94
47
#include <avahi-common/malloc.h>
95
48
#include <avahi-common/error.h>
98
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
101
init_gnutls_session(),
103
#include <gnutls/openpgp.h>
104
/* gnutls_certificate_set_openpgp_key_file(),
105
GNUTLS_OPENPGP_FMT_BASE64 */
108
#include <gpgme.h> /* All GPGME types, constants and
111
GPGME_PROTOCOL_OpenPGP,
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
65
#include <errno.h> /* perror() */
114
71
#define BUFFER_SIZE 256
116
#define PATHDIR "/conf/conf.d/mandos"
117
#define SECKEY "seckey.txt"
118
#define PUBKEY "pubkey.txt"
74
static const char *certdir = "/conf/conf.d/mandos";
75
static const char *certfile = "openpgp-client.txt";
76
static const char *certkey = "openpgp-client-key.txt";
120
78
bool debug = false;
121
static const char mandos_protocol_version[] = "1";
122
const char *argp_program_version = "mandos-client " VERSION;
123
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
125
/* Used for passing in values through the Avahi callback functions */
127
AvahiSimplePoll *simple_poll;
81
gnutls_session_t session;
129
82
gnutls_certificate_credentials_t cred;
130
unsigned int dh_bits;
131
83
gnutls_dh_params_t dh_params;
132
const char *priority;
87
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
90
gpgme_data_t dh_crypto, dh_plain;
136
/* global context so signal handler can reach it*/
140
* Make additional room in "buffer" for at least BUFFER_SIZE more
141
* bytes. "buffer_capacity" is how much is currently allocated,
142
* "buffer_length" is how much is already used.
144
size_t incbuffer(char **buffer, size_t buffer_length,
145
size_t buffer_capacity){
146
if(buffer_length + BUFFER_SIZE > buffer_capacity){
147
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
151
buffer_capacity += BUFFER_SIZE;
153
return buffer_capacity;
159
static bool init_gpgme(const char *seckey,
160
const char *pubkey, const char *tempdir){
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
163
96
gpgme_engine_info_t engine_info;
167
* Helper function to insert pub and seckey to the engine keyring.
169
bool import_key(const char *filename){
171
gpgme_data_t pgp_data;
173
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
179
rc = gpgme_data_new_from_fd(&pgp_data, fd);
180
if(rc != GPG_ERR_NO_ERROR){
181
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
182
gpgme_strsource(rc), gpgme_strerror(rc));
186
rc = gpgme_op_import(mc.ctx, pgp_data);
187
if(rc != GPG_ERR_NO_ERROR){
188
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
189
gpgme_strsource(rc), gpgme_strerror(rc));
193
ret = (int)TEMP_FAILURE_RETRY(close(fd));
197
gpgme_data_release(pgp_data);
202
fprintf(stderr, "Initializing GPGME\n");
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
206
103
gpgme_check_version(NULL);
207
104
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
208
if(rc != GPG_ERR_NO_ERROR){
105
if (rc != GPG_ERR_NO_ERROR){
209
106
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
210
107
gpgme_strsource(rc), gpgme_strerror(rc));
214
/* Set GPGME home directory for the OpenPGP engine only */
215
rc = gpgme_get_engine_info(&engine_info);
216
if(rc != GPG_ERR_NO_ERROR){
111
/* Set GPGME home directory */
112
rc = gpgme_get_engine_info (&engine_info);
113
if (rc != GPG_ERR_NO_ERROR){
217
114
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
218
115
gpgme_strsource(rc), gpgme_strerror(rc));
221
118
while(engine_info != NULL){
222
119
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
223
120
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
224
engine_info->file_name, tempdir);
121
engine_info->file_name, homedir);
227
124
engine_info = engine_info->next;
229
126
if(engine_info == NULL){
230
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
234
/* Create new GPGME "context" */
235
rc = gpgme_new(&(mc.ctx));
236
if(rc != GPG_ERR_NO_ERROR){
237
fprintf(stderr, "bad gpgme_new: %s: %s\n",
238
gpgme_strsource(rc), gpgme_strerror(rc));
242
if(not import_key(pubkey) or not import_key(seckey)){
250
* Decrypt OpenPGP data.
251
* Returns -1 on error
253
static ssize_t pgp_packet_decrypt(const char *cryptotext,
256
gpgme_data_t dh_crypto, dh_plain;
259
size_t plaintext_capacity = 0;
260
ssize_t plaintext_length = 0;
263
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
266
/* Create new GPGME data buffer from memory cryptotext */
267
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
269
if(rc != GPG_ERR_NO_ERROR){
127
fprintf(stderr, "Could not set home dir to %s\n", homedir);
131
/* Create new GPGME data buffer from packet buffer */
132
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
133
if (rc != GPG_ERR_NO_ERROR){
270
134
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
271
135
gpgme_strsource(rc), gpgme_strerror(rc));
275
139
/* Create new empty GPGME data buffer for the plaintext */
276
140
rc = gpgme_data_new(&dh_plain);
277
if(rc != GPG_ERR_NO_ERROR){
141
if (rc != GPG_ERR_NO_ERROR){
278
142
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
279
143
gpgme_strsource(rc), gpgme_strerror(rc));
280
gpgme_data_release(dh_crypto);
284
/* Decrypt data from the cryptotext data buffer to the plaintext
286
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
287
if(rc != GPG_ERR_NO_ERROR){
147
/* Create new GPGME "context" */
148
rc = gpgme_new(&ctx);
149
if (rc != GPG_ERR_NO_ERROR){
150
fprintf(stderr, "bad gpgme_new: %s: %s\n",
151
gpgme_strsource(rc), gpgme_strerror(rc));
155
/* Decrypt data from the FILE pointer to the plaintext data
157
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
158
if (rc != GPG_ERR_NO_ERROR){
288
159
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
289
160
gpgme_strsource(rc), gpgme_strerror(rc));
290
plaintext_length = -1;
292
gpgme_decrypt_result_t result;
293
result = gpgme_op_decrypt_result(mc.ctx);
295
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
297
fprintf(stderr, "Unsupported algorithm: %s\n",
298
result->unsupported_algorithm);
299
fprintf(stderr, "Wrong key usage: %u\n",
300
result->wrong_key_usage);
301
if(result->file_name != NULL){
302
fprintf(stderr, "File name: %s\n", result->file_name);
304
gpgme_recipient_t recipient;
305
recipient = result->recipients;
307
while(recipient != NULL){
308
fprintf(stderr, "Public key algorithm: %s\n",
309
gpgme_pubkey_algo_name(recipient->pubkey_algo));
310
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
311
fprintf(stderr, "Secret key available: %s\n",
312
recipient->status == GPG_ERR_NO_SECKEY
314
recipient = recipient->next;
165
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
169
gpgme_decrypt_result_t result;
170
result = gpgme_op_decrypt_result(ctx);
172
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
174
fprintf(stderr, "Unsupported algorithm: %s\n",
175
result->unsupported_algorithm);
176
fprintf(stderr, "Wrong key usage: %d\n",
177
result->wrong_key_usage);
178
if(result->file_name != NULL){
179
fprintf(stderr, "File name: %s\n", result->file_name);
181
gpgme_recipient_t recipient;
182
recipient = result->recipients;
184
while(recipient != NULL){
185
fprintf(stderr, "Public key algorithm: %s\n",
186
gpgme_pubkey_algo_name(recipient->pubkey_algo));
187
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
188
fprintf(stderr, "Secret key available: %s\n",
189
recipient->status == GPG_ERR_NO_SECKEY
191
recipient = recipient->next;
323
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
197
/* Delete the GPGME FILE pointer cryptotext data buffer */
198
gpgme_data_release(dh_crypto);
326
200
/* Seek back to the beginning of the GPGME plaintext data buffer */
327
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
328
perror("gpgme_data_seek");
329
plaintext_length = -1;
201
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
202
perror("pgpme_data_seek");
335
plaintext_capacity = incbuffer(plaintext,
336
(size_t)plaintext_length,
338
if(plaintext_capacity == 0){
340
plaintext_length = -1;
207
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
208
*new_packet = realloc(*new_packet,
209
(unsigned int)new_packet_capacity
211
if (*new_packet == NULL){
215
new_packet_capacity += BUFFER_SIZE;
344
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
218
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
346
220
/* Print the data, if any */
352
225
perror("gpgme_data_read");
353
plaintext_length = -1;
356
plaintext_length += ret;
360
fprintf(stderr, "Decrypted password is: ");
361
for(ssize_t i = 0; i < plaintext_length; i++){
362
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
364
fprintf(stderr, "\n");
369
/* Delete the GPGME cryptotext data buffer */
370
gpgme_data_release(dh_crypto);
228
new_packet_length += ret;
231
/* FIXME: check characters before printing to screen so to not print
232
terminal control characters */
234
/* fprintf(stderr, "decrypted password is: "); */
235
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
236
/* fprintf(stderr, "\n"); */
372
239
/* Delete the GPGME plaintext data buffer */
373
240
gpgme_data_release(dh_plain);
374
return plaintext_length;
241
return new_packet_length;
377
static const char * safer_gnutls_strerror(int value){
378
const char *ret = gnutls_strerror(value); /* Spurious warning from
379
-Wunreachable-code */
244
static const char * safer_gnutls_strerror (int value) {
245
const char *ret = gnutls_strerror (value);
381
247
ret = "(unknown)";
385
/* GnuTLS log function callback */
386
251
static void debuggnutls(__attribute__((unused)) int level,
387
252
const char* string){
388
fprintf(stderr, "GnuTLS: %s", string);
253
fprintf(stderr, "%s", string);
391
static int init_gnutls_global(const char *pubkeyfilename,
392
const char *seckeyfilename){
256
static int initgnutls(encrypted_session *es){
396
261
fprintf(stderr, "Initializing GnuTLS\n");
399
ret = gnutls_global_init();
400
if(ret != GNUTLS_E_SUCCESS){
401
fprintf(stderr, "GnuTLS global_init: %s\n",
402
safer_gnutls_strerror(ret));
264
if ((ret = gnutls_global_init ())
265
!= GNUTLS_E_SUCCESS) {
266
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
407
/* "Use a log level over 10 to enable all debugging options."
410
271
gnutls_global_set_log_level(11);
411
272
gnutls_global_set_log_function(debuggnutls);
414
/* OpenPGP credentials */
415
gnutls_certificate_allocate_credentials(&mc.cred);
416
if(ret != GNUTLS_E_SUCCESS){
417
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
421
safer_gnutls_strerror(ret));
422
gnutls_global_deinit();
275
/* openpgp credentials */
276
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
277
!= GNUTLS_E_SUCCESS) {
278
fprintf (stderr, "memory error: %s\n",
279
safer_gnutls_strerror(ret));
427
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
428
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
284
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
285
" and keyfile %s as GnuTLS credentials\n", certfile,
432
289
ret = gnutls_certificate_set_openpgp_key_file
433
(mc.cred, pubkeyfilename, seckeyfilename,
434
GNUTLS_OPENPGP_FMT_BASE64);
435
if(ret != GNUTLS_E_SUCCESS){
437
"Error[%d] while reading the OpenPGP key pair ('%s',"
438
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
439
fprintf(stderr, "The GnuTLS error is: %s\n",
440
safer_gnutls_strerror(ret));
444
/* GnuTLS server initialization */
445
ret = gnutls_dh_params_init(&mc.dh_params);
446
if(ret != GNUTLS_E_SUCCESS){
447
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
448
" %s\n", safer_gnutls_strerror(ret));
451
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
452
if(ret != GNUTLS_E_SUCCESS){
453
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
454
safer_gnutls_strerror(ret));
458
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
464
gnutls_certificate_free_credentials(mc.cred);
465
gnutls_global_deinit();
466
gnutls_dh_params_deinit(mc.dh_params);
470
static int init_gnutls_session(gnutls_session_t *session){
472
/* GnuTLS session creation */
473
ret = gnutls_init(session, GNUTLS_SERVER);
474
if(ret != GNUTLS_E_SUCCESS){
290
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
291
if (ret != GNUTLS_E_SUCCESS) {
293
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
295
ret, certfile, certkey);
296
fprintf(stdout, "The Error is: %s\n",
297
safer_gnutls_strerror(ret));
301
//GnuTLS server initialization
302
if ((ret = gnutls_dh_params_init (&es->dh_params))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in dh parameter initialization: %s\n",
305
safer_gnutls_strerror(ret));
309
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
310
!= GNUTLS_E_SUCCESS) {
311
fprintf (stderr, "Error in prime generation: %s\n",
312
safer_gnutls_strerror(ret));
316
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
318
// GnuTLS session creation
319
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
320
!= GNUTLS_E_SUCCESS){
475
321
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
476
322
safer_gnutls_strerror(ret));
481
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
482
if(ret != GNUTLS_E_SUCCESS){
483
fprintf(stderr, "Syntax error at: %s\n", err);
484
fprintf(stderr, "GnuTLS error: %s\n",
485
safer_gnutls_strerror(ret));
486
gnutls_deinit(*session);
325
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
326
!= GNUTLS_E_SUCCESS) {
327
fprintf(stderr, "Syntax error at: %s\n", err);
328
fprintf(stderr, "GnuTLS error: %s\n",
329
safer_gnutls_strerror(ret));
491
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
493
if(ret != GNUTLS_E_SUCCESS){
494
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
333
if ((ret = gnutls_credentials_set
334
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
335
!= GNUTLS_E_SUCCESS) {
336
fprintf(stderr, "Error setting a credentials set: %s\n",
495
337
safer_gnutls_strerror(ret));
496
gnutls_deinit(*session);
500
341
/* ignore client certificate if any. */
501
gnutls_certificate_server_set_request(*session,
342
gnutls_certificate_server_set_request (es->session,
504
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
345
gnutls_dh_set_prime_bits (es->session, DH_BITS);
509
/* Avahi log function callback */
510
350
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
511
351
__attribute__((unused)) const char *txt){}
513
/* Called when a Mandos server is found */
514
353
static int start_mandos_communication(const char *ip, uint16_t port,
515
AvahiIfIndex if_index,
354
AvahiIfIndex if_index){
520
struct sockaddr_in in;
521
struct sockaddr_in6 in6;
356
struct sockaddr_in6 to;
357
encrypted_session es;
523
358
char *buffer = NULL;
524
359
char *decrypted_buffer;
525
360
size_t buffer_length = 0;
526
361
size_t buffer_capacity = 0;
527
362
ssize_t decrypted_buffer_size;
530
gnutls_session_t session;
531
int pf; /* Protocol family */
541
fprintf(stderr, "Bad address family: %d\n", af);
545
ret = init_gnutls_session(&session);
365
char interface[IF_NAMESIZE];
551
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
368
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
555
tcp_sd = socket(pf, SOCK_STREAM, 0);
372
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
557
374
perror("socket");
379
if(if_indextoname((unsigned int)if_index, interface) == NULL){
381
perror("if_indextoname");
386
fprintf(stderr, "Binding to interface %s\n", interface);
561
memset(&to, 0, sizeof(to));
563
to.in6.sin6_family = (uint16_t)af;
564
ret = inet_pton(af, ip, &to.in6.sin6_addr);
566
to.in.sin_family = (sa_family_t)af;
567
ret = inet_pton(af, ip, &to.in.sin_addr);
389
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
570
393
perror("inet_pton");
574
397
fprintf(stderr, "Bad address: %s\n", ip);
578
to.in6.sin6_port = htons(port); /* Spurious warnings from
580
-Wunreachable-code */
582
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
583
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
585
if(if_index == AVAHI_IF_UNSPEC){
586
fprintf(stderr, "An IPv6 link-local address is incomplete"
587
" without a network interface\n");
590
/* Set the network interface number as scope */
591
to.in6.sin6_scope_id = (uint32_t)if_index;
594
to.in.sin_port = htons(port); /* Spurious warnings from
596
-Wunreachable-code */
400
to.sin6_port = htons(port); /* Spurious warning */
402
to.sin6_scope_id = (uint32_t)if_index;
600
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
601
char interface[IF_NAMESIZE];
602
if(if_indextoname((unsigned int)if_index, interface) == NULL){
603
perror("if_indextoname");
605
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
606
ip, interface, port);
609
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
612
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
613
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
616
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
619
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
625
if(strcmp(addrstr, ip) != 0){
626
fprintf(stderr, "Canonical address form: %s\n", addrstr);
405
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
406
/* char addrstr[INET6_ADDRSTRLEN]; */
407
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
408
/* sizeof(addrstr)) == NULL){ */
409
/* perror("inet_ntop"); */
411
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
412
/* addrstr, ntohs(to.sin6_port)); */
632
ret = connect(tcp_sd, &to.in6, sizeof(to));
634
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
416
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
637
418
perror("connect");
641
const char *out = mandos_protocol_version;
644
size_t out_size = strlen(out);
645
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
646
out_size - written));
652
written += (size_t)ret;
653
if(written < out_size){
656
if(out == mandos_protocol_version){
422
ret = initgnutls (&es);
428
gnutls_transport_set_ptr (es.session,
429
(gnutls_transport_ptr_t) tcp_sd);
666
432
fprintf(stderr, "Establishing TLS session with %s\n", ip);
669
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
672
ret = gnutls_handshake(session);
673
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
675
if(ret != GNUTLS_E_SUCCESS){
435
ret = gnutls_handshake (es.session);
437
if (ret != GNUTLS_E_SUCCESS){
677
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
439
fprintf(stderr, "\n*** Handshake failed ***\n");
684
/* Read OpenPGP packet that contains the wanted password */
446
//Retrieve OpenPGP packet that contains the wanted password
687
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
449
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
692
buffer_capacity = incbuffer(&buffer, buffer_length,
694
if(buffer_capacity == 0){
454
if (buffer_length + BUFFER_SIZE > buffer_capacity){
455
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
460
buffer_capacity += BUFFER_SIZE;
700
sret = gnutls_record_recv(session, buffer+buffer_length,
463
ret = gnutls_record_recv
464
(es.session, buffer+buffer_length, BUFFER_SIZE);
707
470
case GNUTLS_E_INTERRUPTED:
708
471
case GNUTLS_E_AGAIN:
710
473
case GNUTLS_E_REHANDSHAKE:
712
ret = gnutls_handshake(session);
713
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
715
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
474
ret = gnutls_handshake (es.session);
476
fprintf(stderr, "\n*** Handshake failed ***\n");
722
483
fprintf(stderr, "Unknown error while reading data from"
723
" encrypted session with Mandos server\n");
484
" encrypted session with mandos server\n");
725
gnutls_bye(session, GNUTLS_SHUT_RDWR);
486
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
729
buffer_length += (size_t) sret;
490
buffer_length += (size_t) ret;
734
fprintf(stderr, "Closing TLS session\n");
737
gnutls_bye(session, GNUTLS_SHUT_RDWR);
739
if(buffer_length > 0){
494
if (buffer_length > 0){
740
495
decrypted_buffer_size = pgp_packet_decrypt(buffer,
743
if(decrypted_buffer_size >= 0){
499
if (decrypted_buffer_size >= 0){
745
500
while(written < (size_t) decrypted_buffer_size){
746
ret = (int)fwrite(decrypted_buffer + written, 1,
747
(size_t)decrypted_buffer_size - written,
501
ret = (int)fwrite (decrypted_buffer + written, 1,
502
(size_t)decrypted_buffer_size - written,
749
504
if(ret == 0 and ferror(stdout)){
751
506
fprintf(stderr, "Error writing encrypted data: %s\n",
808
569
char ip[AVAHI_ADDRESS_STR_MAX];
809
570
avahi_address_snprint(ip, sizeof(ip), address);
811
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
812
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
813
ip, (intmax_t)interface, port);
572
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
573
" port %d\n", name, host_name, ip, port);
815
int ret = start_mandos_communication(ip, port, interface,
816
avahi_proto_to_af(proto));
818
avahi_simple_poll_quit(mc.simple_poll);
575
int ret = start_mandos_communication(ip, port, interface);
822
581
avahi_s_service_resolver_free(r);
825
static void browse_callback(AvahiSServiceBrowser *b,
826
AvahiIfIndex interface,
827
AvahiProtocol protocol,
828
AvahiBrowserEvent event,
832
AVAHI_GCC_UNUSED AvahiLookupResultFlags
834
AVAHI_GCC_UNUSED void* userdata){
837
/* Called whenever a new services becomes available on the LAN or
838
is removed from the LAN */
842
case AVAHI_BROWSER_FAILURE:
844
fprintf(stderr, "(Avahi browser) %s\n",
845
avahi_strerror(avahi_server_errno(mc.server)));
846
avahi_simple_poll_quit(mc.simple_poll);
849
case AVAHI_BROWSER_NEW:
850
/* We ignore the returned Avahi resolver object. In the callback
851
function we free it. If the Avahi server is terminated before
852
the callback function is called the Avahi server will free the
855
if(!(avahi_s_service_resolver_new(mc.server, interface,
856
protocol, name, type, domain,
857
AVAHI_PROTO_INET6, 0,
858
resolve_callback, NULL)))
859
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
860
name, avahi_strerror(avahi_server_errno(mc.server)));
863
case AVAHI_BROWSER_REMOVE:
866
case AVAHI_BROWSER_ALL_FOR_NOW:
867
case AVAHI_BROWSER_CACHE_EXHAUSTED:
869
fprintf(stderr, "No Mandos server found, still searching...\n");
584
static void browse_callback(
585
AvahiSServiceBrowser *b,
586
AvahiIfIndex interface,
587
AvahiProtocol protocol,
588
AvahiBrowserEvent event,
592
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
595
AvahiServer *s = userdata;
596
assert(b); /* Spurious warning */
598
/* Called whenever a new services becomes available on the LAN or
599
is removed from the LAN */
603
case AVAHI_BROWSER_FAILURE:
605
fprintf(stderr, "(Browser) %s\n",
606
avahi_strerror(avahi_server_errno(server)));
607
avahi_simple_poll_quit(simple_poll);
610
case AVAHI_BROWSER_NEW:
611
/* We ignore the returned resolver object. In the callback
612
function we free it. If the server is terminated before
613
the callback function is called the server will free
614
the resolver for us. */
616
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
618
AVAHI_PROTO_INET6, 0,
619
resolve_callback, s)))
620
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
621
avahi_strerror(avahi_server_errno(s)));
624
case AVAHI_BROWSER_REMOVE:
627
case AVAHI_BROWSER_ALL_FOR_NOW:
628
case AVAHI_BROWSER_CACHE_EXHAUSTED:
875
sig_atomic_t quit_now = 0;
877
static void handle_sigterm(__attribute__((unused)) int sig){
882
int old_errno = errno;
883
if(mc.simple_poll != NULL){
884
avahi_simple_poll_quit(mc.simple_poll);
889
int main(int argc, char *argv[]){
890
AvahiSServiceBrowser *sb = NULL;
895
int exitcode = EXIT_SUCCESS;
896
const char *interface = "eth0";
897
struct ifreq network;
901
char *connect_to = NULL;
902
char tempdir[] = "/tmp/mandosXXXXXX";
903
bool tempdir_created = false;
904
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
905
const char *seckey = PATHDIR "/" SECKEY;
906
const char *pubkey = PATHDIR "/" PUBKEY;
908
/* Initialize Mandos context */
909
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
910
.dh_bits = 1024, .priority = "SECURE256"
911
":!CTYPE-X.509:+CTYPE-OPENPGP" };
912
bool gnutls_initialized = false;
913
bool gpgme_initialized = false;
916
struct sigaction old_sigterm_action;
917
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
920
struct argp_option options[] = {
921
{ .name = "debug", .key = 128,
922
.doc = "Debug mode", .group = 3 },
923
{ .name = "connect", .key = 'c',
924
.arg = "ADDRESS:PORT",
925
.doc = "Connect directly to a specific Mandos server",
927
{ .name = "interface", .key = 'i',
929
.doc = "Network interface that will be used to search for"
932
{ .name = "seckey", .key = 's',
934
.doc = "OpenPGP secret key file base name",
936
{ .name = "pubkey", .key = 'p',
938
.doc = "OpenPGP public key file base name",
940
{ .name = "dh-bits", .key = 129,
942
.doc = "Bit length of the prime number used in the"
943
" Diffie-Hellman key exchange",
945
{ .name = "priority", .key = 130,
947
.doc = "GnuTLS priority string for the TLS handshake",
949
{ .name = "delay", .key = 131,
951
.doc = "Maximum delay to wait for interface startup",
633
/* Combines file name and path and returns the malloced new
634
string. some sane checks could/should be added */
635
static const char *combinepath(const char *first, const char *second){
636
size_t f_len = strlen(first);
637
size_t s_len = strlen(second);
638
char *tmp = malloc(f_len + s_len + 2);
643
memcpy(tmp, first, f_len);
647
memcpy(tmp + f_len + 1, second, s_len);
649
tmp[f_len + 1 + s_len] = '\0';
654
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
655
AvahiServerConfig config;
656
AvahiSServiceBrowser *sb = NULL;
659
int returncode = EXIT_SUCCESS;
660
const char *interface = "eth0";
661
struct ifreq network;
663
char *connect_to = NULL;
664
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
956
error_t parse_opt(int key, char *arg,
957
struct argp_state *state){
959
case 128: /* --debug */
962
case 'c': /* --connect */
965
case 'i': /* --interface */
968
case 's': /* --seckey */
971
case 'p': /* --pubkey */
974
case 129: /* --dh-bits */
975
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
976
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
977
or arg[numchars] != '\0'){
978
fprintf(stderr, "Bad number of DH bits\n");
981
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
983
case 130: /* --priority */
986
case 131: /* --delay */
987
ret = sscanf(arg, "%lf%n", &delay, &numchars);
988
if(ret < 1 or arg[numchars] != '\0'){
989
fprintf(stderr, "Bad delay\n");
667
static struct option long_options[] = {
668
{"debug", no_argument, (int *)&debug, 1},
669
{"connect", required_argument, 0, 'C'},
670
{"interface", required_argument, 0, 'i'},
671
{"certdir", required_argument, 0, 'd'},
672
{"certkey", required_argument, 0, 'c'},
673
{"certfile", required_argument, 0, 'k'},
676
int option_index = 0;
677
ret = getopt_long (argc, argv, "i:", long_options,
998
return ARGP_ERR_UNKNOWN;
1003
struct argp argp = { .options = options, .parser = parse_opt,
1005
.doc = "Mandos client -- Get and decrypt"
1006
" passwords from a Mandos server" };
1007
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1008
if(ret == ARGP_ERR_UNKNOWN){
1009
fprintf(stderr, "Unknown error while parsing arguments\n");
1010
exitcode = EXIT_FAILURE;
1015
/* If the interface is down, bring it up */
1016
if(interface[0] != '\0'){
1018
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1019
messages to mess up the prompt */
1020
ret = klogctl(8, NULL, 5);
1021
bool restore_loglevel = true;
1023
restore_loglevel = false;
1026
#endif /* __linux__ */
707
certfile = combinepath(certdir, certfile);
708
if (certfile == NULL){
709
perror("combinepath");
710
returncode = EXIT_FAILURE;
714
certkey = combinepath(certdir, certkey);
715
if (certkey == NULL){
716
perror("combinepath");
717
returncode = EXIT_FAILURE;
721
if_index = (AvahiIfIndex) if_nametoindex(interface);
723
fprintf(stderr, "No such interface: \"%s\"\n", interface);
727
if(connect_to != NULL){
728
/* Connect directly, do not use Zeroconf */
729
/* (Mainly meant for debugging) */
730
char *address = strrchr(connect_to, ':');
732
fprintf(stderr, "No colon in address\n");
736
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
738
perror("Bad port number");
742
address = connect_to;
743
ret = start_mandos_communication(address, port, if_index);
1028
751
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1030
753
perror("socket");
1031
exitcode = EXIT_FAILURE;
1033
if(restore_loglevel){
1034
ret = klogctl(7, NULL, 0);
1039
#endif /* __linux__ */
754
returncode = EXIT_FAILURE;
1042
strcpy(network.ifr_name, interface);
757
strcpy(network.ifr_name, interface);
1043
758
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1045
761
perror("ioctl SIOCGIFFLAGS");
1047
if(restore_loglevel){
1048
ret = klogctl(7, NULL, 0);
1053
#endif /* __linux__ */
1054
exitcode = EXIT_FAILURE;
762
returncode = EXIT_FAILURE;
1057
765
if((network.ifr_flags & IFF_UP) == 0){
1058
766
network.ifr_flags |= IFF_UP;
1059
767
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1061
769
perror("ioctl SIOCSIFFLAGS");
1062
exitcode = EXIT_FAILURE;
1064
if(restore_loglevel){
1065
ret = klogctl(7, NULL, 0);
1070
#endif /* __linux__ */
1074
/* sleep checking until interface is running */
1075
for(int i=0; i < delay * 4; i++){
1076
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1078
perror("ioctl SIOCGIFFLAGS");
1079
} else if(network.ifr_flags & IFF_RUNNING){
1082
struct timespec sleeptime = { .tv_nsec = 250000000 };
1083
ret = nanosleep(&sleeptime, NULL);
1084
if(ret == -1 and errno != EINTR){
1085
perror("nanosleep");
1088
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1093
if(restore_loglevel){
1094
/* Restores kernel loglevel to default */
1095
ret = klogctl(7, NULL, 0);
1100
#endif /* __linux__ */
1117
ret = init_gnutls_global(pubkey, seckey);
1119
fprintf(stderr, "init_gnutls_global failed\n");
1120
exitcode = EXIT_FAILURE;
1123
gnutls_initialized = true;
1126
if(mkdtemp(tempdir) == NULL){
1130
tempdir_created = true;
1132
if(not init_gpgme(pubkey, seckey, tempdir)){
1133
fprintf(stderr, "init_gpgme failed\n");
1134
exitcode = EXIT_FAILURE;
1137
gpgme_initialized = true;
1140
if(interface[0] != '\0'){
1141
if_index = (AvahiIfIndex) if_nametoindex(interface);
1143
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1144
exitcode = EXIT_FAILURE;
1149
if(connect_to != NULL){
1150
/* Connect directly, do not use Zeroconf */
1151
/* (Mainly meant for debugging) */
1152
char *address = strrchr(connect_to, ':');
1153
if(address == NULL){
1154
fprintf(stderr, "No colon in address\n");
1155
exitcode = EXIT_FAILURE;
1159
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1160
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1161
or address[numchars+1] != '\0'){
1162
fprintf(stderr, "Bad port number\n");
1163
exitcode = EXIT_FAILURE;
1166
port = (uint16_t)tmpmax;
1168
address = connect_to;
1169
/* Colon in address indicates IPv6 */
1171
if(strchr(address, ':') != NULL){
1176
ret = start_mandos_communication(address, port, if_index, af);
1178
exitcode = EXIT_FAILURE;
1180
exitcode = EXIT_SUCCESS;
1186
avahi_set_log_function(empty_log);
1189
/* Initialize the pseudo-RNG for Avahi */
1190
srand((unsigned int) time(NULL));
1192
/* Allocate main Avahi loop object */
1193
mc.simple_poll = avahi_simple_poll_new();
1194
if(mc.simple_poll == NULL){
1195
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1196
exitcode = EXIT_FAILURE;
1201
AvahiServerConfig config;
1202
/* Do not publish any local Zeroconf records */
770
returncode = EXIT_FAILURE;
777
avahi_set_log_function(empty_log);
780
/* Initialize the psuedo-RNG */
781
srand((unsigned int) time(NULL));
783
/* Allocate main loop object */
784
if (!(simple_poll = avahi_simple_poll_new())) {
785
fprintf(stderr, "Failed to create simple poll object.\n");
786
returncode = EXIT_FAILURE;
790
/* Do not publish any local records */
1203
791
avahi_server_config_init(&config);
1204
792
config.publish_hinfo = 0;
1205
793
config.publish_addresses = 0;
1206
794
config.publish_workstation = 0;
1207
795
config.publish_domain = 0;
1209
797
/* Allocate a new server */
1210
mc.server = avahi_server_new(avahi_simple_poll_get
1211
(mc.simple_poll), &config, NULL,
1214
/* Free the Avahi configuration data */
798
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
799
&config, NULL, NULL, &error);
801
/* Free the configuration data */
1215
802
avahi_server_config_free(&config);
1218
/* Check if creating the Avahi server object succeeded */
1219
if(mc.server == NULL){
1220
fprintf(stderr, "Failed to create Avahi server: %s\n",
1221
avahi_strerror(error));
1222
exitcode = EXIT_FAILURE;
1226
/* Create the Avahi service browser */
1227
sb = avahi_s_service_browser_new(mc.server, if_index,
1228
AVAHI_PROTO_INET6, "_mandos._tcp",
1229
NULL, 0, browse_callback, NULL);
1231
fprintf(stderr, "Failed to create service browser: %s\n",
1232
avahi_strerror(avahi_server_errno(mc.server)));
1233
exitcode = EXIT_FAILURE;
1237
sigemptyset(&sigterm_action.sa_mask);
1238
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1240
perror("sigaddset");
1241
exitcode = EXIT_FAILURE;
1244
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1246
perror("sigaddset");
1247
exitcode = EXIT_FAILURE;
1250
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1252
perror("sigaddset");
1253
exitcode = EXIT_FAILURE;
1256
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1258
perror("sigaction");
1259
exitcode = EXIT_FAILURE;
1263
/* Run the main loop */
1266
fprintf(stderr, "Starting Avahi loop search\n");
1269
avahi_simple_poll_loop(mc.simple_poll);
1274
fprintf(stderr, "%s exiting\n", argv[0]);
1277
/* Cleanup things */
1279
avahi_s_service_browser_free(sb);
1281
if(mc.server != NULL)
1282
avahi_server_free(mc.server);
1284
if(mc.simple_poll != NULL)
1285
avahi_simple_poll_free(mc.simple_poll);
1287
if(gnutls_initialized){
1288
gnutls_certificate_free_credentials(mc.cred);
1289
gnutls_global_deinit();
1290
gnutls_dh_params_deinit(mc.dh_params);
1293
if(gpgme_initialized){
1294
gpgme_release(mc.ctx);
1297
/* Removes the temp directory used by GPGME */
1298
if(tempdir_created){
1300
struct dirent *direntry;
1301
d = opendir(tempdir);
1303
if(errno != ENOENT){
1308
direntry = readdir(d);
1309
if(direntry == NULL){
1312
/* Skip "." and ".." */
1313
if(direntry->d_name[0] == '.'
1314
and (direntry->d_name[1] == '\0'
1315
or (direntry->d_name[1] == '.'
1316
and direntry->d_name[2] == '\0'))){
1319
char *fullname = NULL;
1320
ret = asprintf(&fullname, "%s/%s", tempdir,
1326
ret = remove(fullname);
1328
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1335
ret = rmdir(tempdir);
1336
if(ret == -1 and errno != ENOENT){
804
/* Check if creating the server object succeeded */
806
fprintf(stderr, "Failed to create server: %s\n",
807
avahi_strerror(error));
808
returncode = EXIT_FAILURE;
812
/* Create the service browser */
813
sb = avahi_s_service_browser_new(server, if_index,
815
"_mandos._tcp", NULL, 0,
816
browse_callback, server);
818
fprintf(stderr, "Failed to create service browser: %s\n",
819
avahi_strerror(avahi_server_errno(server)));
820
returncode = EXIT_FAILURE;
824
/* Run the main loop */
827
fprintf(stderr, "Starting avahi loop search\n");
830
avahi_simple_poll_loop(simple_poll);
835
fprintf(stderr, "%s exiting\n", argv[0]);
840
avahi_s_service_browser_free(sb);
843
avahi_server_free(server);
846
avahi_simple_poll_free(simple_poll);