To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 24.1.6
- compare with another revision
- download diff
- download tarball
- view history from revision 24.1.6
- Committer: Björn Påhlsson
- Date: 2008-08-02 14:48:45 UTC
- mto: (24.1.154 mandos) (237.4.3 mandos-release)
- mto: This revision was merged to the branch mainline in revision 38.
- Revision ID: belorn@braxen-20080802144845-sd6z98g9poztxffs
plugbasedclient
change uid to nobody:nogroup as default for all plugins
mandosclient
Takes up the interface if needed
change uid to nobody:nogroup as default for all plugins
mandosclient
Takes up the interface if needed
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- clients.conf => mandos-clients.conf
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
8
8
* includes the following functions: "resolve_callback",
9
9
* "browse_callback", and parts of "main".
10
10
*
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
11
* Everything else is Copyright © 2007-2008 Teddy Hogeborn and Björn
12
* Påhlsson.
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
26
25
* along with this program. If not, see
27
26
* <http://www.gnu.org/licenses/>.
28
27
*
29
* Contact the authors at <mandos@fukt.bsnet.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
30
30
*/
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
32
#define _FORTIFY_SOURCE 2
33
34
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
35
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), setuid(),
75
setgid() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sigaction,
84
sig_atomic_t */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
90
/* Avahi */
91
/* All Avahi types, constants and functions
92
Avahi*, avahi_*,
93
AVAHI_* */
36
37
#include <stdio.h>
38
#include <assert.h>
39
#include <stdlib.h>
40
#include <time.h>
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
43
#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
44
94
45
#include <avahi-core/core.h>
95
46
#include <avahi-core/lookup.h>
96
47
#include <avahi-core/log.h>
98
49
#include <avahi-common/malloc.h>
99
50
#include <avahi-common/error.h>
100
51
101
/* GnuTLS */
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
103
functions:
104
gnutls_*
105
init_gnutls_session(),
106
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
110
111
/* GPGME */
112
#include <gpgme.h> /* All GPGME types, constants and
113
functions:
114
gpgme_*
115
GPGME_PROTOCOL_OpenPGP,
116
GPG_ERR_NO_* */
52
//mandos client part
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
58
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
65
66
// gpgme
67
#include <errno.h> /* perror() */
68
#include <gpgme.h>
69
70
// getopt long
71
#include <getopt.h>
117
72
118
73
#define BUFFER_SIZE 256
74
#define DH_BITS 1024
119
75
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
76
const char *certdir = "/conf/conf.d/cryptkeyreq/";
77
const char *certfile = "openpgp-client.txt";
78
const char *certkey = "openpgp-client-key.txt";
123
79
124
80
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
128
81
129
/* Used for passing in values through the Avahi callback functions */
130
82
typedef struct {
131
AvahiSimplePoll *simple_poll;
132
AvahiServer *server;
83
gnutls_session_t session;
133
84
gnutls_certificate_credentials_t cred;
134
unsigned int dh_bits;
135
85
gnutls_dh_params_t dh_params;
136
const char *priority;
86
} encrypted_session;
87
88
89
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
90
char **new_packet, const char *homedir){
91
gpgme_data_t dh_crypto, dh_plain;
137
92
gpgme_ctx_t ctx;
138
} mandos_context;
139
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
/*
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
* bytes. "buffer_capacity" is how much is currently allocated,
148
* "buffer_length" is how much is already used.
149
*/
150
size_t incbuffer(char **buffer, size_t buffer_length,
151
size_t buffer_capacity){
152
if(buffer_length + BUFFER_SIZE > buffer_capacity){
153
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
154
if(buffer == NULL){
155
return 0;
156
}
157
buffer_capacity += BUFFER_SIZE;
158
}
159
return buffer_capacity;
160
}
161
162
/*
163
* Initialize GPGME.
164
*/
165
static bool init_gpgme(const char *seckey,
166
const char *pubkey, const char *tempdir){
167
int ret;
168
93
gpgme_error_t rc;
94
ssize_t ret;
95
ssize_t new_packet_capacity = 0;
96
ssize_t new_packet_length = 0;
169
97
gpgme_engine_info_t engine_info;
170
171
172
/*
173
* Helper function to insert pub and seckey to the engine keyring.
174
*/
175
bool import_key(const char *filename){
176
int fd;
177
gpgme_data_t pgp_data;
178
179
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
180
if(fd == -1){
181
perror("open");
182
return false;
183
}
184
185
rc = gpgme_data_new_from_fd(&pgp_data, fd);
186
if(rc != GPG_ERR_NO_ERROR){
187
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
188
gpgme_strsource(rc), gpgme_strerror(rc));
189
return false;
190
}
191
192
rc = gpgme_op_import(mc.ctx, pgp_data);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
196
return false;
197
}
198
199
ret = (int)TEMP_FAILURE_RETRY(close(fd));
200
if(ret == -1){
201
perror("close");
202
}
203
gpgme_data_release(pgp_data);
204
return true;
205
}
206
207
if(debug){
208
fprintf(stderr, "Initializing GPGME\n");
98
99
if (debug){
100
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
209
101
}
210
102
211
103
/* Init GPGME */
212
104
gpgme_check_version(NULL);
213
105
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
214
if(rc != GPG_ERR_NO_ERROR){
106
if (rc != GPG_ERR_NO_ERROR){
215
107
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
216
108
gpgme_strsource(rc), gpgme_strerror(rc));
217
return false;
109
return -1;
218
110
}
219
111
220
/* Set GPGME home directory for the OpenPGP engine only */
221
rc = gpgme_get_engine_info(&engine_info);
222
if(rc != GPG_ERR_NO_ERROR){
112
/* Set GPGME home directory */
113
rc = gpgme_get_engine_info (&engine_info);
114
if (rc != GPG_ERR_NO_ERROR){
223
115
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
224
116
gpgme_strsource(rc), gpgme_strerror(rc));
225
return false;
117
return -1;
226
118
}
227
119
while(engine_info != NULL){
228
120
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
229
121
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
230
engine_info->file_name, tempdir);
122
engine_info->file_name, homedir);
231
123
break;
232
124
}
233
125
engine_info = engine_info->next;
234
126
}
235
127
if(engine_info == NULL){
236
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
237
return false;
238
}
239
240
/* Create new GPGME "context" */
241
rc = gpgme_new(&(mc.ctx));
242
if(rc != GPG_ERR_NO_ERROR){
243
fprintf(stderr, "bad gpgme_new: %s: %s\n",
244
gpgme_strsource(rc), gpgme_strerror(rc));
245
return false;
246
}
247
248
if(not import_key(pubkey) or not import_key(seckey)){
249
return false;
250
}
251
252
return true;
253
}
254
255
/*
256
* Decrypt OpenPGP data.
257
* Returns -1 on error
258
*/
259
static ssize_t pgp_packet_decrypt(const char *cryptotext,
260
size_t crypto_size,
261
char **plaintext){
262
gpgme_data_t dh_crypto, dh_plain;
263
gpgme_error_t rc;
264
ssize_t ret;
265
size_t plaintext_capacity = 0;
266
ssize_t plaintext_length = 0;
267
268
if(debug){
269
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
270
}
271
272
/* Create new GPGME data buffer from memory cryptotext */
273
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
274
0);
275
if(rc != GPG_ERR_NO_ERROR){
128
fprintf(stderr, "Could not set home dir to %s\n", homedir);
129
return -1;
130
}
131
132
/* Create new GPGME data buffer from packet buffer */
133
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
134
if (rc != GPG_ERR_NO_ERROR){
276
135
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
277
136
gpgme_strsource(rc), gpgme_strerror(rc));
278
137
return -1;
280
139
281
140
/* Create new empty GPGME data buffer for the plaintext */
282
141
rc = gpgme_data_new(&dh_plain);
283
if(rc != GPG_ERR_NO_ERROR){
142
if (rc != GPG_ERR_NO_ERROR){
284
143
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
285
144
gpgme_strsource(rc), gpgme_strerror(rc));
286
gpgme_data_release(dh_crypto);
287
return -1;
288
}
289
290
/* Decrypt data from the cryptotext data buffer to the plaintext
291
data buffer */
292
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
293
if(rc != GPG_ERR_NO_ERROR){
145
return -1;
146
}
147
148
/* Create new GPGME "context" */
149
rc = gpgme_new(&ctx);
150
if (rc != GPG_ERR_NO_ERROR){
151
fprintf(stderr, "bad gpgme_new: %s: %s\n",
152
gpgme_strsource(rc), gpgme_strerror(rc));
153
return -1;
154
}
155
156
/* Decrypt data from the FILE pointer to the plaintext data
157
buffer */
158
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
159
if (rc != GPG_ERR_NO_ERROR){
294
160
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
295
161
gpgme_strsource(rc), gpgme_strerror(rc));
296
plaintext_length = -1;
297
if(debug){
298
gpgme_decrypt_result_t result;
299
result = gpgme_op_decrypt_result(mc.ctx);
300
if(result == NULL){
301
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
302
} else {
303
fprintf(stderr, "Unsupported algorithm: %s\n",
304
result->unsupported_algorithm);
305
fprintf(stderr, "Wrong key usage: %u\n",
306
result->wrong_key_usage);
307
if(result->file_name != NULL){
308
fprintf(stderr, "File name: %s\n", result->file_name);
309
}
310
gpgme_recipient_t recipient;
311
recipient = result->recipients;
312
if(recipient){
313
while(recipient != NULL){
314
fprintf(stderr, "Public key algorithm: %s\n",
315
gpgme_pubkey_algo_name(recipient->pubkey_algo));
316
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
317
fprintf(stderr, "Secret key available: %s\n",
318
recipient->status == GPG_ERR_NO_SECKEY
319
? "No" : "Yes");
320
recipient = recipient->next;
321
}
162
return -1;
163
}
164
165
if(debug){
166
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
167
}
168
169
if (debug){
170
gpgme_decrypt_result_t result;
171
result = gpgme_op_decrypt_result(ctx);
172
if (result == NULL){
173
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
174
} else {
175
fprintf(stderr, "Unsupported algorithm: %s\n",
176
result->unsupported_algorithm);
177
fprintf(stderr, "Wrong key usage: %d\n",
178
result->wrong_key_usage);
179
if(result->file_name != NULL){
180
fprintf(stderr, "File name: %s\n", result->file_name);
181
}
182
gpgme_recipient_t recipient;
183
recipient = result->recipients;
184
if(recipient){
185
while(recipient != NULL){
186
fprintf(stderr, "Public key algorithm: %s\n",
187
gpgme_pubkey_algo_name(recipient->pubkey_algo));
188
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
189
fprintf(stderr, "Secret key available: %s\n",
190
recipient->status == GPG_ERR_NO_SECKEY
191
? "No" : "Yes");
192
recipient = recipient->next;
322
193
}
323
194
}
324
195
}
325
goto decrypt_end;
326
196
}
327
197
328
if(debug){
329
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
330
}
198
/* Delete the GPGME FILE pointer cryptotext data buffer */
199
gpgme_data_release(dh_crypto);
331
200
332
201
/* Seek back to the beginning of the GPGME plaintext data buffer */
333
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
334
perror("gpgme_data_seek");
335
plaintext_length = -1;
336
goto decrypt_end;
202
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
203
perror("pgpme_data_seek");
337
204
}
338
205
339
*plaintext = NULL;
206
*new_packet = 0;
340
207
while(true){
341
plaintext_capacity = incbuffer(plaintext,
342
(size_t)plaintext_length,
343
plaintext_capacity);
344
if(plaintext_capacity == 0){
345
perror("incbuffer");
346
plaintext_length = -1;
347
goto decrypt_end;
208
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
209
*new_packet = realloc(*new_packet,
210
(unsigned int)new_packet_capacity
211
+ BUFFER_SIZE);
212
if (*new_packet == NULL){
213
perror("realloc");
214
return -1;
215
}
216
new_packet_capacity += BUFFER_SIZE;
348
217
}
349
218
350
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
219
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
351
220
BUFFER_SIZE);
352
221
/* Print the data, if any */
353
if(ret == 0){
354
/* EOF */
222
if (ret == 0){
355
223
break;
356
224
}
357
225
if(ret < 0){
358
226
perror("gpgme_data_read");
359
plaintext_length = -1;
360
goto decrypt_end;
361
}
362
plaintext_length += ret;
363
}
364
365
if(debug){
366
fprintf(stderr, "Decrypted password is: ");
367
for(ssize_t i = 0; i < plaintext_length; i++){
368
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
369
}
370
fprintf(stderr, "\n");
371
}
372
373
decrypt_end:
374
375
/* Delete the GPGME cryptotext data buffer */
376
gpgme_data_release(dh_crypto);
227
return -1;
228
}
229
new_packet_length += ret;
230
}
231
232
/* FIXME: check characters before printing to screen so to not print
233
terminal control characters */
234
/* if(debug){ */
235
/* fprintf(stderr, "decrypted password is: "); */
236
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
237
/* fprintf(stderr, "\n"); */
238
/* } */
377
239
378
240
/* Delete the GPGME plaintext data buffer */
379
241
gpgme_data_release(dh_plain);
380
return plaintext_length;
242
return new_packet_length;
381
243
}
382
244
383
static const char * safer_gnutls_strerror(int value){
384
const char *ret = gnutls_strerror(value); /* Spurious warning from
385
-Wunreachable-code */
386
if(ret == NULL)
245
static const char * safer_gnutls_strerror (int value) {
246
const char *ret = gnutls_strerror (value);
247
if (ret == NULL)
387
248
ret = "(unknown)";
388
249
return ret;
389
250
}
390
251
391
/* GnuTLS log function callback */
392
static void debuggnutls(__attribute__((unused)) int level,
393
const char* string){
394
fprintf(stderr, "GnuTLS: %s", string);
252
void debuggnutls(__attribute__((unused)) int level,
253
const char* string){
254
fprintf(stderr, "%s", string);
395
255
}
396
256
397
static int init_gnutls_global(const char *pubkeyfilename,
398
const char *seckeyfilename){
257
int initgnutls(encrypted_session *es){
258
const char *err;
399
259
int ret;
400
260
401
261
if(debug){
402
262
fprintf(stderr, "Initializing GnuTLS\n");
403
263
}
404
405
ret = gnutls_global_init();
406
if(ret != GNUTLS_E_SUCCESS){
407
fprintf(stderr, "GnuTLS global_init: %s\n",
408
safer_gnutls_strerror(ret));
264
265
if ((ret = gnutls_global_init ())
266
!= GNUTLS_E_SUCCESS) {
267
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
409
268
return -1;
410
269
}
411
412
if(debug){
413
/* "Use a log level over 10 to enable all debugging options."
414
* - GnuTLS manual
415
*/
270
271
if (debug){
416
272
gnutls_global_set_log_level(11);
417
273
gnutls_global_set_log_function(debuggnutls);
418
274
}
419
275
420
/* OpenPGP credentials */
421
gnutls_certificate_allocate_credentials(&mc.cred);
422
if(ret != GNUTLS_E_SUCCESS){
423
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
424
from
425
-Wunreachable-code
426
*/
427
safer_gnutls_strerror(ret));
428
gnutls_global_deinit();
276
/* openpgp credentials */
277
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
278
!= GNUTLS_E_SUCCESS) {
279
fprintf (stderr, "memory error: %s\n",
280
safer_gnutls_strerror(ret));
429
281
return -1;
430
282
}
431
283
432
284
if(debug){
433
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
434
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
435
seckeyfilename);
285
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
286
" and keyfile %s as GnuTLS credentials\n", certfile,
287
certkey);
436
288
}
437
289
438
290
ret = gnutls_certificate_set_openpgp_key_file
439
(mc.cred, pubkeyfilename, seckeyfilename,
440
GNUTLS_OPENPGP_FMT_BASE64);
441
if(ret != GNUTLS_E_SUCCESS){
442
fprintf(stderr,
443
"Error[%d] while reading the OpenPGP key pair ('%s',"
444
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
445
fprintf(stderr, "The GnuTLS error is: %s\n",
446
safer_gnutls_strerror(ret));
447
goto globalfail;
448
}
449
450
/* GnuTLS server initialization */
451
ret = gnutls_dh_params_init(&mc.dh_params);
452
if(ret != GNUTLS_E_SUCCESS){
453
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
454
" %s\n", safer_gnutls_strerror(ret));
455
goto globalfail;
456
}
457
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
458
if(ret != GNUTLS_E_SUCCESS){
459
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
460
safer_gnutls_strerror(ret));
461
goto globalfail;
462
}
463
464
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
465
466
return 0;
467
468
globalfail:
469
470
gnutls_certificate_free_credentials(mc.cred);
471
gnutls_global_deinit();
472
gnutls_dh_params_deinit(mc.dh_params);
473
return -1;
474
}
475
476
static int init_gnutls_session(gnutls_session_t *session){
477
int ret;
478
/* GnuTLS session creation */
479
ret = gnutls_init(session, GNUTLS_SERVER);
480
if(ret != GNUTLS_E_SUCCESS){
291
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
292
if (ret != GNUTLS_E_SUCCESS) {
293
fprintf
294
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
295
" '%s')\n",
296
ret, certfile, certkey);
297
fprintf(stdout, "The Error is: %s\n",
298
safer_gnutls_strerror(ret));
299
return -1;
300
}
301
302
//GnuTLS server initialization
303
if ((ret = gnutls_dh_params_init (&es->dh_params))
304
!= GNUTLS_E_SUCCESS) {
305
fprintf (stderr, "Error in dh parameter initialization: %s\n",
306
safer_gnutls_strerror(ret));
307
return -1;
308
}
309
310
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
311
!= GNUTLS_E_SUCCESS) {
312
fprintf (stderr, "Error in prime generation: %s\n",
313
safer_gnutls_strerror(ret));
314
return -1;
315
}
316
317
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
318
319
// GnuTLS session creation
320
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
321
!= GNUTLS_E_SUCCESS){
481
322
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
482
323
safer_gnutls_strerror(ret));
483
324
}
484
325
485
{
486
const char *err;
487
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
488
if(ret != GNUTLS_E_SUCCESS){
489
fprintf(stderr, "Syntax error at: %s\n", err);
490
fprintf(stderr, "GnuTLS error: %s\n",
491
safer_gnutls_strerror(ret));
492
gnutls_deinit(*session);
493
return -1;
494
}
326
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Syntax error at: %s\n", err);
329
fprintf(stderr, "GnuTLS error: %s\n",
330
safer_gnutls_strerror(ret));
331
return -1;
495
332
}
496
333
497
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
498
mc.cred);
499
if(ret != GNUTLS_E_SUCCESS){
500
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
334
if ((ret = gnutls_credentials_set
335
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
336
!= GNUTLS_E_SUCCESS) {
337
fprintf(stderr, "Error setting a credentials set: %s\n",
501
338
safer_gnutls_strerror(ret));
502
gnutls_deinit(*session);
503
339
return -1;
504
340
}
505
341
506
342
/* ignore client certificate if any. */
507
gnutls_certificate_server_set_request(*session,
508
GNUTLS_CERT_IGNORE);
343
gnutls_certificate_server_set_request (es->session,
344
GNUTLS_CERT_IGNORE);
509
345
510
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
346
gnutls_dh_set_prime_bits (es->session, DH_BITS);
511
347
512
348
return 0;
513
349
}
514
350
515
/* Avahi log function callback */
516
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
517
__attribute__((unused)) const char *txt){}
351
void empty_log(__attribute__((unused)) AvahiLogLevel level,
352
__attribute__((unused)) const char *txt){}
518
353
519
/* Called when a Mandos server is found */
520
static int start_mandos_communication(const char *ip, uint16_t port,
521
AvahiIfIndex if_index,
522
int af){
354
int start_mandos_communication(const char *ip, uint16_t port,
355
unsigned int if_index){
523
356
int ret, tcp_sd;
524
ssize_t sret;
525
union {
526
struct sockaddr_in in;
527
struct sockaddr_in6 in6;
528
} to;
357
struct sockaddr_in6 to;
358
encrypted_session es;
529
359
char *buffer = NULL;
530
360
char *decrypted_buffer;
531
361
size_t buffer_length = 0;
532
362
size_t buffer_capacity = 0;
533
363
ssize_t decrypted_buffer_size;
534
size_t written;
364
size_t written = 0;
535
365
int retval = 0;
536
gnutls_session_t session;
537
int pf; /* Protocol family */
538
539
switch(af){
540
case AF_INET6:
541
pf = PF_INET6;
542
break;
543
case AF_INET:
544
pf = PF_INET;
545
break;
546
default:
547
fprintf(stderr, "Bad address family: %d\n", af);
548
return -1;
549
}
550
551
ret = init_gnutls_session(&session);
552
if(ret != 0){
553
return -1;
554
}
366
char interface[IF_NAMESIZE];
555
367
556
368
if(debug){
557
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
558
"\n", ip, port);
369
fprintf(stderr, "Setting up a tcp connection to %s\n", ip);
559
370
}
560
371
561
tcp_sd = socket(pf, SOCK_STREAM, 0);
562
if(tcp_sd < 0){
372
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
373
if(tcp_sd < 0) {
563
374
perror("socket");
564
375
return -1;
565
376
}
377
378
if(debug){
379
if(if_indextoname(if_index, interface) == NULL){
380
if(debug){
381
perror("if_indextoname");
382
}
383
return -1;
384
}
385
386
fprintf(stderr, "Binding to interface %s\n", interface);
387
}
566
388
567
memset(&to, 0, sizeof(to));
568
if(af == AF_INET6){
569
to.in6.sin6_family = (uint16_t)af;
570
ret = inet_pton(af, ip, &to.in6.sin6_addr);
571
} else { /* IPv4 */
572
to.in.sin_family = (sa_family_t)af;
573
ret = inet_pton(af, ip, &to.in.sin_addr);
574
}
575
if(ret < 0 ){
389
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
392
if (ret < 0 ){
576
393
perror("inet_pton");
577
394
return -1;
578
}
395
}
579
396
if(ret == 0){
580
397
fprintf(stderr, "Bad address: %s\n", ip);
581
398
return -1;
582
399
}
583
if(af == AF_INET6){
584
to.in6.sin6_port = htons(port); /* Spurious warnings from
585
-Wconversion and
586
-Wunreachable-code */
587
588
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
589
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
590
-Wunreachable-code*/
591
if(if_index == AVAHI_IF_UNSPEC){
592
fprintf(stderr, "An IPv6 link-local address is incomplete"
593
" without a network interface\n");
594
return -1;
595
}
596
/* Set the network interface number as scope */
597
to.in6.sin6_scope_id = (uint32_t)if_index;
598
}
599
} else {
600
to.in.sin_port = htons(port); /* Spurious warnings from
601
-Wconversion and
602
-Wunreachable-code */
603
}
400
to.sin6_port = htons(port); /* Spurious warning */
401
402
to.sin6_scope_id = (uint32_t)if_index;
604
403
605
404
if(debug){
606
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
607
char interface[IF_NAMESIZE];
608
if(if_indextoname((unsigned int)if_index, interface) == NULL){
609
perror("if_indextoname");
610
} else {
611
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
612
ip, interface, port);
613
}
614
} else {
615
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
616
port);
617
}
618
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
619
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
620
const char *pcret;
621
if(af == AF_INET6){
622
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
623
sizeof(addrstr));
624
} else {
625
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
626
sizeof(addrstr));
627
}
628
if(pcret == NULL){
629
perror("inet_ntop");
630
} else {
631
if(strcmp(addrstr, ip) != 0){
632
fprintf(stderr, "Canonical address form: %s\n", addrstr);
633
}
634
}
405
fprintf(stderr, "Connection to: %s\n", ip);
635
406
}
636
407
637
if(af == AF_INET6){
638
ret = connect(tcp_sd, &to.in6, sizeof(to));
639
} else {
640
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
641
}
642
if(ret < 0){
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
409
if (ret < 0){
643
410
perror("connect");
644
411
return -1;
645
412
}
646
413
647
const char *out = mandos_protocol_version;
648
written = 0;
649
while(true){
650
size_t out_size = strlen(out);
651
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
652
out_size - written));
653
if(ret == -1){
654
perror("write");
655
retval = -1;
656
goto mandos_end;
657
}
658
written += (size_t)ret;
659
if(written < out_size){
660
continue;
661
} else {
662
if(out == mandos_protocol_version){
663
written = 0;
664
out = "\r\n";
665
} else {
666
break;
667
}
668
}
414
ret = initgnutls (&es);
415
if (ret != 0){
416
retval = -1;
417
return -1;
669
418
}
670
419
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
422
671
423
if(debug){
672
424
fprintf(stderr, "Establishing TLS session with %s\n", ip);
673
425
}
674
426
675
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
676
677
do{
678
ret = gnutls_handshake(session);
679
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
680
681
if(ret != GNUTLS_E_SUCCESS){
427
ret = gnutls_handshake (es.session);
428
429
if (ret != GNUTLS_E_SUCCESS){
682
430
if(debug){
683
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
684
gnutls_perror(ret);
431
fprintf(stderr, "\n*** Handshake failed ***\n");
432
gnutls_perror (ret);
685
433
}
686
434
retval = -1;
687
goto mandos_end;
435
goto exit;
688
436
}
689
437
690
/* Read OpenPGP packet that contains the wanted password */
438
//Retrieve OpenPGP packet that contains the wanted password
691
439
692
440
if(debug){
693
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
441
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
694
442
ip);
695
443
}
696
444
697
445
while(true){
698
buffer_capacity = incbuffer(&buffer, buffer_length,
699
buffer_capacity);
700
if(buffer_capacity == 0){
701
perror("incbuffer");
702
retval = -1;
703
goto mandos_end;
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
448
if (buffer == NULL){
449
perror("realloc");
450
goto exit;
451
}
452
buffer_capacity += BUFFER_SIZE;
704
453
}
705
454
706
sret = gnutls_record_recv(session, buffer+buffer_length,
707
BUFFER_SIZE);
708
if(sret == 0){
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
457
if (ret == 0){
709
458
break;
710
459
}
711
if(sret < 0){
712
switch(sret){
460
if (ret < 0){
461
switch(ret){
713
462
case GNUTLS_E_INTERRUPTED:
714
463
case GNUTLS_E_AGAIN:
715
464
break;
716
465
case GNUTLS_E_REHANDSHAKE:
717
do{
718
ret = gnutls_handshake(session);
719
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
720
if(ret < 0){
721
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
722
gnutls_perror(ret);
466
ret = gnutls_handshake (es.session);
467
if (ret < 0){
468
fprintf(stderr, "\n*** Handshake failed ***\n");
469
gnutls_perror (ret);
723
470
retval = -1;
724
goto mandos_end;
471
goto exit;
725
472
}
726
473
break;
727
474
default:
728
475
fprintf(stderr, "Unknown error while reading data from"
729
" encrypted session with Mandos server\n");
476
" encrypted session with mandos server\n");
730
477
retval = -1;
731
gnutls_bye(session, GNUTLS_SHUT_RDWR);
732
goto mandos_end;
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
479
goto exit;
733
480
}
734
481
} else {
735
buffer_length += (size_t) sret;
482
buffer_length += (size_t) ret;
736
483
}
737
484
}
738
485
739
if(debug){
740
fprintf(stderr, "Closing TLS session\n");
741
}
742
743
gnutls_bye(session, GNUTLS_SHUT_RDWR);
744
745
if(buffer_length > 0){
486
if (buffer_length > 0){
746
487
decrypted_buffer_size = pgp_packet_decrypt(buffer,
747
488
buffer_length,
748
&decrypted_buffer);
749
if(decrypted_buffer_size >= 0){
750
written = 0;
751
while(written < (size_t) decrypted_buffer_size){
752
ret = (int)fwrite(decrypted_buffer + written, 1,
753
(size_t)decrypted_buffer_size - written,
754
stdout);
489
&decrypted_buffer,
490
certdir);
491
if (decrypted_buffer_size >= 0){
492
while(written < (size_t)decrypted_buffer_size){
493
ret = (int)fwrite (decrypted_buffer + written, 1,
494
(size_t)decrypted_buffer_size - written,
495
stdout);
755
496
if(ret == 0 and ferror(stdout)){
756
497
if(debug){
757
498
fprintf(stderr, "Error writing encrypted data: %s\n",
766
507
} else {
767
508
retval = -1;
768
509
}
769
} else {
770
retval = -1;
771
}
772
773
/* Shutdown procedure */
774
775
mandos_end:
510
}
511
512
//shutdown procedure
513
514
if(debug){
515
fprintf(stderr, "Closing TLS session\n");
516
}
517
776
518
free(buffer);
777
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
778
if(ret == -1){
779
perror("close");
780
}
781
gnutls_deinit(session);
519
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
520
exit:
521
close(tcp_sd);
522
gnutls_deinit (es.session);
523
gnutls_certificate_free_credentials (es.cred);
524
gnutls_global_deinit ();
782
525
return retval;
783
526
}
784
527
785
static void resolve_callback(AvahiSServiceResolver *r,
786
AvahiIfIndex interface,
787
AvahiProtocol proto,
788
AvahiResolverEvent event,
789
const char *name,
790
const char *type,
791
const char *domain,
792
const char *host_name,
793
const AvahiAddress *address,
794
uint16_t port,
795
AVAHI_GCC_UNUSED AvahiStringList *txt,
796
AVAHI_GCC_UNUSED AvahiLookupResultFlags
797
flags,
798
AVAHI_GCC_UNUSED void* userdata){
799
assert(r);
528
static AvahiSimplePoll *simple_poll = NULL;
529
static AvahiServer *server = NULL;
530
531
static void resolve_callback(
532
AvahiSServiceResolver *r,
533
AvahiIfIndex interface,
534
AVAHI_GCC_UNUSED AvahiProtocol protocol,
535
AvahiResolverEvent event,
536
const char *name,
537
const char *type,
538
const char *domain,
539
const char *host_name,
540
const AvahiAddress *address,
541
uint16_t port,
542
AVAHI_GCC_UNUSED AvahiStringList *txt,
543
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
544
AVAHI_GCC_UNUSED void* userdata) {
545
546
assert(r); /* Spurious warning */
800
547
801
548
/* Called whenever a service has been resolved successfully or
802
549
timed out */
803
550
804
switch(event){
551
switch (event) {
805
552
default:
806
553
case AVAHI_RESOLVER_FAILURE:
807
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
808
" of type '%s' in domain '%s': %s\n", name, type, domain,
809
avahi_strerror(avahi_server_errno(mc.server)));
554
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
555
" type '%s' in domain '%s': %s\n", name, type, domain,
556
avahi_strerror(avahi_server_errno(server)));
810
557
break;
811
558
812
559
case AVAHI_RESOLVER_FOUND:
814
561
char ip[AVAHI_ADDRESS_STR_MAX];
815
562
avahi_address_snprint(ip, sizeof(ip), address);
816
563
if(debug){
817
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
818
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
819
ip, (intmax_t)interface, port);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
820
566
}
821
int ret = start_mandos_communication(ip, port, interface,
822
avahi_proto_to_af(proto));
823
if(ret == 0){
824
avahi_simple_poll_quit(mc.simple_poll);
567
int ret = start_mandos_communication(ip, port,
568
(unsigned int) interface);
569
if (ret == 0){
570
exit(EXIT_SUCCESS);
825
571
}
826
572
}
827
573
}
828
574
avahi_s_service_resolver_free(r);
829
575
}
830
576
831
static void browse_callback(AvahiSServiceBrowser *b,
832
AvahiIfIndex interface,
833
AvahiProtocol protocol,
834
AvahiBrowserEvent event,
835
const char *name,
836
const char *type,
837
const char *domain,
838
AVAHI_GCC_UNUSED AvahiLookupResultFlags
839
flags,
840
AVAHI_GCC_UNUSED void* userdata){
841
assert(b);
842
843
/* Called whenever a new services becomes available on the LAN or
844
is removed from the LAN */
845
846
switch(event){
847
default:
848
case AVAHI_BROWSER_FAILURE:
849
850
fprintf(stderr, "(Avahi browser) %s\n",
851
avahi_strerror(avahi_server_errno(mc.server)));
852
avahi_simple_poll_quit(mc.simple_poll);
853
return;
854
855
case AVAHI_BROWSER_NEW:
856
/* We ignore the returned Avahi resolver object. In the callback
857
function we free it. If the Avahi server is terminated before
858
the callback function is called the Avahi server will free the
859
resolver for us. */
860
861
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
862
name, type, domain, protocol, 0,
863
resolve_callback, NULL) == NULL)
864
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
865
name, avahi_strerror(avahi_server_errno(mc.server)));
866
break;
867
868
case AVAHI_BROWSER_REMOVE:
869
break;
870
871
case AVAHI_BROWSER_ALL_FOR_NOW:
872
case AVAHI_BROWSER_CACHE_EXHAUSTED:
873
if(debug){
874
fprintf(stderr, "No Mandos server found, still searching...\n");
577
static void browse_callback(
578
AvahiSServiceBrowser *b,
579
AvahiIfIndex interface,
580
AvahiProtocol protocol,
581
AvahiBrowserEvent event,
582
const char *name,
583
const char *type,
584
const char *domain,
585
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
586
void* userdata) {
587
588
AvahiServer *s = userdata;
589
assert(b); /* Spurious warning */
590
591
/* Called whenever a new services becomes available on the LAN or
592
is removed from the LAN */
593
594
switch (event) {
595
default:
596
case AVAHI_BROWSER_FAILURE:
597
598
fprintf(stderr, "(Browser) %s\n",
599
avahi_strerror(avahi_server_errno(server)));
600
avahi_simple_poll_quit(simple_poll);
601
return;
602
603
case AVAHI_BROWSER_NEW:
604
/* We ignore the returned resolver object. In the callback
605
function we free it. If the server is terminated before
606
the callback function is called the server will free
607
the resolver for us. */
608
609
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
610
type, domain,
611
AVAHI_PROTO_INET6, 0,
612
resolve_callback, s)))
613
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
614
avahi_strerror(avahi_server_errno(s)));
615
break;
616
617
case AVAHI_BROWSER_REMOVE:
618
break;
619
620
case AVAHI_BROWSER_ALL_FOR_NOW:
621
case AVAHI_BROWSER_CACHE_EXHAUSTED:
622
break;
875
623
}
876
break;
877
}
878
}
879
880
sig_atomic_t quit_now = 0;
881
882
/* stop main loop after sigterm has been called */
883
static void handle_sigterm(__attribute__((unused)) int sig){
884
if(quit_now){
885
return;
886
}
887
quit_now = 1;
888
int old_errno = errno;
889
if(mc.simple_poll != NULL){
890
avahi_simple_poll_quit(mc.simple_poll);
891
}
892
errno = old_errno;
893
}
894
895
int main(int argc, char *argv[]){
896
AvahiSServiceBrowser *sb = NULL;
897
int error;
898
int ret;
899
intmax_t tmpmax;
624
}
625
626
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
627
const char *combinepath(const char *first, const char *second){
900
628
char *tmp;
901
int exitcode = EXIT_SUCCESS;
902
const char *interface = "eth0";
903
struct ifreq network;
904
int sd;
905
uid_t uid;
906
gid_t gid;
907
char *connect_to = NULL;
908
char tempdir[] = "/tmp/mandosXXXXXX";
909
bool tempdir_created = false;
910
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
911
const char *seckey = PATHDIR "/" SECKEY;
912
const char *pubkey = PATHDIR "/" PUBKEY;
913
914
bool gnutls_initialized = false;
915
bool gpgme_initialized = false;
916
float delay = 2.5f;
917
918
struct sigaction old_sigterm_action;
919
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
920
921
{
922
struct argp_option options[] = {
923
{ .name = "debug", .key = 128,
924
.doc = "Debug mode", .group = 3 },
925
{ .name = "connect", .key = 'c',
926
.arg = "ADDRESS:PORT",
927
.doc = "Connect directly to a specific Mandos server",
928
.group = 1 },
929
{ .name = "interface", .key = 'i',
930
.arg = "NAME",
931
.doc = "Network interface that will be used to search for"
932
" Mandos servers",
933
.group = 1 },
934
{ .name = "seckey", .key = 's',
935
.arg = "FILE",
936
.doc = "OpenPGP secret key file base name",
937
.group = 1 },
938
{ .name = "pubkey", .key = 'p',
939
.arg = "FILE",
940
.doc = "OpenPGP public key file base name",
941
.group = 2 },
942
{ .name = "dh-bits", .key = 129,
943
.arg = "BITS",
944
.doc = "Bit length of the prime number used in the"
945
" Diffie-Hellman key exchange",
946
.group = 2 },
947
{ .name = "priority", .key = 130,
948
.arg = "STRING",
949
.doc = "GnuTLS priority string for the TLS handshake",
950
.group = 1 },
951
{ .name = "delay", .key = 131,
952
.arg = "SECONDS",
953
.doc = "Maximum delay to wait for interface startup",
954
.group = 2 },
955
{ .name = NULL }
956
};
629
tmp = malloc(strlen(first) + strlen(second) + 2);
630
if (tmp == NULL){
631
perror("malloc");
632
return NULL;
633
}
634
strcpy(tmp, first);
635
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
636
strcat(tmp, "/");
637
}
638
strcat(tmp, second);
639
return tmp;
640
}
641
642
643
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
644
AvahiServerConfig config;
645
AvahiSServiceBrowser *sb = NULL;
646
int error;
647
int ret;
648
int returncode = EXIT_SUCCESS;
649
const char *interface = "eth0";
650
struct ifreq network;
651
int sd;
957
652
958
error_t parse_opt(int key, char *arg,
959
struct argp_state *state){
960
switch(key){
961
case 128: /* --debug */
962
debug = true;
963
break;
964
case 'c': /* --connect */
965
connect_to = arg;
966
break;
967
case 'i': /* --interface */
968
interface = arg;
969
break;
970
case 's': /* --seckey */
971
seckey = arg;
972
break;
973
case 'p': /* --pubkey */
974
pubkey = arg;
975
break;
976
case 129: /* --dh-bits */
977
errno = 0;
978
tmpmax = strtoimax(arg, &tmp, 10);
979
if(errno != 0 or tmp == arg or *tmp != '\0'
980
or tmpmax != (typeof(mc.dh_bits))tmpmax){
981
fprintf(stderr, "Bad number of DH bits\n");
982
exit(EXIT_FAILURE);
983
}
984
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
985
break;
986
case 130: /* --priority */
987
mc.priority = arg;
988
break;
989
case 131: /* --delay */
990
errno = 0;
991
delay = strtof(arg, &tmp);
992
if(errno != 0 or tmp == arg or *tmp != '\0'){
993
fprintf(stderr, "Bad delay\n");
994
exit(EXIT_FAILURE);
995
}
996
break;
997
case ARGP_KEY_ARG:
998
argp_usage(state);
999
case ARGP_KEY_END:
653
while (true){
654
static struct option long_options[] = {
655
{"debug", no_argument, (int *)&debug, 1},
656
{"interface", required_argument, 0, 'i'},
657
{"certdir", required_argument, 0, 'd'},
658
{"certkey", required_argument, 0, 'c'},
659
{"certfile", required_argument, 0, 'k'},
660
{0, 0, 0, 0} };
661
662
int option_index = 0;
663
ret = getopt_long (argc, argv, "i:", long_options,
664
&option_index);
665
666
if (ret == -1){
667
break;
668
}
669
670
switch(ret){
671
case 0:
672
break;
673
case 'i':
674
interface = optarg;
675
break;
676
case 'd':
677
certdir = optarg;
678
break;
679
case 'c':
680
certfile = optarg;
681
break;
682
case 'k':
683
certkey = optarg;
1000
684
break;
1001
685
default:
1002
return ARGP_ERR_UNKNOWN;
686
exit(EXIT_FAILURE);
1003
687
}
1004
return 0;
1005
}
1006
1007
struct argp argp = { .options = options, .parser = parse_opt,
1008
.args_doc = "",
1009
.doc = "Mandos client -- Get and decrypt"
1010
" passwords from a Mandos server" };
1011
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1012
if(ret == ARGP_ERR_UNKNOWN){
1013
fprintf(stderr, "Unknown error while parsing arguments\n");
1014
exitcode = EXIT_FAILURE;
1015
goto end;
1016
}
1017
}
1018
1019
if(not debug){
1020
avahi_set_log_function(empty_log);
1021
}
1022
1023
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1024
from the signal handler */
1025
/* Initialize the pseudo-RNG for Avahi */
1026
srand((unsigned int) time(NULL));
1027
mc.simple_poll = avahi_simple_poll_new();
1028
if(mc.simple_poll == NULL){
1029
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1030
exitcode = EXIT_FAILURE;
1031
goto end;
1032
}
1033
1034
sigemptyset(&sigterm_action.sa_mask);
1035
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1036
if(ret == -1){
1037
perror("sigaddset");
1038
exitcode = EXIT_FAILURE;
1039
goto end;
1040
}
1041
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1042
if(ret == -1){
1043
perror("sigaddset");
1044
exitcode = EXIT_FAILURE;
1045
goto end;
1046
}
1047
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1048
if(ret == -1){
1049
perror("sigaddset");
1050
exitcode = EXIT_FAILURE;
1051
goto end;
1052
}
1053
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1054
if(ret == -1){
1055
perror("sigaction");
1056
exitcode = EXIT_FAILURE;
1057
goto end;
1058
}
1059
1060
/* If the interface is down, bring it up */
1061
if(interface[0] != '\0'){
1062
#ifdef __linux__
1063
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1064
messages to mess up the prompt */
1065
ret = klogctl(8, NULL, 5);
1066
bool restore_loglevel = true;
1067
if(ret == -1){
1068
restore_loglevel = false;
1069
perror("klogctl");
1070
}
1071
#endif /* __linux__ */
1072
688
}
689
690
certfile = combinepath(certdir, certfile);
691
if (certfile == NULL){
692
returncode = EXIT_FAILURE;
693
goto exit;
694
}
695
696
certkey = combinepath(certdir, certkey);
697
if (certkey == NULL){
698
returncode = EXIT_FAILURE;
699
goto exit;
700
}
701
1073
702
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1074
if(sd < 0){
703
if(sd < 0) {
1075
704
perror("socket");
1076
exitcode = EXIT_FAILURE;
1077
#ifdef __linux__
1078
if(restore_loglevel){
1079
ret = klogctl(7, NULL, 0);
1080
if(ret == -1){
1081
perror("klogctl");
1082
}
1083
}
1084
#endif /* __linux__ */
1085
goto end;
705
returncode = EXIT_FAILURE;
706
goto exit;
1086
707
}
1087
strcpy(network.ifr_name, interface);
708
strcpy(network.ifr_name, interface);
1088
709
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1089
710
if(ret == -1){
711
1090
712
perror("ioctl SIOCGIFFLAGS");
1091
#ifdef __linux__
1092
if(restore_loglevel){
1093
ret = klogctl(7, NULL, 0);
1094
if(ret == -1){
1095
perror("klogctl");
1096
}
1097
}
1098
#endif /* __linux__ */
1099
exitcode = EXIT_FAILURE;
1100
goto end;
713
returncode = EXIT_FAILURE;
714
goto exit;
1101
715
}
1102
716
if((network.ifr_flags & IFF_UP) == 0){
1103
717
network.ifr_flags |= IFF_UP;
1104
718
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1105
719
if(ret == -1){
1106
720
perror("ioctl SIOCSIFFLAGS");
1107
exitcode = EXIT_FAILURE;
1108
#ifdef __linux__
1109
if(restore_loglevel){
1110
ret = klogctl(7, NULL, 0);
1111
if(ret == -1){
1112
perror("klogctl");
1113
}
1114
}
1115
#endif /* __linux__ */
1116
goto end;
1117
}
1118
}
1119
/* sleep checking until interface is running */
1120
for(int i=0; i < delay * 4; i++){
1121
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1122
if(ret == -1){
1123
perror("ioctl SIOCGIFFLAGS");
1124
} else if(network.ifr_flags & IFF_RUNNING){
1125
break;
1126
}
1127
struct timespec sleeptime = { .tv_nsec = 250000000 };
1128
ret = nanosleep(&sleeptime, NULL);
1129
if(ret == -1 and errno != EINTR){
1130
perror("nanosleep");
1131
}
1132
}
1133
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1134
if(ret == -1){
1135
perror("close");
1136
}
1137
#ifdef __linux__
1138
if(restore_loglevel){
1139
/* Restores kernel loglevel to default */
1140
ret = klogctl(7, NULL, 0);
1141
if(ret == -1){
1142
perror("klogctl");
1143
}
1144
}
1145
#endif /* __linux__ */
1146
}
1147
1148
uid = getuid();
1149
gid = getgid();
1150
1151
errno = 0;
1152
setgid(gid);
1153
if(ret == -1){
1154
perror("setgid");
1155
}
1156
1157
ret = setuid(uid);
1158
if(ret == -1){
1159
perror("setuid");
1160
}
1161
1162
ret = init_gnutls_global(pubkey, seckey);
1163
if(ret == -1){
1164
fprintf(stderr, "init_gnutls_global failed\n");
1165
exitcode = EXIT_FAILURE;
1166
goto end;
1167
} else {
1168
gnutls_initialized = true;
1169
}
1170
1171
if(mkdtemp(tempdir) == NULL){
1172
perror("mkdtemp");
1173
goto end;
1174
}
1175
tempdir_created = true;
1176
1177
if(not init_gpgme(pubkey, seckey, tempdir)){
1178
fprintf(stderr, "init_gpgme failed\n");
1179
exitcode = EXIT_FAILURE;
1180
goto end;
1181
} else {
1182
gpgme_initialized = true;
1183
}
1184
1185
if(interface[0] != '\0'){
1186
if_index = (AvahiIfIndex) if_nametoindex(interface);
1187
if(if_index == 0){
1188
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1189
exitcode = EXIT_FAILURE;
1190
goto end;
1191
}
1192
}
1193
1194
if(connect_to != NULL){
1195
/* Connect directly, do not use Zeroconf */
1196
/* (Mainly meant for debugging) */
1197
char *address = strrchr(connect_to, ':');
1198
if(address == NULL){
1199
fprintf(stderr, "No colon in address\n");
1200
exitcode = EXIT_FAILURE;
1201
goto end;
1202
}
1203
uint16_t port;
1204
errno = 0;
1205
tmpmax = strtoimax(address+1, &tmp, 10);
1206
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1207
or tmpmax != (uint16_t)tmpmax){
1208
fprintf(stderr, "Bad port number\n");
1209
exitcode = EXIT_FAILURE;
1210
goto end;
1211
}
1212
port = (uint16_t)tmpmax;
1213
*address = '\0';
1214
address = connect_to;
1215
/* Colon in address indicates IPv6 */
1216
int af;
1217
if(strchr(address, ':') != NULL){
1218
af = AF_INET6;
1219
} else {
1220
af = AF_INET;
1221
}
1222
ret = start_mandos_communication(address, port, if_index, af);
1223
if(ret < 0){
1224
exitcode = EXIT_FAILURE;
1225
} else {
1226
exitcode = EXIT_SUCCESS;
1227
}
1228
goto end;
1229
}
1230
1231
{
1232
AvahiServerConfig config;
1233
/* Do not publish any local Zeroconf records */
721
returncode = EXIT_FAILURE;
722
goto exit;
723
}
724
}
725
close(sd);
726
727
if (not debug){
728
avahi_set_log_function(empty_log);
729
}
730
731
/* Initialize the psuedo-RNG */
732
srand((unsigned int) time(NULL));
733
734
/* Allocate main loop object */
735
if (!(simple_poll = avahi_simple_poll_new())) {
736
fprintf(stderr, "Failed to create simple poll object.\n");
737
returncode = EXIT_FAILURE;
738
goto exit;
739
}
740
741
/* Do not publish any local records */
1234
742
avahi_server_config_init(&config);
1235
743
config.publish_hinfo = 0;
1236
744
config.publish_addresses = 0;
1237
745
config.publish_workstation = 0;
1238
746
config.publish_domain = 0;
1239
747
1240
748
/* Allocate a new server */
1241
mc.server = avahi_server_new(avahi_simple_poll_get
1242
(mc.simple_poll), &config, NULL,
1243
NULL, &error);
1244
1245
/* Free the Avahi configuration data */
749
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
750
&config, NULL, NULL, &error);
751
752
/* Free the configuration data */
1246
753
avahi_server_config_free(&config);
1247
}
1248
1249
/* Check if creating the Avahi server object succeeded */
1250
if(mc.server == NULL){
1251
fprintf(stderr, "Failed to create Avahi server: %s\n",
1252
avahi_strerror(error));
1253
exitcode = EXIT_FAILURE;
1254
goto end;
1255
}
1256
1257
/* Create the Avahi service browser */
1258
sb = avahi_s_service_browser_new(mc.server, if_index,
1259
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1260
NULL, 0, browse_callback, NULL);
1261
if(sb == NULL){
1262
fprintf(stderr, "Failed to create service browser: %s\n",
1263
avahi_strerror(avahi_server_errno(mc.server)));
1264
exitcode = EXIT_FAILURE;
1265
goto end;
1266
}
1267
1268
/* Run the main loop */
1269
1270
if(debug){
1271
fprintf(stderr, "Starting Avahi loop search\n");
1272
}
1273
1274
avahi_simple_poll_loop(mc.simple_poll);
1275
1276
end:
1277
1278
if(debug){
1279
fprintf(stderr, "%s exiting\n", argv[0]);
1280
}
1281
1282
/* Cleanup things */
1283
if(sb != NULL)
1284
avahi_s_service_browser_free(sb);
1285
1286
if(mc.server != NULL)
1287
avahi_server_free(mc.server);
1288
1289
if(mc.simple_poll != NULL)
1290
avahi_simple_poll_free(mc.simple_poll);
1291
1292
if(gnutls_initialized){
1293
gnutls_certificate_free_credentials(mc.cred);
1294
gnutls_global_deinit();
1295
gnutls_dh_params_deinit(mc.dh_params);
1296
}
1297
1298
if(gpgme_initialized){
1299
gpgme_release(mc.ctx);
1300
}
1301
1302
/* Removes the temp directory used by GPGME */
1303
if(tempdir_created){
1304
DIR *d;
1305
struct dirent *direntry;
1306
d = opendir(tempdir);
1307
if(d == NULL){
1308
if(errno != ENOENT){
1309
perror("opendir");
1310
}
1311
} else {
1312
while(true){
1313
direntry = readdir(d);
1314
if(direntry == NULL){
1315
break;
1316
}
1317
/* Skip "." and ".." */
1318
if(direntry->d_name[0] == '.'
1319
and (direntry->d_name[1] == '\0'
1320
or (direntry->d_name[1] == '.'
1321
and direntry->d_name[2] == '\0'))){
1322
continue;
1323
}
1324
char *fullname = NULL;
1325
ret = asprintf(&fullname, "%s/%s", tempdir,
1326
direntry->d_name);
1327
if(ret < 0){
1328
perror("asprintf");
1329
continue;
1330
}
1331
ret = remove(fullname);
1332
if(ret == -1){
1333
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1334
strerror(errno));
1335
}
1336
free(fullname);
1337
}
1338
closedir(d);
1339
}
1340
ret = rmdir(tempdir);
1341
if(ret == -1 and errno != ENOENT){
1342
perror("rmdir");
1343
}
1344
}
1345
1346
return exitcode;
754
755
/* Check if creating the server object succeeded */
756
if (!server) {
757
fprintf(stderr, "Failed to create server: %s\n",
758
avahi_strerror(error));
759
returncode = EXIT_FAILURE;
760
goto exit;
761
}
762
763
/* Create the service browser */
764
sb = avahi_s_service_browser_new(server,
765
(AvahiIfIndex)
766
if_nametoindex(interface),
767
AVAHI_PROTO_INET6,
768
"_mandos._tcp", NULL, 0,
769
browse_callback, server);
770
if (!sb) {
771
fprintf(stderr, "Failed to create service browser: %s\n",
772
avahi_strerror(avahi_server_errno(server)));
773
returncode = EXIT_FAILURE;
774
goto exit;
775
}
776
777
/* Run the main loop */
778
779
if (debug){
780
fprintf(stderr, "Starting avahi loop search\n");
781
}
782
783
avahi_simple_poll_loop(simple_poll);
784
785
exit:
786
787
if (debug){
788
fprintf(stderr, "%s exiting\n", argv[0]);
789
}
790
791
/* Cleanup things */
792
if (sb)
793
avahi_s_service_browser_free(sb);
794
795
if (server)
796
avahi_server_free(server);
797
798
if (simple_poll)
799
avahi_simple_poll_free(simple_poll);
800
free(certfile);
801
free(certkey);
802
803
return returncode;
1347
804
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0