25
26
* along with this program. If not, see
26
27
* <http://www.gnu.org/licenses/>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
29
* Contact the authors at <mandos@fukt.bsnet.se>.
32
#define _FORTIFY_SOURCE 2
32
/* Needed by GPGME, specifically gpgme_data_seek() */
34
33
#define _LARGEFILE_SOURCE
35
34
#define _FILE_OFFSET_BITS 64
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
43
#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
41
#include <stdint.h> /* uint16_t, uint32_t */
42
#include <stddef.h> /* NULL, size_t, ssize_t */
43
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
45
#include <stdbool.h> /* bool, true */
46
#include <string.h> /* memset(), strcmp(), strlen(),
47
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, INET6_ADDRSTRLEN,
52
uid_t, gid_t, open(), opendir(),
54
#include <sys/stat.h> /* open() */
55
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
56
struct in6_addr, inet_pton(),
58
#include <fcntl.h> /* open() */
59
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
62
#include <assert.h> /* assert() */
63
#include <errno.h> /* perror(), errno */
64
#include <time.h> /* nanosleep(), time() */
65
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
66
SIOCSIFFLAGS, if_indextoname(),
67
if_nametoindex(), IF_NAMESIZE */
68
#include <netinet/in.h>
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
getuid(), getgid(), setuid(),
72
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, and, or */
74
#include <argp.h> /* struct argp_option, error_t, struct
75
argp_state, struct argp,
76
argp_parse(), ARGP_KEY_ARG,
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
79
#include <sys/klog.h> /* klogctl() */
83
/* All Avahi types, constants and functions
45
86
#include <avahi-core/core.h>
46
87
#include <avahi-core/lookup.h>
47
88
#include <avahi-core/log.h>
49
90
#include <avahi-common/malloc.h>
50
91
#include <avahi-common/error.h>
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
67
#include <errno.h> /* perror() */
94
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
97
init_gnutls_session(),
99
#include <gnutls/openpgp.h>
100
/* gnutls_certificate_set_openpgp_key_file(),
101
GNUTLS_OPENPGP_FMT_BASE64 */
104
#include <gpgme.h> /* All GPGME types, constants and
107
GPGME_PROTOCOL_OpenPGP,
73
110
#define BUFFER_SIZE 256
76
const char *certdir = "/conf/conf.d/cryptkeyreq/";
77
const char *certfile = "openpgp-client.txt";
78
const char *certkey = "openpgp-client-key.txt";
112
#define PATHDIR "/conf/conf.d/mandos"
113
#define SECKEY "seckey.txt"
114
#define PUBKEY "pubkey.txt"
80
116
bool debug = false;
117
static const char mandos_protocol_version[] = "1";
118
const char *argp_program_version = "mandos-client " VERSION;
119
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
121
/* Used for passing in values through the Avahi callback functions */
83
gnutls_session_t session;
123
AvahiSimplePoll *simple_poll;
84
125
gnutls_certificate_credentials_t cred;
126
unsigned int dh_bits;
85
127
gnutls_dh_params_t dh_params;
89
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
90
char **new_packet, const char *homedir){
91
gpgme_data_t dh_crypto, dh_plain;
128
const char *priority;
133
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
134
* "buffer_capacity" is how much is currently allocated,
135
* "buffer_length" is how much is already used.
137
size_t adjustbuffer(char **buffer, size_t buffer_length,
138
size_t buffer_capacity){
139
if(buffer_length + BUFFER_SIZE > buffer_capacity){
140
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
144
buffer_capacity += BUFFER_SIZE;
146
return buffer_capacity;
152
static bool init_gpgme(mandos_context *mc, const char *seckey,
153
const char *pubkey, const char *tempdir){
95
ssize_t new_packet_capacity = 0;
96
ssize_t new_packet_length = 0;
97
156
gpgme_engine_info_t engine_info;
100
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
160
* Helper function to insert pub and seckey to the engine keyring.
162
bool import_key(const char *filename){
164
gpgme_data_t pgp_data;
166
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
172
rc = gpgme_data_new_from_fd(&pgp_data, fd);
173
if(rc != GPG_ERR_NO_ERROR){
174
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
175
gpgme_strsource(rc), gpgme_strerror(rc));
179
rc = gpgme_op_import(mc->ctx, pgp_data);
180
if(rc != GPG_ERR_NO_ERROR){
181
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
182
gpgme_strsource(rc), gpgme_strerror(rc));
186
ret = (int)TEMP_FAILURE_RETRY(close(fd));
190
gpgme_data_release(pgp_data);
195
fprintf(stderr, "Initialize gpgme\n");
104
199
gpgme_check_version(NULL);
105
200
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
106
if (rc != GPG_ERR_NO_ERROR){
201
if(rc != GPG_ERR_NO_ERROR){
107
202
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
108
203
gpgme_strsource(rc), gpgme_strerror(rc));
112
/* Set GPGME home directory */
113
rc = gpgme_get_engine_info (&engine_info);
114
if (rc != GPG_ERR_NO_ERROR){
207
/* Set GPGME home directory for the OpenPGP engine only */
208
rc = gpgme_get_engine_info(&engine_info);
209
if(rc != GPG_ERR_NO_ERROR){
115
210
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
116
211
gpgme_strsource(rc), gpgme_strerror(rc));
119
214
while(engine_info != NULL){
120
215
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
121
216
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
122
engine_info->file_name, homedir);
217
engine_info->file_name, tempdir);
125
220
engine_info = engine_info->next;
127
222
if(engine_info == NULL){
128
fprintf(stderr, "Could not set home dir to %s\n", homedir);
132
/* Create new GPGME data buffer from packet buffer */
133
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
134
if (rc != GPG_ERR_NO_ERROR){
223
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
227
/* Create new GPGME "context" */
228
rc = gpgme_new(&(mc->ctx));
229
if(rc != GPG_ERR_NO_ERROR){
230
fprintf(stderr, "bad gpgme_new: %s: %s\n",
231
gpgme_strsource(rc), gpgme_strerror(rc));
235
if(not import_key(pubkey) or not import_key(seckey)){
243
* Decrypt OpenPGP data.
244
* Returns -1 on error
246
static ssize_t pgp_packet_decrypt(const mandos_context *mc,
247
const char *cryptotext,
250
gpgme_data_t dh_crypto, dh_plain;
253
size_t plaintext_capacity = 0;
254
ssize_t plaintext_length = 0;
257
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
260
/* Create new GPGME data buffer from memory cryptotext */
261
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
263
if(rc != GPG_ERR_NO_ERROR){
135
264
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
136
265
gpgme_strsource(rc), gpgme_strerror(rc));
140
269
/* Create new empty GPGME data buffer for the plaintext */
141
270
rc = gpgme_data_new(&dh_plain);
142
if (rc != GPG_ERR_NO_ERROR){
271
if(rc != GPG_ERR_NO_ERROR){
143
272
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
144
273
gpgme_strsource(rc), gpgme_strerror(rc));
148
/* Create new GPGME "context" */
149
rc = gpgme_new(&ctx);
150
if (rc != GPG_ERR_NO_ERROR){
151
fprintf(stderr, "bad gpgme_new: %s: %s\n",
152
gpgme_strsource(rc), gpgme_strerror(rc));
156
/* Decrypt data from the FILE pointer to the plaintext data
158
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
159
if (rc != GPG_ERR_NO_ERROR){
274
gpgme_data_release(dh_crypto);
278
/* Decrypt data from the cryptotext data buffer to the plaintext
280
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
281
if(rc != GPG_ERR_NO_ERROR){
160
282
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
161
283
gpgme_strsource(rc), gpgme_strerror(rc));
284
plaintext_length = -1;
286
gpgme_decrypt_result_t result;
287
result = gpgme_op_decrypt_result(mc->ctx);
289
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
291
fprintf(stderr, "Unsupported algorithm: %s\n",
292
result->unsupported_algorithm);
293
fprintf(stderr, "Wrong key usage: %u\n",
294
result->wrong_key_usage);
295
if(result->file_name != NULL){
296
fprintf(stderr, "File name: %s\n", result->file_name);
298
gpgme_recipient_t recipient;
299
recipient = result->recipients;
301
while(recipient != NULL){
302
fprintf(stderr, "Public key algorithm: %s\n",
303
gpgme_pubkey_algo_name(recipient->pubkey_algo));
304
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
305
fprintf(stderr, "Secret key available: %s\n",
306
recipient->status == GPG_ERR_NO_SECKEY
308
recipient = recipient->next;
166
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
170
gpgme_decrypt_result_t result;
171
result = gpgme_op_decrypt_result(ctx);
173
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
175
fprintf(stderr, "Unsupported algorithm: %s\n",
176
result->unsupported_algorithm);
177
fprintf(stderr, "Wrong key usage: %d\n",
178
result->wrong_key_usage);
179
if(result->file_name != NULL){
180
fprintf(stderr, "File name: %s\n", result->file_name);
182
gpgme_recipient_t recipient;
183
recipient = result->recipients;
185
while(recipient != NULL){
186
fprintf(stderr, "Public key algorithm: %s\n",
187
gpgme_pubkey_algo_name(recipient->pubkey_algo));
188
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
189
fprintf(stderr, "Secret key available: %s\n",
190
recipient->status == GPG_ERR_NO_SECKEY
192
recipient = recipient->next;
198
/* Delete the GPGME FILE pointer cryptotext data buffer */
199
gpgme_data_release(dh_crypto);
317
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
201
320
/* Seek back to the beginning of the GPGME plaintext data buffer */
202
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
203
perror("pgpme_data_seek");
321
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
322
perror("gpgme_data_seek");
323
plaintext_length = -1;
208
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
209
*new_packet = realloc(*new_packet,
210
(unsigned int)new_packet_capacity
212
if (*new_packet == NULL){
216
new_packet_capacity += BUFFER_SIZE;
329
plaintext_capacity = adjustbuffer(plaintext,
330
(size_t)plaintext_length,
332
if(plaintext_capacity == 0){
333
perror("adjustbuffer");
334
plaintext_length = -1;
219
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
338
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
221
340
/* Print the data, if any */
226
346
perror("gpgme_data_read");
229
new_packet_length += ret;
232
/* FIXME: check characters before printing to screen so to not print
233
terminal control characters */
235
/* fprintf(stderr, "decrypted password is: "); */
236
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
237
/* fprintf(stderr, "\n"); */
347
plaintext_length = -1;
350
plaintext_length += ret;
354
fprintf(stderr, "Decrypted password is: ");
355
for(ssize_t i = 0; i < plaintext_length; i++){
356
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
358
fprintf(stderr, "\n");
363
/* Delete the GPGME cryptotext data buffer */
364
gpgme_data_release(dh_crypto);
240
366
/* Delete the GPGME plaintext data buffer */
241
367
gpgme_data_release(dh_plain);
242
return new_packet_length;
368
return plaintext_length;
245
static const char * safer_gnutls_strerror (int value) {
246
const char *ret = gnutls_strerror (value);
371
static const char * safer_gnutls_strerror(int value){
372
const char *ret = gnutls_strerror(value); /* Spurious warning from
373
-Wunreachable-code */
248
375
ret = "(unknown)";
252
void debuggnutls(__attribute__((unused)) int level,
254
fprintf(stderr, "%s", string);
379
/* GnuTLS log function callback */
380
static void debuggnutls(__attribute__((unused)) int level,
382
fprintf(stderr, "GnuTLS: %s", string);
257
int initgnutls(encrypted_session *es){
385
static int init_gnutls_global(mandos_context *mc,
386
const char *pubkeyfilename,
387
const char *seckeyfilename){
262
391
fprintf(stderr, "Initializing GnuTLS\n");
265
if ((ret = gnutls_global_init ())
266
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
394
ret = gnutls_global_init();
395
if(ret != GNUTLS_E_SUCCESS){
396
fprintf(stderr, "GnuTLS global_init: %s\n",
397
safer_gnutls_strerror(ret));
402
/* "Use a log level over 10 to enable all debugging options."
272
405
gnutls_global_set_log_level(11);
273
406
gnutls_global_set_log_function(debuggnutls);
276
/* openpgp credentials */
277
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
278
!= GNUTLS_E_SUCCESS) {
279
fprintf (stderr, "memory error: %s\n",
280
safer_gnutls_strerror(ret));
409
/* OpenPGP credentials */
410
gnutls_certificate_allocate_credentials(&mc->cred);
411
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
416
safer_gnutls_strerror(ret));
417
gnutls_global_deinit();
285
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
286
" and keyfile %s as GnuTLS credentials\n", certfile,
422
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
423
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
290
427
ret = gnutls_certificate_set_openpgp_key_file
291
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
292
if (ret != GNUTLS_E_SUCCESS) {
294
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
296
ret, certfile, certkey);
297
fprintf(stdout, "The Error is: %s\n",
298
safer_gnutls_strerror(ret));
302
//GnuTLS server initialization
303
if ((ret = gnutls_dh_params_init (&es->dh_params))
304
!= GNUTLS_E_SUCCESS) {
305
fprintf (stderr, "Error in dh parameter initialization: %s\n",
306
safer_gnutls_strerror(ret));
310
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
311
!= GNUTLS_E_SUCCESS) {
312
fprintf (stderr, "Error in prime generation: %s\n",
313
safer_gnutls_strerror(ret));
317
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
319
// GnuTLS session creation
320
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
321
!= GNUTLS_E_SUCCESS){
428
(mc->cred, pubkeyfilename, seckeyfilename,
429
GNUTLS_OPENPGP_FMT_BASE64);
430
if(ret != GNUTLS_E_SUCCESS){
432
"Error[%d] while reading the OpenPGP key pair ('%s',"
433
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
434
fprintf(stderr, "The GnuTLS error is: %s\n",
435
safer_gnutls_strerror(ret));
439
/* GnuTLS server initialization */
440
ret = gnutls_dh_params_init(&mc->dh_params);
441
if(ret != GNUTLS_E_SUCCESS){
442
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
443
" %s\n", safer_gnutls_strerror(ret));
446
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
447
if(ret != GNUTLS_E_SUCCESS){
448
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
449
safer_gnutls_strerror(ret));
453
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
459
gnutls_certificate_free_credentials(mc->cred);
460
gnutls_global_deinit();
461
gnutls_dh_params_deinit(mc->dh_params);
465
static int init_gnutls_session(mandos_context *mc,
466
gnutls_session_t *session){
468
/* GnuTLS session creation */
469
ret = gnutls_init(session, GNUTLS_SERVER);
470
if(ret != GNUTLS_E_SUCCESS){
322
471
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
323
472
safer_gnutls_strerror(ret));
326
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Syntax error at: %s\n", err);
329
fprintf(stderr, "GnuTLS error: %s\n",
330
safer_gnutls_strerror(ret));
477
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
478
if(ret != GNUTLS_E_SUCCESS){
479
fprintf(stderr, "Syntax error at: %s\n", err);
480
fprintf(stderr, "GnuTLS error: %s\n",
481
safer_gnutls_strerror(ret));
482
gnutls_deinit(*session);
334
if ((ret = gnutls_credentials_set
335
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
336
!= GNUTLS_E_SUCCESS) {
337
fprintf(stderr, "Error setting a credentials set: %s\n",
487
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
489
if(ret != GNUTLS_E_SUCCESS){
490
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
338
491
safer_gnutls_strerror(ret));
492
gnutls_deinit(*session);
342
496
/* ignore client certificate if any. */
343
gnutls_certificate_server_set_request (es->session,
497
gnutls_certificate_server_set_request(*session,
346
gnutls_dh_set_prime_bits (es->session, DH_BITS);
500
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
351
void empty_log(__attribute__((unused)) AvahiLogLevel level,
352
__attribute__((unused)) const char *txt){}
505
/* Avahi log function callback */
506
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
507
__attribute__((unused)) const char *txt){}
354
int start_mandos_communication(const char *ip, uint16_t port,
355
unsigned int if_index){
509
/* Called when a Mandos server is found */
510
static int start_mandos_communication(const char *ip, uint16_t port,
511
AvahiIfIndex if_index,
357
struct sockaddr_in6 to;
358
encrypted_session es;
515
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
359
516
char *buffer = NULL;
360
517
char *decrypted_buffer;
361
518
size_t buffer_length = 0;
362
519
size_t buffer_capacity = 0;
363
520
ssize_t decrypted_buffer_size;
366
523
char interface[IF_NAMESIZE];
524
gnutls_session_t session;
526
ret = init_gnutls_session(mc, &session);
369
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
532
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
372
536
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
374
538
perror("socket");
379
if(if_indextoname(if_index, interface) == NULL){
381
perror("if_indextoname");
543
if(if_indextoname((unsigned int)if_index, interface) == NULL){
544
perror("if_indextoname");
386
547
fprintf(stderr, "Binding to interface %s\n", interface);
389
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
550
memset(&to, 0, sizeof(to));
551
to.in6.sin6_family = AF_INET6;
552
/* It would be nice to have a way to detect if we were passed an
553
IPv4 address here. Now we assume an IPv6 address. */
554
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
393
556
perror("inet_pton");
397
560
fprintf(stderr, "Bad address: %s\n", ip);
400
to.sin6_port = htons(port); /* Spurious warning */
563
to.in6.sin6_port = htons(port); /* Spurious warnings from
565
-Wunreachable-code */
402
to.sin6_scope_id = (uint32_t)if_index;
567
to.in6.sin6_scope_id = (uint32_t)if_index;
405
fprintf(stderr, "Connection to: %s\n", ip);
570
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
572
char addrstr[INET6_ADDRSTRLEN] = "";
573
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
574
sizeof(addrstr)) == NULL){
577
if(strcmp(addrstr, ip) != 0){
578
fprintf(stderr, "Canonical address form: %s\n", addrstr);
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
583
ret = connect(tcp_sd, &to.in, sizeof(to));
410
585
perror("connect");
414
ret = initgnutls (&es);
589
const char *out = mandos_protocol_version;
592
size_t out_size = strlen(out);
593
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
594
out_size - written));
600
written += (size_t)ret;
601
if(written < out_size){
604
if(out == mandos_protocol_version){
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
424
614
fprintf(stderr, "Establishing TLS session with %s\n", ip);
427
ret = gnutls_handshake (es.session);
429
if (ret != GNUTLS_E_SUCCESS){
617
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
620
ret = gnutls_handshake(session);
621
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
623
if(ret != GNUTLS_E_SUCCESS){
431
fprintf(stderr, "\n*** Handshake failed ***\n");
625
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
438
//Retrieve OpenPGP packet that contains the wanted password
632
/* Read OpenPGP packet that contains the wanted password */
441
635
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
452
buffer_capacity += BUFFER_SIZE;
640
buffer_capacity = adjustbuffer(&buffer, buffer_length,
642
if(buffer_capacity == 0){
643
perror("adjustbuffer");
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
648
sret = gnutls_record_recv(session, buffer+buffer_length,
462
655
case GNUTLS_E_INTERRUPTED:
463
656
case GNUTLS_E_AGAIN:
465
658
case GNUTLS_E_REHANDSHAKE:
466
ret = gnutls_handshake (es.session);
468
fprintf(stderr, "\n*** Handshake failed ***\n");
660
ret = gnutls_handshake(session);
661
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
663
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
475
670
fprintf(stderr, "Unknown error while reading data from"
476
" encrypted session with mandos server\n");
671
" encrypted session with Mandos server\n");
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
673
gnutls_bye(session, GNUTLS_SHUT_RDWR);
482
buffer_length += (size_t) ret;
677
buffer_length += (size_t) sret;
486
if (buffer_length > 0){
487
decrypted_buffer_size = pgp_packet_decrypt(buffer,
682
fprintf(stderr, "Closing TLS session\n");
685
gnutls_bye(session, GNUTLS_SHUT_RDWR);
687
if(buffer_length > 0){
688
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
491
if (decrypted_buffer_size >= 0){
492
while(written < (size_t)decrypted_buffer_size){
493
ret = (int)fwrite (decrypted_buffer + written, 1,
494
(size_t)decrypted_buffer_size - written,
691
if(decrypted_buffer_size >= 0){
693
while(written < (size_t) decrypted_buffer_size){
694
ret = (int)fwrite(decrypted_buffer + written, 1,
695
(size_t)decrypted_buffer_size - written,
496
697
if(ret == 0 and ferror(stdout)){
498
699
fprintf(stderr, "Error writing encrypted data: %s\n",
561
757
char ip[AVAHI_ADDRESS_STR_MAX];
562
758
avahi_address_snprint(ip, sizeof(ip), address);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
760
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
761
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
762
ip, (intmax_t)interface, port);
567
int ret = start_mandos_communication(ip, port,
568
(unsigned int) interface);
764
int ret = start_mandos_communication(ip, port, interface, mc);
766
avahi_simple_poll_quit(mc->simple_poll);
574
770
avahi_s_service_resolver_free(r);
577
static void browse_callback(
578
AvahiSServiceBrowser *b,
579
AvahiIfIndex interface,
580
AvahiProtocol protocol,
581
AvahiBrowserEvent event,
585
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
588
AvahiServer *s = userdata;
589
assert(b); /* Spurious warning */
591
/* Called whenever a new services becomes available on the LAN or
592
is removed from the LAN */
596
case AVAHI_BROWSER_FAILURE:
598
fprintf(stderr, "(Browser) %s\n",
599
avahi_strerror(avahi_server_errno(server)));
600
avahi_simple_poll_quit(simple_poll);
603
case AVAHI_BROWSER_NEW:
604
/* We ignore the returned resolver object. In the callback
605
function we free it. If the server is terminated before
606
the callback function is called the server will free
607
the resolver for us. */
609
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
611
AVAHI_PROTO_INET6, 0,
612
resolve_callback, s)))
613
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
614
avahi_strerror(avahi_server_errno(s)));
617
case AVAHI_BROWSER_REMOVE:
620
case AVAHI_BROWSER_ALL_FOR_NOW:
621
case AVAHI_BROWSER_CACHE_EXHAUSTED:
773
static void browse_callback(AvahiSServiceBrowser *b,
774
AvahiIfIndex interface,
775
AvahiProtocol protocol,
776
AvahiBrowserEvent event,
780
AVAHI_GCC_UNUSED AvahiLookupResultFlags
783
mandos_context *mc = userdata;
786
/* Called whenever a new services becomes available on the LAN or
787
is removed from the LAN */
791
case AVAHI_BROWSER_FAILURE:
793
fprintf(stderr, "(Avahi browser) %s\n",
794
avahi_strerror(avahi_server_errno(mc->server)));
795
avahi_simple_poll_quit(mc->simple_poll);
798
case AVAHI_BROWSER_NEW:
799
/* We ignore the returned Avahi resolver object. In the callback
800
function we free it. If the Avahi server is terminated before
801
the callback function is called the Avahi server will free the
804
if(!(avahi_s_service_resolver_new(mc->server, interface,
805
protocol, name, type, domain,
806
AVAHI_PROTO_INET6, 0,
807
resolve_callback, mc)))
808
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
809
name, avahi_strerror(avahi_server_errno(mc->server)));
812
case AVAHI_BROWSER_REMOVE:
815
case AVAHI_BROWSER_ALL_FOR_NOW:
816
case AVAHI_BROWSER_CACHE_EXHAUSTED:
818
fprintf(stderr, "No Mandos server found, still searching...\n");
626
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
627
const char *combinepath(const char *first, const char *second){
629
tmp = malloc(strlen(first) + strlen(second) + 2);
635
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
643
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
644
AvahiServerConfig config;
645
AvahiSServiceBrowser *sb = NULL;
648
int returncode = EXIT_SUCCESS;
649
const char *interface = "eth0";
650
struct ifreq network;
824
int main(int argc, char *argv[]){
825
AvahiSServiceBrowser *sb = NULL;
830
int exitcode = EXIT_SUCCESS;
831
const char *interface = "eth0";
832
struct ifreq network;
836
char *connect_to = NULL;
837
char tempdir[] = "/tmp/mandosXXXXXX";
838
bool tempdir_created = false;
839
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
840
const char *seckey = PATHDIR "/" SECKEY;
841
const char *pubkey = PATHDIR "/" PUBKEY;
843
mandos_context mc = { .simple_poll = NULL, .server = NULL,
844
.dh_bits = 1024, .priority = "SECURE256"
845
":!CTYPE-X.509:+CTYPE-OPENPGP" };
846
bool gnutls_initialized = false;
847
bool gpgme_initialized = false;
851
struct argp_option options[] = {
852
{ .name = "debug", .key = 128,
853
.doc = "Debug mode", .group = 3 },
854
{ .name = "connect", .key = 'c',
855
.arg = "ADDRESS:PORT",
856
.doc = "Connect directly to a specific Mandos server",
858
{ .name = "interface", .key = 'i',
860
.doc = "Interface that will be used to search for Mandos"
863
{ .name = "seckey", .key = 's',
865
.doc = "OpenPGP secret key file base name",
867
{ .name = "pubkey", .key = 'p',
869
.doc = "OpenPGP public key file base name",
871
{ .name = "dh-bits", .key = 129,
873
.doc = "Bit length of the prime number used in the"
874
" Diffie-Hellman key exchange",
876
{ .name = "priority", .key = 130,
878
.doc = "GnuTLS priority string for the TLS handshake",
880
{ .name = "delay", .key = 131,
882
.doc = "Maximum delay to wait for interface startup",
654
static struct option long_options[] = {
655
{"debug", no_argument, (int *)&debug, 1},
656
{"interface", required_argument, 0, 'i'},
657
{"certdir", required_argument, 0, 'd'},
658
{"certkey", required_argument, 0, 'c'},
659
{"certfile", required_argument, 0, 'k'},
662
int option_index = 0;
663
ret = getopt_long (argc, argv, "i:", long_options,
887
error_t parse_opt(int key, char *arg,
888
struct argp_state *state){
890
case 128: /* --debug */
893
case 'c': /* --connect */
896
case 'i': /* --interface */
899
case 's': /* --seckey */
902
case 'p': /* --pubkey */
905
case 129: /* --dh-bits */
906
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
907
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
908
or arg[numchars] != '\0'){
909
fprintf(stderr, "Bad number of DH bits\n");
912
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
914
case 130: /* --priority */
917
case 131: /* --delay */
918
ret = sscanf(arg, "%lf%n", &delay, &numchars);
919
if(ret < 1 or arg[numchars] != '\0'){
920
fprintf(stderr, "Bad delay\n");
929
return ARGP_ERR_UNKNOWN;
690
certfile = combinepath(certdir, certfile);
691
if (certfile == NULL){
692
returncode = EXIT_FAILURE;
696
certkey = combinepath(certdir, certkey);
697
if (certkey == NULL){
698
returncode = EXIT_FAILURE;
934
struct argp argp = { .options = options, .parser = parse_opt,
936
.doc = "Mandos client -- Get and decrypt"
937
" passwords from a Mandos server" };
938
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
939
if(ret == ARGP_ERR_UNKNOWN){
940
fprintf(stderr, "Unknown error while parsing arguments\n");
941
exitcode = EXIT_FAILURE;
946
/* If the interface is down, bring it up */
949
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
950
messages to mess up the prompt */
951
ret = klogctl(8, NULL, 5);
702
957
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
704
959
perror("socket");
705
returncode = EXIT_FAILURE;
960
exitcode = EXIT_FAILURE;
962
ret = klogctl(7, NULL, 0);
708
strcpy(network.ifr_name, interface);
969
strcpy(network.ifr_name, interface);
709
970
ret = ioctl(sd, SIOCGIFFLAGS, &network);
712
972
perror("ioctl SIOCGIFFLAGS");
713
returncode = EXIT_FAILURE;
974
ret = klogctl(7, NULL, 0);
979
exitcode = EXIT_FAILURE;
716
982
if((network.ifr_flags & IFF_UP) == 0){
717
983
network.ifr_flags |= IFF_UP;
718
984
ret = ioctl(sd, SIOCSIFFLAGS, &network);
720
986
perror("ioctl SIOCSIFFLAGS");
721
returncode = EXIT_FAILURE;
728
avahi_set_log_function(empty_log);
731
/* Initialize the psuedo-RNG */
732
srand((unsigned int) time(NULL));
734
/* Allocate main loop object */
735
if (!(simple_poll = avahi_simple_poll_new())) {
736
fprintf(stderr, "Failed to create simple poll object.\n");
737
returncode = EXIT_FAILURE;
741
/* Do not publish any local records */
987
exitcode = EXIT_FAILURE;
989
ret = klogctl(7, NULL, 0);
997
/* sleep checking until interface is running */
998
for(int i=0; i < delay * 4; i++){
999
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1001
perror("ioctl SIOCGIFFLAGS");
1002
} else if(network.ifr_flags & IFF_RUNNING){
1005
struct timespec sleeptime = { .tv_nsec = 250000000 };
1006
ret = nanosleep(&sleeptime, NULL);
1007
if(ret == -1 and errno != EINTR){
1008
perror("nanosleep");
1011
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1016
/* Restores kernel loglevel to default */
1017
ret = klogctl(7, NULL, 0);
1037
ret = init_gnutls_global(&mc, pubkey, seckey);
1039
fprintf(stderr, "init_gnutls_global failed\n");
1040
exitcode = EXIT_FAILURE;
1043
gnutls_initialized = true;
1046
if(mkdtemp(tempdir) == NULL){
1050
tempdir_created = true;
1052
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
1053
fprintf(stderr, "init_gpgme failed\n");
1054
exitcode = EXIT_FAILURE;
1057
gpgme_initialized = true;
1060
if_index = (AvahiIfIndex) if_nametoindex(interface);
1062
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1063
exitcode = EXIT_FAILURE;
1067
if(connect_to != NULL){
1068
/* Connect directly, do not use Zeroconf */
1069
/* (Mainly meant for debugging) */
1070
char *address = strrchr(connect_to, ':');
1071
if(address == NULL){
1072
fprintf(stderr, "No colon in address\n");
1073
exitcode = EXIT_FAILURE;
1077
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1078
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1079
or address[numchars+1] != '\0'){
1080
fprintf(stderr, "Bad port number\n");
1081
exitcode = EXIT_FAILURE;
1084
port = (uint16_t)tmpmax;
1086
address = connect_to;
1087
ret = start_mandos_communication(address, port, if_index, &mc);
1089
exitcode = EXIT_FAILURE;
1091
exitcode = EXIT_SUCCESS;
1097
avahi_set_log_function(empty_log);
1100
/* Initialize the pseudo-RNG for Avahi */
1101
srand((unsigned int) time(NULL));
1103
/* Allocate main Avahi loop object */
1104
mc.simple_poll = avahi_simple_poll_new();
1105
if(mc.simple_poll == NULL){
1106
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1107
exitcode = EXIT_FAILURE;
1112
AvahiServerConfig config;
1113
/* Do not publish any local Zeroconf records */
742
1114
avahi_server_config_init(&config);
743
1115
config.publish_hinfo = 0;
744
1116
config.publish_addresses = 0;
745
1117
config.publish_workstation = 0;
746
1118
config.publish_domain = 0;
748
1120
/* Allocate a new server */
749
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
750
&config, NULL, NULL, &error);
752
/* Free the configuration data */
1121
mc.server = avahi_server_new(avahi_simple_poll_get
1122
(mc.simple_poll), &config, NULL,
1125
/* Free the Avahi configuration data */
753
1126
avahi_server_config_free(&config);
755
/* Check if creating the server object succeeded */
757
fprintf(stderr, "Failed to create server: %s\n",
758
avahi_strerror(error));
759
returncode = EXIT_FAILURE;
763
/* Create the service browser */
764
sb = avahi_s_service_browser_new(server,
766
if_nametoindex(interface),
768
"_mandos._tcp", NULL, 0,
769
browse_callback, server);
771
fprintf(stderr, "Failed to create service browser: %s\n",
772
avahi_strerror(avahi_server_errno(server)));
773
returncode = EXIT_FAILURE;
777
/* Run the main loop */
780
fprintf(stderr, "Starting avahi loop search\n");
783
avahi_simple_poll_loop(simple_poll);
788
fprintf(stderr, "%s exiting\n", argv[0]);
793
avahi_s_service_browser_free(sb);
796
avahi_server_free(server);
799
avahi_simple_poll_free(simple_poll);
1129
/* Check if creating the Avahi server object succeeded */
1130
if(mc.server == NULL){
1131
fprintf(stderr, "Failed to create Avahi server: %s\n",
1132
avahi_strerror(error));
1133
exitcode = EXIT_FAILURE;
1137
/* Create the Avahi service browser */
1138
sb = avahi_s_service_browser_new(mc.server, if_index,
1139
AVAHI_PROTO_INET6, "_mandos._tcp",
1140
NULL, 0, browse_callback, &mc);
1142
fprintf(stderr, "Failed to create service browser: %s\n",
1143
avahi_strerror(avahi_server_errno(mc.server)));
1144
exitcode = EXIT_FAILURE;
1148
/* Run the main loop */
1151
fprintf(stderr, "Starting Avahi loop search\n");
1154
avahi_simple_poll_loop(mc.simple_poll);
1159
fprintf(stderr, "%s exiting\n", argv[0]);
1162
/* Cleanup things */
1164
avahi_s_service_browser_free(sb);
1166
if(mc.server != NULL)
1167
avahi_server_free(mc.server);
1169
if(mc.simple_poll != NULL)
1170
avahi_simple_poll_free(mc.simple_poll);
1172
if(gnutls_initialized){
1173
gnutls_certificate_free_credentials(mc.cred);
1174
gnutls_global_deinit();
1175
gnutls_dh_params_deinit(mc.dh_params);
1178
if(gpgme_initialized){
1179
gpgme_release(mc.ctx);
1182
/* Removes the temp directory used by GPGME */
1183
if(tempdir_created){
1185
struct dirent *direntry;
1186
d = opendir(tempdir);
1188
if(errno != ENOENT){
1193
direntry = readdir(d);
1194
if(direntry == NULL){
1197
/* Skip "." and ".." */
1198
if(direntry->d_name[0] == '.'
1199
and (direntry->d_name[1] == '\0'
1200
or (direntry->d_name[1] == '.'
1201
and direntry->d_name[2] == '\0'))){
1204
char *fullname = NULL;
1205
ret = asprintf(&fullname, "%s/%s", tempdir,
1211
ret = remove(fullname);
1213
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1220
ret = rmdir(tempdir);
1221
if(ret == -1 and errno != ENOENT){