/mandos/trunk : revision 24.1.25

32

#define _LARGEFILE_SOURCE

33

#define _FILE_OFFSET_BITS 64

34

35

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */

36

35

37

#include <stdio.h>

36

38

#include <assert.h>

37

39

#include <stdlib.h>

38

40

#include <time.h>

39

41

#include <net/if.h> /* if_nametoindex */

40

#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS

41

#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS

42

#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

43

SIOCSIFFLAGS */

44

#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,

45

SIOCSIFFLAGS */

42

46

43

47

#include <avahi-core/core.h>

44

48

#include <avahi-core/lookup.h>

47

51

#include <avahi-common/malloc.h>

48

52

#include <avahi-common/error.h>

49

53

50

//mandos client part

54

/* Mandos client part */

51

55

#include <sys/types.h> /* socket(), inet_pton() */

52

56

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

53

57

struct in6_addr, inet_pton() */

60

64

#include <string.h> /* memset */

61

65

#include <arpa/inet.h> /* inet_pton() */

62

66

#include <iso646.h> /* not */

63

64

// gpgme

67

#include <net/if.h> /* IF_NAMESIZE */

68

#include <argp.h> /* struct argp_option,

69

struct argp_state, struct argp,

70

argp_parse() */

71

/* GPGME */

65

72

#include <errno.h> /* perror() */

66

73

#include <gpgme.h>

67

74

68

// getopt long

69

#include <getopt.h>

70

71

75

#define BUFFER_SIZE 256

72

#define DH_BITS 1024

73

74

static const char *certdir = "/conf/conf.d/mandos";

75

static const char *certfile = "openpgp-client.txt";

76

static const char *certkey = "openpgp-client-key.txt";

77

76

78

77

bool debug = false;

78

static const char *keydir = "/conf/conf.d/mandos";

79

static const char mandos_protocol_version[] = "1";

80

const char *argp_program_version = "mandosclient 0.9";

81

const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";

79

82

83

/* Used for passing in values through the Avahi callback functions */

80

84

typedef struct {

81

85

AvahiSimplePoll *simple_poll;

82

86

AvahiServer *server;

83

87

gnutls_certificate_credentials_t cred;

84

88

unsigned int dh_bits;

89

gnutls_dh_params_t dh_params;

85

90

const char *priority;

86

91

} mandos_context;

87

92

88

static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,

89

char **new_packet,

93

/*

94

* Make room in "buffer" for at least BUFFER_SIZE additional bytes.

95

* "buffer_capacity" is how much is currently allocated,

96

* "buffer_length" is how much is already used.

97

*/

98

size_t adjustbuffer(char **buffer, size_t buffer_length,

99

size_t buffer_capacity){

100

if (buffer_length + BUFFER_SIZE > buffer_capacity){

101

*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);

102

if (buffer == NULL){

103

return 0;

104

}

105

buffer_capacity += BUFFER_SIZE;

106

}

107

return buffer_capacity;

108

}

109

110

/*

111

* Decrypt OpenPGP data using keyrings in HOMEDIR.

112

* Returns -1 on error

113

*/

114

static ssize_t pgp_packet_decrypt (const char *cryptotext,

115

size_t crypto_size,

116

char **plaintext,

90

117

const char *homedir){

91

118

gpgme_data_t dh_crypto, dh_plain;

92

119

gpgme_ctx_t ctx;

93

120

gpgme_error_t rc;

94

121

ssize_t ret;

95

ssize_t new_packet_capacity = 0;

96

ssize_t new_packet_length = 0;

122

size_t plaintext_capacity = 0;

123

ssize_t plaintext_length = 0;

97

124

gpgme_engine_info_t engine_info;

98

125

99

126

if (debug){

100

fprintf(stderr, "Trying to decrypt OpenPGP packet\n");

127

fprintf(stderr, "Trying to decrypt OpenPGP data\n");

101

128

}

102

129

103

130

/* Init GPGME */

109

136

return -1;

110

137

}

111

138

112

/* Set GPGME home directory */

139

/* Set GPGME home directory for the OpenPGP engine only */

113

140

rc = gpgme_get_engine_info (&engine_info);

114

141

if (rc != GPG_ERR_NO_ERROR){

115

142

fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",

125

152

engine_info = engine_info->next;

126

153

}

127

154

if(engine_info == NULL){

128

fprintf(stderr, "Could not set home dir to %s\n", homedir);

155

fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);

129

156

return -1;

130

157

}

131

158

132

/* Create new GPGME data buffer from packet buffer */

133

rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);

159

/* Create new GPGME data buffer from memory cryptotext */

160

rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,

161

0);

134

162

if (rc != GPG_ERR_NO_ERROR){

135

163

fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",

136

164

gpgme_strsource(rc), gpgme_strerror(rc));

142

170

if (rc != GPG_ERR_NO_ERROR){

143

171

fprintf(stderr, "bad gpgme_data_new: %s: %s\n",

144

172

gpgme_strsource(rc), gpgme_strerror(rc));

173

gpgme_data_release(dh_crypto);

145

174

return -1;

146

175

}

147

176

150

179

if (rc != GPG_ERR_NO_ERROR){

151

180

fprintf(stderr, "bad gpgme_new: %s: %s\n",

152

181

gpgme_strsource(rc), gpgme_strerror(rc));

153

return -1;

182

plaintext_length = -1;

183

goto decrypt_end;

154

184

}

155

185

156

/* Decrypt data from the FILE pointer to the plaintext data

157

buffer */

186

/* Decrypt data from the cryptotext data buffer to the plaintext

187

data buffer */

158

188

rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);

159

189

if (rc != GPG_ERR_NO_ERROR){

160

190

fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",

161

191

gpgme_strsource(rc), gpgme_strerror(rc));

162

return -1;

192

plaintext_length = -1;

193

goto decrypt_end;

163

194

}

164

195

165

196

if(debug){

166

fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");

197

fprintf(stderr, "Decryption of OpenPGP data succeeded\n");

167

198

}

168

199

169

200

if (debug){

170

201

gpgme_decrypt_result_t result;

171

202

result = gpgme_op_decrypt_result(ctx);

195

226

}

196

227

}

197

228

198

/* Delete the GPGME FILE pointer cryptotext data buffer */

199

gpgme_data_release(dh_crypto);

200

201

229

/* Seek back to the beginning of the GPGME plaintext data buffer */

202

230

if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){

203

231

perror("pgpme_data_seek");

232

plaintext_length = -1;

233

goto decrypt_end;

204

234

}

205

235

206

*new_packet = 0;

236

*plaintext = NULL;

207

237

while(true){

208

if (new_packet_length + BUFFER_SIZE > new_packet_capacity){

209

*new_packet = realloc(*new_packet,

210

(unsigned int)new_packet_capacity

211

+ BUFFER_SIZE);

212

if (*new_packet == NULL){

213

perror("realloc");

214

return -1;

215

}

216

new_packet_capacity += BUFFER_SIZE;

238

plaintext_capacity = adjustbuffer(plaintext,

239

(size_t)plaintext_length,

240

plaintext_capacity);

241

if (plaintext_capacity == 0){

242

perror("adjustbuffer");

243

plaintext_length = -1;

244

goto decrypt_end;

217

245

}

218

246

219

ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,

247

ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,

220

248

BUFFER_SIZE);

221

249

/* Print the data, if any */

222

250

if (ret == 0){

251

/* EOF */

223

252

break;

224

253

}

225

254

if(ret < 0){

226

255

perror("gpgme_data_read");

227

return -1;

256

plaintext_length = -1;

257

goto decrypt_end;

228

258

}

229

new_packet_length += ret;

259

plaintext_length += ret;

230

260

}

231

261

232

/* FIXME: check characters before printing to screen so to not print

233

terminal control characters */

234

/* if(debug){ */

235

/* fprintf(stderr, "decrypted password is: "); */

236

/* fwrite(*new_packet, 1, new_packet_length, stderr); */

237

/* fprintf(stderr, "\n"); */

238

/* } */

262

if(debug){

263

fprintf(stderr, "Decrypted password is: ");

264

for(ssize_t i = 0; i < plaintext_length; i++){

265

fprintf(stderr, "%02hhX ", (*plaintext)[i]);

266

}

267

fprintf(stderr, "\n");

268

}

269

270

decrypt_end:

271

272

/* Delete the GPGME cryptotext data buffer */

273

gpgme_data_release(dh_crypto);

239

274

240

275

/* Delete the GPGME plaintext data buffer */

241

276

gpgme_data_release(dh_plain);

242

return new_packet_length;

277

return plaintext_length;

243

278

}

244

279

245

280

static const char * safer_gnutls_strerror (int value) {

249

284

return ret;

250

285

}

251

286

287

/* GnuTLS log function callback */

252

288

static void debuggnutls(__attribute__((unused)) int level,

253

289

const char* string){

254

fprintf(stderr, "%s", string);

290

fprintf(stderr, "GnuTLS: %s", string);

255

291

}

256

292

257

static int initgnutls(mandos_context *mc){

258

const char *err;

293

static int init_gnutls_global(mandos_context *mc,

294

const char *pubkeyfile,

295

const char *seckeyfile){

259

296

int ret;

260

297

261

298

if(debug){

264

301

265

302

if ((ret = gnutls_global_init ())

266

303

!= GNUTLS_E_SUCCESS) {

267

fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));

304

fprintf (stderr, "GnuTLS global_init: %s\n",

305

safer_gnutls_strerror(ret));

268

306

return -1;

269

307

}

270

308

271

309

if (debug){

310

/* "Use a log level over 10 to enable all debugging options."

311

* - GnuTLS manual

312

*/

272

313

gnutls_global_set_log_level(11);

273

314

gnutls_global_set_log_function(debuggnutls);

274

315

}

275

316

276

/* openpgp credentials */

277

if ((ret = gnutls_certificate_allocate_credentials (&es->cred))

317

/* OpenPGP credentials */

318

if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))

278

319

!= GNUTLS_E_SUCCESS) {

279

fprintf (stderr, "memory error: %s\n",

320

fprintf (stderr, "GnuTLS memory error: %s\n",

280

321

safer_gnutls_strerror(ret));

322

gnutls_global_deinit ();

281

323

return -1;

282

324

}

283

325

284

326

if(debug){

285

327

fprintf(stderr, "Attempting to use OpenPGP certificate %s"

286

" and keyfile %s as GnuTLS credentials\n", certfile,

287

certkey);

328

" and keyfile %s as GnuTLS credentials\n", pubkeyfile,

329

seckeyfile);

288

330

}

289

331

290

332

ret = gnutls_certificate_set_openpgp_key_file

291

(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);

333

(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);

292

334

if (ret != GNUTLS_E_SUCCESS) {

293

fprintf

294

(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"

295

" '%s')\n",

296

ret, certfile, certkey);

297

fprintf(stdout, "The Error is: %s\n",

335

fprintf(stderr,

336

"Error[%d] while reading the OpenPGP key pair ('%s',"

337

" '%s')\n", ret, pubkeyfile, seckeyfile);

338

fprintf(stdout, "The GnuTLS error is: %s\n",

298

339

safer_gnutls_strerror(ret));

299

return -1;

300

}

301

302

//GnuTLS server initialization

303

if ((ret = gnutls_dh_params_init (&es->dh_params))

304

!= GNUTLS_E_SUCCESS) {

305

fprintf (stderr, "Error in dh parameter initialization: %s\n",

306

safer_gnutls_strerror(ret));

307

return -1;

308

}

309

310

if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))

311

!= GNUTLS_E_SUCCESS) {

312

fprintf (stderr, "Error in prime generation: %s\n",

313

safer_gnutls_strerror(ret));

314

return -1;

315

}

316

317

gnutls_certificate_set_dh_params (es->cred, es->dh_params);

318

319

// GnuTLS session creation

320

if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))

321

!= GNUTLS_E_SUCCESS){

340

goto globalfail;

341

}

342

343

/* GnuTLS server initialization */

344

ret = gnutls_dh_params_init(&mc->dh_params);

345

if (ret != GNUTLS_E_SUCCESS) {

346

fprintf (stderr, "Error in GnuTLS DH parameter initialization:"

347

" %s\n", safer_gnutls_strerror(ret));

348

goto globalfail;

349

}

350

ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);

351

if (ret != GNUTLS_E_SUCCESS) {

352

fprintf (stderr, "Error in GnuTLS prime generation: %s\n",

353

safer_gnutls_strerror(ret));

354

goto globalfail;

355

}

356

357

gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);

358

359

return 0;

360

361

globalfail:

362

363

gnutls_certificate_free_credentials (mc->cred);

364

gnutls_global_deinit ();

365

return -1;

366

367

}

368

369

static int init_gnutls_session(mandos_context *mc,

370

gnutls_session_t *session){

371

int ret;

372

/* GnuTLS session creation */

373

ret = gnutls_init(session, GNUTLS_SERVER);

374

if (ret != GNUTLS_E_SUCCESS){

322

375

fprintf(stderr, "Error in GnuTLS session initialization: %s\n",

323

376

safer_gnutls_strerror(ret));

324

377

}

325

378

326

if ((ret = gnutls_priority_set_direct (es->session, mc->priority, &err))

327

!= GNUTLS_E_SUCCESS) {

328

fprintf(stderr, "Syntax error at: %s\n", err);

329

fprintf(stderr, "GnuTLS error: %s\n",

330

safer_gnutls_strerror(ret));

331

return -1;

379

{

380

const char *err;

381

ret = gnutls_priority_set_direct(*session, mc->priority, &err);

382

if (ret != GNUTLS_E_SUCCESS) {

383

fprintf(stderr, "Syntax error at: %s\n", err);

384

fprintf(stderr, "GnuTLS error: %s\n",

385

safer_gnutls_strerror(ret));

386

gnutls_deinit (*session);

387

return -1;

388

}

332

389

}

333

390

334

if ((ret = gnutls_credentials_set

335

(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))

336

!= GNUTLS_E_SUCCESS) {

337

fprintf(stderr, "Error setting a credentials set: %s\n",

391

ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,

392

mc->cred);

393

if (ret != GNUTLS_E_SUCCESS) {

394

fprintf(stderr, "Error setting GnuTLS credentials: %s\n",

338

395

safer_gnutls_strerror(ret));

396

gnutls_deinit (*session);

339

397

return -1;

340

398

}

341

399

342

400

/* ignore client certificate if any. */

343

gnutls_certificate_server_set_request (es->session,

401

gnutls_certificate_server_set_request (*session,

344

402

GNUTLS_CERT_IGNORE);

345

403

346

gnutls_dh_set_prime_bits (es->session, DH_BITS);

404

gnutls_dh_set_prime_bits (*session, mc->dh_bits);

347

405

348

406

return 0;

349

407

}

350

408

409

/* Avahi log function callback */

351

410

static void empty_log(__attribute__((unused)) AvahiLogLevel level,

352

411

__attribute__((unused)) const char *txt){}

353

412

413

/* Called when a Mandos server is found */

354

414

static int start_mandos_communication(const char *ip, uint16_t port,

355

415

AvahiIfIndex if_index,

356

416

mandos_context *mc){

357

417

int ret, tcp_sd;

358

struct sockaddr_in6 to;

359

encrypted_session es;

418

union { struct sockaddr in; struct sockaddr_in6 in6; } to;

360

419

char *buffer = NULL;

361

420

char *decrypted_buffer;

362

421

size_t buffer_length = 0;

363

422

size_t buffer_capacity = 0;

364

423

ssize_t decrypted_buffer_size;

365

size_t written = 0;

424

size_t written;

366

425

int retval = 0;

367

426

char interface[IF_NAMESIZE];

427

gnutls_session_t session;

428

429

ret = init_gnutls_session (mc, &session);

430

if (ret != 0){

431

return -1;

432

}

368

433

369

434

if(debug){

370

435

fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",

379

444

380

445

if(debug){

381

446

if(if_indextoname((unsigned int)if_index, interface) == NULL){

382

if(debug){

383

perror("if_indextoname");

384

}

447

perror("if_indextoname");

385

448

return -1;

386

449

}

387

388

450

fprintf(stderr, "Binding to interface %s\n", interface);

389

451

}

390

452

391

453

memset(&to,0,sizeof(to)); /* Spurious warning */

392

to.sin6_family = AF_INET6;

393

ret = inet_pton(AF_INET6, ip, &to.sin6_addr);

454

to.in6.sin6_family = AF_INET6;

455

/* It would be nice to have a way to detect if we were passed an

456

IPv4 address here. Now we assume an IPv6 address. */

457

ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);

394

458

if (ret < 0 ){

395

459

perror("inet_pton");

396

460

return -1;

397

}

461

}

398

462

if(ret == 0){

399

463

fprintf(stderr, "Bad address: %s\n", ip);

400

464

return -1;

401

465

}

402

to.sin6_port = htons(port); /* Spurious warning */

466

to.in6.sin6_port = htons(port); /* Spurious warning */

403

467

404

to.sin6_scope_id = (uint32_t)if_index;

468

to.in6.sin6_scope_id = (uint32_t)if_index;

405

469

406

470

if(debug){

407

471

fprintf(stderr, "Connection to: %s, port %d\n", ip, port);

408

/* char addrstr[INET6_ADDRSTRLEN]; */

409

/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */

410

/* sizeof(addrstr)) == NULL){ */

411

/* perror("inet_ntop"); */

412

/* } else { */

413

/* fprintf(stderr, "Really connecting to: %s, port %d\n", */

414

/* addrstr, ntohs(to.sin6_port)); */

415

/* } */

472

char addrstr[INET6_ADDRSTRLEN] = "";

473

if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,

474

sizeof(addrstr)) == NULL){

475

perror("inet_ntop");

476

} else {

477

if(strcmp(addrstr, ip) != 0){

478

fprintf(stderr, "Canonical address form: %s\n", addrstr);

479

}

480

}

416

481

}

417

482

418

ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));

483

ret = connect(tcp_sd, &to.in, sizeof(to));

419

484

if (ret < 0){

420

485

perror("connect");

421

486

return -1;

422

487

}

423

424

ret = initgnutls (&es);

425

if (ret != 0){

426

retval = -1;

427

return -1;

488

489

const char *out = mandos_protocol_version;

490

written = 0;

491

while (true){

492

size_t out_size = strlen(out);

493

ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,

494

out_size - written));

495

if (ret == -1){

496

perror("write");

497

retval = -1;

498

goto mandos_end;

499

}

500

written += (size_t)ret;

501

if(written < out_size){

502

continue;

503

} else {

504

if (out == mandos_protocol_version){

505

written = 0;

506

out = "\r\n";

507

} else {

508

break;

509

}

510

}

428

511

}

429

430

gnutls_transport_set_ptr (es.session,

431

(gnutls_transport_ptr_t) tcp_sd);

432

512

433

513

if(debug){

434

514

fprintf(stderr, "Establishing TLS session with %s\n", ip);

435

515

}

436

516

437

ret = gnutls_handshake (es.session);

517

gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);

518

519

ret = gnutls_handshake (session);

438

520

439

521

if (ret != GNUTLS_E_SUCCESS){

440

522

if(debug){

441

fprintf(stderr, "\n*** Handshake failed ***\n");

523

fprintf(stderr, "*** GnuTLS Handshake failed ***\n");

442

524

gnutls_perror (ret);

443

525

}

444

526

retval = -1;

445

goto exit;

527

goto mandos_end;

446

528

}

447

529

448

//Retrieve OpenPGP packet that contains the wanted password

530

/* Read OpenPGP packet that contains the wanted password */

449

531

450

532

if(debug){

451

533

fprintf(stderr, "Retrieving pgp encrypted password from %s\n",

453

535

}

454

536

455

537

while(true){

456

if (buffer_length + BUFFER_SIZE > buffer_capacity){

457

buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);

458

if (buffer == NULL){

459

perror("realloc");

460

goto exit;

461

}

462

buffer_capacity += BUFFER_SIZE;

538

buffer_capacity = adjustbuffer(&buffer, buffer_length,

539

buffer_capacity);

540

if (buffer_capacity == 0){

541

perror("adjustbuffer");

542

retval = -1;

543

goto mandos_end;

463

544

}

464

545

465

ret = gnutls_record_recv

466

(es.session, buffer+buffer_length, BUFFER_SIZE);

546

ret = gnutls_record_recv(session, buffer+buffer_length,

547

BUFFER_SIZE);

467

548

if (ret == 0){

468

549

break;

469

550

}

473

554

case GNUTLS_E_AGAIN:

474

555

break;

475

556

case GNUTLS_E_REHANDSHAKE:

476

ret = gnutls_handshake (es.session);

557

ret = gnutls_handshake (session);

477

558

if (ret < 0){

478

fprintf(stderr, "\n*** Handshake failed ***\n");

559

fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");

479

560

gnutls_perror (ret);

480

561

retval = -1;

481

goto exit;

562

goto mandos_end;

482

563

}

483

564

break;

484

565

default:

485

566

fprintf(stderr, "Unknown error while reading data from"

486

" encrypted session with mandos server\n");

567

" encrypted session with Mandos server\n");

487

568

retval = -1;

488

gnutls_bye (es.session, GNUTLS_SHUT_RDWR);

489

goto exit;

569

gnutls_bye (session, GNUTLS_SHUT_RDWR);

570

goto mandos_end;

490

571

}

491

572

} else {

492

573

buffer_length += (size_t) ret;

493

574

}

494

575

}

495

576

577

if(debug){

578

fprintf(stderr, "Closing TLS session\n");

579

}

580

581

gnutls_bye (session, GNUTLS_SHUT_RDWR);

582

496

583

if (buffer_length > 0){

497

584

decrypted_buffer_size = pgp_packet_decrypt(buffer,

498

585

buffer_length,

499

586

&decrypted_buffer,

500

certdir);

587

keydir);

501

588

if (decrypted_buffer_size >= 0){

589

written = 0;

502

590

while(written < (size_t) decrypted_buffer_size){

503

591

ret = (int)fwrite (decrypted_buffer + written, 1,

504

592

(size_t)decrypted_buffer_size - written,

518

606

retval = -1;

519

607

}

520

608

}

521

522

//shutdown procedure

523

524

if(debug){

525

fprintf(stderr, "Closing TLS session\n");

526

}

527

609

610

/* Shutdown procedure */

611

612

mandos_end:

528

613

free(buffer);

529

gnutls_bye (es.session, GNUTLS_SHUT_RDWR);

530

exit:

531

614

close(tcp_sd);

532

gnutls_deinit (es.session);

533

gnutls_certificate_free_credentials (es.cred);

534

gnutls_global_deinit ();

615

gnutls_deinit (session);

535

616

return retval;

536

617

}

537

618

538

static void resolve_callback( AvahiSServiceResolver *r,

539

AvahiIfIndex interface,

540

AVAHI_GCC_UNUSED AvahiProtocol protocol,

541

AvahiResolverEvent event,

542

const char *name,

543

const char *type,

544

const char *domain,

545

const char *host_name,

546

const AvahiAddress *address,

547

uint16_t port,

548

AVAHI_GCC_UNUSED AvahiStringList *txt,

549

AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,

550

AVAHI_GCC_UNUSED void* userdata) {

619

static void resolve_callback(AvahiSServiceResolver *r,

620

AvahiIfIndex interface,

621

AVAHI_GCC_UNUSED AvahiProtocol protocol,

622

AvahiResolverEvent event,

623

const char *name,

624

const char *type,

625

const char *domain,

626

const char *host_name,

627

const AvahiAddress *address,

628

uint16_t port,

629

AVAHI_GCC_UNUSED AvahiStringList *txt,

630

AVAHI_GCC_UNUSED AvahiLookupResultFlags

631

flags,

632

void* userdata) {

551

633

mandos_context *mc = userdata;

552

634

assert(r); /* Spurious warning */

553

635

557

639

switch (event) {

558

640

default:

559

641

case AVAHI_RESOLVER_FAILURE:

560

fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"

561

" type '%s' in domain '%s': %s\n", name, type, domain,

642

fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"

643

" of type '%s' in domain '%s': %s\n", name, type, domain,

562

644

avahi_strerror(avahi_server_errno(mc->server)));

563

645

break;

564

646

567

649

char ip[AVAHI_ADDRESS_STR_MAX];

568

650

avahi_address_snprint(ip, sizeof(ip), address);

569

651

if(debug){

570

fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"

571

" port %d\n", name, host_name, ip, port);

652

fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"

653

" port %d\n", name, host_name, ip, interface, port);

572

654

}

573

655

int ret = start_mandos_communication(ip, port, interface, mc);

574

656

if (ret == 0){

586

668

const char *name,

587

669

const char *type,

588

670

const char *domain,

589

AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,

671

AVAHI_GCC_UNUSED AvahiLookupResultFlags

672

flags,

590

673

void* userdata) {

591

674

mandos_context *mc = userdata;

592

675

assert(b); /* Spurious warning */

597

680

switch (event) {

598

681

default:

599

682

case AVAHI_BROWSER_FAILURE:

600

601

fprintf(stderr, "(Browser) %s\n",

683

684

fprintf(stderr, "(Avahi browser) %s\n",

602

685

avahi_strerror(avahi_server_errno(mc->server)));

603

686

avahi_simple_poll_quit(mc->simple_poll);

604

687

return;

605

688

606

689

case AVAHI_BROWSER_NEW:

607

/* We ignore the returned resolver object. In the callback

608

function we free it. If the server is terminated before

609

the callback function is called the server will free

610

the resolver for us. */

611

612

if (!(avahi_s_service_resolver_new(mc->server, interface, protocol, name,

613

type, domain,

690

/* We ignore the returned Avahi resolver object. In the callback

691

function we free it. If the Avahi server is terminated before

692

the callback function is called the Avahi server will free the

693

resolver for us. */

694

695

if (!(avahi_s_service_resolver_new(mc->server, interface,

696

protocol, name, type, domain,

614

697

AVAHI_PROTO_INET6, 0,

615

698

resolve_callback, mc)))

616

fprintf(stderr, "Failed to resolve service '%s': %s\n", name,

617

avahi_strerror(avahi_server_errno(s)));

699

fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",

700

name, avahi_strerror(avahi_server_errno(mc->server)));

618

701

break;

619

702

620

703

case AVAHI_BROWSER_REMOVE:

621

704

break;

622

705

623

706

case AVAHI_BROWSER_ALL_FOR_NOW:

624

707

case AVAHI_BROWSER_CACHE_EXHAUSTED:

708

if(debug){

709

fprintf(stderr, "No Mandos server found, still searching...\n");

710

}

625

711

break;

626

712

}

627

713

}

636

722

return NULL;

637

723

}

638

724

if(f_len > 0){

639

memcpy(tmp, first, f_len);

725

memcpy(tmp, first, f_len); /* Spurious warning */

640

726

}

641

727

tmp[f_len] = '/';

642

728

if(s_len > 0){

643

memcpy(tmp + f_len + 1, second, s_len);

729

memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */

644

730

}

645

731

tmp[f_len + 1 + s_len] = '\0';

646

732

return tmp;

647

733

}

648

734

649

735

650

int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {

651

AvahiServerConfig config;

736

int main(int argc, char *argv[]){

652

737

AvahiSServiceBrowser *sb = NULL;

653

738

int error;

654

739

int ret;

655

int returncode = EXIT_SUCCESS;

740

int exitcode = EXIT_SUCCESS;

656

741

const char *interface = "eth0";

657

742

struct ifreq network;

658

743

int sd;

744

uid_t uid;

745

gid_t gid;

659

746

char *connect_to = NULL;

660

747

AvahiIfIndex if_index = AVAHI_IF_UNSPEC;

748

const char *pubkeyfile = "pubkey.txt";

749

const char *seckeyfile = "seckey.txt";

661

750

mandos_context mc = { .simple_poll = NULL, .server = NULL,

662

.dh_bits = 2048, .priority = "SECURE256"};

751

.dh_bits = 1024, .priority = "SECURE256"};

752

bool gnutls_initalized = false;

663

753

664

while (true){

665

static struct option long_options[] = {

666

{"debug", no_argument, (int *)&debug, 1},

667

{"connect", required_argument, 0, 'C'},

668

{"interface", required_argument, 0, 'i'},

669

{"certdir", required_argument, 0, 'd'},

670

{"certkey", required_argument, 0, 'c'},

671

{"certfile", required_argument, 0, 'k'},

672

{"dh_bits", required_argument, 0, 'D'},

673

{"priority", required_argument, 0, 'p'},

674

{0, 0, 0, 0} };

675

676

int option_index = 0;

677

ret = getopt_long (argc, argv, "i:", long_options,

678

&option_index);

679

680

if (ret == -1){

681

break;

682

}

683

684

switch(ret){

685

case 0:

686

break;

687

case 'i':

688

interface = optarg;

689

break;

690

case 'C':

691

connect_to = optarg;

692

break;

693

case 'd':

694

certdir = optarg;

695

break;

696

case 'c':

697

certfile = optarg;

698

break;

699

case 'k':

700

certkey = optarg;

701

break;

702

case 'D':

703

{

704

long int tmp;

754

{

755

struct argp_option options[] = {

756

{ .name = "debug", .key = 128,

757

.doc = "Debug mode", .group = 3 },

758

{ .name = "connect", .key = 'c',

759

.arg = "IP",

760

.doc = "Connect directly to a sepcified mandos server",

761

.group = 1 },

762

{ .name = "interface", .key = 'i',

763

.arg = "INTERFACE",

764

.doc = "Interface that Avahi will conntect through",

765

.group = 1 },

766

{ .name = "keydir", .key = 'd',

767

.arg = "KEYDIR",

768

.doc = "Directory where the openpgp keyring is",

769

.group = 1 },

770

{ .name = "seckey", .key = 's',

771

.arg = "SECKEY",

772

.doc = "Secret openpgp key for gnutls authentication",

773

.group = 1 },

774

{ .name = "pubkey", .key = 'p',

775

.arg = "PUBKEY",

776

.doc = "Public openpgp key for gnutls authentication",

777

.group = 2 },

778

{ .name = "dh-bits", .key = 129,

779

.arg = "BITS",

780

.doc = "dh-bits to use in gnutls communication",

781

.group = 2 },

782

{ .name = "priority", .key = 130,

783

.arg = "PRIORITY",

784

.doc = "GNUTLS priority", .group = 1 },

785

{ .name = NULL }

786

};

787

788

789

error_t parse_opt (int key, char *arg,

790

struct argp_state *state) {

791

/* Get the INPUT argument from `argp_parse', which we know is

792

a pointer to our plugin list pointer. */

793

switch (key) {

794

case 128:

795

debug = true;

796

break;

797

case 'c':

798

connect_to = arg;

799

break;

800

case 'i':

801

interface = arg;

802

break;

803

case 'd':

804

keydir = arg;

805

break;

806

case 's':

807

seckeyfile = arg;

808

break;

809

case 'p':

810

pubkeyfile = arg;

811

break;

812

case 129:

705

813

errno = 0;

706

tmp = strtol(optarg, NULL, 10);

707

if (errno == ERANGE){

814

mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);

815

if (errno){

708

816

perror("strtol");

709

817

exit(EXIT_FAILURE);

710

818

}

711

mc.dh_bits = tmp;

819

break;

820

case 130:

821

mc.priority = arg;

822

break;

823

case ARGP_KEY_ARG:

824

argp_usage (state);

825

break;

826

case ARGP_KEY_END:

827

break;

828

default:

829

return ARGP_ERR_UNKNOWN;

712

830

}

713

break;

714

case 'p':

715

mc.priority = optarg;

716

break;

717

default:

718

exit(EXIT_FAILURE);

831

return 0;

719

832

}

720

}

721

722

certfile = combinepath(certdir, certfile);

723

if (certfile == NULL){

724

perror("combinepath");

725

returncode = EXIT_FAILURE;

726

goto exit;

727

}

728

729

certkey = combinepath(certdir, certkey);

730

if (certkey == NULL){

731

perror("combinepath");

732

returncode = EXIT_FAILURE;

733

goto exit;

833

834

struct argp argp = { .options = options, .parser = parse_opt,

835

.args_doc = "",

836

.doc = "Mandos client -- Get and decrypt"

837

" passwords from mandos server" };

838

argp_parse (&argp, argc, argv, 0, 0, NULL);

839

}

840

841

pubkeyfile = combinepath(keydir, pubkeyfile);

842

if (pubkeyfile == NULL){

843

perror("combinepath");

844

exitcode = EXIT_FAILURE;

845

goto end;

846

}

847

848

seckeyfile = combinepath(keydir, seckeyfile);

849

if (seckeyfile == NULL){

850

perror("combinepath");

851

goto end;

852

}

853

854

ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);

855

if (ret == -1){

856

fprintf(stderr, "init_gnutls_global\n");

857

goto end;

858

} else {

859

gnutls_initalized = true;

860

}

861

862

uid = getuid();

863

gid = getgid();

864

865

ret = setuid(uid);

866

if (ret == -1){

867

perror("setuid");

868

}

869

870

setgid(gid);

871

if (ret == -1){

872

perror("setgid");

734

873

}

735

874

736

875

if_index = (AvahiIfIndex) if_nametoindex(interface);

745

884

char *address = strrchr(connect_to, ':');

746

885

if(address == NULL){

747

886

fprintf(stderr, "No colon in address\n");

748

exit(EXIT_FAILURE);

887

exitcode = EXIT_FAILURE;

888

goto end;

749

889

}

750

890

errno = 0;

751

891

uint16_t port = (uint16_t) strtol(address+1, NULL, 10);

752

892

if(errno){

753

893

perror("Bad port number");

754

exit(EXIT_FAILURE);

894

exitcode = EXIT_FAILURE;

895

goto end;

755

896

}

756

897

*address = '\0';

757

898

address = connect_to;

758

ret = start_mandos_communication(address, port, if_index);

899

ret = start_mandos_communication(address, port, if_index, &mc);

759

900

if(ret < 0){

760

exit(EXIT_FAILURE);

901

exitcode = EXIT_FAILURE;

761

902

} else {

762

exit(EXIT_SUCCESS);

903

exitcode = EXIT_SUCCESS;

763

904

}

905

goto end;

764

906

}

765

907

766

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

767

if(sd < 0) {

768

perror("socket");

769

returncode = EXIT_FAILURE;

770

goto exit;

771

}

772

strcpy(network.ifr_name, interface);

773

ret = ioctl(sd, SIOCGIFFLAGS, &network);

774

if(ret == -1){

775

776

perror("ioctl SIOCGIFFLAGS");

777

returncode = EXIT_FAILURE;

778

goto exit;

779

}

780

if((network.ifr_flags & IFF_UP) == 0){

781

network.ifr_flags |= IFF_UP;

782

ret = ioctl(sd, SIOCSIFFLAGS, &network);

908

/* If the interface is down, bring it up */

909

{

910

sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);

911

if(sd < 0) {

912

perror("socket");

913

exitcode = EXIT_FAILURE;

914

goto end;

915

}

916

strcpy(network.ifr_name, interface); /* Spurious warning */

917

ret = ioctl(sd, SIOCGIFFLAGS, &network);

783

918

if(ret == -1){

784

perror("ioctl SIOCSIFFLAGS");

785

returncode = EXIT_FAILURE;

786

goto exit;

787

}

919

perror("ioctl SIOCGIFFLAGS");

920

exitcode = EXIT_FAILURE;

921

goto end;

922

}

923

if((network.ifr_flags & IFF_UP) == 0){

924

network.ifr_flags |= IFF_UP;

925

ret = ioctl(sd, SIOCSIFFLAGS, &network);

926

if(ret == -1){

927

perror("ioctl SIOCSIFFLAGS");

928

exitcode = EXIT_FAILURE;

929

goto end;

930

}

931

}

932

close(sd);

788

933

}

789

close(sd);

790

934

791

935

if (not debug){

792

936

avahi_set_log_function(empty_log);

793

937

}

794

938

795

/* Initialize the psuedo-RNG */

939

/* Initialize the pseudo-RNG for Avahi */

796

940

srand((unsigned int) time(NULL));

797

798

/* Allocate main loop object */

799

if (!(mc.simple_poll = avahi_simple_poll_new())) {

800

fprintf(stderr, "Failed to create simple poll object.\n");

801

returncode = EXIT_FAILURE;

802

goto exit;

803

}

804

805

/* Do not publish any local records */

806

avahi_server_config_init(&config);

807

config.publish_hinfo = 0;

808

config.publish_addresses = 0;

809

config.publish_workstation = 0;

810

config.publish_domain = 0;

811

812

/* Allocate a new server */

813

mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),

814

&config, NULL, NULL, &error);

815

816

/* Free the configuration data */

817

avahi_server_config_free(&config);

818

819

/* Check if creating the server object succeeded */

820

if (!mc.server) {

821

fprintf(stderr, "Failed to create server: %s\n",

941

942

/* Allocate main Avahi loop object */

943

mc.simple_poll = avahi_simple_poll_new();

944

if (mc.simple_poll == NULL) {

945

fprintf(stderr, "Avahi: Failed to create simple poll"

946

" object.\n");

947

exitcode = EXIT_FAILURE;

948

goto end;

949

}

950

951

{

952

AvahiServerConfig config;

953

/* Do not publish any local Zeroconf records */

954

avahi_server_config_init(&config);

955

config.publish_hinfo = 0;

956

config.publish_addresses = 0;

957

config.publish_workstation = 0;

958

config.publish_domain = 0;

959

960

/* Allocate a new server */

961

mc.server = avahi_server_new(avahi_simple_poll_get

962

(mc.simple_poll), &config, NULL,

963

NULL, &error);

964

965

/* Free the Avahi configuration data */

966

avahi_server_config_free(&config);

967

}

968

969

/* Check if creating the Avahi server object succeeded */

970

if (mc.server == NULL) {

971

fprintf(stderr, "Failed to create Avahi server: %s\n",

822

972

avahi_strerror(error));

823

returncode = EXIT_FAILURE;

824

goto exit;

973

exitcode = EXIT_FAILURE;

974

goto end;

825

975

}

826

976

827

/* Create the service browser */

977

/* Create the Avahi service browser */

828

978

sb = avahi_s_service_browser_new(mc.server, if_index,

829

979

AVAHI_PROTO_INET6,

830

980

"_mandos._tcp", NULL, 0,

831

981

browse_callback, &mc);

832

if (!sb) {

982

if (sb == NULL) {

833

983

fprintf(stderr, "Failed to create service browser: %s\n",

834

984

avahi_strerror(avahi_server_errno(mc.server)));

835

returncode = EXIT_FAILURE;

836

goto exit;

985

exitcode = EXIT_FAILURE;

986

goto end;

837

987

}

838

988

839

989

/* Run the main loop */

840

990

841

991

if (debug){

842

fprintf(stderr, "Starting avahi loop search\n");

992

fprintf(stderr, "Starting Avahi loop search\n");

843

993

}

844

994

845

avahi_simple_poll_loop(simple_poll);

995

avahi_simple_poll_loop(mc.simple_poll);

846

996

847

exit:

997

end:

848

998

849

999

if (debug){

850

1000

fprintf(stderr, "%s exiting\n", argv[0]);

851

1001

}

852

1002

853

1003

/* Cleanup things */

854

if (sb)

1004

if (sb != NULL)

855

1005

avahi_s_service_browser_free(sb);

856

1006

857

if (mc.server)

1007

if (mc.server != NULL)

858

1008

avahi_server_free(mc.server);

859

1009

860

if (simple_poll)

861

avahi_simple_poll_free(simple_poll);

862

free(certfile);

863

free(certkey);

1010

if (mc.simple_poll != NULL)

1011

avahi_simple_poll_free(mc.simple_poll);

1012

free(pubkeyfile);

1013

free(seckeyfile);

1014

1015

if (gnutls_initalized){

1016

gnutls_certificate_free_credentials (mc.cred);

1017

gnutls_global_deinit ();

1018

}

864

1019

865

return returncode;

1020

return exitcode;

866

1021

}