To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 302
- compare with another revision
- download diff
- download tarball
- view history from revision 302
- Committer: Teddy Hogeborn
- Date: 2009-02-07 04:50:39 UTC
- Revision ID: teddy@fukt.bsnet.se-20090207045039-xkr6b80vtqwqrq8l
* Makefile (install-client-nokey): Move "initramfs-tools-script" from
"/scripts/local-top/mandos" to
"/scripts/init-premount/mandos".
(uninstall-client): - '' -
* debian/mandos-client.dirs: - '' -
* initramfs-tools-script (PREREQ): Added "udev".
"/scripts/local-top/mandos" to
"/scripts/init-premount/mandos".
(uninstall-client): - '' -
* debian/mandos-client.dirs: - '' -
* initramfs-tools-script (PREREQ): Added "udev".
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
32
33
#define _LARGEFILE_SOURCE
33
34
#define _FILE_OFFSET_BITS 64
34
35
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
40
remove() */
41
#include <stdint.h> /* uint16_t, uint32_t */
42
#include <stddef.h> /* NULL, size_t, ssize_t */
43
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
44
srand() */
45
#include <stdbool.h> /* bool, true */
46
#include <string.h> /* memset(), strcmp(), strlen(),
47
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, INET6_ADDRSTRLEN,
52
uid_t, gid_t, open(), opendir(),
53
DIR */
54
#include <sys/stat.h> /* open() */
55
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
56
struct in6_addr, inet_pton(),
57
connect() */
58
#include <fcntl.h> /* open() */
59
#include <dirent.h> /* opendir(), struct dirent, readdir()
60
*/
61
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
62
#include <assert.h> /* assert() */
63
#include <errno.h> /* perror(), errno */
64
#include <time.h> /* nanosleep(), time() */
65
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
66
SIOCSIFFLAGS, if_indextoname(),
67
if_nametoindex(), IF_NAMESIZE */
68
#include <netinet/in.h>
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
getuid(), getgid(), setuid(),
71
setgid() */
72
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, and, or */
74
#include <argp.h> /* struct argp_option, error_t, struct
75
argp_state, struct argp,
76
argp_parse(), ARGP_KEY_ARG,
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
#ifdef __linux__
79
#include <sys/klog.h> /* klogctl() */
80
#endif
81
82
/* Avahi */
83
/* All Avahi types, constants and functions
84
Avahi*, avahi_*,
85
AVAHI_* */
41
86
#include <avahi-core/core.h>
42
87
#include <avahi-core/lookup.h>
43
88
#include <avahi-core/log.h>
45
90
#include <avahi-common/malloc.h>
46
91
#include <avahi-common/error.h>
47
92
48
//mandos client part
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
// getopt long
67
#include <getopt.h>
93
/* GnuTLS */
94
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
95
functions:
96
gnutls_*
97
init_gnutls_session(),
98
GNUTLS_* */
99
#include <gnutls/openpgp.h>
100
/* gnutls_certificate_set_openpgp_key_file(),
101
GNUTLS_OPENPGP_FMT_BASE64 */
102
103
/* GPGME */
104
#include <gpgme.h> /* All GPGME types, constants and
105
functions:
106
gpgme_*
107
GPGME_PROTOCOL_OpenPGP,
108
GPG_ERR_NO_* */
68
109
69
110
#define BUFFER_SIZE 256
70
#define DH_BITS 1024
71
111
72
static const char *certdir = "/conf/conf.d/mandos";
73
static const char *certfile = "openpgp-client.txt";
74
static const char *certkey = "openpgp-client-key.txt";
112
#define PATHDIR "/conf/conf.d/mandos"
113
#define SECKEY "seckey.txt"
114
#define PUBKEY "pubkey.txt"
75
115
76
116
bool debug = false;
117
static const char mandos_protocol_version[] = "1";
118
const char *argp_program_version = "mandos-client " VERSION;
119
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
77
120
121
/* Used for passing in values through the Avahi callback functions */
78
122
typedef struct {
79
gnutls_session_t session;
123
AvahiSimplePoll *simple_poll;
124
AvahiServer *server;
80
125
gnutls_certificate_credentials_t cred;
126
unsigned int dh_bits;
81
127
gnutls_dh_params_t dh_params;
82
} encrypted_session;
83
84
85
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
86
char **new_packet,
87
const char *homedir){
88
gpgme_data_t dh_crypto, dh_plain;
128
const char *priority;
89
129
gpgme_ctx_t ctx;
130
} mandos_context;
131
132
/*
133
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
134
* "buffer_capacity" is how much is currently allocated,
135
* "buffer_length" is how much is already used.
136
*/
137
size_t adjustbuffer(char **buffer, size_t buffer_length,
138
size_t buffer_capacity){
139
if(buffer_length + BUFFER_SIZE > buffer_capacity){
140
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
141
if(buffer == NULL){
142
return 0;
143
}
144
buffer_capacity += BUFFER_SIZE;
145
}
146
return buffer_capacity;
147
}
148
149
/*
150
* Initialize GPGME.
151
*/
152
static bool init_gpgme(mandos_context *mc, const char *seckey,
153
const char *pubkey, const char *tempdir){
154
int ret;
90
155
gpgme_error_t rc;
91
ssize_t ret;
92
ssize_t new_packet_capacity = 0;
93
ssize_t new_packet_length = 0;
94
156
gpgme_engine_info_t engine_info;
95
96
if (debug){
97
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
157
158
159
/*
160
* Helper function to insert pub and seckey to the engine keyring.
161
*/
162
bool import_key(const char *filename){
163
int fd;
164
gpgme_data_t pgp_data;
165
166
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
167
if(fd == -1){
168
perror("open");
169
return false;
170
}
171
172
rc = gpgme_data_new_from_fd(&pgp_data, fd);
173
if(rc != GPG_ERR_NO_ERROR){
174
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
175
gpgme_strsource(rc), gpgme_strerror(rc));
176
return false;
177
}
178
179
rc = gpgme_op_import(mc->ctx, pgp_data);
180
if(rc != GPG_ERR_NO_ERROR){
181
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
182
gpgme_strsource(rc), gpgme_strerror(rc));
183
return false;
184
}
185
186
ret = (int)TEMP_FAILURE_RETRY(close(fd));
187
if(ret == -1){
188
perror("close");
189
}
190
gpgme_data_release(pgp_data);
191
return true;
192
}
193
194
if(debug){
195
fprintf(stderr, "Initialize gpgme\n");
98
196
}
99
197
100
198
/* Init GPGME */
101
199
gpgme_check_version(NULL);
102
200
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
103
if (rc != GPG_ERR_NO_ERROR){
201
if(rc != GPG_ERR_NO_ERROR){
104
202
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
105
203
gpgme_strsource(rc), gpgme_strerror(rc));
106
return -1;
204
return false;
107
205
}
108
206
109
/* Set GPGME home directory */
110
rc = gpgme_get_engine_info (&engine_info);
111
if (rc != GPG_ERR_NO_ERROR){
207
/* Set GPGME home directory for the OpenPGP engine only */
208
rc = gpgme_get_engine_info(&engine_info);
209
if(rc != GPG_ERR_NO_ERROR){
112
210
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
113
211
gpgme_strsource(rc), gpgme_strerror(rc));
114
return -1;
212
return false;
115
213
}
116
214
while(engine_info != NULL){
117
215
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
118
216
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
119
engine_info->file_name, homedir);
217
engine_info->file_name, tempdir);
120
218
break;
121
219
}
122
220
engine_info = engine_info->next;
123
221
}
124
222
if(engine_info == NULL){
125
fprintf(stderr, "Could not set home dir to %s\n", homedir);
126
return -1;
127
}
128
129
/* Create new GPGME data buffer from packet buffer */
130
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
131
if (rc != GPG_ERR_NO_ERROR){
223
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
224
return false;
225
}
226
227
/* Create new GPGME "context" */
228
rc = gpgme_new(&(mc->ctx));
229
if(rc != GPG_ERR_NO_ERROR){
230
fprintf(stderr, "bad gpgme_new: %s: %s\n",
231
gpgme_strsource(rc), gpgme_strerror(rc));
232
return false;
233
}
234
235
if(not import_key(pubkey) or not import_key(seckey)){
236
return false;
237
}
238
239
return true;
240
}
241
242
/*
243
* Decrypt OpenPGP data.
244
* Returns -1 on error
245
*/
246
static ssize_t pgp_packet_decrypt(const mandos_context *mc,
247
const char *cryptotext,
248
size_t crypto_size,
249
char **plaintext){
250
gpgme_data_t dh_crypto, dh_plain;
251
gpgme_error_t rc;
252
ssize_t ret;
253
size_t plaintext_capacity = 0;
254
ssize_t plaintext_length = 0;
255
256
if(debug){
257
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
258
}
259
260
/* Create new GPGME data buffer from memory cryptotext */
261
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
262
0);
263
if(rc != GPG_ERR_NO_ERROR){
132
264
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
133
265
gpgme_strsource(rc), gpgme_strerror(rc));
134
266
return -1;
136
268
137
269
/* Create new empty GPGME data buffer for the plaintext */
138
270
rc = gpgme_data_new(&dh_plain);
139
if (rc != GPG_ERR_NO_ERROR){
271
if(rc != GPG_ERR_NO_ERROR){
140
272
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
141
273
gpgme_strsource(rc), gpgme_strerror(rc));
142
return -1;
143
}
144
145
/* Create new GPGME "context" */
146
rc = gpgme_new(&ctx);
147
if (rc != GPG_ERR_NO_ERROR){
148
fprintf(stderr, "bad gpgme_new: %s: %s\n",
149
gpgme_strsource(rc), gpgme_strerror(rc));
150
return -1;
151
}
152
153
/* Decrypt data from the FILE pointer to the plaintext data
154
buffer */
155
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
156
if (rc != GPG_ERR_NO_ERROR){
274
gpgme_data_release(dh_crypto);
275
return -1;
276
}
277
278
/* Decrypt data from the cryptotext data buffer to the plaintext
279
data buffer */
280
rc = gpgme_op_decrypt(mc->ctx, dh_crypto, dh_plain);
281
if(rc != GPG_ERR_NO_ERROR){
157
282
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
158
283
gpgme_strsource(rc), gpgme_strerror(rc));
159
return -1;
284
plaintext_length = -1;
285
if(debug){
286
gpgme_decrypt_result_t result;
287
result = gpgme_op_decrypt_result(mc->ctx);
288
if(result == NULL){
289
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
290
} else {
291
fprintf(stderr, "Unsupported algorithm: %s\n",
292
result->unsupported_algorithm);
293
fprintf(stderr, "Wrong key usage: %u\n",
294
result->wrong_key_usage);
295
if(result->file_name != NULL){
296
fprintf(stderr, "File name: %s\n", result->file_name);
297
}
298
gpgme_recipient_t recipient;
299
recipient = result->recipients;
300
if(recipient){
301
while(recipient != NULL){
302
fprintf(stderr, "Public key algorithm: %s\n",
303
gpgme_pubkey_algo_name(recipient->pubkey_algo));
304
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
305
fprintf(stderr, "Secret key available: %s\n",
306
recipient->status == GPG_ERR_NO_SECKEY
307
? "No" : "Yes");
308
recipient = recipient->next;
309
}
310
}
311
}
312
}
313
goto decrypt_end;
160
314
}
161
315
162
316
if(debug){
163
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
164
}
165
166
if (debug){
167
gpgme_decrypt_result_t result;
168
result = gpgme_op_decrypt_result(ctx);
169
if (result == NULL){
170
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
171
} else {
172
fprintf(stderr, "Unsupported algorithm: %s\n",
173
result->unsupported_algorithm);
174
fprintf(stderr, "Wrong key usage: %d\n",
175
result->wrong_key_usage);
176
if(result->file_name != NULL){
177
fprintf(stderr, "File name: %s\n", result->file_name);
178
}
179
gpgme_recipient_t recipient;
180
recipient = result->recipients;
181
if(recipient){
182
while(recipient != NULL){
183
fprintf(stderr, "Public key algorithm: %s\n",
184
gpgme_pubkey_algo_name(recipient->pubkey_algo));
185
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
186
fprintf(stderr, "Secret key available: %s\n",
187
recipient->status == GPG_ERR_NO_SECKEY
188
? "No" : "Yes");
189
recipient = recipient->next;
190
}
191
}
192
}
193
}
194
195
/* Delete the GPGME FILE pointer cryptotext data buffer */
196
gpgme_data_release(dh_crypto);
317
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
318
}
197
319
198
320
/* Seek back to the beginning of the GPGME plaintext data buffer */
199
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
200
perror("pgpme_data_seek");
321
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
322
perror("gpgme_data_seek");
323
plaintext_length = -1;
324
goto decrypt_end;
201
325
}
202
326
203
*new_packet = 0;
327
*plaintext = NULL;
204
328
while(true){
205
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
206
*new_packet = realloc(*new_packet,
207
(unsigned int)new_packet_capacity
208
+ BUFFER_SIZE);
209
if (*new_packet == NULL){
210
perror("realloc");
211
return -1;
212
}
213
new_packet_capacity += BUFFER_SIZE;
329
plaintext_capacity = adjustbuffer(plaintext,
330
(size_t)plaintext_length,
331
plaintext_capacity);
332
if(plaintext_capacity == 0){
333
perror("adjustbuffer");
334
plaintext_length = -1;
335
goto decrypt_end;
214
336
}
215
337
216
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
338
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
217
339
BUFFER_SIZE);
218
340
/* Print the data, if any */
219
if (ret == 0){
341
if(ret == 0){
342
/* EOF */
220
343
break;
221
344
}
222
345
if(ret < 0){
223
346
perror("gpgme_data_read");
224
return -1;
225
}
226
new_packet_length += ret;
227
}
228
229
/* FIXME: check characters before printing to screen so to not print
230
terminal control characters */
231
/* if(debug){ */
232
/* fprintf(stderr, "decrypted password is: "); */
233
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
234
/* fprintf(stderr, "\n"); */
235
/* } */
347
plaintext_length = -1;
348
goto decrypt_end;
349
}
350
plaintext_length += ret;
351
}
352
353
if(debug){
354
fprintf(stderr, "Decrypted password is: ");
355
for(ssize_t i = 0; i < plaintext_length; i++){
356
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
357
}
358
fprintf(stderr, "\n");
359
}
360
361
decrypt_end:
362
363
/* Delete the GPGME cryptotext data buffer */
364
gpgme_data_release(dh_crypto);
236
365
237
366
/* Delete the GPGME plaintext data buffer */
238
367
gpgme_data_release(dh_plain);
239
return new_packet_length;
368
return plaintext_length;
240
369
}
241
370
242
static const char * safer_gnutls_strerror (int value) {
243
const char *ret = gnutls_strerror (value);
244
if (ret == NULL)
371
static const char * safer_gnutls_strerror(int value){
372
const char *ret = gnutls_strerror(value); /* Spurious warning from
373
-Wunreachable-code */
374
if(ret == NULL)
245
375
ret = "(unknown)";
246
376
return ret;
247
377
}
248
378
379
/* GnuTLS log function callback */
249
380
static void debuggnutls(__attribute__((unused)) int level,
250
381
const char* string){
251
fprintf(stderr, "%s", string);
382
fprintf(stderr, "GnuTLS: %s", string);
252
383
}
253
384
254
static int initgnutls(encrypted_session *es){
255
const char *err;
385
static int init_gnutls_global(mandos_context *mc,
386
const char *pubkeyfilename,
387
const char *seckeyfilename){
256
388
int ret;
257
389
258
390
if(debug){
259
391
fprintf(stderr, "Initializing GnuTLS\n");
260
392
}
261
262
if ((ret = gnutls_global_init ())
263
!= GNUTLS_E_SUCCESS) {
264
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
393
394
ret = gnutls_global_init();
395
if(ret != GNUTLS_E_SUCCESS){
396
fprintf(stderr, "GnuTLS global_init: %s\n",
397
safer_gnutls_strerror(ret));
265
398
return -1;
266
399
}
267
268
if (debug){
400
401
if(debug){
402
/* "Use a log level over 10 to enable all debugging options."
403
* - GnuTLS manual
404
*/
269
405
gnutls_global_set_log_level(11);
270
406
gnutls_global_set_log_function(debuggnutls);
271
407
}
272
408
273
/* openpgp credentials */
274
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
275
!= GNUTLS_E_SUCCESS) {
276
fprintf (stderr, "memory error: %s\n",
277
safer_gnutls_strerror(ret));
409
/* OpenPGP credentials */
410
gnutls_certificate_allocate_credentials(&mc->cred);
411
if(ret != GNUTLS_E_SUCCESS){
412
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
413
* from
414
* -Wunreachable-code
415
*/
416
safer_gnutls_strerror(ret));
417
gnutls_global_deinit();
278
418
return -1;
279
419
}
280
420
281
421
if(debug){
282
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
283
" and keyfile %s as GnuTLS credentials\n", certfile,
284
certkey);
422
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
423
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
424
seckeyfilename);
285
425
}
286
426
287
427
ret = gnutls_certificate_set_openpgp_key_file
288
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
289
if (ret != GNUTLS_E_SUCCESS) {
290
fprintf
291
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
292
" '%s')\n",
293
ret, certfile, certkey);
294
fprintf(stdout, "The Error is: %s\n",
295
safer_gnutls_strerror(ret));
296
return -1;
297
}
298
299
//GnuTLS server initialization
300
if ((ret = gnutls_dh_params_init (&es->dh_params))
301
!= GNUTLS_E_SUCCESS) {
302
fprintf (stderr, "Error in dh parameter initialization: %s\n",
303
safer_gnutls_strerror(ret));
304
return -1;
305
}
306
307
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
308
!= GNUTLS_E_SUCCESS) {
309
fprintf (stderr, "Error in prime generation: %s\n",
310
safer_gnutls_strerror(ret));
311
return -1;
312
}
313
314
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
315
316
// GnuTLS session creation
317
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
318
!= GNUTLS_E_SUCCESS){
428
(mc->cred, pubkeyfilename, seckeyfilename,
429
GNUTLS_OPENPGP_FMT_BASE64);
430
if(ret != GNUTLS_E_SUCCESS){
431
fprintf(stderr,
432
"Error[%d] while reading the OpenPGP key pair ('%s',"
433
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
434
fprintf(stderr, "The GnuTLS error is: %s\n",
435
safer_gnutls_strerror(ret));
436
goto globalfail;
437
}
438
439
/* GnuTLS server initialization */
440
ret = gnutls_dh_params_init(&mc->dh_params);
441
if(ret != GNUTLS_E_SUCCESS){
442
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
443
" %s\n", safer_gnutls_strerror(ret));
444
goto globalfail;
445
}
446
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
447
if(ret != GNUTLS_E_SUCCESS){
448
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
449
safer_gnutls_strerror(ret));
450
goto globalfail;
451
}
452
453
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
454
455
return 0;
456
457
globalfail:
458
459
gnutls_certificate_free_credentials(mc->cred);
460
gnutls_global_deinit();
461
gnutls_dh_params_deinit(mc->dh_params);
462
return -1;
463
}
464
465
static int init_gnutls_session(mandos_context *mc,
466
gnutls_session_t *session){
467
int ret;
468
/* GnuTLS session creation */
469
ret = gnutls_init(session, GNUTLS_SERVER);
470
if(ret != GNUTLS_E_SUCCESS){
319
471
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
320
472
safer_gnutls_strerror(ret));
321
473
}
322
474
323
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
324
!= GNUTLS_E_SUCCESS) {
325
fprintf(stderr, "Syntax error at: %s\n", err);
326
fprintf(stderr, "GnuTLS error: %s\n",
327
safer_gnutls_strerror(ret));
328
return -1;
475
{
476
const char *err;
477
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
478
if(ret != GNUTLS_E_SUCCESS){
479
fprintf(stderr, "Syntax error at: %s\n", err);
480
fprintf(stderr, "GnuTLS error: %s\n",
481
safer_gnutls_strerror(ret));
482
gnutls_deinit(*session);
483
return -1;
484
}
329
485
}
330
486
331
if ((ret = gnutls_credentials_set
332
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
333
!= GNUTLS_E_SUCCESS) {
334
fprintf(stderr, "Error setting a credentials set: %s\n",
487
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
488
mc->cred);
489
if(ret != GNUTLS_E_SUCCESS){
490
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
335
491
safer_gnutls_strerror(ret));
492
gnutls_deinit(*session);
336
493
return -1;
337
494
}
338
495
339
496
/* ignore client certificate if any. */
340
gnutls_certificate_server_set_request (es->session,
341
GNUTLS_CERT_IGNORE);
497
gnutls_certificate_server_set_request(*session,
498
GNUTLS_CERT_IGNORE);
342
499
343
gnutls_dh_set_prime_bits (es->session, DH_BITS);
500
gnutls_dh_set_prime_bits(*session, mc->dh_bits);
344
501
345
502
return 0;
346
503
}
347
504
505
/* Avahi log function callback */
348
506
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
349
507
__attribute__((unused)) const char *txt){}
350
508
509
/* Called when a Mandos server is found */
351
510
static int start_mandos_communication(const char *ip, uint16_t port,
352
AvahiIfIndex if_index){
511
AvahiIfIndex if_index,
512
mandos_context *mc){
353
513
int ret, tcp_sd;
354
struct sockaddr_in6 to;
355
encrypted_session es;
514
ssize_t sret;
515
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
356
516
char *buffer = NULL;
357
517
char *decrypted_buffer;
358
518
size_t buffer_length = 0;
359
519
size_t buffer_capacity = 0;
360
520
ssize_t decrypted_buffer_size;
361
size_t written = 0;
521
size_t written;
362
522
int retval = 0;
363
523
char interface[IF_NAMESIZE];
524
gnutls_session_t session;
525
526
ret = init_gnutls_session(mc, &session);
527
if(ret != 0){
528
return -1;
529
}
364
530
365
531
if(debug){
366
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
367
ip, port);
532
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
533
"\n", ip, port);
368
534
}
369
535
370
536
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
371
if(tcp_sd < 0) {
537
if(tcp_sd < 0){
372
538
perror("socket");
373
539
return -1;
374
540
}
375
541
376
if(if_indextoname((unsigned int)if_index, interface) == NULL){
377
if(debug){
542
if(debug){
543
if(if_indextoname((unsigned int)if_index, interface) == NULL){
378
544
perror("if_indextoname");
545
return -1;
379
546
}
380
return -1;
381
}
382
383
if(debug){
384
547
fprintf(stderr, "Binding to interface %s\n", interface);
385
548
}
386
549
387
memset(&to,0,sizeof(to)); /* Spurious warning */
388
to.sin6_family = AF_INET6;
389
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
390
if (ret < 0 ){
550
memset(&to, 0, sizeof(to));
551
to.in6.sin6_family = AF_INET6;
552
/* It would be nice to have a way to detect if we were passed an
553
IPv4 address here. Now we assume an IPv6 address. */
554
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
555
if(ret < 0 ){
391
556
perror("inet_pton");
392
557
return -1;
393
}
558
}
394
559
if(ret == 0){
395
560
fprintf(stderr, "Bad address: %s\n", ip);
396
561
return -1;
397
562
}
398
to.sin6_port = htons(port); /* Spurious warning */
563
to.in6.sin6_port = htons(port); /* Spurious warnings from
564
-Wconversion and
565
-Wunreachable-code */
399
566
400
to.sin6_scope_id = (uint32_t)if_index;
567
to.in6.sin6_scope_id = (uint32_t)if_index;
401
568
402
569
if(debug){
403
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
404
/* char addrstr[INET6_ADDRSTRLEN]; */
405
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
406
/* sizeof(addrstr)) == NULL){ */
407
/* perror("inet_ntop"); */
408
/* } else { */
409
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
410
/* addrstr, ntohs(to.sin6_port)); */
411
/* } */
570
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
571
port);
572
char addrstr[INET6_ADDRSTRLEN] = "";
573
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
574
sizeof(addrstr)) == NULL){
575
perror("inet_ntop");
576
} else {
577
if(strcmp(addrstr, ip) != 0){
578
fprintf(stderr, "Canonical address form: %s\n", addrstr);
579
}
580
}
412
581
}
413
582
414
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
415
if (ret < 0){
583
ret = connect(tcp_sd, &to.in, sizeof(to));
584
if(ret < 0){
416
585
perror("connect");
417
586
return -1;
418
587
}
419
588
420
ret = initgnutls (&es);
421
if (ret != 0){
422
retval = -1;
423
return -1;
589
const char *out = mandos_protocol_version;
590
written = 0;
591
while(true){
592
size_t out_size = strlen(out);
593
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
594
out_size - written));
595
if(ret == -1){
596
perror("write");
597
retval = -1;
598
goto mandos_end;
599
}
600
written += (size_t)ret;
601
if(written < out_size){
602
continue;
603
} else {
604
if(out == mandos_protocol_version){
605
written = 0;
606
out = "\r\n";
607
} else {
608
break;
609
}
610
}
424
611
}
425
612
426
gnutls_transport_set_ptr (es.session,
427
(gnutls_transport_ptr_t) tcp_sd);
428
429
613
if(debug){
430
614
fprintf(stderr, "Establishing TLS session with %s\n", ip);
431
615
}
432
616
433
ret = gnutls_handshake (es.session);
434
435
if (ret != GNUTLS_E_SUCCESS){
617
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
618
619
do{
620
ret = gnutls_handshake(session);
621
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
622
623
if(ret != GNUTLS_E_SUCCESS){
436
624
if(debug){
437
fprintf(stderr, "\n*** Handshake failed ***\n");
438
gnutls_perror (ret);
625
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
626
gnutls_perror(ret);
439
627
}
440
628
retval = -1;
441
goto exit;
629
goto mandos_end;
442
630
}
443
631
444
//Retrieve OpenPGP packet that contains the wanted password
632
/* Read OpenPGP packet that contains the wanted password */
445
633
446
634
if(debug){
447
635
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
448
636
ip);
449
637
}
450
638
451
639
while(true){
452
if (buffer_length + BUFFER_SIZE > buffer_capacity){
453
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
454
if (buffer == NULL){
455
perror("realloc");
456
goto exit;
457
}
458
buffer_capacity += BUFFER_SIZE;
640
buffer_capacity = adjustbuffer(&buffer, buffer_length,
641
buffer_capacity);
642
if(buffer_capacity == 0){
643
perror("adjustbuffer");
644
retval = -1;
645
goto mandos_end;
459
646
}
460
647
461
ret = gnutls_record_recv
462
(es.session, buffer+buffer_length, BUFFER_SIZE);
463
if (ret == 0){
648
sret = gnutls_record_recv(session, buffer+buffer_length,
649
BUFFER_SIZE);
650
if(sret == 0){
464
651
break;
465
652
}
466
if (ret < 0){
467
switch(ret){
653
if(sret < 0){
654
switch(sret){
468
655
case GNUTLS_E_INTERRUPTED:
469
656
case GNUTLS_E_AGAIN:
470
657
break;
471
658
case GNUTLS_E_REHANDSHAKE:
472
ret = gnutls_handshake (es.session);
473
if (ret < 0){
474
fprintf(stderr, "\n*** Handshake failed ***\n");
475
gnutls_perror (ret);
659
do{
660
ret = gnutls_handshake(session);
661
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
662
if(ret < 0){
663
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
664
gnutls_perror(ret);
476
665
retval = -1;
477
goto exit;
666
goto mandos_end;
478
667
}
479
668
break;
480
669
default:
481
670
fprintf(stderr, "Unknown error while reading data from"
482
" encrypted session with mandos server\n");
671
" encrypted session with Mandos server\n");
483
672
retval = -1;
484
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
485
goto exit;
673
gnutls_bye(session, GNUTLS_SHUT_RDWR);
674
goto mandos_end;
486
675
}
487
676
} else {
488
buffer_length += (size_t) ret;
677
buffer_length += (size_t) sret;
489
678
}
490
679
}
491
680
492
if (buffer_length > 0){
493
decrypted_buffer_size = pgp_packet_decrypt(buffer,
681
if(debug){
682
fprintf(stderr, "Closing TLS session\n");
683
}
684
685
gnutls_bye(session, GNUTLS_SHUT_RDWR);
686
687
if(buffer_length > 0){
688
decrypted_buffer_size = pgp_packet_decrypt(mc, buffer,
494
689
buffer_length,
495
&decrypted_buffer,
496
certdir);
497
if (decrypted_buffer_size >= 0){
690
&decrypted_buffer);
691
if(decrypted_buffer_size >= 0){
692
written = 0;
498
693
while(written < (size_t) decrypted_buffer_size){
499
ret = (int)fwrite (decrypted_buffer + written, 1,
500
(size_t)decrypted_buffer_size - written,
501
stdout);
694
ret = (int)fwrite(decrypted_buffer + written, 1,
695
(size_t)decrypted_buffer_size - written,
696
stdout);
502
697
if(ret == 0 and ferror(stdout)){
503
698
if(debug){
504
699
fprintf(stderr, "Error writing encrypted data: %s\n",
513
708
} else {
514
709
retval = -1;
515
710
}
516
}
517
518
//shutdown procedure
519
520
if(debug){
521
fprintf(stderr, "Closing TLS session\n");
522
}
523
711
} else {
712
retval = -1;
713
}
714
715
/* Shutdown procedure */
716
717
mandos_end:
524
718
free(buffer);
525
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
526
exit:
527
close(tcp_sd);
528
gnutls_deinit (es.session);
529
gnutls_certificate_free_credentials (es.cred);
530
gnutls_global_deinit ();
719
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
720
if(ret == -1){
721
perror("close");
722
}
723
gnutls_deinit(session);
531
724
return retval;
532
725
}
533
726
534
static AvahiSimplePoll *simple_poll = NULL;
535
static AvahiServer *server = NULL;
536
537
static void resolve_callback(
538
AvahiSServiceResolver *r,
539
AvahiIfIndex interface,
540
AVAHI_GCC_UNUSED AvahiProtocol protocol,
541
AvahiResolverEvent event,
542
const char *name,
543
const char *type,
544
const char *domain,
545
const char *host_name,
546
const AvahiAddress *address,
547
uint16_t port,
548
AVAHI_GCC_UNUSED AvahiStringList *txt,
549
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
550
AVAHI_GCC_UNUSED void* userdata) {
551
552
assert(r); /* Spurious warning */
727
static void resolve_callback(AvahiSServiceResolver *r,
728
AvahiIfIndex interface,
729
AVAHI_GCC_UNUSED AvahiProtocol protocol,
730
AvahiResolverEvent event,
731
const char *name,
732
const char *type,
733
const char *domain,
734
const char *host_name,
735
const AvahiAddress *address,
736
uint16_t port,
737
AVAHI_GCC_UNUSED AvahiStringList *txt,
738
AVAHI_GCC_UNUSED AvahiLookupResultFlags
739
flags,
740
void* userdata){
741
mandos_context *mc = userdata;
742
assert(r);
553
743
554
744
/* Called whenever a service has been resolved successfully or
555
745
timed out */
556
746
557
switch (event) {
747
switch(event){
558
748
default:
559
749
case AVAHI_RESOLVER_FAILURE:
560
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
561
" type '%s' in domain '%s': %s\n", name, type, domain,
562
avahi_strerror(avahi_server_errno(server)));
750
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
751
" of type '%s' in domain '%s': %s\n", name, type, domain,
752
avahi_strerror(avahi_server_errno(mc->server)));
563
753
break;
564
754
565
755
case AVAHI_RESOLVER_FOUND:
567
757
char ip[AVAHI_ADDRESS_STR_MAX];
568
758
avahi_address_snprint(ip, sizeof(ip), address);
569
759
if(debug){
570
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
571
" port %d\n", name, host_name, ip, port);
760
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
761
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
762
ip, (intmax_t)interface, port);
572
763
}
573
int ret = start_mandos_communication(ip, port, interface);
574
if (ret == 0){
575
exit(EXIT_SUCCESS);
764
int ret = start_mandos_communication(ip, port, interface, mc);
765
if(ret == 0){
766
avahi_simple_poll_quit(mc->simple_poll);
576
767
}
577
768
}
578
769
}
579
770
avahi_s_service_resolver_free(r);
580
771
}
581
772
582
static void browse_callback(
583
AvahiSServiceBrowser *b,
584
AvahiIfIndex interface,
585
AvahiProtocol protocol,
586
AvahiBrowserEvent event,
587
const char *name,
588
const char *type,
589
const char *domain,
590
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
591
void* userdata) {
592
593
AvahiServer *s = userdata;
594
assert(b); /* Spurious warning */
595
596
/* Called whenever a new services becomes available on the LAN or
597
is removed from the LAN */
598
599
switch (event) {
600
default:
601
case AVAHI_BROWSER_FAILURE:
602
603
fprintf(stderr, "(Browser) %s\n",
604
avahi_strerror(avahi_server_errno(server)));
605
avahi_simple_poll_quit(simple_poll);
606
return;
607
608
case AVAHI_BROWSER_NEW:
609
/* We ignore the returned resolver object. In the callback
610
function we free it. If the server is terminated before
611
the callback function is called the server will free
612
the resolver for us. */
613
614
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
615
type, domain,
616
AVAHI_PROTO_INET6, 0,
617
resolve_callback, s)))
618
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
619
avahi_strerror(avahi_server_errno(s)));
620
break;
621
622
case AVAHI_BROWSER_REMOVE:
623
break;
624
625
case AVAHI_BROWSER_ALL_FOR_NOW:
626
case AVAHI_BROWSER_CACHE_EXHAUSTED:
627
break;
628
}
629
}
630
631
/* Combines file name and path and returns the malloced new
632
string. some sane checks could/should be added */
633
static const char *combinepath(const char *first, const char *second){
634
size_t f_len = strlen(first);
635
size_t s_len = strlen(second);
636
char *tmp = malloc(f_len + s_len + 2);
637
if (tmp == NULL){
638
return NULL;
639
}
640
if(f_len > 0){
641
memcpy(tmp, first, f_len);
642
}
643
tmp[f_len] = '/';
644
if(s_len > 0){
645
memcpy(tmp + f_len + 1, second, s_len);
646
}
647
tmp[f_len + 1 + s_len] = '\0';
648
return tmp;
649
}
650
651
652
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
773
static void browse_callback(AvahiSServiceBrowser *b,
774
AvahiIfIndex interface,
775
AvahiProtocol protocol,
776
AvahiBrowserEvent event,
777
const char *name,
778
const char *type,
779
const char *domain,
780
AVAHI_GCC_UNUSED AvahiLookupResultFlags
781
flags,
782
void* userdata){
783
mandos_context *mc = userdata;
784
assert(b);
785
786
/* Called whenever a new services becomes available on the LAN or
787
is removed from the LAN */
788
789
switch(event){
790
default:
791
case AVAHI_BROWSER_FAILURE:
792
793
fprintf(stderr, "(Avahi browser) %s\n",
794
avahi_strerror(avahi_server_errno(mc->server)));
795
avahi_simple_poll_quit(mc->simple_poll);
796
return;
797
798
case AVAHI_BROWSER_NEW:
799
/* We ignore the returned Avahi resolver object. In the callback
800
function we free it. If the Avahi server is terminated before
801
the callback function is called the Avahi server will free the
802
resolver for us. */
803
804
if(!(avahi_s_service_resolver_new(mc->server, interface,
805
protocol, name, type, domain,
806
AVAHI_PROTO_INET6, 0,
807
resolve_callback, mc)))
808
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
809
name, avahi_strerror(avahi_server_errno(mc->server)));
810
break;
811
812
case AVAHI_BROWSER_REMOVE:
813
break;
814
815
case AVAHI_BROWSER_ALL_FOR_NOW:
816
case AVAHI_BROWSER_CACHE_EXHAUSTED:
817
if(debug){
818
fprintf(stderr, "No Mandos server found, still searching...\n");
819
}
820
break;
821
}
822
}
823
824
int main(int argc, char *argv[]){
825
AvahiSServiceBrowser *sb = NULL;
826
int error;
827
int ret;
828
intmax_t tmpmax;
829
int numchars;
830
int exitcode = EXIT_SUCCESS;
831
const char *interface = "eth0";
832
struct ifreq network;
833
int sd;
834
uid_t uid;
835
gid_t gid;
836
char *connect_to = NULL;
837
char tempdir[] = "/tmp/mandosXXXXXX";
838
bool tempdir_created = false;
839
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
840
const char *seckey = PATHDIR "/" SECKEY;
841
const char *pubkey = PATHDIR "/" PUBKEY;
842
843
mandos_context mc = { .simple_poll = NULL, .server = NULL,
844
.dh_bits = 1024, .priority = "SECURE256"
845
":!CTYPE-X.509:+CTYPE-OPENPGP" };
846
bool gnutls_initialized = false;
847
bool gpgme_initialized = false;
848
double delay = 2.5;
849
850
{
851
struct argp_option options[] = {
852
{ .name = "debug", .key = 128,
853
.doc = "Debug mode", .group = 3 },
854
{ .name = "connect", .key = 'c',
855
.arg = "ADDRESS:PORT",
856
.doc = "Connect directly to a specific Mandos server",
857
.group = 1 },
858
{ .name = "interface", .key = 'i',
859
.arg = "NAME",
860
.doc = "Interface that will be used to search for Mandos"
861
" servers",
862
.group = 1 },
863
{ .name = "seckey", .key = 's',
864
.arg = "FILE",
865
.doc = "OpenPGP secret key file base name",
866
.group = 1 },
867
{ .name = "pubkey", .key = 'p',
868
.arg = "FILE",
869
.doc = "OpenPGP public key file base name",
870
.group = 2 },
871
{ .name = "dh-bits", .key = 129,
872
.arg = "BITS",
873
.doc = "Bit length of the prime number used in the"
874
" Diffie-Hellman key exchange",
875
.group = 2 },
876
{ .name = "priority", .key = 130,
877
.arg = "STRING",
878
.doc = "GnuTLS priority string for the TLS handshake",
879
.group = 1 },
880
{ .name = "delay", .key = 131,
881
.arg = "SECONDS",
882
.doc = "Maximum delay to wait for interface startup",
883
.group = 2 },
884
{ .name = NULL }
885
};
886
887
error_t parse_opt(int key, char *arg,
888
struct argp_state *state){
889
switch(key){
890
case 128: /* --debug */
891
debug = true;
892
break;
893
case 'c': /* --connect */
894
connect_to = arg;
895
break;
896
case 'i': /* --interface */
897
interface = arg;
898
break;
899
case 's': /* --seckey */
900
seckey = arg;
901
break;
902
case 'p': /* --pubkey */
903
pubkey = arg;
904
break;
905
case 129: /* --dh-bits */
906
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
907
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
908
or arg[numchars] != '\0'){
909
fprintf(stderr, "Bad number of DH bits\n");
910
exit(EXIT_FAILURE);
911
}
912
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
913
break;
914
case 130: /* --priority */
915
mc.priority = arg;
916
break;
917
case 131: /* --delay */
918
ret = sscanf(arg, "%lf%n", &delay, &numchars);
919
if(ret < 1 or arg[numchars] != '\0'){
920
fprintf(stderr, "Bad delay\n");
921
exit(EXIT_FAILURE);
922
}
923
break;
924
case ARGP_KEY_ARG:
925
argp_usage(state);
926
case ARGP_KEY_END:
927
break;
928
default:
929
return ARGP_ERR_UNKNOWN;
930
}
931
return 0;
932
}
933
934
struct argp argp = { .options = options, .parser = parse_opt,
935
.args_doc = "",
936
.doc = "Mandos client -- Get and decrypt"
937
" passwords from a Mandos server" };
938
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
939
if(ret == ARGP_ERR_UNKNOWN){
940
fprintf(stderr, "Unknown error while parsing arguments\n");
941
exitcode = EXIT_FAILURE;
942
goto end;
943
}
944
}
945
946
/* If the interface is down, bring it up */
947
{
948
#ifdef __linux__
949
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
950
messages to mess up the prompt */
951
ret = klogctl(8, NULL, 5);
952
if(ret == -1){
953
perror("klogctl");
954
}
955
#endif
956
957
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
958
if(sd < 0){
959
perror("socket");
960
exitcode = EXIT_FAILURE;
961
#ifdef __linux__
962
ret = klogctl(7, NULL, 0);
963
if(ret == -1){
964
perror("klogctl");
965
}
966
#endif
967
goto end;
968
}
969
strcpy(network.ifr_name, interface);
970
ret = ioctl(sd, SIOCGIFFLAGS, &network);
971
if(ret == -1){
972
perror("ioctl SIOCGIFFLAGS");
973
#ifdef __linux__
974
ret = klogctl(7, NULL, 0);
975
if(ret == -1){
976
perror("klogctl");
977
}
978
#endif
979
exitcode = EXIT_FAILURE;
980
goto end;
981
}
982
if((network.ifr_flags & IFF_UP) == 0){
983
network.ifr_flags |= IFF_UP;
984
ret = ioctl(sd, SIOCSIFFLAGS, &network);
985
if(ret == -1){
986
perror("ioctl SIOCSIFFLAGS");
987
exitcode = EXIT_FAILURE;
988
#ifdef __linux__
989
ret = klogctl(7, NULL, 0);
990
if(ret == -1){
991
perror("klogctl");
992
}
993
#endif
994
goto end;
995
}
996
}
997
/* sleep checking until interface is running */
998
for(int i=0; i < delay * 4; i++){
999
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1000
if(ret == -1){
1001
perror("ioctl SIOCGIFFLAGS");
1002
} else if(network.ifr_flags & IFF_RUNNING){
1003
break;
1004
}
1005
struct timespec sleeptime = { .tv_nsec = 250000000 };
1006
ret = nanosleep(&sleeptime, NULL);
1007
if(ret == -1 and errno != EINTR){
1008
perror("nanosleep");
1009
}
1010
}
1011
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1012
if(ret == -1){
1013
perror("close");
1014
}
1015
#ifdef __linux__
1016
/* Restores kernel loglevel to default */
1017
ret = klogctl(7, NULL, 0);
1018
if(ret == -1){
1019
perror("klogctl");
1020
}
1021
#endif
1022
}
1023
1024
uid = getuid();
1025
gid = getgid();
1026
1027
setgid(gid);
1028
if(ret == -1){
1029
perror("setgid");
1030
}
1031
1032
ret = setuid(uid);
1033
if(ret == -1){
1034
perror("setuid");
1035
}
1036
1037
ret = init_gnutls_global(&mc, pubkey, seckey);
1038
if(ret == -1){
1039
fprintf(stderr, "init_gnutls_global failed\n");
1040
exitcode = EXIT_FAILURE;
1041
goto end;
1042
} else {
1043
gnutls_initialized = true;
1044
}
1045
1046
if(mkdtemp(tempdir) == NULL){
1047
perror("mkdtemp");
1048
goto end;
1049
}
1050
tempdir_created = true;
1051
1052
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
1053
fprintf(stderr, "init_gpgme failed\n");
1054
exitcode = EXIT_FAILURE;
1055
goto end;
1056
} else {
1057
gpgme_initialized = true;
1058
}
1059
1060
if_index = (AvahiIfIndex) if_nametoindex(interface);
1061
if(if_index == 0){
1062
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1063
exitcode = EXIT_FAILURE;
1064
goto end;
1065
}
1066
1067
if(connect_to != NULL){
1068
/* Connect directly, do not use Zeroconf */
1069
/* (Mainly meant for debugging) */
1070
char *address = strrchr(connect_to, ':');
1071
if(address == NULL){
1072
fprintf(stderr, "No colon in address\n");
1073
exitcode = EXIT_FAILURE;
1074
goto end;
1075
}
1076
uint16_t port;
1077
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1078
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1079
or address[numchars+1] != '\0'){
1080
fprintf(stderr, "Bad port number\n");
1081
exitcode = EXIT_FAILURE;
1082
goto end;
1083
}
1084
port = (uint16_t)tmpmax;
1085
*address = '\0';
1086
address = connect_to;
1087
ret = start_mandos_communication(address, port, if_index, &mc);
1088
if(ret < 0){
1089
exitcode = EXIT_FAILURE;
1090
} else {
1091
exitcode = EXIT_SUCCESS;
1092
}
1093
goto end;
1094
}
1095
1096
if(not debug){
1097
avahi_set_log_function(empty_log);
1098
}
1099
1100
/* Initialize the pseudo-RNG for Avahi */
1101
srand((unsigned int) time(NULL));
1102
1103
/* Allocate main Avahi loop object */
1104
mc.simple_poll = avahi_simple_poll_new();
1105
if(mc.simple_poll == NULL){
1106
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1107
exitcode = EXIT_FAILURE;
1108
goto end;
1109
}
1110
1111
{
653
1112
AvahiServerConfig config;
654
AvahiSServiceBrowser *sb = NULL;
655
int error;
656
int ret;
657
int returncode = EXIT_SUCCESS;
658
const char *interface = NULL;
659
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
660
char *connect_to = NULL;
661
662
while (true){
663
static struct option long_options[] = {
664
{"debug", no_argument, (int *)&debug, 1},
665
{"connect", required_argument, 0, 'C'},
666
{"interface", required_argument, 0, 'i'},
667
{"certdir", required_argument, 0, 'd'},
668
{"certkey", required_argument, 0, 'c'},
669
{"certfile", required_argument, 0, 'k'},
670
{0, 0, 0, 0} };
671
672
int option_index = 0;
673
ret = getopt_long (argc, argv, "i:", long_options,
674
&option_index);
675
676
if (ret == -1){
677
break;
678
}
679
680
switch(ret){
681
case 0:
682
break;
683
case 'i':
684
interface = optarg;
685
break;
686
case 'C':
687
connect_to = optarg;
688
break;
689
case 'd':
690
certdir = optarg;
691
break;
692
case 'c':
693
certfile = optarg;
694
break;
695
case 'k':
696
certkey = optarg;
697
break;
698
default:
699
exit(EXIT_FAILURE);
700
}
701
}
702
703
certfile = combinepath(certdir, certfile);
704
if (certfile == NULL){
705
perror("combinepath");
706
goto exit;
707
}
708
709
if(interface != NULL){
710
if_index = (AvahiIfIndex) if_nametoindex(interface);
711
if(if_index == 0){
712
fprintf(stderr, "No such interface: \"%s\"\n", interface);
713
exit(EXIT_FAILURE);
714
}
715
}
716
717
if(connect_to != NULL){
718
/* Connect directly, do not use Zeroconf */
719
/* (Mainly meant for debugging) */
720
char *address = strrchr(connect_to, ':');
721
if(address == NULL){
722
fprintf(stderr, "No colon in address\n");
723
exit(EXIT_FAILURE);
724
}
725
errno = 0;
726
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
727
if(errno){
728
perror("Bad port number");
729
exit(EXIT_FAILURE);
730
}
731
*address = '\0';
732
address = connect_to;
733
ret = start_mandos_communication(address, port, if_index);
734
if(ret < 0){
735
exit(EXIT_FAILURE);
736
} else {
737
exit(EXIT_SUCCESS);
738
}
739
}
740
741
certkey = combinepath(certdir, certkey);
742
if (certkey == NULL){
743
perror("combinepath");
744
goto exit;
745
}
746
747
if (not debug){
748
avahi_set_log_function(empty_log);
749
}
750
751
/* Initialize the psuedo-RNG */
752
srand((unsigned int) time(NULL));
753
754
/* Allocate main loop object */
755
if (!(simple_poll = avahi_simple_poll_new())) {
756
fprintf(stderr, "Failed to create simple poll object.\n");
757
758
goto exit;
759
}
760
761
/* Do not publish any local records */
1113
/* Do not publish any local Zeroconf records */
762
1114
avahi_server_config_init(&config);
763
1115
config.publish_hinfo = 0;
764
1116
config.publish_addresses = 0;
765
1117
config.publish_workstation = 0;
766
1118
config.publish_domain = 0;
767
1119
768
1120
/* Allocate a new server */
769
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
770
&config, NULL, NULL, &error);
771
772
/* Free the configuration data */
1121
mc.server = avahi_server_new(avahi_simple_poll_get
1122
(mc.simple_poll), &config, NULL,
1123
NULL, &error);
1124
1125
/* Free the Avahi configuration data */
773
1126
avahi_server_config_free(&config);
774
775
/* Check if creating the server object succeeded */
776
if (!server) {
777
fprintf(stderr, "Failed to create server: %s\n",
778
avahi_strerror(error));
779
returncode = EXIT_FAILURE;
780
goto exit;
781
}
782
783
/* Create the service browser */
784
sb = avahi_s_service_browser_new(server, if_index,
785
AVAHI_PROTO_INET6,
786
"_mandos._tcp", NULL, 0,
787
browse_callback, server);
788
if (!sb) {
789
fprintf(stderr, "Failed to create service browser: %s\n",
790
avahi_strerror(avahi_server_errno(server)));
791
returncode = EXIT_FAILURE;
792
goto exit;
793
}
794
795
/* Run the main loop */
796
797
if (debug){
798
fprintf(stderr, "Starting avahi loop search\n");
799
}
800
801
avahi_simple_poll_loop(simple_poll);
802
803
exit:
804
805
if (debug){
806
fprintf(stderr, "%s exiting\n", argv[0]);
807
}
808
809
/* Cleanup things */
810
if (sb)
811
avahi_s_service_browser_free(sb);
812
813
if (server)
814
avahi_server_free(server);
815
816
if (simple_poll)
817
avahi_simple_poll_free(simple_poll);
818
free(certfile);
819
free(certkey);
820
821
return returncode;
1127
}
1128
1129
/* Check if creating the Avahi server object succeeded */
1130
if(mc.server == NULL){
1131
fprintf(stderr, "Failed to create Avahi server: %s\n",
1132
avahi_strerror(error));
1133
exitcode = EXIT_FAILURE;
1134
goto end;
1135
}
1136
1137
/* Create the Avahi service browser */
1138
sb = avahi_s_service_browser_new(mc.server, if_index,
1139
AVAHI_PROTO_INET6, "_mandos._tcp",
1140
NULL, 0, browse_callback, &mc);
1141
if(sb == NULL){
1142
fprintf(stderr, "Failed to create service browser: %s\n",
1143
avahi_strerror(avahi_server_errno(mc.server)));
1144
exitcode = EXIT_FAILURE;
1145
goto end;
1146
}
1147
1148
/* Run the main loop */
1149
1150
if(debug){
1151
fprintf(stderr, "Starting Avahi loop search\n");
1152
}
1153
1154
avahi_simple_poll_loop(mc.simple_poll);
1155
1156
end:
1157
1158
if(debug){
1159
fprintf(stderr, "%s exiting\n", argv[0]);
1160
}
1161
1162
/* Cleanup things */
1163
if(sb != NULL)
1164
avahi_s_service_browser_free(sb);
1165
1166
if(mc.server != NULL)
1167
avahi_server_free(mc.server);
1168
1169
if(mc.simple_poll != NULL)
1170
avahi_simple_poll_free(mc.simple_poll);
1171
1172
if(gnutls_initialized){
1173
gnutls_certificate_free_credentials(mc.cred);
1174
gnutls_global_deinit();
1175
gnutls_dh_params_deinit(mc.dh_params);
1176
}
1177
1178
if(gpgme_initialized){
1179
gpgme_release(mc.ctx);
1180
}
1181
1182
/* Removes the temp directory used by GPGME */
1183
if(tempdir_created){
1184
DIR *d;
1185
struct dirent *direntry;
1186
d = opendir(tempdir);
1187
if(d == NULL){
1188
if(errno != ENOENT){
1189
perror("opendir");
1190
}
1191
} else {
1192
while(true){
1193
direntry = readdir(d);
1194
if(direntry == NULL){
1195
break;
1196
}
1197
/* Skip "." and ".." */
1198
if(direntry->d_name[0] == '.'
1199
and (direntry->d_name[1] == '\0'
1200
or (direntry->d_name[1] == '.'
1201
and direntry->d_name[2] == '\0'))){
1202
continue;
1203
}
1204
char *fullname = NULL;
1205
ret = asprintf(&fullname, "%s/%s", tempdir,
1206
direntry->d_name);
1207
if(ret < 0){
1208
perror("asprintf");
1209
continue;
1210
}
1211
ret = remove(fullname);
1212
if(ret == -1){
1213
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1214
strerror(errno));
1215
}
1216
free(fullname);
1217
}
1218
closedir(d);
1219
}
1220
ret = rmdir(tempdir);
1221
if(ret == -1 and errno != ENOENT){
1222
perror("rmdir");
1223
}
1224
}
1225
1226
return exitcode;
822
1227
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0