302
263
if ((ret = gnutls_global_init ())
303
264
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "GnuTLS global_init: %s\n",
305
safer_gnutls_strerror(ret));
265
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
310
/* "Use a log level over 10 to enable all debugging options."
313
270
gnutls_global_set_log_level(11);
314
271
gnutls_global_set_log_function(debuggnutls);
317
/* OpenPGP credentials */
318
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
274
/* openpgp credentials */
275
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
319
276
!= GNUTLS_E_SUCCESS) {
320
fprintf (stderr, "GnuTLS memory error: %s\n",
277
fprintf (stderr, "memory error: %s\n",
321
278
safer_gnutls_strerror(ret));
322
gnutls_global_deinit ();
327
283
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
328
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
284
" and keyfile %s as GnuTLS credentials\n", certfile,
332
288
ret = gnutls_certificate_set_openpgp_key_file
333
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
289
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
334
290
if (ret != GNUTLS_E_SUCCESS) {
336
"Error[%d] while reading the OpenPGP key pair ('%s',"
337
" '%s')\n", ret, pubkeyfile, seckeyfile);
338
fprintf(stdout, "The GnuTLS error is: %s\n",
292
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
294
ret, certfile, certkey);
295
fprintf(stdout, "The Error is: %s\n",
339
296
safer_gnutls_strerror(ret));
343
/* GnuTLS server initialization */
344
ret = gnutls_dh_params_init(&mc->dh_params);
345
if (ret != GNUTLS_E_SUCCESS) {
346
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
347
" %s\n", safer_gnutls_strerror(ret));
350
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
351
if (ret != GNUTLS_E_SUCCESS) {
352
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
353
safer_gnutls_strerror(ret));
357
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
363
gnutls_certificate_free_credentials (mc->cred);
364
gnutls_global_deinit ();
369
static int init_gnutls_session(mandos_context *mc,
370
gnutls_session_t *session){
372
/* GnuTLS session creation */
373
ret = gnutls_init(session, GNUTLS_SERVER);
374
if (ret != GNUTLS_E_SUCCESS){
300
//GnuTLS server initialization
301
if ((ret = gnutls_dh_params_init (&es->dh_params))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in dh parameter initialization: %s\n",
304
safer_gnutls_strerror(ret));
308
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
309
!= GNUTLS_E_SUCCESS) {
310
fprintf (stderr, "Error in prime generation: %s\n",
311
safer_gnutls_strerror(ret));
315
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
317
// GnuTLS session creation
318
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
319
!= GNUTLS_E_SUCCESS){
375
320
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
376
321
safer_gnutls_strerror(ret));
381
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
382
if (ret != GNUTLS_E_SUCCESS) {
383
fprintf(stderr, "Syntax error at: %s\n", err);
384
fprintf(stderr, "GnuTLS error: %s\n",
385
safer_gnutls_strerror(ret));
386
gnutls_deinit (*session);
324
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
325
!= GNUTLS_E_SUCCESS) {
326
fprintf(stderr, "Syntax error at: %s\n", err);
327
fprintf(stderr, "GnuTLS error: %s\n",
328
safer_gnutls_strerror(ret));
391
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
393
if (ret != GNUTLS_E_SUCCESS) {
394
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
332
if ((ret = gnutls_credentials_set
333
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
334
!= GNUTLS_E_SUCCESS) {
335
fprintf(stderr, "Error setting a credentials set: %s\n",
395
336
safer_gnutls_strerror(ret));
396
gnutls_deinit (*session);
400
340
/* ignore client certificate if any. */
401
gnutls_certificate_server_set_request (*session,
341
gnutls_certificate_server_set_request (es->session,
402
342
GNUTLS_CERT_IGNORE);
404
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
344
gnutls_dh_set_prime_bits (es->session, DH_BITS);
409
/* Avahi log function callback */
410
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
411
__attribute__((unused)) const char *txt){}
349
void empty_log(__attribute__((unused)) AvahiLogLevel level,
350
__attribute__((unused)) const char *txt){}
413
/* Called when a Mandos server is found */
414
static int start_mandos_communication(const char *ip, uint16_t port,
415
AvahiIfIndex if_index,
352
int start_mandos_communication(const char *ip, uint16_t port,
353
unsigned int if_index){
418
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
355
struct sockaddr_in6 to;
356
encrypted_session es;
419
357
char *buffer = NULL;
420
358
char *decrypted_buffer;
421
359
size_t buffer_length = 0;
422
360
size_t buffer_capacity = 0;
423
361
ssize_t decrypted_buffer_size;
426
364
char interface[IF_NAMESIZE];
427
gnutls_session_t session;
429
ret = init_gnutls_session (mc, &session);
435
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
367
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
439
370
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
441
372
perror("socket");
446
if(if_indextoname((unsigned int)if_index, interface) == NULL){
376
if(if_indextoname(if_index, interface) == NULL){
447
378
perror("if_indextoname");
450
384
fprintf(stderr, "Binding to interface %s\n", interface);
453
387
memset(&to,0,sizeof(to)); /* Spurious warning */
454
to.in6.sin6_family = AF_INET6;
455
/* It would be nice to have a way to detect if we were passed an
456
IPv4 address here. Now we assume an IPv6 address. */
457
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
388
to.sin6_family = AF_INET6;
389
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
459
391
perror("inet_pton");
463
395
fprintf(stderr, "Bad address: %s\n", ip);
466
to.in6.sin6_port = htons(port); /* Spurious warning */
398
to.sin6_port = htons(port); /* Spurious warning */
468
to.in6.sin6_scope_id = (uint32_t)if_index;
400
to.sin6_scope_id = (uint32_t)if_index;
471
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
472
char addrstr[INET6_ADDRSTRLEN] = "";
473
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
474
sizeof(addrstr)) == NULL){
477
if(strcmp(addrstr, ip) != 0){
478
fprintf(stderr, "Canonical address form: %s\n", addrstr);
403
fprintf(stderr, "Connection to: %s\n", ip);
483
ret = connect(tcp_sd, &to.in, sizeof(to));
406
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
485
408
perror("connect");
489
const char *out = mandos_protocol_version;
492
size_t out_size = strlen(out);
493
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
494
out_size - written));
500
written += (size_t)ret;
501
if(written < out_size){
504
if (out == mandos_protocol_version){
412
ret = initgnutls (&es);
418
gnutls_transport_set_ptr (es.session,
419
(gnutls_transport_ptr_t) tcp_sd);
514
422
fprintf(stderr, "Establishing TLS session with %s\n", ip);
517
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
519
ret = gnutls_handshake (session);
425
ret = gnutls_handshake (es.session);
521
427
if (ret != GNUTLS_E_SUCCESS){
523
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
429
fprintf(stderr, "\n*** Handshake failed ***\n");
524
430
gnutls_perror (ret);
530
/* Read OpenPGP packet that contains the wanted password */
436
//Retrieve OpenPGP packet that contains the wanted password
533
439
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
661
572
avahi_s_service_resolver_free(r);
664
static void browse_callback( AvahiSServiceBrowser *b,
665
AvahiIfIndex interface,
666
AvahiProtocol protocol,
667
AvahiBrowserEvent event,
671
AVAHI_GCC_UNUSED AvahiLookupResultFlags
674
mandos_context *mc = userdata;
675
assert(b); /* Spurious warning */
677
/* Called whenever a new services becomes available on the LAN or
678
is removed from the LAN */
682
case AVAHI_BROWSER_FAILURE:
684
fprintf(stderr, "(Avahi browser) %s\n",
685
avahi_strerror(avahi_server_errno(mc->server)));
686
avahi_simple_poll_quit(mc->simple_poll);
689
case AVAHI_BROWSER_NEW:
690
/* We ignore the returned Avahi resolver object. In the callback
691
function we free it. If the Avahi server is terminated before
692
the callback function is called the Avahi server will free the
695
if (!(avahi_s_service_resolver_new(mc->server, interface,
696
protocol, name, type, domain,
697
AVAHI_PROTO_INET6, 0,
698
resolve_callback, mc)))
699
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
700
name, avahi_strerror(avahi_server_errno(mc->server)));
703
case AVAHI_BROWSER_REMOVE:
706
case AVAHI_BROWSER_ALL_FOR_NOW:
707
case AVAHI_BROWSER_CACHE_EXHAUSTED:
709
fprintf(stderr, "No Mandos server found, still searching...\n");
575
static void browse_callback(
576
AvahiSServiceBrowser *b,
577
AvahiIfIndex interface,
578
AvahiProtocol protocol,
579
AvahiBrowserEvent event,
583
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
586
AvahiServer *s = userdata;
587
assert(b); /* Spurious warning */
589
/* Called whenever a new services becomes available on the LAN or
590
is removed from the LAN */
594
case AVAHI_BROWSER_FAILURE:
596
fprintf(stderr, "(Browser) %s\n",
597
avahi_strerror(avahi_server_errno(server)));
598
avahi_simple_poll_quit(simple_poll);
601
case AVAHI_BROWSER_NEW:
602
/* We ignore the returned resolver object. In the callback
603
function we free it. If the server is terminated before
604
the callback function is called the server will free
605
the resolver for us. */
607
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
609
AVAHI_PROTO_INET6, 0,
610
resolve_callback, s)))
611
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
612
avahi_strerror(avahi_server_errno(s)));
615
case AVAHI_BROWSER_REMOVE:
618
case AVAHI_BROWSER_ALL_FOR_NOW:
619
case AVAHI_BROWSER_CACHE_EXHAUSTED:
715
/* Combines file name and path and returns the malloced new
716
string. some sane checks could/should be added */
717
static const char *combinepath(const char *first, const char *second){
718
size_t f_len = strlen(first);
719
size_t s_len = strlen(second);
720
char *tmp = malloc(f_len + s_len + 2);
624
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
625
const char *combinepath(const char *first, const char *second){
627
tmp = malloc(strlen(first) + strlen(second) + 2);
721
628
if (tmp == NULL){
725
memcpy(tmp, first, f_len); /* Spurious warning */
729
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
731
tmp[f_len + 1 + s_len] = '\0';
633
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
736
int main(int argc, char *argv[]){
641
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
642
AvahiServerConfig config;
737
643
AvahiSServiceBrowser *sb = NULL;
740
int exitcode = EXIT_SUCCESS;
646
int returncode = EXIT_SUCCESS;
741
647
const char *interface = "eth0";
742
struct ifreq network;
746
char *connect_to = NULL;
747
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
748
const char *pubkeyfile = "pubkey.txt";
749
const char *seckeyfile = "seckey.txt";
750
mandos_context mc = { .simple_poll = NULL, .server = NULL,
751
.dh_bits = 1024, .priority = "SECURE256"};
752
bool gnutls_initalized = false;
755
struct argp_option options[] = {
756
{ .name = "debug", .key = 128,
757
.doc = "Debug mode", .group = 3 },
758
{ .name = "connect", .key = 'c',
760
.doc = "Connect directly to a sepcified mandos server",
762
{ .name = "interface", .key = 'i',
764
.doc = "Interface that Avahi will conntect through",
766
{ .name = "keydir", .key = 'd',
768
.doc = "Directory where the openpgp keyring is",
770
{ .name = "seckey", .key = 's',
772
.doc = "Secret openpgp key for gnutls authentication",
774
{ .name = "pubkey", .key = 'p',
776
.doc = "Public openpgp key for gnutls authentication",
778
{ .name = "dh-bits", .key = 129,
780
.doc = "dh-bits to use in gnutls communication",
782
{ .name = "priority", .key = 130,
784
.doc = "GNUTLS priority", .group = 1 },
789
error_t parse_opt (int key, char *arg,
790
struct argp_state *state) {
791
/* Get the INPUT argument from `argp_parse', which we know is
792
a pointer to our plugin list pointer. */
814
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
829
return ARGP_ERR_UNKNOWN;
834
struct argp argp = { .options = options, .parser = parse_opt,
836
.doc = "Mandos client -- Get and decrypt"
837
" passwords from mandos server" };
838
argp_parse (&argp, argc, argv, 0, 0, NULL);
841
pubkeyfile = combinepath(keydir, pubkeyfile);
842
if (pubkeyfile == NULL){
843
perror("combinepath");
844
exitcode = EXIT_FAILURE;
848
seckeyfile = combinepath(keydir, seckeyfile);
849
if (seckeyfile == NULL){
850
perror("combinepath");
854
ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);
856
fprintf(stderr, "init_gnutls_global\n");
859
gnutls_initalized = true;
875
if_index = (AvahiIfIndex) if_nametoindex(interface);
877
fprintf(stderr, "No such interface: \"%s\"\n", interface);
881
if(connect_to != NULL){
882
/* Connect directly, do not use Zeroconf */
883
/* (Mainly meant for debugging) */
884
char *address = strrchr(connect_to, ':');
886
fprintf(stderr, "No colon in address\n");
887
exitcode = EXIT_FAILURE;
891
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
893
perror("Bad port number");
894
exitcode = EXIT_FAILURE;
898
address = connect_to;
899
ret = start_mandos_communication(address, port, if_index, &mc);
901
exitcode = EXIT_FAILURE;
903
exitcode = EXIT_SUCCESS;
908
/* If the interface is down, bring it up */
910
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
913
exitcode = EXIT_FAILURE;
916
strcpy(network.ifr_name, interface); /* Spurious warning */
917
ret = ioctl(sd, SIOCGIFFLAGS, &network);
919
perror("ioctl SIOCGIFFLAGS");
920
exitcode = EXIT_FAILURE;
923
if((network.ifr_flags & IFF_UP) == 0){
924
network.ifr_flags |= IFF_UP;
925
ret = ioctl(sd, SIOCSIFFLAGS, &network);
927
perror("ioctl SIOCSIFFLAGS");
928
exitcode = EXIT_FAILURE;
650
static struct option long_options[] = {
651
{"debug", no_argument, (int *)&debug, 1},
652
{"interface", required_argument, 0, 'i'},
653
{"certdir", required_argument, 0, 'd'},
654
{"certkey", required_argument, 0, 'c'},
655
{"certfile", required_argument, 0, 'k'},
658
int option_index = 0;
659
ret = getopt_long (argc, argv, "i:", long_options,
686
certfile = combinepath(certdir, certfile);
687
if (certfile == NULL){
691
certkey = combinepath(certdir, certkey);
692
if (certkey == NULL){
936
697
avahi_set_log_function(empty_log);
939
/* Initialize the pseudo-RNG for Avahi */
700
/* Initialize the psuedo-RNG */
940
701
srand((unsigned int) time(NULL));
942
/* Allocate main Avahi loop object */
943
mc.simple_poll = avahi_simple_poll_new();
944
if (mc.simple_poll == NULL) {
945
fprintf(stderr, "Avahi: Failed to create simple poll"
947
exitcode = EXIT_FAILURE;
952
AvahiServerConfig config;
953
/* Do not publish any local Zeroconf records */
954
avahi_server_config_init(&config);
955
config.publish_hinfo = 0;
956
config.publish_addresses = 0;
957
config.publish_workstation = 0;
958
config.publish_domain = 0;
960
/* Allocate a new server */
961
mc.server = avahi_server_new(avahi_simple_poll_get
962
(mc.simple_poll), &config, NULL,
965
/* Free the Avahi configuration data */
966
avahi_server_config_free(&config);
969
/* Check if creating the Avahi server object succeeded */
970
if (mc.server == NULL) {
971
fprintf(stderr, "Failed to create Avahi server: %s\n",
703
/* Allocate main loop object */
704
if (!(simple_poll = avahi_simple_poll_new())) {
705
fprintf(stderr, "Failed to create simple poll object.\n");
710
/* Do not publish any local records */
711
avahi_server_config_init(&config);
712
config.publish_hinfo = 0;
713
config.publish_addresses = 0;
714
config.publish_workstation = 0;
715
config.publish_domain = 0;
717
/* Allocate a new server */
718
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
719
&config, NULL, NULL, &error);
721
/* Free the configuration data */
722
avahi_server_config_free(&config);
724
/* Check if creating the server object succeeded */
726
fprintf(stderr, "Failed to create server: %s\n",
972
727
avahi_strerror(error));
973
exitcode = EXIT_FAILURE;
728
returncode = EXIT_FAILURE;
977
/* Create the Avahi service browser */
978
sb = avahi_s_service_browser_new(mc.server, if_index,
732
/* Create the service browser */
733
sb = avahi_s_service_browser_new(server,
735
if_nametoindex(interface),
979
736
AVAHI_PROTO_INET6,
980
737
"_mandos._tcp", NULL, 0,
981
browse_callback, &mc);
738
browse_callback, server);
983
740
fprintf(stderr, "Failed to create service browser: %s\n",
984
avahi_strerror(avahi_server_errno(mc.server)));
985
exitcode = EXIT_FAILURE;
741
avahi_strerror(avahi_server_errno(server)));
742
returncode = EXIT_FAILURE;
989
746
/* Run the main loop */
992
fprintf(stderr, "Starting Avahi loop search\n");
749
fprintf(stderr, "Starting avahi loop search\n");
995
avahi_simple_poll_loop(mc.simple_poll);
752
avahi_simple_poll_loop(simple_poll);
1000
757
fprintf(stderr, "%s exiting\n", argv[0]);
1003
760
/* Cleanup things */
1005
762
avahi_s_service_browser_free(sb);
1007
if (mc.server != NULL)
1008
avahi_server_free(mc.server);
1010
if (mc.simple_poll != NULL)
1011
avahi_simple_poll_free(mc.simple_poll);
1015
if (gnutls_initalized){
1016
gnutls_certificate_free_credentials (mc.cred);
1017
gnutls_global_deinit ();
765
avahi_server_free(server);
768
avahi_simple_poll_free(simple_poll);