To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 39
- compare with another revision
- download diff
- download tarball
- view history from revision 39
- Committer: Teddy Hogeborn
- Date: 2008-08-03 03:33:56 UTC
- Revision ID: teddy@fukt.bsnet.se-20080803033356-6aemgj0g0hoz91ow
* plugins.d/mandosclient.c (pgp_packet_decrypt): Renamed variables.
On debug, show
decrypted plaintext
in hexadecimal. Free
the GPGME data
buffers even on
errors.
On debug, show
decrypted plaintext
in hexadecimal. Free
the GPGME data
buffers even on
errors.
- files added:
- ca.pem
- files removed:
- .bzr-builddeb
- debian
- debian/po
- files renamed:
- plugin-runner.c => plugbasedclient.c
- plugins.d/mandos-client.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
1
1
/* -*- coding: utf-8 -*- */
2
2
/*
3
* Mandos-client - get and decrypt data from a Mandos server
3
* Mandos client - get and decrypt data from a Mandos server
4
4
*
5
5
* This program is partly derived from an example program for an Avahi
6
6
* service browser, downloaded from
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008,2009 Teddy Hogeborn
13
* Copyright © 2008,2009 Björn Påhlsson
12
* Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
14
13
*
15
14
* This program is free software: you can redistribute it and/or
16
15
* modify it under the terms of the GNU General Public License as
30
29
*/
31
30
32
31
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
34
32
#define _LARGEFILE_SOURCE
35
#endif
36
#ifndef _FILE_OFFSET_BITS
37
33
#define _FILE_OFFSET_BITS 64
38
#endif
39
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
44
#include <stdint.h> /* uint16_t, uint32_t */
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
48
#include <stdbool.h> /* bool, false, true */
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
strerror(), asprintf(), strcpy() */
51
#include <sys/ioctl.h> /* ioctl */
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
sockaddr_in6, PF_INET6,
54
SOCK_STREAM, uid_t, gid_t, open(),
55
opendir(), DIR */
56
#include <sys/stat.h> /* open() */
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
*/
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
63
strtoimax() */
64
#include <assert.h> /* assert() */
65
#include <errno.h> /* perror(), errno */
66
#include <time.h> /* nanosleep(), time() */
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
41
SIOCSIFFLAGS */
67
42
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
68
SIOCSIFFLAGS, if_indextoname(),
69
if_nametoindex(), IF_NAMESIZE */
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
*/
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), seteuid(),
75
setgid() */
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
#include <iso646.h> /* not, or, and */
78
#include <argp.h> /* struct argp_option, error_t, struct
79
argp_state, struct argp,
80
argp_parse(), ARGP_KEY_ARG,
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
86
#ifdef __linux__
87
#include <sys/klog.h> /* klogctl() */
88
#endif /* __linux__ */
89
90
/* Avahi */
91
/* All Avahi types, constants and functions
92
Avahi*, avahi_*,
93
AVAHI_* */
43
SIOCSIFFLAGS */
44
94
45
#include <avahi-core/core.h>
95
46
#include <avahi-core/lookup.h>
96
47
#include <avahi-core/log.h>
98
49
#include <avahi-common/malloc.h>
99
50
#include <avahi-common/error.h>
100
51
101
/* GnuTLS */
102
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and
103
functions:
104
gnutls_*
105
init_gnutls_session(),
106
GNUTLS_* */
107
#include <gnutls/openpgp.h>
108
/* gnutls_certificate_set_openpgp_key_file(),
109
GNUTLS_OPENPGP_FMT_BASE64 */
110
111
/* GPGME */
112
#include <gpgme.h> /* All GPGME types, constants and
113
functions:
114
gpgme_*
115
GPGME_PROTOCOL_OpenPGP,
116
GPG_ERR_NO_* */
52
//mandos client part
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
58
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
65
66
// gpgme
67
#include <errno.h> /* perror() */
68
#include <gpgme.h>
69
70
// getopt_long
71
#include <getopt.h>
117
72
118
73
#define BUFFER_SIZE 256
119
74
120
#define PATHDIR "/conf/conf.d/mandos"
121
#define SECKEY "seckey.txt"
122
#define PUBKEY "pubkey.txt"
75
static const char *keydir = "/conf/conf.d/mandos";
76
static const char *pubkeyfile = "pubkey.txt";
77
static const char *seckeyfile = "seckey.txt";
123
78
124
79
bool debug = false;
125
static const char mandos_protocol_version[] = "1";
126
const char *argp_program_version = "mandos-client " VERSION;
127
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
128
80
129
/* Used for passing in values through the Avahi callback functions */
81
/* Used for passing in values through all the callback functions */
130
82
typedef struct {
131
83
AvahiSimplePoll *simple_poll;
132
84
AvahiServer *server;
133
85
gnutls_certificate_credentials_t cred;
134
86
unsigned int dh_bits;
135
gnutls_dh_params_t dh_params;
136
87
const char *priority;
88
} mandos_context;
89
90
/*
91
* Decrypt OpenPGP data using keyrings in HOMEDIR.
92
* Returns -1 on error
93
*/
94
static ssize_t pgp_packet_decrypt (const char *cryptotext,
95
size_t crypto_size,
96
char **plaintext,
97
const char *homedir){
98
gpgme_data_t dh_crypto, dh_plain;
137
99
gpgme_ctx_t ctx;
138
} mandos_context;
139
140
/* global context so signal handler can reach it*/
141
mandos_context mc = { .simple_poll = NULL, .server = NULL,
142
.dh_bits = 1024, .priority = "SECURE256"
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
145
/*
146
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
* bytes. "buffer_capacity" is how much is currently allocated,
148
* "buffer_length" is how much is already used.
149
*/
150
size_t incbuffer(char **buffer, size_t buffer_length,
151
size_t buffer_capacity){
152
if(buffer_length + BUFFER_SIZE > buffer_capacity){
153
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
154
if(buffer == NULL){
155
return 0;
156
}
157
buffer_capacity += BUFFER_SIZE;
158
}
159
return buffer_capacity;
160
}
161
162
/*
163
* Initialize GPGME.
164
*/
165
static bool init_gpgme(const char *seckey,
166
const char *pubkey, const char *tempdir){
167
100
gpgme_error_t rc;
101
ssize_t ret;
102
ssize_t plaintext_capacity = 0;
103
ssize_t plaintext_length = 0;
168
104
gpgme_engine_info_t engine_info;
169
105
170
171
/*
172
* Helper function to insert pub and seckey to the engine keyring.
173
*/
174
bool import_key(const char *filename){
175
int ret;
176
int fd;
177
gpgme_data_t pgp_data;
178
179
fd = (int)TEMP_FAILURE_RETRY(open(filename, O_RDONLY));
180
if(fd == -1){
181
perror("open");
182
return false;
183
}
184
185
rc = gpgme_data_new_from_fd(&pgp_data, fd);
186
if(rc != GPG_ERR_NO_ERROR){
187
fprintf(stderr, "bad gpgme_data_new_from_fd: %s: %s\n",
188
gpgme_strsource(rc), gpgme_strerror(rc));
189
return false;
190
}
191
192
rc = gpgme_op_import(mc.ctx, pgp_data);
193
if(rc != GPG_ERR_NO_ERROR){
194
fprintf(stderr, "bad gpgme_op_import: %s: %s\n",
195
gpgme_strsource(rc), gpgme_strerror(rc));
196
return false;
197
}
198
199
ret = (int)TEMP_FAILURE_RETRY(close(fd));
200
if(ret == -1){
201
perror("close");
202
}
203
gpgme_data_release(pgp_data);
204
return true;
205
}
206
207
if(debug){
208
fprintf(stderr, "Initializing GPGME\n");
106
if (debug){
107
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
209
108
}
210
109
211
110
/* Init GPGME */
212
111
gpgme_check_version(NULL);
213
112
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
214
if(rc != GPG_ERR_NO_ERROR){
113
if (rc != GPG_ERR_NO_ERROR){
215
114
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
216
115
gpgme_strsource(rc), gpgme_strerror(rc));
217
return false;
116
return -1;
218
117
}
219
118
220
/* Set GPGME home directory for the OpenPGP engine only */
221
rc = gpgme_get_engine_info(&engine_info);
222
if(rc != GPG_ERR_NO_ERROR){
119
/* Set GPGME home directory for the OpenPGP engine only */
120
rc = gpgme_get_engine_info (&engine_info);
121
if (rc != GPG_ERR_NO_ERROR){
223
122
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
224
123
gpgme_strsource(rc), gpgme_strerror(rc));
225
return false;
124
return -1;
226
125
}
227
126
while(engine_info != NULL){
228
127
if(engine_info->protocol == GPGME_PROTOCOL_OpenPGP){
229
128
gpgme_set_engine_info(GPGME_PROTOCOL_OpenPGP,
230
engine_info->file_name, tempdir);
129
engine_info->file_name, homedir);
231
130
break;
232
131
}
233
132
engine_info = engine_info->next;
234
133
}
235
134
if(engine_info == NULL){
236
fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir);
237
return false;
238
}
239
240
/* Create new GPGME "context" */
241
rc = gpgme_new(&(mc.ctx));
242
if(rc != GPG_ERR_NO_ERROR){
243
fprintf(stderr, "bad gpgme_new: %s: %s\n",
244
gpgme_strsource(rc), gpgme_strerror(rc));
245
return false;
246
}
247
248
if(not import_key(pubkey) or not import_key(seckey)){
249
return false;
250
}
251
252
return true;
253
}
254
255
/*
256
* Decrypt OpenPGP data.
257
* Returns -1 on error
258
*/
259
static ssize_t pgp_packet_decrypt(const char *cryptotext,
260
size_t crypto_size,
261
char **plaintext){
262
gpgme_data_t dh_crypto, dh_plain;
263
gpgme_error_t rc;
264
ssize_t ret;
265
size_t plaintext_capacity = 0;
266
ssize_t plaintext_length = 0;
267
268
if(debug){
269
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
135
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
136
return -1;
270
137
}
271
138
272
139
/* Create new GPGME data buffer from memory cryptotext */
273
140
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
274
141
0);
275
if(rc != GPG_ERR_NO_ERROR){
142
if (rc != GPG_ERR_NO_ERROR){
276
143
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
277
144
gpgme_strsource(rc), gpgme_strerror(rc));
278
145
return -1;
280
147
281
148
/* Create new empty GPGME data buffer for the plaintext */
282
149
rc = gpgme_data_new(&dh_plain);
283
if(rc != GPG_ERR_NO_ERROR){
150
if (rc != GPG_ERR_NO_ERROR){
284
151
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
285
152
gpgme_strsource(rc), gpgme_strerror(rc));
286
153
gpgme_data_release(dh_crypto);
287
154
return -1;
288
155
}
289
156
157
/* Create new GPGME "context" */
158
rc = gpgme_new(&ctx);
159
if (rc != GPG_ERR_NO_ERROR){
160
fprintf(stderr, "bad gpgme_new: %s: %s\n",
161
gpgme_strsource(rc), gpgme_strerror(rc));
162
plaintext_length = -1;
163
goto decrypt_end;
164
}
165
290
166
/* Decrypt data from the cryptotext data buffer to the plaintext
291
167
data buffer */
292
rc = gpgme_op_decrypt(mc.ctx, dh_crypto, dh_plain);
293
if(rc != GPG_ERR_NO_ERROR){
168
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
169
if (rc != GPG_ERR_NO_ERROR){
294
170
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
295
171
gpgme_strsource(rc), gpgme_strerror(rc));
296
172
plaintext_length = -1;
297
if(debug){
298
gpgme_decrypt_result_t result;
299
result = gpgme_op_decrypt_result(mc.ctx);
300
if(result == NULL){
301
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
302
} else {
303
fprintf(stderr, "Unsupported algorithm: %s\n",
304
result->unsupported_algorithm);
305
fprintf(stderr, "Wrong key usage: %u\n",
306
result->wrong_key_usage);
307
if(result->file_name != NULL){
308
fprintf(stderr, "File name: %s\n", result->file_name);
309
}
310
gpgme_recipient_t recipient;
311
recipient = result->recipients;
173
goto decrypt_end;
174
}
175
176
if(debug){
177
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
178
}
179
180
if (debug){
181
gpgme_decrypt_result_t result;
182
result = gpgme_op_decrypt_result(ctx);
183
if (result == NULL){
184
fprintf(stderr, "gpgme_op_decrypt_result failed\n");
185
} else {
186
fprintf(stderr, "Unsupported algorithm: %s\n",
187
result->unsupported_algorithm);
188
fprintf(stderr, "Wrong key usage: %d\n",
189
result->wrong_key_usage);
190
if(result->file_name != NULL){
191
fprintf(stderr, "File name: %s\n", result->file_name);
192
}
193
gpgme_recipient_t recipient;
194
recipient = result->recipients;
195
if(recipient){
312
196
while(recipient != NULL){
313
197
fprintf(stderr, "Public key algorithm: %s\n",
314
198
gpgme_pubkey_algo_name(recipient->pubkey_algo));
320
204
}
321
205
}
322
206
}
323
goto decrypt_end;
324
}
325
326
if(debug){
327
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
328
207
}
329
208
330
209
/* Seek back to the beginning of the GPGME plaintext data buffer */
331
if(gpgme_data_seek(dh_plain, (off_t)0, SEEK_SET) == -1){
332
perror("gpgme_data_seek");
210
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
211
perror("pgpme_data_seek");
333
212
plaintext_length = -1;
334
213
goto decrypt_end;
335
214
}
336
215
337
216
*plaintext = NULL;
338
217
while(true){
339
plaintext_capacity = incbuffer(plaintext,
340
(size_t)plaintext_length,
341
plaintext_capacity);
342
if(plaintext_capacity == 0){
343
perror("incbuffer");
218
if (plaintext_length + BUFFER_SIZE > plaintext_capacity){
219
*plaintext = realloc(*plaintext,
220
(unsigned int)plaintext_capacity
221
+ BUFFER_SIZE);
222
if (*plaintext == NULL){
223
perror("realloc");
344
224
plaintext_length = -1;
345
225
goto decrypt_end;
226
}
227
plaintext_capacity += BUFFER_SIZE;
346
228
}
347
229
348
230
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
349
231
BUFFER_SIZE);
350
232
/* Print the data, if any */
351
if(ret == 0){
233
if (ret == 0){
352
234
/* EOF */
353
235
break;
354
236
}
359
241
}
360
242
plaintext_length += ret;
361
243
}
362
244
363
245
if(debug){
364
246
fprintf(stderr, "Decrypted password is: ");
365
for(ssize_t i = 0; i < plaintext_length; i++){
247
for(size_t i = 0; i < plaintext_length; i++){
366
248
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
367
249
}
368
250
fprintf(stderr, "\n");
378
260
return plaintext_length;
379
261
}
380
262
381
static const char * safer_gnutls_strerror(int value){
382
const char *ret = gnutls_strerror(value); /* Spurious warning from
383
-Wunreachable-code */
384
if(ret == NULL)
263
static const char * safer_gnutls_strerror (int value) {
264
const char *ret = gnutls_strerror (value);
265
if (ret == NULL)
385
266
ret = "(unknown)";
386
267
return ret;
387
268
}
388
269
389
/* GnuTLS log function callback */
390
270
static void debuggnutls(__attribute__((unused)) int level,
391
271
const char* string){
392
fprintf(stderr, "GnuTLS: %s", string);
272
fprintf(stderr, "%s", string);
393
273
}
394
274
395
static int init_gnutls_global(const char *pubkeyfilename,
396
const char *seckeyfilename){
275
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
276
gnutls_dh_params_t *dh_params){
277
const char *err;
397
278
int ret;
398
279
399
280
if(debug){
400
281
fprintf(stderr, "Initializing GnuTLS\n");
401
282
}
402
403
ret = gnutls_global_init();
404
if(ret != GNUTLS_E_SUCCESS){
405
fprintf(stderr, "GnuTLS global_init: %s\n",
406
safer_gnutls_strerror(ret));
283
284
if ((ret = gnutls_global_init ())
285
!= GNUTLS_E_SUCCESS) {
286
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
407
287
return -1;
408
288
}
409
289
410
if(debug){
411
/* "Use a log level over 10 to enable all debugging options."
412
* - GnuTLS manual
413
*/
290
if (debug){
414
291
gnutls_global_set_log_level(11);
415
292
gnutls_global_set_log_function(debuggnutls);
416
293
}
417
294
418
/* OpenPGP credentials */
419
gnutls_certificate_allocate_credentials(&mc.cred);
420
if(ret != GNUTLS_E_SUCCESS){
421
fprintf(stderr, "GnuTLS memory error: %s\n", /* Spurious warning
422
from
423
-Wunreachable-code
424
*/
425
safer_gnutls_strerror(ret));
426
gnutls_global_deinit();
295
/* openpgp credentials */
296
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
297
!= GNUTLS_E_SUCCESS) {
298
fprintf (stderr, "memory error: %s\n",
299
safer_gnutls_strerror(ret));
427
300
return -1;
428
301
}
429
302
430
303
if(debug){
431
fprintf(stderr, "Attempting to use OpenPGP public key %s and"
432
" secret key %s as GnuTLS credentials\n", pubkeyfilename,
433
seckeyfilename);
304
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
305
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
306
seckeyfile);
434
307
}
435
308
436
309
ret = gnutls_certificate_set_openpgp_key_file
437
(mc.cred, pubkeyfilename, seckeyfilename,
438
GNUTLS_OPENPGP_FMT_BASE64);
439
if(ret != GNUTLS_E_SUCCESS){
440
fprintf(stderr,
441
"Error[%d] while reading the OpenPGP key pair ('%s',"
442
" '%s')\n", ret, pubkeyfilename, seckeyfilename);
443
fprintf(stderr, "The GnuTLS error is: %s\n",
444
safer_gnutls_strerror(ret));
445
goto globalfail;
446
}
447
448
/* GnuTLS server initialization */
449
ret = gnutls_dh_params_init(&mc.dh_params);
450
if(ret != GNUTLS_E_SUCCESS){
451
fprintf(stderr, "Error in GnuTLS DH parameter initialization:"
452
" %s\n", safer_gnutls_strerror(ret));
453
goto globalfail;
454
}
455
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
456
if(ret != GNUTLS_E_SUCCESS){
457
fprintf(stderr, "Error in GnuTLS prime generation: %s\n",
458
safer_gnutls_strerror(ret));
459
goto globalfail;
460
}
461
462
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
463
464
return 0;
465
466
globalfail:
467
468
gnutls_certificate_free_credentials(mc.cred);
469
gnutls_global_deinit();
470
gnutls_dh_params_deinit(mc.dh_params);
471
return -1;
472
}
473
474
static int init_gnutls_session(gnutls_session_t *session){
475
int ret;
476
/* GnuTLS session creation */
477
ret = gnutls_init(session, GNUTLS_SERVER);
478
if(ret != GNUTLS_E_SUCCESS){
310
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
311
if (ret != GNUTLS_E_SUCCESS) {
312
fprintf
313
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
314
" '%s')\n",
315
ret, pubkeyfile, seckeyfile);
316
fprintf(stdout, "The Error is: %s\n",
317
safer_gnutls_strerror(ret));
318
return -1;
319
}
320
321
//GnuTLS server initialization
322
if ((ret = gnutls_dh_params_init(dh_params))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf (stderr, "Error in dh parameter initialization: %s\n",
325
safer_gnutls_strerror(ret));
326
return -1;
327
}
328
329
if ((ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits))
330
!= GNUTLS_E_SUCCESS) {
331
fprintf (stderr, "Error in prime generation: %s\n",
332
safer_gnutls_strerror(ret));
333
return -1;
334
}
335
336
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
337
338
// GnuTLS session creation
339
if ((ret = gnutls_init(session, GNUTLS_SERVER))
340
!= GNUTLS_E_SUCCESS){
479
341
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
480
342
safer_gnutls_strerror(ret));
481
343
}
482
344
483
{
484
const char *err;
485
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
486
if(ret != GNUTLS_E_SUCCESS){
487
fprintf(stderr, "Syntax error at: %s\n", err);
488
fprintf(stderr, "GnuTLS error: %s\n",
489
safer_gnutls_strerror(ret));
490
gnutls_deinit(*session);
491
return -1;
492
}
345
if ((ret = gnutls_priority_set_direct(*session, mc->priority, &err))
346
!= GNUTLS_E_SUCCESS) {
347
fprintf(stderr, "Syntax error at: %s\n", err);
348
fprintf(stderr, "GnuTLS error: %s\n",
349
safer_gnutls_strerror(ret));
350
return -1;
493
351
}
494
352
495
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
496
mc.cred);
497
if(ret != GNUTLS_E_SUCCESS){
498
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
353
if ((ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
354
mc->cred))
355
!= GNUTLS_E_SUCCESS) {
356
fprintf(stderr, "Error setting a credentials set: %s\n",
499
357
safer_gnutls_strerror(ret));
500
gnutls_deinit(*session);
501
358
return -1;
502
359
}
503
360
504
361
/* ignore client certificate if any. */
505
gnutls_certificate_server_set_request(*session,
506
GNUTLS_CERT_IGNORE);
362
gnutls_certificate_server_set_request (*session,
363
GNUTLS_CERT_IGNORE);
507
364
508
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
365
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
509
366
510
367
return 0;
511
368
}
512
369
513
/* Avahi log function callback */
514
370
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
515
371
__attribute__((unused)) const char *txt){}
516
372
517
sig_atomic_t quit_now = 0;
518
int signal_received = 0;
519
520
/* Called when a Mandos server is found */
521
373
static int start_mandos_communication(const char *ip, uint16_t port,
522
374
AvahiIfIndex if_index,
523
int af){
524
int ret, tcp_sd = -1;
525
ssize_t sret;
526
union {
527
struct sockaddr_in in;
528
struct sockaddr_in6 in6;
529
} to;
375
mandos_context *mc){
376
int ret, tcp_sd;
377
struct sockaddr_in6 to;
530
378
char *buffer = NULL;
531
379
char *decrypted_buffer;
532
380
size_t buffer_length = 0;
533
381
size_t buffer_capacity = 0;
534
size_t written;
382
ssize_t decrypted_buffer_size;
383
size_t written = 0;
535
384
int retval = 0;
385
char interface[IF_NAMESIZE];
536
386
gnutls_session_t session;
537
int pf; /* Protocol family */
538
539
if(quit_now){
540
return -1;
541
}
542
543
switch(af){
544
case AF_INET6:
545
pf = PF_INET6;
546
break;
547
case AF_INET:
548
pf = PF_INET;
549
break;
550
default:
551
fprintf(stderr, "Bad address family: %d\n", af);
552
return -1;
553
}
554
555
ret = init_gnutls_session(&session);
556
if(ret != 0){
557
return -1;
558
}
387
gnutls_dh_params_t dh_params;
559
388
560
389
if(debug){
561
fprintf(stderr, "Setting up a TCP connection to %s, port %" PRIu16
562
"\n", ip, port);
390
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
391
ip, port);
563
392
}
564
393
565
tcp_sd = socket(pf, SOCK_STREAM, 0);
566
if(tcp_sd < 0){
394
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
395
if(tcp_sd < 0) {
567
396
perror("socket");
568
retval = -1;
569
goto mandos_end;
570
}
571
572
if(quit_now){
573
goto mandos_end;
574
}
575
576
memset(&to, 0, sizeof(to));
577
if(af == AF_INET6){
578
to.in6.sin6_family = (sa_family_t)af;
579
ret = inet_pton(af, ip, &to.in6.sin6_addr);
580
} else { /* IPv4 */
581
to.in.sin_family = (sa_family_t)af;
582
ret = inet_pton(af, ip, &to.in.sin_addr);
583
}
584
if(ret < 0 ){
397
return -1;
398
}
399
400
if(debug){
401
if(if_indextoname((unsigned int)if_index, interface) == NULL){
402
perror("if_indextoname");
403
return -1;
404
}
405
fprintf(stderr, "Binding to interface %s\n", interface);
406
}
407
408
memset(&to,0,sizeof(to)); /* Spurious warning */
409
to.sin6_family = AF_INET6;
410
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
411
if (ret < 0 ){
585
412
perror("inet_pton");
586
retval = -1;
587
goto mandos_end;
413
return -1;
588
414
}
589
415
if(ret == 0){
590
416
fprintf(stderr, "Bad address: %s\n", ip);
591
retval = -1;
592
goto mandos_end;
593
}
594
if(af == AF_INET6){
595
to.in6.sin6_port = htons(port); /* Spurious warnings from
596
-Wconversion and
597
-Wunreachable-code */
598
599
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
600
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
601
-Wunreachable-code*/
602
if(if_index == AVAHI_IF_UNSPEC){
603
fprintf(stderr, "An IPv6 link-local address is incomplete"
604
" without a network interface\n");
605
retval = -1;
606
goto mandos_end;
607
}
608
/* Set the network interface number as scope */
609
to.in6.sin6_scope_id = (uint32_t)if_index;
610
}
611
} else {
612
to.in.sin_port = htons(port); /* Spurious warnings from
613
-Wconversion and
614
-Wunreachable-code */
615
}
417
return -1;
418
}
419
to.sin6_port = htons(port); /* Spurious warning */
616
420
617
if(quit_now){
618
goto mandos_end;
619
}
421
to.sin6_scope_id = (uint32_t)if_index;
620
422
621
423
if(debug){
622
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
623
char interface[IF_NAMESIZE];
624
if(if_indextoname((unsigned int)if_index, interface) == NULL){
625
perror("if_indextoname");
626
} else {
627
fprintf(stderr, "Connection to: %s%%%s, port %" PRIu16 "\n",
628
ip, interface, port);
629
}
630
} else {
631
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
632
port);
633
}
634
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
635
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
636
const char *pcret;
637
if(af == AF_INET6){
638
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
639
sizeof(addrstr));
640
} else {
641
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
642
sizeof(addrstr));
643
}
644
if(pcret == NULL){
424
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
425
char addrstr[INET6_ADDRSTRLEN] = "";
426
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
427
sizeof(addrstr)) == NULL){
645
428
perror("inet_ntop");
646
429
} else {
647
430
if(strcmp(addrstr, ip) != 0){
650
433
}
651
434
}
652
435
653
if(quit_now){
654
goto mandos_end;
655
}
656
657
if(af == AF_INET6){
658
ret = connect(tcp_sd, &to.in6, sizeof(to));
659
} else {
660
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
661
}
662
if(ret < 0){
436
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
437
if (ret < 0){
663
438
perror("connect");
439
return -1;
440
}
441
442
ret = initgnutls (mc, &session, &dh_params);
443
if (ret != 0){
664
444
retval = -1;
665
goto mandos_end;
666
}
667
668
if(quit_now){
669
goto mandos_end;
670
}
671
672
const char *out = mandos_protocol_version;
673
written = 0;
674
while(true){
675
size_t out_size = strlen(out);
676
ret = (int)TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
677
out_size - written));
678
if(ret == -1){
679
perror("write");
680
retval = -1;
681
goto mandos_end;
682
}
683
written += (size_t)ret;
684
if(written < out_size){
685
continue;
686
} else {
687
if(out == mandos_protocol_version){
688
written = 0;
689
out = "\r\n";
690
} else {
691
break;
692
}
693
}
694
695
if(quit_now){
696
goto mandos_end;
697
}
698
}
445
return -1;
446
}
447
448
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
699
449
700
450
if(debug){
701
451
fprintf(stderr, "Establishing TLS session with %s\n", ip);
702
452
}
703
453
704
if(quit_now){
705
goto mandos_end;
706
}
707
708
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
709
710
if(quit_now){
711
goto mandos_end;
712
}
713
714
do {
715
ret = gnutls_handshake(session);
716
if(quit_now){
717
goto mandos_end;
718
}
719
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
720
721
if(ret != GNUTLS_E_SUCCESS){
454
ret = gnutls_handshake (session);
455
456
if (ret != GNUTLS_E_SUCCESS){
722
457
if(debug){
723
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
724
gnutls_perror(ret);
458
fprintf(stderr, "\n*** Handshake failed ***\n");
459
gnutls_perror (ret);
725
460
}
726
461
retval = -1;
727
goto mandos_end;
462
goto exit;
728
463
}
729
464
730
/* Read OpenPGP packet that contains the wanted password */
465
//Retrieve OpenPGP packet that contains the wanted password
731
466
732
467
if(debug){
733
fprintf(stderr, "Retrieving OpenPGP encrypted password from %s\n",
468
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
734
469
ip);
735
470
}
736
471
737
472
while(true){
738
739
if(quit_now){
740
goto mandos_end;
741
}
742
743
buffer_capacity = incbuffer(&buffer, buffer_length,
744
buffer_capacity);
745
if(buffer_capacity == 0){
746
perror("incbuffer");
747
retval = -1;
748
goto mandos_end;
749
}
750
751
if(quit_now){
752
goto mandos_end;
753
}
754
755
sret = gnutls_record_recv(session, buffer+buffer_length,
756
BUFFER_SIZE);
757
if(sret == 0){
473
if (buffer_length + BUFFER_SIZE > buffer_capacity){
474
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
475
if (buffer == NULL){
476
perror("realloc");
477
goto exit;
478
}
479
buffer_capacity += BUFFER_SIZE;
480
}
481
482
ret = gnutls_record_recv(session, buffer+buffer_length,
483
BUFFER_SIZE);
484
if (ret == 0){
758
485
break;
759
486
}
760
if(sret < 0){
761
switch(sret){
487
if (ret < 0){
488
switch(ret){
762
489
case GNUTLS_E_INTERRUPTED:
763
490
case GNUTLS_E_AGAIN:
764
491
break;
765
492
case GNUTLS_E_REHANDSHAKE:
766
do {
767
ret = gnutls_handshake(session);
768
769
if(quit_now){
770
goto mandos_end;
771
}
772
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
773
if(ret < 0){
774
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
775
gnutls_perror(ret);
493
ret = gnutls_handshake (session);
494
if (ret < 0){
495
fprintf(stderr, "\n*** Handshake failed ***\n");
496
gnutls_perror (ret);
776
497
retval = -1;
777
goto mandos_end;
498
goto exit;
778
499
}
779
500
break;
780
501
default:
781
502
fprintf(stderr, "Unknown error while reading data from"
782
" encrypted session with Mandos server\n");
503
" encrypted session with mandos server\n");
783
504
retval = -1;
784
gnutls_bye(session, GNUTLS_SHUT_RDWR);
785
goto mandos_end;
505
gnutls_bye (session, GNUTLS_SHUT_RDWR);
506
goto exit;
786
507
}
787
508
} else {
788
buffer_length += (size_t) sret;
509
buffer_length += (size_t) ret;
789
510
}
790
511
}
791
512
792
if(debug){
793
fprintf(stderr, "Closing TLS session\n");
794
}
795
796
if(quit_now){
797
goto mandos_end;
798
}
799
800
gnutls_bye(session, GNUTLS_SHUT_RDWR);
801
802
if(quit_now){
803
goto mandos_end;
804
}
805
806
if(buffer_length > 0){
807
ssize_t decrypted_buffer_size;
513
if (buffer_length > 0){
808
514
decrypted_buffer_size = pgp_packet_decrypt(buffer,
809
515
buffer_length,
810
&decrypted_buffer);
811
if(decrypted_buffer_size >= 0){
812
813
written = 0;
516
&decrypted_buffer,
517
keydir);
518
if (decrypted_buffer_size >= 0){
814
519
while(written < (size_t) decrypted_buffer_size){
815
if(quit_now){
816
goto mandos_end;
817
}
818
819
ret = (int)fwrite(decrypted_buffer + written, 1,
820
(size_t)decrypted_buffer_size - written,
821
stdout);
520
ret = (int)fwrite (decrypted_buffer + written, 1,
521
(size_t)decrypted_buffer_size - written,
522
stdout);
822
523
if(ret == 0 and ferror(stdout)){
823
524
if(debug){
824
525
fprintf(stderr, "Error writing encrypted data: %s\n",
833
534
} else {
834
535
retval = -1;
835
536
}
836
} else {
837
retval = -1;
838
}
839
840
/* Shutdown procedure */
841
842
mandos_end:
537
}
538
539
//shutdown procedure
540
541
if(debug){
542
fprintf(stderr, "Closing TLS session\n");
543
}
544
843
545
free(buffer);
844
if(tcp_sd >= 0){
845
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
846
}
847
if(ret == -1){
848
perror("close");
849
}
850
gnutls_deinit(session);
851
if(quit_now){
852
retval = -1;
853
}
546
gnutls_bye (session, GNUTLS_SHUT_RDWR);
547
exit:
548
close(tcp_sd);
549
gnutls_deinit (session);
550
gnutls_certificate_free_credentials (mc->cred);
551
gnutls_global_deinit ();
854
552
return retval;
855
553
}
856
554
857
555
static void resolve_callback(AvahiSServiceResolver *r,
858
556
AvahiIfIndex interface,
859
AvahiProtocol proto,
557
AVAHI_GCC_UNUSED AvahiProtocol protocol,
860
558
AvahiResolverEvent event,
861
559
const char *name,
862
560
const char *type,
867
565
AVAHI_GCC_UNUSED AvahiStringList *txt,
868
566
AVAHI_GCC_UNUSED AvahiLookupResultFlags
869
567
flags,
870
AVAHI_GCC_UNUSED void* userdata){
871
assert(r);
568
void* userdata) {
569
mandos_context *mc = userdata;
570
assert(r); /* Spurious warning */
872
571
873
572
/* Called whenever a service has been resolved successfully or
874
573
timed out */
875
574
876
if(quit_now){
877
return;
878
}
879
880
switch(event){
575
switch (event) {
881
576
default:
882
577
case AVAHI_RESOLVER_FAILURE:
883
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
884
" of type '%s' in domain '%s': %s\n", name, type, domain,
885
avahi_strerror(avahi_server_errno(mc.server)));
578
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
579
" type '%s' in domain '%s': %s\n", name, type, domain,
580
avahi_strerror(avahi_server_errno(mc->server)));
886
581
break;
887
582
888
583
case AVAHI_RESOLVER_FOUND:
890
585
char ip[AVAHI_ADDRESS_STR_MAX];
891
586
avahi_address_snprint(ip, sizeof(ip), address);
892
587
if(debug){
893
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
894
PRIdMAX ") on port %" PRIu16 "\n", name, host_name,
895
ip, (intmax_t)interface, port);
588
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
589
" port %d\n", name, host_name, ip, port);
896
590
}
897
int ret = start_mandos_communication(ip, port, interface,
898
avahi_proto_to_af(proto));
899
if(ret == 0){
900
avahi_simple_poll_quit(mc.simple_poll);
591
int ret = start_mandos_communication(ip, port, interface, mc);
592
if (ret == 0){
593
exit(EXIT_SUCCESS);
901
594
}
902
595
}
903
596
}
904
597
avahi_s_service_resolver_free(r);
905
598
}
906
599
907
static void browse_callback(AvahiSServiceBrowser *b,
908
AvahiIfIndex interface,
909
AvahiProtocol protocol,
910
AvahiBrowserEvent event,
911
const char *name,
912
const char *type,
913
const char *domain,
914
AVAHI_GCC_UNUSED AvahiLookupResultFlags
915
flags,
916
AVAHI_GCC_UNUSED void* userdata){
917
assert(b);
600
static void browse_callback( AvahiSServiceBrowser *b,
601
AvahiIfIndex interface,
602
AvahiProtocol protocol,
603
AvahiBrowserEvent event,
604
const char *name,
605
const char *type,
606
const char *domain,
607
AVAHI_GCC_UNUSED AvahiLookupResultFlags
608
flags,
609
void* userdata) {
610
mandos_context *mc = userdata;
611
assert(b); /* Spurious warning */
918
612
919
613
/* Called whenever a new services becomes available on the LAN or
920
614
is removed from the LAN */
921
615
922
if(quit_now){
923
return;
924
}
925
926
switch(event){
616
switch (event) {
927
617
default:
928
618
case AVAHI_BROWSER_FAILURE:
929
619
930
fprintf(stderr, "(Avahi browser) %s\n",
931
avahi_strerror(avahi_server_errno(mc.server)));
932
avahi_simple_poll_quit(mc.simple_poll);
620
fprintf(stderr, "(Browser) %s\n",
621
avahi_strerror(avahi_server_errno(mc->server)));
622
avahi_simple_poll_quit(mc->simple_poll);
933
623
return;
934
624
935
625
case AVAHI_BROWSER_NEW:
936
/* We ignore the returned Avahi resolver object. In the callback
937
function we free it. If the Avahi server is terminated before
938
the callback function is called the Avahi server will free the
939
resolver for us. */
626
/* We ignore the returned resolver object. In the callback
627
function we free it. If the server is terminated before
628
the callback function is called the server will free
629
the resolver for us. */
940
630
941
if(avahi_s_service_resolver_new(mc.server, interface, protocol,
942
name, type, domain, protocol, 0,
943
resolve_callback, NULL) == NULL)
944
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
945
name, avahi_strerror(avahi_server_errno(mc.server)));
631
if (!(avahi_s_service_resolver_new(mc->server, interface,
632
protocol, name, type, domain,
633
AVAHI_PROTO_INET6, 0,
634
resolve_callback, mc)))
635
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
636
avahi_strerror(avahi_server_errno(mc->server)));
946
637
break;
947
638
948
639
case AVAHI_BROWSER_REMOVE:
950
641
951
642
case AVAHI_BROWSER_ALL_FOR_NOW:
952
643
case AVAHI_BROWSER_CACHE_EXHAUSTED:
953
if(debug){
954
fprintf(stderr, "No Mandos server found, still searching...\n");
955
}
956
644
break;
957
645
}
958
646
}
959
647
960
/* stop main loop after sigterm has been called */
961
static void handle_sigterm(int sig){
962
if(quit_now){
963
return;
964
}
965
quit_now = 1;
966
signal_received = sig;
967
int old_errno = errno;
968
if(mc.simple_poll != NULL){
969
avahi_simple_poll_quit(mc.simple_poll);
970
}
971
errno = old_errno;
648
/* Combines file name and path and returns the malloced new
649
string. some sane checks could/should be added */
650
static const char *combinepath(const char *first, const char *second){
651
size_t f_len = strlen(first);
652
size_t s_len = strlen(second);
653
char *tmp = malloc(f_len + s_len + 2);
654
if (tmp == NULL){
655
return NULL;
656
}
657
if(f_len > 0){
658
memcpy(tmp, first, f_len); /* Spurious warning */
659
}
660
tmp[f_len] = '/';
661
if(s_len > 0){
662
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
663
}
664
tmp[f_len + 1 + s_len] = '\0';
665
return tmp;
972
666
}
973
667
974
int main(int argc, char *argv[]){
975
AvahiSServiceBrowser *sb = NULL;
976
int error;
977
int ret;
978
intmax_t tmpmax;
979
char *tmp;
980
int exitcode = EXIT_SUCCESS;
981
const char *interface = "eth0";
982
struct ifreq network;
983
int sd = -1;
984
bool take_down_interface = false;
985
uid_t uid;
986
gid_t gid;
987
char *connect_to = NULL;
988
char tempdir[] = "/tmp/mandosXXXXXX";
989
bool tempdir_created = false;
990
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
991
const char *seckey = PATHDIR "/" SECKEY;
992
const char *pubkey = PATHDIR "/" PUBKEY;
993
994
bool gnutls_initialized = false;
995
bool gpgme_initialized = false;
996
float delay = 2.5f;
997
998
struct sigaction old_sigterm_action;
999
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1000
1001
{
1002
struct argp_option options[] = {
1003
{ .name = "debug", .key = 128,
1004
.doc = "Debug mode", .group = 3 },
1005
{ .name = "connect", .key = 'c',
1006
.arg = "ADDRESS:PORT",
1007
.doc = "Connect directly to a specific Mandos server",
1008
.group = 1 },
1009
{ .name = "interface", .key = 'i',
1010
.arg = "NAME",
1011
.doc = "Network interface that will be used to search for"
1012
" Mandos servers",
1013
.group = 1 },
1014
{ .name = "seckey", .key = 's',
1015
.arg = "FILE",
1016
.doc = "OpenPGP secret key file base name",
1017
.group = 1 },
1018
{ .name = "pubkey", .key = 'p',
1019
.arg = "FILE",
1020
.doc = "OpenPGP public key file base name",
1021
.group = 2 },
1022
{ .name = "dh-bits", .key = 129,
1023
.arg = "BITS",
1024
.doc = "Bit length of the prime number used in the"
1025
" Diffie-Hellman key exchange",
1026
.group = 2 },
1027
{ .name = "priority", .key = 130,
1028
.arg = "STRING",
1029
.doc = "GnuTLS priority string for the TLS handshake",
1030
.group = 1 },
1031
{ .name = "delay", .key = 131,
1032
.arg = "SECONDS",
1033
.doc = "Maximum delay to wait for interface startup",
1034
.group = 2 },
1035
{ .name = NULL }
1036
};
668
669
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
670
AvahiServerConfig config;
671
AvahiSServiceBrowser *sb = NULL;
672
int error;
673
int ret;
674
int debug_int;
675
int returncode = EXIT_SUCCESS;
676
const char *interface = "eth0";
677
struct ifreq network;
678
int sd;
679
char *connect_to = NULL;
680
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
681
mandos_context mc = { .simple_poll = NULL, .server = NULL,
682
.dh_bits = 1024, .priority = "SECURE256"};
1037
683
1038
error_t parse_opt(int key, char *arg,
1039
struct argp_state *state){
1040
switch(key){
1041
case 128: /* --debug */
1042
debug = true;
1043
break;
1044
case 'c': /* --connect */
1045
connect_to = arg;
1046
break;
1047
case 'i': /* --interface */
1048
interface = arg;
1049
break;
1050
case 's': /* --seckey */
1051
seckey = arg;
1052
break;
1053
case 'p': /* --pubkey */
1054
pubkey = arg;
1055
break;
1056
case 129: /* --dh-bits */
1057
errno = 0;
1058
tmpmax = strtoimax(arg, &tmp, 10);
1059
if(errno != 0 or tmp == arg or *tmp != '\0'
1060
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1061
fprintf(stderr, "Bad number of DH bits\n");
1062
exit(EXIT_FAILURE);
1063
}
1064
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1065
break;
1066
case 130: /* --priority */
1067
mc.priority = arg;
1068
break;
1069
case 131: /* --delay */
1070
errno = 0;
1071
delay = strtof(arg, &tmp);
1072
if(errno != 0 or tmp == arg or *tmp != '\0'){
1073
fprintf(stderr, "Bad delay\n");
1074
exit(EXIT_FAILURE);
1075
}
1076
break;
1077
case ARGP_KEY_ARG:
1078
argp_usage(state);
1079
case ARGP_KEY_END:
1080
break;
684
debug_int = debug ? 1 : 0;
685
while (true){
686
struct option long_options[] = {
687
{"debug", no_argument, &debug_int, 1},
688
{"connect", required_argument, NULL, 'c'},
689
{"interface", required_argument, NULL, 'i'},
690
{"keydir", required_argument, NULL, 'd'},
691
{"seckey", required_argument, NULL, 's'},
692
{"pubkey", required_argument, NULL, 'p'},
693
{"dh-bits", required_argument, NULL, 'D'},
694
{"priority", required_argument, NULL, 'P'},
695
{0, 0, 0, 0} };
696
697
int option_index = 0;
698
ret = getopt_long (argc, argv, "i:", long_options,
699
&option_index);
700
701
if (ret == -1){
702
break;
703
}
704
705
switch(ret){
706
case 0:
707
break;
708
case 'i':
709
interface = optarg;
710
break;
711
case 'c':
712
connect_to = optarg;
713
break;
714
case 'd':
715
keydir = optarg;
716
break;
717
case 'p':
718
pubkeyfile = optarg;
719
break;
720
case 's':
721
seckeyfile = optarg;
722
break;
723
case 'D':
724
errno = 0;
725
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
726
if (errno){
727
perror("strtol");
728
exit(EXIT_FAILURE);
729
}
730
break;
731
case 'P':
732
mc.priority = optarg;
733
break;
734
case '?':
1081
735
default:
1082
return ARGP_ERR_UNKNOWN;
736
exit(EXIT_FAILURE);
1083
737
}
1084
return 0;
1085
}
1086
1087
struct argp argp = { .options = options, .parser = parse_opt,
1088
.args_doc = "",
1089
.doc = "Mandos client -- Get and decrypt"
1090
" passwords from a Mandos server" };
1091
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
1092
if(ret == ARGP_ERR_UNKNOWN){
1093
fprintf(stderr, "Unknown error while parsing arguments\n");
1094
exitcode = EXIT_FAILURE;
1095
goto end;
1096
}
1097
}
1098
1099
if(not debug){
1100
avahi_set_log_function(empty_log);
1101
}
1102
1103
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1104
from the signal handler */
1105
/* Initialize the pseudo-RNG for Avahi */
1106
srand((unsigned int) time(NULL));
1107
mc.simple_poll = avahi_simple_poll_new();
1108
if(mc.simple_poll == NULL){
1109
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1110
exitcode = EXIT_FAILURE;
1111
goto end;
1112
}
1113
1114
sigemptyset(&sigterm_action.sa_mask);
1115
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1116
if(ret == -1){
1117
perror("sigaddset");
1118
exitcode = EXIT_FAILURE;
1119
goto end;
1120
}
1121
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1122
if(ret == -1){
1123
perror("sigaddset");
1124
exitcode = EXIT_FAILURE;
1125
goto end;
1126
}
1127
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1128
if(ret == -1){
1129
perror("sigaddset");
1130
exitcode = EXIT_FAILURE;
1131
goto end;
1132
}
1133
/* Need to check if the handler is SIG_IGN before handling:
1134
| [[info:libc:Initial Signal Actions]] |
1135
| [[info:libc:Basic Signal Handling]] |
1136
*/
1137
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1138
if(ret == -1){
1139
perror("sigaction");
1140
return EXIT_FAILURE;
1141
}
1142
if(old_sigterm_action.sa_handler != SIG_IGN){
1143
ret = sigaction(SIGINT, &sigterm_action, NULL);
1144
if(ret == -1){
1145
perror("sigaction");
1146
exitcode = EXIT_FAILURE;
1147
goto end;
1148
}
1149
}
1150
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1151
if(ret == -1){
1152
perror("sigaction");
1153
return EXIT_FAILURE;
1154
}
1155
if(old_sigterm_action.sa_handler != SIG_IGN){
1156
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1157
if(ret == -1){
1158
perror("sigaction");
1159
exitcode = EXIT_FAILURE;
1160
goto end;
1161
}
1162
}
1163
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1164
if(ret == -1){
1165
perror("sigaction");
1166
return EXIT_FAILURE;
1167
}
1168
if(old_sigterm_action.sa_handler != SIG_IGN){
1169
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1170
if(ret == -1){
1171
perror("sigaction");
1172
exitcode = EXIT_FAILURE;
1173
goto end;
1174
}
1175
}
1176
1177
/* If the interface is down, bring it up */
1178
if(interface[0] != '\0'){
738
}
739
debug = debug_int ? true : false;
740
741
pubkeyfile = combinepath(keydir, pubkeyfile);
742
if (pubkeyfile == NULL){
743
perror("combinepath");
744
returncode = EXIT_FAILURE;
745
goto exit;
746
}
747
748
seckeyfile = combinepath(keydir, seckeyfile);
749
if (seckeyfile == NULL){
750
perror("combinepath");
751
goto exit;
752
}
753
1179
754
if_index = (AvahiIfIndex) if_nametoindex(interface);
1180
755
if(if_index == 0){
1181
756
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1182
exitcode = EXIT_FAILURE;
1183
goto end;
1184
}
1185
1186
if(quit_now){
1187
goto end;
1188
}
1189
1190
#ifdef __linux__
1191
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1192
messages to mess up the prompt */
1193
ret = klogctl(8, NULL, 5);
1194
bool restore_loglevel = true;
1195
if(ret == -1){
1196
restore_loglevel = false;
1197
perror("klogctl");
1198
}
1199
#endif /* __linux__ */
757
exit(EXIT_FAILURE);
758
}
759
760
if(connect_to != NULL){
761
/* Connect directly, do not use Zeroconf */
762
/* (Mainly meant for debugging) */
763
char *address = strrchr(connect_to, ':');
764
if(address == NULL){
765
fprintf(stderr, "No colon in address\n");
766
exit(EXIT_FAILURE);
767
}
768
errno = 0;
769
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
770
if(errno){
771
perror("Bad port number");
772
exit(EXIT_FAILURE);
773
}
774
*address = '\0';
775
address = connect_to;
776
ret = start_mandos_communication(address, port, if_index, &mc);
777
if(ret < 0){
778
exit(EXIT_FAILURE);
779
} else {
780
exit(EXIT_SUCCESS);
781
}
782
}
1200
783
1201
784
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1202
if(sd < 0){
785
if(sd < 0) {
1203
786
perror("socket");
1204
exitcode = EXIT_FAILURE;
1205
#ifdef __linux__
1206
if(restore_loglevel){
1207
ret = klogctl(7, NULL, 0);
1208
if(ret == -1){
1209
perror("klogctl");
1210
}
1211
}
1212
#endif /* __linux__ */
1213
goto end;
787
returncode = EXIT_FAILURE;
788
goto exit;
1214
789
}
1215
strcpy(network.ifr_name, interface);
790
strcpy(network.ifr_name, interface); /* Spurious warning */
1216
791
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1217
792
if(ret == -1){
793
1218
794
perror("ioctl SIOCGIFFLAGS");
1219
#ifdef __linux__
1220
if(restore_loglevel){
1221
ret = klogctl(7, NULL, 0);
1222
if(ret == -1){
1223
perror("klogctl");
1224
}
1225
}
1226
#endif /* __linux__ */
1227
exitcode = EXIT_FAILURE;
1228
goto end;
795
returncode = EXIT_FAILURE;
796
goto exit;
1229
797
}
1230
798
if((network.ifr_flags & IFF_UP) == 0){
1231
799
network.ifr_flags |= IFF_UP;
1232
take_down_interface = true;
1233
800
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1234
801
if(ret == -1){
1235
take_down_interface = false;
1236
802
perror("ioctl SIOCSIFFLAGS");
1237
exitcode = EXIT_FAILURE;
1238
#ifdef __linux__
1239
if(restore_loglevel){
1240
ret = klogctl(7, NULL, 0);
1241
if(ret == -1){
1242
perror("klogctl");
1243
}
1244
}
1245
#endif /* __linux__ */
1246
goto end;
1247
}
1248
}
1249
/* sleep checking until interface is running */
1250
for(int i=0; i < delay * 4; i++){
1251
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1252
if(ret == -1){
1253
perror("ioctl SIOCGIFFLAGS");
1254
} else if(network.ifr_flags & IFF_RUNNING){
1255
break;
1256
}
1257
struct timespec sleeptime = { .tv_nsec = 250000000 };
1258
ret = nanosleep(&sleeptime, NULL);
1259
if(ret == -1 and errno != EINTR){
1260
perror("nanosleep");
1261
}
1262
}
1263
if(not take_down_interface){
1264
/* We won't need the socket anymore */
1265
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1266
if(ret == -1){
1267
perror("close");
1268
}
1269
}
1270
#ifdef __linux__
1271
if(restore_loglevel){
1272
/* Restores kernel loglevel to default */
1273
ret = klogctl(7, NULL, 0);
1274
if(ret == -1){
1275
perror("klogctl");
1276
}
1277
}
1278
#endif /* __linux__ */
1279
}
1280
1281
if(quit_now){
1282
goto end;
1283
}
1284
1285
uid = getuid();
1286
gid = getgid();
1287
1288
/* Drop any group privileges we might have, just to be safe */
1289
errno = 0;
1290
ret = setgid(gid);
1291
if(ret == -1){
1292
perror("setgid");
1293
}
1294
1295
/* Drop user privileges */
1296
errno = 0;
1297
/* Will we need privileges later? */
1298
if(take_down_interface){
1299
/* Drop user privileges temporarily */
1300
ret = seteuid(uid);
1301
if(ret == -1){
1302
perror("seteuid");
1303
}
1304
} else {
1305
/* Drop user privileges permanently */
1306
ret = setuid(uid);
1307
if(ret == -1){
1308
perror("setuid");
1309
}
1310
}
1311
1312
if(quit_now){
1313
goto end;
1314
}
1315
1316
ret = init_gnutls_global(pubkey, seckey);
1317
if(ret == -1){
1318
fprintf(stderr, "init_gnutls_global failed\n");
1319
exitcode = EXIT_FAILURE;
1320
goto end;
1321
} else {
1322
gnutls_initialized = true;
1323
}
1324
1325
if(quit_now){
1326
goto end;
1327
}
1328
1329
tempdir_created = true;
1330
if(mkdtemp(tempdir) == NULL){
1331
tempdir_created = false;
1332
perror("mkdtemp");
1333
goto end;
1334
}
1335
1336
if(quit_now){
1337
goto end;
1338
}
1339
1340
if(not init_gpgme(pubkey, seckey, tempdir)){
1341
fprintf(stderr, "init_gpgme failed\n");
1342
exitcode = EXIT_FAILURE;
1343
goto end;
1344
} else {
1345
gpgme_initialized = true;
1346
}
1347
1348
if(quit_now){
1349
goto end;
1350
}
1351
1352
if(connect_to != NULL){
1353
/* Connect directly, do not use Zeroconf */
1354
/* (Mainly meant for debugging) */
1355
char *address = strrchr(connect_to, ':');
1356
if(address == NULL){
1357
fprintf(stderr, "No colon in address\n");
1358
exitcode = EXIT_FAILURE;
1359
goto end;
1360
}
1361
1362
if(quit_now){
1363
goto end;
1364
}
1365
1366
uint16_t port;
1367
errno = 0;
1368
tmpmax = strtoimax(address+1, &tmp, 10);
1369
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1370
or tmpmax != (uint16_t)tmpmax){
1371
fprintf(stderr, "Bad port number\n");
1372
exitcode = EXIT_FAILURE;
1373
goto end;
1374
}
1375
1376
if(quit_now){
1377
goto end;
1378
}
1379
1380
port = (uint16_t)tmpmax;
1381
*address = '\0';
1382
address = connect_to;
1383
/* Colon in address indicates IPv6 */
1384
int af;
1385
if(strchr(address, ':') != NULL){
1386
af = AF_INET6;
1387
} else {
1388
af = AF_INET;
1389
}
1390
1391
if(quit_now){
1392
goto end;
1393
}
1394
1395
ret = start_mandos_communication(address, port, if_index, af);
1396
if(ret < 0){
1397
exitcode = EXIT_FAILURE;
1398
} else {
1399
exitcode = EXIT_SUCCESS;
1400
}
1401
goto end;
1402
}
1403
1404
if(quit_now){
1405
goto end;
1406
}
1407
1408
{
1409
AvahiServerConfig config;
1410
/* Do not publish any local Zeroconf records */
803
returncode = EXIT_FAILURE;
804
goto exit;
805
}
806
}
807
close(sd);
808
809
if (not debug){
810
avahi_set_log_function(empty_log);
811
}
812
813
/* Initialize the psuedo-RNG */
814
srand((unsigned int) time(NULL));
815
816
/* Allocate main loop object */
817
if (!(mc.simple_poll = avahi_simple_poll_new())) {
818
fprintf(stderr, "Failed to create simple poll object.\n");
819
returncode = EXIT_FAILURE;
820
goto exit;
821
}
822
823
/* Do not publish any local records */
1411
824
avahi_server_config_init(&config);
1412
825
config.publish_hinfo = 0;
1413
826
config.publish_addresses = 0;
1414
827
config.publish_workstation = 0;
1415
828
config.publish_domain = 0;
1416
829
1417
830
/* Allocate a new server */
1418
mc.server = avahi_server_new(avahi_simple_poll_get
1419
(mc.simple_poll), &config, NULL,
1420
NULL, &error);
831
mc.server=avahi_server_new(avahi_simple_poll_get(mc.simple_poll),
832
&config, NULL, NULL, &error);
1421
833
1422
/* Free the Avahi configuration data */
834
/* Free the configuration data */
1423
835
avahi_server_config_free(&config);
1424
}
1425
1426
/* Check if creating the Avahi server object succeeded */
1427
if(mc.server == NULL){
1428
fprintf(stderr, "Failed to create Avahi server: %s\n",
1429
avahi_strerror(error));
1430
exitcode = EXIT_FAILURE;
1431
goto end;
1432
}
1433
1434
if(quit_now){
1435
goto end;
1436
}
1437
1438
/* Create the Avahi service browser */
1439
sb = avahi_s_service_browser_new(mc.server, if_index,
1440
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1441
NULL, 0, browse_callback, NULL);
1442
if(sb == NULL){
1443
fprintf(stderr, "Failed to create service browser: %s\n",
1444
avahi_strerror(avahi_server_errno(mc.server)));
1445
exitcode = EXIT_FAILURE;
1446
goto end;
1447
}
1448
1449
if(quit_now){
1450
goto end;
1451
}
1452
1453
/* Run the main loop */
1454
1455
if(debug){
1456
fprintf(stderr, "Starting Avahi loop search\n");
1457
}
1458
1459
avahi_simple_poll_loop(mc.simple_poll);
1460
1461
end:
1462
1463
if(debug){
1464
fprintf(stderr, "%s exiting\n", argv[0]);
1465
}
1466
1467
/* Cleanup things */
1468
if(sb != NULL)
1469
avahi_s_service_browser_free(sb);
1470
1471
if(mc.server != NULL)
1472
avahi_server_free(mc.server);
1473
1474
if(mc.simple_poll != NULL)
1475
avahi_simple_poll_free(mc.simple_poll);
1476
1477
if(gnutls_initialized){
1478
gnutls_certificate_free_credentials(mc.cred);
1479
gnutls_global_deinit();
1480
gnutls_dh_params_deinit(mc.dh_params);
1481
}
1482
1483
if(gpgme_initialized){
1484
gpgme_release(mc.ctx);
1485
}
1486
1487
/* Take down the network interface */
1488
if(take_down_interface){
1489
/* Re-raise priviliges */
1490
errno = 0;
1491
ret = seteuid(0);
1492
if(ret == -1){
1493
perror("seteuid");
1494
}
1495
if(geteuid() == 0){
1496
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1497
if(ret == -1){
1498
perror("ioctl SIOCGIFFLAGS");
1499
} else if(network.ifr_flags & IFF_UP) {
1500
network.ifr_flags &= ~IFF_UP; /* clear flag */
1501
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1502
if(ret == -1){
1503
perror("ioctl SIOCSIFFLAGS");
1504
}
1505
}
1506
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1507
if(ret == -1){
1508
perror("close");
1509
}
1510
/* Lower privileges, permanently this time */
1511
errno = 0;
1512
ret = setuid(uid);
1513
if(ret == -1){
1514
perror("setuid");
1515
}
1516
}
1517
}
1518
1519
/* Removes the temp directory used by GPGME */
1520
if(tempdir_created){
1521
DIR *d;
1522
struct dirent *direntry;
1523
d = opendir(tempdir);
1524
if(d == NULL){
1525
if(errno != ENOENT){
1526
perror("opendir");
1527
}
1528
} else {
1529
while(true){
1530
direntry = readdir(d);
1531
if(direntry == NULL){
1532
break;
1533
}
1534
/* Skip "." and ".." */
1535
if(direntry->d_name[0] == '.'
1536
and (direntry->d_name[1] == '\0'
1537
or (direntry->d_name[1] == '.'
1538
and direntry->d_name[2] == '\0'))){
1539
continue;
1540
}
1541
char *fullname = NULL;
1542
ret = asprintf(&fullname, "%s/%s", tempdir,
1543
direntry->d_name);
1544
if(ret < 0){
1545
perror("asprintf");
1546
continue;
1547
}
1548
ret = remove(fullname);
1549
if(ret == -1){
1550
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1551
strerror(errno));
1552
}
1553
free(fullname);
1554
}
1555
closedir(d);
1556
}
1557
ret = rmdir(tempdir);
1558
if(ret == -1 and errno != ENOENT){
1559
perror("rmdir");
1560
}
1561
}
1562
1563
if(quit_now){
1564
sigemptyset(&old_sigterm_action.sa_mask);
1565
old_sigterm_action.sa_handler = SIG_DFL;
1566
ret = sigaction(signal_received, &old_sigterm_action, NULL);
1567
if(ret == -1){
1568
perror("sigaction");
1569
}
1570
raise(signal_received);
1571
}
1572
1573
return exitcode;
836
837
/* Check if creating the server object succeeded */
838
if (!mc.server) {
839
fprintf(stderr, "Failed to create server: %s\n",
840
avahi_strerror(error));
841
returncode = EXIT_FAILURE;
842
goto exit;
843
}
844
845
/* Create the service browser */
846
sb = avahi_s_service_browser_new(mc.server, if_index,
847
AVAHI_PROTO_INET6,
848
"_mandos._tcp", NULL, 0,
849
browse_callback, &mc);
850
if (!sb) {
851
fprintf(stderr, "Failed to create service browser: %s\n",
852
avahi_strerror(avahi_server_errno(mc.server)));
853
returncode = EXIT_FAILURE;
854
goto exit;
855
}
856
857
/* Run the main loop */
858
859
if (debug){
860
fprintf(stderr, "Starting avahi loop search\n");
861
}
862
863
avahi_simple_poll_loop(mc.simple_poll);
864
865
exit:
866
867
if (debug){
868
fprintf(stderr, "%s exiting\n", argv[0]);
869
}
870
871
/* Cleanup things */
872
if (sb)
873
avahi_s_service_browser_free(sb);
874
875
if (mc.server)
876
avahi_server_free(mc.server);
877
878
if (mc.simple_poll)
879
avahi_simple_poll_free(mc.simple_poll);
880
free(pubkeyfile);
881
free(seckeyfile);
882
883
return returncode;
1574
884
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0