To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 21
- compare with another revision
- download diff
- download tarball
- view history from revision 21
- Committer: Teddy Hogeborn
- Date: 2008-07-21 15:34:44 UTC
- Revision ID: teddy@fukt.bsnet.se-20080721153444-lugbjkj1oq65ugq3
* Makefile (CFLAGS): Changed to use $(WARN), $(DEBUG), $(COVERAGE) and
$(LANGUAGE).
(WARN, DEBUG, COVERAGE, LANGUAGE): New.
(LDFLAGS): New; use $(COVERAGE)
* plugbasedclient.c: Added copyright header.
(process.buffer_size, process.buffer_length): Changed to "size_t".
(main): Cast arguments to malloc and realloc. Detect read errors
from processes.
* mandosclient.c: Added copyright header.
(interface): Moved to inside "main".
(gpg_packet_decrypt): Renamed to "pgp_packet_decrypt"; all callers
changed. Changed "new_packet_capacity" and
"new_packet_length" to be ssize_t. Cast
arguments to realloc.
(debuggnutls): Attribute "level" argument as unused.
(empty_log): Attribute "level" and "txt" arguments as unused.
(start_mandos_communication): New argument "if_index". Bug fix:
check ret, no tcp_sd, for errors from
setsockopt. Use "if_index" directly
instead of looking up the index. Loop
around fwrite until all data is written.
(resolve_callback): Attribute "txt", and "flags" as usused. Added
default case to switch. Also show server host
name. Call start_mandos_communication with
"interface".
(browse_callback): Added default case to switch.
(main): Variable "interface" moved here. Cast "srand" argument.
Bug fix: Call avahi_s_service_browser_new with index of
"interface", not "eth0".
* passprompt.c: Added copyright header.
(termination_handler): Attribute "signum" argument as unused.
$(LANGUAGE).
(WARN, DEBUG, COVERAGE, LANGUAGE): New.
(LDFLAGS): New; use $(COVERAGE)
* plugbasedclient.c: Added copyright header.
(process.buffer_size, process.buffer_length): Changed to "size_t".
(main): Cast arguments to malloc and realloc. Detect read errors
from processes.
* mandosclient.c: Added copyright header.
(interface): Moved to inside "main".
(gpg_packet_decrypt): Renamed to "pgp_packet_decrypt"; all callers
changed. Changed "new_packet_capacity" and
"new_packet_length" to be ssize_t. Cast
arguments to realloc.
(debuggnutls): Attribute "level" argument as unused.
(empty_log): Attribute "level" and "txt" arguments as unused.
(start_mandos_communication): New argument "if_index". Bug fix:
check ret, no tcp_sd, for errors from
setsockopt. Use "if_index" directly
instead of looking up the index. Loop
around fwrite until all data is written.
(resolve_callback): Attribute "txt", and "flags" as usused. Added
default case to switch. Also show server host
name. Call start_mandos_communication with
"interface".
(browse_callback): Added default case to switch.
(main): Variable "interface" moved here. Cast "srand" argument.
Bug fix: Call avahi_s_service_browser_new with index of
"interface", not "eth0".
* passprompt.c: Added copyright header.
(termination_handler): Attribute "signum" argument as unused.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
8
8
* includes the following functions: "resolve_callback",
9
9
* "browse_callback", and parts of "main".
10
10
*
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
11
* Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
12
* Påhlsson.
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
26
25
* along with this program. If not, see
27
26
* <http://www.gnu.org/licenses/>.
28
27
*
29
* Contact the authors at <mandos@fukt.bsnet.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
30
30
*/
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
32
#define _FORTIFY_SOURCE 2
33
33
34
#define _LARGEFILE_SOURCE
34
35
#define _FILE_OFFSET_BITS 64
35
36
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
40
remove() */
41
#include <stdint.h> /* uint16_t, uint32_t */
42
#include <stddef.h> /* NULL, size_t, ssize_t */
43
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
44
srand() */
45
#include <stdbool.h> /* bool, false, true */
46
#include <string.h> /* memset(), strcmp(), strlen(),
47
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, uid_t, gid_t, open(),
52
opendir(), DIR */
53
#include <sys/stat.h> /* open() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
inet_pton(), connect() */
56
#include <fcntl.h> /* open() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir()
58
*/
59
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
60
#include <assert.h> /* assert() */
61
#include <errno.h> /* perror(), errno */
62
#include <time.h> /* nanosleep(), time() */
63
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
64
SIOCSIFFLAGS, if_indextoname(),
65
if_nametoindex(), IF_NAMESIZE */
66
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
68
*/
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
getuid(), getgid(), setuid(),
71
setgid() */
72
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, or, and */
74
#include <argp.h> /* struct argp_option, error_t, struct
75
argp_state, struct argp,
76
argp_parse(), ARGP_KEY_ARG,
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
#include <signal.h> /* sigemptyset(), sigaddset(),
79
sigaction(), SIGTERM, sigaction,
80
sig_atomic_t */
81
82
#ifdef __linux__
83
#include <sys/klog.h> /* klogctl() */
84
#endif /* __linux__ */
85
86
/* Avahi */
87
/* All Avahi types, constants and functions
88
Avahi*, avahi_*,
89
AVAHI_* */
37
#include <stdio.h>
38
#include <assert.h>
39
#include <stdlib.h>
40
#include <time.h>
41
#include <net/if.h> /* if_nametoindex */
42
90
43
#include <avahi-core/core.h>
91
44
#include <avahi-core/lookup.h>
92
45
#include <avahi-core/log.h>
94
47
#include <avahi-common/malloc.h>
95
48
#include <avahi-common/error.h>
96
49
97
/* GnuTLS */
98
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
99
functions:
100
gnutls_*
101
init_gnutls_session(),
102
GNUTLS_* */
103
#include <gnutls/openpgp.h>
104
/* gnutls_certificate_set_openpgp_key_file(),
105
GNUTLS_OPENPGP_FMT_BASE64 */
106
107
/* GPGME */
108
#include <gpgme.h> /* All GPGME types, constants and
109
functions:
110
gpgme_*
111
GPGME_PROTOCOL_OpenPGP,
112
GPG_ERR_NO_* */
113
50
//mandos client part
51
#include <sys/types.h> /* socket(), setsockopt(),
52
inet_pton() */
53
#include <sys/socket.h> /* socket(), setsockopt(),
54
struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
58
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
65
66
// gpgme
67
#include <errno.h> /* perror() */
68
#include <gpgme.h>
69
70
// getopt long
71
#include <getopt.h>
72
73
#ifndef CERT_ROOT
74
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
75
#endif
76
#define CERTFILE CERT_ROOT "openpgp-client.txt"
77
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
114
78
#define BUFFER_SIZE 256
115
116
#define PATHDIR "/conf/conf.d/mandos"
117
#define SECKEY "seckey.txt"
118
#define PUBKEY "pubkey.txt"
79
#define DH_BITS 1024
119
80
120
81
bool debug = false;
121
static const char mandos_protocol_version[] = "1";
122
const char *argp_program_version = "mandos-client " VERSION;
123
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
124
82
125
/* Used for passing in values through the Avahi callback functions */
126
83
typedef struct {
127
AvahiSimplePoll *simple_poll;
128
AvahiServer *server;
84
gnutls_session_t session;
129
85
gnutls_certificate_credentials_t cred;
130
unsigned int dh_bits;
131
86
gnutls_dh_params_t dh_params;
132
const char *priority;
87
} encrypted_session;
88
89
90
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
91
char **new_packet, const char *homedir){
92
gpgme_data_t dh_crypto, dh_plain;
133
93
gpgme_ctx_t ctx;
134
} mandos_context;
135
136
/* global context so signal handler can reach it*/
137
mandos_context mc = { .simple_poll = NULL, .server = NULL,
138
.dh_bits = 1024, .priority = "SECURE256"
139
":!CTYPE-X.509:+CTYPE-OPENPGP" };
140
141
/*
142
* Make additional room in "buffer" for at least BUFFER_SIZE more
143
* bytes. "buffer_capacity" is how much is currently allocated,
144
* "buffer_length" is how much is already used.
145
*/
146
size_t incbuffer(char **buffer, size_t buffer_length,
147
size_t buffer_capacity){
148
if(buffer_length + BUFFER_SIZE > buffer_capacity){
149
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
150
if(buffer == NULL){
151
return 0;
152
}
153
buffer_capacity += BUFFER_SIZE;
154
}
155
return buffer_capacity;
156
}
157
158
/*
159
* Initialize GPGME.
160
*/
161
static bool init_gpgme(const char *seckey,
162
const char *pubkey, const char *tempdir){
163
int ret;
164
94
gpgme_error_t rc;
95
ssize_t ret;
96
ssize_t new_packet_capacity = 0;
97
ssize_t new_packet_length = 0;
165
98
gpgme_engine_info_t engine_info;
166
167
168
/*
169
* Helper function to insert pub and seckey to the engine keyring.
170
*/
171
bool import_key(const char *filename){
172
int fd;
173
gpgme_data_t pgp_data;
174
175
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
176
if(fd == -1){
177
perror("open");
178
return false;
179
}
180
181
rc = gpgme_data_new_from_fd(&pgp_data, fd);
182
if(rc != GPG_ERR_NO_ERROR){
183
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
184
gpgme_strsource(rc), gpgme_strerror(rc));
185
return false;
186
}
187
188
rc = gpgme_op_import(mc.ctx, pgp_data);
189
if(rc != GPG_ERR_NO_ERROR){
190
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
191
gpgme_strsource(rc), gpgme_strerror(rc));
192
return false;
193
}
194
195
ret = (int)TEMP_FAILURE_RETRY(close(fd));
196
if(ret == -1){
197
perror("close");
198
}
199
gpgme_data_release(pgp_data);
200
return true;
201
}
202
203
if(debug){
204
fprintf(stderr, "Initializing GPGME\n");
99
100
if (debug){
101
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
205
102
}
206
103
207
104
/* Init GPGME */
208
105
gpgme_check_version(NULL);
209
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
210
if(rc != GPG_ERR_NO_ERROR){
211
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
212
gpgme_strsource(rc), gpgme_strerror(rc));
213
return false;
214
}
106
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
215
107
216
/* Set GPGME home directory for the OpenPGP engine only */
217
rc = gpgme_get_engine_info(&engine_info);
218
if(rc != GPG_ERR_NO_ERROR){
108
/* Set GPGME home directory */
109
rc = gpgme_get_engine_info (&engine_info);
110
if (rc != GPG_ERR_NO_ERROR){
219
111
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
220
112
gpgme_strsource(rc), gpgme_strerror(rc));
221
return false;
113
return -1;
222
114
}
223
115
while(engine_info != NULL){
224
116
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
225
117
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
226
engine_info->file_name, tempdir);
118
engine_info->file_name, homedir);
227
119
break;
228
120
}
229
121
engine_info = engine_info->next;
230
122
}
231
123
if(engine_info == NULL){
232
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
233
return false;
234
}
235
236
/* Create new GPGME "context" */
237
rc = gpgme_new(&(mc.ctx));
238
if(rc != GPG_ERR_NO_ERROR){
239
fprintf(stderr, "bad gpgme_new: %s: %s\n",
240
gpgme_strsource(rc), gpgme_strerror(rc));
241
return false;
242
}
243
244
if(not import_key(pubkey) or not import_key(seckey)){
245
return false;
246
}
247
248
return true;
249
}
250
251
/*
252
* Decrypt OpenPGP data.
253
* Returns -1 on error
254
*/
255
static ssize_t pgp_packet_decrypt(const char *cryptotext,
256
size_t crypto_size,
257
char **plaintext){
258
gpgme_data_t dh_crypto, dh_plain;
259
gpgme_error_t rc;
260
ssize_t ret;
261
size_t plaintext_capacity = 0;
262
ssize_t plaintext_length = 0;
263
264
if(debug){
265
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
266
}
267
268
/* Create new GPGME data buffer from memory cryptotext */
269
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
270
0);
271
if(rc != GPG_ERR_NO_ERROR){
124
fprintf(stderr, "Could not set home dir to %s\n", homedir);
125
return -1;
126
}
127
128
/* Create new GPGME data buffer from packet buffer */
129
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
130
if (rc != GPG_ERR_NO_ERROR){
272
131
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
273
132
gpgme_strsource(rc), gpgme_strerror(rc));
274
133
return -1;
276
135
277
136
/* Create new empty GPGME data buffer for the plaintext */
278
137
rc = gpgme_data_new(&dh_plain);
279
if(rc != GPG_ERR_NO_ERROR){
138
if (rc != GPG_ERR_NO_ERROR){
280
139
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
281
140
gpgme_strsource(rc), gpgme_strerror(rc));
282
gpgme_data_release(dh_crypto);
283
return -1;
284
}
285
286
/* Decrypt data from the cryptotext data buffer to the plaintext
287
data buffer */
288
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
289
if(rc != GPG_ERR_NO_ERROR){
141
return -1;
142
}
143
144
/* Create new GPGME "context" */
145
rc = gpgme_new(&ctx);
146
if (rc != GPG_ERR_NO_ERROR){
147
fprintf(stderr, "bad gpgme_new: %s: %s\n",
148
gpgme_strsource(rc), gpgme_strerror(rc));
149
return -1;
150
}
151
152
/* Decrypt data from the FILE pointer to the plaintext data
153
buffer */
154
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
155
if (rc != GPG_ERR_NO_ERROR){
290
156
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
291
157
gpgme_strsource(rc), gpgme_strerror(rc));
292
plaintext_length = -1;
293
if(debug){
294
gpgme_decrypt_result_t result;
295
result = gpgme_op_decrypt_result(mc.ctx);
296
if(result == NULL){
297
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
298
} else {
299
fprintf(stderr, "Unsupported algorithm: %s\n",
300
result->unsupported_algorithm);
301
fprintf(stderr, "Wrong key usage: %u\n",
302
result->wrong_key_usage);
303
if(result->file_name != NULL){
304
fprintf(stderr, "File name: %s\n", result->file_name);
305
}
306
gpgme_recipient_t recipient;
307
recipient = result->recipients;
308
if(recipient){
309
while(recipient != NULL){
310
fprintf(stderr, "Public key algorithm: %s\n",
311
gpgme_pubkey_algo_name(recipient->pubkey_algo));
312
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
313
fprintf(stderr, "Secret key available: %s\n",
314
recipient->status == GPG_ERR_NO_SECKEY
315
? "No" : "Yes");
316
recipient = recipient->next;
317
}
158
return -1;
159
}
160
161
if(debug){
162
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
163
}
164
165
if (debug){
166
gpgme_decrypt_result_t result;
167
result = gpgme_op_decrypt_result(ctx);
168
if (result == NULL){
169
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
170
} else {
171
fprintf(stderr, "Unsupported algorithm: %s\n",
172
result->unsupported_algorithm);
173
fprintf(stderr, "Wrong key usage: %d\n",
174
result->wrong_key_usage);
175
if(result->file_name != NULL){
176
fprintf(stderr, "File name: %s\n", result->file_name);
177
}
178
gpgme_recipient_t recipient;
179
recipient = result->recipients;
180
if(recipient){
181
while(recipient != NULL){
182
fprintf(stderr, "Public key algorithm: %s\n",
183
gpgme_pubkey_algo_name(recipient->pubkey_algo));
184
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
185
fprintf(stderr, "Secret key available: %s\n",
186
recipient->status == GPG_ERR_NO_SECKEY
187
? "No" : "Yes");
188
recipient = recipient->next;
318
189
}
319
190
}
320
191
}
321
goto decrypt_end;
322
192
}
323
193
324
if(debug){
325
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
326
}
194
/* Delete the GPGME FILE pointer cryptotext data buffer */
195
gpgme_data_release(dh_crypto);
327
196
328
197
/* Seek back to the beginning of the GPGME plaintext data buffer */
329
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
330
perror("gpgme_data_seek");
331
plaintext_length = -1;
332
goto decrypt_end;
333
}
334
335
*plaintext = NULL;
198
gpgme_data_seek(dh_plain, 0, SEEK_SET);
199
200
*new_packet = 0;
336
201
while(true){
337
plaintext_capacity = incbuffer(plaintext,
338
(size_t)plaintext_length,
339
plaintext_capacity);
340
if(plaintext_capacity == 0){
341
perror("incbuffer");
342
plaintext_length = -1;
343
goto decrypt_end;
202
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
203
*new_packet = realloc(*new_packet,
204
(unsigned int)new_packet_capacity
205
+ BUFFER_SIZE);
206
if (*new_packet == NULL){
207
perror("realloc");
208
return -1;
209
}
210
new_packet_capacity += BUFFER_SIZE;
344
211
}
345
212
346
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
213
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
347
214
BUFFER_SIZE);
348
215
/* Print the data, if any */
349
if(ret == 0){
350
/* EOF */
216
if (ret == 0){
351
217
break;
352
218
}
353
219
if(ret < 0){
354
220
perror("gpgme_data_read");
355
plaintext_length = -1;
356
goto decrypt_end;
357
}
358
plaintext_length += ret;
359
}
360
361
if(debug){
362
fprintf(stderr, "Decrypted password is: ");
363
for(ssize_t i = 0; i < plaintext_length; i++){
364
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
365
}
366
fprintf(stderr, "\n");
367
}
368
369
decrypt_end:
370
371
/* Delete the GPGME cryptotext data buffer */
372
gpgme_data_release(dh_crypto);
221
return -1;
222
}
223
new_packet_length += ret;
224
}
225
226
/* FIXME: check characters before printing to screen so to not print
227
terminal control characters */
228
/* if(debug){ */
229
/* fprintf(stderr, "decrypted password is: "); */
230
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
231
/* fprintf(stderr, "\n"); */
232
/* } */
373
233
374
234
/* Delete the GPGME plaintext data buffer */
375
235
gpgme_data_release(dh_plain);
376
return plaintext_length;
236
return new_packet_length;
377
237
}
378
238
379
static const char * safer_gnutls_strerror(int value){
380
const char *ret = gnutls_strerror(value); /* Spurious warning from
381
-Wunreachable-code */
382
if(ret == NULL)
239
static const char * safer_gnutls_strerror (int value) {
240
const char *ret = gnutls_strerror (value);
241
if (ret == NULL)
383
242
ret = "(unknown)";
384
243
return ret;
385
244
}
386
245
387
/* GnuTLS log function callback */
388
static void debuggnutls(__attribute__((unused)) int level,
389
const char* string){
390
fprintf(stderr, "GnuTLS: %s", string);
246
void debuggnutls(__attribute__((unused)) int level,
247
const char* string){
248
fprintf(stderr, "%s", string);
391
249
}
392
250
393
static int init_gnutls_global(const char *pubkeyfilename,
394
const char *seckeyfilename){
251
int initgnutls(encrypted_session *es){
252
const char *err;
395
253
int ret;
396
254
397
255
if(debug){
398
256
fprintf(stderr, "Initializing GnuTLS\n");
399
257
}
400
258
401
ret = gnutls_global_init();
402
if(ret != GNUTLS_E_SUCCESS){
403
fprintf(stderr, "GnuTLS global_init: %s\n",
404
safer_gnutls_strerror(ret));
259
if ((ret = gnutls_global_init ())
260
!= GNUTLS_E_SUCCESS) {
261
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
405
262
return -1;
406
263
}
407
408
if(debug){
409
/* "Use a log level over 10 to enable all debugging options."
410
* - GnuTLS manual
411
*/
264
265
if (debug){
412
266
gnutls_global_set_log_level(11);
413
267
gnutls_global_set_log_function(debuggnutls);
414
268
}
415
269
416
/* OpenPGP credentials */
417
gnutls_certificate_allocate_credentials(&mc.cred);
418
if(ret != GNUTLS_E_SUCCESS){
419
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
420
from
421
-Wunreachable-code
422
*/
423
safer_gnutls_strerror(ret));
424
gnutls_global_deinit();
270
/* openpgp credentials */
271
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
272
!= GNUTLS_E_SUCCESS) {
273
fprintf (stderr, "memory error: %s\n",
274
safer_gnutls_strerror(ret));
425
275
return -1;
426
276
}
427
277
428
278
if(debug){
429
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
430
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
431
seckeyfilename);
279
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
280
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
281
KEYFILE);
432
282
}
433
283
434
284
ret = gnutls_certificate_set_openpgp_key_file
435
(mc.cred, pubkeyfilename, seckeyfilename,
436
GNUTLS_OPENPGP_FMT_BASE64);
437
if(ret != GNUTLS_E_SUCCESS){
438
fprintf(stderr,
439
"Error[%d] while reading the OpenPGP key pair ('%s',"
440
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
441
fprintf(stderr, "The GnuTLS error is: %s\n",
442
safer_gnutls_strerror(ret));
443
goto globalfail;
444
}
445
446
/* GnuTLS server initialization */
447
ret = gnutls_dh_params_init(&mc.dh_params);
448
if(ret != GNUTLS_E_SUCCESS){
449
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
450
" %s\n", safer_gnutls_strerror(ret));
451
goto globalfail;
452
}
453
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
454
if(ret != GNUTLS_E_SUCCESS){
455
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
456
safer_gnutls_strerror(ret));
457
goto globalfail;
458
}
459
460
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
461
462
return 0;
463
464
globalfail:
465
466
gnutls_certificate_free_credentials(mc.cred);
467
gnutls_global_deinit();
468
gnutls_dh_params_deinit(mc.dh_params);
469
return -1;
470
}
471
472
static int init_gnutls_session(gnutls_session_t *session){
473
int ret;
474
/* GnuTLS session creation */
475
ret = gnutls_init(session, GNUTLS_SERVER);
476
if(ret != GNUTLS_E_SUCCESS){
285
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
286
if (ret != GNUTLS_E_SUCCESS) {
287
fprintf
288
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
289
" '%s')\n",
290
ret, CERTFILE, KEYFILE);
291
fprintf(stdout, "The Error is: %s\n",
292
safer_gnutls_strerror(ret));
293
return -1;
294
}
295
296
//GnuTLS server initialization
297
if ((ret = gnutls_dh_params_init (&es->dh_params))
298
!= GNUTLS_E_SUCCESS) {
299
fprintf (stderr, "Error in dh parameter initialization: %s\n",
300
safer_gnutls_strerror(ret));
301
return -1;
302
}
303
304
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
305
!= GNUTLS_E_SUCCESS) {
306
fprintf (stderr, "Error in prime generation: %s\n",
307
safer_gnutls_strerror(ret));
308
return -1;
309
}
310
311
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
312
313
// GnuTLS session creation
314
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
315
!= GNUTLS_E_SUCCESS){
477
316
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
478
317
safer_gnutls_strerror(ret));
479
318
}
480
319
481
{
482
const char *err;
483
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
484
if(ret != GNUTLS_E_SUCCESS){
485
fprintf(stderr, "Syntax error at: %s\n", err);
486
fprintf(stderr, "GnuTLS error: %s\n",
487
safer_gnutls_strerror(ret));
488
gnutls_deinit(*session);
489
return -1;
490
}
320
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
321
!= GNUTLS_E_SUCCESS) {
322
fprintf(stderr, "Syntax error at: %s\n", err);
323
fprintf(stderr, "GnuTLS error: %s\n",
324
safer_gnutls_strerror(ret));
325
return -1;
491
326
}
492
327
493
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
494
mc.cred);
495
if(ret != GNUTLS_E_SUCCESS){
496
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
328
if ((ret = gnutls_credentials_set
329
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
330
!= GNUTLS_E_SUCCESS) {
331
fprintf(stderr, "Error setting a credentials set: %s\n",
497
332
safer_gnutls_strerror(ret));
498
gnutls_deinit(*session);
499
333
return -1;
500
334
}
501
335
502
336
/* ignore client certificate if any. */
503
gnutls_certificate_server_set_request(*session,
504
GNUTLS_CERT_IGNORE);
337
gnutls_certificate_server_set_request (es->session,
338
GNUTLS_CERT_IGNORE);
505
339
506
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
340
gnutls_dh_set_prime_bits (es->session, DH_BITS);
507
341
508
342
return 0;
509
343
}
510
344
511
/* Avahi log function callback */
512
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
513
__attribute__((unused)) const char *txt){}
345
void empty_log(__attribute__((unused)) AvahiLogLevel level,
346
__attribute__((unused)) const char *txt){}
514
347
515
/* Called when a Mandos server is found */
516
static int start_mandos_communication(const char *ip, uint16_t port,
517
AvahiIfIndex if_index,
518
int af){
348
int start_mandos_communication(char *ip, uint16_t port,
349
unsigned int if_index){
519
350
int ret, tcp_sd;
520
ssize_t sret;
521
union {
522
struct sockaddr_in in;
523
struct sockaddr_in6 in6;
524
} to;
351
struct sockaddr_in6 to;
352
encrypted_session es;
525
353
char *buffer = NULL;
526
354
char *decrypted_buffer;
527
355
size_t buffer_length = 0;
528
356
size_t buffer_capacity = 0;
529
357
ssize_t decrypted_buffer_size;
530
size_t written;
531
358
int retval = 0;
532
gnutls_session_t session;
533
int pf; /* Protocol family */
534
535
switch(af){
536
case AF_INET6:
537
pf = PF_INET6;
538
break;
539
case AF_INET:
540
pf = PF_INET;
541
break;
542
default:
543
fprintf(stderr, "Bad address family: %d\n", af);
544
return -1;
545
}
546
547
ret = init_gnutls_session(&session);
548
if(ret != 0){
549
return -1;
550
}
359
char interface[IF_NAMESIZE];
551
360
552
361
if(debug){
553
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
554
"\n", ip, port);
362
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
555
363
}
556
364
557
tcp_sd = socket(pf, SOCK_STREAM, 0);
558
if(tcp_sd < 0){
365
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
366
if(tcp_sd < 0) {
559
367
perror("socket");
560
368
return -1;
561
369
}
562
370
563
memset(&to, 0, sizeof(to));
564
if(af == AF_INET6){
565
to.in6.sin6_family = (uint16_t)af;
566
ret = inet_pton(af, ip, &to.in6.sin6_addr);
567
} else { /* IPv4 */
568
to.in.sin_family = (sa_family_t)af;
569
ret = inet_pton(af, ip, &to.in.sin_addr);
570
}
571
if(ret < 0 ){
371
if(if_indextoname(if_index, interface) == NULL){
372
if(debug){
373
perror("if_indextoname");
374
}
375
return -1;
376
}
377
378
if(debug){
379
fprintf(stderr, "Binding to interface %s\n", interface);
380
}
381
382
ret = setsockopt(tcp_sd, SOL_SOCKET, SO_BINDTODEVICE, interface, 5);
383
if(ret < 0) {
384
perror("setsockopt bindtodevice");
385
return -1;
386
}
387
388
memset(&to,0,sizeof(to));
389
to.sin6_family = AF_INET6;
390
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
391
if (ret < 0 ){
572
392
perror("inet_pton");
573
393
return -1;
574
}
394
}
575
395
if(ret == 0){
576
396
fprintf(stderr, "Bad address: %s\n", ip);
577
397
return -1;
578
398
}
579
if(af == AF_INET6){
580
to.in6.sin6_port = htons(port); /* Spurious warnings from
581
-Wconversion and
582
-Wunreachable-code */
583
584
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
585
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
586
-Wunreachable-code*/
587
if(if_index == AVAHI_IF_UNSPEC){
588
fprintf(stderr, "An IPv6 link-local address is incomplete"
589
" without a network interface\n");
590
return -1;
591
}
592
/* Set the network interface number as scope */
593
to.in6.sin6_scope_id = (uint32_t)if_index;
594
}
595
} else {
596
to.in.sin_port = htons(port); /* Spurious warnings from
597
-Wconversion and
598
-Wunreachable-code */
599
}
399
/* Spurious warnings for the next line, see for instance
400
<http://bugs.debian.org/488884> */
401
to.sin6_port = htons(port);
402
403
to.sin6_scope_id = (uint32_t)if_index;
600
404
601
405
if(debug){
602
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
603
char interface[IF_NAMESIZE];
604
if(if_indextoname((unsigned int)if_index, interface) == NULL){
605
perror("if_indextoname");
606
} else {
607
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
608
ip, interface, port);
609
}
610
} else {
611
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
612
port);
613
}
614
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
615
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
616
const char *pcret;
617
if(af == AF_INET6){
618
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
619
sizeof(addrstr));
620
} else {
621
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
622
sizeof(addrstr));
623
}
624
if(pcret == NULL){
625
perror("inet_ntop");
626
} else {
627
if(strcmp(addrstr, ip) != 0){
628
fprintf(stderr, "Canonical address form: %s\n", addrstr);
629
}
630
}
406
fprintf(stderr, "Connection to: %s\n", ip);
631
407
}
632
408
633
if(af == AF_INET6){
634
ret = connect(tcp_sd, &to.in6, sizeof(to));
635
} else {
636
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
637
}
638
if(ret < 0){
409
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
410
if (ret < 0){
639
411
perror("connect");
640
412
return -1;
641
413
}
642
414
643
const char *out = mandos_protocol_version;
644
written = 0;
645
while(true){
646
size_t out_size = strlen(out);
647
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
648
out_size - written));
649
if(ret == -1){
650
perror("write");
651
retval = -1;
652
goto mandos_end;
653
}
654
written += (size_t)ret;
655
if(written < out_size){
656
continue;
657
} else {
658
if(out == mandos_protocol_version){
659
written = 0;
660
out = "\r\n";
661
} else {
662
break;
663
}
664
}
415
ret = initgnutls (&es);
416
if (ret != 0){
417
retval = -1;
418
return -1;
665
419
}
666
420
421
gnutls_transport_set_ptr (es.session,
422
(gnutls_transport_ptr_t) tcp_sd);
423
667
424
if(debug){
668
425
fprintf(stderr, "Establishing TLS session with %s\n", ip);
669
426
}
670
427
671
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
672
673
do{
674
ret = gnutls_handshake(session);
675
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
676
677
if(ret != GNUTLS_E_SUCCESS){
678
if(debug){
679
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
680
gnutls_perror(ret);
681
}
428
ret = gnutls_handshake (es.session);
429
430
if (ret != GNUTLS_E_SUCCESS){
431
fprintf(stderr, "\n*** Handshake failed ***\n");
432
gnutls_perror (ret);
682
433
retval = -1;
683
goto mandos_end;
434
goto exit;
684
435
}
685
436
686
/* Read OpenPGP packet that contains the wanted password */
437
//Retrieve OpenPGP packet that contains the wanted password
687
438
688
439
if(debug){
689
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
440
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
690
441
ip);
691
442
}
692
443
693
444
while(true){
694
buffer_capacity = incbuffer(&buffer, buffer_length,
695
buffer_capacity);
696
if(buffer_capacity == 0){
697
perror("incbuffer");
698
retval = -1;
699
goto mandos_end;
445
if (buffer_length + BUFFER_SIZE > buffer_capacity){
446
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
447
if (buffer == NULL){
448
perror("realloc");
449
goto exit;
450
}
451
buffer_capacity += BUFFER_SIZE;
700
452
}
701
453
702
sret = gnutls_record_recv(session, buffer+buffer_length,
703
BUFFER_SIZE);
704
if(sret == 0){
454
ret = gnutls_record_recv
455
(es.session, buffer+buffer_length, BUFFER_SIZE);
456
if (ret == 0){
705
457
break;
706
458
}
707
if(sret < 0){
708
switch(sret){
459
if (ret < 0){
460
switch(ret){
709
461
case GNUTLS_E_INTERRUPTED:
710
462
case GNUTLS_E_AGAIN:
711
463
break;
712
464
case GNUTLS_E_REHANDSHAKE:
713
do{
714
ret = gnutls_handshake(session);
715
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
716
if(ret < 0){
717
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
718
gnutls_perror(ret);
465
ret = gnutls_handshake (es.session);
466
if (ret < 0){
467
fprintf(stderr, "\n*** Handshake failed ***\n");
468
gnutls_perror (ret);
719
469
retval = -1;
720
goto mandos_end;
470
goto exit;
721
471
}
722
472
break;
723
473
default:
724
474
fprintf(stderr, "Unknown error while reading data from"
725
" encrypted session with Mandos server\n");
475
" encrypted session with mandos server\n");
726
476
retval = -1;
727
gnutls_bye(session, GNUTLS_SHUT_RDWR);
728
goto mandos_end;
477
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
478
goto exit;
729
479
}
730
480
} else {
731
buffer_length += (size_t) sret;
481
buffer_length += (size_t) ret;
732
482
}
733
483
}
734
484
735
if(debug){
736
fprintf(stderr, "Closing TLS session\n");
737
}
738
739
gnutls_bye(session, GNUTLS_SHUT_RDWR);
740
741
if(buffer_length > 0){
485
if (buffer_length > 0){
742
486
decrypted_buffer_size = pgp_packet_decrypt(buffer,
743
487
buffer_length,
744
&decrypted_buffer);
745
if(decrypted_buffer_size >= 0){
746
written = 0;
747
while(written < (size_t) decrypted_buffer_size){
748
ret = (int)fwrite(decrypted_buffer + written, 1,
749
(size_t)decrypted_buffer_size - written,
750
stdout);
488
&decrypted_buffer,
489
CERT_ROOT);
490
if (decrypted_buffer_size >= 0){
491
while(decrypted_buffer_size > 0){
492
ret = fwrite (decrypted_buffer, 1, (size_t)decrypted_buffer_size,
493
stdout);
751
494
if(ret == 0 and ferror(stdout)){
752
495
if(debug){
753
496
fprintf(stderr, "Error writing encrypted data: %s\n",
756
499
retval = -1;
757
500
break;
758
501
}
759
written += (size_t)ret;
502
decrypted_buffer += ret;
503
decrypted_buffer_size -= ret;
760
504
}
761
505
free(decrypted_buffer);
762
506
} else {
763
507
retval = -1;
764
508
}
765
} else {
766
retval = -1;
767
}
768
769
/* Shutdown procedure */
770
771
mandos_end:
509
}
510
511
//shutdown procedure
512
513
if(debug){
514
fprintf(stderr, "Closing TLS session\n");
515
}
516
772
517
free(buffer);
773
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
774
if(ret == -1){
775
perror("close");
776
}
777
gnutls_deinit(session);
518
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
519
exit:
520
close(tcp_sd);
521
gnutls_deinit (es.session);
522
gnutls_certificate_free_credentials (es.cred);
523
gnutls_global_deinit ();
778
524
return retval;
779
525
}
780
526
781
static void resolve_callback(AvahiSServiceResolver *r,
782
AvahiIfIndex interface,
783
AvahiProtocol proto,
784
AvahiResolverEvent event,
785
const char *name,
786
const char *type,
787
const char *domain,
788
const char *host_name,
789
const AvahiAddress *address,
790
uint16_t port,
791
AVAHI_GCC_UNUSED AvahiStringList *txt,
792
AVAHI_GCC_UNUSED AvahiLookupResultFlags
793
flags,
794
AVAHI_GCC_UNUSED void* userdata){
527
static AvahiSimplePoll *simple_poll = NULL;
528
static AvahiServer *server = NULL;
529
530
static void resolve_callback(
531
AvahiSServiceResolver *r,
532
AVAHI_GCC_UNUSED AvahiIfIndex interface,
533
AVAHI_GCC_UNUSED AvahiProtocol protocol,
534
AvahiResolverEvent event,
535
const char *name,
536
const char *type,
537
const char *domain,
538
const char *host_name,
539
const AvahiAddress *address,
540
uint16_t port,
541
AVAHI_GCC_UNUSED AvahiStringList *txt,
542
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
543
AVAHI_GCC_UNUSED void* userdata) {
544
795
545
assert(r);
796
546
797
547
/* Called whenever a service has been resolved successfully or
798
548
timed out */
799
800
switch(event){
549
550
switch (event) {
801
551
default:
802
552
case AVAHI_RESOLVER_FAILURE:
803
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
804
" of type '%s' in domain '%s': %s\n", name, type, domain,
805
avahi_strerror(avahi_server_errno(mc.server)));
553
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
554
" type '%s' in domain '%s': %s\n", name, type, domain,
555
avahi_strerror(avahi_server_errno(server)));
806
556
break;
807
557
808
558
case AVAHI_RESOLVER_FOUND:
809
559
{
810
560
char ip[AVAHI_ADDRESS_STR_MAX];
811
561
avahi_address_snprint(ip, sizeof(ip), address);
812
562
if(debug){
813
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
814
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
815
ip, (intmax_t)interface, port);
563
fprintf(stderr, "Mandos server found on %s (%s) on port %d\n",
564
host_name, ip, port);
816
565
}
817
int ret = start_mandos_communication(ip, port, interface,
818
avahi_proto_to_af(proto));
819
if(ret == 0){
820
avahi_simple_poll_quit(mc.simple_poll);
566
int ret = start_mandos_communication(ip, port,
567
(unsigned int)
568
interface);
569
if (ret == 0){
570
exit(EXIT_SUCCESS);
571
} else {
572
exit(EXIT_FAILURE);
821
573
}
822
574
}
823
575
}
824
576
avahi_s_service_resolver_free(r);
825
577
}
826
578
827
static void browse_callback(AvahiSServiceBrowser *b,
828
AvahiIfIndex interface,
829
AvahiProtocol protocol,
830
AvahiBrowserEvent event,
831
const char *name,
832
const char *type,
833
const char *domain,
834
AVAHI_GCC_UNUSED AvahiLookupResultFlags
835
flags,
836
AVAHI_GCC_UNUSED void* userdata){
837
assert(b);
838
839
/* Called whenever a new services becomes available on the LAN or
840
is removed from the LAN */
841
842
switch(event){
843
default:
844
case AVAHI_BROWSER_FAILURE:
845
846
fprintf(stderr, "(Avahi browser) %s\n",
847
avahi_strerror(avahi_server_errno(mc.server)));
848
avahi_simple_poll_quit(mc.simple_poll);
849
return;
850
851
case AVAHI_BROWSER_NEW:
852
/* We ignore the returned Avahi resolver object. In the callback
853
function we free it. If the Avahi server is terminated before
854
the callback function is called the Avahi server will free the
855
resolver for us. */
856
857
if(!(avahi_s_service_resolver_new(mc.server, interface,
858
protocol, name, type, domain,
859
AVAHI_PROTO_INET6, 0,
860
resolve_callback, NULL)))
861
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
862
name, avahi_strerror(avahi_server_errno(mc.server)));
863
break;
864
865
case AVAHI_BROWSER_REMOVE:
866
break;
867
868
case AVAHI_BROWSER_ALL_FOR_NOW:
869
case AVAHI_BROWSER_CACHE_EXHAUSTED:
870
if(debug){
871
fprintf(stderr, "No Mandos server found, still searching...\n");
872
}
873
break;
874
}
875
}
876
877
sig_atomic_t quit_now = 0;
878
879
/* stop main loop after sigterm has been called */
880
static void handle_sigterm(__attribute__((unused)) int sig){
881
if(quit_now){
882
return;
883
}
884
quit_now = 1;
885
int old_errno = errno;
886
if(mc.simple_poll != NULL){
887
avahi_simple_poll_quit(mc.simple_poll);
888
}
889
errno = old_errno;
890
}
891
892
int main(int argc, char *argv[]){
893
AvahiSServiceBrowser *sb = NULL;
894
int error;
895
int ret;
896
intmax_t tmpmax;
897
int numchars;
898
int exitcode = EXIT_SUCCESS;
899
const char *interface = "eth0";
900
struct ifreq network;
901
int sd;
902
uid_t uid;
903
gid_t gid;
904
char *connect_to = NULL;
905
char tempdir[] = "/tmp/mandosXXXXXX";
906
bool tempdir_created = false;
907
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
908
const char *seckey = PATHDIR "/" SECKEY;
909
const char *pubkey = PATHDIR "/" PUBKEY;
910
911
/* Initialize Mandos context */
912
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
913
.dh_bits = 1024, .priority = "SECURE256"
914
":!CTYPE-X.509:+CTYPE-OPENPGP" };
915
bool gnutls_initialized = false;
916
bool gpgme_initialized = false;
917
double delay = 2.5;
918
919
struct sigaction old_sigterm_action;
920
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
921
922
{
923
struct argp_option options[] = {
924
{ .name = "debug", .key = 128,
925
.doc = "Debug mode", .group = 3 },
926
{ .name = "connect", .key = 'c',
927
.arg = "ADDRESS:PORT",
928
.doc = "Connect directly to a specific Mandos server",
929
.group = 1 },
930
{ .name = "interface", .key = 'i',
931
.arg = "NAME",
932
.doc = "Network interface that will be used to search for"
933
" Mandos servers",
934
.group = 1 },
935
{ .name = "seckey", .key = 's',
936
.arg = "FILE",
937
.doc = "OpenPGP secret key file base name",
938
.group = 1 },
939
{ .name = "pubkey", .key = 'p',
940
.arg = "FILE",
941
.doc = "OpenPGP public key file base name",
942
.group = 2 },
943
{ .name = "dh-bits", .key = 129,
944
.arg = "BITS",
945
.doc = "Bit length of the prime number used in the"
946
" Diffie-Hellman key exchange",
947
.group = 2 },
948
{ .name = "priority", .key = 130,
949
.arg = "STRING",
950
.doc = "GnuTLS priority string for the TLS handshake",
951
.group = 1 },
952
{ .name = "delay", .key = 131,
953
.arg = "SECONDS",
954
.doc = "Maximum delay to wait for interface startup",
955
.group = 2 },
956
{ .name = NULL }
957
};
958
959
error_t parse_opt(int key, char *arg,
960
struct argp_state *state){
961
switch(key){
962
case 128: /* --debug */
963
debug = true;
964
break;
965
case 'c': /* --connect */
966
connect_to = arg;
967
break;
968
case 'i': /* --interface */
969
interface = arg;
970
break;
971
case 's': /* --seckey */
972
seckey = arg;
973
break;
974
case 'p': /* --pubkey */
975
pubkey = arg;
976
break;
977
case 129: /* --dh-bits */
978
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
979
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
980
or arg[numchars] != '\0'){
981
fprintf(stderr, "Bad number of DH bits\n");
982
exit(EXIT_FAILURE);
983
}
984
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
985
break;
986
case 130: /* --priority */
987
mc.priority = arg;
988
break;
989
case 131: /* --delay */
990
ret = sscanf(arg, "%lf%n", &delay, &numchars);
991
if(ret < 1 or arg[numchars] != '\0'){
992
fprintf(stderr, "Bad delay\n");
993
exit(EXIT_FAILURE);
994
}
995
break;
996
case ARGP_KEY_ARG:
997
argp_usage(state);
998
case ARGP_KEY_END:
999
break;
1000
default:
1001
return ARGP_ERR_UNKNOWN;
1002
}
1003
return 0;
1004
}
1005
1006
struct argp argp = { .options = options, .parser = parse_opt,
1007
.args_doc = "",
1008
.doc = "Mandos client -- Get and decrypt"
1009
" passwords from a Mandos server" };
1010
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1011
if(ret == ARGP_ERR_UNKNOWN){
1012
fprintf(stderr, "Unknown error while parsing arguments\n");
1013
exitcode = EXIT_FAILURE;
1014
goto end;
1015
}
1016
}
1017
1018
if(not debug){
1019
avahi_set_log_function(empty_log);
1020
}
1021
1022
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1023
from the signal handler */
1024
/* Initialize the pseudo-RNG for Avahi */
1025
srand((unsigned int) time(NULL));
1026
mc.simple_poll = avahi_simple_poll_new();
1027
if(mc.simple_poll == NULL){
1028
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1029
exitcode = EXIT_FAILURE;
1030
goto end;
1031
}
1032
1033
sigemptyset(&sigterm_action.sa_mask);
1034
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1035
if(ret == -1){
1036
perror("sigaddset");
1037
exitcode = EXIT_FAILURE;
1038
goto end;
1039
}
1040
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1041
if(ret == -1){
1042
perror("sigaddset");
1043
exitcode = EXIT_FAILURE;
1044
goto end;
1045
}
1046
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1047
if(ret == -1){
1048
perror("sigaddset");
1049
exitcode = EXIT_FAILURE;
1050
goto end;
1051
}
1052
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1053
if(ret == -1){
1054
perror("sigaction");
1055
exitcode = EXIT_FAILURE;
1056
goto end;
1057
}
1058
1059
/* If the interface is down, bring it up */
1060
if(interface[0] != '\0'){
1061
#ifdef __linux__
1062
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1063
messages to mess up the prompt */
1064
ret = klogctl(8, NULL, 5);
1065
bool restore_loglevel = true;
1066
if(ret == -1){
1067
restore_loglevel = false;
1068
perror("klogctl");
1069
}
1070
#endif /* __linux__ */
1071
1072
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1073
if(sd < 0){
1074
perror("socket");
1075
exitcode = EXIT_FAILURE;
1076
#ifdef __linux__
1077
if(restore_loglevel){
1078
ret = klogctl(7, NULL, 0);
1079
if(ret == -1){
1080
perror("klogctl");
1081
}
1082
}
1083
#endif /* __linux__ */
1084
goto end;
1085
}
1086
strcpy(network.ifr_name, interface);
1087
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1088
if(ret == -1){
1089
perror("ioctl SIOCGIFFLAGS");
1090
#ifdef __linux__
1091
if(restore_loglevel){
1092
ret = klogctl(7, NULL, 0);
1093
if(ret == -1){
1094
perror("klogctl");
1095
}
1096
}
1097
#endif /* __linux__ */
1098
exitcode = EXIT_FAILURE;
1099
goto end;
1100
}
1101
if((network.ifr_flags & IFF_UP) == 0){
1102
network.ifr_flags |= IFF_UP;
1103
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1104
if(ret == -1){
1105
perror("ioctl SIOCSIFFLAGS");
1106
exitcode = EXIT_FAILURE;
1107
#ifdef __linux__
1108
if(restore_loglevel){
1109
ret = klogctl(7, NULL, 0);
1110
if(ret == -1){
1111
perror("klogctl");
1112
}
1113
}
1114
#endif /* __linux__ */
1115
goto end;
1116
}
1117
}
1118
/* sleep checking until interface is running */
1119
for(int i=0; i < delay * 4; i++){
1120
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1121
if(ret == -1){
1122
perror("ioctl SIOCGIFFLAGS");
1123
} else if(network.ifr_flags & IFF_RUNNING){
1124
break;
1125
}
1126
struct timespec sleeptime = { .tv_nsec = 250000000 };
1127
ret = nanosleep(&sleeptime, NULL);
1128
if(ret == -1 and errno != EINTR){
1129
perror("nanosleep");
1130
}
1131
}
1132
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1133
if(ret == -1){
1134
perror("close");
1135
}
1136
#ifdef __linux__
1137
if(restore_loglevel){
1138
/* Restores kernel loglevel to default */
1139
ret = klogctl(7, NULL, 0);
1140
if(ret == -1){
1141
perror("klogctl");
1142
}
1143
}
1144
#endif /* __linux__ */
1145
}
1146
1147
uid = getuid();
1148
gid = getgid();
1149
1150
errno = 0;
1151
setgid(gid);
1152
if(ret == -1){
1153
perror("setgid");
1154
}
1155
1156
ret = setuid(uid);
1157
if(ret == -1){
1158
perror("setuid");
1159
}
1160
1161
ret = init_gnutls_global(pubkey, seckey);
1162
if(ret == -1){
1163
fprintf(stderr, "init_gnutls_global failed\n");
1164
exitcode = EXIT_FAILURE;
1165
goto end;
1166
} else {
1167
gnutls_initialized = true;
1168
}
1169
1170
if(mkdtemp(tempdir) == NULL){
1171
perror("mkdtemp");
1172
goto end;
1173
}
1174
tempdir_created = true;
1175
1176
if(not init_gpgme(pubkey, seckey, tempdir)){
1177
fprintf(stderr, "init_gpgme failed\n");
1178
exitcode = EXIT_FAILURE;
1179
goto end;
1180
} else {
1181
gpgme_initialized = true;
1182
}
1183
1184
if(interface[0] != '\0'){
1185
if_index = (AvahiIfIndex) if_nametoindex(interface);
1186
if(if_index == 0){
1187
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1188
exitcode = EXIT_FAILURE;
1189
goto end;
1190
}
1191
}
1192
1193
if(connect_to != NULL){
1194
/* Connect directly, do not use Zeroconf */
1195
/* (Mainly meant for debugging) */
1196
char *address = strrchr(connect_to, ':');
1197
if(address == NULL){
1198
fprintf(stderr, "No colon in address\n");
1199
exitcode = EXIT_FAILURE;
1200
goto end;
1201
}
1202
uint16_t port;
1203
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1204
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1205
or address[numchars+1] != '\0'){
1206
fprintf(stderr, "Bad port number\n");
1207
exitcode = EXIT_FAILURE;
1208
goto end;
1209
}
1210
port = (uint16_t)tmpmax;
1211
*address = '\0';
1212
address = connect_to;
1213
/* Colon in address indicates IPv6 */
1214
int af;
1215
if(strchr(address, ':') != NULL){
1216
af = AF_INET6;
1217
} else {
1218
af = AF_INET;
1219
}
1220
ret = start_mandos_communication(address, port, if_index, af);
1221
if(ret < 0){
1222
exitcode = EXIT_FAILURE;
1223
} else {
1224
exitcode = EXIT_SUCCESS;
1225
}
1226
goto end;
1227
}
1228
1229
{
579
static void browse_callback(
580
AvahiSServiceBrowser *b,
581
AvahiIfIndex interface,
582
AvahiProtocol protocol,
583
AvahiBrowserEvent event,
584
const char *name,
585
const char *type,
586
const char *domain,
587
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
588
void* userdata) {
589
590
AvahiServer *s = userdata;
591
assert(b);
592
593
/* Called whenever a new services becomes available on the LAN or
594
is removed from the LAN */
595
596
switch (event) {
597
default:
598
case AVAHI_BROWSER_FAILURE:
599
600
fprintf(stderr, "(Browser) %s\n",
601
avahi_strerror(avahi_server_errno(server)));
602
avahi_simple_poll_quit(simple_poll);
603
return;
604
605
case AVAHI_BROWSER_NEW:
606
/* We ignore the returned resolver object. In the callback
607
function we free it. If the server is terminated before
608
the callback function is called the server will free
609
the resolver for us. */
610
611
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
612
type, domain,
613
AVAHI_PROTO_INET6, 0,
614
resolve_callback, s)))
615
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
616
avahi_strerror(avahi_server_errno(s)));
617
break;
618
619
case AVAHI_BROWSER_REMOVE:
620
break;
621
622
case AVAHI_BROWSER_ALL_FOR_NOW:
623
case AVAHI_BROWSER_CACHE_EXHAUSTED:
624
break;
625
}
626
}
627
628
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
1230
629
AvahiServerConfig config;
1231
/* Do not publish any local Zeroconf records */
630
AvahiSServiceBrowser *sb = NULL;
631
int error;
632
int ret;
633
int returncode = EXIT_SUCCESS;
634
const char *interface = "eth0";
635
636
while (true){
637
static struct option long_options[] = {
638
{"debug", no_argument, (int *)&debug, 1},
639
{"interface", required_argument, 0, 'i'},
640
{0, 0, 0, 0} };
641
642
int option_index = 0;
643
ret = getopt_long (argc, argv, "i:", long_options,
644
&option_index);
645
646
if (ret == -1){
647
break;
648
}
649
650
switch(ret){
651
case 0:
652
break;
653
case 'i':
654
interface = optarg;
655
break;
656
default:
657
exit(EXIT_FAILURE);
658
}
659
}
660
661
if (not debug){
662
avahi_set_log_function(empty_log);
663
}
664
665
/* Initialize the psuedo-RNG */
666
srand((unsigned int) time(NULL));
667
668
/* Allocate main loop object */
669
if (!(simple_poll = avahi_simple_poll_new())) {
670
fprintf(stderr, "Failed to create simple poll object.\n");
671
672
goto exit;
673
}
674
675
/* Do not publish any local records */
1232
676
avahi_server_config_init(&config);
1233
677
config.publish_hinfo = 0;
1234
678
config.publish_addresses = 0;
1235
679
config.publish_workstation = 0;
1236
680
config.publish_domain = 0;
1237
681
1238
682
/* Allocate a new server */
1239
mc.server = avahi_server_new(avahi_simple_poll_get
1240
(mc.simple_poll), &config, NULL,
1241
NULL, &error);
1242
1243
/* Free the Avahi configuration data */
683
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
684
&config, NULL, NULL, &error);
685
686
/* Free the configuration data */
1244
687
avahi_server_config_free(&config);
1245
}
1246
1247
/* Check if creating the Avahi server object succeeded */
1248
if(mc.server == NULL){
1249
fprintf(stderr, "Failed to create Avahi server: %s\n",
1250
avahi_strerror(error));
1251
exitcode = EXIT_FAILURE;
1252
goto end;
1253
}
1254
1255
/* Create the Avahi service browser */
1256
sb = avahi_s_service_browser_new(mc.server, if_index,
1257
AVAHI_PROTO_INET6, "_mandos._tcp",
1258
NULL, 0, browse_callback, NULL);
1259
if(sb == NULL){
1260
fprintf(stderr, "Failed to create service browser: %s\n",
1261
avahi_strerror(avahi_server_errno(mc.server)));
1262
exitcode = EXIT_FAILURE;
1263
goto end;
1264
}
1265
1266
/* Run the main loop */
1267
1268
if(debug){
1269
fprintf(stderr, "Starting Avahi loop search\n");
1270
}
1271
1272
avahi_simple_poll_loop(mc.simple_poll);
1273
1274
end:
1275
1276
if(debug){
1277
fprintf(stderr, "%s exiting\n", argv[0]);
1278
}
1279
1280
/* Cleanup things */
1281
if(sb != NULL)
1282
avahi_s_service_browser_free(sb);
1283
1284
if(mc.server != NULL)
1285
avahi_server_free(mc.server);
1286
1287
if(mc.simple_poll != NULL)
1288
avahi_simple_poll_free(mc.simple_poll);
1289
1290
if(gnutls_initialized){
1291
gnutls_certificate_free_credentials(mc.cred);
1292
gnutls_global_deinit();
1293
gnutls_dh_params_deinit(mc.dh_params);
1294
}
1295
1296
if(gpgme_initialized){
1297
gpgme_release(mc.ctx);
1298
}
1299
1300
/* Removes the temp directory used by GPGME */
1301
if(tempdir_created){
1302
DIR *d;
1303
struct dirent *direntry;
1304
d = opendir(tempdir);
1305
if(d == NULL){
1306
if(errno != ENOENT){
1307
perror("opendir");
1308
}
1309
} else {
1310
while(true){
1311
direntry = readdir(d);
1312
if(direntry == NULL){
1313
break;
1314
}
1315
/* Skip "." and ".." */
1316
if(direntry->d_name[0] == '.'
1317
and (direntry->d_name[1] == '\0'
1318
or (direntry->d_name[1] == '.'
1319
and direntry->d_name[2] == '\0'))){
1320
continue;
1321
}
1322
char *fullname = NULL;
1323
ret = asprintf(&fullname, "%s/%s", tempdir,
1324
direntry->d_name);
1325
if(ret < 0){
1326
perror("asprintf");
1327
continue;
1328
}
1329
ret = remove(fullname);
1330
if(ret == -1){
1331
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1332
strerror(errno));
1333
}
1334
free(fullname);
1335
}
1336
closedir(d);
1337
}
1338
ret = rmdir(tempdir);
1339
if(ret == -1 and errno != ENOENT){
1340
perror("rmdir");
1341
}
1342
}
1343
1344
return exitcode;
688
689
/* Check if creating the server object succeeded */
690
if (!server) {
691
fprintf(stderr, "Failed to create server: %s\n",
692
avahi_strerror(error));
693
returncode = EXIT_FAILURE;
694
goto exit;
695
}
696
697
/* Create the service browser */
698
sb = avahi_s_service_browser_new(server,
699
(AvahiIfIndex)
700
if_nametoindex(interface),
701
AVAHI_PROTO_INET6,
702
"_mandos._tcp", NULL, 0,
703
browse_callback, server);
704
if (!sb) {
705
fprintf(stderr, "Failed to create service browser: %s\n",
706
avahi_strerror(avahi_server_errno(server)));
707
returncode = EXIT_FAILURE;
708
goto exit;
709
}
710
711
/* Run the main loop */
712
713
if (debug){
714
fprintf(stderr, "Starting avahi loop search\n");
715
}
716
717
avahi_simple_poll_loop(simple_poll);
718
719
exit:
720
721
if (debug){
722
fprintf(stderr, "%s exiting\n", argv[0]);
723
}
724
725
/* Cleanup things */
726
if (sb)
727
avahi_s_service_browser_free(sb);
728
729
if (server)
730
avahi_server_free(server);
731
732
if (simple_poll)
733
avahi_simple_poll_free(simple_poll);
734
735
return returncode;
1345
736
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0