1
1
/* -*- coding: utf-8 -*- */
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
47
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
48
49
sockaddr_in6, PF_INET6,
49
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
#include <inttypes.h> /* PRIu16 */
51
uid_t, gid_t, open(), opendir(), DIR */
52
#include <sys/stat.h> /* open() */
52
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
54
struct in6_addr, inet_pton(),
56
#include <fcntl.h> /* open() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16 */
55
59
#include <assert.h> /* assert() */
56
60
#include <errno.h> /* perror(), errno */
57
61
#include <time.h> /* time() */
58
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
59
63
SIOCSIFFLAGS, if_indextoname(),
60
64
if_nametoindex(), IF_NAMESIZE */
65
#include <netinet/in.h>
61
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
62
67
getuid(), getgid(), setuid(),
64
#include <netinet/in.h>
65
69
#include <arpa/inet.h> /* inet_pton(), htons */
66
70
#include <iso646.h> /* not, and */
67
71
#include <argp.h> /* struct argp_option, error_t, struct
99
103
#define BUFFER_SIZE 256
105
#define PATHDIR "/conf/conf.d/mandos"
106
#define SECKEY "seckey.txt"
107
#define PUBKEY "pubkey.txt"
101
109
bool debug = false;
102
static const char *keydir = "/conf/conf.d/mandos";
103
110
static const char mandos_protocol_version[] = "1";
104
const char *argp_program_version = "password-request 1.0";
111
const char *argp_program_version = "mandos-client " VERSION;
105
112
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
107
114
/* Used for passing in values through the Avahi callback functions */
135
* Decrypt OpenPGP data using keyrings in HOMEDIR.
136
* Returns -1 on error
138
static ssize_t pgp_packet_decrypt (const char *cryptotext,
141
const char *homedir){
142
gpgme_data_t dh_crypto, dh_plain;
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
146
const char *pubkey, const char *tempdir){
144
148
gpgme_error_t rc;
146
size_t plaintext_capacity = 0;
147
ssize_t plaintext_length = 0;
148
149
gpgme_engine_info_t engine_info;
153
* Helper function to insert pub and seckey to the enigne keyring.
155
bool import_key(const char *filename){
157
gpgme_data_t pgp_data;
159
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
166
if (rc != GPG_ERR_NO_ERROR){
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
168
gpgme_strsource(rc), gpgme_strerror(rc));
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
175
gpgme_strsource(rc), gpgme_strerror(rc));
179
ret = (int)TEMP_FAILURE_RETRY(close(fd));
183
gpgme_data_release(pgp_data);
151
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
188
fprintf(stderr, "Initialize gpgme\n");
157
194
if (rc != GPG_ERR_NO_ERROR){
158
195
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
159
196
gpgme_strsource(rc), gpgme_strerror(rc));
163
/* Set GPGME home directory for the OpenPGP engine only */
200
/* Set GPGME home directory for the OpenPGP engine only */
164
201
rc = gpgme_get_engine_info (&engine_info);
165
202
if (rc != GPG_ERR_NO_ERROR){
166
203
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
167
204
gpgme_strsource(rc), gpgme_strerror(rc));
170
207
while(engine_info != NULL){
171
208
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
172
209
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
173
engine_info->file_name, homedir);
210
engine_info->file_name, tempdir);
176
213
engine_info = engine_info->next;
178
215
if(engine_info == NULL){
179
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
216
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
220
/* Create new GPGME "context" */
221
rc = gpgme_new(&(mc->ctx));
222
if (rc != GPG_ERR_NO_ERROR){
223
fprintf(stderr, "bad gpgme_new: %s: %s\n",
224
gpgme_strsource(rc), gpgme_strerror(rc));
228
if (not import_key(pubkey) or not import_key(seckey)){
236
* Decrypt OpenPGP data.
237
* Returns -1 on error
239
static ssize_t pgp_packet_decrypt (const mandos_context *mc,
240
const char *cryptotext,
243
gpgme_data_t dh_crypto, dh_plain;
246
size_t plaintext_capacity = 0;
247
ssize_t plaintext_length = 0;
250
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
183
253
/* Create new GPGME data buffer from memory cryptotext */
201
/* Create new GPGME "context" */
202
rc = gpgme_new(&ctx);
203
if (rc != GPG_ERR_NO_ERROR){
204
fprintf(stderr, "bad gpgme_new: %s: %s\n",
205
gpgme_strsource(rc), gpgme_strerror(rc));
206
plaintext_length = -1;
210
271
/* Decrypt data from the cryptotext data buffer to the plaintext
212
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
213
274
if (rc != GPG_ERR_NO_ERROR){
214
275
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
215
276
gpgme_strsource(rc), gpgme_strerror(rc));
216
277
plaintext_length = -1;
218
279
gpgme_decrypt_result_t result;
219
result = gpgme_op_decrypt_result(ctx);
280
result = gpgme_op_decrypt_result(mc->ctx);
220
281
if (result == NULL){
221
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
252
313
/* Seek back to the beginning of the GPGME plaintext data buffer */
253
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
254
perror("pgpme_data_seek");
315
perror("gpgme_data_seek");
255
316
plaintext_length = -1;
256
317
goto decrypt_end;
351
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
352
" and keyfile %s as GnuTLS credentials\n", pubkeyfilename,
412
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
413
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
361
422
"Error[%d] while reading the OpenPGP key pair ('%s',"
362
423
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
363
fprintf(stdout, "The GnuTLS error is: %s\n",
424
fprintf(stderr, "The GnuTLS error is: %s\n",
364
425
safer_gnutls_strerror(ret));
517
580
size_t out_size = strlen(out);
518
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
581
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
519
582
out_size - written));
573
ret = gnutls_record_recv(session, buffer+buffer_length,
636
sret = gnutls_record_recv(session, buffer+buffer_length,
580
643
case GNUTLS_E_INTERRUPTED:
581
644
case GNUTLS_E_AGAIN:
610
673
gnutls_bye (session, GNUTLS_SHUT_RDWR);
612
675
if (buffer_length > 0){
613
decrypted_buffer_size = pgp_packet_decrypt(buffer,
676
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
617
679
if (decrypted_buffer_size >= 0){
619
681
while(written < (size_t) decrypted_buffer_size){
747
/* Combines file name and path and returns the malloced new
748
string. some sane checks could/should be added */
749
static char *combinepath(const char *first, const char *second){
751
int ret = asprintf(&tmp, "%s/%s", first, second);
759
812
int main(int argc, char *argv[]){
760
813
AvahiSServiceBrowser *sb = NULL;
769
822
char *connect_to = NULL;
823
char tempdir[] = "/tmp/mandosXXXXXX";
770
824
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
771
char *pubkeyfilename = NULL;
772
char *seckeyfilename = NULL;
773
const char *pubkeyname = "pubkey.txt";
774
const char *seckeyname = "seckey.txt";
825
const char *seckey = PATHDIR "/" SECKEY;
826
const char *pubkey = PATHDIR "/" PUBKEY;
775
828
mandos_context mc = { .simple_poll = NULL, .server = NULL,
776
829
.dh_bits = 1024, .priority = "SECURE256"
777
830
":!CTYPE-X.509:+CTYPE-OPENPGP" };
778
831
bool gnutls_initalized = false;
832
bool gpgme_initalized = false;
781
835
struct argp_option options[] = {
790
844
.doc = "Interface that will be used to search for Mandos"
793
{ .name = "keydir", .key = 'd',
795
.doc = "Directory to read the OpenPGP key files from",
797
847
{ .name = "seckey", .key = 's',
799
849
.doc = "OpenPGP secret key file base name",
873
pubkeyfilename = combinepath(keydir, pubkeyname);
874
if (pubkeyfilename == NULL){
875
perror("combinepath");
876
exitcode = EXIT_FAILURE;
880
seckeyfilename = combinepath(keydir, seckeyname);
881
if (seckeyfilename == NULL){
882
perror("combinepath");
883
exitcode = EXIT_FAILURE;
887
ret = init_gnutls_global(&mc, pubkeyfilename, seckeyfilename);
889
fprintf(stderr, "init_gnutls_global failed\n");
890
exitcode = EXIT_FAILURE;
893
gnutls_initalized = true;
896
920
/* If the interface is down, bring it up */
898
922
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
933
960
perror("setgid");
963
ret = init_gnutls_global(&mc, pubkey, seckey);
965
fprintf(stderr, "init_gnutls_global failed\n");
966
exitcode = EXIT_FAILURE;
969
gnutls_initalized = true;
972
if(mkdtemp(tempdir) == NULL){
978
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
979
fprintf(stderr, "gpgme_initalized failed\n");
980
exitcode = EXIT_FAILURE;
983
gpgme_initalized = true;
936
986
if_index = (AvahiIfIndex) if_nametoindex(interface);
937
987
if(if_index == 0){
938
988
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1044
1094
if (mc.simple_poll != NULL)
1045
1095
avahi_simple_poll_free(mc.simple_poll);
1046
free(pubkeyfilename);
1047
free(seckeyfilename);
1049
1097
if (gnutls_initalized){
1050
1098
gnutls_certificate_free_credentials(mc.cred);
1051
1099
gnutls_global_deinit ();
1100
gnutls_dh_params_deinit(mc.dh_params);
1103
if(gpgme_initalized){
1104
gpgme_release(mc.ctx);
1107
/* Removes the temp directory used by GPGME */
1108
if(tempdir[0] != '\0'){
1110
struct dirent *direntry;
1111
d = opendir(tempdir);
1116
direntry = readdir(d);
1117
if(direntry == NULL){
1120
if (direntry->d_type == DT_REG){
1121
char *fullname = NULL;
1122
ret = asprintf(&fullname, "%s/%s", tempdir,
1128
ret = unlink(fullname);
1130
fprintf(stderr, "unlink(\"%s\"): %s",
1131
fullname, strerror(errno));
1138
ret = rmdir(tempdir);
1054
1144
return exitcode;