265
302
if ((ret = gnutls_global_init ())
266
303
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
304
fprintf (stderr, "GnuTLS global_init: %s\n",
305
safer_gnutls_strerror(ret));
310
/* "Use a log level over 10 to enable all debugging options."
272
313
gnutls_global_set_log_level(11);
273
314
gnutls_global_set_log_function(debuggnutls);
276
/* openpgp credentials */
277
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
317
/* OpenPGP credentials */
318
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
278
319
!= GNUTLS_E_SUCCESS) {
279
fprintf (stderr, "memory error: %s\n",
320
fprintf (stderr, "GnuTLS memory error: %s\n",
280
321
safer_gnutls_strerror(ret));
285
326
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
286
" and keyfile %s as GnuTLS credentials\n", certfile,
327
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
290
331
ret = gnutls_certificate_set_openpgp_key_file
291
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
332
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
292
333
if (ret != GNUTLS_E_SUCCESS) {
294
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
296
ret, certfile, certkey);
297
fprintf(stdout, "The Error is: %s\n",
335
"Error[%d] while reading the OpenPGP key pair ('%s',"
336
" '%s')\n", ret, pubkeyfile, seckeyfile);
337
fprintf(stdout, "The GnuTLS error is: %s\n",
298
338
safer_gnutls_strerror(ret));
302
//GnuTLS server initialization
303
if ((ret = gnutls_dh_params_init (&es->dh_params))
304
!= GNUTLS_E_SUCCESS) {
305
fprintf (stderr, "Error in dh parameter initialization: %s\n",
306
safer_gnutls_strerror(ret));
310
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
311
!= GNUTLS_E_SUCCESS) {
312
fprintf (stderr, "Error in prime generation: %s\n",
313
safer_gnutls_strerror(ret));
317
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
319
// GnuTLS session creation
320
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
321
!= GNUTLS_E_SUCCESS){
342
/* GnuTLS server initialization */
343
ret = gnutls_dh_params_init(&mc->dh_params);
344
if (ret != GNUTLS_E_SUCCESS) {
345
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
346
" %s\n", safer_gnutls_strerror(ret));
349
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
350
if (ret != GNUTLS_E_SUCCESS) {
351
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
352
safer_gnutls_strerror(ret));
356
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
361
static int init_gnutls_session(mandos_context *mc,
362
gnutls_session_t *session){
364
/* GnuTLS session creation */
365
ret = gnutls_init(session, GNUTLS_SERVER);
366
if (ret != GNUTLS_E_SUCCESS){
322
367
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
323
368
safer_gnutls_strerror(ret));
326
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Syntax error at: %s\n", err);
329
fprintf(stderr, "GnuTLS error: %s\n",
330
safer_gnutls_strerror(ret));
373
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
374
if (ret != GNUTLS_E_SUCCESS) {
375
fprintf(stderr, "Syntax error at: %s\n", err);
376
fprintf(stderr, "GnuTLS error: %s\n",
377
safer_gnutls_strerror(ret));
334
if ((ret = gnutls_credentials_set
335
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
336
!= GNUTLS_E_SUCCESS) {
337
fprintf(stderr, "Error setting a credentials set: %s\n",
382
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
384
if (ret != GNUTLS_E_SUCCESS) {
385
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
338
386
safer_gnutls_strerror(ret));
342
390
/* ignore client certificate if any. */
343
gnutls_certificate_server_set_request (es->session,
391
gnutls_certificate_server_set_request (*session,
344
392
GNUTLS_CERT_IGNORE);
346
gnutls_dh_set_prime_bits (es->session, DH_BITS);
394
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
351
void empty_log(__attribute__((unused)) AvahiLogLevel level,
352
__attribute__((unused)) const char *txt){}
399
/* Avahi log function callback */
400
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
401
__attribute__((unused)) const char *txt){}
354
int start_mandos_communication(const char *ip, uint16_t port,
355
unsigned int if_index){
403
/* Called when a Mandos server is found */
404
static int start_mandos_communication(const char *ip, uint16_t port,
405
AvahiIfIndex if_index,
357
struct sockaddr_in6 to;
358
encrypted_session es;
408
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
359
409
char *buffer = NULL;
360
410
char *decrypted_buffer;
361
411
size_t buffer_length = 0;
362
412
size_t buffer_capacity = 0;
363
413
ssize_t decrypted_buffer_size;
366
416
char interface[IF_NAMESIZE];
417
gnutls_session_t session;
419
ret = init_gnutls_session (mc, &session);
369
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
425
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
372
429
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
379
if(if_indextoname(if_index, interface) == NULL){
381
perror("if_indextoname");
436
if(if_indextoname((unsigned int)if_index, interface) == NULL){
437
perror("if_indextoname");
386
440
fprintf(stderr, "Binding to interface %s\n", interface);
389
443
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
444
to.in6.sin6_family = AF_INET6;
445
/* It would be nice to have a way to detect if we were passed an
446
IPv4 address here. Now we assume an IPv6 address. */
447
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
393
449
perror("inet_pton");
397
453
fprintf(stderr, "Bad address: %s\n", ip);
400
to.sin6_port = htons(port); /* Spurious warning */
456
to.in6.sin6_port = htons(port); /* Spurious warning */
402
to.sin6_scope_id = (uint32_t)if_index;
458
to.in6.sin6_scope_id = (uint32_t)if_index;
405
fprintf(stderr, "Connection to: %s\n", ip);
461
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
462
char addrstr[INET6_ADDRSTRLEN] = "";
463
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
464
sizeof(addrstr)) == NULL){
467
if(strcmp(addrstr, ip) != 0){
468
fprintf(stderr, "Canonical address form: %s\n", addrstr);
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
473
ret = connect(tcp_sd, &to.in, sizeof(to));
410
475
perror("connect");
414
ret = initgnutls (&es);
479
const char *out = mandos_protocol_version;
482
size_t out_size = strlen(out);
483
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
484
out_size - written));
490
written += (size_t)ret;
491
if(written < out_size){
494
if (out == mandos_protocol_version){
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
424
504
fprintf(stderr, "Establishing TLS session with %s\n", ip);
427
ret = gnutls_handshake (es.session);
507
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
509
ret = gnutls_handshake (session);
429
511
if (ret != GNUTLS_E_SUCCESS){
431
fprintf(stderr, "\n*** Handshake failed ***\n");
513
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
432
514
gnutls_perror (ret);
438
//Retrieve OpenPGP packet that contains the wanted password
520
/* Read OpenPGP packet that contains the wanted password */
441
523
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
574
653
avahi_s_service_resolver_free(r);
577
static void browse_callback(
578
AvahiSServiceBrowser *b,
579
AvahiIfIndex interface,
580
AvahiProtocol protocol,
581
AvahiBrowserEvent event,
585
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
588
AvahiServer *s = userdata;
589
assert(b); /* Spurious warning */
591
/* Called whenever a new services becomes available on the LAN or
592
is removed from the LAN */
596
case AVAHI_BROWSER_FAILURE:
598
fprintf(stderr, "(Browser) %s\n",
599
avahi_strerror(avahi_server_errno(server)));
600
avahi_simple_poll_quit(simple_poll);
603
case AVAHI_BROWSER_NEW:
604
/* We ignore the returned resolver object. In the callback
605
function we free it. If the server is terminated before
606
the callback function is called the server will free
607
the resolver for us. */
609
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
611
AVAHI_PROTO_INET6, 0,
612
resolve_callback, s)))
613
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
614
avahi_strerror(avahi_server_errno(s)));
617
case AVAHI_BROWSER_REMOVE:
620
case AVAHI_BROWSER_ALL_FOR_NOW:
621
case AVAHI_BROWSER_CACHE_EXHAUSTED:
656
static void browse_callback( AvahiSServiceBrowser *b,
657
AvahiIfIndex interface,
658
AvahiProtocol protocol,
659
AvahiBrowserEvent event,
663
AVAHI_GCC_UNUSED AvahiLookupResultFlags
666
mandos_context *mc = userdata;
667
assert(b); /* Spurious warning */
669
/* Called whenever a new services becomes available on the LAN or
670
is removed from the LAN */
674
case AVAHI_BROWSER_FAILURE:
676
fprintf(stderr, "(Avahi browser) %s\n",
677
avahi_strerror(avahi_server_errno(mc->server)));
678
avahi_simple_poll_quit(mc->simple_poll);
681
case AVAHI_BROWSER_NEW:
682
/* We ignore the returned Avahi resolver object. In the callback
683
function we free it. If the Avahi server is terminated before
684
the callback function is called the Avahi server will free the
687
if (!(avahi_s_service_resolver_new(mc->server, interface,
688
protocol, name, type, domain,
689
AVAHI_PROTO_INET6, 0,
690
resolve_callback, mc)))
691
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
692
name, avahi_strerror(avahi_server_errno(mc->server)));
695
case AVAHI_BROWSER_REMOVE:
698
case AVAHI_BROWSER_ALL_FOR_NOW:
699
case AVAHI_BROWSER_CACHE_EXHAUSTED:
701
fprintf(stderr, "No Mandos server found, still searching...\n");
626
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
627
const char *combinepath(const char *first, const char *second){
629
tmp = malloc(strlen(first) + strlen(second) + 2);
707
/* Combines file name and path and returns the malloced new
708
string. some sane checks could/should be added */
709
static const char *combinepath(const char *first, const char *second){
710
size_t f_len = strlen(first);
711
size_t s_len = strlen(second);
712
char *tmp = malloc(f_len + s_len + 2);
630
713
if (tmp == NULL){
635
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
717
memcpy(tmp, first, f_len); /* Spurious warning */
721
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
723
tmp[f_len + 1 + s_len] = '\0';
643
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
644
AvahiServerConfig config;
728
int main(int argc, char *argv[]){
645
729
AvahiSServiceBrowser *sb = NULL;
648
int returncode = EXIT_SUCCESS;
732
int exitcode = EXIT_SUCCESS;
649
733
const char *interface = "eth0";
650
734
struct ifreq network;
654
static struct option long_options[] = {
655
{"debug", no_argument, (int *)&debug, 1},
656
{"interface", required_argument, 0, 'i'},
657
{"certdir", required_argument, 0, 'd'},
658
{"certkey", required_argument, 0, 'c'},
659
{"certfile", required_argument, 0, 'k'},
662
int option_index = 0;
663
ret = getopt_long (argc, argv, "i:", long_options,
690
certfile = combinepath(certdir, certfile);
691
if (certfile == NULL){
692
returncode = EXIT_FAILURE;
696
certkey = combinepath(certdir, certkey);
697
if (certkey == NULL){
698
returncode = EXIT_FAILURE;
702
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
705
returncode = EXIT_FAILURE;
708
strcpy(network.ifr_name, interface);
709
ret = ioctl(sd, SIOCGIFFLAGS, &network);
712
perror("ioctl SIOCGIFFLAGS");
713
returncode = EXIT_FAILURE;
716
if((network.ifr_flags & IFF_UP) == 0){
717
network.ifr_flags |= IFF_UP;
718
ret = ioctl(sd, SIOCSIFFLAGS, &network);
738
char *connect_to = NULL;
739
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
740
const char *pubkeyfile = "pubkey.txt";
741
const char *seckeyfile = "seckey.txt";
742
mandos_context mc = { .simple_poll = NULL, .server = NULL,
743
.dh_bits = 1024, .priority = "SECURE256"};
746
struct argp_option options[] = {
747
{ .name = "debug", .key = 128,
748
.doc = "Debug mode", .group = 3 },
749
{ .name = "connect", .key = 'c',
751
.doc = "Connect directly to a sepcified mandos server",
753
{ .name = "interface", .key = 'i',
755
.doc = "Interface that Avahi will conntect through",
757
{ .name = "keydir", .key = 'd',
759
.doc = "Directory where the openpgp keyring is",
761
{ .name = "seckey", .key = 's',
763
.doc = "Secret openpgp key for gnutls authentication",
765
{ .name = "pubkey", .key = 'p',
767
.doc = "Public openpgp key for gnutls authentication",
769
{ .name = "dh-bits", .key = 129,
771
.doc = "dh-bits to use in gnutls communication",
773
{ .name = "priority", .key = 130,
775
.doc = "GNUTLS priority", .group = 1 },
780
error_t parse_opt (int key, char *arg,
781
struct argp_state *state) {
782
/* Get the INPUT argument from `argp_parse', which we know is
783
a pointer to our plugin list pointer. */
805
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
820
return ARGP_ERR_UNKNOWN;
825
struct argp argp = { .options = options, .parser = parse_opt,
827
.doc = "Mandos client -- Get and decrypt"
828
" passwords from mandos server" };
829
argp_parse (&argp, argc, argv, 0, 0, NULL);
832
pubkeyfile = combinepath(keydir, pubkeyfile);
833
if (pubkeyfile == NULL){
834
perror("combinepath");
835
exitcode = EXIT_FAILURE;
839
seckeyfile = combinepath(keydir, seckeyfile);
840
if (seckeyfile == NULL){
841
perror("combinepath");
845
ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);
847
fprintf(stderr, "init_gnutls_global\n");
864
if_index = (AvahiIfIndex) if_nametoindex(interface);
866
fprintf(stderr, "No such interface: \"%s\"\n", interface);
870
if(connect_to != NULL){
871
/* Connect directly, do not use Zeroconf */
872
/* (Mainly meant for debugging) */
873
char *address = strrchr(connect_to, ':');
875
fprintf(stderr, "No colon in address\n");
876
exitcode = EXIT_FAILURE;
880
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
882
perror("Bad port number");
883
exitcode = EXIT_FAILURE;
887
address = connect_to;
888
ret = start_mandos_communication(address, port, if_index, &mc);
890
exitcode = EXIT_FAILURE;
892
exitcode = EXIT_SUCCESS;
897
/* If the interface is down, bring it up */
899
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
902
exitcode = EXIT_FAILURE;
905
strcpy(network.ifr_name, interface); /* Spurious warning */
906
ret = ioctl(sd, SIOCGIFFLAGS, &network);
720
perror("ioctl SIOCSIFFLAGS");
721
returncode = EXIT_FAILURE;
908
perror("ioctl SIOCGIFFLAGS");
909
exitcode = EXIT_FAILURE;
912
if((network.ifr_flags & IFF_UP) == 0){
913
network.ifr_flags |= IFF_UP;
914
ret = ioctl(sd, SIOCSIFFLAGS, &network);
916
perror("ioctl SIOCSIFFLAGS");
917
exitcode = EXIT_FAILURE;
728
925
avahi_set_log_function(empty_log);
731
/* Initialize the psuedo-RNG */
928
/* Initialize the pseudo-RNG for Avahi */
732
929
srand((unsigned int) time(NULL));
734
/* Allocate main loop object */
735
if (!(simple_poll = avahi_simple_poll_new())) {
736
fprintf(stderr, "Failed to create simple poll object.\n");
737
returncode = EXIT_FAILURE;
741
/* Do not publish any local records */
742
avahi_server_config_init(&config);
743
config.publish_hinfo = 0;
744
config.publish_addresses = 0;
745
config.publish_workstation = 0;
746
config.publish_domain = 0;
748
/* Allocate a new server */
749
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
750
&config, NULL, NULL, &error);
752
/* Free the configuration data */
753
avahi_server_config_free(&config);
755
/* Check if creating the server object succeeded */
757
fprintf(stderr, "Failed to create server: %s\n",
931
/* Allocate main Avahi loop object */
932
mc.simple_poll = avahi_simple_poll_new();
933
if (mc.simple_poll == NULL) {
934
fprintf(stderr, "Avahi: Failed to create simple poll"
936
exitcode = EXIT_FAILURE;
941
AvahiServerConfig config;
942
/* Do not publish any local Zeroconf records */
943
avahi_server_config_init(&config);
944
config.publish_hinfo = 0;
945
config.publish_addresses = 0;
946
config.publish_workstation = 0;
947
config.publish_domain = 0;
949
/* Allocate a new server */
950
mc.server = avahi_server_new(avahi_simple_poll_get
951
(mc.simple_poll), &config, NULL,
954
/* Free the Avahi configuration data */
955
avahi_server_config_free(&config);
958
/* Check if creating the Avahi server object succeeded */
959
if (mc.server == NULL) {
960
fprintf(stderr, "Failed to create Avahi server: %s\n",
758
961
avahi_strerror(error));
759
returncode = EXIT_FAILURE;
962
exitcode = EXIT_FAILURE;
763
/* Create the service browser */
764
sb = avahi_s_service_browser_new(server,
766
if_nametoindex(interface),
966
/* Create the Avahi service browser */
967
sb = avahi_s_service_browser_new(mc.server, if_index,
767
968
AVAHI_PROTO_INET6,
768
969
"_mandos._tcp", NULL, 0,
769
browse_callback, server);
970
browse_callback, &mc);
771
972
fprintf(stderr, "Failed to create service browser: %s\n",
772
avahi_strerror(avahi_server_errno(server)));
773
returncode = EXIT_FAILURE;
973
avahi_strerror(avahi_server_errno(mc.server)));
974
exitcode = EXIT_FAILURE;
777
978
/* Run the main loop */
780
fprintf(stderr, "Starting avahi loop search\n");
981
fprintf(stderr, "Starting Avahi loop search\n");
783
avahi_simple_poll_loop(simple_poll);
984
avahi_simple_poll_loop(mc.simple_poll);
788
989
fprintf(stderr, "%s exiting\n", argv[0]);
791
992
/* Cleanup things */
793
994
avahi_s_service_browser_free(sb);
796
avahi_server_free(server);
996
if (mc.server != NULL)
997
avahi_server_free(mc.server);
799
avahi_simple_poll_free(simple_poll);
999
if (mc.simple_poll != NULL)
1000
avahi_simple_poll_free(mc.simple_poll);