67
64
#include <errno.h> /* perror() */
71
68
#include <getopt.h>
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
73
75
#define BUFFER_SIZE 256
75
static const char *keydir = "/conf/conf.d/mandos";
76
static const char *pubkeyfile = "pubkey.txt";
77
static const char *seckeyfile = "seckey.txt";
79
78
bool debug = false;
81
/* Used for passing in values through all the callback functions */
83
AvahiSimplePoll *simple_poll;
81
gnutls_session_t session;
85
82
gnutls_certificate_credentials_t cred;
91
* Decrypt OpenPGP data using keyrings in HOMEDIR.
94
static ssize_t pgp_packet_decrypt (const char *cryptotext,
83
gnutls_dh_params_t dh_params;
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
98
89
gpgme_data_t dh_crypto, dh_plain;
102
ssize_t plaintext_capacity = 0;
103
ssize_t plaintext_length = 0;
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
104
95
gpgme_engine_info_t engine_info;
107
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
111
102
gpgme_check_version(NULL);
112
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
113
if (rc != GPG_ERR_NO_ERROR){
114
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
115
gpgme_strsource(rc), gpgme_strerror(rc));
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
119
/* Set GPGME home directory for the OpenPGP engine only */
105
/* Set GPGME home directory */
120
106
rc = gpgme_get_engine_info (&engine_info);
121
107
if (rc != GPG_ERR_NO_ERROR){
122
108
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
209
194
/* Seek back to the beginning of the GPGME plaintext data buffer */
210
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
211
perror("pgpme_data_seek");
212
plaintext_length = -1;
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
218
if (plaintext_length + BUFFER_SIZE > plaintext_capacity){
219
*plaintext = realloc(*plaintext,
220
(unsigned int)plaintext_capacity
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
222
if (*plaintext == NULL){
203
if (*new_packet == NULL){
223
204
perror("realloc");
224
plaintext_length = -1;
227
plaintext_capacity += BUFFER_SIZE;
207
new_packet_capacity += BUFFER_SIZE;
230
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
232
212
/* Print the data, if any */
238
217
perror("gpgme_data_read");
239
plaintext_length = -1;
242
plaintext_length += ret;
220
new_packet_length += ret;
246
fprintf(stderr, "Decrypted password is: ");
247
for(size_t i = 0; i < plaintext_length; i++){
248
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
250
fprintf(stderr, "\n");
255
/* Delete the GPGME cryptotext data buffer */
256
gpgme_data_release(dh_crypto);
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
258
231
/* Delete the GPGME plaintext data buffer */
259
232
gpgme_data_release(dh_plain);
260
return plaintext_length;
233
return new_packet_length;
263
236
static const char * safer_gnutls_strerror (int value) {
270
static void debuggnutls(__attribute__((unused)) int level,
243
void debuggnutls(__attribute__((unused)) int level,
272
245
fprintf(stderr, "%s", string);
275
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
276
gnutls_dh_params_t *dh_params){
248
int initgnutls(encrypted_session *es){
281
253
fprintf(stderr, "Initializing GnuTLS\n");
284
256
if ((ret = gnutls_global_init ())
285
257
!= GNUTLS_E_SUCCESS) {
286
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
291
263
gnutls_global_set_log_level(11);
292
264
gnutls_global_set_log_function(debuggnutls);
295
267
/* openpgp credentials */
296
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
297
269
!= GNUTLS_E_SUCCESS) {
298
270
fprintf (stderr, "memory error: %s\n",
299
271
safer_gnutls_strerror(ret));
304
276
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
305
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
309
281
ret = gnutls_certificate_set_openpgp_key_file
310
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
311
283
if (ret != GNUTLS_E_SUCCESS) {
313
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
315
ret, pubkeyfile, seckeyfile);
287
ret, CERTFILE, KEYFILE);
316
288
fprintf(stdout, "The Error is: %s\n",
317
289
safer_gnutls_strerror(ret));
321
293
//GnuTLS server initialization
322
if ((ret = gnutls_dh_params_init(dh_params))
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
323
295
!= GNUTLS_E_SUCCESS) {
324
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
325
297
safer_gnutls_strerror(ret));
329
if ((ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits))
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
330
302
!= GNUTLS_E_SUCCESS) {
331
303
fprintf (stderr, "Error in prime generation: %s\n",
332
304
safer_gnutls_strerror(ret));
336
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
338
310
// GnuTLS session creation
339
if ((ret = gnutls_init(session, GNUTLS_SERVER))
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
340
312
!= GNUTLS_E_SUCCESS){
341
313
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
342
314
safer_gnutls_strerror(ret));
345
if ((ret = gnutls_priority_set_direct(*session, mc->priority, &err))
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
346
318
!= GNUTLS_E_SUCCESS) {
347
319
fprintf(stderr, "Syntax error at: %s\n", err);
348
320
fprintf(stderr, "GnuTLS error: %s\n",
424
397
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
425
char addrstr[INET6_ADDRSTRLEN] = "";
426
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
427
sizeof(addrstr)) == NULL){
430
if(strcmp(addrstr, ip) != 0){
431
fprintf(stderr, "Canonical address form: %s\n", addrstr);
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
436
408
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
546
gnutls_bye (session, GNUTLS_SHUT_RDWR);
519
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
549
gnutls_deinit (session);
550
gnutls_certificate_free_credentials (mc->cred);
522
gnutls_deinit (es.session);
523
gnutls_certificate_free_credentials (es.cred);
551
524
gnutls_global_deinit ();
555
static void resolve_callback(AvahiSServiceResolver *r,
556
AvahiIfIndex interface,
557
AVAHI_GCC_UNUSED AvahiProtocol protocol,
558
AvahiResolverEvent event,
562
const char *host_name,
563
const AvahiAddress *address,
565
AVAHI_GCC_UNUSED AvahiStringList *txt,
566
AVAHI_GCC_UNUSED AvahiLookupResultFlags
569
mandos_context *mc = userdata;
528
static AvahiSimplePoll *simple_poll = NULL;
529
static AvahiServer *server = NULL;
531
static void resolve_callback(
532
AvahiSServiceResolver *r,
533
AvahiIfIndex interface,
534
AVAHI_GCC_UNUSED AvahiProtocol protocol,
535
AvahiResolverEvent event,
539
const char *host_name,
540
const AvahiAddress *address,
542
AVAHI_GCC_UNUSED AvahiStringList *txt,
543
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
544
AVAHI_GCC_UNUSED void* userdata) {
570
546
assert(r); /* Spurious warning */
572
548
/* Called whenever a service has been resolved successfully or
597
573
avahi_s_service_resolver_free(r);
600
static void browse_callback( AvahiSServiceBrowser *b,
601
AvahiIfIndex interface,
602
AvahiProtocol protocol,
603
AvahiBrowserEvent event,
607
AVAHI_GCC_UNUSED AvahiLookupResultFlags
610
mandos_context *mc = userdata;
611
assert(b); /* Spurious warning */
613
/* Called whenever a new services becomes available on the LAN or
614
is removed from the LAN */
618
case AVAHI_BROWSER_FAILURE:
620
fprintf(stderr, "(Browser) %s\n",
621
avahi_strerror(avahi_server_errno(mc->server)));
622
avahi_simple_poll_quit(mc->simple_poll);
625
case AVAHI_BROWSER_NEW:
626
/* We ignore the returned resolver object. In the callback
627
function we free it. If the server is terminated before
628
the callback function is called the server will free
629
the resolver for us. */
631
if (!(avahi_s_service_resolver_new(mc->server, interface,
632
protocol, name, type, domain,
633
AVAHI_PROTO_INET6, 0,
634
resolve_callback, mc)))
635
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
636
avahi_strerror(avahi_server_errno(mc->server)));
639
case AVAHI_BROWSER_REMOVE:
642
case AVAHI_BROWSER_ALL_FOR_NOW:
643
case AVAHI_BROWSER_CACHE_EXHAUSTED:
648
/* Combines file name and path and returns the malloced new
649
string. some sane checks could/should be added */
650
static const char *combinepath(const char *first, const char *second){
651
size_t f_len = strlen(first);
652
size_t s_len = strlen(second);
653
char *tmp = malloc(f_len + s_len + 2);
658
memcpy(tmp, first, f_len); /* Spurious warning */
662
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
664
tmp[f_len + 1 + s_len] = '\0';
576
static void browse_callback(
577
AvahiSServiceBrowser *b,
578
AvahiIfIndex interface,
579
AvahiProtocol protocol,
580
AvahiBrowserEvent event,
584
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
587
AvahiServer *s = userdata;
588
assert(b); /* Spurious warning */
590
/* Called whenever a new services becomes available on the LAN or
591
is removed from the LAN */
595
case AVAHI_BROWSER_FAILURE:
597
fprintf(stderr, "(Browser) %s\n",
598
avahi_strerror(avahi_server_errno(server)));
599
avahi_simple_poll_quit(simple_poll);
602
case AVAHI_BROWSER_NEW:
603
/* We ignore the returned resolver object. In the callback
604
function we free it. If the server is terminated before
605
the callback function is called the server will free
606
the resolver for us. */
608
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
610
AVAHI_PROTO_INET6, 0,
611
resolve_callback, s)))
612
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
613
avahi_strerror(avahi_server_errno(s)));
616
case AVAHI_BROWSER_REMOVE:
619
case AVAHI_BROWSER_ALL_FOR_NOW:
620
case AVAHI_BROWSER_CACHE_EXHAUSTED:
669
625
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
670
626
AvahiServerConfig config;
671
627
AvahiSServiceBrowser *sb = NULL;
675
630
int returncode = EXIT_SUCCESS;
676
const char *interface = "eth0";
677
struct ifreq network;
631
const char *interface = NULL;
632
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
679
633
char *connect_to = NULL;
680
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
681
mandos_context mc = { .simple_poll = NULL, .server = NULL,
682
.dh_bits = 1024, .priority = "SECURE256"};
684
debug_int = debug ? 1 : 0;
686
struct option long_options[] = {
687
{"debug", no_argument, &debug_int, 1},
688
{"connect", required_argument, NULL, 'c'},
689
{"interface", required_argument, NULL, 'i'},
690
{"keydir", required_argument, NULL, 'd'},
691
{"seckey", required_argument, NULL, 's'},
692
{"pubkey", required_argument, NULL, 'p'},
693
{"dh-bits", required_argument, NULL, 'D'},
694
{"priority", required_argument, NULL, 'P'},
636
static struct option long_options[] = {
637
{"debug", no_argument, (int *)&debug, 1},
638
{"connect", required_argument, 0, 'c'},
639
{"interface", required_argument, 0, 'i'},
697
642
int option_index = 0;