To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 29
- compare with another revision
- download diff
- download tarball
- view history from revision 29
- Committer: Teddy Hogeborn
- Date: 2008-07-31 19:48:05 UTC
- Revision ID: teddy@fukt.bsnet.se-20080731194805-mseis21dxwrdfqhk
* plugins.d/mandosclient.c (start_mandos_communication): Changed
"if_index" to
be of type
"AvahiIfIndex".
All callers
changed.
(main): Add default values to "interface" and "if_index". Only
change if_index from default if "interface" was given.
* server.py (IPv6_TCPServer.server_bind): Bug fix: test if interface
is empty, not if equal to
avahi.IF_UNSPEC.
(if_nametoindex): Bug fix; typo: assign to _func[0], not func[0].
(main): Bug fix: Do not set service.interface unless the interface
setting has been given.
"if_index" to
be of type
"AvahiIfIndex".
All callers
changed.
(main): Add default values to "interface" and "if_index". Only
change if_index from default if "interface" was given.
* server.py (IPv6_TCPServer.server_bind): Bug fix: test if interface
is empty, not if equal to
avahi.IF_UNSPEC.
(if_nametoindex): Bug fix; typo: assign to _func[0], not func[0].
(main): Bug fix: Do not set service.interface unless the interface
setting has been given.
- files modified:
- TODO
added
removed
plugins.d/mandosclient.c
25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
27
27
*
28
* Contact the authors at <mandos@fukt.bsnet.se>.
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
29
30
*/
30
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
32
33
#define _LARGEFILE_SOURCE
33
34
#define _FILE_OFFSET_BITS 64
34
35
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
37
36
#include <stdio.h>
38
37
#include <assert.h>
39
38
#include <stdlib.h>
40
39
#include <time.h>
41
40
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
44
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
45
SIOCSIFFLAGS */
46
41
47
42
#include <avahi-core/core.h>
48
43
#include <avahi-core/lookup.h>
51
46
#include <avahi-common/malloc.h>
52
47
#include <avahi-common/error.h>
53
48
54
/* Mandos client part */
49
//mandos client part
55
50
#include <sys/types.h> /* socket(), inet_pton() */
56
51
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
57
52
struct in6_addr, inet_pton() */
64
59
#include <string.h> /* memset */
65
60
#include <arpa/inet.h> /* inet_pton() */
66
61
#include <iso646.h> /* not */
67
#include <net/if.h> /* IF_NAMESIZE */
68
62
69
/* GPGME */
63
// gpgme
70
64
#include <errno.h> /* perror() */
71
65
#include <gpgme.h>
72
66
73
/* getopt_long */
67
// getopt long
74
68
#include <getopt.h>
75
69
70
#ifndef CERT_ROOT
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
72
#endif
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
76
75
#define BUFFER_SIZE 256
77
78
static const char *keydir = "/conf/conf.d/mandos";
79
static const char *pubkeyfile = "pubkey.txt";
80
static const char *seckeyfile = "seckey.txt";
76
#define DH_BITS 1024
81
77
82
78
bool debug = false;
83
79
84
const char mandos_protocol_version[] = "1";
85
86
/* Used for passing in values through all the callback functions */
87
80
typedef struct {
88
AvahiSimplePoll *simple_poll;
89
AvahiServer *server;
81
gnutls_session_t session;
90
82
gnutls_certificate_credentials_t cred;
91
unsigned int dh_bits;
92
83
gnutls_dh_params_t dh_params;
93
const char *priority;
94
} mandos_context;
95
96
size_t adjustbuffer(char **buffer, size_t buffer_length,
97
size_t buffer_capacity){
98
if (buffer_length + BUFFER_SIZE > buffer_capacity){
99
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
100
if (buffer == NULL){
101
return 0;
102
}
103
buffer_capacity += BUFFER_SIZE;
104
}
105
return buffer_capacity;
106
}
107
108
/*
109
* Decrypt OpenPGP data using keyrings in HOMEDIR.
110
* Returns -1 on error
111
*/
112
static ssize_t pgp_packet_decrypt (const char *cryptotext,
113
size_t crypto_size,
114
char **plaintext,
115
const char *homedir){
84
} encrypted_session;
85
86
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
116
89
gpgme_data_t dh_crypto, dh_plain;
117
90
gpgme_ctx_t ctx;
118
91
gpgme_error_t rc;
119
92
ssize_t ret;
120
size_t plaintext_capacity = 0;
121
ssize_t plaintext_length = 0;
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
122
95
gpgme_engine_info_t engine_info;
123
96
124
97
if (debug){
125
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
126
99
}
127
100
128
101
/* Init GPGME */
129
102
gpgme_check_version(NULL);
130
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
131
if (rc != GPG_ERR_NO_ERROR){
132
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
133
gpgme_strsource(rc), gpgme_strerror(rc));
134
return -1;
135
}
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
136
104
137
/* Set GPGME home directory for the OpenPGP engine only */
105
/* Set GPGME home directory */
138
106
rc = gpgme_get_engine_info (&engine_info);
139
107
if (rc != GPG_ERR_NO_ERROR){
140
108
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
150
118
engine_info = engine_info->next;
151
119
}
152
120
if(engine_info == NULL){
153
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
121
fprintf(stderr, "Could not set home dir to %s\n", homedir);
154
122
return -1;
155
123
}
156
124
157
/* Create new GPGME data buffer from memory cryptotext */
158
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
159
0);
125
/* Create new GPGME data buffer from packet buffer */
126
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
160
127
if (rc != GPG_ERR_NO_ERROR){
161
128
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
162
129
gpgme_strsource(rc), gpgme_strerror(rc));
168
135
if (rc != GPG_ERR_NO_ERROR){
169
136
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
170
137
gpgme_strsource(rc), gpgme_strerror(rc));
171
gpgme_data_release(dh_crypto);
172
138
return -1;
173
139
}
174
140
177
143
if (rc != GPG_ERR_NO_ERROR){
178
144
fprintf(stderr, "bad gpgme_new: %s: %s\n",
179
145
gpgme_strsource(rc), gpgme_strerror(rc));
180
plaintext_length = -1;
181
goto decrypt_end;
146
return -1;
182
147
}
183
148
184
/* Decrypt data from the cryptotext data buffer to the plaintext
185
data buffer */
149
/* Decrypt data from the FILE pointer to the plaintext data
150
buffer */
186
151
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
187
152
if (rc != GPG_ERR_NO_ERROR){
188
153
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
189
154
gpgme_strsource(rc), gpgme_strerror(rc));
190
plaintext_length = -1;
191
goto decrypt_end;
155
return -1;
192
156
}
193
157
194
158
if(debug){
195
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
159
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
196
160
}
197
161
198
162
if (debug){
199
163
gpgme_decrypt_result_t result;
200
164
result = gpgme_op_decrypt_result(ctx);
224
188
}
225
189
}
226
190
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
193
227
194
/* Seek back to the beginning of the GPGME plaintext data buffer */
228
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
229
perror("pgpme_data_seek");
230
plaintext_length = -1;
231
goto decrypt_end;
232
}
233
234
*plaintext = NULL;
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
196
197
*new_packet = 0;
235
198
while(true){
236
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
237
plaintext_capacity);
238
if (plaintext_capacity == 0){
239
perror("adjustbuffer");
240
plaintext_length = -1;
241
goto decrypt_end;
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
202
+ BUFFER_SIZE);
203
if (*new_packet == NULL){
204
perror("realloc");
205
return -1;
206
}
207
new_packet_capacity += BUFFER_SIZE;
242
208
}
243
209
244
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
245
211
BUFFER_SIZE);
246
212
/* Print the data, if any */
247
213
if (ret == 0){
248
/* EOF */
249
214
break;
250
215
}
251
216
if(ret < 0){
252
217
perror("gpgme_data_read");
253
plaintext_length = -1;
254
goto decrypt_end;
218
return -1;
255
219
}
256
plaintext_length += ret;
220
new_packet_length += ret;
257
221
}
258
222
259
if(debug){
260
fprintf(stderr, "Decrypted password is: ");
261
for(ssize_t i = 0; i < plaintext_length; i++){
262
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
263
}
264
fprintf(stderr, "\n");
265
}
266
267
decrypt_end:
268
269
/* Delete the GPGME cryptotext data buffer */
270
gpgme_data_release(dh_crypto);
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
225
/* if(debug){ */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
229
/* } */
271
230
272
231
/* Delete the GPGME plaintext data buffer */
273
232
gpgme_data_release(dh_plain);
274
return plaintext_length;
233
return new_packet_length;
275
234
}
276
235
277
236
static const char * safer_gnutls_strerror (int value) {
281
240
return ret;
282
241
}
283
242
284
/* GnuTLS log function callback */
285
static void debuggnutls(__attribute__((unused)) int level,
286
const char* string){
287
fprintf(stderr, "GnuTLS: %s", string);
243
void debuggnutls(__attribute__((unused)) int level,
244
const char* string){
245
fprintf(stderr, "%s", string);
288
246
}
289
247
290
static int init_gnutls_global(mandos_context *mc){
248
int initgnutls(encrypted_session *es){
249
const char *err;
291
250
int ret;
292
251
293
252
if(debug){
294
253
fprintf(stderr, "Initializing GnuTLS\n");
295
254
}
296
255
297
256
if ((ret = gnutls_global_init ())
298
257
!= GNUTLS_E_SUCCESS) {
299
fprintf (stderr, "GnuTLS global_init: %s\n",
300
safer_gnutls_strerror(ret));
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
301
259
return -1;
302
260
}
303
261
304
262
if (debug){
305
/* "Use a log level over 10 to enable all debugging options."
306
* - GnuTLS manual
307
*/
308
263
gnutls_global_set_log_level(11);
309
264
gnutls_global_set_log_function(debuggnutls);
310
265
}
311
266
312
/* OpenPGP credentials */
313
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
267
/* openpgp credentials */
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
314
269
!= GNUTLS_E_SUCCESS) {
315
fprintf (stderr, "GnuTLS memory error: %s\n",
270
fprintf (stderr, "memory error: %s\n",
316
271
safer_gnutls_strerror(ret));
317
272
return -1;
318
273
}
319
274
320
275
if(debug){
321
276
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
322
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
323
seckeyfile);
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
278
KEYFILE);
324
279
}
325
280
326
281
ret = gnutls_certificate_set_openpgp_key_file
327
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
328
283
if (ret != GNUTLS_E_SUCCESS) {
329
fprintf(stderr,
330
"Error[%d] while reading the OpenPGP key pair ('%s',"
331
" '%s')\n", ret, pubkeyfile, seckeyfile);
332
fprintf(stdout, "The GnuTLS error is: %s\n",
284
fprintf
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
286
" '%s')\n",
287
ret, CERTFILE, KEYFILE);
288
fprintf(stdout, "The Error is: %s\n",
333
289
safer_gnutls_strerror(ret));
334
290
return -1;
335
291
}
336
292
337
/* GnuTLS server initialization */
338
ret = gnutls_dh_params_init(&mc->dh_params);
339
if (ret != GNUTLS_E_SUCCESS) {
340
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
341
" %s\n", safer_gnutls_strerror(ret));
342
return -1;
343
}
344
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
345
if (ret != GNUTLS_E_SUCCESS) {
346
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
347
safer_gnutls_strerror(ret));
348
return -1;
349
}
350
351
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
352
353
return 0;
354
}
355
356
static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
357
int ret;
358
/* GnuTLS session creation */
359
ret = gnutls_init(session, GNUTLS_SERVER);
360
if (ret != GNUTLS_E_SUCCESS){
293
//GnuTLS server initialization
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
295
!= GNUTLS_E_SUCCESS) {
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
297
safer_gnutls_strerror(ret));
298
return -1;
299
}
300
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in prime generation: %s\n",
304
safer_gnutls_strerror(ret));
305
return -1;
306
}
307
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
309
310
// GnuTLS session creation
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
312
!= GNUTLS_E_SUCCESS){
361
313
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
362
314
safer_gnutls_strerror(ret));
363
315
}
364
316
365
{
366
const char *err;
367
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
368
if (ret != GNUTLS_E_SUCCESS) {
369
fprintf(stderr, "Syntax error at: %s\n", err);
370
fprintf(stderr, "GnuTLS error: %s\n",
371
safer_gnutls_strerror(ret));
372
return -1;
373
}
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf(stderr, "Syntax error at: %s\n", err);
320
fprintf(stderr, "GnuTLS error: %s\n",
321
safer_gnutls_strerror(ret));
322
return -1;
374
323
}
375
324
376
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
377
mc->cred);
378
if (ret != GNUTLS_E_SUCCESS) {
379
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
325
if ((ret = gnutls_credentials_set
326
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Error setting a credentials set: %s\n",
380
329
safer_gnutls_strerror(ret));
381
330
return -1;
382
331
}
383
332
384
333
/* ignore client certificate if any. */
385
gnutls_certificate_server_set_request (*session,
334
gnutls_certificate_server_set_request (es->session,
386
335
GNUTLS_CERT_IGNORE);
387
336
388
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
337
gnutls_dh_set_prime_bits (es->session, DH_BITS);
389
338
390
339
return 0;
391
340
}
392
341
393
/* Avahi log function callback */
394
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
395
__attribute__((unused)) const char *txt){}
342
void empty_log(__attribute__((unused)) AvahiLogLevel level,
343
__attribute__((unused)) const char *txt){}
396
344
397
/* Called when a Mandos server is found */
398
static int start_mandos_communication(const char *ip, uint16_t port,
399
AvahiIfIndex if_index,
400
mandos_context *mc){
345
int start_mandos_communication(const char *ip, uint16_t port,
346
AvahiIfIndex if_index){
401
347
int ret, tcp_sd;
402
348
struct sockaddr_in6 to;
349
encrypted_session es;
403
350
char *buffer = NULL;
404
351
char *decrypted_buffer;
405
352
size_t buffer_length = 0;
406
353
size_t buffer_capacity = 0;
407
354
ssize_t decrypted_buffer_size;
408
size_t written;
355
size_t written = 0;
409
356
int retval = 0;
410
357
char interface[IF_NAMESIZE];
411
gnutls_session_t session;
412
gnutls_dh_params_t dh_params;
413
414
ret = init_gnutls_session (mc, &session);
415
if (ret != 0){
416
return -1;
417
}
418
358
419
359
if(debug){
420
360
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
426
366
perror("socket");
427
367
return -1;
428
368
}
429
430
if(debug){
431
if(if_indextoname((unsigned int)if_index, interface) == NULL){
369
370
if(if_indextoname((unsigned int)if_index, interface) == NULL){
371
if(debug){
432
372
perror("if_indextoname");
433
return -1;
434
373
}
374
return -1;
375
}
376
377
if(debug){
435
378
fprintf(stderr, "Binding to interface %s\n", interface);
436
379
}
437
380
438
381
memset(&to,0,sizeof(to)); /* Spurious warning */
439
382
to.sin6_family = AF_INET6;
440
/* It would be nice to have a way to detect if we were passed an
441
IPv4 address here. Now we assume an IPv6 address. */
442
383
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
443
384
if (ret < 0 ){
444
385
perror("inet_pton");
445
386
return -1;
446
}
387
}
447
388
if(ret == 0){
448
389
fprintf(stderr, "Bad address: %s\n", ip);
449
390
return -1;
454
395
455
396
if(debug){
456
397
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
457
char addrstr[INET6_ADDRSTRLEN] = "";
458
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
459
sizeof(addrstr)) == NULL){
460
perror("inet_ntop");
461
} else {
462
if(strcmp(addrstr, ip) != 0){
463
fprintf(stderr, "Canonical address form: %s\n", addrstr);
464
}
465
}
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
402
/* } else { */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
405
/* } */
466
406
}
467
407
468
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
470
410
perror("connect");
471
411
return -1;
472
412
}
473
474
const char *out = mandos_protocol_version;
475
written = 0;
476
while (true){
477
size_t out_size = strlen(out);
478
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
479
out_size - written));
480
if (ret == -1){
481
perror("write");
482
retval = -1;
483
goto mandos_end;
484
}
485
written += (size_t)ret;
486
if(written < out_size){
487
continue;
488
} else {
489
if (out == mandos_protocol_version){
490
written = 0;
491
out = "\r\n";
492
} else {
493
break;
494
}
495
}
413
414
ret = initgnutls (&es);
415
if (ret != 0){
416
retval = -1;
417
return -1;
496
418
}
497
419
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
422
498
423
if(debug){
499
424
fprintf(stderr, "Establishing TLS session with %s\n", ip);
500
425
}
501
426
502
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
503
504
ret = gnutls_handshake (session);
427
ret = gnutls_handshake (es.session);
505
428
506
429
if (ret != GNUTLS_E_SUCCESS){
507
430
if(debug){
508
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
431
fprintf(stderr, "\n*** Handshake failed ***\n");
509
432
gnutls_perror (ret);
510
433
}
511
434
retval = -1;
512
goto mandos_end;
435
goto exit;
513
436
}
514
437
515
/* Read OpenPGP packet that contains the wanted password */
438
//Retrieve OpenPGP packet that contains the wanted password
516
439
517
440
if(debug){
518
441
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
520
443
}
521
444
522
445
while(true){
523
buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);
524
if (buffer_capacity == 0){
525
perror("adjustbuffer");
526
retval = -1;
527
goto mandos_end;
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
448
if (buffer == NULL){
449
perror("realloc");
450
goto exit;
451
}
452
buffer_capacity += BUFFER_SIZE;
528
453
}
529
454
530
ret = gnutls_record_recv(session, buffer+buffer_length,
531
BUFFER_SIZE);
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
532
457
if (ret == 0){
533
458
break;
534
459
}
538
463
case GNUTLS_E_AGAIN:
539
464
break;
540
465
case GNUTLS_E_REHANDSHAKE:
541
ret = gnutls_handshake (session);
466
ret = gnutls_handshake (es.session);
542
467
if (ret < 0){
543
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
468
fprintf(stderr, "\n*** Handshake failed ***\n");
544
469
gnutls_perror (ret);
545
470
retval = -1;
546
goto mandos_end;
471
goto exit;
547
472
}
548
473
break;
549
474
default:
550
475
fprintf(stderr, "Unknown error while reading data from"
551
" encrypted session with Mandos server\n");
476
" encrypted session with mandos server\n");
552
477
retval = -1;
553
gnutls_bye (session, GNUTLS_SHUT_RDWR);
554
goto mandos_end;
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
479
goto exit;
555
480
}
556
481
} else {
557
482
buffer_length += (size_t) ret;
558
483
}
559
484
}
560
485
561
if(debug){
562
fprintf(stderr, "Closing TLS session\n");
563
}
564
565
gnutls_bye (session, GNUTLS_SHUT_RDWR);
566
567
486
if (buffer_length > 0){
568
487
decrypted_buffer_size = pgp_packet_decrypt(buffer,
569
488
buffer_length,
570
489
&decrypted_buffer,
571
keydir);
490
CERT_ROOT);
572
491
if (decrypted_buffer_size >= 0){
573
written = 0;
574
492
while(written < (size_t) decrypted_buffer_size){
575
493
ret = (int)fwrite (decrypted_buffer + written, 1,
576
494
(size_t)decrypted_buffer_size - written,
590
508
retval = -1;
591
509
}
592
510
}
593
594
/* Shutdown procedure */
595
596
mandos_end:
511
512
//shutdown procedure
513
514
if(debug){
515
fprintf(stderr, "Closing TLS session\n");
516
}
517
597
518
free(buffer);
519
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
520
exit:
598
521
close(tcp_sd);
599
gnutls_deinit (session);
600
gnutls_certificate_free_credentials (mc->cred);
522
gnutls_deinit (es.session);
523
gnutls_certificate_free_credentials (es.cred);
601
524
gnutls_global_deinit ();
602
525
return retval;
603
526
}
604
527
605
static void resolve_callback(AvahiSServiceResolver *r,
606
AvahiIfIndex interface,
607
AVAHI_GCC_UNUSED AvahiProtocol protocol,
608
AvahiResolverEvent event,
609
const char *name,
610
const char *type,
611
const char *domain,
612
const char *host_name,
613
const AvahiAddress *address,
614
uint16_t port,
615
AVAHI_GCC_UNUSED AvahiStringList *txt,
616
AVAHI_GCC_UNUSED AvahiLookupResultFlags
617
flags,
618
void* userdata) {
619
mandos_context *mc = userdata;
528
static AvahiSimplePoll *simple_poll = NULL;
529
static AvahiServer *server = NULL;
530
531
static void resolve_callback(
532
AvahiSServiceResolver *r,
533
AvahiIfIndex interface,
534
AVAHI_GCC_UNUSED AvahiProtocol protocol,
535
AvahiResolverEvent event,
536
const char *name,
537
const char *type,
538
const char *domain,
539
const char *host_name,
540
const AvahiAddress *address,
541
uint16_t port,
542
AVAHI_GCC_UNUSED AvahiStringList *txt,
543
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
544
AVAHI_GCC_UNUSED void* userdata) {
545
620
546
assert(r); /* Spurious warning */
621
547
622
548
/* Called whenever a service has been resolved successfully or
625
551
switch (event) {
626
552
default:
627
553
case AVAHI_RESOLVER_FAILURE:
628
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
629
" of type '%s' in domain '%s': %s\n", name, type, domain,
630
avahi_strerror(avahi_server_errno(mc->server)));
554
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
555
" type '%s' in domain '%s': %s\n", name, type, domain,
556
avahi_strerror(avahi_server_errno(server)));
631
557
break;
632
558
633
559
case AVAHI_RESOLVER_FOUND:
635
561
char ip[AVAHI_ADDRESS_STR_MAX];
636
562
avahi_address_snprint(ip, sizeof(ip), address);
637
563
if(debug){
638
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"
639
" port %d\n", name, host_name, ip, interface, port);
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
640
566
}
641
int ret = start_mandos_communication(ip, port, interface, mc);
567
int ret = start_mandos_communication(ip, port, interface);
642
568
if (ret == 0){
643
569
exit(EXIT_SUCCESS);
644
570
}
647
573
avahi_s_service_resolver_free(r);
648
574
}
649
575
650
static void browse_callback( AvahiSServiceBrowser *b,
651
AvahiIfIndex interface,
652
AvahiProtocol protocol,
653
AvahiBrowserEvent event,
654
const char *name,
655
const char *type,
656
const char *domain,
657
AVAHI_GCC_UNUSED AvahiLookupResultFlags
658
flags,
659
void* userdata) {
660
mandos_context *mc = userdata;
661
assert(b); /* Spurious warning */
662
663
/* Called whenever a new services becomes available on the LAN or
664
is removed from the LAN */
665
666
switch (event) {
667
default:
668
case AVAHI_BROWSER_FAILURE:
669
670
fprintf(stderr, "(Avahi browser) %s\n",
671
avahi_strerror(avahi_server_errno(mc->server)));
672
avahi_simple_poll_quit(mc->simple_poll);
673
return;
674
675
case AVAHI_BROWSER_NEW:
676
/* We ignore the returned Avahi resolver object. In the callback
677
function we free it. If the Avahi server is terminated before
678
the callback function is called the Avahi server will free the
679
resolver for us. */
680
681
if (!(avahi_s_service_resolver_new(mc->server, interface,
682
protocol, name, type, domain,
683
AVAHI_PROTO_INET6, 0,
684
resolve_callback, mc)))
685
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
686
name, avahi_strerror(avahi_server_errno(mc->server)));
687
break;
688
689
case AVAHI_BROWSER_REMOVE:
690
break;
691
692
case AVAHI_BROWSER_ALL_FOR_NOW:
693
case AVAHI_BROWSER_CACHE_EXHAUSTED:
694
if(debug){
695
fprintf(stderr, "No Mandos server found, still searching...\n");
576
static void browse_callback(
577
AvahiSServiceBrowser *b,
578
AvahiIfIndex interface,
579
AvahiProtocol protocol,
580
AvahiBrowserEvent event,
581
const char *name,
582
const char *type,
583
const char *domain,
584
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
585
void* userdata) {
586
587
AvahiServer *s = userdata;
588
assert(b); /* Spurious warning */
589
590
/* Called whenever a new services becomes available on the LAN or
591
is removed from the LAN */
592
593
switch (event) {
594
default:
595
case AVAHI_BROWSER_FAILURE:
596
597
fprintf(stderr, "(Browser) %s\n",
598
avahi_strerror(avahi_server_errno(server)));
599
avahi_simple_poll_quit(simple_poll);
600
return;
601
602
case AVAHI_BROWSER_NEW:
603
/* We ignore the returned resolver object. In the callback
604
function we free it. If the server is terminated before
605
the callback function is called the server will free
606
the resolver for us. */
607
608
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
609
type, domain,
610
AVAHI_PROTO_INET6, 0,
611
resolve_callback, s)))
612
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
613
avahi_strerror(avahi_server_errno(s)));
614
break;
615
616
case AVAHI_BROWSER_REMOVE:
617
break;
618
619
case AVAHI_BROWSER_ALL_FOR_NOW:
620
case AVAHI_BROWSER_CACHE_EXHAUSTED:
621
break;
696
622
}
697
break;
698
}
699
}
700
701
/* Combines file name and path and returns the malloced new
702
string. some sane checks could/should be added */
703
static const char *combinepath(const char *first, const char *second){
704
size_t f_len = strlen(first);
705
size_t s_len = strlen(second);
706
char *tmp = malloc(f_len + s_len + 2);
707
if (tmp == NULL){
708
return NULL;
709
}
710
if(f_len > 0){
711
memcpy(tmp, first, f_len); /* Spurious warning */
712
}
713
tmp[f_len] = '/';
714
if(s_len > 0){
715
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
716
}
717
tmp[f_len + 1 + s_len] = '\0';
718
return tmp;
719
}
720
721
722
int main(int argc, char *argv[]){
623
}
624
625
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
626
AvahiServerConfig config;
723
627
AvahiSServiceBrowser *sb = NULL;
724
628
int error;
725
629
int ret;
726
int exitcode = EXIT_SUCCESS;
727
const char *interface = "eth0";
728
struct ifreq network;
729
int sd;
730
uid_t uid;
731
gid_t gid;
630
int returncode = EXIT_SUCCESS;
631
const char *interface = NULL;
632
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
732
633
char *connect_to = NULL;
733
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
734
mandos_context mc = { .simple_poll = NULL, .server = NULL,
735
.dh_bits = 1024, .priority = "SECURE256"};
736
737
{
738
/* Temporary int to get the address of for getopt_long */
739
int debug_int = debug ? 1 : 0;
740
while (true){
741
struct option long_options[] = {
742
{"debug", no_argument, &debug_int, 1},
743
{"connect", required_argument, NULL, 'c'},
744
{"interface", required_argument, NULL, 'i'},
745
{"keydir", required_argument, NULL, 'd'},
746
{"seckey", required_argument, NULL, 's'},
747
{"pubkey", required_argument, NULL, 'p'},
748
{"dh-bits", required_argument, NULL, 'D'},
749
{"priority", required_argument, NULL, 'P'},
750
{0, 0, 0, 0} };
751
752
int option_index = 0;
753
ret = getopt_long (argc, argv, "i:", long_options,
754
&option_index);
755
756
if (ret == -1){
757
break;
758
}
759
760
switch(ret){
761
case 0:
762
break;
763
case 'i':
764
interface = optarg;
765
break;
766
case 'c':
767
connect_to = optarg;
768
break;
769
case 'd':
770
keydir = optarg;
771
break;
772
case 'p':
773
pubkeyfile = optarg;
774
break;
775
case 's':
776
seckeyfile = optarg;
777
break;
778
case 'D':
779
errno = 0;
780
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
781
if (errno){
782
perror("strtol");
783
exit(EXIT_FAILURE);
784
}
785
break;
786
case 'P':
787
mc.priority = optarg;
788
break;
789
case '?':
790
default:
791
/* getopt_long() has already printed a message about the
792
unrcognized option, so just exit. */
793
exit(EXIT_FAILURE);
794
}
795
}
796
/* Set the global debug flag from the temporary int */
797
debug = debug_int ? true : false;
798
}
799
800
pubkeyfile = combinepath(keydir, pubkeyfile);
801
if (pubkeyfile == NULL){
802
perror("combinepath");
803
exitcode = EXIT_FAILURE;
804
goto end;
805
}
806
807
seckeyfile = combinepath(keydir, seckeyfile);
808
if (seckeyfile == NULL){
809
perror("combinepath");
810
goto end;
811
}
812
813
ret = init_gnutls_global(&mc);
814
if (ret == -1){
815
fprintf(stderr, "init_gnutls_global\n");
816
goto end;
817
}
818
819
uid = getuid();
820
gid = getgid();
821
822
ret = setuid(uid);
823
if (ret == -1){
824
perror("setuid");
825
}
826
827
setgid(gid);
828
if (ret == -1){
829
perror("setgid");
830
}
831
832
if_index = (AvahiIfIndex) if_nametoindex(interface);
833
if(if_index == 0){
834
fprintf(stderr, "No such interface: \"%s\"\n", interface);
835
exit(EXIT_FAILURE);
634
635
while (true){
636
static struct option long_options[] = {
637
{"debug", no_argument, (int *)&debug, 1},
638
{"connect", required_argument, 0, 'c'},
639
{"interface", required_argument, 0, 'i'},
640
{0, 0, 0, 0} };
641
642
int option_index = 0;
643
ret = getopt_long (argc, argv, "i:", long_options,
644
&option_index);
645
646
if (ret == -1){
647
break;
648
}
649
650
switch(ret){
651
case 0:
652
break;
653
case 'i':
654
interface = optarg;
655
break;
656
case 'c':
657
connect_to = optarg;
658
break;
659
default:
660
exit(EXIT_FAILURE);
661
}
662
}
663
664
if(interface != NULL){
665
if_index = (AvahiIfIndex) if_nametoindex(interface);
666
if(if_index == 0){
667
fprintf(stderr, "No such interface: \"%s\"\n", interface);
668
exit(EXIT_FAILURE);
669
}
836
670
}
837
671
838
672
if(connect_to != NULL){
841
675
char *address = strrchr(connect_to, ':');
842
676
if(address == NULL){
843
677
fprintf(stderr, "No colon in address\n");
844
exitcode = EXIT_FAILURE;
845
goto end;
678
exit(EXIT_FAILURE);
846
679
}
847
680
errno = 0;
848
681
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
849
682
if(errno){
850
683
perror("Bad port number");
851
exitcode = EXIT_FAILURE;
852
goto end;
684
exit(EXIT_FAILURE);
853
685
}
854
686
*address = '\0';
855
687
address = connect_to;
856
ret = start_mandos_communication(address, port, if_index, &mc);
688
ret = start_mandos_communication(address, port, if_index);
857
689
if(ret < 0){
858
exitcode = EXIT_FAILURE;
690
exit(EXIT_FAILURE);
859
691
} else {
860
exitcode = EXIT_SUCCESS;
861
}
862
goto end;
863
}
864
865
/* If the interface is down, bring it up */
866
{
867
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
868
if(sd < 0) {
869
perror("socket");
870
exitcode = EXIT_FAILURE;
871
goto end;
872
}
873
strcpy(network.ifr_name, interface); /* Spurious warning */
874
ret = ioctl(sd, SIOCGIFFLAGS, &network);
875
if(ret == -1){
876
perror("ioctl SIOCGIFFLAGS");
877
exitcode = EXIT_FAILURE;
878
goto end;
879
}
880
if((network.ifr_flags & IFF_UP) == 0){
881
network.ifr_flags |= IFF_UP;
882
ret = ioctl(sd, SIOCSIFFLAGS, &network);
883
if(ret == -1){
884
perror("ioctl SIOCSIFFLAGS");
885
exitcode = EXIT_FAILURE;
886
goto end;
887
}
888
}
889
close(sd);
692
exit(EXIT_SUCCESS);
693
}
890
694
}
891
695
892
696
if (not debug){
893
697
avahi_set_log_function(empty_log);
894
698
}
895
699
896
/* Initialize the pseudo-RNG for Avahi */
700
/* Initialize the psuedo-RNG */
897
701
srand((unsigned int) time(NULL));
898
899
/* Allocate main Avahi loop object */
900
mc.simple_poll = avahi_simple_poll_new();
901
if (mc.simple_poll == NULL) {
902
fprintf(stderr, "Avahi: Failed to create simple poll"
903
" object.\n");
904
exitcode = EXIT_FAILURE;
905
goto end;
906
}
907
908
{
909
AvahiServerConfig config;
910
/* Do not publish any local Zeroconf records */
911
avahi_server_config_init(&config);
912
config.publish_hinfo = 0;
913
config.publish_addresses = 0;
914
config.publish_workstation = 0;
915
config.publish_domain = 0;
916
917
/* Allocate a new server */
918
mc.server = avahi_server_new(avahi_simple_poll_get
919
(mc.simple_poll), &config, NULL,
920
NULL, &error);
921
922
/* Free the Avahi configuration data */
923
avahi_server_config_free(&config);
924
}
925
926
/* Check if creating the Avahi server object succeeded */
927
if (mc.server == NULL) {
928
fprintf(stderr, "Failed to create Avahi server: %s\n",
702
703
/* Allocate main loop object */
704
if (!(simple_poll = avahi_simple_poll_new())) {
705
fprintf(stderr, "Failed to create simple poll object.\n");
706
707
goto exit;
708
}
709
710
/* Do not publish any local records */
711
avahi_server_config_init(&config);
712
config.publish_hinfo = 0;
713
config.publish_addresses = 0;
714
config.publish_workstation = 0;
715
config.publish_domain = 0;
716
717
/* Allocate a new server */
718
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
719
&config, NULL, NULL, &error);
720
721
/* Free the configuration data */
722
avahi_server_config_free(&config);
723
724
/* Check if creating the server object succeeded */
725
if (!server) {
726
fprintf(stderr, "Failed to create server: %s\n",
929
727
avahi_strerror(error));
930
exitcode = EXIT_FAILURE;
931
goto end;
728
returncode = EXIT_FAILURE;
729
goto exit;
932
730
}
933
731
934
/* Create the Avahi service browser */
935
sb = avahi_s_service_browser_new(mc.server, if_index,
732
/* Create the service browser */
733
sb = avahi_s_service_browser_new(server, if_index,
936
734
AVAHI_PROTO_INET6,
937
735
"_mandos._tcp", NULL, 0,
938
browse_callback, &mc);
939
if (sb == NULL) {
736
browse_callback, server);
737
if (!sb) {
940
738
fprintf(stderr, "Failed to create service browser: %s\n",
941
avahi_strerror(avahi_server_errno(mc.server)));
942
exitcode = EXIT_FAILURE;
943
goto end;
739
avahi_strerror(avahi_server_errno(server)));
740
returncode = EXIT_FAILURE;
741
goto exit;
944
742
}
945
743
946
744
/* Run the main loop */
947
745
948
746
if (debug){
949
fprintf(stderr, "Starting Avahi loop search\n");
747
fprintf(stderr, "Starting avahi loop search\n");
950
748
}
951
749
952
avahi_simple_poll_loop(mc.simple_poll);
750
avahi_simple_poll_loop(simple_poll);
953
751
954
end:
752
exit:
955
753
956
754
if (debug){
957
755
fprintf(stderr, "%s exiting\n", argv[0]);
958
756
}
959
757
960
758
/* Cleanup things */
961
if (sb != NULL)
759
if (sb)
962
760
avahi_s_service_browser_free(sb);
963
761
964
if (mc.server != NULL)
965
avahi_server_free(mc.server);
966
967
if (mc.simple_poll != NULL)
968
avahi_simple_poll_free(mc.simple_poll);
969
free(pubkeyfile);
970
free(seckeyfile);
971
972
return exitcode;
762
if (server)
763
avahi_server_free(server);
764
765
if (simple_poll)
766
avahi_simple_poll_free(simple_poll);
767
768
return returncode;
973
769
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0