To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 308
- compare with another revision
- download diff
- download tarball
- view history from revision 308
- Committer: Teddy Hogeborn
- Date: 2009-02-09 19:26:19 UTC
- Revision ID: teddy@fukt.bsnet.se-20090209192619-7rse82x9pypq4ihk
* plugin-runner.c: Comment change.
* plugins.d/mandos-client.c: Comment changes.
(quit_now): New global flag.
(handle_sigterm): Only call avahi_simple_poll_quit once.
(main): Also handle SIGINT and SIGHUP.
* plugins.d/mandos-client.c: Comment changes.
(quit_now): New global flag.
(handle_sigterm): Only call avahi_simple_poll_quit once.
(main): Also handle SIGINT and SIGHUP.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
32
33
#define _LARGEFILE_SOURCE
33
34
#define _FILE_OFFSET_BITS 64
34
35
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
36
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
37
38
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
40
remove() */
41
#include <stdint.h> /* uint16_t, uint32_t */
42
#include <stddef.h> /* NULL, size_t, ssize_t */
43
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
44
srand() */
45
#include <stdbool.h> /* bool, false, true */
46
#include <string.h> /* memset(), strcmp(), strlen(),
47
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, uid_t, gid_t, open(),
52
opendir(), DIR */
53
#include <sys/stat.h> /* open() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
inet_pton(), connect() */
56
#include <fcntl.h> /* open() */
57
#include <dirent.h> /* opendir(), struct dirent, readdir()
58
*/
59
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
60
#include <assert.h> /* assert() */
61
#include <errno.h> /* perror(), errno */
62
#include <time.h> /* nanosleep(), time() */
63
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
64
SIOCSIFFLAGS, if_indextoname(),
65
if_nametoindex(), IF_NAMESIZE */
66
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
67
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
68
*/
69
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
getuid(), getgid(), setuid(),
71
setgid() */
72
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, or, and */
74
#include <argp.h> /* struct argp_option, error_t, struct
75
argp_state, struct argp,
76
argp_parse(), ARGP_KEY_ARG,
77
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
78
#include <signal.h> /* sigemptyset(), sigaddset(),
79
sigaction(), SIGTERM, sigaction,
80
sig_atomic_t */
81
82
#ifdef __linux__
83
#include <sys/klog.h> /* klogctl() */
84
#endif /* __linux__ */
85
86
/* Avahi */
87
/* All Avahi types, constants and functions
88
Avahi*, avahi_*,
89
AVAHI_* */
41
90
#include <avahi-core/core.h>
42
91
#include <avahi-core/lookup.h>
43
92
#include <avahi-core/log.h>
45
94
#include <avahi-common/malloc.h>
46
95
#include <avahi-common/error.h>
47
96
48
//mandos client part
49
#include <sys/types.h> /* socket(), inet_pton() */
50
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
51
struct in6_addr, inet_pton() */
52
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
53
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
54
55
#include <unistd.h> /* close() */
56
#include <netinet/in.h>
57
#include <stdbool.h> /* true */
58
#include <string.h> /* memset */
59
#include <arpa/inet.h> /* inet_pton() */
60
#include <iso646.h> /* not */
61
62
// gpgme
63
#include <errno.h> /* perror() */
64
#include <gpgme.h>
65
66
// getopt long
67
#include <getopt.h>
97
/* GnuTLS */
98
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
99
functions:
100
gnutls_*
101
init_gnutls_session(),
102
GNUTLS_* */
103
#include <gnutls/openpgp.h>
104
/* gnutls_certificate_set_openpgp_key_file(),
105
GNUTLS_OPENPGP_FMT_BASE64 */
106
107
/* GPGME */
108
#include <gpgme.h> /* All GPGME types, constants and
109
functions:
110
gpgme_*
111
GPGME_PROTOCOL_OpenPGP,
112
GPG_ERR_NO_* */
68
113
69
114
#define BUFFER_SIZE 256
70
#define DH_BITS 1024
71
115
72
static const char *certdir = "/conf/conf.d/mandos";
73
static const char *certfile = "openpgp-client.txt";
74
static const char *certkey = "openpgp-client-key.txt";
116
#define PATHDIR "/conf/conf.d/mandos"
117
#define SECKEY "seckey.txt"
118
#define PUBKEY "pubkey.txt"
75
119
76
120
bool debug = false;
121
static const char mandos_protocol_version[] = "1";
122
const char *argp_program_version = "mandos-client " VERSION;
123
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
77
124
125
/* Used for passing in values through the Avahi callback functions */
78
126
typedef struct {
79
gnutls_session_t session;
127
AvahiSimplePoll *simple_poll;
128
AvahiServer *server;
80
129
gnutls_certificate_credentials_t cred;
130
unsigned int dh_bits;
81
131
gnutls_dh_params_t dh_params;
82
} encrypted_session;
83
84
85
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
86
char **new_packet,
87
const char *homedir){
88
gpgme_data_t dh_crypto, dh_plain;
132
const char *priority;
89
133
gpgme_ctx_t ctx;
134
} mandos_context;
135
136
/* global context so signal handler can reach it*/
137
mandos_context mc;
138
139
/*
140
* Make additional room in "buffer" for at least BUFFER_SIZE more
141
* bytes. "buffer_capacity" is how much is currently allocated,
142
* "buffer_length" is how much is already used.
143
*/
144
size_t incbuffer(char **buffer, size_t buffer_length,
145
size_t buffer_capacity){
146
if(buffer_length + BUFFER_SIZE > buffer_capacity){
147
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
148
if(buffer == NULL){
149
return 0;
150
}
151
buffer_capacity += BUFFER_SIZE;
152
}
153
return buffer_capacity;
154
}
155
156
/*
157
* Initialize GPGME.
158
*/
159
static bool init_gpgme(const char *seckey,
160
const char *pubkey, const char *tempdir){
161
int ret;
90
162
gpgme_error_t rc;
91
ssize_t ret;
92
ssize_t new_packet_capacity = 0;
93
ssize_t new_packet_length = 0;
94
163
gpgme_engine_info_t engine_info;
95
96
if (debug){
97
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
164
165
166
/*
167
* Helper function to insert pub and seckey to the engine keyring.
168
*/
169
bool import_key(const char *filename){
170
int fd;
171
gpgme_data_t pgp_data;
172
173
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
174
if(fd == -1){
175
perror("open");
176
return false;
177
}
178
179
rc = gpgme_data_new_from_fd(&pgp_data, fd);
180
if(rc != GPG_ERR_NO_ERROR){
181
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
182
gpgme_strsource(rc), gpgme_strerror(rc));
183
return false;
184
}
185
186
rc = gpgme_op_import(mc.ctx, pgp_data);
187
if(rc != GPG_ERR_NO_ERROR){
188
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
189
gpgme_strsource(rc), gpgme_strerror(rc));
190
return false;
191
}
192
193
ret = (int)TEMP_FAILURE_RETRY(close(fd));
194
if(ret == -1){
195
perror("close");
196
}
197
gpgme_data_release(pgp_data);
198
return true;
199
}
200
201
if(debug){
202
fprintf(stderr, "Initializing GPGME\n");
98
203
}
99
204
100
205
/* Init GPGME */
101
206
gpgme_check_version(NULL);
102
207
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
103
if (rc != GPG_ERR_NO_ERROR){
208
if(rc != GPG_ERR_NO_ERROR){
104
209
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
105
210
gpgme_strsource(rc), gpgme_strerror(rc));
106
return -1;
211
return false;
107
212
}
108
213
109
/* Set GPGME home directory */
110
rc = gpgme_get_engine_info (&engine_info);
111
if (rc != GPG_ERR_NO_ERROR){
214
/* Set GPGME home directory for the OpenPGP engine only */
215
rc = gpgme_get_engine_info(&engine_info);
216
if(rc != GPG_ERR_NO_ERROR){
112
217
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
113
218
gpgme_strsource(rc), gpgme_strerror(rc));
114
return -1;
219
return false;
115
220
}
116
221
while(engine_info != NULL){
117
222
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
118
223
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
119
engine_info->file_name, homedir);
224
engine_info->file_name, tempdir);
120
225
break;
121
226
}
122
227
engine_info = engine_info->next;
123
228
}
124
229
if(engine_info == NULL){
125
fprintf(stderr, "Could not set home dir to %s\n", homedir);
126
return -1;
127
}
128
129
/* Create new GPGME data buffer from packet buffer */
130
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
131
if (rc != GPG_ERR_NO_ERROR){
230
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
231
return false;
232
}
233
234
/* Create new GPGME "context" */
235
rc = gpgme_new(&(mc.ctx));
236
if(rc != GPG_ERR_NO_ERROR){
237
fprintf(stderr, "bad gpgme_new: %s: %s\n",
238
gpgme_strsource(rc), gpgme_strerror(rc));
239
return false;
240
}
241
242
if(not import_key(pubkey) or not import_key(seckey)){
243
return false;
244
}
245
246
return true;
247
}
248
249
/*
250
* Decrypt OpenPGP data.
251
* Returns -1 on error
252
*/
253
static ssize_t pgp_packet_decrypt(const char *cryptotext,
254
size_t crypto_size,
255
char **plaintext){
256
gpgme_data_t dh_crypto, dh_plain;
257
gpgme_error_t rc;
258
ssize_t ret;
259
size_t plaintext_capacity = 0;
260
ssize_t plaintext_length = 0;
261
262
if(debug){
263
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
264
}
265
266
/* Create new GPGME data buffer from memory cryptotext */
267
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
268
0);
269
if(rc != GPG_ERR_NO_ERROR){
132
270
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
133
271
gpgme_strsource(rc), gpgme_strerror(rc));
134
272
return -1;
136
274
137
275
/* Create new empty GPGME data buffer for the plaintext */
138
276
rc = gpgme_data_new(&dh_plain);
139
if (rc != GPG_ERR_NO_ERROR){
277
if(rc != GPG_ERR_NO_ERROR){
140
278
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
141
279
gpgme_strsource(rc), gpgme_strerror(rc));
142
return -1;
143
}
144
145
/* Create new GPGME "context" */
146
rc = gpgme_new(&ctx);
147
if (rc != GPG_ERR_NO_ERROR){
148
fprintf(stderr, "bad gpgme_new: %s: %s\n",
149
gpgme_strsource(rc), gpgme_strerror(rc));
150
return -1;
151
}
152
153
/* Decrypt data from the FILE pointer to the plaintext data
154
buffer */
155
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
156
if (rc != GPG_ERR_NO_ERROR){
280
gpgme_data_release(dh_crypto);
281
return -1;
282
}
283
284
/* Decrypt data from the cryptotext data buffer to the plaintext
285
data buffer */
286
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
287
if(rc != GPG_ERR_NO_ERROR){
157
288
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
158
289
gpgme_strsource(rc), gpgme_strerror(rc));
159
return -1;
290
plaintext_length = -1;
291
if(debug){
292
gpgme_decrypt_result_t result;
293
result = gpgme_op_decrypt_result(mc.ctx);
294
if(result == NULL){
295
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
296
} else {
297
fprintf(stderr, "Unsupported algorithm: %s\n",
298
result->unsupported_algorithm);
299
fprintf(stderr, "Wrong key usage: %u\n",
300
result->wrong_key_usage);
301
if(result->file_name != NULL){
302
fprintf(stderr, "File name: %s\n", result->file_name);
303
}
304
gpgme_recipient_t recipient;
305
recipient = result->recipients;
306
if(recipient){
307
while(recipient != NULL){
308
fprintf(stderr, "Public key algorithm: %s\n",
309
gpgme_pubkey_algo_name(recipient->pubkey_algo));
310
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
311
fprintf(stderr, "Secret key available: %s\n",
312
recipient->status == GPG_ERR_NO_SECKEY
313
? "No" : "Yes");
314
recipient = recipient->next;
315
}
316
}
317
}
318
}
319
goto decrypt_end;
160
320
}
161
321
162
322
if(debug){
163
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
164
}
165
166
if (debug){
167
gpgme_decrypt_result_t result;
168
result = gpgme_op_decrypt_result(ctx);
169
if (result == NULL){
170
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
171
} else {
172
fprintf(stderr, "Unsupported algorithm: %s\n",
173
result->unsupported_algorithm);
174
fprintf(stderr, "Wrong key usage: %d\n",
175
result->wrong_key_usage);
176
if(result->file_name != NULL){
177
fprintf(stderr, "File name: %s\n", result->file_name);
178
}
179
gpgme_recipient_t recipient;
180
recipient = result->recipients;
181
if(recipient){
182
while(recipient != NULL){
183
fprintf(stderr, "Public key algorithm: %s\n",
184
gpgme_pubkey_algo_name(recipient->pubkey_algo));
185
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
186
fprintf(stderr, "Secret key available: %s\n",
187
recipient->status == GPG_ERR_NO_SECKEY
188
? "No" : "Yes");
189
recipient = recipient->next;
190
}
191
}
192
}
193
}
194
195
/* Delete the GPGME FILE pointer cryptotext data buffer */
196
gpgme_data_release(dh_crypto);
323
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
324
}
197
325
198
326
/* Seek back to the beginning of the GPGME plaintext data buffer */
199
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
200
perror("pgpme_data_seek");
327
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
328
perror("gpgme_data_seek");
329
plaintext_length = -1;
330
goto decrypt_end;
201
331
}
202
332
203
*new_packet = 0;
333
*plaintext = NULL;
204
334
while(true){
205
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
206
*new_packet = realloc(*new_packet,
207
(unsigned int)new_packet_capacity
208
+ BUFFER_SIZE);
209
if (*new_packet == NULL){
210
perror("realloc");
211
return -1;
212
}
213
new_packet_capacity += BUFFER_SIZE;
335
plaintext_capacity = incbuffer(plaintext,
336
(size_t)plaintext_length,
337
plaintext_capacity);
338
if(plaintext_capacity == 0){
339
perror("incbuffer");
340
plaintext_length = -1;
341
goto decrypt_end;
214
342
}
215
343
216
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
344
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
217
345
BUFFER_SIZE);
218
346
/* Print the data, if any */
219
if (ret == 0){
347
if(ret == 0){
348
/* EOF */
220
349
break;
221
350
}
222
351
if(ret < 0){
223
352
perror("gpgme_data_read");
224
return -1;
225
}
226
new_packet_length += ret;
227
}
228
229
/* FIXME: check characters before printing to screen so to not print
230
terminal control characters */
231
/* if(debug){ */
232
/* fprintf(stderr, "decrypted password is: "); */
233
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
234
/* fprintf(stderr, "\n"); */
235
/* } */
353
plaintext_length = -1;
354
goto decrypt_end;
355
}
356
plaintext_length += ret;
357
}
358
359
if(debug){
360
fprintf(stderr, "Decrypted password is: ");
361
for(ssize_t i = 0; i < plaintext_length; i++){
362
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
363
}
364
fprintf(stderr, "\n");
365
}
366
367
decrypt_end:
368
369
/* Delete the GPGME cryptotext data buffer */
370
gpgme_data_release(dh_crypto);
236
371
237
372
/* Delete the GPGME plaintext data buffer */
238
373
gpgme_data_release(dh_plain);
239
return new_packet_length;
374
return plaintext_length;
240
375
}
241
376
242
static const char * safer_gnutls_strerror (int value) {
243
const char *ret = gnutls_strerror (value);
244
if (ret == NULL)
377
static const char * safer_gnutls_strerror(int value){
378
const char *ret = gnutls_strerror(value); /* Spurious warning from
379
-Wunreachable-code */
380
if(ret == NULL)
245
381
ret = "(unknown)";
246
382
return ret;
247
383
}
248
384
385
/* GnuTLS log function callback */
249
386
static void debuggnutls(__attribute__((unused)) int level,
250
387
const char* string){
251
fprintf(stderr, "%s", string);
388
fprintf(stderr, "GnuTLS: %s", string);
252
389
}
253
390
254
static int initgnutls(encrypted_session *es){
255
const char *err;
391
static int init_gnutls_global(const char *pubkeyfilename,
392
const char *seckeyfilename){
256
393
int ret;
257
394
258
395
if(debug){
259
396
fprintf(stderr, "Initializing GnuTLS\n");
260
397
}
261
262
if ((ret = gnutls_global_init ())
263
!= GNUTLS_E_SUCCESS) {
264
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
398
399
ret = gnutls_global_init();
400
if(ret != GNUTLS_E_SUCCESS){
401
fprintf(stderr, "GnuTLS global_init: %s\n",
402
safer_gnutls_strerror(ret));
265
403
return -1;
266
404
}
267
268
if (debug){
405
406
if(debug){
407
/* "Use a log level over 10 to enable all debugging options."
408
* - GnuTLS manual
409
*/
269
410
gnutls_global_set_log_level(11);
270
411
gnutls_global_set_log_function(debuggnutls);
271
412
}
272
413
273
/* openpgp credentials */
274
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
275
!= GNUTLS_E_SUCCESS) {
276
fprintf (stderr, "memory error: %s\n",
277
safer_gnutls_strerror(ret));
414
/* OpenPGP credentials */
415
gnutls_certificate_allocate_credentials(&mc.cred);
416
if(ret != GNUTLS_E_SUCCESS){
417
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
418
from
419
-Wunreachable-code
420
*/
421
safer_gnutls_strerror(ret));
422
gnutls_global_deinit();
278
423
return -1;
279
424
}
280
425
281
426
if(debug){
282
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
283
" and keyfile %s as GnuTLS credentials\n", certfile,
284
certkey);
427
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
428
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
429
seckeyfilename);
285
430
}
286
431
287
432
ret = gnutls_certificate_set_openpgp_key_file
288
(es->cred, certfile, certkey, GNUTLS_OPENPGP_FMT_BASE64);
289
if (ret != GNUTLS_E_SUCCESS) {
290
fprintf
291
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
292
" '%s')\n",
293
ret, certfile, certkey);
294
fprintf(stdout, "The Error is: %s\n",
295
safer_gnutls_strerror(ret));
296
return -1;
297
}
298
299
//GnuTLS server initialization
300
if ((ret = gnutls_dh_params_init (&es->dh_params))
301
!= GNUTLS_E_SUCCESS) {
302
fprintf (stderr, "Error in dh parameter initialization: %s\n",
303
safer_gnutls_strerror(ret));
304
return -1;
305
}
306
307
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
308
!= GNUTLS_E_SUCCESS) {
309
fprintf (stderr, "Error in prime generation: %s\n",
310
safer_gnutls_strerror(ret));
311
return -1;
312
}
313
314
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
315
316
// GnuTLS session creation
317
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
318
!= GNUTLS_E_SUCCESS){
433
(mc.cred, pubkeyfilename, seckeyfilename,
434
GNUTLS_OPENPGP_FMT_BASE64);
435
if(ret != GNUTLS_E_SUCCESS){
436
fprintf(stderr,
437
"Error[%d] while reading the OpenPGP key pair ('%s',"
438
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
439
fprintf(stderr, "The GnuTLS error is: %s\n",
440
safer_gnutls_strerror(ret));
441
goto globalfail;
442
}
443
444
/* GnuTLS server initialization */
445
ret = gnutls_dh_params_init(&mc.dh_params);
446
if(ret != GNUTLS_E_SUCCESS){
447
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
448
" %s\n", safer_gnutls_strerror(ret));
449
goto globalfail;
450
}
451
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
452
if(ret != GNUTLS_E_SUCCESS){
453
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
454
safer_gnutls_strerror(ret));
455
goto globalfail;
456
}
457
458
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
459
460
return 0;
461
462
globalfail:
463
464
gnutls_certificate_free_credentials(mc.cred);
465
gnutls_global_deinit();
466
gnutls_dh_params_deinit(mc.dh_params);
467
return -1;
468
}
469
470
static int init_gnutls_session(gnutls_session_t *session){
471
int ret;
472
/* GnuTLS session creation */
473
ret = gnutls_init(session, GNUTLS_SERVER);
474
if(ret != GNUTLS_E_SUCCESS){
319
475
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
320
476
safer_gnutls_strerror(ret));
321
477
}
322
478
323
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
324
!= GNUTLS_E_SUCCESS) {
325
fprintf(stderr, "Syntax error at: %s\n", err);
326
fprintf(stderr, "GnuTLS error: %s\n",
327
safer_gnutls_strerror(ret));
328
return -1;
479
{
480
const char *err;
481
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
482
if(ret != GNUTLS_E_SUCCESS){
483
fprintf(stderr, "Syntax error at: %s\n", err);
484
fprintf(stderr, "GnuTLS error: %s\n",
485
safer_gnutls_strerror(ret));
486
gnutls_deinit(*session);
487
return -1;
488
}
329
489
}
330
490
331
if ((ret = gnutls_credentials_set
332
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
333
!= GNUTLS_E_SUCCESS) {
334
fprintf(stderr, "Error setting a credentials set: %s\n",
491
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
492
mc.cred);
493
if(ret != GNUTLS_E_SUCCESS){
494
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
335
495
safer_gnutls_strerror(ret));
496
gnutls_deinit(*session);
336
497
return -1;
337
498
}
338
499
339
500
/* ignore client certificate if any. */
340
gnutls_certificate_server_set_request (es->session,
341
GNUTLS_CERT_IGNORE);
501
gnutls_certificate_server_set_request(*session,
502
GNUTLS_CERT_IGNORE);
342
503
343
gnutls_dh_set_prime_bits (es->session, DH_BITS);
504
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
344
505
345
506
return 0;
346
507
}
347
508
509
/* Avahi log function callback */
348
510
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
349
511
__attribute__((unused)) const char *txt){}
350
512
513
/* Called when a Mandos server is found */
351
514
static int start_mandos_communication(const char *ip, uint16_t port,
352
AvahiIfIndex if_index){
515
AvahiIfIndex if_index,
516
int af){
353
517
int ret, tcp_sd;
354
struct sockaddr_in6 to;
355
encrypted_session es;
518
ssize_t sret;
519
union {
520
struct sockaddr_in in;
521
struct sockaddr_in6 in6;
522
} to;
356
523
char *buffer = NULL;
357
524
char *decrypted_buffer;
358
525
size_t buffer_length = 0;
359
526
size_t buffer_capacity = 0;
360
527
ssize_t decrypted_buffer_size;
361
size_t written = 0;
528
size_t written;
362
529
int retval = 0;
363
char interface[IF_NAMESIZE];
530
gnutls_session_t session;
531
int pf; /* Protocol family */
532
533
switch(af){
534
case AF_INET6:
535
pf = PF_INET6;
536
break;
537
case AF_INET:
538
pf = PF_INET;
539
break;
540
default:
541
fprintf(stderr, "Bad address family: %d\n", af);
542
return -1;
543
}
544
545
ret = init_gnutls_session(&session);
546
if(ret != 0){
547
return -1;
548
}
364
549
365
550
if(debug){
366
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
367
ip, port);
551
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
552
"\n", ip, port);
368
553
}
369
554
370
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
371
if(tcp_sd < 0) {
555
tcp_sd = socket(pf, SOCK_STREAM, 0);
556
if(tcp_sd < 0){
372
557
perror("socket");
373
558
return -1;
374
559
}
375
560
376
if(if_indextoname((unsigned int)if_index, interface) == NULL){
377
if(debug){
378
perror("if_indextoname");
379
}
380
return -1;
381
}
382
383
if(debug){
384
fprintf(stderr, "Binding to interface %s\n", interface);
385
}
386
387
memset(&to,0,sizeof(to)); /* Spurious warning */
388
to.sin6_family = AF_INET6;
389
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
390
if (ret < 0 ){
561
memset(&to, 0, sizeof(to));
562
if(af == AF_INET6){
563
to.in6.sin6_family = (uint16_t)af;
564
ret = inet_pton(af, ip, &to.in6.sin6_addr);
565
} else { /* IPv4 */
566
to.in.sin_family = (sa_family_t)af;
567
ret = inet_pton(af, ip, &to.in.sin_addr);
568
}
569
if(ret < 0 ){
391
570
perror("inet_pton");
392
571
return -1;
393
}
572
}
394
573
if(ret == 0){
395
574
fprintf(stderr, "Bad address: %s\n", ip);
396
575
return -1;
397
576
}
398
to.sin6_port = htons(port); /* Spurious warning */
399
400
to.sin6_scope_id = (uint32_t)if_index;
577
if(af == AF_INET6){
578
to.in6.sin6_port = htons(port); /* Spurious warnings from
579
-Wconversion and
580
-Wunreachable-code */
581
582
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
583
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
584
-Wunreachable-code*/
585
if(if_index == AVAHI_IF_UNSPEC){
586
fprintf(stderr, "An IPv6 link-local address is incomplete"
587
" without a network interface\n");
588
return -1;
589
}
590
/* Set the network interface number as scope */
591
to.in6.sin6_scope_id = (uint32_t)if_index;
592
}
593
} else {
594
to.in.sin_port = htons(port); /* Spurious warnings from
595
-Wconversion and
596
-Wunreachable-code */
597
}
401
598
402
599
if(debug){
403
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
404
/* char addrstr[INET6_ADDRSTRLEN]; */
405
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
406
/* sizeof(addrstr)) == NULL){ */
407
/* perror("inet_ntop"); */
408
/* } else { */
409
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
410
/* addrstr, ntohs(to.sin6_port)); */
411
/* } */
600
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
601
char interface[IF_NAMESIZE];
602
if(if_indextoname((unsigned int)if_index, interface) == NULL){
603
perror("if_indextoname");
604
} else {
605
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
606
ip, interface, port);
607
}
608
} else {
609
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
610
port);
611
}
612
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
613
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
614
const char *pcret;
615
if(af == AF_INET6){
616
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
617
sizeof(addrstr));
618
} else {
619
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
620
sizeof(addrstr));
621
}
622
if(pcret == NULL){
623
perror("inet_ntop");
624
} else {
625
if(strcmp(addrstr, ip) != 0){
626
fprintf(stderr, "Canonical address form: %s\n", addrstr);
627
}
628
}
412
629
}
413
630
414
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
415
if (ret < 0){
631
if(af == AF_INET6){
632
ret = connect(tcp_sd, &to.in6, sizeof(to));
633
} else {
634
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
635
}
636
if(ret < 0){
416
637
perror("connect");
417
638
return -1;
418
639
}
419
640
420
ret = initgnutls (&es);
421
if (ret != 0){
422
retval = -1;
423
return -1;
641
const char *out = mandos_protocol_version;
642
written = 0;
643
while(true){
644
size_t out_size = strlen(out);
645
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
646
out_size - written));
647
if(ret == -1){
648
perror("write");
649
retval = -1;
650
goto mandos_end;
651
}
652
written += (size_t)ret;
653
if(written < out_size){
654
continue;
655
} else {
656
if(out == mandos_protocol_version){
657
written = 0;
658
out = "\r\n";
659
} else {
660
break;
661
}
662
}
424
663
}
425
664
426
gnutls_transport_set_ptr (es.session,
427
(gnutls_transport_ptr_t) tcp_sd);
428
429
665
if(debug){
430
666
fprintf(stderr, "Establishing TLS session with %s\n", ip);
431
667
}
432
668
433
ret = gnutls_handshake (es.session);
434
435
if (ret != GNUTLS_E_SUCCESS){
669
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
670
671
do{
672
ret = gnutls_handshake(session);
673
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
674
675
if(ret != GNUTLS_E_SUCCESS){
436
676
if(debug){
437
fprintf(stderr, "\n*** Handshake failed ***\n");
438
gnutls_perror (ret);
677
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
678
gnutls_perror(ret);
439
679
}
440
680
retval = -1;
441
goto exit;
681
goto mandos_end;
442
682
}
443
683
444
//Retrieve OpenPGP packet that contains the wanted password
684
/* Read OpenPGP packet that contains the wanted password */
445
685
446
686
if(debug){
447
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
687
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
448
688
ip);
449
689
}
450
690
451
691
while(true){
452
if (buffer_length + BUFFER_SIZE > buffer_capacity){
453
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
454
if (buffer == NULL){
455
perror("realloc");
456
goto exit;
457
}
458
buffer_capacity += BUFFER_SIZE;
692
buffer_capacity = incbuffer(&buffer, buffer_length,
693
buffer_capacity);
694
if(buffer_capacity == 0){
695
perror("incbuffer");
696
retval = -1;
697
goto mandos_end;
459
698
}
460
699
461
ret = gnutls_record_recv
462
(es.session, buffer+buffer_length, BUFFER_SIZE);
463
if (ret == 0){
700
sret = gnutls_record_recv(session, buffer+buffer_length,
701
BUFFER_SIZE);
702
if(sret == 0){
464
703
break;
465
704
}
466
if (ret < 0){
467
switch(ret){
705
if(sret < 0){
706
switch(sret){
468
707
case GNUTLS_E_INTERRUPTED:
469
708
case GNUTLS_E_AGAIN:
470
709
break;
471
710
case GNUTLS_E_REHANDSHAKE:
472
ret = gnutls_handshake (es.session);
473
if (ret < 0){
474
fprintf(stderr, "\n*** Handshake failed ***\n");
475
gnutls_perror (ret);
711
do{
712
ret = gnutls_handshake(session);
713
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
714
if(ret < 0){
715
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
716
gnutls_perror(ret);
476
717
retval = -1;
477
goto exit;
718
goto mandos_end;
478
719
}
479
720
break;
480
721
default:
481
722
fprintf(stderr, "Unknown error while reading data from"
482
" encrypted session with mandos server\n");
723
" encrypted session with Mandos server\n");
483
724
retval = -1;
484
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
485
goto exit;
725
gnutls_bye(session, GNUTLS_SHUT_RDWR);
726
goto mandos_end;
486
727
}
487
728
} else {
488
buffer_length += (size_t) ret;
729
buffer_length += (size_t) sret;
489
730
}
490
731
}
491
732
492
if (buffer_length > 0){
733
if(debug){
734
fprintf(stderr, "Closing TLS session\n");
735
}
736
737
gnutls_bye(session, GNUTLS_SHUT_RDWR);
738
739
if(buffer_length > 0){
493
740
decrypted_buffer_size = pgp_packet_decrypt(buffer,
494
741
buffer_length,
495
&decrypted_buffer,
496
certdir);
497
if (decrypted_buffer_size >= 0){
742
&decrypted_buffer);
743
if(decrypted_buffer_size >= 0){
744
written = 0;
498
745
while(written < (size_t) decrypted_buffer_size){
499
ret = (int)fwrite (decrypted_buffer + written, 1,
500
(size_t)decrypted_buffer_size - written,
501
stdout);
746
ret = (int)fwrite(decrypted_buffer + written, 1,
747
(size_t)decrypted_buffer_size - written,
748
stdout);
502
749
if(ret == 0 and ferror(stdout)){
503
750
if(debug){
504
751
fprintf(stderr, "Error writing encrypted data: %s\n",
513
760
} else {
514
761
retval = -1;
515
762
}
516
}
517
518
//shutdown procedure
519
520
if(debug){
521
fprintf(stderr, "Closing TLS session\n");
522
}
523
763
} else {
764
retval = -1;
765
}
766
767
/* Shutdown procedure */
768
769
mandos_end:
524
770
free(buffer);
525
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
526
exit:
527
close(tcp_sd);
528
gnutls_deinit (es.session);
529
gnutls_certificate_free_credentials (es.cred);
530
gnutls_global_deinit ();
771
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
772
if(ret == -1){
773
perror("close");
774
}
775
gnutls_deinit(session);
531
776
return retval;
532
777
}
533
778
534
static AvahiSimplePoll *simple_poll = NULL;
535
static AvahiServer *server = NULL;
536
537
static void resolve_callback(
538
AvahiSServiceResolver *r,
539
AvahiIfIndex interface,
540
AVAHI_GCC_UNUSED AvahiProtocol protocol,
541
AvahiResolverEvent event,
542
const char *name,
543
const char *type,
544
const char *domain,
545
const char *host_name,
546
const AvahiAddress *address,
547
uint16_t port,
548
AVAHI_GCC_UNUSED AvahiStringList *txt,
549
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
550
AVAHI_GCC_UNUSED void* userdata) {
551
552
assert(r); /* Spurious warning */
779
static void resolve_callback(AvahiSServiceResolver *r,
780
AvahiIfIndex interface,
781
AvahiProtocol proto,
782
AvahiResolverEvent event,
783
const char *name,
784
const char *type,
785
const char *domain,
786
const char *host_name,
787
const AvahiAddress *address,
788
uint16_t port,
789
AVAHI_GCC_UNUSED AvahiStringList *txt,
790
AVAHI_GCC_UNUSED AvahiLookupResultFlags
791
flags,
792
AVAHI_GCC_UNUSED void* userdata){
793
assert(r);
553
794
554
795
/* Called whenever a service has been resolved successfully or
555
796
timed out */
556
797
557
switch (event) {
798
switch(event){
558
799
default:
559
800
case AVAHI_RESOLVER_FAILURE:
560
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
561
" type '%s' in domain '%s': %s\n", name, type, domain,
562
avahi_strerror(avahi_server_errno(server)));
801
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
802
" of type '%s' in domain '%s': %s\n", name, type, domain,
803
avahi_strerror(avahi_server_errno(mc.server)));
563
804
break;
564
805
565
806
case AVAHI_RESOLVER_FOUND:
567
808
char ip[AVAHI_ADDRESS_STR_MAX];
568
809
avahi_address_snprint(ip, sizeof(ip), address);
569
810
if(debug){
570
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
571
" port %d\n", name, host_name, ip, port);
811
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
812
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
813
ip, (intmax_t)interface, port);
572
814
}
573
int ret = start_mandos_communication(ip, port, interface);
574
if (ret == 0){
575
exit(EXIT_SUCCESS);
815
int ret = start_mandos_communication(ip, port, interface,
816
avahi_proto_to_af(proto));
817
if(ret == 0){
818
avahi_simple_poll_quit(mc.simple_poll);
576
819
}
577
820
}
578
821
}
579
822
avahi_s_service_resolver_free(r);
580
823
}
581
824
582
static void browse_callback(
583
AvahiSServiceBrowser *b,
584
AvahiIfIndex interface,
585
AvahiProtocol protocol,
586
AvahiBrowserEvent event,
587
const char *name,
588
const char *type,
589
const char *domain,
590
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
591
void* userdata) {
592
593
AvahiServer *s = userdata;
594
assert(b); /* Spurious warning */
595
596
/* Called whenever a new services becomes available on the LAN or
597
is removed from the LAN */
598
599
switch (event) {
600
default:
601
case AVAHI_BROWSER_FAILURE:
602
603
fprintf(stderr, "(Browser) %s\n",
604
avahi_strerror(avahi_server_errno(server)));
605
avahi_simple_poll_quit(simple_poll);
606
return;
607
608
case AVAHI_BROWSER_NEW:
609
/* We ignore the returned resolver object. In the callback
610
function we free it. If the server is terminated before
611
the callback function is called the server will free
612
the resolver for us. */
613
614
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
615
type, domain,
616
AVAHI_PROTO_INET6, 0,
617
resolve_callback, s)))
618
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
619
avahi_strerror(avahi_server_errno(s)));
620
break;
621
622
case AVAHI_BROWSER_REMOVE:
623
break;
624
625
case AVAHI_BROWSER_ALL_FOR_NOW:
626
case AVAHI_BROWSER_CACHE_EXHAUSTED:
627
break;
628
}
629
}
630
631
/* Combines file name and path and returns the malloced new
632
string. some sane checks could/should be added */
633
static const char *combinepath(const char *first, const char *second){
634
size_t f_len = strlen(first);
635
size_t s_len = strlen(second);
636
char *tmp = malloc(f_len + s_len + 2);
637
if (tmp == NULL){
638
return NULL;
639
}
640
if(f_len > 0){
641
memcpy(tmp, first, f_len);
642
}
643
tmp[f_len] = '/';
644
if(s_len > 0){
645
memcpy(tmp + f_len + 1, second, s_len);
646
}
647
tmp[f_len + 1 + s_len] = '\0';
648
return tmp;
649
}
650
651
652
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
825
static void browse_callback(AvahiSServiceBrowser *b,
826
AvahiIfIndex interface,
827
AvahiProtocol protocol,
828
AvahiBrowserEvent event,
829
const char *name,
830
const char *type,
831
const char *domain,
832
AVAHI_GCC_UNUSED AvahiLookupResultFlags
833
flags,
834
AVAHI_GCC_UNUSED void* userdata){
835
assert(b);
836
837
/* Called whenever a new services becomes available on the LAN or
838
is removed from the LAN */
839
840
switch(event){
841
default:
842
case AVAHI_BROWSER_FAILURE:
843
844
fprintf(stderr, "(Avahi browser) %s\n",
845
avahi_strerror(avahi_server_errno(mc.server)));
846
avahi_simple_poll_quit(mc.simple_poll);
847
return;
848
849
case AVAHI_BROWSER_NEW:
850
/* We ignore the returned Avahi resolver object. In the callback
851
function we free it. If the Avahi server is terminated before
852
the callback function is called the Avahi server will free the
853
resolver for us. */
854
855
if(!(avahi_s_service_resolver_new(mc.server, interface,
856
protocol, name, type, domain,
857
AVAHI_PROTO_INET6, 0,
858
resolve_callback, NULL)))
859
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
860
name, avahi_strerror(avahi_server_errno(mc.server)));
861
break;
862
863
case AVAHI_BROWSER_REMOVE:
864
break;
865
866
case AVAHI_BROWSER_ALL_FOR_NOW:
867
case AVAHI_BROWSER_CACHE_EXHAUSTED:
868
if(debug){
869
fprintf(stderr, "No Mandos server found, still searching...\n");
870
}
871
break;
872
}
873
}
874
875
sig_atomic_t quit_now = 0;
876
877
static void handle_sigterm(__attribute__((unused)) int sig){
878
if(quit_now){
879
return;
880
}
881
quit_now = 1;
882
int old_errno = errno;
883
if(mc.simple_poll != NULL){
884
avahi_simple_poll_quit(mc.simple_poll);
885
}
886
errno = old_errno;
887
}
888
889
int main(int argc, char *argv[]){
890
AvahiSServiceBrowser *sb = NULL;
891
int error;
892
int ret;
893
intmax_t tmpmax;
894
int numchars;
895
int exitcode = EXIT_SUCCESS;
896
const char *interface = "eth0";
897
struct ifreq network;
898
int sd;
899
uid_t uid;
900
gid_t gid;
901
char *connect_to = NULL;
902
char tempdir[] = "/tmp/mandosXXXXXX";
903
bool tempdir_created = false;
904
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
905
const char *seckey = PATHDIR "/" SECKEY;
906
const char *pubkey = PATHDIR "/" PUBKEY;
907
908
/* Initialize Mandos context */
909
mc = (mandos_context){ .simple_poll = NULL, .server = NULL,
910
.dh_bits = 1024, .priority = "SECURE256"
911
":!CTYPE-X.509:+CTYPE-OPENPGP" };
912
bool gnutls_initialized = false;
913
bool gpgme_initialized = false;
914
double delay = 2.5;
915
916
struct sigaction old_sigterm_action;
917
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
918
919
{
920
struct argp_option options[] = {
921
{ .name = "debug", .key = 128,
922
.doc = "Debug mode", .group = 3 },
923
{ .name = "connect", .key = 'c',
924
.arg = "ADDRESS:PORT",
925
.doc = "Connect directly to a specific Mandos server",
926
.group = 1 },
927
{ .name = "interface", .key = 'i',
928
.arg = "NAME",
929
.doc = "Network interface that will be used to search for"
930
" Mandos servers",
931
.group = 1 },
932
{ .name = "seckey", .key = 's',
933
.arg = "FILE",
934
.doc = "OpenPGP secret key file base name",
935
.group = 1 },
936
{ .name = "pubkey", .key = 'p',
937
.arg = "FILE",
938
.doc = "OpenPGP public key file base name",
939
.group = 2 },
940
{ .name = "dh-bits", .key = 129,
941
.arg = "BITS",
942
.doc = "Bit length of the prime number used in the"
943
" Diffie-Hellman key exchange",
944
.group = 2 },
945
{ .name = "priority", .key = 130,
946
.arg = "STRING",
947
.doc = "GnuTLS priority string for the TLS handshake",
948
.group = 1 },
949
{ .name = "delay", .key = 131,
950
.arg = "SECONDS",
951
.doc = "Maximum delay to wait for interface startup",
952
.group = 2 },
953
{ .name = NULL }
954
};
955
956
error_t parse_opt(int key, char *arg,
957
struct argp_state *state){
958
switch(key){
959
case 128: /* --debug */
960
debug = true;
961
break;
962
case 'c': /* --connect */
963
connect_to = arg;
964
break;
965
case 'i': /* --interface */
966
interface = arg;
967
break;
968
case 's': /* --seckey */
969
seckey = arg;
970
break;
971
case 'p': /* --pubkey */
972
pubkey = arg;
973
break;
974
case 129: /* --dh-bits */
975
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
976
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
977
or arg[numchars] != '\0'){
978
fprintf(stderr, "Bad number of DH bits\n");
979
exit(EXIT_FAILURE);
980
}
981
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
982
break;
983
case 130: /* --priority */
984
mc.priority = arg;
985
break;
986
case 131: /* --delay */
987
ret = sscanf(arg, "%lf%n", &delay, &numchars);
988
if(ret < 1 or arg[numchars] != '\0'){
989
fprintf(stderr, "Bad delay\n");
990
exit(EXIT_FAILURE);
991
}
992
break;
993
case ARGP_KEY_ARG:
994
argp_usage(state);
995
case ARGP_KEY_END:
996
break;
997
default:
998
return ARGP_ERR_UNKNOWN;
999
}
1000
return 0;
1001
}
1002
1003
struct argp argp = { .options = options, .parser = parse_opt,
1004
.args_doc = "",
1005
.doc = "Mandos client -- Get and decrypt"
1006
" passwords from a Mandos server" };
1007
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1008
if(ret == ARGP_ERR_UNKNOWN){
1009
fprintf(stderr, "Unknown error while parsing arguments\n");
1010
exitcode = EXIT_FAILURE;
1011
goto end;
1012
}
1013
}
1014
1015
/* If the interface is down, bring it up */
1016
if(interface[0] != '\0'){
1017
#ifdef __linux__
1018
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1019
messages to mess up the prompt */
1020
ret = klogctl(8, NULL, 5);
1021
bool restore_loglevel = true;
1022
if(ret == -1){
1023
restore_loglevel = false;
1024
perror("klogctl");
1025
}
1026
#endif /* __linux__ */
1027
1028
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1029
if(sd < 0){
1030
perror("socket");
1031
exitcode = EXIT_FAILURE;
1032
#ifdef __linux__
1033
if(restore_loglevel){
1034
ret = klogctl(7, NULL, 0);
1035
if(ret == -1){
1036
perror("klogctl");
1037
}
1038
}
1039
#endif /* __linux__ */
1040
goto end;
1041
}
1042
strcpy(network.ifr_name, interface);
1043
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1044
if(ret == -1){
1045
perror("ioctl SIOCGIFFLAGS");
1046
#ifdef __linux__
1047
if(restore_loglevel){
1048
ret = klogctl(7, NULL, 0);
1049
if(ret == -1){
1050
perror("klogctl");
1051
}
1052
}
1053
#endif /* __linux__ */
1054
exitcode = EXIT_FAILURE;
1055
goto end;
1056
}
1057
if((network.ifr_flags & IFF_UP) == 0){
1058
network.ifr_flags |= IFF_UP;
1059
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1060
if(ret == -1){
1061
perror("ioctl SIOCSIFFLAGS");
1062
exitcode = EXIT_FAILURE;
1063
#ifdef __linux__
1064
if(restore_loglevel){
1065
ret = klogctl(7, NULL, 0);
1066
if(ret == -1){
1067
perror("klogctl");
1068
}
1069
}
1070
#endif /* __linux__ */
1071
goto end;
1072
}
1073
}
1074
/* sleep checking until interface is running */
1075
for(int i=0; i < delay * 4; i++){
1076
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1077
if(ret == -1){
1078
perror("ioctl SIOCGIFFLAGS");
1079
} else if(network.ifr_flags & IFF_RUNNING){
1080
break;
1081
}
1082
struct timespec sleeptime = { .tv_nsec = 250000000 };
1083
ret = nanosleep(&sleeptime, NULL);
1084
if(ret == -1 and errno != EINTR){
1085
perror("nanosleep");
1086
}
1087
}
1088
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1089
if(ret == -1){
1090
perror("close");
1091
}
1092
#ifdef __linux__
1093
if(restore_loglevel){
1094
/* Restores kernel loglevel to default */
1095
ret = klogctl(7, NULL, 0);
1096
if(ret == -1){
1097
perror("klogctl");
1098
}
1099
}
1100
#endif /* __linux__ */
1101
}
1102
1103
uid = getuid();
1104
gid = getgid();
1105
1106
errno = 0;
1107
setgid(gid);
1108
if(ret == -1){
1109
perror("setgid");
1110
}
1111
1112
ret = setuid(uid);
1113
if(ret == -1){
1114
perror("setuid");
1115
}
1116
1117
ret = init_gnutls_global(pubkey, seckey);
1118
if(ret == -1){
1119
fprintf(stderr, "init_gnutls_global failed\n");
1120
exitcode = EXIT_FAILURE;
1121
goto end;
1122
} else {
1123
gnutls_initialized = true;
1124
}
1125
1126
if(mkdtemp(tempdir) == NULL){
1127
perror("mkdtemp");
1128
goto end;
1129
}
1130
tempdir_created = true;
1131
1132
if(not init_gpgme(pubkey, seckey, tempdir)){
1133
fprintf(stderr, "init_gpgme failed\n");
1134
exitcode = EXIT_FAILURE;
1135
goto end;
1136
} else {
1137
gpgme_initialized = true;
1138
}
1139
1140
if(interface[0] != '\0'){
1141
if_index = (AvahiIfIndex) if_nametoindex(interface);
1142
if(if_index == 0){
1143
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1144
exitcode = EXIT_FAILURE;
1145
goto end;
1146
}
1147
}
1148
1149
if(connect_to != NULL){
1150
/* Connect directly, do not use Zeroconf */
1151
/* (Mainly meant for debugging) */
1152
char *address = strrchr(connect_to, ':');
1153
if(address == NULL){
1154
fprintf(stderr, "No colon in address\n");
1155
exitcode = EXIT_FAILURE;
1156
goto end;
1157
}
1158
uint16_t port;
1159
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1160
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1161
or address[numchars+1] != '\0'){
1162
fprintf(stderr, "Bad port number\n");
1163
exitcode = EXIT_FAILURE;
1164
goto end;
1165
}
1166
port = (uint16_t)tmpmax;
1167
*address = '\0';
1168
address = connect_to;
1169
/* Colon in address indicates IPv6 */
1170
int af;
1171
if(strchr(address, ':') != NULL){
1172
af = AF_INET6;
1173
} else {
1174
af = AF_INET;
1175
}
1176
ret = start_mandos_communication(address, port, if_index, af);
1177
if(ret < 0){
1178
exitcode = EXIT_FAILURE;
1179
} else {
1180
exitcode = EXIT_SUCCESS;
1181
}
1182
goto end;
1183
}
1184
1185
if(not debug){
1186
avahi_set_log_function(empty_log);
1187
}
1188
1189
/* Initialize the pseudo-RNG for Avahi */
1190
srand((unsigned int) time(NULL));
1191
1192
/* Allocate main Avahi loop object */
1193
mc.simple_poll = avahi_simple_poll_new();
1194
if(mc.simple_poll == NULL){
1195
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1196
exitcode = EXIT_FAILURE;
1197
goto end;
1198
}
1199
1200
{
653
1201
AvahiServerConfig config;
654
AvahiSServiceBrowser *sb = NULL;
655
int error;
656
int ret;
657
int returncode = EXIT_SUCCESS;
658
const char *interface = NULL;
659
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
660
char *connect_to = NULL;
661
662
while (true){
663
static struct option long_options[] = {
664
{"debug", no_argument, (int *)&debug, 1},
665
{"connect", required_argument, 0, 'C'},
666
{"interface", required_argument, 0, 'i'},
667
{"certdir", required_argument, 0, 'd'},
668
{"certkey", required_argument, 0, 'c'},
669
{"certfile", required_argument, 0, 'k'},
670
{0, 0, 0, 0} };
671
672
int option_index = 0;
673
ret = getopt_long (argc, argv, "i:", long_options,
674
&option_index);
675
676
if (ret == -1){
677
break;
678
}
679
680
switch(ret){
681
case 0:
682
break;
683
case 'i':
684
interface = optarg;
685
break;
686
case 'C':
687
connect_to = optarg;
688
break;
689
case 'd':
690
certdir = optarg;
691
break;
692
case 'c':
693
certfile = optarg;
694
break;
695
case 'k':
696
certkey = optarg;
697
break;
698
default:
699
exit(EXIT_FAILURE);
700
}
701
}
702
703
certfile = combinepath(certdir, certfile);
704
if (certfile == NULL){
705
perror("combinepath");
706
goto exit;
707
}
708
709
if(interface != NULL){
710
if_index = (AvahiIfIndex) if_nametoindex(interface);
711
if(if_index == 0){
712
fprintf(stderr, "No such interface: \"%s\"\n", interface);
713
exit(EXIT_FAILURE);
714
}
715
}
716
717
if(connect_to != NULL){
718
/* Connect directly, do not use Zeroconf */
719
/* (Mainly meant for debugging) */
720
char *address = strrchr(connect_to, ':');
721
if(address == NULL){
722
fprintf(stderr, "No colon in address\n");
723
exit(EXIT_FAILURE);
724
}
725
errno = 0;
726
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
727
if(errno){
728
perror("Bad port number");
729
exit(EXIT_FAILURE);
730
}
731
*address = '\0';
732
address = connect_to;
733
ret = start_mandos_communication(address, port, if_index);
734
if(ret < 0){
735
exit(EXIT_FAILURE);
736
} else {
737
exit(EXIT_SUCCESS);
738
}
739
}
740
741
certkey = combinepath(certdir, certkey);
742
if (certkey == NULL){
743
perror("combinepath");
744
goto exit;
745
}
746
747
if (not debug){
748
avahi_set_log_function(empty_log);
749
}
750
751
/* Initialize the psuedo-RNG */
752
srand((unsigned int) time(NULL));
753
754
/* Allocate main loop object */
755
if (!(simple_poll = avahi_simple_poll_new())) {
756
fprintf(stderr, "Failed to create simple poll object.\n");
757
758
goto exit;
759
}
760
761
/* Do not publish any local records */
1202
/* Do not publish any local Zeroconf records */
762
1203
avahi_server_config_init(&config);
763
1204
config.publish_hinfo = 0;
764
1205
config.publish_addresses = 0;
765
1206
config.publish_workstation = 0;
766
1207
config.publish_domain = 0;
767
1208
768
1209
/* Allocate a new server */
769
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
770
&config, NULL, NULL, &error);
771
772
/* Free the configuration data */
1210
mc.server = avahi_server_new(avahi_simple_poll_get
1211
(mc.simple_poll), &config, NULL,
1212
NULL, &error);
1213
1214
/* Free the Avahi configuration data */
773
1215
avahi_server_config_free(&config);
774
775
/* Check if creating the server object succeeded */
776
if (!server) {
777
fprintf(stderr, "Failed to create server: %s\n",
778
avahi_strerror(error));
779
returncode = EXIT_FAILURE;
780
goto exit;
781
}
782
783
/* Create the service browser */
784
sb = avahi_s_service_browser_new(server, if_index,
785
AVAHI_PROTO_INET6,
786
"_mandos._tcp", NULL, 0,
787
browse_callback, server);
788
if (!sb) {
789
fprintf(stderr, "Failed to create service browser: %s\n",
790
avahi_strerror(avahi_server_errno(server)));
791
returncode = EXIT_FAILURE;
792
goto exit;
793
}
794
795
/* Run the main loop */
796
797
if (debug){
798
fprintf(stderr, "Starting avahi loop search\n");
799
}
800
801
avahi_simple_poll_loop(simple_poll);
802
803
exit:
804
805
if (debug){
806
fprintf(stderr, "%s exiting\n", argv[0]);
807
}
808
809
/* Cleanup things */
810
if (sb)
811
avahi_s_service_browser_free(sb);
812
813
if (server)
814
avahi_server_free(server);
815
816
if (simple_poll)
817
avahi_simple_poll_free(simple_poll);
818
free(certfile);
819
free(certkey);
820
821
return returncode;
1216
}
1217
1218
/* Check if creating the Avahi server object succeeded */
1219
if(mc.server == NULL){
1220
fprintf(stderr, "Failed to create Avahi server: %s\n",
1221
avahi_strerror(error));
1222
exitcode = EXIT_FAILURE;
1223
goto end;
1224
}
1225
1226
/* Create the Avahi service browser */
1227
sb = avahi_s_service_browser_new(mc.server, if_index,
1228
AVAHI_PROTO_INET6, "_mandos._tcp",
1229
NULL, 0, browse_callback, NULL);
1230
if(sb == NULL){
1231
fprintf(stderr, "Failed to create service browser: %s\n",
1232
avahi_strerror(avahi_server_errno(mc.server)));
1233
exitcode = EXIT_FAILURE;
1234
goto end;
1235
}
1236
1237
sigemptyset(&sigterm_action.sa_mask);
1238
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1239
if(ret == -1){
1240
perror("sigaddset");
1241
exitcode = EXIT_FAILURE;
1242
goto end;
1243
}
1244
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1245
if(ret == -1){
1246
perror("sigaddset");
1247
exitcode = EXIT_FAILURE;
1248
goto end;
1249
}
1250
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1251
if(ret == -1){
1252
perror("sigaddset");
1253
exitcode = EXIT_FAILURE;
1254
goto end;
1255
}
1256
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1257
if(ret == -1){
1258
perror("sigaction");
1259
exitcode = EXIT_FAILURE;
1260
goto end;
1261
}
1262
1263
/* Run the main loop */
1264
1265
if(debug){
1266
fprintf(stderr, "Starting Avahi loop search\n");
1267
}
1268
1269
avahi_simple_poll_loop(mc.simple_poll);
1270
1271
end:
1272
1273
if(debug){
1274
fprintf(stderr, "%s exiting\n", argv[0]);
1275
}
1276
1277
/* Cleanup things */
1278
if(sb != NULL)
1279
avahi_s_service_browser_free(sb);
1280
1281
if(mc.server != NULL)
1282
avahi_server_free(mc.server);
1283
1284
if(mc.simple_poll != NULL)
1285
avahi_simple_poll_free(mc.simple_poll);
1286
1287
if(gnutls_initialized){
1288
gnutls_certificate_free_credentials(mc.cred);
1289
gnutls_global_deinit();
1290
gnutls_dh_params_deinit(mc.dh_params);
1291
}
1292
1293
if(gpgme_initialized){
1294
gpgme_release(mc.ctx);
1295
}
1296
1297
/* Removes the temp directory used by GPGME */
1298
if(tempdir_created){
1299
DIR *d;
1300
struct dirent *direntry;
1301
d = opendir(tempdir);
1302
if(d == NULL){
1303
if(errno != ENOENT){
1304
perror("opendir");
1305
}
1306
} else {
1307
while(true){
1308
direntry = readdir(d);
1309
if(direntry == NULL){
1310
break;
1311
}
1312
/* Skip "." and ".." */
1313
if(direntry->d_name[0] == '.'
1314
and (direntry->d_name[1] == '\0'
1315
or (direntry->d_name[1] == '.'
1316
and direntry->d_name[2] == '\0'))){
1317
continue;
1318
}
1319
char *fullname = NULL;
1320
ret = asprintf(&fullname, "%s/%s", tempdir,
1321
direntry->d_name);
1322
if(ret < 0){
1323
perror("asprintf");
1324
continue;
1325
}
1326
ret = remove(fullname);
1327
if(ret == -1){
1328
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1329
strerror(errno));
1330
}
1331
free(fullname);
1332
}
1333
closedir(d);
1334
}
1335
ret = rmdir(tempdir);
1336
if(ret == -1 and errno != ENOENT){
1337
perror("rmdir");
1338
}
1339
}
1340
1341
return exitcode;
822
1342
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0