To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 24.1.13
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.13
- Committer: Björn Påhlsson
- Date: 2008-08-03 20:35:01 UTC
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 41.
- Revision ID: belorn@braxen-20080803203501-av7janz21ve7iq0b
mandosclient
Droping privileges
split gnutls function into global and session
* server.py (if_nametoindex): Redefine itself instead of using a
default keyword argument.
Droping privileges
split gnutls function into global and session
* server.py (if_nametoindex): Redefine itself instead of using a
default keyword argument.
- files added:
- server.conf
- files renamed:
- mandos-clients.conf => clients.conf
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
8
8
* includes the following functions: "resolve_callback",
9
9
* "browse_callback", and parts of "main".
10
10
*
11
* Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
12
* Påhlsson.
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
13
13
*
14
14
* This program is free software: you can redistribute it and/or
15
15
* modify it under the terms of the GNU General Public License as
25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
27
27
*
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
30
29
*/
31
30
32
#define _FORTIFY_SOURCE 2
33
31
/* Needed by GPGME, specifically gpgme_data_seek() */
34
32
#define _LARGEFILE_SOURCE
35
33
#define _FILE_OFFSET_BITS 64
36
34
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
37
37
#include <stdio.h>
38
38
#include <assert.h>
39
39
#include <stdlib.h>
40
40
#include <time.h>
41
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
44
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
45
SIOCSIFFLAGS */
42
46
43
47
#include <avahi-core/core.h>
44
48
#include <avahi-core/lookup.h>
47
51
#include <avahi-common/malloc.h>
48
52
#include <avahi-common/error.h>
49
53
50
//mandos client part
54
/* Mandos client part */
51
55
#include <sys/types.h> /* socket(), inet_pton() */
52
56
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
57
struct in6_addr, inet_pton() */
60
64
#include <string.h> /* memset */
61
65
#include <arpa/inet.h> /* inet_pton() */
62
66
#include <iso646.h> /* not */
67
#include <net/if.h> /* IF_NAMESIZE */
63
68
64
// gpgme
69
/* GPGME */
65
70
#include <errno.h> /* perror() */
66
71
#include <gpgme.h>
67
72
68
// getopt long
73
/* getopt_long */
69
74
#include <getopt.h>
70
75
71
#ifndef CERT_ROOT
72
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#endif
74
#define CERTFILE CERT_ROOT "openpgp-client.txt"
75
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
76
76
#define BUFFER_SIZE 256
77
#define DH_BITS 1024
77
78
static const char *keydir = "/conf/conf.d/mandos";
79
static const char *pubkeyfile = "pubkey.txt";
80
static const char *seckeyfile = "seckey.txt";
78
81
79
82
bool debug = false;
80
83
84
const char mandos_protocol_version[] = "1";
85
86
/* Used for passing in values through all the callback functions */
81
87
typedef struct {
82
gnutls_session_t session;
88
AvahiSimplePoll *simple_poll;
89
AvahiServer *server;
83
90
gnutls_certificate_credentials_t cred;
91
unsigned int dh_bits;
84
92
gnutls_dh_params_t dh_params;
85
} encrypted_session;
86
87
88
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
89
char **new_packet, const char *homedir){
93
const char *priority;
94
} mandos_context;
95
96
size_t adjustbuffer(char **buffer, size_t buffer_length,
97
size_t buffer_capacity){
98
if (buffer_length + BUFFER_SIZE > buffer_capacity){
99
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
100
if (buffer == NULL){
101
return 0;
102
}
103
buffer_capacity += BUFFER_SIZE;
104
}
105
return buffer_capacity;
106
}
107
108
/*
109
* Decrypt OpenPGP data using keyrings in HOMEDIR.
110
* Returns -1 on error
111
*/
112
static ssize_t pgp_packet_decrypt (const char *cryptotext,
113
size_t crypto_size,
114
char **plaintext,
115
const char *homedir){
90
116
gpgme_data_t dh_crypto, dh_plain;
91
117
gpgme_ctx_t ctx;
92
118
gpgme_error_t rc;
93
119
ssize_t ret;
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
120
size_t plaintext_capacity = 0;
121
ssize_t plaintext_length = 0;
96
122
gpgme_engine_info_t engine_info;
97
123
98
124
if (debug){
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
125
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
100
126
}
101
127
102
128
/* Init GPGME */
103
129
gpgme_check_version(NULL);
104
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
130
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
131
if (rc != GPG_ERR_NO_ERROR){
132
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
133
gpgme_strsource(rc), gpgme_strerror(rc));
134
return -1;
135
}
105
136
106
/* Set GPGME home directory */
137
/* Set GPGME home directory for the OpenPGP engine only */
107
138
rc = gpgme_get_engine_info (&engine_info);
108
139
if (rc != GPG_ERR_NO_ERROR){
109
140
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
119
150
engine_info = engine_info->next;
120
151
}
121
152
if(engine_info == NULL){
122
fprintf(stderr, "Could not set home dir to %s\n", homedir);
153
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
123
154
return -1;
124
155
}
125
156
126
/* Create new GPGME data buffer from packet buffer */
127
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
157
/* Create new GPGME data buffer from memory cryptotext */
158
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
159
0);
128
160
if (rc != GPG_ERR_NO_ERROR){
129
161
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
130
162
gpgme_strsource(rc), gpgme_strerror(rc));
136
168
if (rc != GPG_ERR_NO_ERROR){
137
169
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
138
170
gpgme_strsource(rc), gpgme_strerror(rc));
171
gpgme_data_release(dh_crypto);
139
172
return -1;
140
173
}
141
174
144
177
if (rc != GPG_ERR_NO_ERROR){
145
178
fprintf(stderr, "bad gpgme_new: %s: %s\n",
146
179
gpgme_strsource(rc), gpgme_strerror(rc));
147
return -1;
180
plaintext_length = -1;
181
goto decrypt_end;
148
182
}
149
183
150
/* Decrypt data from the FILE pointer to the plaintext data
151
buffer */
184
/* Decrypt data from the cryptotext data buffer to the plaintext
185
data buffer */
152
186
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
153
187
if (rc != GPG_ERR_NO_ERROR){
154
188
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
155
189
gpgme_strsource(rc), gpgme_strerror(rc));
156
return -1;
190
plaintext_length = -1;
191
goto decrypt_end;
157
192
}
158
193
159
194
if(debug){
160
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
195
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
161
196
}
162
197
163
198
if (debug){
164
199
gpgme_decrypt_result_t result;
165
200
result = gpgme_op_decrypt_result(ctx);
189
224
}
190
225
}
191
226
192
/* Delete the GPGME FILE pointer cryptotext data buffer */
193
gpgme_data_release(dh_crypto);
194
195
227
/* Seek back to the beginning of the GPGME plaintext data buffer */
196
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
197
198
*new_packet = 0;
228
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
229
perror("pgpme_data_seek");
230
plaintext_length = -1;
231
goto decrypt_end;
232
}
233
234
*plaintext = NULL;
199
235
while(true){
200
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
201
*new_packet = realloc(*new_packet,
202
(unsigned int)new_packet_capacity
203
+ BUFFER_SIZE);
204
if (*new_packet == NULL){
205
perror("realloc");
206
return -1;
207
}
208
new_packet_capacity += BUFFER_SIZE;
236
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
237
plaintext_capacity);
238
if (plaintext_capacity == 0){
239
perror("adjustbuffer");
240
plaintext_length = -1;
241
goto decrypt_end;
209
242
}
210
243
211
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
244
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
212
245
BUFFER_SIZE);
213
246
/* Print the data, if any */
214
247
if (ret == 0){
248
/* EOF */
215
249
break;
216
250
}
217
251
if(ret < 0){
218
252
perror("gpgme_data_read");
219
return -1;
253
plaintext_length = -1;
254
goto decrypt_end;
220
255
}
221
new_packet_length += ret;
256
plaintext_length += ret;
222
257
}
223
258
224
/* FIXME: check characters before printing to screen so to not print
225
terminal control characters */
226
/* if(debug){ */
227
/* fprintf(stderr, "decrypted password is: "); */
228
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
229
/* fprintf(stderr, "\n"); */
230
/* } */
259
if(debug){
260
fprintf(stderr, "Decrypted password is: ");
261
for(ssize_t i = 0; i < plaintext_length; i++){
262
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
263
}
264
fprintf(stderr, "\n");
265
}
266
267
decrypt_end:
268
269
/* Delete the GPGME cryptotext data buffer */
270
gpgme_data_release(dh_crypto);
231
271
232
272
/* Delete the GPGME plaintext data buffer */
233
273
gpgme_data_release(dh_plain);
234
return new_packet_length;
274
return plaintext_length;
235
275
}
236
276
237
277
static const char * safer_gnutls_strerror (int value) {
241
281
return ret;
242
282
}
243
283
244
void debuggnutls(__attribute__((unused)) int level,
245
const char* string){
246
fprintf(stderr, "%s", string);
284
/* GnuTLS log function callback */
285
static void debuggnutls(__attribute__((unused)) int level,
286
const char* string){
287
fprintf(stderr, "GnuTLS: %s", string);
247
288
}
248
289
249
int initgnutls(encrypted_session *es){
250
const char *err;
290
static int init_gnutls_global(mandos_context *mc){
251
291
int ret;
252
292
253
293
if(debug){
254
294
fprintf(stderr, "Initializing GnuTLS\n");
255
295
}
256
296
257
297
if ((ret = gnutls_global_init ())
258
298
!= GNUTLS_E_SUCCESS) {
259
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
299
fprintf (stderr, "GnuTLS global_init: %s\n",
300
safer_gnutls_strerror(ret));
260
301
return -1;
261
302
}
262
303
263
304
if (debug){
305
/* "Use a log level over 10 to enable all debugging options."
306
* - GnuTLS manual
307
*/
264
308
gnutls_global_set_log_level(11);
265
309
gnutls_global_set_log_function(debuggnutls);
266
310
}
267
311
268
/* openpgp credentials */
269
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
312
/* OpenPGP credentials */
313
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
270
314
!= GNUTLS_E_SUCCESS) {
271
fprintf (stderr, "memory error: %s\n",
315
fprintf (stderr, "GnuTLS memory error: %s\n",
272
316
safer_gnutls_strerror(ret));
273
317
return -1;
274
318
}
275
319
276
320
if(debug){
277
321
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
278
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
279
KEYFILE);
322
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
323
seckeyfile);
280
324
}
281
325
282
326
ret = gnutls_certificate_set_openpgp_key_file
283
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
327
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
284
328
if (ret != GNUTLS_E_SUCCESS) {
285
fprintf
286
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
287
" '%s')\n",
288
ret, CERTFILE, KEYFILE);
289
fprintf(stdout, "The Error is: %s\n",
329
fprintf(stderr,
330
"Error[%d] while reading the OpenPGP key pair ('%s',"
331
" '%s')\n", ret, pubkeyfile, seckeyfile);
332
fprintf(stdout, "The GnuTLS error is: %s\n",
290
333
safer_gnutls_strerror(ret));
291
334
return -1;
292
335
}
293
336
294
//GnuTLS server initialization
295
if ((ret = gnutls_dh_params_init (&es->dh_params))
296
!= GNUTLS_E_SUCCESS) {
297
fprintf (stderr, "Error in dh parameter initialization: %s\n",
298
safer_gnutls_strerror(ret));
299
return -1;
300
}
301
302
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in prime generation: %s\n",
305
safer_gnutls_strerror(ret));
306
return -1;
307
}
308
309
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
310
311
// GnuTLS session creation
312
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
313
!= GNUTLS_E_SUCCESS){
337
/* GnuTLS server initialization */
338
ret = gnutls_dh_params_init(&mc->dh_params);
339
if (ret != GNUTLS_E_SUCCESS) {
340
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
341
" %s\n", safer_gnutls_strerror(ret));
342
return -1;
343
}
344
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
345
if (ret != GNUTLS_E_SUCCESS) {
346
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
347
safer_gnutls_strerror(ret));
348
return -1;
349
}
350
351
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
352
353
return 0;
354
}
355
356
static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
357
int ret;
358
/* GnuTLS session creation */
359
ret = gnutls_init(session, GNUTLS_SERVER);
360
if (ret != GNUTLS_E_SUCCESS){
314
361
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
315
362
safer_gnutls_strerror(ret));
316
363
}
317
364
318
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
319
!= GNUTLS_E_SUCCESS) {
320
fprintf(stderr, "Syntax error at: %s\n", err);
321
fprintf(stderr, "GnuTLS error: %s\n",
322
safer_gnutls_strerror(ret));
323
return -1;
365
{
366
const char *err;
367
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
368
if (ret != GNUTLS_E_SUCCESS) {
369
fprintf(stderr, "Syntax error at: %s\n", err);
370
fprintf(stderr, "GnuTLS error: %s\n",
371
safer_gnutls_strerror(ret));
372
return -1;
373
}
324
374
}
325
375
326
if ((ret = gnutls_credentials_set
327
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
328
!= GNUTLS_E_SUCCESS) {
329
fprintf(stderr, "Error setting a credentials set: %s\n",
376
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
377
mc->cred);
378
if (ret != GNUTLS_E_SUCCESS) {
379
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
330
380
safer_gnutls_strerror(ret));
331
381
return -1;
332
382
}
333
383
334
384
/* ignore client certificate if any. */
335
gnutls_certificate_server_set_request (es->session,
385
gnutls_certificate_server_set_request (*session,
336
386
GNUTLS_CERT_IGNORE);
337
387
338
gnutls_dh_set_prime_bits (es->session, DH_BITS);
388
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
339
389
340
390
return 0;
341
391
}
342
392
343
void empty_log(__attribute__((unused)) AvahiLogLevel level,
344
__attribute__((unused)) const char *txt){}
393
/* Avahi log function callback */
394
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
395
__attribute__((unused)) const char *txt){}
345
396
346
int start_mandos_communication(const char *ip, uint16_t port,
347
unsigned int if_index){
397
/* Called when a Mandos server is found */
398
static int start_mandos_communication(const char *ip, uint16_t port,
399
AvahiIfIndex if_index,
400
mandos_context *mc){
348
401
int ret, tcp_sd;
349
402
struct sockaddr_in6 to;
350
encrypted_session es;
351
403
char *buffer = NULL;
352
404
char *decrypted_buffer;
353
405
size_t buffer_length = 0;
354
406
size_t buffer_capacity = 0;
355
407
ssize_t decrypted_buffer_size;
356
size_t written = 0;
408
size_t written;
357
409
int retval = 0;
358
410
char interface[IF_NAMESIZE];
411
gnutls_session_t session;
412
gnutls_dh_params_t dh_params;
413
414
ret = init_gnutls_session (mc, &session);
415
if (ret != 0){
416
return -1;
417
}
359
418
360
419
if(debug){
361
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
420
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
421
ip, port);
362
422
}
363
423
364
424
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
366
426
perror("socket");
367
427
return -1;
368
428
}
369
370
if(if_indextoname(if_index, interface) == NULL){
371
if(debug){
429
430
if(debug){
431
if(if_indextoname((unsigned int)if_index, interface) == NULL){
372
432
perror("if_indextoname");
433
return -1;
373
434
}
374
return -1;
375
}
376
377
if(debug){
378
435
fprintf(stderr, "Binding to interface %s\n", interface);
379
436
}
380
437
381
438
memset(&to,0,sizeof(to)); /* Spurious warning */
382
439
to.sin6_family = AF_INET6;
440
/* It would be nice to have a way to detect if we were passed an
441
IPv4 address here. Now we assume an IPv6 address. */
383
442
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
384
443
if (ret < 0 ){
385
444
perror("inet_pton");
386
445
return -1;
387
}
446
}
388
447
if(ret == 0){
389
448
fprintf(stderr, "Bad address: %s\n", ip);
390
449
return -1;
394
453
to.sin6_scope_id = (uint32_t)if_index;
395
454
396
455
if(debug){
397
fprintf(stderr, "Connection to: %s\n", ip);
456
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
457
char addrstr[INET6_ADDRSTRLEN] = "";
458
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
459
sizeof(addrstr)) == NULL){
460
perror("inet_ntop");
461
} else {
462
if(strcmp(addrstr, ip) != 0){
463
fprintf(stderr, "Canonical address form: %s\n", addrstr);
464
}
465
}
398
466
}
399
467
400
468
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
402
470
perror("connect");
403
471
return -1;
404
472
}
405
406
ret = initgnutls (&es);
407
if (ret != 0){
408
retval = -1;
409
return -1;
473
474
const char *out = mandos_protocol_version;
475
written = 0;
476
while (true){
477
size_t out_size = strlen(out);
478
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
479
out_size - written));
480
if (ret == -1){
481
perror("write");
482
retval = -1;
483
goto mandos_end;
484
}
485
written += (size_t)ret;
486
if(written < out_size){
487
continue;
488
} else {
489
if (out == mandos_protocol_version){
490
written = 0;
491
out = "\r\n";
492
} else {
493
break;
494
}
495
}
410
496
}
411
412
gnutls_transport_set_ptr (es.session,
413
(gnutls_transport_ptr_t) tcp_sd);
414
497
415
498
if(debug){
416
499
fprintf(stderr, "Establishing TLS session with %s\n", ip);
417
500
}
418
501
419
ret = gnutls_handshake (es.session);
502
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
503
504
ret = gnutls_handshake (session);
420
505
421
506
if (ret != GNUTLS_E_SUCCESS){
422
fprintf(stderr, "\n*** Handshake failed ***\n");
423
gnutls_perror (ret);
507
if(debug){
508
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
509
gnutls_perror (ret);
510
}
424
511
retval = -1;
425
goto exit;
512
goto mandos_end;
426
513
}
427
514
428
//Retrieve OpenPGP packet that contains the wanted password
515
/* Read OpenPGP packet that contains the wanted password */
429
516
430
517
if(debug){
431
518
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
433
520
}
434
521
435
522
while(true){
436
if (buffer_length + BUFFER_SIZE > buffer_capacity){
437
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
438
if (buffer == NULL){
439
perror("realloc");
440
goto exit;
441
}
442
buffer_capacity += BUFFER_SIZE;
523
buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);
524
if (buffer_capacity == 0){
525
perror("adjustbuffer");
526
retval = -1;
527
goto mandos_end;
443
528
}
444
529
445
ret = gnutls_record_recv
446
(es.session, buffer+buffer_length, BUFFER_SIZE);
530
ret = gnutls_record_recv(session, buffer+buffer_length,
531
BUFFER_SIZE);
447
532
if (ret == 0){
448
533
break;
449
534
}
453
538
case GNUTLS_E_AGAIN:
454
539
break;
455
540
case GNUTLS_E_REHANDSHAKE:
456
ret = gnutls_handshake (es.session);
541
ret = gnutls_handshake (session);
457
542
if (ret < 0){
458
fprintf(stderr, "\n*** Handshake failed ***\n");
543
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
459
544
gnutls_perror (ret);
460
545
retval = -1;
461
goto exit;
546
goto mandos_end;
462
547
}
463
548
break;
464
549
default:
465
550
fprintf(stderr, "Unknown error while reading data from"
466
" encrypted session with mandos server\n");
551
" encrypted session with Mandos server\n");
467
552
retval = -1;
468
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
469
goto exit;
553
gnutls_bye (session, GNUTLS_SHUT_RDWR);
554
goto mandos_end;
470
555
}
471
556
} else {
472
557
buffer_length += (size_t) ret;
473
558
}
474
559
}
475
560
561
if(debug){
562
fprintf(stderr, "Closing TLS session\n");
563
}
564
565
gnutls_bye (session, GNUTLS_SHUT_RDWR);
566
476
567
if (buffer_length > 0){
477
568
decrypted_buffer_size = pgp_packet_decrypt(buffer,
478
569
buffer_length,
479
570
&decrypted_buffer,
480
CERT_ROOT);
571
keydir);
481
572
if (decrypted_buffer_size >= 0){
482
while(written < decrypted_buffer_size){
573
written = 0;
574
while(written < (size_t) decrypted_buffer_size){
483
575
ret = (int)fwrite (decrypted_buffer + written, 1,
484
576
(size_t)decrypted_buffer_size - written,
485
577
stdout);
498
590
retval = -1;
499
591
}
500
592
}
501
502
//shutdown procedure
503
504
if(debug){
505
fprintf(stderr, "Closing TLS session\n");
506
}
507
593
594
/* Shutdown procedure */
595
596
mandos_end:
508
597
free(buffer);
509
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
510
exit:
511
598
close(tcp_sd);
512
gnutls_deinit (es.session);
513
gnutls_certificate_free_credentials (es.cred);
599
gnutls_deinit (session);
600
gnutls_certificate_free_credentials (mc->cred);
514
601
gnutls_global_deinit ();
515
602
return retval;
516
603
}
517
604
518
static AvahiSimplePoll *simple_poll = NULL;
519
static AvahiServer *server = NULL;
520
521
static void resolve_callback(
522
AvahiSServiceResolver *r,
523
AvahiIfIndex interface,
524
AVAHI_GCC_UNUSED AvahiProtocol protocol,
525
AvahiResolverEvent event,
526
const char *name,
527
const char *type,
528
const char *domain,
529
const char *host_name,
530
const AvahiAddress *address,
531
uint16_t port,
532
AVAHI_GCC_UNUSED AvahiStringList *txt,
533
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
534
AVAHI_GCC_UNUSED void* userdata) {
535
605
static void resolve_callback(AvahiSServiceResolver *r,
606
AvahiIfIndex interface,
607
AVAHI_GCC_UNUSED AvahiProtocol protocol,
608
AvahiResolverEvent event,
609
const char *name,
610
const char *type,
611
const char *domain,
612
const char *host_name,
613
const AvahiAddress *address,
614
uint16_t port,
615
AVAHI_GCC_UNUSED AvahiStringList *txt,
616
AVAHI_GCC_UNUSED AvahiLookupResultFlags
617
flags,
618
void* userdata) {
619
mandos_context *mc = userdata;
536
620
assert(r); /* Spurious warning */
537
621
538
622
/* Called whenever a service has been resolved successfully or
541
625
switch (event) {
542
626
default:
543
627
case AVAHI_RESOLVER_FAILURE:
544
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
545
" type '%s' in domain '%s': %s\n", name, type, domain,
546
avahi_strerror(avahi_server_errno(server)));
628
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
629
" of type '%s' in domain '%s': %s\n", name, type, domain,
630
avahi_strerror(avahi_server_errno(mc->server)));
547
631
break;
548
632
549
633
case AVAHI_RESOLVER_FOUND:
551
635
char ip[AVAHI_ADDRESS_STR_MAX];
552
636
avahi_address_snprint(ip, sizeof(ip), address);
553
637
if(debug){
554
fprintf(stderr, "Mandos server found on %s (%s) on port %d\n",
555
host_name, ip, port);
638
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"
639
" port %d\n", name, host_name, ip, interface, port);
556
640
}
557
int ret = start_mandos_communication(ip, port,
558
(unsigned int) interface);
641
int ret = start_mandos_communication(ip, port, interface, mc);
559
642
if (ret == 0){
560
643
exit(EXIT_SUCCESS);
561
} else {
562
exit(EXIT_FAILURE);
563
644
}
564
645
}
565
646
}
566
647
avahi_s_service_resolver_free(r);
567
648
}
568
649
569
static void browse_callback(
570
AvahiSServiceBrowser *b,
571
AvahiIfIndex interface,
572
AvahiProtocol protocol,
573
AvahiBrowserEvent event,
574
const char *name,
575
const char *type,
576
const char *domain,
577
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
578
void* userdata) {
579
580
AvahiServer *s = userdata;
581
assert(b); /* Spurious warning */
582
583
/* Called whenever a new services becomes available on the LAN or
584
is removed from the LAN */
585
586
switch (event) {
587
default:
588
case AVAHI_BROWSER_FAILURE:
589
590
fprintf(stderr, "(Browser) %s\n",
591
avahi_strerror(avahi_server_errno(server)));
592
avahi_simple_poll_quit(simple_poll);
593
return;
594
595
case AVAHI_BROWSER_NEW:
596
/* We ignore the returned resolver object. In the callback
597
function we free it. If the server is terminated before
598
the callback function is called the server will free
599
the resolver for us. */
600
601
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
602
type, domain,
603
AVAHI_PROTO_INET6, 0,
604
resolve_callback, s)))
605
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
606
avahi_strerror(avahi_server_errno(s)));
607
break;
608
609
case AVAHI_BROWSER_REMOVE:
610
break;
611
612
case AVAHI_BROWSER_ALL_FOR_NOW:
613
case AVAHI_BROWSER_CACHE_EXHAUSTED:
614
break;
650
static void browse_callback( AvahiSServiceBrowser *b,
651
AvahiIfIndex interface,
652
AvahiProtocol protocol,
653
AvahiBrowserEvent event,
654
const char *name,
655
const char *type,
656
const char *domain,
657
AVAHI_GCC_UNUSED AvahiLookupResultFlags
658
flags,
659
void* userdata) {
660
mandos_context *mc = userdata;
661
assert(b); /* Spurious warning */
662
663
/* Called whenever a new services becomes available on the LAN or
664
is removed from the LAN */
665
666
switch (event) {
667
default:
668
case AVAHI_BROWSER_FAILURE:
669
670
fprintf(stderr, "(Avahi browser) %s\n",
671
avahi_strerror(avahi_server_errno(mc->server)));
672
avahi_simple_poll_quit(mc->simple_poll);
673
return;
674
675
case AVAHI_BROWSER_NEW:
676
/* We ignore the returned Avahi resolver object. In the callback
677
function we free it. If the Avahi server is terminated before
678
the callback function is called the Avahi server will free the
679
resolver for us. */
680
681
if (!(avahi_s_service_resolver_new(mc->server, interface,
682
protocol, name, type, domain,
683
AVAHI_PROTO_INET6, 0,
684
resolve_callback, mc)))
685
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
686
name, avahi_strerror(avahi_server_errno(mc->server)));
687
break;
688
689
case AVAHI_BROWSER_REMOVE:
690
break;
691
692
case AVAHI_BROWSER_ALL_FOR_NOW:
693
case AVAHI_BROWSER_CACHE_EXHAUSTED:
694
if(debug){
695
fprintf(stderr, "No Mandos server found, still searching...\n");
615
696
}
616
}
617
618
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
619
AvahiServerConfig config;
697
break;
698
}
699
}
700
701
/* Combines file name and path and returns the malloced new
702
string. some sane checks could/should be added */
703
static const char *combinepath(const char *first, const char *second){
704
size_t f_len = strlen(first);
705
size_t s_len = strlen(second);
706
char *tmp = malloc(f_len + s_len + 2);
707
if (tmp == NULL){
708
return NULL;
709
}
710
if(f_len > 0){
711
memcpy(tmp, first, f_len); /* Spurious warning */
712
}
713
tmp[f_len] = '/';
714
if(s_len > 0){
715
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
716
}
717
tmp[f_len + 1 + s_len] = '\0';
718
return tmp;
719
}
720
721
722
int main(int argc, char *argv[]){
620
723
AvahiSServiceBrowser *sb = NULL;
621
724
int error;
622
725
int ret;
623
int returncode = EXIT_SUCCESS;
726
int exitcode = EXIT_SUCCESS;
624
727
const char *interface = "eth0";
625
626
while (true){
627
static struct option long_options[] = {
628
{"debug", no_argument, (int *)&debug, 1},
629
{"interface", required_argument, 0, 'i'},
630
{0, 0, 0, 0} };
631
632
int option_index = 0;
633
ret = getopt_long (argc, argv, "i:", long_options,
634
&option_index);
635
636
if (ret == -1){
637
break;
638
}
639
640
switch(ret){
641
case 0:
642
break;
643
case 'i':
644
interface = optarg;
645
break;
646
default:
647
exit(EXIT_FAILURE);
648
}
728
struct ifreq network;
729
int sd;
730
uid_t uid;
731
gid_t gid;
732
char *connect_to = NULL;
733
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
734
mandos_context mc = { .simple_poll = NULL, .server = NULL,
735
.dh_bits = 1024, .priority = "SECURE256"};
736
737
{
738
/* Temporary int to get the address of for getopt_long */
739
int debug_int = debug ? 1 : 0;
740
while (true){
741
struct option long_options[] = {
742
{"debug", no_argument, &debug_int, 1},
743
{"connect", required_argument, NULL, 'c'},
744
{"interface", required_argument, NULL, 'i'},
745
{"keydir", required_argument, NULL, 'd'},
746
{"seckey", required_argument, NULL, 's'},
747
{"pubkey", required_argument, NULL, 'p'},
748
{"dh-bits", required_argument, NULL, 'D'},
749
{"priority", required_argument, NULL, 'P'},
750
{0, 0, 0, 0} };
751
752
int option_index = 0;
753
ret = getopt_long (argc, argv, "i:", long_options,
754
&option_index);
755
756
if (ret == -1){
757
break;
758
}
759
760
switch(ret){
761
case 0:
762
break;
763
case 'i':
764
interface = optarg;
765
break;
766
case 'c':
767
connect_to = optarg;
768
break;
769
case 'd':
770
keydir = optarg;
771
break;
772
case 'p':
773
pubkeyfile = optarg;
774
break;
775
case 's':
776
seckeyfile = optarg;
777
break;
778
case 'D':
779
errno = 0;
780
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
781
if (errno){
782
perror("strtol");
783
exit(EXIT_FAILURE);
784
}
785
break;
786
case 'P':
787
mc.priority = optarg;
788
break;
789
case '?':
790
default:
791
/* getopt_long() has already printed a message about the
792
unrcognized option, so just exit. */
793
exit(EXIT_FAILURE);
794
}
795
}
796
/* Set the global debug flag from the temporary int */
797
debug = debug_int ? true : false;
798
}
799
800
pubkeyfile = combinepath(keydir, pubkeyfile);
801
if (pubkeyfile == NULL){
802
perror("combinepath");
803
exitcode = EXIT_FAILURE;
804
goto end;
805
}
806
807
seckeyfile = combinepath(keydir, seckeyfile);
808
if (seckeyfile == NULL){
809
perror("combinepath");
810
goto end;
811
}
812
813
ret = init_gnutls_global(&mc);
814
if (ret == -1){
815
fprintf(stderr, "init_gnutls_global\n");
816
goto end;
817
}
818
819
uid = getuid();
820
gid = getgid();
821
822
ret = setuid(uid);
823
if (ret == -1){
824
perror("setuid");
825
}
826
827
setgid(gid);
828
if (ret == -1){
829
perror("setgid");
830
}
831
832
if_index = (AvahiIfIndex) if_nametoindex(interface);
833
if(if_index == 0){
834
fprintf(stderr, "No such interface: \"%s\"\n", interface);
835
exit(EXIT_FAILURE);
836
}
837
838
if(connect_to != NULL){
839
/* Connect directly, do not use Zeroconf */
840
/* (Mainly meant for debugging) */
841
char *address = strrchr(connect_to, ':');
842
if(address == NULL){
843
fprintf(stderr, "No colon in address\n");
844
exitcode = EXIT_FAILURE;
845
goto end;
846
}
847
errno = 0;
848
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
849
if(errno){
850
perror("Bad port number");
851
exitcode = EXIT_FAILURE;
852
goto end;
853
}
854
*address = '\0';
855
address = connect_to;
856
ret = start_mandos_communication(address, port, if_index, &mc);
857
if(ret < 0){
858
exitcode = EXIT_FAILURE;
859
} else {
860
exitcode = EXIT_SUCCESS;
861
}
862
goto end;
863
}
864
865
/* If the interface is down, bring it up */
866
{
867
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
868
if(sd < 0) {
869
perror("socket");
870
exitcode = EXIT_FAILURE;
871
goto end;
872
}
873
strcpy(network.ifr_name, interface); /* Spurious warning */
874
ret = ioctl(sd, SIOCGIFFLAGS, &network);
875
if(ret == -1){
876
perror("ioctl SIOCGIFFLAGS");
877
exitcode = EXIT_FAILURE;
878
goto end;
879
}
880
if((network.ifr_flags & IFF_UP) == 0){
881
network.ifr_flags |= IFF_UP;
882
ret = ioctl(sd, SIOCSIFFLAGS, &network);
883
if(ret == -1){
884
perror("ioctl SIOCSIFFLAGS");
885
exitcode = EXIT_FAILURE;
886
goto end;
887
}
888
}
889
close(sd);
649
890
}
650
891
651
892
if (not debug){
652
893
avahi_set_log_function(empty_log);
653
894
}
654
895
655
/* Initialize the psuedo-RNG */
896
/* Initialize the pseudo-RNG for Avahi */
656
897
srand((unsigned int) time(NULL));
657
658
/* Allocate main loop object */
659
if (!(simple_poll = avahi_simple_poll_new())) {
660
fprintf(stderr, "Failed to create simple poll object.\n");
661
662
goto exit;
663
}
664
665
/* Do not publish any local records */
666
avahi_server_config_init(&config);
667
config.publish_hinfo = 0;
668
config.publish_addresses = 0;
669
config.publish_workstation = 0;
670
config.publish_domain = 0;
671
672
/* Allocate a new server */
673
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
674
&config, NULL, NULL, &error);
675
676
/* Free the configuration data */
677
avahi_server_config_free(&config);
678
679
/* Check if creating the server object succeeded */
680
if (!server) {
681
fprintf(stderr, "Failed to create server: %s\n",
898
899
/* Allocate main Avahi loop object */
900
mc.simple_poll = avahi_simple_poll_new();
901
if (mc.simple_poll == NULL) {
902
fprintf(stderr, "Avahi: Failed to create simple poll"
903
" object.\n");
904
exitcode = EXIT_FAILURE;
905
goto end;
906
}
907
908
{
909
AvahiServerConfig config;
910
/* Do not publish any local Zeroconf records */
911
avahi_server_config_init(&config);
912
config.publish_hinfo = 0;
913
config.publish_addresses = 0;
914
config.publish_workstation = 0;
915
config.publish_domain = 0;
916
917
/* Allocate a new server */
918
mc.server = avahi_server_new(avahi_simple_poll_get
919
(mc.simple_poll), &config, NULL,
920
NULL, &error);
921
922
/* Free the Avahi configuration data */
923
avahi_server_config_free(&config);
924
}
925
926
/* Check if creating the Avahi server object succeeded */
927
if (mc.server == NULL) {
928
fprintf(stderr, "Failed to create Avahi server: %s\n",
682
929
avahi_strerror(error));
683
returncode = EXIT_FAILURE;
684
goto exit;
930
exitcode = EXIT_FAILURE;
931
goto end;
685
932
}
686
933
687
/* Create the service browser */
688
sb = avahi_s_service_browser_new(server,
689
(AvahiIfIndex)
690
if_nametoindex(interface),
934
/* Create the Avahi service browser */
935
sb = avahi_s_service_browser_new(mc.server, if_index,
691
936
AVAHI_PROTO_INET6,
692
937
"_mandos._tcp", NULL, 0,
693
browse_callback, server);
694
if (!sb) {
938
browse_callback, &mc);
939
if (sb == NULL) {
695
940
fprintf(stderr, "Failed to create service browser: %s\n",
696
avahi_strerror(avahi_server_errno(server)));
697
returncode = EXIT_FAILURE;
698
goto exit;
941
avahi_strerror(avahi_server_errno(mc.server)));
942
exitcode = EXIT_FAILURE;
943
goto end;
699
944
}
700
945
701
946
/* Run the main loop */
702
947
703
948
if (debug){
704
fprintf(stderr, "Starting avahi loop search\n");
949
fprintf(stderr, "Starting Avahi loop search\n");
705
950
}
706
951
707
avahi_simple_poll_loop(simple_poll);
952
avahi_simple_poll_loop(mc.simple_poll);
708
953
709
exit:
954
end:
710
955
711
956
if (debug){
712
957
fprintf(stderr, "%s exiting\n", argv[0]);
713
958
}
714
959
715
960
/* Cleanup things */
716
if (sb)
961
if (sb != NULL)
717
962
avahi_s_service_browser_free(sb);
718
963
719
if (server)
720
avahi_server_free(server);
721
722
if (simple_poll)
723
avahi_simple_poll_free(simple_poll);
724
725
return returncode;
964
if (mc.server != NULL)
965
avahi_server_free(mc.server);
966
967
if (mc.simple_poll != NULL)
968
avahi_simple_poll_free(mc.simple_poll);
969
free(pubkeyfile);
970
free(seckeyfile);
971
972
return exitcode;
726
973
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0