To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 39
- compare with another revision
- download diff
- download tarball
- view history from revision 39
- Committer: Teddy Hogeborn
- Date: 2008-08-03 03:33:56 UTC
- Revision ID: teddy@fukt.bsnet.se-20080803033356-6aemgj0g0hoz91ow
* plugins.d/mandosclient.c (pgp_packet_decrypt): Renamed variables.
On debug, show
decrypted plaintext
in hexadecimal. Free
the GPGME data
buffers even on
errors.
On debug, show
decrypted plaintext
in hexadecimal. Free
the GPGME data
buffers even on
errors.
- files added:
- ca.pem
- files removed:
- mandos-client.xml
- files renamed:
- mandos-client.c => plugbasedclient.c
- plugins.d/password-request.c => plugins.d/mandosclient.c
- plugins.d/password-prompt.c => plugins.d/passprompt.c
- mandos.conf => server.conf
- mandos => server.py
- files modified:
- Makefile
added
removed
plugins.d/mandosclient.c
32
32
#define _LARGEFILE_SOURCE
33
33
#define _FILE_OFFSET_BITS 64
34
34
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
37
#include <stdio.h> /* fprintf(), stderr, fwrite(), stdout,
38
ferror() */
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
42
srand() */
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), memcpy(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <net/if.h> /* ifreq, SIOCGIFFLAGS, SIOCSIFFLAGS,
48
IFF_UP */
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, INET6_ADDRSTRLEN,
52
uid_t, gid_t */
53
#include <inttypes.h> /* PRIu16 */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton(),
56
connect() */
57
#include <assert.h> /* assert() */
58
#include <errno.h> /* perror(), errno */
59
#include <time.h> /* time() */
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
41
SIOCSIFFLAGS */
60
42
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
61
SIOCSIFFLAGS, if_indextoname(),
62
if_nametoindex(), IF_NAMESIZE */
63
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
64
getuid(), getgid(), setuid(),
65
setgid() */
66
#include <netinet/in.h>
67
#include <arpa/inet.h> /* inet_pton(), htons */
68
#include <iso646.h> /* not, and */
69
#include <argp.h> /* struct argp_option, error_t, struct
70
argp_state, struct argp,
71
argp_parse(), ARGP_KEY_ARG,
72
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
43
SIOCSIFFLAGS */
73
44
74
/* Avahi */
75
/* All Avahi types, constants and functions
76
Avahi*, avahi_*,
77
AVAHI_* */
78
45
#include <avahi-core/core.h>
79
46
#include <avahi-core/lookup.h>
80
47
#include <avahi-core/log.h>
82
49
#include <avahi-common/malloc.h>
83
50
#include <avahi-common/error.h>
84
51
85
/* GnuTLS */
86
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and functions
87
gnutls_*
88
init_gnutls_session(),
89
GNUTLS_* */
90
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
91
GNUTLS_OPENPGP_FMT_BASE64 */
92
93
/* GPGME */
94
#include <gpgme.h> /* All GPGME types, constants and functions
95
gpgme_*
96
GPGME_PROTOCOL_OpenPGP,
97
GPG_ERR_NO_* */
52
//mandos client part
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
58
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
65
66
// gpgme
67
#include <errno.h> /* perror() */
68
#include <gpgme.h>
69
70
// getopt_long
71
#include <getopt.h>
98
72
99
73
#define BUFFER_SIZE 256
100
74
75
static const char *keydir = "/conf/conf.d/mandos";
76
static const char *pubkeyfile = "pubkey.txt";
77
static const char *seckeyfile = "seckey.txt";
78
101
79
bool debug = false;
102
static const char *keydir = "/conf/conf.d/mandos";
103
static const char mandos_protocol_version[] = "1";
104
const char *argp_program_version = "password-request 1.0";
105
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
106
80
107
/* Used for passing in values through the Avahi callback functions */
81
/* Used for passing in values through all the callback functions */
108
82
typedef struct {
109
83
AvahiSimplePoll *simple_poll;
110
84
AvahiServer *server;
111
85
gnutls_certificate_credentials_t cred;
112
86
unsigned int dh_bits;
113
gnutls_dh_params_t dh_params;
114
87
const char *priority;
115
88
} mandos_context;
116
89
117
/*
118
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
119
* "buffer_capacity" is how much is currently allocated,
120
* "buffer_length" is how much is already used.
121
*/
122
size_t adjustbuffer(char **buffer, size_t buffer_length,
123
size_t buffer_capacity){
124
if (buffer_length + BUFFER_SIZE > buffer_capacity){
125
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
126
if (buffer == NULL){
127
return 0;
128
}
129
buffer_capacity += BUFFER_SIZE;
130
}
131
return buffer_capacity;
132
}
133
134
90
/*
135
91
* Decrypt OpenPGP data using keyrings in HOMEDIR.
136
92
* Returns -1 on error
143
99
gpgme_ctx_t ctx;
144
100
gpgme_error_t rc;
145
101
ssize_t ret;
146
size_t plaintext_capacity = 0;
102
ssize_t plaintext_capacity = 0;
147
103
ssize_t plaintext_length = 0;
148
104
gpgme_engine_info_t engine_info;
149
105
229
185
} else {
230
186
fprintf(stderr, "Unsupported algorithm: %s\n",
231
187
result->unsupported_algorithm);
232
fprintf(stderr, "Wrong key usage: %u\n",
188
fprintf(stderr, "Wrong key usage: %d\n",
233
189
result->wrong_key_usage);
234
190
if(result->file_name != NULL){
235
191
fprintf(stderr, "File name: %s\n", result->file_name);
259
215
260
216
*plaintext = NULL;
261
217
while(true){
262
plaintext_capacity = adjustbuffer(plaintext,
263
(size_t)plaintext_length,
264
plaintext_capacity);
265
if (plaintext_capacity == 0){
266
perror("adjustbuffer");
218
if (plaintext_length + BUFFER_SIZE > plaintext_capacity){
219
*plaintext = realloc(*plaintext,
220
(unsigned int)plaintext_capacity
221
+ BUFFER_SIZE);
222
if (*plaintext == NULL){
223
perror("realloc");
267
224
plaintext_length = -1;
268
225
goto decrypt_end;
226
}
227
plaintext_capacity += BUFFER_SIZE;
269
228
}
270
229
271
230
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
285
244
286
245
if(debug){
287
246
fprintf(stderr, "Decrypted password is: ");
288
for(ssize_t i = 0; i < plaintext_length; i++){
247
for(size_t i = 0; i < plaintext_length; i++){
289
248
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
290
249
}
291
250
fprintf(stderr, "\n");
308
267
return ret;
309
268
}
310
269
311
/* GnuTLS log function callback */
312
270
static void debuggnutls(__attribute__((unused)) int level,
313
271
const char* string){
314
fprintf(stderr, "GnuTLS: %s", string);
272
fprintf(stderr, "%s", string);
315
273
}
316
274
317
static int init_gnutls_global(mandos_context *mc,
318
const char *pubkeyfile,
319
const char *seckeyfile){
275
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
276
gnutls_dh_params_t *dh_params){
277
const char *err;
320
278
int ret;
321
279
322
280
if(debug){
323
281
fprintf(stderr, "Initializing GnuTLS\n");
324
282
}
325
326
ret = gnutls_global_init();
327
if (ret != GNUTLS_E_SUCCESS) {
328
fprintf (stderr, "GnuTLS global_init: %s\n",
329
safer_gnutls_strerror(ret));
283
284
if ((ret = gnutls_global_init ())
285
!= GNUTLS_E_SUCCESS) {
286
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
330
287
return -1;
331
288
}
332
289
333
290
if (debug){
334
/* "Use a log level over 10 to enable all debugging options."
335
* - GnuTLS manual
336
*/
337
291
gnutls_global_set_log_level(11);
338
292
gnutls_global_set_log_function(debuggnutls);
339
293
}
340
294
341
/* OpenPGP credentials */
342
gnutls_certificate_allocate_credentials(&mc->cred);
343
if (ret != GNUTLS_E_SUCCESS){
344
fprintf (stderr, "GnuTLS memory error: %s\n",
295
/* openpgp credentials */
296
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
297
!= GNUTLS_E_SUCCESS) {
298
fprintf (stderr, "memory error: %s\n",
345
299
safer_gnutls_strerror(ret));
346
gnutls_global_deinit ();
347
300
return -1;
348
301
}
349
302
356
309
ret = gnutls_certificate_set_openpgp_key_file
357
310
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
358
311
if (ret != GNUTLS_E_SUCCESS) {
359
fprintf(stderr,
360
"Error[%d] while reading the OpenPGP key pair ('%s',"
361
" '%s')\n", ret, pubkeyfile, seckeyfile);
362
fprintf(stdout, "The GnuTLS error is: %s\n",
312
fprintf
313
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
314
" '%s')\n",
315
ret, pubkeyfile, seckeyfile);
316
fprintf(stdout, "The Error is: %s\n",
363
317
safer_gnutls_strerror(ret));
364
goto globalfail;
365
}
366
367
/* GnuTLS server initialization */
368
ret = gnutls_dh_params_init(&mc->dh_params);
369
if (ret != GNUTLS_E_SUCCESS) {
370
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
371
" %s\n", safer_gnutls_strerror(ret));
372
goto globalfail;
373
}
374
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
375
if (ret != GNUTLS_E_SUCCESS) {
376
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
377
safer_gnutls_strerror(ret));
378
goto globalfail;
379
}
380
381
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
382
383
return 0;
384
385
globalfail:
386
387
gnutls_certificate_free_credentials(mc->cred);
388
gnutls_global_deinit();
389
return -1;
390
391
}
392
393
static int init_gnutls_session(mandos_context *mc,
394
gnutls_session_t *session){
395
int ret;
396
/* GnuTLS session creation */
397
ret = gnutls_init(session, GNUTLS_SERVER);
398
if (ret != GNUTLS_E_SUCCESS){
318
return -1;
319
}
320
321
//GnuTLS server initialization
322
if ((ret = gnutls_dh_params_init(dh_params))
323
!= GNUTLS_E_SUCCESS) {
324
fprintf (stderr, "Error in dh parameter initialization: %s\n",
325
safer_gnutls_strerror(ret));
326
return -1;
327
}
328
329
if ((ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits))
330
!= GNUTLS_E_SUCCESS) {
331
fprintf (stderr, "Error in prime generation: %s\n",
332
safer_gnutls_strerror(ret));
333
return -1;
334
}
335
336
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
337
338
// GnuTLS session creation
339
if ((ret = gnutls_init(session, GNUTLS_SERVER))
340
!= GNUTLS_E_SUCCESS){
399
341
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
400
342
safer_gnutls_strerror(ret));
401
343
}
402
344
403
{
404
const char *err;
405
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
406
if (ret != GNUTLS_E_SUCCESS) {
407
fprintf(stderr, "Syntax error at: %s\n", err);
408
fprintf(stderr, "GnuTLS error: %s\n",
409
safer_gnutls_strerror(ret));
410
gnutls_deinit (*session);
411
return -1;
412
}
345
if ((ret = gnutls_priority_set_direct(*session, mc->priority, &err))
346
!= GNUTLS_E_SUCCESS) {
347
fprintf(stderr, "Syntax error at: %s\n", err);
348
fprintf(stderr, "GnuTLS error: %s\n",
349
safer_gnutls_strerror(ret));
350
return -1;
413
351
}
414
352
415
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
416
mc->cred);
417
if (ret != GNUTLS_E_SUCCESS) {
418
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
353
if ((ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
354
mc->cred))
355
!= GNUTLS_E_SUCCESS) {
356
fprintf(stderr, "Error setting a credentials set: %s\n",
419
357
safer_gnutls_strerror(ret));
420
gnutls_deinit (*session);
421
358
return -1;
422
359
}
423
360
430
367
return 0;
431
368
}
432
369
433
/* Avahi log function callback */
434
370
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
435
371
__attribute__((unused)) const char *txt){}
436
372
437
/* Called when a Mandos server is found */
438
373
static int start_mandos_communication(const char *ip, uint16_t port,
439
374
AvahiIfIndex if_index,
440
375
mandos_context *mc){
441
376
int ret, tcp_sd;
442
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
377
struct sockaddr_in6 to;
443
378
char *buffer = NULL;
444
379
char *decrypted_buffer;
445
380
size_t buffer_length = 0;
446
381
size_t buffer_capacity = 0;
447
382
ssize_t decrypted_buffer_size;
448
size_t written;
383
size_t written = 0;
449
384
int retval = 0;
450
385
char interface[IF_NAMESIZE];
451
386
gnutls_session_t session;
452
453
ret = init_gnutls_session (mc, &session);
454
if (ret != 0){
455
return -1;
456
}
387
gnutls_dh_params_t dh_params;
457
388
458
389
if(debug){
459
fprintf(stderr, "Setting up a tcp connection to %s, port %" PRIu16
460
"\n", ip, port);
390
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
391
ip, port);
461
392
}
462
393
463
394
tcp_sd = socket(PF_INET6, SOCK_STREAM, 0);
475
406
}
476
407
477
408
memset(&to,0,sizeof(to)); /* Spurious warning */
478
to.in6.sin6_family = AF_INET6;
479
/* It would be nice to have a way to detect if we were passed an
480
IPv4 address here. Now we assume an IPv6 address. */
481
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
409
to.sin6_family = AF_INET6;
410
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
482
411
if (ret < 0 ){
483
412
perror("inet_pton");
484
413
return -1;
487
416
fprintf(stderr, "Bad address: %s\n", ip);
488
417
return -1;
489
418
}
490
to.in6.sin6_port = htons(port); /* Spurious warning */
419
to.sin6_port = htons(port); /* Spurious warning */
491
420
492
to.in6.sin6_scope_id = (uint32_t)if_index;
421
to.sin6_scope_id = (uint32_t)if_index;
493
422
494
423
if(debug){
495
fprintf(stderr, "Connection to: %s, port %" PRIu16 "\n", ip,
496
port);
424
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
497
425
char addrstr[INET6_ADDRSTRLEN] = "";
498
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
426
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
499
427
sizeof(addrstr)) == NULL){
500
428
perror("inet_ntop");
501
429
} else {
505
433
}
506
434
}
507
435
508
ret = connect(tcp_sd, &to.in, sizeof(to));
436
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
509
437
if (ret < 0){
510
438
perror("connect");
511
439
return -1;
512
440
}
513
514
const char *out = mandos_protocol_version;
515
written = 0;
516
while (true){
517
size_t out_size = strlen(out);
518
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
519
out_size - written));
520
if (ret == -1){
521
perror("write");
522
retval = -1;
523
goto mandos_end;
524
}
525
written += (size_t)ret;
526
if(written < out_size){
527
continue;
528
} else {
529
if (out == mandos_protocol_version){
530
written = 0;
531
out = "\r\n";
532
} else {
533
break;
534
}
535
}
441
442
ret = initgnutls (mc, &session, &dh_params);
443
if (ret != 0){
444
retval = -1;
445
return -1;
536
446
}
537
447
448
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
449
538
450
if(debug){
539
451
fprintf(stderr, "Establishing TLS session with %s\n", ip);
540
452
}
541
453
542
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
543
544
do{
545
ret = gnutls_handshake (session);
546
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
454
ret = gnutls_handshake (session);
547
455
548
456
if (ret != GNUTLS_E_SUCCESS){
549
457
if(debug){
550
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
458
fprintf(stderr, "\n*** Handshake failed ***\n");
551
459
gnutls_perror (ret);
552
460
}
553
461
retval = -1;
554
goto mandos_end;
462
goto exit;
555
463
}
556
464
557
/* Read OpenPGP packet that contains the wanted password */
465
//Retrieve OpenPGP packet that contains the wanted password
558
466
559
467
if(debug){
560
468
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
562
470
}
563
471
564
472
while(true){
565
buffer_capacity = adjustbuffer(&buffer, buffer_length,
566
buffer_capacity);
567
if (buffer_capacity == 0){
568
perror("adjustbuffer");
569
retval = -1;
570
goto mandos_end;
473
if (buffer_length + BUFFER_SIZE > buffer_capacity){
474
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
475
if (buffer == NULL){
476
perror("realloc");
477
goto exit;
478
}
479
buffer_capacity += BUFFER_SIZE;
571
480
}
572
481
573
482
ret = gnutls_record_recv(session, buffer+buffer_length,
581
490
case GNUTLS_E_AGAIN:
582
491
break;
583
492
case GNUTLS_E_REHANDSHAKE:
584
do{
585
ret = gnutls_handshake (session);
586
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
493
ret = gnutls_handshake (session);
587
494
if (ret < 0){
588
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
495
fprintf(stderr, "\n*** Handshake failed ***\n");
589
496
gnutls_perror (ret);
590
497
retval = -1;
591
goto mandos_end;
498
goto exit;
592
499
}
593
500
break;
594
501
default:
595
502
fprintf(stderr, "Unknown error while reading data from"
596
" encrypted session with Mandos server\n");
503
" encrypted session with mandos server\n");
597
504
retval = -1;
598
505
gnutls_bye (session, GNUTLS_SHUT_RDWR);
599
goto mandos_end;
506
goto exit;
600
507
}
601
508
} else {
602
509
buffer_length += (size_t) ret;
603
510
}
604
511
}
605
512
606
if(debug){
607
fprintf(stderr, "Closing TLS session\n");
608
}
609
610
gnutls_bye (session, GNUTLS_SHUT_RDWR);
611
612
513
if (buffer_length > 0){
613
514
decrypted_buffer_size = pgp_packet_decrypt(buffer,
614
515
buffer_length,
615
516
&decrypted_buffer,
616
517
keydir);
617
518
if (decrypted_buffer_size >= 0){
618
written = 0;
619
519
while(written < (size_t) decrypted_buffer_size){
620
520
ret = (int)fwrite (decrypted_buffer + written, 1,
621
521
(size_t)decrypted_buffer_size - written,
635
535
retval = -1;
636
536
}
637
537
}
638
639
/* Shutdown procedure */
640
641
mandos_end:
538
539
//shutdown procedure
540
541
if(debug){
542
fprintf(stderr, "Closing TLS session\n");
543
}
544
642
545
free(buffer);
546
gnutls_bye (session, GNUTLS_SHUT_RDWR);
547
exit:
643
548
close(tcp_sd);
644
549
gnutls_deinit (session);
550
gnutls_certificate_free_credentials (mc->cred);
551
gnutls_global_deinit ();
645
552
return retval;
646
553
}
647
554
668
575
switch (event) {
669
576
default:
670
577
case AVAHI_RESOLVER_FAILURE:
671
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
672
" of type '%s' in domain '%s': %s\n", name, type, domain,
578
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
579
" type '%s' in domain '%s': %s\n", name, type, domain,
673
580
avahi_strerror(avahi_server_errno(mc->server)));
674
581
break;
675
582
678
585
char ip[AVAHI_ADDRESS_STR_MAX];
679
586
avahi_address_snprint(ip, sizeof(ip), address);
680
587
if(debug){
681
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %"
682
PRIu16 ") on port %d\n", name, host_name, ip,
683
interface, port);
588
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
589
" port %d\n", name, host_name, ip, port);
684
590
}
685
591
int ret = start_mandos_communication(ip, port, interface, mc);
686
592
if (ret == 0){
711
617
default:
712
618
case AVAHI_BROWSER_FAILURE:
713
619
714
fprintf(stderr, "(Avahi browser) %s\n",
620
fprintf(stderr, "(Browser) %s\n",
715
621
avahi_strerror(avahi_server_errno(mc->server)));
716
622
avahi_simple_poll_quit(mc->simple_poll);
717
623
return;
718
624
719
625
case AVAHI_BROWSER_NEW:
720
/* We ignore the returned Avahi resolver object. In the callback
721
function we free it. If the Avahi server is terminated before
722
the callback function is called the Avahi server will free the
723
resolver for us. */
626
/* We ignore the returned resolver object. In the callback
627
function we free it. If the server is terminated before
628
the callback function is called the server will free
629
the resolver for us. */
724
630
725
631
if (!(avahi_s_service_resolver_new(mc->server, interface,
726
632
protocol, name, type, domain,
727
633
AVAHI_PROTO_INET6, 0,
728
634
resolve_callback, mc)))
729
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
730
name, avahi_strerror(avahi_server_errno(mc->server)));
635
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
636
avahi_strerror(avahi_server_errno(mc->server)));
731
637
break;
732
638
733
639
case AVAHI_BROWSER_REMOVE:
735
641
736
642
case AVAHI_BROWSER_ALL_FOR_NOW:
737
643
case AVAHI_BROWSER_CACHE_EXHAUSTED:
738
if(debug){
739
fprintf(stderr, "No Mandos server found, still searching...\n");
740
}
741
644
break;
742
645
}
743
646
}
763
666
}
764
667
765
668
766
int main(int argc, char *argv[]){
669
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
670
AvahiServerConfig config;
767
671
AvahiSServiceBrowser *sb = NULL;
768
672
int error;
769
673
int ret;
770
int exitcode = EXIT_SUCCESS;
674
int debug_int;
675
int returncode = EXIT_SUCCESS;
771
676
const char *interface = "eth0";
772
677
struct ifreq network;
773
678
int sd;
774
uid_t uid;
775
gid_t gid;
776
679
char *connect_to = NULL;
777
680
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
778
const char *pubkeyfile = "pubkey.txt";
779
const char *seckeyfile = "seckey.txt";
780
681
mandos_context mc = { .simple_poll = NULL, .server = NULL,
781
682
.dh_bits = 1024, .priority = "SECURE256"};
782
bool gnutls_initalized = false;
783
683
784
{
785
struct argp_option options[] = {
786
{ .name = "debug", .key = 128,
787
.doc = "Debug mode", .group = 3 },
788
{ .name = "connect", .key = 'c',
789
.arg = "IP",
790
.doc = "Connect directly to a sepcified mandos server",
791
.group = 1 },
792
{ .name = "interface", .key = 'i',
793
.arg = "INTERFACE",
794
.doc = "Interface that Avahi will conntect through",
795
.group = 1 },
796
{ .name = "keydir", .key = 'd',
797
.arg = "KEYDIR",
798
.doc = "Directory where the openpgp keyring is",
799
.group = 1 },
800
{ .name = "seckey", .key = 's',
801
.arg = "SECKEY",
802
.doc = "Secret openpgp key for gnutls authentication",
803
.group = 1 },
804
{ .name = "pubkey", .key = 'p',
805
.arg = "PUBKEY",
806
.doc = "Public openpgp key for gnutls authentication",
807
.group = 2 },
808
{ .name = "dh-bits", .key = 129,
809
.arg = "BITS",
810
.doc = "dh-bits to use in gnutls communication",
811
.group = 2 },
812
{ .name = "priority", .key = 130,
813
.arg = "PRIORITY",
814
.doc = "GNUTLS priority", .group = 1 },
815
{ .name = NULL }
816
};
817
818
819
error_t parse_opt (int key, char *arg,
820
struct argp_state *state) {
821
/* Get the INPUT argument from `argp_parse', which we know is
822
a pointer to our plugin list pointer. */
823
switch (key) {
824
case 128:
825
debug = true;
826
break;
827
case 'c':
828
connect_to = arg;
829
break;
830
case 'i':
831
interface = arg;
832
break;
833
case 'd':
834
keydir = arg;
835
break;
836
case 's':
837
seckeyfile = arg;
838
break;
839
case 'p':
840
pubkeyfile = arg;
841
break;
842
case 129:
843
errno = 0;
844
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
845
if (errno){
846
perror("strtol");
847
exit(EXIT_FAILURE);
848
}
849
break;
850
case 130:
851
mc.priority = arg;
852
break;
853
case ARGP_KEY_ARG:
854
argp_usage (state);
855
break;
856
case ARGP_KEY_END:
857
break;
858
default:
859
return ARGP_ERR_UNKNOWN;
684
debug_int = debug ? 1 : 0;
685
while (true){
686
struct option long_options[] = {
687
{"debug", no_argument, &debug_int, 1},
688
{"connect", required_argument, NULL, 'c'},
689
{"interface", required_argument, NULL, 'i'},
690
{"keydir", required_argument, NULL, 'd'},
691
{"seckey", required_argument, NULL, 's'},
692
{"pubkey", required_argument, NULL, 'p'},
693
{"dh-bits", required_argument, NULL, 'D'},
694
{"priority", required_argument, NULL, 'P'},
695
{0, 0, 0, 0} };
696
697
int option_index = 0;
698
ret = getopt_long (argc, argv, "i:", long_options,
699
&option_index);
700
701
if (ret == -1){
702
break;
703
}
704
705
switch(ret){
706
case 0:
707
break;
708
case 'i':
709
interface = optarg;
710
break;
711
case 'c':
712
connect_to = optarg;
713
break;
714
case 'd':
715
keydir = optarg;
716
break;
717
case 'p':
718
pubkeyfile = optarg;
719
break;
720
case 's':
721
seckeyfile = optarg;
722
break;
723
case 'D':
724
errno = 0;
725
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
726
if (errno){
727
perror("strtol");
728
exit(EXIT_FAILURE);
860
729
}
861
return 0;
862
}
863
864
struct argp argp = { .options = options, .parser = parse_opt,
865
.args_doc = "",
866
.doc = "Mandos client -- Get and decrypt"
867
" passwords from mandos server" };
868
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
869
if (ret == ARGP_ERR_UNKNOWN){
870
fprintf(stderr, "Unkown error while parsing arguments\n");
871
exitcode = EXIT_FAILURE;
872
goto end;
730
break;
731
case 'P':
732
mc.priority = optarg;
733
break;
734
case '?':
735
default:
736
exit(EXIT_FAILURE);
873
737
}
874
738
}
875
739
debug = debug_int ? true : false;
740
876
741
pubkeyfile = combinepath(keydir, pubkeyfile);
877
742
if (pubkeyfile == NULL){
878
743
perror("combinepath");
879
exitcode = EXIT_FAILURE;
880
goto end;
744
returncode = EXIT_FAILURE;
745
goto exit;
881
746
}
882
747
883
748
seckeyfile = combinepath(keydir, seckeyfile);
884
749
if (seckeyfile == NULL){
885
750
perror("combinepath");
886
goto end;
887
}
888
889
ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);
890
if (ret == -1){
891
fprintf(stderr, "init_gnutls_global\n");
892
goto end;
893
} else {
894
gnutls_initalized = true;
895
}
896
897
uid = getuid();
898
gid = getgid();
899
900
ret = setuid(uid);
901
if (ret == -1){
902
perror("setuid");
903
}
904
905
setgid(gid);
906
if (ret == -1){
907
perror("setgid");
751
goto exit;
908
752
}
909
753
910
754
if_index = (AvahiIfIndex) if_nametoindex(interface);
919
763
char *address = strrchr(connect_to, ':');
920
764
if(address == NULL){
921
765
fprintf(stderr, "No colon in address\n");
922
exitcode = EXIT_FAILURE;
923
goto end;
766
exit(EXIT_FAILURE);
924
767
}
925
768
errno = 0;
926
769
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
927
770
if(errno){
928
771
perror("Bad port number");
929
exitcode = EXIT_FAILURE;
930
goto end;
772
exit(EXIT_FAILURE);
931
773
}
932
774
*address = '\0';
933
775
address = connect_to;
934
776
ret = start_mandos_communication(address, port, if_index, &mc);
935
777
if(ret < 0){
936
exitcode = EXIT_FAILURE;
778
exit(EXIT_FAILURE);
937
779
} else {
938
exitcode = EXIT_SUCCESS;
780
exit(EXIT_SUCCESS);
939
781
}
940
goto end;
941
782
}
942
783
943
/* If the interface is down, bring it up */
944
{
945
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
946
if(sd < 0) {
947
perror("socket");
948
exitcode = EXIT_FAILURE;
949
goto end;
950
}
951
strcpy(network.ifr_name, interface); /* Spurious warning */
952
ret = ioctl(sd, SIOCGIFFLAGS, &network);
784
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
785
if(sd < 0) {
786
perror("socket");
787
returncode = EXIT_FAILURE;
788
goto exit;
789
}
790
strcpy(network.ifr_name, interface); /* Spurious warning */
791
ret = ioctl(sd, SIOCGIFFLAGS, &network);
792
if(ret == -1){
793
794
perror("ioctl SIOCGIFFLAGS");
795
returncode = EXIT_FAILURE;
796
goto exit;
797
}
798
if((network.ifr_flags & IFF_UP) == 0){
799
network.ifr_flags |= IFF_UP;
800
ret = ioctl(sd, SIOCSIFFLAGS, &network);
953
801
if(ret == -1){
954
perror("ioctl SIOCGIFFLAGS");
955
exitcode = EXIT_FAILURE;
956
goto end;
957
}
958
if((network.ifr_flags & IFF_UP) == 0){
959
network.ifr_flags |= IFF_UP;
960
ret = ioctl(sd, SIOCSIFFLAGS, &network);
961
if(ret == -1){
962
perror("ioctl SIOCSIFFLAGS");
963
exitcode = EXIT_FAILURE;
964
goto end;
965
}
966
}
967
close(sd);
802
perror("ioctl SIOCSIFFLAGS");
803
returncode = EXIT_FAILURE;
804
goto exit;
805
}
968
806
}
807
close(sd);
969
808
970
809
if (not debug){
971
810
avahi_set_log_function(empty_log);
972
811
}
973
812
974
/* Initialize the pseudo-RNG for Avahi */
813
/* Initialize the psuedo-RNG */
975
814
srand((unsigned int) time(NULL));
976
977
/* Allocate main Avahi loop object */
978
mc.simple_poll = avahi_simple_poll_new();
979
if (mc.simple_poll == NULL) {
980
fprintf(stderr, "Avahi: Failed to create simple poll"
981
" object.\n");
982
exitcode = EXIT_FAILURE;
983
goto end;
984
}
985
986
{
987
AvahiServerConfig config;
988
/* Do not publish any local Zeroconf records */
989
avahi_server_config_init(&config);
990
config.publish_hinfo = 0;
991
config.publish_addresses = 0;
992
config.publish_workstation = 0;
993
config.publish_domain = 0;
994
995
/* Allocate a new server */
996
mc.server = avahi_server_new(avahi_simple_poll_get
997
(mc.simple_poll), &config, NULL,
998
NULL, &error);
999
1000
/* Free the Avahi configuration data */
1001
avahi_server_config_free(&config);
1002
}
1003
1004
/* Check if creating the Avahi server object succeeded */
1005
if (mc.server == NULL) {
1006
fprintf(stderr, "Failed to create Avahi server: %s\n",
815
816
/* Allocate main loop object */
817
if (!(mc.simple_poll = avahi_simple_poll_new())) {
818
fprintf(stderr, "Failed to create simple poll object.\n");
819
returncode = EXIT_FAILURE;
820
goto exit;
821
}
822
823
/* Do not publish any local records */
824
avahi_server_config_init(&config);
825
config.publish_hinfo = 0;
826
config.publish_addresses = 0;
827
config.publish_workstation = 0;
828
config.publish_domain = 0;
829
830
/* Allocate a new server */
831
mc.server=avahi_server_new(avahi_simple_poll_get(mc.simple_poll),
832
&config, NULL, NULL, &error);
833
834
/* Free the configuration data */
835
avahi_server_config_free(&config);
836
837
/* Check if creating the server object succeeded */
838
if (!mc.server) {
839
fprintf(stderr, "Failed to create server: %s\n",
1007
840
avahi_strerror(error));
1008
exitcode = EXIT_FAILURE;
1009
goto end;
841
returncode = EXIT_FAILURE;
842
goto exit;
1010
843
}
1011
844
1012
/* Create the Avahi service browser */
845
/* Create the service browser */
1013
846
sb = avahi_s_service_browser_new(mc.server, if_index,
1014
847
AVAHI_PROTO_INET6,
1015
848
"_mandos._tcp", NULL, 0,
1016
849
browse_callback, &mc);
1017
if (sb == NULL) {
850
if (!sb) {
1018
851
fprintf(stderr, "Failed to create service browser: %s\n",
1019
852
avahi_strerror(avahi_server_errno(mc.server)));
1020
exitcode = EXIT_FAILURE;
1021
goto end;
853
returncode = EXIT_FAILURE;
854
goto exit;
1022
855
}
1023
856
1024
857
/* Run the main loop */
1025
858
1026
859
if (debug){
1027
fprintf(stderr, "Starting Avahi loop search\n");
860
fprintf(stderr, "Starting avahi loop search\n");
1028
861
}
1029
862
1030
863
avahi_simple_poll_loop(mc.simple_poll);
1031
864
1032
end:
865
exit:
1033
866
1034
867
if (debug){
1035
868
fprintf(stderr, "%s exiting\n", argv[0]);
1036
869
}
1037
870
1038
871
/* Cleanup things */
1039
if (sb != NULL)
872
if (sb)
1040
873
avahi_s_service_browser_free(sb);
1041
874
1042
if (mc.server != NULL)
875
if (mc.server)
1043
876
avahi_server_free(mc.server);
1044
877
1045
if (mc.simple_poll != NULL)
878
if (mc.simple_poll)
1046
879
avahi_simple_poll_free(mc.simple_poll);
1047
880
free(pubkeyfile);
1048
881
free(seckeyfile);
1049
1050
if (gnutls_initalized){
1051
gnutls_certificate_free_credentials(mc.cred);
1052
gnutls_global_deinit ();
1053
}
1054
882
1055
return exitcode;
883
return returncode;
1056
884
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0