To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 290
- compare with another revision
- download diff
- download tarball
- view history from revision 290
- Committer: Teddy Hogeborn
- Date: 2009-01-29 22:22:32 UTC
- Revision ID: teddy@fukt.bsnet.se-20090129222232-p9hqnq338nsvxayp
* mandos (main): Bug fix: Do setgid before setuid. Add verbose GnuTLS
debugging messages.
* plugins.d/mandos-client.c (main): Bug fix: Do setgid before setuid.
debugging messages.
* plugins.d/mandos-client.c (main): Bug fix: Do setgid before setuid.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
32
33
#define _LARGEFILE_SOURCE
33
34
#define _FILE_OFFSET_BITS 64
34
35
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
40
remove() */
41
#include <stdint.h> /* uint16_t, uint32_t */
42
#include <stddef.h> /* NULL, size_t, ssize_t */
43
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
44
srand() */
45
#include <stdbool.h> /* bool, true */
46
#include <string.h> /* memset(), strcmp(), strlen(),
47
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, INET6_ADDRSTRLEN,
52
uid_t, gid_t, open(), opendir(),
53
DIR */
54
#include <sys/stat.h> /* open() */
55
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
56
struct in6_addr, inet_pton(),
57
connect() */
58
#include <fcntl.h> /* open() */
59
#include <dirent.h> /* opendir(), struct dirent, readdir()
60
*/
61
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
62
#include <assert.h> /* assert() */
63
#include <errno.h> /* perror(), errno */
64
#include <time.h> /* time() */
65
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
66
SIOCSIFFLAGS, if_indextoname(),
67
if_nametoindex(), IF_NAMESIZE */
68
#include <netinet/in.h>
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
getuid(), getgid(), setuid(),
71
setgid() */
72
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, and, or */
74
#include <argp.h> /* struct argp_option, error_t, struct
75
argp_state, struct argp,
76
argp_parse(), ARGP_KEY_ARG,
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
79
/* Avahi */
80
/* All Avahi types, constants and functions
81
Avahi*, avahi_*,
82
AVAHI_* */
41
83
#include <avahi-core/core.h>
42
84
#include <avahi-core/lookup.h>
43
85
#include <avahi-core/log.h>
45
87
#include <avahi-common/malloc.h>
46
88
#include <avahi-common/error.h>
47
89
48
//mandos client part
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
// getopt long
67
#include <getopt.h>
90
/* GnuTLS */
91
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
92
functions:
93
gnutls_*
94
init_gnutls_session(),
95
GNUTLS_* */
96
#include <gnutls/openpgp.h>
97
/* gnutls_certificate_set_openpgp_key_file(),
98
GNUTLS_OPENPGP_FMT_BASE64 */
99
100
/* GPGME */
101
#include <gpgme.h> /* All GPGME types, constants and
102
functions:
103
gpgme_*
104
GPGME_PROTOCOL_OpenPGP,
105
GPG_ERR_NO_* */
68
106
69
107
#define BUFFER_SIZE 256
70
#define DH_BITS 1024
71
108
72
const char *certdir = "/conf/conf.d/cryptkeyreq/";
73
const char *certfile = "openpgp-client.txt";
74
const char *certkey = "openpgp-client-key.txt";
109
#define PATHDIR "/conf/conf.d/mandos"
110
#define SECKEY "seckey.txt"
111
#define PUBKEY "pubkey.txt"
75
112
76
113
bool debug = false;
114
static const char mandos_protocol_version[] = "1";
115
const char *argp_program_version = "mandos-client " VERSION;
116
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
77
117
118
/* Used for passing in values through the Avahi callback functions */
78
119
typedef struct {
79
gnutls_session_t session;
120
AvahiSimplePoll *simple_poll;
121
AvahiServer *server;
80
122
gnutls_certificate_credentials_t cred;
123
unsigned int dh_bits;
81
124
gnutls_dh_params_t dh_params;
82
} encrypted_session;
83
84
85
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
86
char **new_packet, const char *homedir){
87
gpgme_data_t dh_crypto, dh_plain;
125
const char *priority;
88
126
gpgme_ctx_t ctx;
127
} mandos_context;
128
129
/*
130
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
131
* "buffer_capacity" is how much is currently allocated,
132
* "buffer_length" is how much is already used.
133
*/
134
size_t adjustbuffer(char **buffer, size_t buffer_length,
135
size_t buffer_capacity){
136
if(buffer_length + BUFFER_SIZE > buffer_capacity){
137
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
138
if(buffer == NULL){
139
return 0;
140
}
141
buffer_capacity += BUFFER_SIZE;
142
}
143
return buffer_capacity;
144
}
145
146
/*
147
* Initialize GPGME.
148
*/
149
static bool init_gpgme(mandos_context *mc, const char *seckey,
150
const char *pubkey, const char *tempdir){
151
int ret;
89
152
gpgme_error_t rc;
90
ssize_t ret;
91
ssize_t new_packet_capacity = 0;
92
ssize_t new_packet_length = 0;
93
153
gpgme_engine_info_t engine_info;
94
95
if (debug){
96
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
154
155
156
/*
157
* Helper function to insert pub and seckey to the engine keyring.
158
*/
159
bool import_key(const char *filename){
160
int fd;
161
gpgme_data_t pgp_data;
162
163
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
164
if(fd == -1){
165
perror("open");
166
return false;
167
}
168
169
rc = gpgme_data_new_from_fd(&pgp_data, fd);
170
if(rc != GPG_ERR_NO_ERROR){
171
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
172
gpgme_strsource(rc), gpgme_strerror(rc));
173
return false;
174
}
175
176
rc = gpgme_op_import(mc->ctx, pgp_data);
177
if(rc != GPG_ERR_NO_ERROR){
178
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
179
gpgme_strsource(rc), gpgme_strerror(rc));
180
return false;
181
}
182
183
ret = (int)TEMP_FAILURE_RETRY(close(fd));
184
if(ret == -1){
185
perror("close");
186
}
187
gpgme_data_release(pgp_data);
188
return true;
189
}
190
191
if(debug){
192
fprintf(stderr, "Initialize gpgme\n");
97
193
}
98
194
99
195
/* Init GPGME */
100
196
gpgme_check_version(NULL);
101
197
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
102
if (rc != GPG_ERR_NO_ERROR){
198
if(rc != GPG_ERR_NO_ERROR){
103
199
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
104
200
gpgme_strsource(rc), gpgme_strerror(rc));
105
return -1;
201
return false;
106
202
}
107
203
108
/* Set GPGME home directory */
109
rc = gpgme_get_engine_info (&engine_info);
110
if (rc != GPG_ERR_NO_ERROR){
204
/* Set GPGME home directory for the OpenPGP engine only */
205
rc = gpgme_get_engine_info(&engine_info);
206
if(rc != GPG_ERR_NO_ERROR){
111
207
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
112
208
gpgme_strsource(rc), gpgme_strerror(rc));
113
return -1;
209
return false;
114
210
}
115
211
while(engine_info != NULL){
116
212
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
117
213
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
118
engine_info->file_name, homedir);
214
engine_info->file_name, tempdir);
119
215
break;
120
216
}
121
217
engine_info = engine_info->next;
122
218
}
123
219
if(engine_info == NULL){
124
fprintf(stderr, "Could not set home dir to %s\n", homedir);
125
return -1;
126
}
127
128
/* Create new GPGME data buffer from packet buffer */
129
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
130
if (rc != GPG_ERR_NO_ERROR){
220
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
221
return false;
222
}
223
224
/* Create new GPGME "context" */
225
rc = gpgme_new(&(mc->ctx));
226
if(rc != GPG_ERR_NO_ERROR){
227
fprintf(stderr, "bad gpgme_new: %s: %s\n",
228
gpgme_strsource(rc), gpgme_strerror(rc));
229
return false;
230
}
231
232
if(not import_key(pubkey) or not import_key(seckey)){
233
return false;
234
}
235
236
return true;
237
}
238
239
/*
240
* Decrypt OpenPGP data.
241
* Returns -1 on error
242
*/
243
static ssize_t pgp_packet_decrypt(const mandos_context *mc,
244
const char *cryptotext,
245
size_t crypto_size,
246
char **plaintext){
247
gpgme_data_t dh_crypto, dh_plain;
248
gpgme_error_t rc;
249
ssize_t ret;
250
size_t plaintext_capacity = 0;
251
ssize_t plaintext_length = 0;
252
253
if(debug){
254
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
255
}
256
257
/* Create new GPGME data buffer from memory cryptotext */
258
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
259
0);
260
if(rc != GPG_ERR_NO_ERROR){
131
261
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
132
262
gpgme_strsource(rc), gpgme_strerror(rc));
133
263
return -1;
135
265
136
266
/* Create new empty GPGME data buffer for the plaintext */
137
267
rc = gpgme_data_new(&dh_plain);
138
if (rc != GPG_ERR_NO_ERROR){
268
if(rc != GPG_ERR_NO_ERROR){
139
269
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
140
270
gpgme_strsource(rc), gpgme_strerror(rc));
141
return -1;
142
}
143
144
/* Create new GPGME "context" */
145
rc = gpgme_new(&ctx);
146
if (rc != GPG_ERR_NO_ERROR){
147
fprintf(stderr, "bad gpgme_new: %s: %s\n",
148
gpgme_strsource(rc), gpgme_strerror(rc));
149
return -1;
150
}
151
152
/* Decrypt data from the FILE pointer to the plaintext data
153
buffer */
154
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
155
if (rc != GPG_ERR_NO_ERROR){
271
gpgme_data_release(dh_crypto);
272
return -1;
273
}
274
275
/* Decrypt data from the cryptotext data buffer to the plaintext
276
data buffer */
277
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
278
if(rc != GPG_ERR_NO_ERROR){
156
279
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
157
280
gpgme_strsource(rc), gpgme_strerror(rc));
158
return -1;
281
plaintext_length = -1;
282
if(debug){
283
gpgme_decrypt_result_t result;
284
result = gpgme_op_decrypt_result(mc->ctx);
285
if(result == NULL){
286
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
287
} else {
288
fprintf(stderr, "Unsupported algorithm: %s\n",
289
result->unsupported_algorithm);
290
fprintf(stderr, "Wrong key usage: %u\n",
291
result->wrong_key_usage);
292
if(result->file_name != NULL){
293
fprintf(stderr, "File name: %s\n", result->file_name);
294
}
295
gpgme_recipient_t recipient;
296
recipient = result->recipients;
297
if(recipient){
298
while(recipient != NULL){
299
fprintf(stderr, "Public key algorithm: %s\n",
300
gpgme_pubkey_algo_name(recipient->pubkey_algo));
301
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
302
fprintf(stderr, "Secret key available: %s\n",
303
recipient->status == GPG_ERR_NO_SECKEY
304
? "No" : "Yes");
305
recipient = recipient->next;
306
}
307
}
308
}
309
}
310
goto decrypt_end;
159
311
}
160
312
161
313
if(debug){
162
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
163
}
164
165
if (debug){
166
gpgme_decrypt_result_t result;
167
result = gpgme_op_decrypt_result(ctx);
168
if (result == NULL){
169
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
170
} else {
171
fprintf(stderr, "Unsupported algorithm: %s\n",
172
result->unsupported_algorithm);
173
fprintf(stderr, "Wrong key usage: %d\n",
174
result->wrong_key_usage);
175
if(result->file_name != NULL){
176
fprintf(stderr, "File name: %s\n", result->file_name);
177
}
178
gpgme_recipient_t recipient;
179
recipient = result->recipients;
180
if(recipient){
181
while(recipient != NULL){
182
fprintf(stderr, "Public key algorithm: %s\n",
183
gpgme_pubkey_algo_name(recipient->pubkey_algo));
184
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
185
fprintf(stderr, "Secret key available: %s\n",
186
recipient->status == GPG_ERR_NO_SECKEY
187
? "No" : "Yes");
188
recipient = recipient->next;
189
}
190
}
191
}
192
}
193
194
/* Delete the GPGME FILE pointer cryptotext data buffer */
195
gpgme_data_release(dh_crypto);
314
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
315
}
196
316
197
317
/* Seek back to the beginning of the GPGME plaintext data buffer */
198
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
199
perror("pgpme_data_seek");
318
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
319
perror("gpgme_data_seek");
320
plaintext_length = -1;
321
goto decrypt_end;
200
322
}
201
323
202
*new_packet = 0;
324
*plaintext = NULL;
203
325
while(true){
204
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
205
*new_packet = realloc(*new_packet,
206
(unsigned int)new_packet_capacity
207
+ BUFFER_SIZE);
208
if (*new_packet == NULL){
209
perror("realloc");
210
return -1;
211
}
212
new_packet_capacity += BUFFER_SIZE;
326
plaintext_capacity = adjustbuffer(plaintext,
327
(size_t)plaintext_length,
328
plaintext_capacity);
329
if(plaintext_capacity == 0){
330
perror("adjustbuffer");
331
plaintext_length = -1;
332
goto decrypt_end;
213
333
}
214
334
215
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
335
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
216
336
BUFFER_SIZE);
217
337
/* Print the data, if any */
218
if (ret == 0){
338
if(ret == 0){
339
/* EOF */
219
340
break;
220
341
}
221
342
if(ret < 0){
222
343
perror("gpgme_data_read");
223
return -1;
224
}
225
new_packet_length += ret;
226
}
227
228
/* FIXME: check characters before printing to screen so to not print
229
terminal control characters */
230
/* if(debug){ */
231
/* fprintf(stderr, "decrypted password is: "); */
232
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
233
/* fprintf(stderr, "\n"); */
234
/* } */
344
plaintext_length = -1;
345
goto decrypt_end;
346
}
347
plaintext_length += ret;
348
}
349
350
if(debug){
351
fprintf(stderr, "Decrypted password is: ");
352
for(ssize_t i = 0; i < plaintext_length; i++){
353
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
354
}
355
fprintf(stderr, "\n");
356
}
357
358
decrypt_end:
359
360
/* Delete the GPGME cryptotext data buffer */
361
gpgme_data_release(dh_crypto);
235
362
236
363
/* Delete the GPGME plaintext data buffer */
237
364
gpgme_data_release(dh_plain);
238
return new_packet_length;
365
return plaintext_length;
239
366
}
240
367
241
static const char * safer_gnutls_strerror (int value) {
242
const char *ret = gnutls_strerror (value);
243
if (ret == NULL)
368
static const char * safer_gnutls_strerror(int value) {
369
const char *ret = gnutls_strerror(value); /* Spurious warning from
370
-Wunreachable-code */
371
if(ret == NULL)
244
372
ret = "(unknown)";
245
373
return ret;
246
374
}
247
375
248
void debuggnutls(__attribute__((unused)) int level,
249
const char* string){
250
fprintf(stderr, "%s", string);
376
/* GnuTLS log function callback */
377
static void debuggnutls(__attribute__((unused)) int level,
378
const char* string){
379
fprintf(stderr, "GnuTLS: %s", string);
251
380
}
252
381
253
int initgnutls(encrypted_session *es){
254
const char *err;
382
static int init_gnutls_global(mandos_context *mc,
383
const char *pubkeyfilename,
384
const char *seckeyfilename){
255
385
int ret;
256
386
257
387
if(debug){
258
388
fprintf(stderr, "Initializing GnuTLS\n");
259
389
}
260
261
if ((ret = gnutls_global_init ())
262
!= GNUTLS_E_SUCCESS) {
263
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
390
391
ret = gnutls_global_init();
392
if(ret != GNUTLS_E_SUCCESS) {
393
fprintf(stderr, "GnuTLS global_init: %s\n",
394
safer_gnutls_strerror(ret));
264
395
return -1;
265
396
}
266
267
if (debug){
397
398
if(debug){
399
/* "Use a log level over 10 to enable all debugging options."
400
* - GnuTLS manual
401
*/
268
402
gnutls_global_set_log_level(11);
269
403
gnutls_global_set_log_function(debuggnutls);
270
404
}
271
405
272
/* openpgp credentials */
273
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
274
!= GNUTLS_E_SUCCESS) {
275
fprintf (stderr, "memory error: %s\n",
276
safer_gnutls_strerror(ret));
406
/* OpenPGP credentials */
407
gnutls_certificate_allocate_credentials(&mc->cred);
408
if(ret != GNUTLS_E_SUCCESS){
409
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
410
* from
411
* -Wunreachable-code
412
*/
413
safer_gnutls_strerror(ret));
414
gnutls_global_deinit();
277
415
return -1;
278
416
}
279
417
280
418
if(debug){
281
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
282
" and keyfile %s as GnuTLS credentials\n", certfile,
283
certkey);
419
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
420
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
421
seckeyfilename);
284
422
}
285
423
286
424
ret = gnutls_certificate_set_openpgp_key_file
287
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
288
if (ret != GNUTLS_E_SUCCESS) {
289
fprintf
290
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
291
" '%s')\n",
292
ret, certfile, certkey);
293
fprintf(stdout, "The Error is: %s\n",
294
safer_gnutls_strerror(ret));
295
return -1;
296
}
297
298
//GnuTLS server initialization
299
if ((ret = gnutls_dh_params_init (&es->dh_params))
300
!= GNUTLS_E_SUCCESS) {
301
fprintf (stderr, "Error in dh parameter initialization: %s\n",
302
safer_gnutls_strerror(ret));
303
return -1;
304
}
305
306
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
307
!= GNUTLS_E_SUCCESS) {
308
fprintf (stderr, "Error in prime generation: %s\n",
309
safer_gnutls_strerror(ret));
310
return -1;
311
}
312
313
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
314
315
// GnuTLS session creation
316
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
317
!= GNUTLS_E_SUCCESS){
425
(mc->cred, pubkeyfilename, seckeyfilename,
426
GNUTLS_OPENPGP_FMT_BASE64);
427
if(ret != GNUTLS_E_SUCCESS) {
428
fprintf(stderr,
429
"Error[%d] while reading the OpenPGP key pair ('%s',"
430
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
431
fprintf(stderr, "The GnuTLS error is: %s\n",
432
safer_gnutls_strerror(ret));
433
goto globalfail;
434
}
435
436
/* GnuTLS server initialization */
437
ret = gnutls_dh_params_init(&mc->dh_params);
438
if(ret != GNUTLS_E_SUCCESS) {
439
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
440
" %s\n", safer_gnutls_strerror(ret));
441
goto globalfail;
442
}
443
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
444
if(ret != GNUTLS_E_SUCCESS) {
445
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
446
safer_gnutls_strerror(ret));
447
goto globalfail;
448
}
449
450
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
451
452
return 0;
453
454
globalfail:
455
456
gnutls_certificate_free_credentials(mc->cred);
457
gnutls_global_deinit();
458
gnutls_dh_params_deinit(mc->dh_params);
459
return -1;
460
}
461
462
static int init_gnutls_session(mandos_context *mc,
463
gnutls_session_t *session){
464
int ret;
465
/* GnuTLS session creation */
466
ret = gnutls_init(session, GNUTLS_SERVER);
467
if(ret != GNUTLS_E_SUCCESS){
318
468
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
319
469
safer_gnutls_strerror(ret));
320
470
}
321
471
322
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf(stderr, "Syntax error at: %s\n", err);
325
fprintf(stderr, "GnuTLS error: %s\n",
326
safer_gnutls_strerror(ret));
327
return -1;
472
{
473
const char *err;
474
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
475
if(ret != GNUTLS_E_SUCCESS) {
476
fprintf(stderr, "Syntax error at: %s\n", err);
477
fprintf(stderr, "GnuTLS error: %s\n",
478
safer_gnutls_strerror(ret));
479
gnutls_deinit(*session);
480
return -1;
481
}
328
482
}
329
483
330
if ((ret = gnutls_credentials_set
331
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
332
!= GNUTLS_E_SUCCESS) {
333
fprintf(stderr, "Error setting a credentials set: %s\n",
484
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
485
mc->cred);
486
if(ret != GNUTLS_E_SUCCESS) {
487
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
334
488
safer_gnutls_strerror(ret));
489
gnutls_deinit(*session);
335
490
return -1;
336
491
}
337
492
338
493
/* ignore client certificate if any. */
339
gnutls_certificate_server_set_request (es->session,
340
GNUTLS_CERT_IGNORE);
494
gnutls_certificate_server_set_request(*session,
495
GNUTLS_CERT_IGNORE);
341
496
342
gnutls_dh_set_prime_bits (es->session, DH_BITS);
497
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
343
498
344
499
return 0;
345
500
}
346
501
347
void empty_log(__attribute__((unused)) AvahiLogLevel level,
348
__attribute__((unused)) const char *txt){}
502
/* Avahi log function callback */
503
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
504
__attribute__((unused)) const char *txt){}
349
505
350
int start_mandos_communication(const char *ip, uint16_t port,
351
AvahiIfIndex if_index){
506
/* Called when a Mandos server is found */
507
static int start_mandos_communication(const char *ip, uint16_t port,
508
AvahiIfIndex if_index,
509
mandos_context *mc){
352
510
int ret, tcp_sd;
353
struct sockaddr_in6 to;
354
encrypted_session es;
511
ssize_t sret;
512
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
355
513
char *buffer = NULL;
356
514
char *decrypted_buffer;
357
515
size_t buffer_length = 0;
358
516
size_t buffer_capacity = 0;
359
517
ssize_t decrypted_buffer_size;
360
size_t written = 0;
518
size_t written;
361
519
int retval = 0;
362
520
char interface[IF_NAMESIZE];
521
gnutls_session_t session;
522
523
ret = init_gnutls_session(mc, &session);
524
if(ret != 0){
525
return -1;
526
}
363
527
364
528
if(debug){
365
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
366
ip, port);
529
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
530
"\n", ip, port);
367
531
}
368
532
369
533
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
372
536
return -1;
373
537
}
374
538
375
if(if_indextoname((unsigned int)if_index, interface) == NULL){
376
if(debug){
539
if(debug){
540
if(if_indextoname((unsigned int)if_index, interface) == NULL){
377
541
perror("if_indextoname");
542
return -1;
378
543
}
379
return -1;
380
}
381
382
if(debug){
383
544
fprintf(stderr, "Binding to interface %s\n", interface);
384
545
}
385
546
386
memset(&to,0,sizeof(to)); /* Spurious warning */
387
to.sin6_family = AF_INET6;
388
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
389
if (ret < 0 ){
547
memset(&to, 0, sizeof(to));
548
to.in6.sin6_family = AF_INET6;
549
/* It would be nice to have a way to detect if we were passed an
550
IPv4 address here. Now we assume an IPv6 address. */
551
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
552
if(ret < 0 ){
390
553
perror("inet_pton");
391
554
return -1;
392
}
555
}
393
556
if(ret == 0){
394
557
fprintf(stderr, "Bad address: %s\n", ip);
395
558
return -1;
396
559
}
397
to.sin6_port = htons(port); /* Spurious warning */
560
to.in6.sin6_port = htons(port); /* Spurious warnings from
561
-Wconversion and
562
-Wunreachable-code */
398
563
399
to.sin6_scope_id = (uint32_t)if_index;
564
to.in6.sin6_scope_id = (uint32_t)if_index;
400
565
401
566
if(debug){
402
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
403
/* char addrstr[INET6_ADDRSTRLEN]; */
404
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
405
/* sizeof(addrstr)) == NULL){ */
406
/* perror("inet_ntop"); */
407
/* } else { */
408
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
409
/* addrstr, ntohs(to.sin6_port)); */
410
/* } */
567
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
568
port);
569
char addrstr[INET6_ADDRSTRLEN] = "";
570
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
571
sizeof(addrstr)) == NULL){
572
perror("inet_ntop");
573
} else {
574
if(strcmp(addrstr, ip) != 0){
575
fprintf(stderr, "Canonical address form: %s\n", addrstr);
576
}
577
}
411
578
}
412
579
413
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
414
if (ret < 0){
580
ret = connect(tcp_sd, &to.in, sizeof(to));
581
if(ret < 0){
415
582
perror("connect");
416
583
return -1;
417
584
}
418
585
419
ret = initgnutls (&es);
420
if (ret != 0){
421
retval = -1;
422
return -1;
586
const char *out = mandos_protocol_version;
587
written = 0;
588
while(true){
589
size_t out_size = strlen(out);
590
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
591
out_size - written));
592
if(ret == -1){
593
perror("write");
594
retval = -1;
595
goto mandos_end;
596
}
597
written += (size_t)ret;
598
if(written < out_size){
599
continue;
600
} else {
601
if(out == mandos_protocol_version){
602
written = 0;
603
out = "\r\n";
604
} else {
605
break;
606
}
607
}
423
608
}
424
609
425
gnutls_transport_set_ptr (es.session,
426
(gnutls_transport_ptr_t) tcp_sd);
427
428
610
if(debug){
429
611
fprintf(stderr, "Establishing TLS session with %s\n", ip);
430
612
}
431
613
432
ret = gnutls_handshake (es.session);
433
434
if (ret != GNUTLS_E_SUCCESS){
614
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
615
616
do{
617
ret = gnutls_handshake(session);
618
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
619
620
if(ret != GNUTLS_E_SUCCESS){
435
621
if(debug){
436
fprintf(stderr, "\n*** Handshake failed ***\n");
437
gnutls_perror (ret);
622
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
623
gnutls_perror(ret);
438
624
}
439
625
retval = -1;
440
goto exit;
626
goto mandos_end;
441
627
}
442
628
443
//Retrieve OpenPGP packet that contains the wanted password
629
/* Read OpenPGP packet that contains the wanted password */
444
630
445
631
if(debug){
446
632
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
447
633
ip);
448
634
}
449
635
450
636
while(true){
451
if (buffer_length + BUFFER_SIZE > buffer_capacity){
452
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
453
if (buffer == NULL){
454
perror("realloc");
455
goto exit;
456
}
457
buffer_capacity += BUFFER_SIZE;
637
buffer_capacity = adjustbuffer(&buffer, buffer_length,
638
buffer_capacity);
639
if(buffer_capacity == 0){
640
perror("adjustbuffer");
641
retval = -1;
642
goto mandos_end;
458
643
}
459
644
460
ret = gnutls_record_recv
461
(es.session, buffer+buffer_length, BUFFER_SIZE);
462
if (ret == 0){
645
sret = gnutls_record_recv(session, buffer+buffer_length,
646
BUFFER_SIZE);
647
if(sret == 0){
463
648
break;
464
649
}
465
if (ret < 0){
466
switch(ret){
650
if(sret < 0){
651
switch(sret){
467
652
case GNUTLS_E_INTERRUPTED:
468
653
case GNUTLS_E_AGAIN:
469
654
break;
470
655
case GNUTLS_E_REHANDSHAKE:
471
ret = gnutls_handshake (es.session);
472
if (ret < 0){
473
fprintf(stderr, "\n*** Handshake failed ***\n");
474
gnutls_perror (ret);
656
do{
657
ret = gnutls_handshake(session);
658
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
659
if(ret < 0){
660
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
661
gnutls_perror(ret);
475
662
retval = -1;
476
goto exit;
663
goto mandos_end;
477
664
}
478
665
break;
479
666
default:
480
667
fprintf(stderr, "Unknown error while reading data from"
481
" encrypted session with mandos server\n");
668
" encrypted session with Mandos server\n");
482
669
retval = -1;
483
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
484
goto exit;
670
gnutls_bye(session, GNUTLS_SHUT_RDWR);
671
goto mandos_end;
485
672
}
486
673
} else {
487
buffer_length += (size_t) ret;
674
buffer_length += (size_t) sret;
488
675
}
489
676
}
490
677
491
if (buffer_length > 0){
492
decrypted_buffer_size = pgp_packet_decrypt(buffer,
678
if(debug){
679
fprintf(stderr, "Closing TLS session\n");
680
}
681
682
gnutls_bye(session, GNUTLS_SHUT_RDWR);
683
684
if(buffer_length > 0){
685
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
493
686
buffer_length,
494
&decrypted_buffer,
495
certdir);
496
if (decrypted_buffer_size >= 0){
687
&decrypted_buffer);
688
if(decrypted_buffer_size >= 0){
689
written = 0;
497
690
while(written < (size_t) decrypted_buffer_size){
498
ret = (int)fwrite (decrypted_buffer + written, 1,
499
(size_t)decrypted_buffer_size - written,
500
stdout);
691
ret = (int)fwrite(decrypted_buffer + written, 1,
692
(size_t)decrypted_buffer_size - written,
693
stdout);
501
694
if(ret == 0 and ferror(stdout)){
502
695
if(debug){
503
696
fprintf(stderr, "Error writing encrypted data: %s\n",
512
705
} else {
513
706
retval = -1;
514
707
}
515
}
516
517
//shutdown procedure
518
519
if(debug){
520
fprintf(stderr, "Closing TLS session\n");
521
}
522
708
} else {
709
retval = -1;
710
}
711
712
/* Shutdown procedure */
713
714
mandos_end:
523
715
free(buffer);
524
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
525
exit:
526
close(tcp_sd);
527
gnutls_deinit (es.session);
528
gnutls_certificate_free_credentials (es.cred);
529
gnutls_global_deinit ();
716
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
717
if(ret == -1){
718
perror("close");
719
}
720
gnutls_deinit(session);
530
721
return retval;
531
722
}
532
723
533
static AvahiSimplePoll *simple_poll = NULL;
534
static AvahiServer *server = NULL;
535
536
static void resolve_callback(
537
AvahiSServiceResolver *r,
538
AvahiIfIndex interface,
539
AVAHI_GCC_UNUSED AvahiProtocol protocol,
540
AvahiResolverEvent event,
541
const char *name,
542
const char *type,
543
const char *domain,
544
const char *host_name,
545
const AvahiAddress *address,
546
uint16_t port,
547
AVAHI_GCC_UNUSED AvahiStringList *txt,
548
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
549
AVAHI_GCC_UNUSED void* userdata) {
550
551
assert(r); /* Spurious warning */
724
static void resolve_callback(AvahiSServiceResolver *r,
725
AvahiIfIndex interface,
726
AVAHI_GCC_UNUSED AvahiProtocol protocol,
727
AvahiResolverEvent event,
728
const char *name,
729
const char *type,
730
const char *domain,
731
const char *host_name,
732
const AvahiAddress *address,
733
uint16_t port,
734
AVAHI_GCC_UNUSED AvahiStringList *txt,
735
AVAHI_GCC_UNUSED AvahiLookupResultFlags
736
flags,
737
void* userdata) {
738
mandos_context *mc = userdata;
739
assert(r);
552
740
553
741
/* Called whenever a service has been resolved successfully or
554
742
timed out */
555
743
556
switch (event) {
744
switch(event) {
557
745
default:
558
746
case AVAHI_RESOLVER_FAILURE:
559
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
560
" type '%s' in domain '%s': %s\n", name, type, domain,
561
avahi_strerror(avahi_server_errno(server)));
747
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
748
" of type '%s' in domain '%s': %s\n", name, type, domain,
749
avahi_strerror(avahi_server_errno(mc->server)));
562
750
break;
563
751
564
752
case AVAHI_RESOLVER_FOUND:
566
754
char ip[AVAHI_ADDRESS_STR_MAX];
567
755
avahi_address_snprint(ip, sizeof(ip), address);
568
756
if(debug){
569
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
570
" port %d\n", name, host_name, ip, port);
757
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
758
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
759
ip, (intmax_t)interface, port);
571
760
}
572
int ret = start_mandos_communication(ip, port, interface);
573
if (ret == 0){
574
exit(EXIT_SUCCESS);
761
int ret = start_mandos_communication(ip, port, interface, mc);
762
if(ret == 0){
763
avahi_simple_poll_quit(mc->simple_poll);
575
764
}
576
765
}
577
766
}
578
767
avahi_s_service_resolver_free(r);
579
768
}
580
769
581
static void browse_callback(
582
AvahiSServiceBrowser *b,
583
AvahiIfIndex interface,
584
AvahiProtocol protocol,
585
AvahiBrowserEvent event,
586
const char *name,
587
const char *type,
588
const char *domain,
589
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
590
void* userdata) {
591
592
AvahiServer *s = userdata;
593
assert(b); /* Spurious warning */
594
595
/* Called whenever a new services becomes available on the LAN or
596
is removed from the LAN */
597
598
switch (event) {
599
default:
600
case AVAHI_BROWSER_FAILURE:
601
602
fprintf(stderr, "(Browser) %s\n",
603
avahi_strerror(avahi_server_errno(server)));
604
avahi_simple_poll_quit(simple_poll);
605
return;
606
607
case AVAHI_BROWSER_NEW:
608
/* We ignore the returned resolver object. In the callback
609
function we free it. If the server is terminated before
610
the callback function is called the server will free
611
the resolver for us. */
612
613
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
614
type, domain,
615
AVAHI_PROTO_INET6, 0,
616
resolve_callback, s)))
617
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
618
avahi_strerror(avahi_server_errno(s)));
619
break;
620
621
case AVAHI_BROWSER_REMOVE:
622
break;
623
624
case AVAHI_BROWSER_ALL_FOR_NOW:
625
case AVAHI_BROWSER_CACHE_EXHAUSTED:
626
break;
770
static void browse_callback( AvahiSServiceBrowser *b,
771
AvahiIfIndex interface,
772
AvahiProtocol protocol,
773
AvahiBrowserEvent event,
774
const char *name,
775
const char *type,
776
const char *domain,
777
AVAHI_GCC_UNUSED AvahiLookupResultFlags
778
flags,
779
void* userdata) {
780
mandos_context *mc = userdata;
781
assert(b);
782
783
/* Called whenever a new services becomes available on the LAN or
784
is removed from the LAN */
785
786
switch(event) {
787
default:
788
case AVAHI_BROWSER_FAILURE:
789
790
fprintf(stderr, "(Avahi browser) %s\n",
791
avahi_strerror(avahi_server_errno(mc->server)));
792
avahi_simple_poll_quit(mc->simple_poll);
793
return;
794
795
case AVAHI_BROWSER_NEW:
796
/* We ignore the returned Avahi resolver object. In the callback
797
function we free it. If the Avahi server is terminated before
798
the callback function is called the Avahi server will free the
799
resolver for us. */
800
801
if(!(avahi_s_service_resolver_new(mc->server, interface,
802
protocol, name, type, domain,
803
AVAHI_PROTO_INET6, 0,
804
resolve_callback, mc)))
805
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
806
name, avahi_strerror(avahi_server_errno(mc->server)));
807
break;
808
809
case AVAHI_BROWSER_REMOVE:
810
break;
811
812
case AVAHI_BROWSER_ALL_FOR_NOW:
813
case AVAHI_BROWSER_CACHE_EXHAUSTED:
814
if(debug){
815
fprintf(stderr, "No Mandos server found, still searching...\n");
627
816
}
628
}
629
630
/* combinds file name and path and returns the malloced new string. som sane checks could/should be added */
631
const char *combinepath(const char *first, const char *second){
632
char *tmp;
633
tmp = malloc(strlen(first) + strlen(second) + 2);
634
if (tmp == NULL){
635
perror("malloc");
636
return NULL;
637
}
638
strcpy(tmp, first);
639
if (first[0] != '\0' and first[strlen(first) - 1] != '/'){
640
strcat(tmp, "/");
641
}
642
strcat(tmp, second);
643
return tmp;
644
}
645
646
647
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
648
AvahiServerConfig config;
817
break;
818
}
819
}
820
821
int main(int argc, char *argv[]){
649
822
AvahiSServiceBrowser *sb = NULL;
650
823
int error;
651
824
int ret;
652
int returncode = EXIT_SUCCESS;
653
const char *interface = NULL;
825
intmax_t tmpmax;
826
int numchars;
827
int exitcode = EXIT_SUCCESS;
828
const char *interface = "eth0";
829
struct ifreq network;
830
int sd;
831
uid_t uid;
832
gid_t gid;
833
char *connect_to = NULL;
834
char tempdir[] = "/tmp/mandosXXXXXX";
835
bool tempdir_created = false;
654
836
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
655
char *connect_to = NULL;
656
657
while (true){
658
static struct option long_options[] = {
659
{"debug", no_argument, (int *)&debug, 1},
660
{"connect", required_argument, 0, 'C'},
661
{"interface", required_argument, 0, 'i'},
662
{"certdir", required_argument, 0, 'd'},
663
{"certkey", required_argument, 0, 'c'},
664
{"certfile", required_argument, 0, 'k'},
665
{0, 0, 0, 0} };
666
667
int option_index = 0;
668
ret = getopt_long (argc, argv, "i:", long_options,
669
&option_index);
670
671
if (ret == -1){
672
break;
673
}
674
675
switch(ret){
676
case 0:
677
break;
678
case 'i':
679
interface = optarg;
680
break;
681
case 'C':
682
connect_to = optarg;
683
break;
684
case 'd':
685
certdir = optarg;
686
break;
687
case 'c':
688
certfile = optarg;
689
break;
690
case 'k':
691
certkey = optarg;
692
break;
693
default:
694
exit(EXIT_FAILURE);
695
}
696
}
697
698
certfile = combinepath(certdir, certfile);
699
if (certfile == NULL){
700
goto exit;
701
}
702
703
if(interface != NULL){
704
if_index = (AvahiIfIndex) if_nametoindex(interface);
705
if(if_index == 0){
706
fprintf(stderr, "No such interface: \"%s\"\n", interface);
707
exit(EXIT_FAILURE);
708
}
837
const char *seckey = PATHDIR "/" SECKEY;
838
const char *pubkey = PATHDIR "/" PUBKEY;
839
840
mandos_context mc = { .simple_poll = NULL, .server = NULL,
841
.dh_bits = 1024, .priority = "SECURE256"
842
":!CTYPE-X.509:+CTYPE-OPENPGP" };
843
bool gnutls_initialized = false;
844
bool gpgme_initialized = false;
845
846
{
847
struct argp_option options[] = {
848
{ .name = "debug", .key = 128,
849
.doc = "Debug mode", .group = 3 },
850
{ .name = "connect", .key = 'c',
851
.arg = "ADDRESS:PORT",
852
.doc = "Connect directly to a specific Mandos server",
853
.group = 1 },
854
{ .name = "interface", .key = 'i',
855
.arg = "NAME",
856
.doc = "Interface that will be used to search for Mandos"
857
" servers",
858
.group = 1 },
859
{ .name = "seckey", .key = 's',
860
.arg = "FILE",
861
.doc = "OpenPGP secret key file base name",
862
.group = 1 },
863
{ .name = "pubkey", .key = 'p',
864
.arg = "FILE",
865
.doc = "OpenPGP public key file base name",
866
.group = 2 },
867
{ .name = "dh-bits", .key = 129,
868
.arg = "BITS",
869
.doc = "Bit length of the prime number used in the"
870
" Diffie-Hellman key exchange",
871
.group = 2 },
872
{ .name = "priority", .key = 130,
873
.arg = "STRING",
874
.doc = "GnuTLS priority string for the TLS handshake",
875
.group = 1 },
876
{ .name = NULL }
877
};
878
879
error_t parse_opt(int key, char *arg,
880
struct argp_state *state) {
881
switch(key) {
882
case 128: /* --debug */
883
debug = true;
884
break;
885
case 'c': /* --connect */
886
connect_to = arg;
887
break;
888
case 'i': /* --interface */
889
interface = arg;
890
break;
891
case 's': /* --seckey */
892
seckey = arg;
893
break;
894
case 'p': /* --pubkey */
895
pubkey = arg;
896
break;
897
case 129: /* --dh-bits */
898
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
899
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
900
or arg[numchars] != '\0'){
901
fprintf(stderr, "Bad number of DH bits\n");
902
exit(EXIT_FAILURE);
903
}
904
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
905
break;
906
case 130: /* --priority */
907
mc.priority = arg;
908
break;
909
case ARGP_KEY_ARG:
910
argp_usage(state);
911
case ARGP_KEY_END:
912
break;
913
default:
914
return ARGP_ERR_UNKNOWN;
915
}
916
return 0;
917
}
918
919
struct argp argp = { .options = options, .parser = parse_opt,
920
.args_doc = "",
921
.doc = "Mandos client -- Get and decrypt"
922
" passwords from a Mandos server" };
923
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
924
if(ret == ARGP_ERR_UNKNOWN){
925
fprintf(stderr, "Unknown error while parsing arguments\n");
926
exitcode = EXIT_FAILURE;
927
goto end;
928
}
929
}
930
931
/* If the interface is down, bring it up */
932
{
933
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
934
if(sd < 0) {
935
perror("socket");
936
exitcode = EXIT_FAILURE;
937
goto end;
938
}
939
strcpy(network.ifr_name, interface);
940
ret = ioctl(sd, SIOCGIFFLAGS, &network);
941
if(ret == -1){
942
perror("ioctl SIOCGIFFLAGS");
943
exitcode = EXIT_FAILURE;
944
goto end;
945
}
946
if((network.ifr_flags & IFF_UP) == 0){
947
network.ifr_flags |= IFF_UP;
948
ret = ioctl(sd, SIOCSIFFLAGS, &network);
949
if(ret == -1){
950
perror("ioctl SIOCSIFFLAGS");
951
exitcode = EXIT_FAILURE;
952
goto end;
953
}
954
}
955
ret = (int)TEMP_FAILURE_RETRY(close(sd));
956
if(ret == -1){
957
perror("close");
958
}
959
}
960
961
uid = getuid();
962
gid = getgid();
963
964
setgid(gid);
965
if(ret == -1){
966
perror("setgid");
967
}
968
969
ret = setuid(uid);
970
if(ret == -1){
971
perror("setuid");
972
}
973
974
ret = init_gnutls_global(&mc, pubkey, seckey);
975
if(ret == -1){
976
fprintf(stderr, "init_gnutls_global failed\n");
977
exitcode = EXIT_FAILURE;
978
goto end;
979
} else {
980
gnutls_initialized = true;
981
}
982
983
if(mkdtemp(tempdir) == NULL){
984
perror("mkdtemp");
985
goto end;
986
}
987
tempdir_created = true;
988
989
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
990
fprintf(stderr, "init_gpgme failed\n");
991
exitcode = EXIT_FAILURE;
992
goto end;
993
} else {
994
gpgme_initialized = true;
995
}
996
997
if_index = (AvahiIfIndex) if_nametoindex(interface);
998
if(if_index == 0){
999
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1000
exitcode = EXIT_FAILURE;
1001
goto end;
709
1002
}
710
1003
711
1004
if(connect_to != NULL){
714
1007
char *address = strrchr(connect_to, ':');
715
1008
if(address == NULL){
716
1009
fprintf(stderr, "No colon in address\n");
717
exit(EXIT_FAILURE);
718
}
719
errno = 0;
720
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
721
if(errno){
722
perror("Bad port number");
723
exit(EXIT_FAILURE);
724
}
1010
exitcode = EXIT_FAILURE;
1011
goto end;
1012
}
1013
uint16_t port;
1014
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1015
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1016
or address[numchars+1] != '\0'){
1017
fprintf(stderr, "Bad port number\n");
1018
exitcode = EXIT_FAILURE;
1019
goto end;
1020
}
1021
port = (uint16_t)tmpmax;
725
1022
*address = '\0';
726
1023
address = connect_to;
727
ret = start_mandos_communication(address, port, if_index);
1024
ret = start_mandos_communication(address, port, if_index, &mc);
728
1025
if(ret < 0){
729
exit(EXIT_FAILURE);
1026
exitcode = EXIT_FAILURE;
730
1027
} else {
731
exit(EXIT_SUCCESS);
1028
exitcode = EXIT_SUCCESS;
732
1029
}
733
}
734
735
certkey = combinepath(certdir, certkey);
736
if (certkey == NULL){
737
goto exit;
738
}
739
740
if (not debug){
1030
goto end;
1031
}
1032
1033
if(not debug){
741
1034
avahi_set_log_function(empty_log);
742
1035
}
743
1036
744
/* Initialize the psuedo-RNG */
1037
/* Initialize the pseudo-RNG for Avahi */
745
1038
srand((unsigned int) time(NULL));
746
747
/* Allocate main loop object */
748
if (!(simple_poll = avahi_simple_poll_new())) {
749
fprintf(stderr, "Failed to create simple poll object.\n");
750
751
goto exit;
752
}
753
754
/* Do not publish any local records */
755
avahi_server_config_init(&config);
756
config.publish_hinfo = 0;
757
config.publish_addresses = 0;
758
config.publish_workstation = 0;
759
config.publish_domain = 0;
760
761
/* Allocate a new server */
762
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
763
&config, NULL, NULL, &error);
764
765
/* Free the configuration data */
766
avahi_server_config_free(&config);
767
768
/* Check if creating the server object succeeded */
769
if (!server) {
770
fprintf(stderr, "Failed to create server: %s\n",
1039
1040
/* Allocate main Avahi loop object */
1041
mc.simple_poll = avahi_simple_poll_new();
1042
if(mc.simple_poll == NULL) {
1043
fprintf(stderr, "Avahi: Failed to create simple poll"
1044
" object.\n");
1045
exitcode = EXIT_FAILURE;
1046
goto end;
1047
}
1048
1049
{
1050
AvahiServerConfig config;
1051
/* Do not publish any local Zeroconf records */
1052
avahi_server_config_init(&config);
1053
config.publish_hinfo = 0;
1054
config.publish_addresses = 0;
1055
config.publish_workstation = 0;
1056
config.publish_domain = 0;
1057
1058
/* Allocate a new server */
1059
mc.server = avahi_server_new(avahi_simple_poll_get
1060
(mc.simple_poll), &config, NULL,
1061
NULL, &error);
1062
1063
/* Free the Avahi configuration data */
1064
avahi_server_config_free(&config);
1065
}
1066
1067
/* Check if creating the Avahi server object succeeded */
1068
if(mc.server == NULL) {
1069
fprintf(stderr, "Failed to create Avahi server: %s\n",
771
1070
avahi_strerror(error));
772
returncode = EXIT_FAILURE;
773
goto exit;
1071
exitcode = EXIT_FAILURE;
1072
goto end;
774
1073
}
775
1074
776
/* Create the service browser */
777
sb = avahi_s_service_browser_new(server, if_index,
1075
/* Create the Avahi service browser */
1076
sb = avahi_s_service_browser_new(mc.server, if_index,
778
1077
AVAHI_PROTO_INET6,
779
1078
"_mandos._tcp", NULL, 0,
780
browse_callback, server);
781
if (!sb) {
1079
browse_callback, &mc);
1080
if(sb == NULL) {
782
1081
fprintf(stderr, "Failed to create service browser: %s\n",
783
avahi_strerror(avahi_server_errno(server)));
784
returncode = EXIT_FAILURE;
785
goto exit;
1082
avahi_strerror(avahi_server_errno(mc.server)));
1083
exitcode = EXIT_FAILURE;
1084
goto end;
786
1085
}
787
1086
788
1087
/* Run the main loop */
789
790
if (debug){
791
fprintf(stderr, "Starting avahi loop search\n");
1088
1089
if(debug){
1090
fprintf(stderr, "Starting Avahi loop search\n");
792
1091
}
793
1092
794
avahi_simple_poll_loop(simple_poll);
795
796
exit:
797
798
if (debug){
1093
avahi_simple_poll_loop(mc.simple_poll);
1094
1095
end:
1096
1097
if(debug){
799
1098
fprintf(stderr, "%s exiting\n", argv[0]);
800
1099
}
801
1100
802
1101
/* Cleanup things */
803
if (sb)
1102
if(sb != NULL)
804
1103
avahi_s_service_browser_free(sb);
805
1104
806
if (server)
807
avahi_server_free(server);
808
809
if (simple_poll)
810
avahi_simple_poll_free(simple_poll);
811
free(certfile);
812
free(certkey);
813
814
return returncode;
1105
if(mc.server != NULL)
1106
avahi_server_free(mc.server);
1107
1108
if(mc.simple_poll != NULL)
1109
avahi_simple_poll_free(mc.simple_poll);
1110
1111
if(gnutls_initialized){
1112
gnutls_certificate_free_credentials(mc.cred);
1113
gnutls_global_deinit();
1114
gnutls_dh_params_deinit(mc.dh_params);
1115
}
1116
1117
if(gpgme_initialized){
1118
gpgme_release(mc.ctx);
1119
}
1120
1121
/* Removes the temp directory used by GPGME */
1122
if(tempdir_created){
1123
DIR *d;
1124
struct dirent *direntry;
1125
d = opendir(tempdir);
1126
if(d == NULL){
1127
if(errno != ENOENT){
1128
perror("opendir");
1129
}
1130
} else {
1131
while(true){
1132
direntry = readdir(d);
1133
if(direntry == NULL){
1134
break;
1135
}
1136
/* Skip "." and ".." */
1137
if(direntry->d_name[0] == '.'
1138
and (direntry->d_name[1] == '\0'
1139
or (direntry->d_name[1] == '.'
1140
and direntry->d_name[2] == '\0'))){
1141
continue;
1142
}
1143
char *fullname = NULL;
1144
ret = asprintf(&fullname, "%s/%s", tempdir,
1145
direntry->d_name);
1146
if(ret < 0){
1147
perror("asprintf");
1148
continue;
1149
}
1150
ret = remove(fullname);
1151
if(ret == -1){
1152
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1153
strerror(errno));
1154
}
1155
free(fullname);
1156
}
1157
closedir(d);
1158
}
1159
ret = rmdir(tempdir);
1160
if(ret == -1 and errno != ENOENT){
1161
perror("rmdir");
1162
}
1163
}
1164
1165
return exitcode;
815
1166
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0