32
33
#define _LARGEFILE_SOURCE
33
34
#define _FILE_OFFSET_BITS 64
39
#include <net/if.h> /* if_nametoindex */
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf */
40
#include <stdint.h> /* uint16_t, uint32_t */
41
#include <stddef.h> /* NULL, size_t, ssize_t */
42
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
44
#include <stdbool.h> /* bool, true */
45
#include <string.h> /* memset(), strcmp(), strlen(),
46
strerror(), asprintf(), strcpy() */
47
#include <sys/ioctl.h> /* ioctl */
48
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
49
sockaddr_in6, PF_INET6,
50
SOCK_STREAM, INET6_ADDRSTRLEN,
51
uid_t, gid_t, open(), opendir(), DIR */
52
#include <sys/stat.h> /* open() */
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
54
struct in6_addr, inet_pton(),
56
#include <fcntl.h> /* open() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir() */
58
#include <inttypes.h> /* PRIu16, SCNu16 */
59
#include <assert.h> /* assert() */
60
#include <errno.h> /* perror(), errno */
61
#include <time.h> /* time() */
62
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
63
SIOCSIFFLAGS, if_indextoname(),
64
if_nametoindex(), IF_NAMESIZE */
65
#include <netinet/in.h>
66
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
67
getuid(), getgid(), setuid(),
69
#include <arpa/inet.h> /* inet_pton(), htons */
70
#include <iso646.h> /* not, and, or */
71
#include <argp.h> /* struct argp_option, error_t, struct
72
argp_state, struct argp,
73
argp_parse(), ARGP_KEY_ARG,
74
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
77
/* All Avahi types, constants and functions
41
80
#include <avahi-core/core.h>
42
81
#include <avahi-core/lookup.h>
43
82
#include <avahi-core/log.h>
45
84
#include <avahi-common/malloc.h>
46
85
#include <avahi-common/error.h>
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
63
#include <errno.h> /* perror() */
88
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
91
init_gnutls_session(),
93
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
94
GNUTLS_OPENPGP_FMT_BASE64 */
97
#include <gpgme.h> /* All GPGME types, constants and
100
GPGME_PROTOCOL_OpenPGP,
69
103
#define BUFFER_SIZE 256
71
static int dh_bits = 1024;
73
static const char *keydir = "/conf/conf.d/mandos";
74
static const char *pubkeyfile = "pubkey.txt";
75
static const char *seckeyfile = "seckey.txt";
105
#define PATHDIR "/conf/conf.d/mandos"
106
#define SECKEY "seckey.txt"
107
#define PUBKEY "pubkey.txt"
77
109
bool debug = false;
110
static const char mandos_protocol_version[] = "1";
111
const char *argp_program_version = "mandos-client " VERSION;
112
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
114
/* Used for passing in values through the Avahi callback functions */
81
gnutls_session_t session;
116
AvahiSimplePoll *simple_poll;
82
118
gnutls_certificate_credentials_t cred;
119
unsigned int dh_bits;
83
120
gnutls_dh_params_t dh_params;
87
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
90
gpgme_data_t dh_crypto, dh_plain;
121
const char *priority;
126
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
127
* "buffer_capacity" is how much is currently allocated,
128
* "buffer_length" is how much is already used.
130
size_t adjustbuffer(char **buffer, size_t buffer_length,
131
size_t buffer_capacity){
132
if (buffer_length + BUFFER_SIZE > buffer_capacity){
133
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
137
buffer_capacity += BUFFER_SIZE;
139
return buffer_capacity;
145
static bool init_gpgme(mandos_context *mc, const char *seckey,
146
const char *pubkey, const char *tempdir){
94
ssize_t new_packet_capacity = 0;
95
ssize_t new_packet_length = 0;
96
149
gpgme_engine_info_t engine_info;
153
* Helper function to insert pub and seckey to the enigne keyring.
155
bool import_key(const char *filename){
157
gpgme_data_t pgp_data;
159
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
165
rc = gpgme_data_new_from_fd(&pgp_data, fd);
166
if (rc != GPG_ERR_NO_ERROR){
167
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
168
gpgme_strsource(rc), gpgme_strerror(rc));
172
rc = gpgme_op_import(mc->ctx, pgp_data);
173
if (rc != GPG_ERR_NO_ERROR){
174
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
175
gpgme_strsource(rc), gpgme_strerror(rc));
179
ret = (int)TEMP_FAILURE_RETRY(close(fd));
183
gpgme_data_release(pgp_data);
99
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
188
fprintf(stderr, "Initialize gpgme\n");
141
264
if (rc != GPG_ERR_NO_ERROR){
142
265
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
143
266
gpgme_strsource(rc), gpgme_strerror(rc));
147
/* Create new GPGME "context" */
148
rc = gpgme_new(&ctx);
149
if (rc != GPG_ERR_NO_ERROR){
150
fprintf(stderr, "bad gpgme_new: %s: %s\n",
151
gpgme_strsource(rc), gpgme_strerror(rc));
155
/* Decrypt data from the FILE pointer to the plaintext data
157
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
267
gpgme_data_release(dh_crypto);
271
/* Decrypt data from the cryptotext data buffer to the plaintext
273
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
158
274
if (rc != GPG_ERR_NO_ERROR){
159
275
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
160
276
gpgme_strsource(rc), gpgme_strerror(rc));
277
plaintext_length = -1;
279
gpgme_decrypt_result_t result;
280
result = gpgme_op_decrypt_result(mc->ctx);
282
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
284
fprintf(stderr, "Unsupported algorithm: %s\n",
285
result->unsupported_algorithm);
286
fprintf(stderr, "Wrong key usage: %u\n",
287
result->wrong_key_usage);
288
if(result->file_name != NULL){
289
fprintf(stderr, "File name: %s\n", result->file_name);
291
gpgme_recipient_t recipient;
292
recipient = result->recipients;
294
while(recipient != NULL){
295
fprintf(stderr, "Public key algorithm: %s\n",
296
gpgme_pubkey_algo_name(recipient->pubkey_algo));
297
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
298
fprintf(stderr, "Secret key available: %s\n",
299
recipient->status == GPG_ERR_NO_SECKEY
301
recipient = recipient->next;
165
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
169
gpgme_decrypt_result_t result;
170
result = gpgme_op_decrypt_result(ctx);
172
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
174
fprintf(stderr, "Unsupported algorithm: %s\n",
175
result->unsupported_algorithm);
176
fprintf(stderr, "Wrong key usage: %d\n",
177
result->wrong_key_usage);
178
if(result->file_name != NULL){
179
fprintf(stderr, "File name: %s\n", result->file_name);
181
gpgme_recipient_t recipient;
182
recipient = result->recipients;
184
while(recipient != NULL){
185
fprintf(stderr, "Public key algorithm: %s\n",
186
gpgme_pubkey_algo_name(recipient->pubkey_algo));
187
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
188
fprintf(stderr, "Secret key available: %s\n",
189
recipient->status == GPG_ERR_NO_SECKEY
191
recipient = recipient->next;
197
/* Delete the GPGME FILE pointer cryptotext data buffer */
198
gpgme_data_release(dh_crypto);
310
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
200
313
/* Seek back to the beginning of the GPGME plaintext data buffer */
201
314
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
202
perror("pgpme_data_seek");
315
perror("gpgme_data_seek");
316
plaintext_length = -1;
207
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
208
*new_packet = realloc(*new_packet,
209
(unsigned int)new_packet_capacity
211
if (*new_packet == NULL){
215
new_packet_capacity += BUFFER_SIZE;
322
plaintext_capacity = adjustbuffer(plaintext,
323
(size_t)plaintext_length,
325
if (plaintext_capacity == 0){
326
perror("adjustbuffer");
327
plaintext_length = -1;
218
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
331
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
220
333
/* Print the data, if any */
225
339
perror("gpgme_data_read");
228
new_packet_length += ret;
231
/* FIXME: check characters before printing to screen so to not print
232
terminal control characters */
234
/* fprintf(stderr, "decrypted password is: "); */
235
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
236
/* fprintf(stderr, "\n"); */
340
plaintext_length = -1;
343
plaintext_length += ret;
347
fprintf(stderr, "Decrypted password is: ");
348
for(ssize_t i = 0; i < plaintext_length; i++){
349
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
351
fprintf(stderr, "\n");
356
/* Delete the GPGME cryptotext data buffer */
357
gpgme_data_release(dh_crypto);
239
359
/* Delete the GPGME plaintext data buffer */
240
360
gpgme_data_release(dh_plain);
241
return new_packet_length;
361
return plaintext_length;
244
364
static const char * safer_gnutls_strerror (int value) {
245
const char *ret = gnutls_strerror (value);
365
const char *ret = gnutls_strerror (value); /* Spurious warning */
247
367
ret = "(unknown)";
371
/* GnuTLS log function callback */
251
372
static void debuggnutls(__attribute__((unused)) int level,
252
373
const char* string){
253
fprintf(stderr, "%s", string);
374
fprintf(stderr, "GnuTLS: %s", string);
256
static int initgnutls(encrypted_session *es){
377
static int init_gnutls_global(mandos_context *mc,
378
const char *pubkeyfilename,
379
const char *seckeyfilename){
261
383
fprintf(stderr, "Initializing GnuTLS\n");
264
if ((ret = gnutls_global_init ())
265
!= GNUTLS_E_SUCCESS) {
266
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
386
ret = gnutls_global_init();
387
if (ret != GNUTLS_E_SUCCESS) {
388
fprintf (stderr, "GnuTLS global_init: %s\n",
389
safer_gnutls_strerror(ret));
394
/* "Use a log level over 10 to enable all debugging options."
271
397
gnutls_global_set_log_level(11);
272
398
gnutls_global_set_log_function(debuggnutls);
275
/* openpgp credentials */
276
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
277
!= GNUTLS_E_SUCCESS) {
278
fprintf (stderr, "memory error: %s\n",
401
/* OpenPGP credentials */
402
gnutls_certificate_allocate_credentials(&mc->cred);
403
if (ret != GNUTLS_E_SUCCESS){
404
fprintf (stderr, "GnuTLS memory error: %s\n", /* Spurious
279
406
safer_gnutls_strerror(ret));
407
gnutls_global_deinit ();
284
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
285
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
412
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
413
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
289
417
ret = gnutls_certificate_set_openpgp_key_file
290
(es->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
418
(mc->cred, pubkeyfilename, seckeyfilename,
419
GNUTLS_OPENPGP_FMT_BASE64);
291
420
if (ret != GNUTLS_E_SUCCESS) {
293
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
295
ret, pubkeyfile, seckeyfile);
296
fprintf(stdout, "The Error is: %s\n",
422
"Error[%d] while reading the OpenPGP key pair ('%s',"
423
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
424
fprintf(stderr, "The GnuTLS error is: %s\n",
297
425
safer_gnutls_strerror(ret));
301
//GnuTLS server initialization
302
if ((ret = gnutls_dh_params_init (&es->dh_params))
303
!= GNUTLS_E_SUCCESS) {
304
fprintf (stderr, "Error in dh parameter initialization: %s\n",
305
safer_gnutls_strerror(ret));
309
if ((ret = gnutls_dh_params_generate2 (es->dh_params, dh_bits))
310
!= GNUTLS_E_SUCCESS) {
311
fprintf (stderr, "Error in prime generation: %s\n",
312
safer_gnutls_strerror(ret));
316
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
318
// GnuTLS session creation
319
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
320
!= GNUTLS_E_SUCCESS){
429
/* GnuTLS server initialization */
430
ret = gnutls_dh_params_init(&mc->dh_params);
431
if (ret != GNUTLS_E_SUCCESS) {
432
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
433
" %s\n", safer_gnutls_strerror(ret));
436
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
437
if (ret != GNUTLS_E_SUCCESS) {
438
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
439
safer_gnutls_strerror(ret));
443
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
449
gnutls_certificate_free_credentials(mc->cred);
450
gnutls_global_deinit();
451
gnutls_dh_params_deinit(mc->dh_params);
455
static int init_gnutls_session(mandos_context *mc,
456
gnutls_session_t *session){
458
/* GnuTLS session creation */
459
ret = gnutls_init(session, GNUTLS_SERVER);
460
if (ret != GNUTLS_E_SUCCESS){
321
461
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
322
462
safer_gnutls_strerror(ret));
325
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
326
!= GNUTLS_E_SUCCESS) {
327
fprintf(stderr, "Syntax error at: %s\n", err);
328
fprintf(stderr, "GnuTLS error: %s\n",
329
safer_gnutls_strerror(ret));
467
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
468
if (ret != GNUTLS_E_SUCCESS) {
469
fprintf(stderr, "Syntax error at: %s\n", err);
470
fprintf(stderr, "GnuTLS error: %s\n",
471
safer_gnutls_strerror(ret));
472
gnutls_deinit (*session);
333
if ((ret = gnutls_credentials_set
334
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
335
!= GNUTLS_E_SUCCESS) {
336
fprintf(stderr, "Error setting a credentials set: %s\n",
477
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
479
if (ret != GNUTLS_E_SUCCESS) {
480
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
337
481
safer_gnutls_strerror(ret));
482
gnutls_deinit (*session);
341
486
/* ignore client certificate if any. */
342
gnutls_certificate_server_set_request (es->session,
487
gnutls_certificate_server_set_request (*session,
343
488
GNUTLS_CERT_IGNORE);
345
gnutls_dh_set_prime_bits (es->session, dh_bits);
490
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
495
/* Avahi log function callback */
350
496
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
351
497
__attribute__((unused)) const char *txt){}
499
/* Called when a Mandos server is found */
353
500
static int start_mandos_communication(const char *ip, uint16_t port,
354
AvahiIfIndex if_index){
501
AvahiIfIndex if_index,
356
struct sockaddr_in6 to;
357
encrypted_session es;
505
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
358
506
char *buffer = NULL;
359
507
char *decrypted_buffer;
360
508
size_t buffer_length = 0;
361
509
size_t buffer_capacity = 0;
362
510
ssize_t decrypted_buffer_size;
365
513
char interface[IF_NAMESIZE];
514
gnutls_session_t session;
516
ret = init_gnutls_session (mc, &session);
368
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
522
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
372
526
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
378
if(if_indextoname((unsigned int)if_index, interface) == NULL){
533
if(if_indextoname((unsigned int)if_index, interface) == NULL){
380
534
perror("if_indextoname");
386
537
fprintf(stderr, "Binding to interface %s\n", interface);
389
memset(&to,0,sizeof(to)); /* Spurious warning */
390
to.sin6_family = AF_INET6;
391
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
540
memset(&to, 0, sizeof(to));
541
to.in6.sin6_family = AF_INET6;
542
/* It would be nice to have a way to detect if we were passed an
543
IPv4 address here. Now we assume an IPv6 address. */
544
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
393
546
perror("inet_pton");
397
550
fprintf(stderr, "Bad address: %s\n", ip);
400
to.sin6_port = htons(port); /* Spurious warning */
553
to.in6.sin6_port = htons(port); /* Spurious warning */
402
to.sin6_scope_id = (uint32_t)if_index;
555
to.in6.sin6_scope_id = (uint32_t)if_index;
405
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
558
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
406
560
char addrstr[INET6_ADDRSTRLEN] = "";
407
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
561
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
408
562
sizeof(addrstr)) == NULL){
409
563
perror("inet_ntop");
411
565
if(strcmp(addrstr, ip) != 0){
412
fprintf(stderr, "Canonical address form: %s\n",
413
addrstr, ntohs(to.sin6_port));
566
fprintf(stderr, "Canonical address form: %s\n", addrstr);
418
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
571
ret = connect(tcp_sd, &to.in, sizeof(to));
420
573
perror("connect");
424
ret = initgnutls (&es);
577
const char *out = mandos_protocol_version;
580
size_t out_size = strlen(out);
581
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
582
out_size - written));
588
written += (size_t)ret;
589
if(written < out_size){
592
if (out == mandos_protocol_version){
430
gnutls_transport_set_ptr (es.session,
431
(gnutls_transport_ptr_t) tcp_sd);
434
602
fprintf(stderr, "Establishing TLS session with %s\n", ip);
437
ret = gnutls_handshake (es.session);
605
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
608
ret = gnutls_handshake (session);
609
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
439
611
if (ret != GNUTLS_E_SUCCESS){
441
fprintf(stderr, "\n*** Handshake failed ***\n");
613
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
442
614
gnutls_perror (ret);
448
//Retrieve OpenPGP packet that contains the wanted password
620
/* Read OpenPGP packet that contains the wanted password */
451
623
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
456
if (buffer_length + BUFFER_SIZE > buffer_capacity){
457
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
462
buffer_capacity += BUFFER_SIZE;
628
buffer_capacity = adjustbuffer(&buffer, buffer_length,
630
if (buffer_capacity == 0){
631
perror("adjustbuffer");
465
ret = gnutls_record_recv
466
(es.session, buffer+buffer_length, BUFFER_SIZE);
636
sret = gnutls_record_recv(session, buffer+buffer_length,
472
643
case GNUTLS_E_INTERRUPTED:
473
644
case GNUTLS_E_AGAIN:
475
646
case GNUTLS_E_REHANDSHAKE:
476
ret = gnutls_handshake (es.session);
648
ret = gnutls_handshake (session);
649
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
478
fprintf(stderr, "\n*** Handshake failed ***\n");
651
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
479
652
gnutls_perror (ret);
485
658
fprintf(stderr, "Unknown error while reading data from"
486
" encrypted session with mandos server\n");
659
" encrypted session with Mandos server\n");
488
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
661
gnutls_bye (session, GNUTLS_SHUT_RDWR);
492
buffer_length += (size_t) ret;
665
buffer_length += (size_t) sret;
670
fprintf(stderr, "Closing TLS session\n");
673
gnutls_bye (session, GNUTLS_SHUT_RDWR);
496
675
if (buffer_length > 0){
497
decrypted_buffer_size = pgp_packet_decrypt(buffer,
676
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
501
679
if (decrypted_buffer_size >= 0){
502
681
while(written < (size_t) decrypted_buffer_size){
503
682
ret = (int)fwrite (decrypted_buffer + written, 1,
504
683
(size_t)decrypted_buffer_size - written,
571
745
char ip[AVAHI_ADDRESS_STR_MAX];
572
746
avahi_address_snprint(ip, sizeof(ip), address);
574
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
575
" port %d\n", name, host_name, ip, port);
748
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
749
PRIu16 ") on port %d\n", name, host_name, ip,
577
int ret = start_mandos_communication(ip, port, interface);
752
int ret = start_mandos_communication(ip, port, interface, mc);
754
avahi_simple_poll_quit(mc->simple_poll);
583
758
avahi_s_service_resolver_free(r);
586
static void browse_callback(
587
AvahiSServiceBrowser *b,
588
AvahiIfIndex interface,
589
AvahiProtocol protocol,
590
AvahiBrowserEvent event,
594
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
597
AvahiServer *s = userdata;
598
assert(b); /* Spurious warning */
600
/* Called whenever a new services becomes available on the LAN or
601
is removed from the LAN */
605
case AVAHI_BROWSER_FAILURE:
607
fprintf(stderr, "(Browser) %s\n",
608
avahi_strerror(avahi_server_errno(server)));
609
avahi_simple_poll_quit(simple_poll);
612
case AVAHI_BROWSER_NEW:
613
/* We ignore the returned resolver object. In the callback
614
function we free it. If the server is terminated before
615
the callback function is called the server will free
616
the resolver for us. */
618
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
620
AVAHI_PROTO_INET6, 0,
621
resolve_callback, s)))
622
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
623
avahi_strerror(avahi_server_errno(s)));
626
case AVAHI_BROWSER_REMOVE:
629
case AVAHI_BROWSER_ALL_FOR_NOW:
630
case AVAHI_BROWSER_CACHE_EXHAUSTED:
761
static void browse_callback( AvahiSServiceBrowser *b,
762
AvahiIfIndex interface,
763
AvahiProtocol protocol,
764
AvahiBrowserEvent event,
768
AVAHI_GCC_UNUSED AvahiLookupResultFlags
771
mandos_context *mc = userdata;
774
/* Called whenever a new services becomes available on the LAN or
775
is removed from the LAN */
779
case AVAHI_BROWSER_FAILURE:
781
fprintf(stderr, "(Avahi browser) %s\n",
782
avahi_strerror(avahi_server_errno(mc->server)));
783
avahi_simple_poll_quit(mc->simple_poll);
786
case AVAHI_BROWSER_NEW:
787
/* We ignore the returned Avahi resolver object. In the callback
788
function we free it. If the Avahi server is terminated before
789
the callback function is called the Avahi server will free the
792
if (!(avahi_s_service_resolver_new(mc->server, interface,
793
protocol, name, type, domain,
794
AVAHI_PROTO_INET6, 0,
795
resolve_callback, mc)))
796
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
797
name, avahi_strerror(avahi_server_errno(mc->server)));
800
case AVAHI_BROWSER_REMOVE:
803
case AVAHI_BROWSER_ALL_FOR_NOW:
804
case AVAHI_BROWSER_CACHE_EXHAUSTED:
806
fprintf(stderr, "No Mandos server found, still searching...\n");
635
/* Combines file name and path and returns the malloced new
636
string. some sane checks could/should be added */
637
static const char *combinepath(const char *first, const char *second){
638
size_t f_len = strlen(first);
639
size_t s_len = strlen(second);
640
char *tmp = malloc(f_len + s_len + 2);
645
memcpy(tmp, first, f_len);
649
memcpy(tmp + f_len + 1, second, s_len);
651
tmp[f_len + 1 + s_len] = '\0';
656
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
657
AvahiServerConfig config;
812
int main(int argc, char *argv[]){
658
813
AvahiSServiceBrowser *sb = NULL;
662
int returncode = EXIT_SUCCESS;
663
const char *interface = NULL;
816
int exitcode = EXIT_SUCCESS;
817
const char *interface = "eth0";
818
struct ifreq network;
822
char *connect_to = NULL;
823
char tempdir[] = "/tmp/mandosXXXXXX";
664
824
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
665
char *connect_to = NULL;
667
debug_int = debug ? 1 : 0;
669
static struct option long_options[] = {
670
{"debug", no_argument, &debug_int, 1},
671
{"connect", required_argument, NULL, 'C'},
672
{"interface", required_argument, NULL, 'i'},
673
{"keydir", required_argument, NULL, 'd'},
674
{"seckey", required_argument, NULL, 'c'},
675
{"pubkey", required_argument, NULL, 'k'},
676
{"dh-bits", required_argument, NULL, 'D'},
679
int option_index = 0;
680
ret = getopt_long (argc, argv, "i:", long_options,
706
dh_bits = atoi(optarg);
714
debug = debug_int ? true : false;
716
pubkeyfile = combinepath(keydir, pubkeyfile);
717
if (pubkeyfile == NULL){
718
perror("combinepath");
722
if(interface != NULL){
723
if_index = (AvahiIfIndex) if_nametoindex(interface);
725
fprintf(stderr, "No such interface: \"%s\"\n", interface);
825
const char *seckey = PATHDIR "/" SECKEY;
826
const char *pubkey = PATHDIR "/" PUBKEY;
828
mandos_context mc = { .simple_poll = NULL, .server = NULL,
829
.dh_bits = 1024, .priority = "SECURE256"
830
":!CTYPE-X.509:+CTYPE-OPENPGP" };
831
bool gnutls_initalized = false;
832
bool gpgme_initalized = false;
835
struct argp_option options[] = {
836
{ .name = "debug", .key = 128,
837
.doc = "Debug mode", .group = 3 },
838
{ .name = "connect", .key = 'c',
839
.arg = "ADDRESS:PORT",
840
.doc = "Connect directly to a specific Mandos server",
842
{ .name = "interface", .key = 'i',
844
.doc = "Interface that will be used to search for Mandos"
847
{ .name = "seckey", .key = 's',
849
.doc = "OpenPGP secret key file base name",
851
{ .name = "pubkey", .key = 'p',
853
.doc = "OpenPGP public key file base name",
855
{ .name = "dh-bits", .key = 129,
857
.doc = "Bit length of the prime number used in the"
858
" Diffie-Hellman key exchange",
860
{ .name = "priority", .key = 130,
862
.doc = "GnuTLS priority string for the TLS handshake",
867
error_t parse_opt (int key, char *arg,
868
struct argp_state *state) {
870
case 128: /* --debug */
873
case 'c': /* --connect */
876
case 'i': /* --interface */
879
case 's': /* --seckey */
882
case 'p': /* --pubkey */
885
case 129: /* --dh-bits */
886
ret = sscanf(arg, "%u", &mc.dh_bits);
888
fprintf(stderr, "Bad number of DH bits\n");
892
case 130: /* --priority */
900
return ARGP_ERR_UNKNOWN;
905
struct argp argp = { .options = options, .parser = parse_opt,
907
.doc = "Mandos client -- Get and decrypt"
908
" passwords from a Mandos server" };
909
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
910
if (ret == ARGP_ERR_UNKNOWN){
911
fprintf(stderr, "Unknown error while parsing arguments\n");
912
exitcode = EXIT_FAILURE;
917
/* If the interface is down, bring it up */
919
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
922
exitcode = EXIT_FAILURE;
925
strcpy(network.ifr_name, interface);
926
ret = ioctl(sd, SIOCGIFFLAGS, &network);
928
perror("ioctl SIOCGIFFLAGS");
929
exitcode = EXIT_FAILURE;
932
if((network.ifr_flags & IFF_UP) == 0){
933
network.ifr_flags |= IFF_UP;
934
ret = ioctl(sd, SIOCSIFFLAGS, &network);
936
perror("ioctl SIOCSIFFLAGS");
937
exitcode = EXIT_FAILURE;
941
ret = (int)TEMP_FAILURE_RETRY(close(sd));
960
ret = init_gnutls_global(&mc, pubkey, seckey);
962
fprintf(stderr, "init_gnutls_global failed\n");
963
exitcode = EXIT_FAILURE;
966
gnutls_initalized = true;
969
if(mkdtemp(tempdir) == NULL){
975
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
976
fprintf(stderr, "gpgme_initalized failed\n");
977
exitcode = EXIT_FAILURE;
980
gpgme_initalized = true;
983
if_index = (AvahiIfIndex) if_nametoindex(interface);
985
fprintf(stderr, "No such interface: \"%s\"\n", interface);
730
989
if(connect_to != NULL){
733
992
char *address = strrchr(connect_to, ':');
734
993
if(address == NULL){
735
994
fprintf(stderr, "No colon in address\n");
995
exitcode = EXIT_FAILURE;
739
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
741
perror("Bad port number");
999
ret = sscanf(address+1, "%" SCNu16, &port);
1001
fprintf(stderr, "Bad port number\n");
1002
exitcode = EXIT_FAILURE;
744
1005
*address = '\0';
745
1006
address = connect_to;
746
ret = start_mandos_communication(address, port, if_index);
1007
ret = start_mandos_communication(address, port, if_index, &mc);
1009
exitcode = EXIT_FAILURE;
1011
exitcode = EXIT_SUCCESS;
754
seckeyfile = combinepath(keydir, seckeyfile);
755
if (seckeyfile == NULL){
756
perror("combinepath");
761
1017
avahi_set_log_function(empty_log);
764
/* Initialize the psuedo-RNG */
1020
/* Initialize the pseudo-RNG for Avahi */
765
1021
srand((unsigned int) time(NULL));
767
/* Allocate main loop object */
768
if (!(simple_poll = avahi_simple_poll_new())) {
769
fprintf(stderr, "Failed to create simple poll object.\n");
774
/* Do not publish any local records */
775
avahi_server_config_init(&config);
776
config.publish_hinfo = 0;
777
config.publish_addresses = 0;
778
config.publish_workstation = 0;
779
config.publish_domain = 0;
781
/* Allocate a new server */
782
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
783
&config, NULL, NULL, &error);
785
/* Free the configuration data */
786
avahi_server_config_free(&config);
788
/* Check if creating the server object succeeded */
790
fprintf(stderr, "Failed to create server: %s\n",
1023
/* Allocate main Avahi loop object */
1024
mc.simple_poll = avahi_simple_poll_new();
1025
if (mc.simple_poll == NULL) {
1026
fprintf(stderr, "Avahi: Failed to create simple poll"
1028
exitcode = EXIT_FAILURE;
1033
AvahiServerConfig config;
1034
/* Do not publish any local Zeroconf records */
1035
avahi_server_config_init(&config);
1036
config.publish_hinfo = 0;
1037
config.publish_addresses = 0;
1038
config.publish_workstation = 0;
1039
config.publish_domain = 0;
1041
/* Allocate a new server */
1042
mc.server = avahi_server_new(avahi_simple_poll_get
1043
(mc.simple_poll), &config, NULL,
1046
/* Free the Avahi configuration data */
1047
avahi_server_config_free(&config);
1050
/* Check if creating the Avahi server object succeeded */
1051
if (mc.server == NULL) {
1052
fprintf(stderr, "Failed to create Avahi server: %s\n",
791
1053
avahi_strerror(error));
792
returncode = EXIT_FAILURE;
1054
exitcode = EXIT_FAILURE;
796
/* Create the service browser */
797
sb = avahi_s_service_browser_new(server, if_index,
1058
/* Create the Avahi service browser */
1059
sb = avahi_s_service_browser_new(mc.server, if_index,
798
1060
AVAHI_PROTO_INET6,
799
1061
"_mandos._tcp", NULL, 0,
800
browse_callback, server);
1062
browse_callback, &mc);
802
1064
fprintf(stderr, "Failed to create service browser: %s\n",
803
avahi_strerror(avahi_server_errno(server)));
804
returncode = EXIT_FAILURE;
1065
avahi_strerror(avahi_server_errno(mc.server)));
1066
exitcode = EXIT_FAILURE;
808
1070
/* Run the main loop */
811
fprintf(stderr, "Starting avahi loop search\n");
1073
fprintf(stderr, "Starting Avahi loop search\n");
814
avahi_simple_poll_loop(simple_poll);
1076
avahi_simple_poll_loop(mc.simple_poll);
819
1081
fprintf(stderr, "%s exiting\n", argv[0]);
822
1084
/* Cleanup things */
824
1086
avahi_s_service_browser_free(sb);
827
avahi_server_free(server);
830
avahi_simple_poll_free(simple_poll);
1088
if (mc.server != NULL)
1089
avahi_server_free(mc.server);
1091
if (mc.simple_poll != NULL)
1092
avahi_simple_poll_free(mc.simple_poll);
1094
if (gnutls_initalized){
1095
gnutls_certificate_free_credentials(mc.cred);
1096
gnutls_global_deinit ();
1097
gnutls_dh_params_deinit(mc.dh_params);
1100
if(gpgme_initalized){
1101
gpgme_release(mc.ctx);
1104
/* Removes the temp directory used by GPGME */
1105
if(tempdir[0] != '\0'){
1107
struct dirent *direntry;
1108
d = opendir(tempdir);
1110
if(errno != ENOENT){
1115
direntry = readdir(d);
1116
if(direntry == NULL){
1119
if (direntry->d_type == DT_REG){
1120
char *fullname = NULL;
1121
ret = asprintf(&fullname, "%s/%s", tempdir,
1127
ret = unlink(fullname);
1129
fprintf(stderr, "unlink(\"%s\"): %s",
1130
fullname, strerror(errno));
1137
ret = rmdir(tempdir);
1138
if(ret == -1 and errno != ENOENT){