To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 366
- compare with another revision
- download diff
- download tarball
- view history from revision 366
- Committer: Teddy Hogeborn
- Date: 2009-09-08 06:28:20 UTC
- Revision ID: teddy@fukt.bsnet.se-20090908062820-xgkdkrnvuze9vc72
* debian/mandos-client.README.Debian: Improved wording and formatting.
Updated location of nfsroot.txt.
* debian/mandos.README.Debian: Improved wording and formatting.
Updated location of nfsroot.txt.
* debian/mandos.README.Debian: Improved wording and formatting.
- files added:
- .bzr-builddeb
- debian
- debian/po
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- server.conf => mandos.conf
- plugbasedclient.c => plugin-runner.c
- plugins.d/mandosclient.c => plugins.d/mandos-client.c
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos client - get and decrypt data from a Mandos server
3
* Mandos-client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
13
14
*
14
15
* This program is free software: you can redistribute it and/or
15
16
* modify it under the terms of the GNU General Public License as
29
30
*/
30
31
31
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
32
34
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
33
37
#define _FILE_OFFSET_BITS 64
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
41
#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
42
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
90
/* Avahi */
91
/* All Avahi types, constants and functions
92
Avahi*, avahi_*,
93
AVAHI_* */
43
94
#include <avahi-core/core.h>
44
95
#include <avahi-core/lookup.h>
45
96
#include <avahi-core/log.h>
47
98
#include <avahi-common/malloc.h>
48
99
#include <avahi-common/error.h>
49
100
50
//mandos client part
51
#include <sys/types.h> /* socket(), inet_pton() */
52
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
struct in6_addr, inet_pton() */
54
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
55
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
56
57
#include <unistd.h> /* close() */
58
#include <netinet/in.h>
59
#include <stdbool.h> /* true */
60
#include <string.h> /* memset */
61
#include <arpa/inet.h> /* inet_pton() */
62
#include <iso646.h> /* not */
63
64
// gpgme
65
#include <errno.h> /* perror() */
66
#include <gpgme.h>
67
68
// getopt_long
69
#include <getopt.h>
101
/* GnuTLS */
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
103
functions:
104
gnutls_*
105
init_gnutls_session(),
106
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
110
111
/* GPGME */
112
#include <gpgme.h> /* All GPGME types, constants and
113
functions:
114
gpgme_*
115
GPGME_PROTOCOL_OpenPGP,
116
GPG_ERR_NO_* */
70
117
71
118
#define BUFFER_SIZE 256
72
119
73
static const char *keydir = "/conf/conf.d/mandos";
74
static const char *pubkeyfile = "pubkey.txt";
75
static const char *seckeyfile = "seckey.txt";
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
76
123
77
124
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
78
128
79
/* Used for passing in values through all the callback functions */
129
/* Used for passing in values through the Avahi callback functions */
80
130
typedef struct {
81
131
AvahiSimplePoll *simple_poll;
82
132
AvahiServer *server;
83
133
gnutls_certificate_credentials_t cred;
84
134
unsigned int dh_bits;
135
gnutls_dh_params_t dh_params;
85
136
const char *priority;
137
gpgme_ctx_t ctx;
86
138
} mandos_context;
87
139
88
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
89
char **new_packet,
90
const char *homedir){
91
gpgme_data_t dh_crypto, dh_plain;
92
gpgme_ctx_t ctx;
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
/*
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
* bytes. "buffer_capacity" is how much is currently allocated,
148
* "buffer_length" is how much is already used.
149
*/
150
size_t incbuffer(char **buffer, size_t buffer_length,
151
size_t buffer_capacity){
152
if(buffer_length + BUFFER_SIZE > buffer_capacity){
153
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
154
if(buffer == NULL){
155
return 0;
156
}
157
buffer_capacity += BUFFER_SIZE;
158
}
159
return buffer_capacity;
160
}
161
162
/*
163
* Initialize GPGME.
164
*/
165
static bool init_gpgme(const char *seckey,
166
const char *pubkey, const char *tempdir){
93
167
gpgme_error_t rc;
94
ssize_t ret;
95
ssize_t new_packet_capacity = 0;
96
ssize_t new_packet_length = 0;
97
168
gpgme_engine_info_t engine_info;
98
99
if (debug){
100
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
169
170
171
/*
172
* Helper function to insert pub and seckey to the engine keyring.
173
*/
174
bool import_key(const char *filename){
175
int ret;
176
int fd;
177
gpgme_data_t pgp_data;
178
179
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
180
if(fd == -1){
181
perror("open");
182
return false;
183
}
184
185
rc = gpgme_data_new_from_fd(&pgp_data, fd);
186
if(rc != GPG_ERR_NO_ERROR){
187
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
188
gpgme_strsource(rc), gpgme_strerror(rc));
189
return false;
190
}
191
192
rc = gpgme_op_import(mc.ctx, pgp_data);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
196
return false;
197
}
198
199
ret = (int)TEMP_FAILURE_RETRY(close(fd));
200
if(ret == -1){
201
perror("close");
202
}
203
gpgme_data_release(pgp_data);
204
return true;
205
}
206
207
if(debug){
208
fprintf(stderr, "Initializing GPGME\n");
101
209
}
102
210
103
211
/* Init GPGME */
104
212
gpgme_check_version(NULL);
105
213
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
106
if (rc != GPG_ERR_NO_ERROR){
214
if(rc != GPG_ERR_NO_ERROR){
107
215
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
108
216
gpgme_strsource(rc), gpgme_strerror(rc));
109
return -1;
217
return false;
110
218
}
111
219
112
/* Set GPGME home directory */
113
rc = gpgme_get_engine_info (&engine_info);
114
if (rc != GPG_ERR_NO_ERROR){
220
/* Set GPGME home directory for the OpenPGP engine only */
221
rc = gpgme_get_engine_info(&engine_info);
222
if(rc != GPG_ERR_NO_ERROR){
115
223
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
116
224
gpgme_strsource(rc), gpgme_strerror(rc));
117
return -1;
225
return false;
118
226
}
119
227
while(engine_info != NULL){
120
228
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
121
229
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
122
engine_info->file_name, homedir);
230
engine_info->file_name, tempdir);
123
231
break;
124
232
}
125
233
engine_info = engine_info->next;
126
234
}
127
235
if(engine_info == NULL){
128
fprintf(stderr, "Could not set home dir to %s\n", homedir);
129
return -1;
130
}
131
132
/* Create new GPGME data buffer from packet buffer */
133
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
134
if (rc != GPG_ERR_NO_ERROR){
236
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
237
return false;
238
}
239
240
/* Create new GPGME "context" */
241
rc = gpgme_new(&(mc.ctx));
242
if(rc != GPG_ERR_NO_ERROR){
243
fprintf(stderr, "bad gpgme_new: %s: %s\n",
244
gpgme_strsource(rc), gpgme_strerror(rc));
245
return false;
246
}
247
248
if(not import_key(pubkey) or not import_key(seckey)){
249
return false;
250
}
251
252
return true;
253
}
254
255
/*
256
* Decrypt OpenPGP data.
257
* Returns -1 on error
258
*/
259
static ssize_t pgp_packet_decrypt(const char *cryptotext,
260
size_t crypto_size,
261
char **plaintext){
262
gpgme_data_t dh_crypto, dh_plain;
263
gpgme_error_t rc;
264
ssize_t ret;
265
size_t plaintext_capacity = 0;
266
ssize_t plaintext_length = 0;
267
268
if(debug){
269
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
270
}
271
272
/* Create new GPGME data buffer from memory cryptotext */
273
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
274
0);
275
if(rc != GPG_ERR_NO_ERROR){
135
276
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
136
277
gpgme_strsource(rc), gpgme_strerror(rc));
137
278
return -1;
139
280
140
281
/* Create new empty GPGME data buffer for the plaintext */
141
282
rc = gpgme_data_new(&dh_plain);
142
if (rc != GPG_ERR_NO_ERROR){
283
if(rc != GPG_ERR_NO_ERROR){
143
284
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
144
285
gpgme_strsource(rc), gpgme_strerror(rc));
145
return -1;
146
}
147
148
/* Create new GPGME "context" */
149
rc = gpgme_new(&ctx);
150
if (rc != GPG_ERR_NO_ERROR){
151
fprintf(stderr, "bad gpgme_new: %s: %s\n",
152
gpgme_strsource(rc), gpgme_strerror(rc));
153
return -1;
154
}
155
156
/* Decrypt data from the FILE pointer to the plaintext data
157
buffer */
158
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
159
if (rc != GPG_ERR_NO_ERROR){
286
gpgme_data_release(dh_crypto);
287
return -1;
288
}
289
290
/* Decrypt data from the cryptotext data buffer to the plaintext
291
data buffer */
292
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
293
if(rc != GPG_ERR_NO_ERROR){
160
294
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
161
295
gpgme_strsource(rc), gpgme_strerror(rc));
162
return -1;
163
}
164
165
if(debug){
166
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
167
}
168
169
if (debug){
170
gpgme_decrypt_result_t result;
171
result = gpgme_op_decrypt_result(ctx);
172
if (result == NULL){
173
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
174
} else {
175
fprintf(stderr, "Unsupported algorithm: %s\n",
176
result->unsupported_algorithm);
177
fprintf(stderr, "Wrong key usage: %d\n",
178
result->wrong_key_usage);
179
if(result->file_name != NULL){
180
fprintf(stderr, "File name: %s\n", result->file_name);
181
}
182
gpgme_recipient_t recipient;
183
recipient = result->recipients;
184
if(recipient){
296
plaintext_length = -1;
297
if(debug){
298
gpgme_decrypt_result_t result;
299
result = gpgme_op_decrypt_result(mc.ctx);
300
if(result == NULL){
301
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
302
} else {
303
fprintf(stderr, "Unsupported algorithm: %s\n",
304
result->unsupported_algorithm);
305
fprintf(stderr, "Wrong key usage: %u\n",
306
result->wrong_key_usage);
307
if(result->file_name != NULL){
308
fprintf(stderr, "File name: %s\n", result->file_name);
309
}
310
gpgme_recipient_t recipient;
311
recipient = result->recipients;
185
312
while(recipient != NULL){
186
313
fprintf(stderr, "Public key algorithm: %s\n",
187
314
gpgme_pubkey_algo_name(recipient->pubkey_algo));
193
320
}
194
321
}
195
322
}
323
goto decrypt_end;
196
324
}
197
325
198
/* Delete the GPGME FILE pointer cryptotext data buffer */
199
gpgme_data_release(dh_crypto);
326
if(debug){
327
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
328
}
200
329
201
330
/* Seek back to the beginning of the GPGME plaintext data buffer */
202
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
203
perror("pgpme_data_seek");
331
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
332
perror("gpgme_data_seek");
333
plaintext_length = -1;
334
goto decrypt_end;
204
335
}
205
336
206
*new_packet = 0;
337
*plaintext = NULL;
207
338
while(true){
208
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
209
*new_packet = realloc(*new_packet,
210
(unsigned int)new_packet_capacity
211
+ BUFFER_SIZE);
212
if (*new_packet == NULL){
213
perror("realloc");
214
return -1;
215
}
216
new_packet_capacity += BUFFER_SIZE;
339
plaintext_capacity = incbuffer(plaintext,
340
(size_t)plaintext_length,
341
plaintext_capacity);
342
if(plaintext_capacity == 0){
343
perror("incbuffer");
344
plaintext_length = -1;
345
goto decrypt_end;
217
346
}
218
347
219
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
348
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
220
349
BUFFER_SIZE);
221
350
/* Print the data, if any */
222
if (ret == 0){
351
if(ret == 0){
352
/* EOF */
223
353
break;
224
354
}
225
355
if(ret < 0){
226
356
perror("gpgme_data_read");
227
return -1;
228
}
229
new_packet_length += ret;
230
}
231
232
/* FIXME: check characters before printing to screen so to not print
233
terminal control characters */
234
/* if(debug){ */
235
/* fprintf(stderr, "decrypted password is: "); */
236
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
237
/* fprintf(stderr, "\n"); */
238
/* } */
357
plaintext_length = -1;
358
goto decrypt_end;
359
}
360
plaintext_length += ret;
361
}
362
363
if(debug){
364
fprintf(stderr, "Decrypted password is: ");
365
for(ssize_t i = 0; i < plaintext_length; i++){
366
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
367
}
368
fprintf(stderr, "\n");
369
}
370
371
decrypt_end:
372
373
/* Delete the GPGME cryptotext data buffer */
374
gpgme_data_release(dh_crypto);
239
375
240
376
/* Delete the GPGME plaintext data buffer */
241
377
gpgme_data_release(dh_plain);
242
return new_packet_length;
378
return plaintext_length;
243
379
}
244
380
245
static const char * safer_gnutls_strerror (int value) {
246
const char *ret = gnutls_strerror (value);
247
if (ret == NULL)
381
static const char * safer_gnutls_strerror(int value){
382
const char *ret = gnutls_strerror(value); /* Spurious warning from
383
-Wunreachable-code */
384
if(ret == NULL)
248
385
ret = "(unknown)";
249
386
return ret;
250
387
}
251
388
389
/* GnuTLS log function callback */
252
390
static void debuggnutls(__attribute__((unused)) int level,
253
391
const char* string){
254
fprintf(stderr, "%s", string);
392
fprintf(stderr, "GnuTLS: %s", string);
255
393
}
256
394
257
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
258
gnutls_dh_params_t *dh_params){
259
const char *err;
395
static int init_gnutls_global(const char *pubkeyfilename,
396
const char *seckeyfilename){
260
397
int ret;
261
398
262
399
if(debug){
263
400
fprintf(stderr, "Initializing GnuTLS\n");
264
401
}
265
266
if ((ret = gnutls_global_init ())
267
!= GNUTLS_E_SUCCESS) {
268
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
402
403
ret = gnutls_global_init();
404
if(ret != GNUTLS_E_SUCCESS){
405
fprintf(stderr, "GnuTLS global_init: %s\n",
406
safer_gnutls_strerror(ret));
269
407
return -1;
270
408
}
271
409
272
if (debug){
410
if(debug){
411
/* "Use a log level over 10 to enable all debugging options."
412
* - GnuTLS manual
413
*/
273
414
gnutls_global_set_log_level(11);
274
415
gnutls_global_set_log_function(debuggnutls);
275
416
}
276
417
277
/* openpgp credentials */
278
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
279
!= GNUTLS_E_SUCCESS) {
280
fprintf (stderr, "memory error: %s\n",
281
safer_gnutls_strerror(ret));
418
/* OpenPGP credentials */
419
gnutls_certificate_allocate_credentials(&mc.cred);
420
if(ret != GNUTLS_E_SUCCESS){
421
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
422
from
423
-Wunreachable-code
424
*/
425
safer_gnutls_strerror(ret));
426
gnutls_global_deinit();
282
427
return -1;
283
428
}
284
429
285
430
if(debug){
286
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
287
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
288
seckeyfile);
431
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
432
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
433
seckeyfilename);
289
434
}
290
435
291
436
ret = gnutls_certificate_set_openpgp_key_file
292
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
293
if (ret != GNUTLS_E_SUCCESS) {
294
fprintf
295
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
296
" '%s')\n",
297
ret, pubkeyfile, seckeyfile);
298
fprintf(stdout, "The Error is: %s\n",
299
safer_gnutls_strerror(ret));
300
return -1;
301
}
302
303
//GnuTLS server initialization
304
if ((ret = gnutls_dh_params_init(dh_params))
305
!= GNUTLS_E_SUCCESS) {
306
fprintf (stderr, "Error in dh parameter initialization: %s\n",
307
safer_gnutls_strerror(ret));
308
return -1;
309
}
310
311
if ((ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits))
312
!= GNUTLS_E_SUCCESS) {
313
fprintf (stderr, "Error in prime generation: %s\n",
314
safer_gnutls_strerror(ret));
315
return -1;
316
}
317
318
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
319
320
// GnuTLS session creation
321
if ((ret = gnutls_init(session, GNUTLS_SERVER))
322
!= GNUTLS_E_SUCCESS){
437
(mc.cred, pubkeyfilename, seckeyfilename,
438
GNUTLS_OPENPGP_FMT_BASE64);
439
if(ret != GNUTLS_E_SUCCESS){
440
fprintf(stderr,
441
"Error[%d] while reading the OpenPGP key pair ('%s',"
442
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
443
fprintf(stderr, "The GnuTLS error is: %s\n",
444
safer_gnutls_strerror(ret));
445
goto globalfail;
446
}
447
448
/* GnuTLS server initialization */
449
ret = gnutls_dh_params_init(&mc.dh_params);
450
if(ret != GNUTLS_E_SUCCESS){
451
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
452
" %s\n", safer_gnutls_strerror(ret));
453
goto globalfail;
454
}
455
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
456
if(ret != GNUTLS_E_SUCCESS){
457
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
458
safer_gnutls_strerror(ret));
459
goto globalfail;
460
}
461
462
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
463
464
return 0;
465
466
globalfail:
467
468
gnutls_certificate_free_credentials(mc.cred);
469
gnutls_global_deinit();
470
gnutls_dh_params_deinit(mc.dh_params);
471
return -1;
472
}
473
474
static int init_gnutls_session(gnutls_session_t *session){
475
int ret;
476
/* GnuTLS session creation */
477
ret = gnutls_init(session, GNUTLS_SERVER);
478
if(ret != GNUTLS_E_SUCCESS){
323
479
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
324
480
safer_gnutls_strerror(ret));
325
481
}
326
482
327
if ((ret = gnutls_priority_set_direct(*session, mc->priority, &err))
328
!= GNUTLS_E_SUCCESS) {
329
fprintf(stderr, "Syntax error at: %s\n", err);
330
fprintf(stderr, "GnuTLS error: %s\n",
331
safer_gnutls_strerror(ret));
332
return -1;
483
{
484
const char *err;
485
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
486
if(ret != GNUTLS_E_SUCCESS){
487
fprintf(stderr, "Syntax error at: %s\n", err);
488
fprintf(stderr, "GnuTLS error: %s\n",
489
safer_gnutls_strerror(ret));
490
gnutls_deinit(*session);
491
return -1;
492
}
333
493
}
334
494
335
if ((ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
336
mc->cred))
337
!= GNUTLS_E_SUCCESS) {
338
fprintf(stderr, "Error setting a credentials set: %s\n",
495
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
496
mc.cred);
497
if(ret != GNUTLS_E_SUCCESS){
498
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
339
499
safer_gnutls_strerror(ret));
500
gnutls_deinit(*session);
340
501
return -1;
341
502
}
342
503
343
504
/* ignore client certificate if any. */
344
gnutls_certificate_server_set_request (*session,
345
GNUTLS_CERT_IGNORE);
505
gnutls_certificate_server_set_request(*session,
506
GNUTLS_CERT_IGNORE);
346
507
347
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
508
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
348
509
349
510
return 0;
350
511
}
351
512
513
/* Avahi log function callback */
352
514
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
353
515
__attribute__((unused)) const char *txt){}
354
516
517
sig_atomic_t quit_now = 0;
518
int signal_received = 0;
519
520
/* Called when a Mandos server is found */
355
521
static int start_mandos_communication(const char *ip, uint16_t port,
356
522
AvahiIfIndex if_index,
357
mandos_context *mc){
358
int ret, tcp_sd;
359
struct sockaddr_in6 to;
523
int af){
524
int ret, tcp_sd = -1;
525
ssize_t sret;
526
union {
527
struct sockaddr_in in;
528
struct sockaddr_in6 in6;
529
} to;
360
530
char *buffer = NULL;
361
531
char *decrypted_buffer;
362
532
size_t buffer_length = 0;
363
533
size_t buffer_capacity = 0;
364
ssize_t decrypted_buffer_size;
365
size_t written = 0;
534
size_t written;
366
535
int retval = 0;
367
char interface[IF_NAMESIZE];
368
536
gnutls_session_t session;
369
gnutls_dh_params_t dh_params;
537
int pf; /* Protocol family */
538
539
if(quit_now){
540
return -1;
541
}
542
543
switch(af){
544
case AF_INET6:
545
pf = PF_INET6;
546
break;
547
case AF_INET:
548
pf = PF_INET;
549
break;
550
default:
551
fprintf(stderr, "Bad address family: %d\n", af);
552
return -1;
553
}
554
555
ret = init_gnutls_session(&session);
556
if(ret != 0){
557
return -1;
558
}
370
559
371
560
if(debug){
372
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
373
ip, port);
561
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
562
"\n", ip, port);
374
563
}
375
564
376
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
377
if(tcp_sd < 0) {
565
tcp_sd = socket(pf, SOCK_STREAM, 0);
566
if(tcp_sd < 0){
378
567
perror("socket");
379
return -1;
380
}
381
382
if(debug){
383
if(if_indextoname((unsigned int)if_index, interface) == NULL){
384
perror("if_indextoname");
385
return -1;
386
}
387
fprintf(stderr, "Binding to interface %s\n", interface);
388
}
389
390
memset(&to,0,sizeof(to)); /* Spurious warning */
391
to.sin6_family = AF_INET6;
392
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
393
if (ret < 0 ){
568
retval = -1;
569
goto mandos_end;
570
}
571
572
if(quit_now){
573
goto mandos_end;
574
}
575
576
memset(&to, 0, sizeof(to));
577
if(af == AF_INET6){
578
to.in6.sin6_family = (sa_family_t)af;
579
ret = inet_pton(af, ip, &to.in6.sin6_addr);
580
} else { /* IPv4 */
581
to.in.sin_family = (sa_family_t)af;
582
ret = inet_pton(af, ip, &to.in.sin_addr);
583
}
584
if(ret < 0 ){
394
585
perror("inet_pton");
395
return -1;
586
retval = -1;
587
goto mandos_end;
396
588
}
397
589
if(ret == 0){
398
590
fprintf(stderr, "Bad address: %s\n", ip);
399
return -1;
400
}
401
to.sin6_port = htons(port); /* Spurious warning */
591
retval = -1;
592
goto mandos_end;
593
}
594
if(af == AF_INET6){
595
to.in6.sin6_port = htons(port); /* Spurious warnings from
596
-Wconversion and
597
-Wunreachable-code */
598
599
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
600
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
601
-Wunreachable-code*/
602
if(if_index == AVAHI_IF_UNSPEC){
603
fprintf(stderr, "An IPv6 link-local address is incomplete"
604
" without a network interface\n");
605
retval = -1;
606
goto mandos_end;
607
}
608
/* Set the network interface number as scope */
609
to.in6.sin6_scope_id = (uint32_t)if_index;
610
}
611
} else {
612
to.in.sin_port = htons(port); /* Spurious warnings from
613
-Wconversion and
614
-Wunreachable-code */
615
}
402
616
403
to.sin6_scope_id = (uint32_t)if_index;
617
if(quit_now){
618
goto mandos_end;
619
}
404
620
405
621
if(debug){
406
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
407
char addrstr[INET6_ADDRSTRLEN] = "";
408
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
409
sizeof(addrstr)) == NULL){
622
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
623
char interface[IF_NAMESIZE];
624
if(if_indextoname((unsigned int)if_index, interface) == NULL){
625
perror("if_indextoname");
626
} else {
627
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
628
ip, interface, port);
629
}
630
} else {
631
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
632
port);
633
}
634
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
635
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
636
const char *pcret;
637
if(af == AF_INET6){
638
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
639
sizeof(addrstr));
640
} else {
641
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
642
sizeof(addrstr));
643
}
644
if(pcret == NULL){
410
645
perror("inet_ntop");
411
646
} else {
412
647
if(strcmp(addrstr, ip) != 0){
415
650
}
416
651
}
417
652
418
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
419
if (ret < 0){
653
if(quit_now){
654
goto mandos_end;
655
}
656
657
if(af == AF_INET6){
658
ret = connect(tcp_sd, &to.in6, sizeof(to));
659
} else {
660
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
661
}
662
if(ret < 0){
420
663
perror("connect");
421
return -1;
422
}
423
424
ret = initgnutls (mc, &session, &dh_params);
425
if (ret != 0){
426
664
retval = -1;
427
return -1;
428
}
429
430
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
665
goto mandos_end;
666
}
667
668
if(quit_now){
669
goto mandos_end;
670
}
671
672
const char *out = mandos_protocol_version;
673
written = 0;
674
while(true){
675
size_t out_size = strlen(out);
676
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
677
out_size - written));
678
if(ret == -1){
679
perror("write");
680
retval = -1;
681
goto mandos_end;
682
}
683
written += (size_t)ret;
684
if(written < out_size){
685
continue;
686
} else {
687
if(out == mandos_protocol_version){
688
written = 0;
689
out = "\r\n";
690
} else {
691
break;
692
}
693
}
694
695
if(quit_now){
696
goto mandos_end;
697
}
698
}
431
699
432
700
if(debug){
433
701
fprintf(stderr, "Establishing TLS session with %s\n", ip);
434
702
}
435
703
436
ret = gnutls_handshake (session);
437
438
if (ret != GNUTLS_E_SUCCESS){
704
if(quit_now){
705
goto mandos_end;
706
}
707
708
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
709
710
if(quit_now){
711
goto mandos_end;
712
}
713
714
do {
715
ret = gnutls_handshake(session);
716
if(quit_now){
717
goto mandos_end;
718
}
719
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
720
721
if(ret != GNUTLS_E_SUCCESS){
439
722
if(debug){
440
fprintf(stderr, "\n*** Handshake failed ***\n");
441
gnutls_perror (ret);
723
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
724
gnutls_perror(ret);
442
725
}
443
726
retval = -1;
444
goto exit;
727
goto mandos_end;
445
728
}
446
729
447
//Retrieve OpenPGP packet that contains the wanted password
730
/* Read OpenPGP packet that contains the wanted password */
448
731
449
732
if(debug){
450
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
733
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
451
734
ip);
452
735
}
453
736
454
737
while(true){
455
if (buffer_length + BUFFER_SIZE > buffer_capacity){
456
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
457
if (buffer == NULL){
458
perror("realloc");
459
goto exit;
460
}
461
buffer_capacity += BUFFER_SIZE;
462
}
463
464
ret = gnutls_record_recv(session, buffer+buffer_length,
465
BUFFER_SIZE);
466
if (ret == 0){
738
739
if(quit_now){
740
goto mandos_end;
741
}
742
743
buffer_capacity = incbuffer(&buffer, buffer_length,
744
buffer_capacity);
745
if(buffer_capacity == 0){
746
perror("incbuffer");
747
retval = -1;
748
goto mandos_end;
749
}
750
751
if(quit_now){
752
goto mandos_end;
753
}
754
755
sret = gnutls_record_recv(session, buffer+buffer_length,
756
BUFFER_SIZE);
757
if(sret == 0){
467
758
break;
468
759
}
469
if (ret < 0){
470
switch(ret){
760
if(sret < 0){
761
switch(sret){
471
762
case GNUTLS_E_INTERRUPTED:
472
763
case GNUTLS_E_AGAIN:
473
764
break;
474
765
case GNUTLS_E_REHANDSHAKE:
475
ret = gnutls_handshake (session);
476
if (ret < 0){
477
fprintf(stderr, "\n*** Handshake failed ***\n");
478
gnutls_perror (ret);
766
do {
767
ret = gnutls_handshake(session);
768
769
if(quit_now){
770
goto mandos_end;
771
}
772
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
773
if(ret < 0){
774
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
775
gnutls_perror(ret);
479
776
retval = -1;
480
goto exit;
777
goto mandos_end;
481
778
}
482
779
break;
483
780
default:
484
781
fprintf(stderr, "Unknown error while reading data from"
485
" encrypted session with mandos server\n");
782
" encrypted session with Mandos server\n");
486
783
retval = -1;
487
gnutls_bye (session, GNUTLS_SHUT_RDWR);
488
goto exit;
784
gnutls_bye(session, GNUTLS_SHUT_RDWR);
785
goto mandos_end;
489
786
}
490
787
} else {
491
buffer_length += (size_t) ret;
788
buffer_length += (size_t) sret;
492
789
}
493
790
}
494
791
495
if (buffer_length > 0){
792
if(debug){
793
fprintf(stderr, "Closing TLS session\n");
794
}
795
796
if(quit_now){
797
goto mandos_end;
798
}
799
800
gnutls_bye(session, GNUTLS_SHUT_RDWR);
801
802
if(quit_now){
803
goto mandos_end;
804
}
805
806
if(buffer_length > 0){
807
ssize_t decrypted_buffer_size;
496
808
decrypted_buffer_size = pgp_packet_decrypt(buffer,
497
809
buffer_length,
498
&decrypted_buffer,
499
keydir);
500
if (decrypted_buffer_size >= 0){
810
&decrypted_buffer);
811
if(decrypted_buffer_size >= 0){
812
813
written = 0;
501
814
while(written < (size_t) decrypted_buffer_size){
502
ret = (int)fwrite (decrypted_buffer + written, 1,
503
(size_t)decrypted_buffer_size - written,
504
stdout);
815
if(quit_now){
816
goto mandos_end;
817
}
818
819
ret = (int)fwrite(decrypted_buffer + written, 1,
820
(size_t)decrypted_buffer_size - written,
821
stdout);
505
822
if(ret == 0 and ferror(stdout)){
506
823
if(debug){
507
824
fprintf(stderr, "Error writing encrypted data: %s\n",
516
833
} else {
517
834
retval = -1;
518
835
}
519
}
520
521
//shutdown procedure
522
523
if(debug){
524
fprintf(stderr, "Closing TLS session\n");
525
}
526
836
} else {
837
retval = -1;
838
}
839
840
/* Shutdown procedure */
841
842
mandos_end:
527
843
free(buffer);
528
gnutls_bye (session, GNUTLS_SHUT_RDWR);
529
exit:
530
close(tcp_sd);
531
gnutls_deinit (session);
532
gnutls_certificate_free_credentials (mc->cred);
533
gnutls_global_deinit ();
844
if(tcp_sd >= 0){
845
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
846
}
847
if(ret == -1){
848
perror("close");
849
}
850
gnutls_deinit(session);
851
if(quit_now){
852
retval = -1;
853
}
534
854
return retval;
535
855
}
536
856
537
static void resolve_callback( AvahiSServiceResolver *r,
538
AvahiIfIndex interface,
539
AVAHI_GCC_UNUSED AvahiProtocol protocol,
540
AvahiResolverEvent event,
541
const char *name,
542
const char *type,
543
const char *domain,
544
const char *host_name,
545
const AvahiAddress *address,
546
uint16_t port,
547
AVAHI_GCC_UNUSED AvahiStringList *txt,
548
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
549
void* userdata) {
550
mandos_context *mc = userdata;
551
assert(r); /* Spurious warning */
857
static void resolve_callback(AvahiSServiceResolver *r,
858
AvahiIfIndex interface,
859
AvahiProtocol proto,
860
AvahiResolverEvent event,
861
const char *name,
862
const char *type,
863
const char *domain,
864
const char *host_name,
865
const AvahiAddress *address,
866
uint16_t port,
867
AVAHI_GCC_UNUSED AvahiStringList *txt,
868
AVAHI_GCC_UNUSED AvahiLookupResultFlags
869
flags,
870
AVAHI_GCC_UNUSED void* userdata){
871
assert(r);
552
872
553
873
/* Called whenever a service has been resolved successfully or
554
874
timed out */
555
875
556
switch (event) {
876
if(quit_now){
877
return;
878
}
879
880
switch(event){
557
881
default:
558
882
case AVAHI_RESOLVER_FAILURE:
559
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
560
" type '%s' in domain '%s': %s\n", name, type, domain,
561
avahi_strerror(avahi_server_errno(mc->server)));
883
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
884
" of type '%s' in domain '%s': %s\n", name, type, domain,
885
avahi_strerror(avahi_server_errno(mc.server)));
562
886
break;
563
887
564
888
case AVAHI_RESOLVER_FOUND:
566
890
char ip[AVAHI_ADDRESS_STR_MAX];
567
891
avahi_address_snprint(ip, sizeof(ip), address);
568
892
if(debug){
569
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
570
" port %d\n", name, host_name, ip, port);
893
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
894
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
895
ip, (intmax_t)interface, port);
571
896
}
572
int ret = start_mandos_communication(ip, port, interface, mc);
573
if (ret == 0){
574
exit(EXIT_SUCCESS);
897
int ret = start_mandos_communication(ip, port, interface,
898
avahi_proto_to_af(proto));
899
if(ret == 0){
900
avahi_simple_poll_quit(mc.simple_poll);
575
901
}
576
902
}
577
903
}
578
904
avahi_s_service_resolver_free(r);
579
905
}
580
906
581
static void browse_callback( AvahiSServiceBrowser *b,
582
AvahiIfIndex interface,
583
AvahiProtocol protocol,
584
AvahiBrowserEvent event,
585
const char *name,
586
const char *type,
587
const char *domain,
588
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
589
void* userdata) {
590
mandos_context *mc = userdata;
591
assert(b); /* Spurious warning */
907
static void browse_callback(AvahiSServiceBrowser *b,
908
AvahiIfIndex interface,
909
AvahiProtocol protocol,
910
AvahiBrowserEvent event,
911
const char *name,
912
const char *type,
913
const char *domain,
914
AVAHI_GCC_UNUSED AvahiLookupResultFlags
915
flags,
916
AVAHI_GCC_UNUSED void* userdata){
917
assert(b);
592
918
593
919
/* Called whenever a new services becomes available on the LAN or
594
920
is removed from the LAN */
595
921
596
switch (event) {
922
if(quit_now){
923
return;
924
}
925
926
switch(event){
597
927
default:
598
928
case AVAHI_BROWSER_FAILURE:
599
929
600
fprintf(stderr, "(Browser) %s\n",
601
avahi_strerror(avahi_server_errno(mc->server)));
602
avahi_simple_poll_quit(mc->simple_poll);
930
fprintf(stderr, "(Avahi browser) %s\n",
931
avahi_strerror(avahi_server_errno(mc.server)));
932
avahi_simple_poll_quit(mc.simple_poll);
603
933
return;
604
934
605
935
case AVAHI_BROWSER_NEW:
606
/* We ignore the returned resolver object. In the callback
607
function we free it. If the server is terminated before
608
the callback function is called the server will free
609
the resolver for us. */
936
/* We ignore the returned Avahi resolver object. In the callback
937
function we free it. If the Avahi server is terminated before
938
the callback function is called the Avahi server will free the
939
resolver for us. */
610
940
611
if (!(avahi_s_service_resolver_new(mc->server, interface, protocol, name,
612
type, domain,
613
AVAHI_PROTO_INET6, 0,
614
resolve_callback, mc)))
615
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
616
avahi_strerror(avahi_server_errno(mc->server)));
941
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
942
name, type, domain, protocol, 0,
943
resolve_callback, NULL) == NULL)
944
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
945
name, avahi_strerror(avahi_server_errno(mc.server)));
617
946
break;
618
947
619
948
case AVAHI_BROWSER_REMOVE:
621
950
622
951
case AVAHI_BROWSER_ALL_FOR_NOW:
623
952
case AVAHI_BROWSER_CACHE_EXHAUSTED:
953
if(debug){
954
fprintf(stderr, "No Mandos server found, still searching...\n");
955
}
624
956
break;
625
957
}
626
958
}
627
959
628
/* Combines file name and path and returns the malloced new
629
string. some sane checks could/should be added */
630
static const char *combinepath(const char *first, const char *second){
631
size_t f_len = strlen(first);
632
size_t s_len = strlen(second);
633
char *tmp = malloc(f_len + s_len + 2);
634
if (tmp == NULL){
635
return NULL;
636
}
637
if(f_len > 0){
638
memcpy(tmp, first, f_len); /* Spurious warning */
639
}
640
tmp[f_len] = '/';
641
if(s_len > 0){
642
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
643
}
644
tmp[f_len + 1 + s_len] = '\0';
645
return tmp;
960
/* stop main loop after sigterm has been called */
961
static void handle_sigterm(int sig){
962
if(quit_now){
963
return;
964
}
965
quit_now = 1;
966
signal_received = sig;
967
int old_errno = errno;
968
if(mc.simple_poll != NULL){
969
avahi_simple_poll_quit(mc.simple_poll);
970
}
971
errno = old_errno;
646
972
}
647
973
648
649
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
650
AvahiServerConfig config;
651
AvahiSServiceBrowser *sb = NULL;
652
int error;
653
int ret;
654
int debug_int;
655
int returncode = EXIT_SUCCESS;
656
const char *interface = "eth0";
657
struct ifreq network;
658
int sd;
659
char *connect_to = NULL;
660
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
661
mandos_context mc = { .simple_poll = NULL, .server = NULL,
662
.dh_bits = 1024, .priority = "SECURE256"};
974
int main(int argc, char *argv[]){
975
AvahiSServiceBrowser *sb = NULL;
976
int error;
977
int ret;
978
intmax_t tmpmax;
979
char *tmp;
980
int exitcode = EXIT_SUCCESS;
981
const char *interface = "eth0";
982
struct ifreq network;
983
int sd = -1;
984
bool take_down_interface = false;
985
uid_t uid;
986
gid_t gid;
987
char *connect_to = NULL;
988
char tempdir[] = "/tmp/mandosXXXXXX";
989
bool tempdir_created = false;
990
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
991
const char *seckey = PATHDIR "/" SECKEY;
992
const char *pubkey = PATHDIR "/" PUBKEY;
993
994
bool gnutls_initialized = false;
995
bool gpgme_initialized = false;
996
float delay = 2.5f;
997
998
struct sigaction old_sigterm_action;
999
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1000
1001
{
1002
struct argp_option options[] = {
1003
{ .name = "debug", .key = 128,
1004
.doc = "Debug mode", .group = 3 },
1005
{ .name = "connect", .key = 'c',
1006
.arg = "ADDRESS:PORT",
1007
.doc = "Connect directly to a specific Mandos server",
1008
.group = 1 },
1009
{ .name = "interface", .key = 'i',
1010
.arg = "NAME",
1011
.doc = "Network interface that will be used to search for"
1012
" Mandos servers",
1013
.group = 1 },
1014
{ .name = "seckey", .key = 's',
1015
.arg = "FILE",
1016
.doc = "OpenPGP secret key file base name",
1017
.group = 1 },
1018
{ .name = "pubkey", .key = 'p',
1019
.arg = "FILE",
1020
.doc = "OpenPGP public key file base name",
1021
.group = 2 },
1022
{ .name = "dh-bits", .key = 129,
1023
.arg = "BITS",
1024
.doc = "Bit length of the prime number used in the"
1025
" Diffie-Hellman key exchange",
1026
.group = 2 },
1027
{ .name = "priority", .key = 130,
1028
.arg = "STRING",
1029
.doc = "GnuTLS priority string for the TLS handshake",
1030
.group = 1 },
1031
{ .name = "delay", .key = 131,
1032
.arg = "SECONDS",
1033
.doc = "Maximum delay to wait for interface startup",
1034
.group = 2 },
1035
{ .name = NULL }
1036
};
663
1037
664
debug_int = debug ? 1 : 0;
665
while (true){
666
struct option long_options[] = {
667
{"debug", no_argument, &debug_int, 1},
668
{"connect", required_argument, NULL, 'c'},
669
{"interface", required_argument, NULL, 'i'},
670
{"keydir", required_argument, NULL, 'd'},
671
{"seckey", required_argument, NULL, 's'},
672
{"pubkey", required_argument, NULL, 'p'},
673
{"dh-bits", required_argument, NULL, 'D'},
674
{"priority", required_argument, NULL, 'P'},
675
{0, 0, 0, 0} };
676
677
int option_index = 0;
678
ret = getopt_long (argc, argv, "i:", long_options,
679
&option_index);
680
681
if (ret == -1){
682
break;
683
}
684
685
switch(ret){
686
case 0:
687
break;
688
case 'i':
689
interface = optarg;
690
break;
691
case 'c':
692
connect_to = optarg;
693
break;
694
case 'd':
695
keydir = optarg;
696
break;
697
case 'p':
698
pubkeyfile = optarg;
699
break;
700
case 's':
701
seckeyfile = optarg;
702
break;
703
case 'D':
704
errno = 0;
705
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
706
if (errno){
707
perror("strtol");
708
exit(EXIT_FAILURE);
709
}
710
break;
711
case 'P':
712
mc.priority = optarg;
713
break;
714
case '?':
1038
error_t parse_opt(int key, char *arg,
1039
struct argp_state *state){
1040
switch(key){
1041
case 128: /* --debug */
1042
debug = true;
1043
break;
1044
case 'c': /* --connect */
1045
connect_to = arg;
1046
break;
1047
case 'i': /* --interface */
1048
interface = arg;
1049
break;
1050
case 's': /* --seckey */
1051
seckey = arg;
1052
break;
1053
case 'p': /* --pubkey */
1054
pubkey = arg;
1055
break;
1056
case 129: /* --dh-bits */
1057
errno = 0;
1058
tmpmax = strtoimax(arg, &tmp, 10);
1059
if(errno != 0 or tmp == arg or *tmp != '\0'
1060
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1061
fprintf(stderr, "Bad number of DH bits\n");
1062
exit(EXIT_FAILURE);
1063
}
1064
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1065
break;
1066
case 130: /* --priority */
1067
mc.priority = arg;
1068
break;
1069
case 131: /* --delay */
1070
errno = 0;
1071
delay = strtof(arg, &tmp);
1072
if(errno != 0 or tmp == arg or *tmp != '\0'){
1073
fprintf(stderr, "Bad delay\n");
1074
exit(EXIT_FAILURE);
1075
}
1076
break;
1077
case ARGP_KEY_ARG:
1078
argp_usage(state);
1079
case ARGP_KEY_END:
1080
break;
715
1081
default:
716
exit(EXIT_FAILURE);
1082
return ARGP_ERR_UNKNOWN;
717
1083
}
718
}
719
debug = debug_int ? true : false;
720
721
pubkeyfile = combinepath(keydir, pubkeyfile);
722
if (pubkeyfile == NULL){
723
perror("combinepath");
724
returncode = EXIT_FAILURE;
725
goto exit;
726
}
727
728
seckeyfile = combinepath(keydir, seckeyfile);
729
if (seckeyfile == NULL){
730
perror("combinepath");
731
goto exit;
732
}
733
1084
return 0;
1085
}
1086
1087
struct argp argp = { .options = options, .parser = parse_opt,
1088
.args_doc = "",
1089
.doc = "Mandos client -- Get and decrypt"
1090
" passwords from a Mandos server" };
1091
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1092
if(ret == ARGP_ERR_UNKNOWN){
1093
fprintf(stderr, "Unknown error while parsing arguments\n");
1094
exitcode = EXIT_FAILURE;
1095
goto end;
1096
}
1097
}
1098
1099
if(not debug){
1100
avahi_set_log_function(empty_log);
1101
}
1102
1103
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1104
from the signal handler */
1105
/* Initialize the pseudo-RNG for Avahi */
1106
srand((unsigned int) time(NULL));
1107
mc.simple_poll = avahi_simple_poll_new();
1108
if(mc.simple_poll == NULL){
1109
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1110
exitcode = EXIT_FAILURE;
1111
goto end;
1112
}
1113
1114
sigemptyset(&sigterm_action.sa_mask);
1115
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1116
if(ret == -1){
1117
perror("sigaddset");
1118
exitcode = EXIT_FAILURE;
1119
goto end;
1120
}
1121
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1122
if(ret == -1){
1123
perror("sigaddset");
1124
exitcode = EXIT_FAILURE;
1125
goto end;
1126
}
1127
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1128
if(ret == -1){
1129
perror("sigaddset");
1130
exitcode = EXIT_FAILURE;
1131
goto end;
1132
}
1133
/* Need to check if the handler is SIG_IGN before handling:
1134
| [[info:libc:Initial Signal Actions]] |
1135
| [[info:libc:Basic Signal Handling]] |
1136
*/
1137
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1138
if(ret == -1){
1139
perror("sigaction");
1140
return EXIT_FAILURE;
1141
}
1142
if(old_sigterm_action.sa_handler != SIG_IGN){
1143
ret = sigaction(SIGINT, &sigterm_action, NULL);
1144
if(ret == -1){
1145
perror("sigaction");
1146
exitcode = EXIT_FAILURE;
1147
goto end;
1148
}
1149
}
1150
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1151
if(ret == -1){
1152
perror("sigaction");
1153
return EXIT_FAILURE;
1154
}
1155
if(old_sigterm_action.sa_handler != SIG_IGN){
1156
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1157
if(ret == -1){
1158
perror("sigaction");
1159
exitcode = EXIT_FAILURE;
1160
goto end;
1161
}
1162
}
1163
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1164
if(ret == -1){
1165
perror("sigaction");
1166
return EXIT_FAILURE;
1167
}
1168
if(old_sigterm_action.sa_handler != SIG_IGN){
1169
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1170
if(ret == -1){
1171
perror("sigaction");
1172
exitcode = EXIT_FAILURE;
1173
goto end;
1174
}
1175
}
1176
1177
/* If the interface is down, bring it up */
1178
if(interface[0] != '\0'){
734
1179
if_index = (AvahiIfIndex) if_nametoindex(interface);
735
1180
if(if_index == 0){
736
1181
fprintf(stderr, "No such interface: \"%s\"\n", interface);
737
exit(EXIT_FAILURE);
738
}
739
740
if(connect_to != NULL){
741
/* Connect directly, do not use Zeroconf */
742
/* (Mainly meant for debugging) */
743
char *address = strrchr(connect_to, ':');
744
if(address == NULL){
745
fprintf(stderr, "No colon in address\n");
746
exit(EXIT_FAILURE);
747
}
748
errno = 0;
749
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
750
if(errno){
751
perror("Bad port number");
752
exit(EXIT_FAILURE);
753
}
754
*address = '\0';
755
address = connect_to;
756
ret = start_mandos_communication(address, port, if_index, &mc);
757
if(ret < 0){
758
exit(EXIT_FAILURE);
759
} else {
760
exit(EXIT_SUCCESS);
761
}
762
}
1182
exitcode = EXIT_FAILURE;
1183
goto end;
1184
}
1185
1186
if(quit_now){
1187
goto end;
1188
}
1189
1190
#ifdef __linux__
1191
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1192
messages to mess up the prompt */
1193
ret = klogctl(8, NULL, 5);
1194
bool restore_loglevel = true;
1195
if(ret == -1){
1196
restore_loglevel = false;
1197
perror("klogctl");
1198
}
1199
#endif /* __linux__ */
763
1200
764
1201
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
765
if(sd < 0) {
1202
if(sd < 0){
766
1203
perror("socket");
767
returncode = EXIT_FAILURE;
768
goto exit;
1204
exitcode = EXIT_FAILURE;
1205
#ifdef __linux__
1206
if(restore_loglevel){
1207
ret = klogctl(7, NULL, 0);
1208
if(ret == -1){
1209
perror("klogctl");
1210
}
1211
}
1212
#endif /* __linux__ */
1213
goto end;
769
1214
}
770
strcpy(network.ifr_name, interface); /* Spurious warning */
1215
strcpy(network.ifr_name, interface);
771
1216
ret = ioctl(sd, SIOCGIFFLAGS, &network);
772
1217
if(ret == -1){
773
774
1218
perror("ioctl SIOCGIFFLAGS");
775
returncode = EXIT_FAILURE;
776
goto exit;
1219
#ifdef __linux__
1220
if(restore_loglevel){
1221
ret = klogctl(7, NULL, 0);
1222
if(ret == -1){
1223
perror("klogctl");
1224
}
1225
}
1226
#endif /* __linux__ */
1227
exitcode = EXIT_FAILURE;
1228
goto end;
777
1229
}
778
1230
if((network.ifr_flags & IFF_UP) == 0){
779
1231
network.ifr_flags |= IFF_UP;
1232
take_down_interface = true;
780
1233
ret = ioctl(sd, SIOCSIFFLAGS, &network);
781
1234
if(ret == -1){
1235
take_down_interface = false;
782
1236
perror("ioctl SIOCSIFFLAGS");
783
returncode = EXIT_FAILURE;
784
goto exit;
785
}
786
}
787
close(sd);
788
789
if (not debug){
790
avahi_set_log_function(empty_log);
791
}
792
793
/* Initialize the psuedo-RNG */
794
srand((unsigned int) time(NULL));
795
796
/* Allocate main loop object */
797
if (!(mc.simple_poll = avahi_simple_poll_new())) {
798
fprintf(stderr, "Failed to create simple poll object.\n");
799
returncode = EXIT_FAILURE;
800
goto exit;
801
}
802
803
/* Do not publish any local records */
1237
exitcode = EXIT_FAILURE;
1238
#ifdef __linux__
1239
if(restore_loglevel){
1240
ret = klogctl(7, NULL, 0);
1241
if(ret == -1){
1242
perror("klogctl");
1243
}
1244
}
1245
#endif /* __linux__ */
1246
goto end;
1247
}
1248
}
1249
/* sleep checking until interface is running */
1250
for(int i=0; i < delay * 4; i++){
1251
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1252
if(ret == -1){
1253
perror("ioctl SIOCGIFFLAGS");
1254
} else if(network.ifr_flags & IFF_RUNNING){
1255
break;
1256
}
1257
struct timespec sleeptime = { .tv_nsec = 250000000 };
1258
ret = nanosleep(&sleeptime, NULL);
1259
if(ret == -1 and errno != EINTR){
1260
perror("nanosleep");
1261
}
1262
}
1263
if(not take_down_interface){
1264
/* We won't need the socket anymore */
1265
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1266
if(ret == -1){
1267
perror("close");
1268
}
1269
}
1270
#ifdef __linux__
1271
if(restore_loglevel){
1272
/* Restores kernel loglevel to default */
1273
ret = klogctl(7, NULL, 0);
1274
if(ret == -1){
1275
perror("klogctl");
1276
}
1277
}
1278
#endif /* __linux__ */
1279
}
1280
1281
if(quit_now){
1282
goto end;
1283
}
1284
1285
uid = getuid();
1286
gid = getgid();
1287
1288
/* Drop any group privileges we might have, just to be safe */
1289
errno = 0;
1290
ret = setgid(gid);
1291
if(ret == -1){
1292
perror("setgid");
1293
}
1294
1295
/* Drop user privileges */
1296
errno = 0;
1297
/* Will we need privileges later? */
1298
if(take_down_interface){
1299
/* Drop user privileges temporarily */
1300
ret = seteuid(uid);
1301
if(ret == -1){
1302
perror("seteuid");
1303
}
1304
} else {
1305
/* Drop user privileges permanently */
1306
ret = setuid(uid);
1307
if(ret == -1){
1308
perror("setuid");
1309
}
1310
}
1311
1312
if(quit_now){
1313
goto end;
1314
}
1315
1316
ret = init_gnutls_global(pubkey, seckey);
1317
if(ret == -1){
1318
fprintf(stderr, "init_gnutls_global failed\n");
1319
exitcode = EXIT_FAILURE;
1320
goto end;
1321
} else {
1322
gnutls_initialized = true;
1323
}
1324
1325
if(quit_now){
1326
goto end;
1327
}
1328
1329
tempdir_created = true;
1330
if(mkdtemp(tempdir) == NULL){
1331
tempdir_created = false;
1332
perror("mkdtemp");
1333
goto end;
1334
}
1335
1336
if(quit_now){
1337
goto end;
1338
}
1339
1340
if(not init_gpgme(pubkey, seckey, tempdir)){
1341
fprintf(stderr, "init_gpgme failed\n");
1342
exitcode = EXIT_FAILURE;
1343
goto end;
1344
} else {
1345
gpgme_initialized = true;
1346
}
1347
1348
if(quit_now){
1349
goto end;
1350
}
1351
1352
if(connect_to != NULL){
1353
/* Connect directly, do not use Zeroconf */
1354
/* (Mainly meant for debugging) */
1355
char *address = strrchr(connect_to, ':');
1356
if(address == NULL){
1357
fprintf(stderr, "No colon in address\n");
1358
exitcode = EXIT_FAILURE;
1359
goto end;
1360
}
1361
1362
if(quit_now){
1363
goto end;
1364
}
1365
1366
uint16_t port;
1367
errno = 0;
1368
tmpmax = strtoimax(address+1, &tmp, 10);
1369
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1370
or tmpmax != (uint16_t)tmpmax){
1371
fprintf(stderr, "Bad port number\n");
1372
exitcode = EXIT_FAILURE;
1373
goto end;
1374
}
1375
1376
if(quit_now){
1377
goto end;
1378
}
1379
1380
port = (uint16_t)tmpmax;
1381
*address = '\0';
1382
address = connect_to;
1383
/* Colon in address indicates IPv6 */
1384
int af;
1385
if(strchr(address, ':') != NULL){
1386
af = AF_INET6;
1387
} else {
1388
af = AF_INET;
1389
}
1390
1391
if(quit_now){
1392
goto end;
1393
}
1394
1395
ret = start_mandos_communication(address, port, if_index, af);
1396
if(ret < 0){
1397
exitcode = EXIT_FAILURE;
1398
} else {
1399
exitcode = EXIT_SUCCESS;
1400
}
1401
goto end;
1402
}
1403
1404
if(quit_now){
1405
goto end;
1406
}
1407
1408
{
1409
AvahiServerConfig config;
1410
/* Do not publish any local Zeroconf records */
804
1411
avahi_server_config_init(&config);
805
1412
config.publish_hinfo = 0;
806
1413
config.publish_addresses = 0;
807
1414
config.publish_workstation = 0;
808
1415
config.publish_domain = 0;
809
1416
810
1417
/* Allocate a new server */
811
mc.server=avahi_server_new(avahi_simple_poll_get(mc.simple_poll),
812
&config, NULL, NULL, &error);
1418
mc.server = avahi_server_new(avahi_simple_poll_get
1419
(mc.simple_poll), &config, NULL,
1420
NULL, &error);
813
1421
814
/* Free the configuration data */
1422
/* Free the Avahi configuration data */
815
1423
avahi_server_config_free(&config);
816
817
/* Check if creating the server object succeeded */
818
if (!mc.server) {
819
fprintf(stderr, "Failed to create server: %s\n",
820
avahi_strerror(error));
821
returncode = EXIT_FAILURE;
822
goto exit;
823
}
824
825
/* Create the service browser */
826
sb = avahi_s_service_browser_new(mc.server, if_index,
827
AVAHI_PROTO_INET6,
828
"_mandos._tcp", NULL, 0,
829
browse_callback, &mc);
830
if (!sb) {
831
fprintf(stderr, "Failed to create service browser: %s\n",
832
avahi_strerror(avahi_server_errno(mc.server)));
833
returncode = EXIT_FAILURE;
834
goto exit;
835
}
836
837
/* Run the main loop */
838
839
if (debug){
840
fprintf(stderr, "Starting avahi loop search\n");
841
}
842
843
avahi_simple_poll_loop(mc.simple_poll);
844
845
exit:
846
847
if (debug){
848
fprintf(stderr, "%s exiting\n", argv[0]);
849
}
850
851
/* Cleanup things */
852
if (sb)
853
avahi_s_service_browser_free(sb);
854
855
if (mc.server)
856
avahi_server_free(mc.server);
857
858
if (mc.simple_poll)
859
avahi_simple_poll_free(mc.simple_poll);
860
free(pubkeyfile);
861
free(seckeyfile);
862
863
return returncode;
1424
}
1425
1426
/* Check if creating the Avahi server object succeeded */
1427
if(mc.server == NULL){
1428
fprintf(stderr, "Failed to create Avahi server: %s\n",
1429
avahi_strerror(error));
1430
exitcode = EXIT_FAILURE;
1431
goto end;
1432
}
1433
1434
if(quit_now){
1435
goto end;
1436
}
1437
1438
/* Create the Avahi service browser */
1439
sb = avahi_s_service_browser_new(mc.server, if_index,
1440
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1441
NULL, 0, browse_callback, NULL);
1442
if(sb == NULL){
1443
fprintf(stderr, "Failed to create service browser: %s\n",
1444
avahi_strerror(avahi_server_errno(mc.server)));
1445
exitcode = EXIT_FAILURE;
1446
goto end;
1447
}
1448
1449
if(quit_now){
1450
goto end;
1451
}
1452
1453
/* Run the main loop */
1454
1455
if(debug){
1456
fprintf(stderr, "Starting Avahi loop search\n");
1457
}
1458
1459
avahi_simple_poll_loop(mc.simple_poll);
1460
1461
end:
1462
1463
if(debug){
1464
fprintf(stderr, "%s exiting\n", argv[0]);
1465
}
1466
1467
/* Cleanup things */
1468
if(sb != NULL)
1469
avahi_s_service_browser_free(sb);
1470
1471
if(mc.server != NULL)
1472
avahi_server_free(mc.server);
1473
1474
if(mc.simple_poll != NULL)
1475
avahi_simple_poll_free(mc.simple_poll);
1476
1477
if(gnutls_initialized){
1478
gnutls_certificate_free_credentials(mc.cred);
1479
gnutls_global_deinit();
1480
gnutls_dh_params_deinit(mc.dh_params);
1481
}
1482
1483
if(gpgme_initialized){
1484
gpgme_release(mc.ctx);
1485
}
1486
1487
/* Take down the network interface */
1488
if(take_down_interface){
1489
/* Re-raise priviliges */
1490
errno = 0;
1491
ret = seteuid(0);
1492
if(ret == -1){
1493
perror("seteuid");
1494
}
1495
if(geteuid() == 0){
1496
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1497
if(ret == -1){
1498
perror("ioctl SIOCGIFFLAGS");
1499
} else if(network.ifr_flags & IFF_UP) {
1500
network.ifr_flags &= ~IFF_UP; /* clear flag */
1501
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1502
if(ret == -1){
1503
perror("ioctl SIOCSIFFLAGS");
1504
}
1505
}
1506
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1507
if(ret == -1){
1508
perror("close");
1509
}
1510
/* Lower privileges, permanently this time */
1511
errno = 0;
1512
ret = setuid(uid);
1513
if(ret == -1){
1514
perror("setuid");
1515
}
1516
}
1517
}
1518
1519
/* Removes the temp directory used by GPGME */
1520
if(tempdir_created){
1521
DIR *d;
1522
struct dirent *direntry;
1523
d = opendir(tempdir);
1524
if(d == NULL){
1525
if(errno != ENOENT){
1526
perror("opendir");
1527
}
1528
} else {
1529
while(true){
1530
direntry = readdir(d);
1531
if(direntry == NULL){
1532
break;
1533
}
1534
/* Skip "." and ".." */
1535
if(direntry->d_name[0] == '.'
1536
and (direntry->d_name[1] == '\0'
1537
or (direntry->d_name[1] == '.'
1538
and direntry->d_name[2] == '\0'))){
1539
continue;
1540
}
1541
char *fullname = NULL;
1542
ret = asprintf(&fullname, "%s/%s", tempdir,
1543
direntry->d_name);
1544
if(ret < 0){
1545
perror("asprintf");
1546
continue;
1547
}
1548
ret = remove(fullname);
1549
if(ret == -1){
1550
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1551
strerror(errno));
1552
}
1553
free(fullname);
1554
}
1555
closedir(d);
1556
}
1557
ret = rmdir(tempdir);
1558
if(ret == -1 and errno != ENOENT){
1559
perror("rmdir");
1560
}
1561
}
1562
1563
if(quit_now){
1564
sigemptyset(&old_sigterm_action.sa_mask);
1565
old_sigterm_action.sa_handler = SIG_DFL;
1566
ret = sigaction(signal_received, &old_sigterm_action, NULL);
1567
if(ret == -1){
1568
perror("sigaction");
1569
}
1570
raise(signal_received);
1571
}
1572
1573
return exitcode;
864
1574
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0