
876
{ .name = "priority", .key = 130,
878
.doc = "GnuTLS priority string for the TLS handshake",
880
{ .name = "delay", .key = 131,
882
.doc = "Maximum delay to wait for interface startup",
887
error_t parse_opt(int key, char *arg,
888
struct argp_state *state){
890
case 128: /* --debug */
893
case 'c': /* --connect */
896
case 'i': /* --interface */
899
case 's': /* --seckey */
902
case 'p': /* --pubkey */
905
case 129: /* --dh-bits */
906
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
907
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
908
or arg[numchars] != '\0'){
909
fprintf(stderr, "Bad number of DH bits\n");
912
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
914
case 130: /* --priority */
917
case 131: /* --delay */
918
ret = sscanf(arg, "%lf%n", &delay, &numchars);
919
if(ret < 1 or arg[numchars] != '\0'){
920
fprintf(stderr, "Bad delay\n");
929
return ARGP_ERR_UNKNOWN;
934
struct argp argp = { .options = options, .parser = parse_opt,
936
.doc = "Mandos client -- Get and decrypt"
937
" passwords from a Mandos server" };
938
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
939
if(ret == ARGP_ERR_UNKNOWN){
940
fprintf(stderr, "Unknown error while parsing arguments\n");
941
exitcode = EXIT_FAILURE;
946
/* If the interface is down, bring it up */
949
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
950
messages to mess up the prompt */
951
ret = klogctl(8, NULL, 5);
957
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
960
exitcode = EXIT_FAILURE;
962
ret = klogctl(7, NULL, 0);
969
strcpy(network.ifr_name, interface);
970
ret = ioctl(sd, SIOCGIFFLAGS, &network);
972
perror("ioctl SIOCGIFFLAGS");
974
ret = klogctl(7, NULL, 0);
979
exitcode = EXIT_FAILURE;
982
if((network.ifr_flags & IFF_UP) == 0){
983
network.ifr_flags |= IFF_UP;
984
ret = ioctl(sd, SIOCSIFFLAGS, &network);
986
perror("ioctl SIOCSIFFLAGS");
987
exitcode = EXIT_FAILURE;
989
ret = klogctl(7, NULL, 0);
997
/* sleep checking until interface is running */
998
for(int i=0; i < delay * 4; i++){
999
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1001
perror("ioctl SIOCGIFFLAGS");
1002
} else if(network.ifr_flags & IFF_RUNNING){
1005
struct timespec sleeptime = { .tv_nsec = 250000000 };
1006
ret = nanosleep(&sleeptime, NULL);
1007
if(ret == -1 and errno != EINTR){
1008
perror("nanosleep");
1011
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1016
/* Restores kernel loglevel to default */
1017
ret = klogctl(7, NULL, 0);
1037
ret = init_gnutls_global(&mc, pubkey, seckey);
1039
fprintf(stderr, "init_gnutls_global failed\n");
1040
exitcode = EXIT_FAILURE;
1043
gnutls_initialized = true;
1046
if(mkdtemp(tempdir) == NULL){
1050
tempdir_created = true;
1052
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
1053
fprintf(stderr, "init_gpgme failed\n");
1054
exitcode = EXIT_FAILURE;
1057
gpgme_initialized = true;
1060
if_index = (AvahiIfIndex) if_nametoindex(interface);
1062
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1063
exitcode = EXIT_FAILURE;
1067
if(connect_to != NULL){
1068
/* Connect directly, do not use Zeroconf */
1069
/* (Mainly meant for debugging) */
1070
char *address = strrchr(connect_to, ':');
1071
if(address == NULL){
1072
fprintf(stderr, "No colon in address\n");
1073
exitcode = EXIT_FAILURE;
1077
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1078
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1079
or address[numchars+1] != '\0'){
1080
fprintf(stderr, "Bad port number\n");
1081
exitcode = EXIT_FAILURE;
1084
port = (uint16_t)tmpmax;
1086
address = connect_to;
1087
ret = start_mandos_communication(address, port, if_index, &mc);
1089
exitcode = EXIT_FAILURE;
1091
exitcode = EXIT_SUCCESS;
1097
avahi_set_log_function(empty_log);
1100
/* Initialize the pseudo-RNG for Avahi */
1101
srand((unsigned int) time(NULL));
1103
/* Allocate main Avahi loop object */
1104
mc.simple_poll = avahi_simple_poll_new();
1105
if(mc.simple_poll == NULL){
1106
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1107
exitcode = EXIT_FAILURE;
464
static AvahiSimplePoll *simple_poll = NULL;
465
static AvahiServer *server = NULL;
467
static void resolve_callback(
468
AvahiSServiceResolver *r,
469
AVAHI_GCC_UNUSED AvahiIfIndex interface,
470
AVAHI_GCC_UNUSED AvahiProtocol protocol,
471
AvahiResolverEvent event,
475
const char *host_name,
476
const AvahiAddress *address,
478
AvahiStringList *txt,
479
AvahiLookupResultFlags flags,
480
AVAHI_GCC_UNUSED void* userdata) {
484
/* Called whenever a service has been resolved successfully or timed out */
487
case AVAHI_RESOLVER_FAILURE:
488
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of type '%s' in domain '%s': %s\n", name, type, domain, avahi_strerror(avahi_server_errno(server)));
491
case AVAHI_RESOLVER_FOUND: {
492
char ip[AVAHI_ADDRESS_STR_MAX];
493
avahi_address_snprint(ip, sizeof(ip), address);
495
fprintf(stderr, "Mandos server found at %s on port %d\n", ip, port);
497
int ret = start_mandos_communication(ip, port);
505
avahi_s_service_resolver_free(r);
508
static void browse_callback(
509
AvahiSServiceBrowser *b,
510
AvahiIfIndex interface,
511
AvahiProtocol protocol,
512
AvahiBrowserEvent event,
516
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
519
AvahiServer *s = userdata;
522
/* Called whenever a new services becomes available on the LAN or is removed from the LAN */
526
case AVAHI_BROWSER_FAILURE:
528
fprintf(stderr, "(Browser) %s\n", avahi_strerror(avahi_server_errno(server)));
529
avahi_simple_poll_quit(simple_poll);
532
case AVAHI_BROWSER_NEW:
533
/* We ignore the returned resolver object. In the callback
534
function we free it. If the server is terminated before
535
the callback function is called the server will free
536
the resolver for us. */
538
if (!(avahi_s_service_resolver_new(s, interface, protocol, name, type, domain, AVAHI_PROTO_INET6, 0, resolve_callback, s)))
539
fprintf(stderr, "Failed to resolve service '%s': %s\n", name, avahi_strerror(avahi_server_errno(s)));
543
case AVAHI_BROWSER_REMOVE:
546
case AVAHI_BROWSER_ALL_FOR_NOW:
547
case AVAHI_BROWSER_CACHE_EXHAUSTED:
552
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1112
553
AvahiServerConfig config;
1113
/* Do not publish any local Zeroconf records */
554
AvahiSServiceBrowser *sb = NULL;
555
const char db[] = "--debug";
558
int returncode = EXIT_SUCCESS;
559
char *basename = rindex(argv[0], '/');
560
if(basename == NULL){
566
char *program_name = malloc(strlen(basename) + sizeof(db));
568
if (program_name == NULL){
573
program_name[0] = '\0';
575
for (int i = 1; i < argc; i++){
576
if (not strncmp(argv[i], db, 5)){
577
strcat(strcat(strcat(program_name, db ), "="), basename);
578
if(not strcmp(argv[i], db) or not strcmp(argv[i], program_name)){
586
avahi_set_log_function(empty_log);
589
/* Initialize the psuedo-RNG */
592
/* Allocate main loop object */
593
if (!(simple_poll = avahi_simple_poll_new())) {
594
fprintf(stderr, "Failed to create simple poll object.\n");
599
/* Do not publish any local records */
1114
600
avahi_server_config_init(&config);
1115
601
config.publish_hinfo = 0;
1116
602
config.publish_addresses = 0;
1117
603
config.publish_workstation = 0;
1118
604
config.publish_domain = 0;
1120
606
/* Allocate a new server */
1121
mc.server = avahi_server_new(avahi_simple_poll_get
1122
(mc.simple_poll), &config, NULL,
1125
/* Free the Avahi configuration data */
607
server = avahi_server_new(avahi_simple_poll_get(simple_poll), &config, NULL, NULL, &error);
609
/* Free the configuration data */
1126
610
avahi_server_config_free(&config);
1129
/* Check if creating the Avahi server object succeeded */
1130
if(mc.server == NULL){
1131
fprintf(stderr, "Failed to create Avahi server: %s\n",
1132
avahi_strerror(error));
1133
exitcode = EXIT_FAILURE;
1137
/* Create the Avahi service browser */
1138
sb = avahi_s_service_browser_new(mc.server, if_index,
1139
AVAHI_PROTO_INET6, "_mandos._tcp",
1140
NULL, 0, browse_callback, &mc);
1142
fprintf(stderr, "Failed to create service browser: %s\n",
1143
avahi_strerror(avahi_server_errno(mc.server)));
1144
exitcode = EXIT_FAILURE;
1148
/* Run the main loop */
1151
fprintf(stderr, "Starting Avahi loop search\n");
1154
avahi_simple_poll_loop(mc.simple_poll);
1159
fprintf(stderr, "%s exiting\n", argv[0]);
1162
/* Cleanup things */
1164
avahi_s_service_browser_free(sb);
1166
if(mc.server != NULL)
1167
avahi_server_free(mc.server);
1169
if(mc.simple_poll != NULL)
1170
avahi_simple_poll_free(mc.simple_poll);
1172
if(gnutls_initialized){
1173
gnutls_certificate_free_credentials(mc.cred);
1174
gnutls_global_deinit();
1175
gnutls_dh_params_deinit(mc.dh_params);
1178
if(gpgme_initialized){
1179
gpgme_release(mc.ctx);
1182
/* Removes the temp directory used by GPGME */
1183
if(tempdir_created){
1185
struct dirent *direntry;
1186
d = opendir(tempdir);
1188
if(errno != ENOENT){
1193
direntry = readdir(d);
1194
if(direntry == NULL){
1197
/* Skip "." and ".." */
1198
if(direntry->d_name[0] == '.'
1199
and (direntry->d_name[1] == '\0'
1200
or (direntry->d_name[1] == '.'
1201
and direntry->d_name[2] == '\0'))){
1204
char *fullname = NULL;
1205
ret = asprintf(&fullname, "%s/%s", tempdir,
1211
ret = remove(fullname);
1213
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1220
ret = rmdir(tempdir);
1221
if(ret == -1 and errno != ENOENT){
612
/* Check if creating the server object succeeded */
614
fprintf(stderr, "Failed to create server: %s\n", avahi_strerror(error));
615
returncode = EXIT_FAILURE;
619
/* Create the service browser */
620
if (!(sb = avahi_s_service_browser_new(server, if_nametoindex("eth0"), AVAHI_PROTO_INET6, "_mandos._tcp", NULL, 0, browse_callback, server))) {
621
fprintf(stderr, "Failed to create service browser: %s\n", avahi_strerror(avahi_server_errno(server)));
622
returncode = EXIT_FAILURE;
626
/* Run the main loop */
629
fprintf(stderr, "Starting avahi loop search\n");
632
avahi_simple_poll_loop(simple_poll);
637
fprintf(stderr, "%s exiting\n", argv[0]);
642
avahi_s_service_browser_free(sb);
645
avahi_server_free(server);
648
avahi_simple_poll_free(simple_poll);