To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 28
- compare with another revision
- download diff
- download tarball
- view history from revision 28
- Committer: Teddy Hogeborn
- Date: 2008-07-29 03:35:39 UTC
- Revision ID: teddy@fukt.bsnet.se-20080729033539-08zecoj3jwlkpjhw
* server.conf: New file.
* mandos-clients.conf: Renamed to clients.conf.
* Makefile (FORTIFY): New.
(CFLAGS): Include $(FORTIFY).
* plugins.d/mandosclient.c (main): New "if_index" variable. Bug fix:
check if interface exists. New
"--connect" option.
* server.py (serviceInterface): Removed; replaced by
"AvahiService.interface". All users
changed.
(AvahiError, AvahiServiceError, AvahiGroupError): New exception
classes.
(AvahiService): New class.
(serviceName): Removed; replaced by "AvahiService.name". All users
changed.
(serviceType): Removed; replaced by "AvahiService.type". All users
changed.
(servicePort): Removed; replaced by "AvahiService.port". All users
changed.
(serviceTXT): Removed; replaced by "AvahiService.TXT". All users
changed.
(domain): Removed; replaced by "AvahiService.domain". All users
changed.
(host): Removed; replaced by "AvahiService.host". All users
changed.
(rename_count): Removed; replaced by "AvahiService.rename_count" and
"AvahiService.max_renames". All users changed.
(Client.__init__): If no secret or secfile, raise TypeError instead
of RuntimeError.
(Client.last_seen): Renamed to "Client.last_checked_ok". All users
changed.
(Client.stop, Client.stop_checker): Use "getattr" with default value
instead of "hasattr".
(Client.still_valid): Removed "now" argument.
(Client.handle): Separate the "no client found" and "client invalid"
cases for clearer code.
(IPv6_TCPServer.__init__): "options" argument replaced by
"settings". All callers changed.
(IPv6_TCPServer.options): Replaced by "IPv6_TCPServer.settings".
All users changed.
(IPv6_TCPServer.server_bind): Use getattr instead of hasattr.
(add_service): Removed; replaced by "AvahiService.add". All callers
changed.
(remove_service): Removed; replaced by "AvahiService.remove". All
callers changed.
(entry_group_state_changed): On entry group collision, call the new
AvahiService.rename method. Raise
AvahiGroupError on group error.
(if_nametoindex): Use ctypes.utils.find_library to locate the C
library. Cache the result. Loop on EINTR.
(daemon): Use os.path.devnull to locate "/dev/null".
(killme): Removed. All callers changed to do "sys.exit()" instead,
except where stated otherwise.
(main): Removed "exitstatus". Removed all default values from all
non-bool options. New option "--configdir". New variables
"server_defaults" and "server_settings", read from
"%(configdir)s/server.conf". Let any supplied command line
options override server settings. Variable "defaults"
renamed to "client_defaults", which is read from
"clients.conf" instead of "mandos-clients.conf". New global
AvahiService object "service" replaces old global variables.
Catch AvahiError and exit with error if caught.
* mandos-clients.conf: Renamed to clients.conf.
* Makefile (FORTIFY): New.
(CFLAGS): Include $(FORTIFY).
* plugins.d/mandosclient.c (main): New "if_index" variable. Bug fix:
check if interface exists. New
"--connect" option.
* server.py (serviceInterface): Removed; replaced by
"AvahiService.interface". All users
changed.
(AvahiError, AvahiServiceError, AvahiGroupError): New exception
classes.
(AvahiService): New class.
(serviceName): Removed; replaced by "AvahiService.name". All users
changed.
(serviceType): Removed; replaced by "AvahiService.type". All users
changed.
(servicePort): Removed; replaced by "AvahiService.port". All users
changed.
(serviceTXT): Removed; replaced by "AvahiService.TXT". All users
changed.
(domain): Removed; replaced by "AvahiService.domain". All users
changed.
(host): Removed; replaced by "AvahiService.host". All users
changed.
(rename_count): Removed; replaced by "AvahiService.rename_count" and
"AvahiService.max_renames". All users changed.
(Client.__init__): If no secret or secfile, raise TypeError instead
of RuntimeError.
(Client.last_seen): Renamed to "Client.last_checked_ok". All users
changed.
(Client.stop, Client.stop_checker): Use "getattr" with default value
instead of "hasattr".
(Client.still_valid): Removed "now" argument.
(Client.handle): Separate the "no client found" and "client invalid"
cases for clearer code.
(IPv6_TCPServer.__init__): "options" argument replaced by
"settings". All callers changed.
(IPv6_TCPServer.options): Replaced by "IPv6_TCPServer.settings".
All users changed.
(IPv6_TCPServer.server_bind): Use getattr instead of hasattr.
(add_service): Removed; replaced by "AvahiService.add". All callers
changed.
(remove_service): Removed; replaced by "AvahiService.remove". All
callers changed.
(entry_group_state_changed): On entry group collision, call the new
AvahiService.rename method. Raise
AvahiGroupError on group error.
(if_nametoindex): Use ctypes.utils.find_library to locate the C
library. Cache the result. Loop on EINTR.
(daemon): Use os.path.devnull to locate "/dev/null".
(killme): Removed. All callers changed to do "sys.exit()" instead,
except where stated otherwise.
(main): Removed "exitstatus". Removed all default values from all
non-bool options. New option "--configdir". New variables
"server_defaults" and "server_settings", read from
"%(configdir)s/server.conf". Let any supplied command line
options override server settings. Variable "defaults"
renamed to "client_defaults", which is read from
"clients.conf" instead of "mandos-clients.conf". New global
AvahiService object "service" replaces old global variables.
Catch AvahiError and exit with error if caught.
- files modified:
- TODO
added
removed
plugins.d/mandosclient.c
25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
27
27
*
28
* Contact the authors at <mandos@fukt.bsnet.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
29
30
*/
30
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
32
33
#define _LARGEFILE_SOURCE
33
34
#define _FILE_OFFSET_BITS 64
34
35
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
37
36
#include <stdio.h>
38
37
#include <assert.h>
39
38
#include <stdlib.h>
40
39
#include <time.h>
41
40
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
44
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
45
SIOCSIFFLAGS */
46
41
47
42
#include <avahi-core/core.h>
48
43
#include <avahi-core/lookup.h>
51
46
#include <avahi-common/malloc.h>
52
47
#include <avahi-common/error.h>
53
48
54
/* Mandos client part */
49
//mandos client part
55
50
#include <sys/types.h> /* socket(), inet_pton() */
56
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
57
52
struct in6_addr, inet_pton() */
64
59
#include <string.h> /* memset */
65
60
#include <arpa/inet.h> /* inet_pton() */
66
61
#include <iso646.h> /* not */
67
#include <net/if.h> /* IF_NAMESIZE */
68
#include <argp.h> /* struct argp_option,
69
struct argp_state, struct argp,
70
argp_parse() */
71
/* GPGME */
62
63
// gpgme
72
64
#include <errno.h> /* perror() */
73
65
#include <gpgme.h>
74
66
67
// getopt long
68
#include <getopt.h>
69
70
#ifndef CERT_ROOT
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
72
#endif
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
75
75
#define BUFFER_SIZE 256
76
#define DH_BITS 1024
76
77
77
78
bool debug = false;
78
const char *keydir = "/conf/conf.d/mandos";
79
const char *argp_program_version = "mandosclient 0.9";
80
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
81
const char mandos_protocol_version[] = "1";
82
79
83
/* Used for passing in values through all the callback functions */
84
80
typedef struct {
85
AvahiSimplePoll *simple_poll;
86
AvahiServer *server;
81
gnutls_session_t session;
87
82
gnutls_certificate_credentials_t cred;
88
unsigned int dh_bits;
89
83
gnutls_dh_params_t dh_params;
90
const char *priority;
91
} mandos_context;
92
93
size_t adjustbuffer(char **buffer, size_t buffer_length,
94
size_t buffer_capacity){
95
if (buffer_length + BUFFER_SIZE > buffer_capacity){
96
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
97
if (buffer == NULL){
98
return 0;
99
}
100
buffer_capacity += BUFFER_SIZE;
101
}
102
return buffer_capacity;
103
}
104
105
/*
106
* Decrypt OpenPGP data using keyrings in HOMEDIR.
107
* Returns -1 on error
108
*/
109
static ssize_t pgp_packet_decrypt (const char *cryptotext,
110
size_t crypto_size,
111
char **plaintext,
112
const char *homedir){
84
} encrypted_session;
85
86
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
113
89
gpgme_data_t dh_crypto, dh_plain;
114
90
gpgme_ctx_t ctx;
115
91
gpgme_error_t rc;
116
92
ssize_t ret;
117
size_t plaintext_capacity = 0;
118
ssize_t plaintext_length = 0;
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
119
95
gpgme_engine_info_t engine_info;
120
96
121
97
if (debug){
122
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
123
99
}
124
100
125
101
/* Init GPGME */
126
102
gpgme_check_version(NULL);
127
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
128
if (rc != GPG_ERR_NO_ERROR){
129
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
130
gpgme_strsource(rc), gpgme_strerror(rc));
131
return -1;
132
}
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
133
104
134
/* Set GPGME home directory for the OpenPGP engine only */
105
/* Set GPGME home directory */
135
106
rc = gpgme_get_engine_info (&engine_info);
136
107
if (rc != GPG_ERR_NO_ERROR){
137
108
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
147
118
engine_info = engine_info->next;
148
119
}
149
120
if(engine_info == NULL){
150
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
121
fprintf(stderr, "Could not set home dir to %s\n", homedir);
151
122
return -1;
152
123
}
153
124
154
/* Create new GPGME data buffer from memory cryptotext */
155
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
156
0);
125
/* Create new GPGME data buffer from packet buffer */
126
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
157
127
if (rc != GPG_ERR_NO_ERROR){
158
128
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
159
129
gpgme_strsource(rc), gpgme_strerror(rc));
165
135
if (rc != GPG_ERR_NO_ERROR){
166
136
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
167
137
gpgme_strsource(rc), gpgme_strerror(rc));
168
gpgme_data_release(dh_crypto);
169
138
return -1;
170
139
}
171
140
174
143
if (rc != GPG_ERR_NO_ERROR){
175
144
fprintf(stderr, "bad gpgme_new: %s: %s\n",
176
145
gpgme_strsource(rc), gpgme_strerror(rc));
177
plaintext_length = -1;
178
goto decrypt_end;
146
return -1;
179
147
}
180
148
181
/* Decrypt data from the cryptotext data buffer to the plaintext
182
data buffer */
149
/* Decrypt data from the FILE pointer to the plaintext data
150
buffer */
183
151
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
184
152
if (rc != GPG_ERR_NO_ERROR){
185
153
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
186
154
gpgme_strsource(rc), gpgme_strerror(rc));
187
plaintext_length = -1;
188
goto decrypt_end;
155
return -1;
189
156
}
190
157
191
158
if(debug){
192
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
159
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
193
160
}
194
161
195
162
if (debug){
196
163
gpgme_decrypt_result_t result;
197
164
result = gpgme_op_decrypt_result(ctx);
221
188
}
222
189
}
223
190
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
193
224
194
/* Seek back to the beginning of the GPGME plaintext data buffer */
225
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
226
perror("pgpme_data_seek");
227
plaintext_length = -1;
228
goto decrypt_end;
229
}
230
231
*plaintext = NULL;
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
196
197
*new_packet = 0;
232
198
while(true){
233
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
234
plaintext_capacity);
235
if (plaintext_capacity == 0){
236
perror("adjustbuffer");
237
plaintext_length = -1;
238
goto decrypt_end;
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
202
+ BUFFER_SIZE);
203
if (*new_packet == NULL){
204
perror("realloc");
205
return -1;
206
}
207
new_packet_capacity += BUFFER_SIZE;
239
208
}
240
209
241
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
242
211
BUFFER_SIZE);
243
212
/* Print the data, if any */
244
213
if (ret == 0){
245
/* EOF */
246
214
break;
247
215
}
248
216
if(ret < 0){
249
217
perror("gpgme_data_read");
250
plaintext_length = -1;
251
goto decrypt_end;
218
return -1;
252
219
}
253
plaintext_length += ret;
220
new_packet_length += ret;
254
221
}
255
222
256
if(debug){
257
fprintf(stderr, "Decrypted password is: ");
258
for(ssize_t i = 0; i < plaintext_length; i++){
259
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
260
}
261
fprintf(stderr, "\n");
262
}
263
264
decrypt_end:
265
266
/* Delete the GPGME cryptotext data buffer */
267
gpgme_data_release(dh_crypto);
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
225
/* if(debug){ */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
229
/* } */
268
230
269
231
/* Delete the GPGME plaintext data buffer */
270
232
gpgme_data_release(dh_plain);
271
return plaintext_length;
233
return new_packet_length;
272
234
}
273
235
274
236
static const char * safer_gnutls_strerror (int value) {
278
240
return ret;
279
241
}
280
242
281
/* GnuTLS log function callback */
282
static void debuggnutls(__attribute__((unused)) int level,
283
const char* string){
284
fprintf(stderr, "GnuTLS: %s", string);
243
void debuggnutls(__attribute__((unused)) int level,
244
const char* string){
245
fprintf(stderr, "%s", string);
285
246
}
286
247
287
static int init_gnutls_global(mandos_context *mc,
288
const char *pubkeyfile,
289
const char *seckeyfile){
248
int initgnutls(encrypted_session *es){
249
const char *err;
290
250
int ret;
291
251
292
252
if(debug){
293
253
fprintf(stderr, "Initializing GnuTLS\n");
294
254
}
295
255
296
256
if ((ret = gnutls_global_init ())
297
257
!= GNUTLS_E_SUCCESS) {
298
fprintf (stderr, "GnuTLS global_init: %s\n",
299
safer_gnutls_strerror(ret));
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
300
259
return -1;
301
260
}
302
261
303
262
if (debug){
304
/* "Use a log level over 10 to enable all debugging options."
305
* - GnuTLS manual
306
*/
307
263
gnutls_global_set_log_level(11);
308
264
gnutls_global_set_log_function(debuggnutls);
309
265
}
310
266
311
/* OpenPGP credentials */
312
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
267
/* openpgp credentials */
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
313
269
!= GNUTLS_E_SUCCESS) {
314
fprintf (stderr, "GnuTLS memory error: %s\n",
270
fprintf (stderr, "memory error: %s\n",
315
271
safer_gnutls_strerror(ret));
316
272
return -1;
317
273
}
318
274
319
275
if(debug){
320
276
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
321
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
322
seckeyfile);
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
278
KEYFILE);
323
279
}
324
280
325
281
ret = gnutls_certificate_set_openpgp_key_file
326
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
327
283
if (ret != GNUTLS_E_SUCCESS) {
328
fprintf(stderr,
329
"Error[%d] while reading the OpenPGP key pair ('%s',"
330
" '%s')\n", ret, pubkeyfile, seckeyfile);
331
fprintf(stdout, "The GnuTLS error is: %s\n",
284
fprintf
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
286
" '%s')\n",
287
ret, CERTFILE, KEYFILE);
288
fprintf(stdout, "The Error is: %s\n",
332
289
safer_gnutls_strerror(ret));
333
290
return -1;
334
291
}
335
292
336
/* GnuTLS server initialization */
337
ret = gnutls_dh_params_init(&mc->dh_params);
338
if (ret != GNUTLS_E_SUCCESS) {
339
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
340
" %s\n", safer_gnutls_strerror(ret));
341
return -1;
342
}
343
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
344
if (ret != GNUTLS_E_SUCCESS) {
345
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
346
safer_gnutls_strerror(ret));
347
return -1;
348
}
349
350
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
351
352
return 0;
353
}
354
355
static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
356
int ret;
357
/* GnuTLS session creation */
358
ret = gnutls_init(session, GNUTLS_SERVER);
359
if (ret != GNUTLS_E_SUCCESS){
293
//GnuTLS server initialization
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
295
!= GNUTLS_E_SUCCESS) {
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
297
safer_gnutls_strerror(ret));
298
return -1;
299
}
300
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in prime generation: %s\n",
304
safer_gnutls_strerror(ret));
305
return -1;
306
}
307
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
309
310
// GnuTLS session creation
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
312
!= GNUTLS_E_SUCCESS){
360
313
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
361
314
safer_gnutls_strerror(ret));
362
315
}
363
316
364
{
365
const char *err;
366
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
367
if (ret != GNUTLS_E_SUCCESS) {
368
fprintf(stderr, "Syntax error at: %s\n", err);
369
fprintf(stderr, "GnuTLS error: %s\n",
370
safer_gnutls_strerror(ret));
371
return -1;
372
}
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf(stderr, "Syntax error at: %s\n", err);
320
fprintf(stderr, "GnuTLS error: %s\n",
321
safer_gnutls_strerror(ret));
322
return -1;
373
323
}
374
324
375
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
376
mc->cred);
377
if (ret != GNUTLS_E_SUCCESS) {
378
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
325
if ((ret = gnutls_credentials_set
326
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Error setting a credentials set: %s\n",
379
329
safer_gnutls_strerror(ret));
380
330
return -1;
381
331
}
382
332
383
333
/* ignore client certificate if any. */
384
gnutls_certificate_server_set_request (*session,
334
gnutls_certificate_server_set_request (es->session,
385
335
GNUTLS_CERT_IGNORE);
386
336
387
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
337
gnutls_dh_set_prime_bits (es->session, DH_BITS);
388
338
389
339
return 0;
390
340
}
391
341
392
/* Avahi log function callback */
393
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
394
__attribute__((unused)) const char *txt){}
342
void empty_log(__attribute__((unused)) AvahiLogLevel level,
343
__attribute__((unused)) const char *txt){}
395
344
396
/* Called when a Mandos server is found */
397
static int start_mandos_communication(const char *ip, uint16_t port,
398
AvahiIfIndex if_index,
399
mandos_context *mc){
345
int start_mandos_communication(const char *ip, uint16_t port,
346
unsigned int if_index){
400
347
int ret, tcp_sd;
401
348
struct sockaddr_in6 to;
349
encrypted_session es;
402
350
char *buffer = NULL;
403
351
char *decrypted_buffer;
404
352
size_t buffer_length = 0;
405
353
size_t buffer_capacity = 0;
406
354
ssize_t decrypted_buffer_size;
407
size_t written;
355
size_t written = 0;
408
356
int retval = 0;
409
357
char interface[IF_NAMESIZE];
410
gnutls_session_t session;
411
gnutls_dh_params_t dh_params;
412
413
ret = init_gnutls_session (mc, &session);
414
if (ret != 0){
415
return -1;
416
}
417
358
418
359
if(debug){
419
360
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
425
366
perror("socket");
426
367
return -1;
427
368
}
428
429
if(debug){
430
if(if_indextoname((unsigned int)if_index, interface) == NULL){
369
370
if(if_indextoname(if_index, interface) == NULL){
371
if(debug){
431
372
perror("if_indextoname");
432
return -1;
433
373
}
374
return -1;
375
}
376
377
if(debug){
434
378
fprintf(stderr, "Binding to interface %s\n", interface);
435
379
}
436
380
437
381
memset(&to,0,sizeof(to)); /* Spurious warning */
438
382
to.sin6_family = AF_INET6;
439
/* It would be nice to have a way to detect if we were passed an
440
IPv4 address here. Now we assume an IPv6 address. */
441
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
442
384
if (ret < 0 ){
443
385
perror("inet_pton");
444
386
return -1;
445
}
387
}
446
388
if(ret == 0){
447
389
fprintf(stderr, "Bad address: %s\n", ip);
448
390
return -1;
453
395
454
396
if(debug){
455
397
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
456
char addrstr[INET6_ADDRSTRLEN] = "";
457
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
458
sizeof(addrstr)) == NULL){
459
perror("inet_ntop");
460
} else {
461
if(strcmp(addrstr, ip) != 0){
462
fprintf(stderr, "Canonical address form: %s\n", addrstr);
463
}
464
}
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
402
/* } else { */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
405
/* } */
465
406
}
466
407
467
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
469
410
perror("connect");
470
411
return -1;
471
412
}
472
473
const char *out = mandos_protocol_version;
474
written = 0;
475
while (true){
476
size_t out_size = strlen(out);
477
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
478
out_size - written));
479
if (ret == -1){
480
perror("write");
481
retval = -1;
482
goto mandos_end;
483
}
484
written += (size_t)ret;
485
if(written < out_size){
486
continue;
487
} else {
488
if (out == mandos_protocol_version){
489
written = 0;
490
out = "\r\n";
491
} else {
492
break;
493
}
494
}
413
414
ret = initgnutls (&es);
415
if (ret != 0){
416
retval = -1;
417
return -1;
495
418
}
496
419
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
422
497
423
if(debug){
498
424
fprintf(stderr, "Establishing TLS session with %s\n", ip);
499
425
}
500
426
501
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
502
503
ret = gnutls_handshake (session);
427
ret = gnutls_handshake (es.session);
504
428
505
429
if (ret != GNUTLS_E_SUCCESS){
506
430
if(debug){
507
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
431
fprintf(stderr, "\n*** Handshake failed ***\n");
508
432
gnutls_perror (ret);
509
433
}
510
434
retval = -1;
511
goto mandos_end;
435
goto exit;
512
436
}
513
437
514
/* Read OpenPGP packet that contains the wanted password */
438
//Retrieve OpenPGP packet that contains the wanted password
515
439
516
440
if(debug){
517
441
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
519
443
}
520
444
521
445
while(true){
522
buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);
523
if (buffer_capacity == 0){
524
perror("adjustbuffer");
525
retval = -1;
526
goto mandos_end;
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
448
if (buffer == NULL){
449
perror("realloc");
450
goto exit;
451
}
452
buffer_capacity += BUFFER_SIZE;
527
453
}
528
454
529
ret = gnutls_record_recv(session, buffer+buffer_length,
530
BUFFER_SIZE);
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
531
457
if (ret == 0){
532
458
break;
533
459
}
537
463
case GNUTLS_E_AGAIN:
538
464
break;
539
465
case GNUTLS_E_REHANDSHAKE:
540
ret = gnutls_handshake (session);
466
ret = gnutls_handshake (es.session);
541
467
if (ret < 0){
542
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
468
fprintf(stderr, "\n*** Handshake failed ***\n");
543
469
gnutls_perror (ret);
544
470
retval = -1;
545
goto mandos_end;
471
goto exit;
546
472
}
547
473
break;
548
474
default:
549
475
fprintf(stderr, "Unknown error while reading data from"
550
" encrypted session with Mandos server\n");
476
" encrypted session with mandos server\n");
551
477
retval = -1;
552
gnutls_bye (session, GNUTLS_SHUT_RDWR);
553
goto mandos_end;
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
479
goto exit;
554
480
}
555
481
} else {
556
482
buffer_length += (size_t) ret;
557
483
}
558
484
}
559
485
560
if(debug){
561
fprintf(stderr, "Closing TLS session\n");
562
}
563
564
gnutls_bye (session, GNUTLS_SHUT_RDWR);
565
566
486
if (buffer_length > 0){
567
487
decrypted_buffer_size = pgp_packet_decrypt(buffer,
568
488
buffer_length,
569
489
&decrypted_buffer,
570
keydir);
490
CERT_ROOT);
571
491
if (decrypted_buffer_size >= 0){
572
written = 0;
573
492
while(written < (size_t) decrypted_buffer_size){
574
493
ret = (int)fwrite (decrypted_buffer + written, 1,
575
494
(size_t)decrypted_buffer_size - written,
589
508
retval = -1;
590
509
}
591
510
}
592
593
/* Shutdown procedure */
594
595
mandos_end:
511
512
//shutdown procedure
513
514
if(debug){
515
fprintf(stderr, "Closing TLS session\n");
516
}
517
596
518
free(buffer);
519
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
520
exit:
597
521
close(tcp_sd);
598
gnutls_deinit (session);
599
gnutls_certificate_free_credentials (mc->cred);
522
gnutls_deinit (es.session);
523
gnutls_certificate_free_credentials (es.cred);
600
524
gnutls_global_deinit ();
601
525
return retval;
602
526
}
603
527
604
static void resolve_callback(AvahiSServiceResolver *r,
605
AvahiIfIndex interface,
606
AVAHI_GCC_UNUSED AvahiProtocol protocol,
607
AvahiResolverEvent event,
608
const char *name,
609
const char *type,
610
const char *domain,
611
const char *host_name,
612
const AvahiAddress *address,
613
uint16_t port,
614
AVAHI_GCC_UNUSED AvahiStringList *txt,
615
AVAHI_GCC_UNUSED AvahiLookupResultFlags
616
flags,
617
void* userdata) {
618
mandos_context *mc = userdata;
528
static AvahiSimplePoll *simple_poll = NULL;
529
static AvahiServer *server = NULL;
530
531
static void resolve_callback(
532
AvahiSServiceResolver *r,
533
AvahiIfIndex interface,
534
AVAHI_GCC_UNUSED AvahiProtocol protocol,
535
AvahiResolverEvent event,
536
const char *name,
537
const char *type,
538
const char *domain,
539
const char *host_name,
540
const AvahiAddress *address,
541
uint16_t port,
542
AVAHI_GCC_UNUSED AvahiStringList *txt,
543
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
544
AVAHI_GCC_UNUSED void* userdata) {
545
619
546
assert(r); /* Spurious warning */
620
547
621
548
/* Called whenever a service has been resolved successfully or
624
551
switch (event) {
625
552
default:
626
553
case AVAHI_RESOLVER_FAILURE:
627
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
628
" of type '%s' in domain '%s': %s\n", name, type, domain,
629
avahi_strerror(avahi_server_errno(mc->server)));
554
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
555
" type '%s' in domain '%s': %s\n", name, type, domain,
556
avahi_strerror(avahi_server_errno(server)));
630
557
break;
631
558
632
559
case AVAHI_RESOLVER_FOUND:
634
561
char ip[AVAHI_ADDRESS_STR_MAX];
635
562
avahi_address_snprint(ip, sizeof(ip), address);
636
563
if(debug){
637
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"
638
" port %d\n", name, host_name, ip, interface, port);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
639
566
}
640
int ret = start_mandos_communication(ip, port, interface, mc);
567
int ret = start_mandos_communication(ip, port,
568
(unsigned int) interface);
641
569
if (ret == 0){
642
570
exit(EXIT_SUCCESS);
643
571
}
646
574
avahi_s_service_resolver_free(r);
647
575
}
648
576
649
static void browse_callback( AvahiSServiceBrowser *b,
650
AvahiIfIndex interface,
651
AvahiProtocol protocol,
652
AvahiBrowserEvent event,
653
const char *name,
654
const char *type,
655
const char *domain,
656
AVAHI_GCC_UNUSED AvahiLookupResultFlags
657
flags,
658
void* userdata) {
659
mandos_context *mc = userdata;
660
assert(b); /* Spurious warning */
661
662
/* Called whenever a new services becomes available on the LAN or
663
is removed from the LAN */
664
665
switch (event) {
666
default:
667
case AVAHI_BROWSER_FAILURE:
668
669
fprintf(stderr, "(Avahi browser) %s\n",
670
avahi_strerror(avahi_server_errno(mc->server)));
671
avahi_simple_poll_quit(mc->simple_poll);
672
return;
673
674
case AVAHI_BROWSER_NEW:
675
/* We ignore the returned Avahi resolver object. In the callback
676
function we free it. If the Avahi server is terminated before
677
the callback function is called the Avahi server will free the
678
resolver for us. */
679
680
if (!(avahi_s_service_resolver_new(mc->server, interface,
681
protocol, name, type, domain,
682
AVAHI_PROTO_INET6, 0,
683
resolve_callback, mc)))
684
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
685
name, avahi_strerror(avahi_server_errno(mc->server)));
686
break;
687
688
case AVAHI_BROWSER_REMOVE:
689
break;
690
691
case AVAHI_BROWSER_ALL_FOR_NOW:
692
case AVAHI_BROWSER_CACHE_EXHAUSTED:
693
if(debug){
694
fprintf(stderr, "No Mandos server found, still searching...\n");
577
static void browse_callback(
578
AvahiSServiceBrowser *b,
579
AvahiIfIndex interface,
580
AvahiProtocol protocol,
581
AvahiBrowserEvent event,
582
const char *name,
583
const char *type,
584
const char *domain,
585
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
586
void* userdata) {
587
588
AvahiServer *s = userdata;
589
assert(b); /* Spurious warning */
590
591
/* Called whenever a new services becomes available on the LAN or
592
is removed from the LAN */
593
594
switch (event) {
595
default:
596
case AVAHI_BROWSER_FAILURE:
597
598
fprintf(stderr, "(Browser) %s\n",
599
avahi_strerror(avahi_server_errno(server)));
600
avahi_simple_poll_quit(simple_poll);
601
return;
602
603
case AVAHI_BROWSER_NEW:
604
/* We ignore the returned resolver object. In the callback
605
function we free it. If the server is terminated before
606
the callback function is called the server will free
607
the resolver for us. */
608
609
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
610
type, domain,
611
AVAHI_PROTO_INET6, 0,
612
resolve_callback, s)))
613
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
614
avahi_strerror(avahi_server_errno(s)));
615
break;
616
617
case AVAHI_BROWSER_REMOVE:
618
break;
619
620
case AVAHI_BROWSER_ALL_FOR_NOW:
621
case AVAHI_BROWSER_CACHE_EXHAUSTED:
622
break;
695
623
}
696
break;
697
}
698
}
699
700
/* Combines file name and path and returns the malloced new
701
string. some sane checks could/should be added */
702
static const char *combinepath(const char *first, const char *second){
703
size_t f_len = strlen(first);
704
size_t s_len = strlen(second);
705
char *tmp = malloc(f_len + s_len + 2);
706
if (tmp == NULL){
707
return NULL;
708
}
709
if(f_len > 0){
710
memcpy(tmp, first, f_len); /* Spurious warning */
711
}
712
tmp[f_len] = '/';
713
if(s_len > 0){
714
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
715
}
716
tmp[f_len + 1 + s_len] = '\0';
717
return tmp;
718
}
719
720
721
int main(int argc, char *argv[]){
624
}
625
626
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
627
AvahiServerConfig config;
722
628
AvahiSServiceBrowser *sb = NULL;
723
629
int error;
724
630
int ret;
725
int exitcode = EXIT_SUCCESS;
631
int returncode = EXIT_SUCCESS;
726
632
const char *interface = "eth0";
727
struct ifreq network;
728
int sd;
729
uid_t uid;
730
gid_t gid;
633
unsigned int if_index;
731
634
char *connect_to = NULL;
732
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
733
const char *pubkeyfile = "pubkey.txt";
734
const char *seckeyfile = "seckey.txt";
735
mandos_context mc = { .simple_poll = NULL, .server = NULL,
736
.dh_bits = 1024, .priority = "SECURE256"};
737
738
{
739
struct argp_option options[] = {
740
{ .name = "debug", .key = 128,
741
.doc = "Debug mode", .group = 3 },
742
{ .name = "connect", .key = 'c',
743
.arg = "IP",
744
.doc = "Connect directly to a sepcified mandos server", .group = 1 },
745
{ .name = "interface", .key = 'i',
746
.arg = "INTERFACE",
747
.doc = "Interface that Avahi will conntect through", .group = 1 },
748
{ .name = "keydir", .key = 'd',
749
.arg = "KEYDIR",
750
.doc = "Directory where the openpgp keyring is", .group = 1 },
751
{ .name = "seckey", .key = 's',
752
.arg = "SECKEY",
753
.doc = "Secret openpgp key for gnutls authentication", .group = 1 },
754
{ .name = "pubkey", .key = 'p',
755
.arg = "PUBKEY",
756
.doc = "Public openpgp key for gnutls authentication", .group = 2 },
757
{ .name = "dh-bits", .key = 129,
758
.arg = "BITS",
759
.doc = "dh-bits to use in gnutls communication", .group = 2 },
760
{ .name = "priority", .key = 130,
761
.arg = "PRIORITY",
762
.doc = "GNUTLS priority", .group = 1 },
763
{ .name = NULL }
764
};
765
766
767
error_t parse_opt (int key, char *arg, struct argp_state *state) {
768
/* Get the INPUT argument from `argp_parse', which we know is a
769
pointer to our plugin list pointer. */
770
switch (key) {
771
case 128:
772
debug = true;
773
break;
774
case 'c':
775
connect_to = arg;
776
break;
777
case 'i':
778
interface = arg;
779
break;
780
case 'd':
781
keydir = arg;
782
break;
783
case 's':
784
seckeyfile = arg;
785
break;
786
case 'p':
787
pubkeyfile = arg;
788
break;
789
case 129:
790
errno = 0;
791
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
792
if (errno){
793
perror("strtol");
794
exit(EXIT_FAILURE);
795
}
796
break;
797
case 130:
798
mc.priority = arg;
799
break;
800
case ARGP_KEY_ARG:
801
argp_usage (state);
802
break;
803
case ARGP_KEY_END:
804
break;
805
default:
806
return ARGP_ERR_UNKNOWN;
807
}
808
return 0;
809
}
810
811
struct argp argp = { .options = options, .parser = parse_opt,
812
.args_doc = "",
813
.doc = "Mandos client -- Get and decrypt passwords from mandos server" };
814
argp_parse (&argp, argc, argv, 0, 0, NULL);
815
}
816
817
pubkeyfile = combinepath(keydir, pubkeyfile);
818
if (pubkeyfile == NULL){
819
perror("combinepath");
820
exitcode = EXIT_FAILURE;
821
goto end;
822
}
823
824
seckeyfile = combinepath(keydir, seckeyfile);
825
if (seckeyfile == NULL){
826
perror("combinepath");
827
goto end;
828
}
829
830
ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);
831
if (ret == -1){
832
fprintf(stderr, "init_gnutls_global\n");
833
goto end;
834
}
835
836
uid = getuid();
837
gid = getgid();
838
839
ret = setuid(uid);
840
if (ret == -1){
841
perror("setuid");
842
}
843
844
setgid(gid);
845
if (ret == -1){
846
perror("setgid");
847
}
848
849
if_index = (AvahiIfIndex) if_nametoindex(interface);
635
636
while (true){
637
static struct option long_options[] = {
638
{"debug", no_argument, (int *)&debug, 1},
639
{"connect", required_argument, 0, 'c'},
640
{"interface", required_argument, 0, 'i'},
641
{0, 0, 0, 0} };
642
643
int option_index = 0;
644
ret = getopt_long (argc, argv, "i:", long_options,
645
&option_index);
646
647
if (ret == -1){
648
break;
649
}
650
651
switch(ret){
652
case 0:
653
break;
654
case 'i':
655
interface = optarg;
656
break;
657
case 'c':
658
connect_to = optarg;
659
break;
660
default:
661
exit(EXIT_FAILURE);
662
}
663
}
664
665
if_index = if_nametoindex(interface);
850
666
if(if_index == 0){
851
667
fprintf(stderr, "No such interface: \"%s\"\n", interface);
852
668
exit(EXIT_FAILURE);
858
674
char *address = strrchr(connect_to, ':');
859
675
if(address == NULL){
860
676
fprintf(stderr, "No colon in address\n");
861
exitcode = EXIT_FAILURE;
862
goto end;
677
exit(EXIT_FAILURE);
863
678
}
864
679
errno = 0;
865
680
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
866
681
if(errno){
867
682
perror("Bad port number");
868
exitcode = EXIT_FAILURE;
869
goto end;
683
exit(EXIT_FAILURE);
870
684
}
871
685
*address = '\0';
872
686
address = connect_to;
873
ret = start_mandos_communication(address, port, if_index, &mc);
687
ret = start_mandos_communication(address, port, if_index);
874
688
if(ret < 0){
875
exitcode = EXIT_FAILURE;
689
exit(EXIT_FAILURE);
876
690
} else {
877
exitcode = EXIT_SUCCESS;
878
}
879
goto end;
880
}
881
882
/* If the interface is down, bring it up */
883
{
884
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
885
if(sd < 0) {
886
perror("socket");
887
exitcode = EXIT_FAILURE;
888
goto end;
889
}
890
strcpy(network.ifr_name, interface); /* Spurious warning */
891
ret = ioctl(sd, SIOCGIFFLAGS, &network);
892
if(ret == -1){
893
perror("ioctl SIOCGIFFLAGS");
894
exitcode = EXIT_FAILURE;
895
goto end;
896
}
897
if((network.ifr_flags & IFF_UP) == 0){
898
network.ifr_flags |= IFF_UP;
899
ret = ioctl(sd, SIOCSIFFLAGS, &network);
900
if(ret == -1){
901
perror("ioctl SIOCSIFFLAGS");
902
exitcode = EXIT_FAILURE;
903
goto end;
904
}
905
}
906
close(sd);
691
exit(EXIT_SUCCESS);
692
}
907
693
}
908
694
909
695
if (not debug){
910
696
avahi_set_log_function(empty_log);
911
697
}
912
698
913
/* Initialize the pseudo-RNG for Avahi */
699
/* Initialize the psuedo-RNG */
914
700
srand((unsigned int) time(NULL));
915
916
/* Allocate main Avahi loop object */
917
mc.simple_poll = avahi_simple_poll_new();
918
if (mc.simple_poll == NULL) {
919
fprintf(stderr, "Avahi: Failed to create simple poll"
920
" object.\n");
921
exitcode = EXIT_FAILURE;
922
goto end;
923
}
924
925
{
926
AvahiServerConfig config;
927
/* Do not publish any local Zeroconf records */
928
avahi_server_config_init(&config);
929
config.publish_hinfo = 0;
930
config.publish_addresses = 0;
931
config.publish_workstation = 0;
932
config.publish_domain = 0;
933
934
/* Allocate a new server */
935
mc.server = avahi_server_new(avahi_simple_poll_get
936
(mc.simple_poll), &config, NULL,
937
NULL, &error);
938
939
/* Free the Avahi configuration data */
940
avahi_server_config_free(&config);
941
}
942
943
/* Check if creating the Avahi server object succeeded */
944
if (mc.server == NULL) {
945
fprintf(stderr, "Failed to create Avahi server: %s\n",
701
702
/* Allocate main loop object */
703
if (!(simple_poll = avahi_simple_poll_new())) {
704
fprintf(stderr, "Failed to create simple poll object.\n");
705
706
goto exit;
707
}
708
709
/* Do not publish any local records */
710
avahi_server_config_init(&config);
711
config.publish_hinfo = 0;
712
config.publish_addresses = 0;
713
config.publish_workstation = 0;
714
config.publish_domain = 0;
715
716
/* Allocate a new server */
717
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
718
&config, NULL, NULL, &error);
719
720
/* Free the configuration data */
721
avahi_server_config_free(&config);
722
723
/* Check if creating the server object succeeded */
724
if (!server) {
725
fprintf(stderr, "Failed to create server: %s\n",
946
726
avahi_strerror(error));
947
exitcode = EXIT_FAILURE;
948
goto end;
727
returncode = EXIT_FAILURE;
728
goto exit;
949
729
}
950
730
951
/* Create the Avahi service browser */
952
sb = avahi_s_service_browser_new(mc.server, if_index,
731
/* Create the service browser */
732
sb = avahi_s_service_browser_new(server, (AvahiIfIndex)if_index,
953
733
AVAHI_PROTO_INET6,
954
734
"_mandos._tcp", NULL, 0,
955
browse_callback, &mc);
956
if (sb == NULL) {
735
browse_callback, server);
736
if (!sb) {
957
737
fprintf(stderr, "Failed to create service browser: %s\n",
958
avahi_strerror(avahi_server_errno(mc.server)));
959
exitcode = EXIT_FAILURE;
960
goto end;
738
avahi_strerror(avahi_server_errno(server)));
739
returncode = EXIT_FAILURE;
740
goto exit;
961
741
}
962
742
963
743
/* Run the main loop */
964
744
965
745
if (debug){
966
fprintf(stderr, "Starting Avahi loop search\n");
746
fprintf(stderr, "Starting avahi loop search\n");
967
747
}
968
748
969
avahi_simple_poll_loop(mc.simple_poll);
749
avahi_simple_poll_loop(simple_poll);
970
750
971
end:
751
exit:
972
752
973
753
if (debug){
974
754
fprintf(stderr, "%s exiting\n", argv[0]);
975
755
}
976
756
977
757
/* Cleanup things */
978
if (sb != NULL)
758
if (sb)
979
759
avahi_s_service_browser_free(sb);
980
760
981
if (mc.server != NULL)
982
avahi_server_free(mc.server);
983
984
if (mc.simple_poll != NULL)
985
avahi_simple_poll_free(mc.simple_poll);
986
free(pubkeyfile);
987
free(seckeyfile);
988
989
return exitcode;
761
if (server)
762
avahi_server_free(server);
763
764
if (simple_poll)
765
avahi_simple_poll_free(simple_poll);
766
767
return returncode;
990
768
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0