26
25
* along with this program. If not, see
27
26
* <http://www.gnu.org/licenses/>.
29
* Contact the authors at <mandos@fukt.bsnet.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
33
#define _LARGEFILE_SOURCE
36
#ifndef _FILE_OFFSET_BITS
37
34
#define _FILE_OFFSET_BITS 64
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), setuid(),
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
91
/* All Avahi types, constants and functions
40
#include <net/if.h> /* if_nametoindex */
94
42
#include <avahi-core/core.h>
95
43
#include <avahi-core/lookup.h>
96
44
#include <avahi-core/log.h>
98
46
#include <avahi-common/malloc.h>
99
47
#include <avahi-common/error.h>
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
105
init_gnutls_session(),
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
112
#include <gpgme.h> /* All GPGME types, constants and
115
GPGME_PROTOCOL_OpenPGP,
50
#include <sys/types.h> /* socket(), inet_pton() */
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
52
struct in6_addr, inet_pton() */
53
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
54
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
#include <unistd.h> /* close() */
57
#include <netinet/in.h>
58
#include <stdbool.h> /* true */
59
#include <string.h> /* memset */
60
#include <arpa/inet.h> /* inet_pton() */
61
#include <iso646.h> /* not */
64
#include <errno.h> /* perror() */
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
118
75
#define BUFFER_SIZE 256
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
124
78
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
129
/* Used for passing in values through the Avahi callback functions */
131
AvahiSimplePoll *simple_poll;
81
gnutls_session_t session;
133
82
gnutls_certificate_credentials_t cred;
134
unsigned int dh_bits;
135
83
gnutls_dh_params_t dh_params;
136
const char *priority;
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
89
gpgme_data_t dh_crypto, dh_plain;
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
* bytes. "buffer_capacity" is how much is currently allocated,
148
* "buffer_length" is how much is already used.
150
size_t incbuffer(char **buffer, size_t buffer_length,
151
size_t buffer_capacity){
152
if(buffer_length + BUFFER_SIZE > buffer_capacity){
153
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
157
buffer_capacity += BUFFER_SIZE;
159
return buffer_capacity;
165
static bool init_gpgme(const char *seckey,
166
const char *pubkey, const char *tempdir){
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
169
95
gpgme_engine_info_t engine_info;
173
* Helper function to insert pub and seckey to the engine keyring.
175
bool import_key(const char *filename){
177
gpgme_data_t pgp_data;
179
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
185
rc = gpgme_data_new_from_fd(&pgp_data, fd);
186
if(rc != GPG_ERR_NO_ERROR){
187
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
188
gpgme_strsource(rc), gpgme_strerror(rc));
192
rc = gpgme_op_import(mc.ctx, pgp_data);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
199
ret = (int)TEMP_FAILURE_RETRY(close(fd));
203
gpgme_data_release(pgp_data);
208
fprintf(stderr, "Initializing GPGME\n");
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
212
102
gpgme_check_version(NULL);
213
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
214
if(rc != GPG_ERR_NO_ERROR){
215
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
216
gpgme_strsource(rc), gpgme_strerror(rc));
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
220
/* Set GPGME home directory for the OpenPGP engine only */
221
rc = gpgme_get_engine_info(&engine_info);
222
if(rc != GPG_ERR_NO_ERROR){
105
/* Set GPGME home directory */
106
rc = gpgme_get_engine_info (&engine_info);
107
if (rc != GPG_ERR_NO_ERROR){
223
108
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
224
109
gpgme_strsource(rc), gpgme_strerror(rc));
227
112
while(engine_info != NULL){
228
113
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
229
114
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
230
engine_info->file_name, tempdir);
115
engine_info->file_name, homedir);
233
118
engine_info = engine_info->next;
235
120
if(engine_info == NULL){
236
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
240
/* Create new GPGME "context" */
241
rc = gpgme_new(&(mc.ctx));
242
if(rc != GPG_ERR_NO_ERROR){
243
fprintf(stderr, "bad gpgme_new: %s: %s\n",
244
gpgme_strsource(rc), gpgme_strerror(rc));
248
if(not import_key(pubkey) or not import_key(seckey)){
256
* Decrypt OpenPGP data.
257
* Returns -1 on error
259
static ssize_t pgp_packet_decrypt(const char *cryptotext,
262
gpgme_data_t dh_crypto, dh_plain;
265
size_t plaintext_capacity = 0;
266
ssize_t plaintext_length = 0;
269
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
272
/* Create new GPGME data buffer from memory cryptotext */
273
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
275
if(rc != GPG_ERR_NO_ERROR){
121
fprintf(stderr, "Could not set home dir to %s\n", homedir);
125
/* Create new GPGME data buffer from packet buffer */
126
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
127
if (rc != GPG_ERR_NO_ERROR){
276
128
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
277
129
gpgme_strsource(rc), gpgme_strerror(rc));
327
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
330
194
/* Seek back to the beginning of the GPGME plaintext data buffer */
331
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
332
perror("gpgme_data_seek");
333
plaintext_length = -1;
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
339
plaintext_capacity = incbuffer(plaintext,
340
(size_t)plaintext_length,
342
if(plaintext_capacity == 0){
344
plaintext_length = -1;
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
203
if (*new_packet == NULL){
207
new_packet_capacity += BUFFER_SIZE;
348
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
350
212
/* Print the data, if any */
356
217
perror("gpgme_data_read");
357
plaintext_length = -1;
360
plaintext_length += ret;
364
fprintf(stderr, "Decrypted password is: ");
365
for(ssize_t i = 0; i < plaintext_length; i++){
366
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
368
fprintf(stderr, "\n");
373
/* Delete the GPGME cryptotext data buffer */
374
gpgme_data_release(dh_crypto);
220
new_packet_length += ret;
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
376
231
/* Delete the GPGME plaintext data buffer */
377
232
gpgme_data_release(dh_plain);
378
return plaintext_length;
233
return new_packet_length;
381
static const char * safer_gnutls_strerror(int value){
382
const char *ret = gnutls_strerror(value); /* Spurious warning from
383
-Wunreachable-code */
236
static const char * safer_gnutls_strerror (int value) {
237
const char *ret = gnutls_strerror (value);
385
239
ret = "(unknown)";
389
/* GnuTLS log function callback */
390
static void debuggnutls(__attribute__((unused)) int level,
392
fprintf(stderr, "GnuTLS: %s", string);
243
void debuggnutls(__attribute__((unused)) int level,
245
fprintf(stderr, "%s", string);
395
static int init_gnutls_global(const char *pubkeyfilename,
396
const char *seckeyfilename){
248
int initgnutls(encrypted_session *es){
400
253
fprintf(stderr, "Initializing GnuTLS\n");
403
ret = gnutls_global_init();
404
if(ret != GNUTLS_E_SUCCESS){
405
fprintf(stderr, "GnuTLS global_init: %s\n",
406
safer_gnutls_strerror(ret));
256
if ((ret = gnutls_global_init ())
257
!= GNUTLS_E_SUCCESS) {
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
411
/* "Use a log level over 10 to enable all debugging options."
414
263
gnutls_global_set_log_level(11);
415
264
gnutls_global_set_log_function(debuggnutls);
418
/* OpenPGP credentials */
419
gnutls_certificate_allocate_credentials(&mc.cred);
420
if(ret != GNUTLS_E_SUCCESS){
421
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
425
safer_gnutls_strerror(ret));
426
gnutls_global_deinit();
267
/* openpgp credentials */
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
269
!= GNUTLS_E_SUCCESS) {
270
fprintf (stderr, "memory error: %s\n",
271
safer_gnutls_strerror(ret));
431
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
432
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
276
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
436
281
ret = gnutls_certificate_set_openpgp_key_file
437
(mc.cred, pubkeyfilename, seckeyfilename,
438
GNUTLS_OPENPGP_FMT_BASE64);
439
if(ret != GNUTLS_E_SUCCESS){
441
"Error[%d] while reading the OpenPGP key pair ('%s',"
442
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
443
fprintf(stderr, "The GnuTLS error is: %s\n",
444
safer_gnutls_strerror(ret));
448
/* GnuTLS server initialization */
449
ret = gnutls_dh_params_init(&mc.dh_params);
450
if(ret != GNUTLS_E_SUCCESS){
451
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
452
" %s\n", safer_gnutls_strerror(ret));
455
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
456
if(ret != GNUTLS_E_SUCCESS){
457
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
458
safer_gnutls_strerror(ret));
462
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
468
gnutls_certificate_free_credentials(mc.cred);
469
gnutls_global_deinit();
470
gnutls_dh_params_deinit(mc.dh_params);
474
static int init_gnutls_session(gnutls_session_t *session){
476
/* GnuTLS session creation */
477
ret = gnutls_init(session, GNUTLS_SERVER);
478
if(ret != GNUTLS_E_SUCCESS){
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
283
if (ret != GNUTLS_E_SUCCESS) {
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
287
ret, CERTFILE, KEYFILE);
288
fprintf(stdout, "The Error is: %s\n",
289
safer_gnutls_strerror(ret));
293
//GnuTLS server initialization
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
295
!= GNUTLS_E_SUCCESS) {
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
297
safer_gnutls_strerror(ret));
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in prime generation: %s\n",
304
safer_gnutls_strerror(ret));
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
310
// GnuTLS session creation
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
312
!= GNUTLS_E_SUCCESS){
479
313
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
480
314
safer_gnutls_strerror(ret));
485
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
486
if(ret != GNUTLS_E_SUCCESS){
487
fprintf(stderr, "Syntax error at: %s\n", err);
488
fprintf(stderr, "GnuTLS error: %s\n",
489
safer_gnutls_strerror(ret));
490
gnutls_deinit(*session);
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf(stderr, "Syntax error at: %s\n", err);
320
fprintf(stderr, "GnuTLS error: %s\n",
321
safer_gnutls_strerror(ret));
495
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
497
if(ret != GNUTLS_E_SUCCESS){
498
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
325
if ((ret = gnutls_credentials_set
326
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Error setting a credentials set: %s\n",
499
329
safer_gnutls_strerror(ret));
500
gnutls_deinit(*session);
504
333
/* ignore client certificate if any. */
505
gnutls_certificate_server_set_request(*session,
334
gnutls_certificate_server_set_request (es->session,
508
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
337
gnutls_dh_set_prime_bits (es->session, DH_BITS);
513
/* Avahi log function callback */
514
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
515
__attribute__((unused)) const char *txt){}
517
sig_atomic_t quit_now = 0;
518
int signal_received = 0;
520
/* Called when a Mandos server is found */
521
static int start_mandos_communication(const char *ip, uint16_t port,
522
AvahiIfIndex if_index,
524
int ret, tcp_sd = -1;
527
struct sockaddr_in in;
528
struct sockaddr_in6 in6;
342
void empty_log(__attribute__((unused)) AvahiLogLevel level,
343
__attribute__((unused)) const char *txt){}
345
int start_mandos_communication(const char *ip, uint16_t port,
346
unsigned int if_index){
348
struct sockaddr_in6 to;
349
encrypted_session es;
530
350
char *buffer = NULL;
531
351
char *decrypted_buffer;
532
352
size_t buffer_length = 0;
533
353
size_t buffer_capacity = 0;
534
354
ssize_t decrypted_buffer_size;
537
gnutls_session_t session;
538
int pf; /* Protocol family */
552
fprintf(stderr, "Bad address family: %d\n", af);
556
ret = init_gnutls_session(&session);
357
char interface[IF_NAMESIZE];
562
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
360
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
566
tcp_sd = socket(pf, SOCK_STREAM, 0);
364
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
568
366
perror("socket");
577
memset(&to, 0, sizeof(to));
579
to.in6.sin6_family = (sa_family_t)af;
580
ret = inet_pton(af, ip, &to.in6.sin6_addr);
582
to.in.sin_family = (sa_family_t)af;
583
ret = inet_pton(af, ip, &to.in.sin_addr);
370
if(if_indextoname(if_index, interface) == NULL){
372
perror("if_indextoname");
378
fprintf(stderr, "Binding to interface %s\n", interface);
381
memset(&to,0,sizeof(to)); /* Spurious warning */
382
to.sin6_family = AF_INET6;
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
586
385
perror("inet_pton");
591
389
fprintf(stderr, "Bad address: %s\n", ip);
596
to.in6.sin6_port = htons(port); /* Spurious warnings from
598
-Wunreachable-code */
600
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
601
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
603
if(if_index == AVAHI_IF_UNSPEC){
604
fprintf(stderr, "An IPv6 link-local address is incomplete"
605
" without a network interface\n");
609
/* Set the network interface number as scope */
610
to.in6.sin6_scope_id = (uint32_t)if_index;
613
to.in.sin_port = htons(port); /* Spurious warnings from
615
-Wunreachable-code */
392
to.sin6_port = htons(port); /* Spurious warning */
394
to.sin6_scope_id = (uint32_t)if_index;
623
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
624
char interface[IF_NAMESIZE];
625
if(if_indextoname((unsigned int)if_index, interface) == NULL){
626
perror("if_indextoname");
628
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
629
ip, interface, port);
632
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
635
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
636
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
639
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
642
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
648
if(strcmp(addrstr, ip) != 0){
649
fprintf(stderr, "Canonical address form: %s\n", addrstr);
659
ret = connect(tcp_sd, &to.in6, sizeof(to));
661
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
397
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
664
410
perror("connect");
414
ret = initgnutls (&es);
673
const char *out = mandos_protocol_version;
676
size_t out_size = strlen(out);
677
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
678
out_size - written));
684
written += (size_t)ret;
685
if(written < out_size){
688
if(out == mandos_protocol_version){
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
702
424
fprintf(stderr, "Establishing TLS session with %s\n", ip);
709
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
716
ret = gnutls_handshake(session);
720
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
722
if(ret != GNUTLS_E_SUCCESS){
427
ret = gnutls_handshake (es.session);
429
if (ret != GNUTLS_E_SUCCESS){
724
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
431
fprintf(stderr, "\n*** Handshake failed ***\n");
731
/* Read OpenPGP packet that contains the wanted password */
438
//Retrieve OpenPGP packet that contains the wanted password
734
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
441
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
744
buffer_capacity = incbuffer(&buffer, buffer_length,
746
if(buffer_capacity == 0){
756
sret = gnutls_record_recv(session, buffer+buffer_length,
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
452
buffer_capacity += BUFFER_SIZE;
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
763
462
case GNUTLS_E_INTERRUPTED:
764
463
case GNUTLS_E_AGAIN:
766
465
case GNUTLS_E_REHANDSHAKE:
768
ret = gnutls_handshake(session);
773
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
775
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
466
ret = gnutls_handshake (es.session);
468
fprintf(stderr, "\n*** Handshake failed ***\n");
782
475
fprintf(stderr, "Unknown error while reading data from"
783
" encrypted session with Mandos server\n");
476
" encrypted session with mandos server\n");
785
gnutls_bye(session, GNUTLS_SHUT_RDWR);
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
789
buffer_length += (size_t) sret;
482
buffer_length += (size_t) ret;
794
fprintf(stderr, "Closing TLS session\n");
801
gnutls_bye(session, GNUTLS_SHUT_RDWR);
807
if(buffer_length > 0){
486
if (buffer_length > 0){
808
487
decrypted_buffer_size = pgp_packet_decrypt(buffer,
811
if(decrypted_buffer_size >= 0){
491
if (decrypted_buffer_size >= 0){
813
492
while(written < (size_t) decrypted_buffer_size){
818
ret = (int)fwrite(decrypted_buffer + written, 1,
819
(size_t)decrypted_buffer_size - written,
493
ret = (int)fwrite (decrypted_buffer + written, 1,
494
(size_t)decrypted_buffer_size - written,
821
496
if(ret == 0 and ferror(stdout)){
823
498
fprintf(stderr, "Error writing encrypted data: %s\n",
889
561
char ip[AVAHI_ADDRESS_STR_MAX];
890
562
avahi_address_snprint(ip, sizeof(ip), address);
892
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
893
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
894
ip, (intmax_t)interface, port);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
896
int ret = start_mandos_communication(ip, port, interface,
897
avahi_proto_to_af(proto));
899
avahi_simple_poll_quit(mc.simple_poll);
567
int ret = start_mandos_communication(ip, port,
568
(unsigned int) interface);
903
574
avahi_s_service_resolver_free(r);
906
static void browse_callback(AvahiSServiceBrowser *b,
907
AvahiIfIndex interface,
908
AvahiProtocol protocol,
909
AvahiBrowserEvent event,
913
AVAHI_GCC_UNUSED AvahiLookupResultFlags
915
AVAHI_GCC_UNUSED void* userdata){
918
/* Called whenever a new services becomes available on the LAN or
919
is removed from the LAN */
927
case AVAHI_BROWSER_FAILURE:
929
fprintf(stderr, "(Avahi browser) %s\n",
930
avahi_strerror(avahi_server_errno(mc.server)));
931
avahi_simple_poll_quit(mc.simple_poll);
934
case AVAHI_BROWSER_NEW:
935
/* We ignore the returned Avahi resolver object. In the callback
936
function we free it. If the Avahi server is terminated before
937
the callback function is called the Avahi server will free the
940
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
941
name, type, domain, protocol, 0,
942
resolve_callback, NULL) == NULL)
943
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
944
name, avahi_strerror(avahi_server_errno(mc.server)));
947
case AVAHI_BROWSER_REMOVE:
950
case AVAHI_BROWSER_ALL_FOR_NOW:
951
case AVAHI_BROWSER_CACHE_EXHAUSTED:
953
fprintf(stderr, "No Mandos server found, still searching...\n");
577
static void browse_callback(
578
AvahiSServiceBrowser *b,
579
AvahiIfIndex interface,
580
AvahiProtocol protocol,
581
AvahiBrowserEvent event,
585
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
588
AvahiServer *s = userdata;
589
assert(b); /* Spurious warning */
591
/* Called whenever a new services becomes available on the LAN or
592
is removed from the LAN */
596
case AVAHI_BROWSER_FAILURE:
598
fprintf(stderr, "(Browser) %s\n",
599
avahi_strerror(avahi_server_errno(server)));
600
avahi_simple_poll_quit(simple_poll);
603
case AVAHI_BROWSER_NEW:
604
/* We ignore the returned resolver object. In the callback
605
function we free it. If the server is terminated before
606
the callback function is called the server will free
607
the resolver for us. */
609
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
611
AVAHI_PROTO_INET6, 0,
612
resolve_callback, s)))
613
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
614
avahi_strerror(avahi_server_errno(s)));
617
case AVAHI_BROWSER_REMOVE:
620
case AVAHI_BROWSER_ALL_FOR_NOW:
621
case AVAHI_BROWSER_CACHE_EXHAUSTED:
959
/* stop main loop after sigterm has been called */
960
static void handle_sigterm(int sig){
965
signal_received = sig;
966
int old_errno = errno;
967
if(mc.simple_poll != NULL){
968
avahi_simple_poll_quit(mc.simple_poll);
973
int main(int argc, char *argv[]){
974
AvahiSServiceBrowser *sb = NULL;
979
int exitcode = EXIT_SUCCESS;
980
const char *interface = "eth0";
981
struct ifreq network;
983
bool take_down_interface = false;
986
char *connect_to = NULL;
987
char tempdir[] = "/tmp/mandosXXXXXX";
988
bool tempdir_created = false;
989
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
990
const char *seckey = PATHDIR "/" SECKEY;
991
const char *pubkey = PATHDIR "/" PUBKEY;
993
bool gnutls_initialized = false;
994
bool gpgme_initialized = false;
997
struct sigaction old_sigterm_action;
998
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1001
struct argp_option options[] = {
1002
{ .name = "debug", .key = 128,
1003
.doc = "Debug mode", .group = 3 },
1004
{ .name = "connect", .key = 'c',
1005
.arg = "ADDRESS:PORT",
1006
.doc = "Connect directly to a specific Mandos server",
1008
{ .name = "interface", .key = 'i',
1010
.doc = "Network interface that will be used to search for"
1013
{ .name = "seckey", .key = 's',
1015
.doc = "OpenPGP secret key file base name",
1017
{ .name = "pubkey", .key = 'p',
1019
.doc = "OpenPGP public key file base name",
1021
{ .name = "dh-bits", .key = 129,
1023
.doc = "Bit length of the prime number used in the"
1024
" Diffie-Hellman key exchange",
1026
{ .name = "priority", .key = 130,
1028
.doc = "GnuTLS priority string for the TLS handshake",
1030
{ .name = "delay", .key = 131,
1032
.doc = "Maximum delay to wait for interface startup",
626
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
627
AvahiServerConfig config;
628
AvahiSServiceBrowser *sb = NULL;
631
int returncode = EXIT_SUCCESS;
632
const char *interface = "eth0";
633
unsigned int if_index;
634
char *connect_to = NULL;
1037
error_t parse_opt(int key, char *arg,
1038
struct argp_state *state){
1040
case 128: /* --debug */
1043
case 'c': /* --connect */
1046
case 'i': /* --interface */
1049
case 's': /* --seckey */
1052
case 'p': /* --pubkey */
1055
case 129: /* --dh-bits */
1057
tmpmax = strtoimax(arg, &tmp, 10);
1058
if(errno != 0 or tmp == arg or *tmp != '\0'
1059
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1060
fprintf(stderr, "Bad number of DH bits\n");
1063
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1065
case 130: /* --priority */
1068
case 131: /* --delay */
1070
delay = strtof(arg, &tmp);
1071
if(errno != 0 or tmp == arg or *tmp != '\0'){
1072
fprintf(stderr, "Bad delay\n");
637
static struct option long_options[] = {
638
{"debug", no_argument, (int *)&debug, 1},
639
{"connect", required_argument, 0, 'c'},
640
{"interface", required_argument, 0, 'i'},
643
int option_index = 0;
644
ret = getopt_long (argc, argv, "i:", long_options,
1081
return ARGP_ERR_UNKNOWN;
1086
struct argp argp = { .options = options, .parser = parse_opt,
1088
.doc = "Mandos client -- Get and decrypt"
1089
" passwords from a Mandos server" };
1090
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1091
if(ret == ARGP_ERR_UNKNOWN){
1092
fprintf(stderr, "Unknown error while parsing arguments\n");
1093
exitcode = EXIT_FAILURE;
1099
avahi_set_log_function(empty_log);
1102
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1103
from the signal handler */
1104
/* Initialize the pseudo-RNG for Avahi */
1105
srand((unsigned int) time(NULL));
1106
mc.simple_poll = avahi_simple_poll_new();
1107
if(mc.simple_poll == NULL){
1108
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1109
exitcode = EXIT_FAILURE;
1113
sigemptyset(&sigterm_action.sa_mask);
1114
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1116
perror("sigaddset");
1117
exitcode = EXIT_FAILURE;
1120
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1122
perror("sigaddset");
1123
exitcode = EXIT_FAILURE;
1126
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1128
perror("sigaddset");
1129
exitcode = EXIT_FAILURE;
1132
/* Need to check if the handler is SIG_IGN before handling:
1133
| [[info:libc:Initial Signal Actions]] |
1134
| [[info:libc:Basic Signal Handling]] |
1136
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1138
perror("sigaction");
1139
return EXIT_FAILURE;
1141
if(old_sigterm_action.sa_handler != SIG_IGN){
1142
ret = sigaction(SIGINT, &sigterm_action, NULL);
1144
perror("sigaction");
1145
exitcode = EXIT_FAILURE;
1149
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1151
perror("sigaction");
1152
return EXIT_FAILURE;
1154
if(old_sigterm_action.sa_handler != SIG_IGN){
1155
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1157
perror("sigaction");
1158
exitcode = EXIT_FAILURE;
1162
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1164
perror("sigaction");
1165
return EXIT_FAILURE;
1167
if(old_sigterm_action.sa_handler != SIG_IGN){
1168
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1170
perror("sigaction");
1171
exitcode = EXIT_FAILURE;
1176
/* If the interface is down, bring it up */
1177
if(interface[0] != '\0'){
1178
if_index = (AvahiIfIndex) if_nametoindex(interface);
665
if_index = if_nametoindex(interface);
1179
666
if(if_index == 0){
1180
667
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1181
exitcode = EXIT_FAILURE;
1190
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1191
messages to mess up the prompt */
1192
ret = klogctl(8, NULL, 5);
1193
bool restore_loglevel = true;
1195
restore_loglevel = false;
1198
#endif /* __linux__ */
1200
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1203
exitcode = EXIT_FAILURE;
1205
if(restore_loglevel){
1206
ret = klogctl(7, NULL, 0);
1211
#endif /* __linux__ */
1214
strcpy(network.ifr_name, interface);
1215
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1217
perror("ioctl SIOCGIFFLAGS");
1219
if(restore_loglevel){
1220
ret = klogctl(7, NULL, 0);
1225
#endif /* __linux__ */
1226
exitcode = EXIT_FAILURE;
1229
if((network.ifr_flags & IFF_UP) == 0){
1230
network.ifr_flags |= IFF_UP;
1231
take_down_interface = true;
1232
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1234
take_down_interface = false;
1235
perror("ioctl SIOCSIFFLAGS");
1236
exitcode = EXIT_FAILURE;
1238
if(restore_loglevel){
1239
ret = klogctl(7, NULL, 0);
1244
#endif /* __linux__ */
1248
/* sleep checking until interface is running */
1249
for(int i=0; i < delay * 4; i++){
1250
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1252
perror("ioctl SIOCGIFFLAGS");
1253
} else if(network.ifr_flags & IFF_RUNNING){
1256
struct timespec sleeptime = { .tv_nsec = 250000000 };
1257
ret = nanosleep(&sleeptime, NULL);
1258
if(ret == -1 and errno != EINTR){
1259
perror("nanosleep");
1262
if(not take_down_interface){
1263
/* We won't need the socket anymore */
1264
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1270
if(restore_loglevel){
1271
/* Restores kernel loglevel to default */
1272
ret = klogctl(7, NULL, 0);
1277
#endif /* __linux__ */
1302
ret = init_gnutls_global(pubkey, seckey);
1304
fprintf(stderr, "init_gnutls_global failed\n");
1305
exitcode = EXIT_FAILURE;
1308
gnutls_initialized = true;
1315
tempdir_created = true;
1316
if(mkdtemp(tempdir) == NULL){
1317
tempdir_created = false;
1326
if(not init_gpgme(pubkey, seckey, tempdir)){
1327
fprintf(stderr, "init_gpgme failed\n");
1328
exitcode = EXIT_FAILURE;
1331
gpgme_initialized = true;
1338
if(connect_to != NULL){
1339
/* Connect directly, do not use Zeroconf */
1340
/* (Mainly meant for debugging) */
1341
char *address = strrchr(connect_to, ':');
1342
if(address == NULL){
1343
fprintf(stderr, "No colon in address\n");
1344
exitcode = EXIT_FAILURE;
1354
tmpmax = strtoimax(address+1, &tmp, 10);
1355
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1356
or tmpmax != (uint16_t)tmpmax){
1357
fprintf(stderr, "Bad port number\n");
1358
exitcode = EXIT_FAILURE;
1366
port = (uint16_t)tmpmax;
1368
address = connect_to;
1369
/* Colon in address indicates IPv6 */
1371
if(strchr(address, ':') != NULL){
1381
ret = start_mandos_communication(address, port, if_index, af);
1383
exitcode = EXIT_FAILURE;
1385
exitcode = EXIT_SUCCESS;
1395
AvahiServerConfig config;
1396
/* Do not publish any local Zeroconf records */
671
if(connect_to != NULL){
672
/* Connect directly, do not use Zeroconf */
673
/* (Mainly meant for debugging) */
674
char *address = strrchr(connect_to, ':');
676
fprintf(stderr, "No colon in address\n");
680
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
682
perror("Bad port number");
686
address = connect_to;
687
ret = start_mandos_communication(address, port, if_index);
696
avahi_set_log_function(empty_log);
699
/* Initialize the psuedo-RNG */
700
srand((unsigned int) time(NULL));
702
/* Allocate main loop object */
703
if (!(simple_poll = avahi_simple_poll_new())) {
704
fprintf(stderr, "Failed to create simple poll object.\n");
709
/* Do not publish any local records */
1397
710
avahi_server_config_init(&config);
1398
711
config.publish_hinfo = 0;
1399
712
config.publish_addresses = 0;
1400
713
config.publish_workstation = 0;
1401
714
config.publish_domain = 0;
1403
716
/* Allocate a new server */
1404
mc.server = avahi_server_new(avahi_simple_poll_get
1405
(mc.simple_poll), &config, NULL,
1408
/* Free the Avahi configuration data */
717
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
718
&config, NULL, NULL, &error);
720
/* Free the configuration data */
1409
721
avahi_server_config_free(&config);
1412
/* Check if creating the Avahi server object succeeded */
1413
if(mc.server == NULL){
1414
fprintf(stderr, "Failed to create Avahi server: %s\n",
1415
avahi_strerror(error));
1416
exitcode = EXIT_FAILURE;
1424
/* Create the Avahi service browser */
1425
sb = avahi_s_service_browser_new(mc.server, if_index,
1426
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1427
NULL, 0, browse_callback, NULL);
1429
fprintf(stderr, "Failed to create service browser: %s\n",
1430
avahi_strerror(avahi_server_errno(mc.server)));
1431
exitcode = EXIT_FAILURE;
1439
/* Run the main loop */
1442
fprintf(stderr, "Starting Avahi loop search\n");
1445
avahi_simple_poll_loop(mc.simple_poll);
1450
fprintf(stderr, "%s exiting\n", argv[0]);
1453
/* Cleanup things */
1455
avahi_s_service_browser_free(sb);
1457
if(mc.server != NULL)
1458
avahi_server_free(mc.server);
1460
if(mc.simple_poll != NULL)
1461
avahi_simple_poll_free(mc.simple_poll);
1463
if(gnutls_initialized){
1464
gnutls_certificate_free_credentials(mc.cred);
1465
gnutls_global_deinit();
1466
gnutls_dh_params_deinit(mc.dh_params);
1469
if(gpgme_initialized){
1470
gpgme_release(mc.ctx);
1473
/* Take down the network interface */
1474
if(take_down_interface){
1475
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1477
perror("ioctl SIOCGIFFLAGS");
1478
} else if(network.ifr_flags & IFF_UP) {
1479
network.ifr_flags &= ~IFF_UP; /* clear flag */
1480
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1482
perror("ioctl SIOCSIFFLAGS");
1485
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1491
/* Removes the temp directory used by GPGME */
1492
if(tempdir_created){
1494
struct dirent *direntry;
1495
d = opendir(tempdir);
1497
if(errno != ENOENT){
1502
direntry = readdir(d);
1503
if(direntry == NULL){
1506
/* Skip "." and ".." */
1507
if(direntry->d_name[0] == '.'
1508
and (direntry->d_name[1] == '\0'
1509
or (direntry->d_name[1] == '.'
1510
and direntry->d_name[2] == '\0'))){
1513
char *fullname = NULL;
1514
ret = asprintf(&fullname, "%s/%s", tempdir,
1520
ret = remove(fullname);
1522
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1529
ret = rmdir(tempdir);
1530
if(ret == -1 and errno != ENOENT){
1536
sigemptyset(&old_sigterm_action.sa_mask);
1537
old_sigterm_action.sa_handler = SIG_DFL;
1538
ret = sigaction(signal_received, &old_sigterm_action, NULL);
1540
perror("sigaction");
1542
raise(signal_received);
723
/* Check if creating the server object succeeded */
725
fprintf(stderr, "Failed to create server: %s\n",
726
avahi_strerror(error));
727
returncode = EXIT_FAILURE;
731
/* Create the service browser */
732
sb = avahi_s_service_browser_new(server, (AvahiIfIndex)if_index,
734
"_mandos._tcp", NULL, 0,
735
browse_callback, server);
737
fprintf(stderr, "Failed to create service browser: %s\n",
738
avahi_strerror(avahi_server_errno(server)));
739
returncode = EXIT_FAILURE;
743
/* Run the main loop */
746
fprintf(stderr, "Starting avahi loop search\n");
749
avahi_simple_poll_loop(simple_poll);
754
fprintf(stderr, "%s exiting\n", argv[0]);
759
avahi_s_service_browser_free(sb);
762
avahi_server_free(server);
765
avahi_simple_poll_free(simple_poll);