To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 41
- compare with another revision
- download diff
- download tarball
- view history from revision 41
- Committer: Teddy Hogeborn
- Date: 2008-08-03 21:45:14 UTC
- mfrom: (24.1.13 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080803214514-plvvkrpoitwsrxeg
Merge.
- files modified:
- TODO
added
removed
plugins.d/mandosclient.c
25
25
* along with this program. If not, see
26
26
* <http://www.gnu.org/licenses/>.
27
27
*
28
* Contact the authors at <https://www.fukt.bsnet.se/~belorn/> and
29
* <https://www.fukt.bsnet.se/~teddy/>.
28
* Contact the authors at <mandos@fukt.bsnet.se>.
30
29
*/
31
30
32
31
/* Needed by GPGME, specifically gpgme_data_seek() */
33
32
#define _LARGEFILE_SOURCE
34
33
#define _FILE_OFFSET_BITS 64
35
34
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
36
37
#include <stdio.h>
37
38
#include <assert.h>
38
39
#include <stdlib.h>
39
40
#include <time.h>
40
41
#include <net/if.h> /* if_nametoindex */
42
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
44
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
45
SIOCSIFFLAGS */
41
46
42
47
#include <avahi-core/core.h>
43
48
#include <avahi-core/lookup.h>
46
51
#include <avahi-common/malloc.h>
47
52
#include <avahi-common/error.h>
48
53
49
//mandos client part
54
/* Mandos client part */
50
55
#include <sys/types.h> /* socket(), inet_pton() */
51
56
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
52
57
struct in6_addr, inet_pton() */
59
64
#include <string.h> /* memset */
60
65
#include <arpa/inet.h> /* inet_pton() */
61
66
#include <iso646.h> /* not */
67
#include <net/if.h> /* IF_NAMESIZE */
62
68
63
// gpgme
69
/* GPGME */
64
70
#include <errno.h> /* perror() */
65
71
#include <gpgme.h>
66
72
67
// getopt long
73
/* getopt_long */
68
74
#include <getopt.h>
69
75
70
#ifndef CERT_ROOT
71
#define CERT_ROOT "/conf/conf.d/cryptkeyreq/"
72
#endif
73
#define CERTFILE CERT_ROOT "openpgp-client.txt"
74
#define KEYFILE CERT_ROOT "openpgp-client-key.txt"
75
76
#define BUFFER_SIZE 256
76
#define DH_BITS 1024
77
78
static const char *keydir = "/conf/conf.d/mandos";
79
static const char *pubkeyfile = "pubkey.txt";
80
static const char *seckeyfile = "seckey.txt";
77
81
78
82
bool debug = false;
79
83
84
const char mandos_protocol_version[] = "1";
85
86
/* Used for passing in values through all the callback functions */
80
87
typedef struct {
81
gnutls_session_t session;
88
AvahiSimplePoll *simple_poll;
89
AvahiServer *server;
82
90
gnutls_certificate_credentials_t cred;
91
unsigned int dh_bits;
83
92
gnutls_dh_params_t dh_params;
84
} encrypted_session;
85
86
87
ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
88
char **new_packet, const char *homedir){
93
const char *priority;
94
} mandos_context;
95
96
size_t adjustbuffer(char **buffer, size_t buffer_length,
97
size_t buffer_capacity){
98
if (buffer_length + BUFFER_SIZE > buffer_capacity){
99
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
100
if (buffer == NULL){
101
return 0;
102
}
103
buffer_capacity += BUFFER_SIZE;
104
}
105
return buffer_capacity;
106
}
107
108
/*
109
* Decrypt OpenPGP data using keyrings in HOMEDIR.
110
* Returns -1 on error
111
*/
112
static ssize_t pgp_packet_decrypt (const char *cryptotext,
113
size_t crypto_size,
114
char **plaintext,
115
const char *homedir){
89
116
gpgme_data_t dh_crypto, dh_plain;
90
117
gpgme_ctx_t ctx;
91
118
gpgme_error_t rc;
92
119
ssize_t ret;
93
ssize_t new_packet_capacity = 0;
94
ssize_t new_packet_length = 0;
120
size_t plaintext_capacity = 0;
121
ssize_t plaintext_length = 0;
95
122
gpgme_engine_info_t engine_info;
96
123
97
124
if (debug){
98
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
125
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
99
126
}
100
127
101
128
/* Init GPGME */
102
129
gpgme_check_version(NULL);
103
gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
130
rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP);
131
if (rc != GPG_ERR_NO_ERROR){
132
fprintf(stderr, "bad gpgme_engine_check_version: %s: %s\n",
133
gpgme_strsource(rc), gpgme_strerror(rc));
134
return -1;
135
}
104
136
105
/* Set GPGME home directory */
137
/* Set GPGME home directory for the OpenPGP engine only */
106
138
rc = gpgme_get_engine_info (&engine_info);
107
139
if (rc != GPG_ERR_NO_ERROR){
108
140
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
118
150
engine_info = engine_info->next;
119
151
}
120
152
if(engine_info == NULL){
121
fprintf(stderr, "Could not set home dir to %s\n", homedir);
153
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
122
154
return -1;
123
155
}
124
156
125
/* Create new GPGME data buffer from packet buffer */
126
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
157
/* Create new GPGME data buffer from memory cryptotext */
158
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
159
0);
127
160
if (rc != GPG_ERR_NO_ERROR){
128
161
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
129
162
gpgme_strsource(rc), gpgme_strerror(rc));
135
168
if (rc != GPG_ERR_NO_ERROR){
136
169
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
137
170
gpgme_strsource(rc), gpgme_strerror(rc));
171
gpgme_data_release(dh_crypto);
138
172
return -1;
139
173
}
140
174
143
177
if (rc != GPG_ERR_NO_ERROR){
144
178
fprintf(stderr, "bad gpgme_new: %s: %s\n",
145
179
gpgme_strsource(rc), gpgme_strerror(rc));
146
return -1;
180
plaintext_length = -1;
181
goto decrypt_end;
147
182
}
148
183
149
/* Decrypt data from the FILE pointer to the plaintext data
150
buffer */
184
/* Decrypt data from the cryptotext data buffer to the plaintext
185
data buffer */
151
186
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
152
187
if (rc != GPG_ERR_NO_ERROR){
153
188
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
154
189
gpgme_strsource(rc), gpgme_strerror(rc));
155
return -1;
190
plaintext_length = -1;
191
goto decrypt_end;
156
192
}
157
193
158
194
if(debug){
159
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
195
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
160
196
}
161
197
162
198
if (debug){
163
199
gpgme_decrypt_result_t result;
164
200
result = gpgme_op_decrypt_result(ctx);
188
224
}
189
225
}
190
226
191
/* Delete the GPGME FILE pointer cryptotext data buffer */
192
gpgme_data_release(dh_crypto);
193
194
227
/* Seek back to the beginning of the GPGME plaintext data buffer */
195
gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET);
196
197
*new_packet = 0;
228
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
229
perror("pgpme_data_seek");
230
plaintext_length = -1;
231
goto decrypt_end;
232
}
233
234
*plaintext = NULL;
198
235
while(true){
199
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
200
*new_packet = realloc(*new_packet,
201
(unsigned int)new_packet_capacity
202
+ BUFFER_SIZE);
203
if (*new_packet == NULL){
204
perror("realloc");
205
return -1;
206
}
207
new_packet_capacity += BUFFER_SIZE;
236
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
237
plaintext_capacity);
238
if (plaintext_capacity == 0){
239
perror("adjustbuffer");
240
plaintext_length = -1;
241
goto decrypt_end;
208
242
}
209
243
210
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
244
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
211
245
BUFFER_SIZE);
212
246
/* Print the data, if any */
213
247
if (ret == 0){
248
/* EOF */
214
249
break;
215
250
}
216
251
if(ret < 0){
217
252
perror("gpgme_data_read");
218
return -1;
253
plaintext_length = -1;
254
goto decrypt_end;
219
255
}
220
new_packet_length += ret;
256
plaintext_length += ret;
221
257
}
222
258
223
/* FIXME: check characters before printing to screen so to not print
224
terminal control characters */
225
/* if(debug){ */
226
/* fprintf(stderr, "decrypted password is: "); */
227
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
228
/* fprintf(stderr, "\n"); */
229
/* } */
259
if(debug){
260
fprintf(stderr, "Decrypted password is: ");
261
for(ssize_t i = 0; i < plaintext_length; i++){
262
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
263
}
264
fprintf(stderr, "\n");
265
}
266
267
decrypt_end:
268
269
/* Delete the GPGME cryptotext data buffer */
270
gpgme_data_release(dh_crypto);
230
271
231
272
/* Delete the GPGME plaintext data buffer */
232
273
gpgme_data_release(dh_plain);
233
return new_packet_length;
274
return plaintext_length;
234
275
}
235
276
236
277
static const char * safer_gnutls_strerror (int value) {
240
281
return ret;
241
282
}
242
283
243
void debuggnutls(__attribute__((unused)) int level,
244
const char* string){
245
fprintf(stderr, "%s", string);
284
/* GnuTLS log function callback */
285
static void debuggnutls(__attribute__((unused)) int level,
286
const char* string){
287
fprintf(stderr, "GnuTLS: %s", string);
246
288
}
247
289
248
int initgnutls(encrypted_session *es){
249
const char *err;
290
static int init_gnutls_global(mandos_context *mc){
250
291
int ret;
251
292
252
293
if(debug){
253
294
fprintf(stderr, "Initializing GnuTLS\n");
254
295
}
255
296
256
297
if ((ret = gnutls_global_init ())
257
298
!= GNUTLS_E_SUCCESS) {
258
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
299
fprintf (stderr, "GnuTLS global_init: %s\n",
300
safer_gnutls_strerror(ret));
259
301
return -1;
260
302
}
261
303
262
304
if (debug){
305
/* "Use a log level over 10 to enable all debugging options."
306
* - GnuTLS manual
307
*/
263
308
gnutls_global_set_log_level(11);
264
309
gnutls_global_set_log_function(debuggnutls);
265
310
}
266
311
267
/* openpgp credentials */
268
if ((ret = gnutls_certificate_allocate_credentials (&es->cred))
312
/* OpenPGP credentials */
313
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
269
314
!= GNUTLS_E_SUCCESS) {
270
fprintf (stderr, "memory error: %s\n",
315
fprintf (stderr, "GnuTLS memory error: %s\n",
271
316
safer_gnutls_strerror(ret));
272
317
return -1;
273
318
}
274
319
275
320
if(debug){
276
321
fprintf(stderr, "Attempting to use OpenPGP certificate %s"
277
" and keyfile %s as GnuTLS credentials\n", CERTFILE,
278
KEYFILE);
322
" and keyfile %s as GnuTLS credentials\n", pubkeyfile,
323
seckeyfile);
279
324
}
280
325
281
326
ret = gnutls_certificate_set_openpgp_key_file
282
(es->cred, CERTFILE, KEYFILE, GNUTLS_OPENPGP_FMT_BASE64);
327
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
283
328
if (ret != GNUTLS_E_SUCCESS) {
284
fprintf
285
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
286
" '%s')\n",
287
ret, CERTFILE, KEYFILE);
288
fprintf(stdout, "The Error is: %s\n",
329
fprintf(stderr,
330
"Error[%d] while reading the OpenPGP key pair ('%s',"
331
" '%s')\n", ret, pubkeyfile, seckeyfile);
332
fprintf(stdout, "The GnuTLS error is: %s\n",
289
333
safer_gnutls_strerror(ret));
290
334
return -1;
291
335
}
292
336
293
//GnuTLS server initialization
294
if ((ret = gnutls_dh_params_init (&es->dh_params))
295
!= GNUTLS_E_SUCCESS) {
296
fprintf (stderr, "Error in dh parameter initialization: %s\n",
297
safer_gnutls_strerror(ret));
298
return -1;
299
}
300
301
if ((ret = gnutls_dh_params_generate2 (es->dh_params, DH_BITS))
302
!= GNUTLS_E_SUCCESS) {
303
fprintf (stderr, "Error in prime generation: %s\n",
304
safer_gnutls_strerror(ret));
305
return -1;
306
}
307
308
gnutls_certificate_set_dh_params (es->cred, es->dh_params);
309
310
// GnuTLS session creation
311
if ((ret = gnutls_init (&es->session, GNUTLS_SERVER))
312
!= GNUTLS_E_SUCCESS){
337
/* GnuTLS server initialization */
338
ret = gnutls_dh_params_init(&mc->dh_params);
339
if (ret != GNUTLS_E_SUCCESS) {
340
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
341
" %s\n", safer_gnutls_strerror(ret));
342
return -1;
343
}
344
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
345
if (ret != GNUTLS_E_SUCCESS) {
346
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
347
safer_gnutls_strerror(ret));
348
return -1;
349
}
350
351
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
352
353
return 0;
354
}
355
356
static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
357
int ret;
358
/* GnuTLS session creation */
359
ret = gnutls_init(session, GNUTLS_SERVER);
360
if (ret != GNUTLS_E_SUCCESS){
313
361
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
314
362
safer_gnutls_strerror(ret));
315
363
}
316
364
317
if ((ret = gnutls_priority_set_direct (es->session, "NORMAL", &err))
318
!= GNUTLS_E_SUCCESS) {
319
fprintf(stderr, "Syntax error at: %s\n", err);
320
fprintf(stderr, "GnuTLS error: %s\n",
321
safer_gnutls_strerror(ret));
322
return -1;
365
{
366
const char *err;
367
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
368
if (ret != GNUTLS_E_SUCCESS) {
369
fprintf(stderr, "Syntax error at: %s\n", err);
370
fprintf(stderr, "GnuTLS error: %s\n",
371
safer_gnutls_strerror(ret));
372
return -1;
373
}
323
374
}
324
375
325
if ((ret = gnutls_credentials_set
326
(es->session, GNUTLS_CRD_CERTIFICATE, es->cred))
327
!= GNUTLS_E_SUCCESS) {
328
fprintf(stderr, "Error setting a credentials set: %s\n",
376
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
377
mc->cred);
378
if (ret != GNUTLS_E_SUCCESS) {
379
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
329
380
safer_gnutls_strerror(ret));
330
381
return -1;
331
382
}
332
383
333
384
/* ignore client certificate if any. */
334
gnutls_certificate_server_set_request (es->session,
385
gnutls_certificate_server_set_request (*session,
335
386
GNUTLS_CERT_IGNORE);
336
387
337
gnutls_dh_set_prime_bits (es->session, DH_BITS);
388
gnutls_dh_set_prime_bits (*session, mc->dh_bits);
338
389
339
390
return 0;
340
391
}
341
392
342
void empty_log(__attribute__((unused)) AvahiLogLevel level,
343
__attribute__((unused)) const char *txt){}
393
/* Avahi log function callback */
394
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
395
__attribute__((unused)) const char *txt){}
344
396
345
int start_mandos_communication(const char *ip, uint16_t port,
346
unsigned int if_index){
397
/* Called when a Mandos server is found */
398
static int start_mandos_communication(const char *ip, uint16_t port,
399
AvahiIfIndex if_index,
400
mandos_context *mc){
347
401
int ret, tcp_sd;
348
402
struct sockaddr_in6 to;
349
encrypted_session es;
350
403
char *buffer = NULL;
351
404
char *decrypted_buffer;
352
405
size_t buffer_length = 0;
353
406
size_t buffer_capacity = 0;
354
407
ssize_t decrypted_buffer_size;
355
size_t written = 0;
408
size_t written;
356
409
int retval = 0;
357
410
char interface[IF_NAMESIZE];
411
gnutls_session_t session;
412
gnutls_dh_params_t dh_params;
413
414
ret = init_gnutls_session (mc, &session);
415
if (ret != 0){
416
return -1;
417
}
358
418
359
419
if(debug){
360
420
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
366
426
perror("socket");
367
427
return -1;
368
428
}
369
370
if(if_indextoname(if_index, interface) == NULL){
371
if(debug){
429
430
if(debug){
431
if(if_indextoname((unsigned int)if_index, interface) == NULL){
372
432
perror("if_indextoname");
433
return -1;
373
434
}
374
return -1;
375
}
376
377
if(debug){
378
435
fprintf(stderr, "Binding to interface %s\n", interface);
379
436
}
380
437
381
438
memset(&to,0,sizeof(to)); /* Spurious warning */
382
439
to.sin6_family = AF_INET6;
440
/* It would be nice to have a way to detect if we were passed an
441
IPv4 address here. Now we assume an IPv6 address. */
383
442
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
384
443
if (ret < 0 ){
385
444
perror("inet_pton");
386
445
return -1;
387
}
446
}
388
447
if(ret == 0){
389
448
fprintf(stderr, "Bad address: %s\n", ip);
390
449
return -1;
395
454
396
455
if(debug){
397
456
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
398
/* char addrstr[INET6_ADDRSTRLEN]; */
399
/* if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr, */
400
/* sizeof(addrstr)) == NULL){ */
401
/* perror("inet_ntop"); */
402
/* } else { */
403
/* fprintf(stderr, "Really connecting to: %s, port %d\n", */
404
/* addrstr, ntohs(to.sin6_port)); */
405
/* } */
457
char addrstr[INET6_ADDRSTRLEN] = "";
458
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
459
sizeof(addrstr)) == NULL){
460
perror("inet_ntop");
461
} else {
462
if(strcmp(addrstr, ip) != 0){
463
fprintf(stderr, "Canonical address form: %s\n", addrstr);
464
}
465
}
406
466
}
407
467
408
468
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
410
470
perror("connect");
411
471
return -1;
412
472
}
413
414
ret = initgnutls (&es);
415
if (ret != 0){
416
retval = -1;
417
return -1;
473
474
const char *out = mandos_protocol_version;
475
written = 0;
476
while (true){
477
size_t out_size = strlen(out);
478
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
479
out_size - written));
480
if (ret == -1){
481
perror("write");
482
retval = -1;
483
goto mandos_end;
484
}
485
written += (size_t)ret;
486
if(written < out_size){
487
continue;
488
} else {
489
if (out == mandos_protocol_version){
490
written = 0;
491
out = "\r\n";
492
} else {
493
break;
494
}
495
}
418
496
}
419
420
gnutls_transport_set_ptr (es.session,
421
(gnutls_transport_ptr_t) tcp_sd);
422
497
423
498
if(debug){
424
499
fprintf(stderr, "Establishing TLS session with %s\n", ip);
425
500
}
426
501
427
ret = gnutls_handshake (es.session);
502
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
503
504
ret = gnutls_handshake (session);
428
505
429
506
if (ret != GNUTLS_E_SUCCESS){
430
507
if(debug){
431
fprintf(stderr, "\n*** Handshake failed ***\n");
508
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
432
509
gnutls_perror (ret);
433
510
}
434
511
retval = -1;
435
goto exit;
512
goto mandos_end;
436
513
}
437
514
438
//Retrieve OpenPGP packet that contains the wanted password
515
/* Read OpenPGP packet that contains the wanted password */
439
516
440
517
if(debug){
441
518
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
443
520
}
444
521
445
522
while(true){
446
if (buffer_length + BUFFER_SIZE > buffer_capacity){
447
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
448
if (buffer == NULL){
449
perror("realloc");
450
goto exit;
451
}
452
buffer_capacity += BUFFER_SIZE;
523
buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);
524
if (buffer_capacity == 0){
525
perror("adjustbuffer");
526
retval = -1;
527
goto mandos_end;
453
528
}
454
529
455
ret = gnutls_record_recv
456
(es.session, buffer+buffer_length, BUFFER_SIZE);
530
ret = gnutls_record_recv(session, buffer+buffer_length,
531
BUFFER_SIZE);
457
532
if (ret == 0){
458
533
break;
459
534
}
463
538
case GNUTLS_E_AGAIN:
464
539
break;
465
540
case GNUTLS_E_REHANDSHAKE:
466
ret = gnutls_handshake (es.session);
541
ret = gnutls_handshake (session);
467
542
if (ret < 0){
468
fprintf(stderr, "\n*** Handshake failed ***\n");
543
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
469
544
gnutls_perror (ret);
470
545
retval = -1;
471
goto exit;
546
goto mandos_end;
472
547
}
473
548
break;
474
549
default:
475
550
fprintf(stderr, "Unknown error while reading data from"
476
" encrypted session with mandos server\n");
551
" encrypted session with Mandos server\n");
477
552
retval = -1;
478
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
479
goto exit;
553
gnutls_bye (session, GNUTLS_SHUT_RDWR);
554
goto mandos_end;
480
555
}
481
556
} else {
482
557
buffer_length += (size_t) ret;
483
558
}
484
559
}
485
560
561
if(debug){
562
fprintf(stderr, "Closing TLS session\n");
563
}
564
565
gnutls_bye (session, GNUTLS_SHUT_RDWR);
566
486
567
if (buffer_length > 0){
487
568
decrypted_buffer_size = pgp_packet_decrypt(buffer,
488
569
buffer_length,
489
570
&decrypted_buffer,
490
CERT_ROOT);
571
keydir);
491
572
if (decrypted_buffer_size >= 0){
573
written = 0;
492
574
while(written < (size_t) decrypted_buffer_size){
493
575
ret = (int)fwrite (decrypted_buffer + written, 1,
494
576
(size_t)decrypted_buffer_size - written,
508
590
retval = -1;
509
591
}
510
592
}
511
512
//shutdown procedure
513
514
if(debug){
515
fprintf(stderr, "Closing TLS session\n");
516
}
517
593
594
/* Shutdown procedure */
595
596
mandos_end:
518
597
free(buffer);
519
gnutls_bye (es.session, GNUTLS_SHUT_RDWR);
520
exit:
521
598
close(tcp_sd);
522
gnutls_deinit (es.session);
523
gnutls_certificate_free_credentials (es.cred);
599
gnutls_deinit (session);
600
gnutls_certificate_free_credentials (mc->cred);
524
601
gnutls_global_deinit ();
525
602
return retval;
526
603
}
527
604
528
static AvahiSimplePoll *simple_poll = NULL;
529
static AvahiServer *server = NULL;
530
531
static void resolve_callback(
532
AvahiSServiceResolver *r,
533
AvahiIfIndex interface,
534
AVAHI_GCC_UNUSED AvahiProtocol protocol,
535
AvahiResolverEvent event,
536
const char *name,
537
const char *type,
538
const char *domain,
539
const char *host_name,
540
const AvahiAddress *address,
541
uint16_t port,
542
AVAHI_GCC_UNUSED AvahiStringList *txt,
543
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
544
AVAHI_GCC_UNUSED void* userdata) {
545
605
static void resolve_callback(AvahiSServiceResolver *r,
606
AvahiIfIndex interface,
607
AVAHI_GCC_UNUSED AvahiProtocol protocol,
608
AvahiResolverEvent event,
609
const char *name,
610
const char *type,
611
const char *domain,
612
const char *host_name,
613
const AvahiAddress *address,
614
uint16_t port,
615
AVAHI_GCC_UNUSED AvahiStringList *txt,
616
AVAHI_GCC_UNUSED AvahiLookupResultFlags
617
flags,
618
void* userdata) {
619
mandos_context *mc = userdata;
546
620
assert(r); /* Spurious warning */
547
621
548
622
/* Called whenever a service has been resolved successfully or
551
625
switch (event) {
552
626
default:
553
627
case AVAHI_RESOLVER_FAILURE:
554
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
555
" type '%s' in domain '%s': %s\n", name, type, domain,
556
avahi_strerror(avahi_server_errno(server)));
628
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
629
" of type '%s' in domain '%s': %s\n", name, type, domain,
630
avahi_strerror(avahi_server_errno(mc->server)));
557
631
break;
558
632
559
633
case AVAHI_RESOLVER_FOUND:
561
635
char ip[AVAHI_ADDRESS_STR_MAX];
562
636
avahi_address_snprint(ip, sizeof(ip), address);
563
637
if(debug){
564
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
565
" port %d\n", name, host_name, ip, port);
638
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"
639
" port %d\n", name, host_name, ip, interface, port);
566
640
}
567
int ret = start_mandos_communication(ip, port,
568
(unsigned int) interface);
641
int ret = start_mandos_communication(ip, port, interface, mc);
569
642
if (ret == 0){
570
643
exit(EXIT_SUCCESS);
571
644
}
574
647
avahi_s_service_resolver_free(r);
575
648
}
576
649
577
static void browse_callback(
578
AvahiSServiceBrowser *b,
579
AvahiIfIndex interface,
580
AvahiProtocol protocol,
581
AvahiBrowserEvent event,
582
const char *name,
583
const char *type,
584
const char *domain,
585
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
586
void* userdata) {
587
588
AvahiServer *s = userdata;
589
assert(b); /* Spurious warning */
590
591
/* Called whenever a new services becomes available on the LAN or
592
is removed from the LAN */
593
594
switch (event) {
595
default:
596
case AVAHI_BROWSER_FAILURE:
597
598
fprintf(stderr, "(Browser) %s\n",
599
avahi_strerror(avahi_server_errno(server)));
600
avahi_simple_poll_quit(simple_poll);
601
return;
602
603
case AVAHI_BROWSER_NEW:
604
/* We ignore the returned resolver object. In the callback
605
function we free it. If the server is terminated before
606
the callback function is called the server will free
607
the resolver for us. */
608
609
if (!(avahi_s_service_resolver_new(s, interface, protocol, name,
610
type, domain,
611
AVAHI_PROTO_INET6, 0,
612
resolve_callback, s)))
613
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
614
avahi_strerror(avahi_server_errno(s)));
615
break;
616
617
case AVAHI_BROWSER_REMOVE:
618
break;
619
620
case AVAHI_BROWSER_ALL_FOR_NOW:
621
case AVAHI_BROWSER_CACHE_EXHAUSTED:
622
break;
650
static void browse_callback( AvahiSServiceBrowser *b,
651
AvahiIfIndex interface,
652
AvahiProtocol protocol,
653
AvahiBrowserEvent event,
654
const char *name,
655
const char *type,
656
const char *domain,
657
AVAHI_GCC_UNUSED AvahiLookupResultFlags
658
flags,
659
void* userdata) {
660
mandos_context *mc = userdata;
661
assert(b); /* Spurious warning */
662
663
/* Called whenever a new services becomes available on the LAN or
664
is removed from the LAN */
665
666
switch (event) {
667
default:
668
case AVAHI_BROWSER_FAILURE:
669
670
fprintf(stderr, "(Avahi browser) %s\n",
671
avahi_strerror(avahi_server_errno(mc->server)));
672
avahi_simple_poll_quit(mc->simple_poll);
673
return;
674
675
case AVAHI_BROWSER_NEW:
676
/* We ignore the returned Avahi resolver object. In the callback
677
function we free it. If the Avahi server is terminated before
678
the callback function is called the Avahi server will free the
679
resolver for us. */
680
681
if (!(avahi_s_service_resolver_new(mc->server, interface,
682
protocol, name, type, domain,
683
AVAHI_PROTO_INET6, 0,
684
resolve_callback, mc)))
685
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
686
name, avahi_strerror(avahi_server_errno(mc->server)));
687
break;
688
689
case AVAHI_BROWSER_REMOVE:
690
break;
691
692
case AVAHI_BROWSER_ALL_FOR_NOW:
693
case AVAHI_BROWSER_CACHE_EXHAUSTED:
694
if(debug){
695
fprintf(stderr, "No Mandos server found, still searching...\n");
623
696
}
624
}
625
626
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
627
AvahiServerConfig config;
697
break;
698
}
699
}
700
701
/* Combines file name and path and returns the malloced new
702
string. some sane checks could/should be added */
703
static const char *combinepath(const char *first, const char *second){
704
size_t f_len = strlen(first);
705
size_t s_len = strlen(second);
706
char *tmp = malloc(f_len + s_len + 2);
707
if (tmp == NULL){
708
return NULL;
709
}
710
if(f_len > 0){
711
memcpy(tmp, first, f_len); /* Spurious warning */
712
}
713
tmp[f_len] = '/';
714
if(s_len > 0){
715
memcpy(tmp + f_len + 1, second, s_len); /* Spurious warning */
716
}
717
tmp[f_len + 1 + s_len] = '\0';
718
return tmp;
719
}
720
721
722
int main(int argc, char *argv[]){
628
723
AvahiSServiceBrowser *sb = NULL;
629
724
int error;
630
725
int ret;
631
int returncode = EXIT_SUCCESS;
726
int exitcode = EXIT_SUCCESS;
632
727
const char *interface = "eth0";
633
unsigned int if_index;
728
struct ifreq network;
729
int sd;
730
uid_t uid;
731
gid_t gid;
634
732
char *connect_to = NULL;
635
636
while (true){
637
static struct option long_options[] = {
638
{"debug", no_argument, (int *)&debug, 1},
639
{"connect", required_argument, 0, 'c'},
640
{"interface", required_argument, 0, 'i'},
641
{0, 0, 0, 0} };
642
643
int option_index = 0;
644
ret = getopt_long (argc, argv, "i:", long_options,
645
&option_index);
646
647
if (ret == -1){
648
break;
649
}
650
651
switch(ret){
652
case 0:
653
break;
654
case 'i':
655
interface = optarg;
656
break;
657
case 'c':
658
connect_to = optarg;
659
break;
660
default:
661
exit(EXIT_FAILURE);
662
}
663
}
664
665
if_index = if_nametoindex(interface);
733
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
734
mandos_context mc = { .simple_poll = NULL, .server = NULL,
735
.dh_bits = 1024, .priority = "SECURE256"};
736
737
{
738
/* Temporary int to get the address of for getopt_long */
739
int debug_int = debug ? 1 : 0;
740
while (true){
741
struct option long_options[] = {
742
{"debug", no_argument, &debug_int, 1},
743
{"connect", required_argument, NULL, 'c'},
744
{"interface", required_argument, NULL, 'i'},
745
{"keydir", required_argument, NULL, 'd'},
746
{"seckey", required_argument, NULL, 's'},
747
{"pubkey", required_argument, NULL, 'p'},
748
{"dh-bits", required_argument, NULL, 'D'},
749
{"priority", required_argument, NULL, 'P'},
750
{0, 0, 0, 0} };
751
752
int option_index = 0;
753
ret = getopt_long (argc, argv, "i:", long_options,
754
&option_index);
755
756
if (ret == -1){
757
break;
758
}
759
760
switch(ret){
761
case 0:
762
break;
763
case 'i':
764
interface = optarg;
765
break;
766
case 'c':
767
connect_to = optarg;
768
break;
769
case 'd':
770
keydir = optarg;
771
break;
772
case 'p':
773
pubkeyfile = optarg;
774
break;
775
case 's':
776
seckeyfile = optarg;
777
break;
778
case 'D':
779
errno = 0;
780
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
781
if (errno){
782
perror("strtol");
783
exit(EXIT_FAILURE);
784
}
785
break;
786
case 'P':
787
mc.priority = optarg;
788
break;
789
case '?':
790
default:
791
/* getopt_long() has already printed a message about the
792
unrcognized option, so just exit. */
793
exit(EXIT_FAILURE);
794
}
795
}
796
/* Set the global debug flag from the temporary int */
797
debug = debug_int ? true : false;
798
}
799
800
pubkeyfile = combinepath(keydir, pubkeyfile);
801
if (pubkeyfile == NULL){
802
perror("combinepath");
803
exitcode = EXIT_FAILURE;
804
goto end;
805
}
806
807
seckeyfile = combinepath(keydir, seckeyfile);
808
if (seckeyfile == NULL){
809
perror("combinepath");
810
goto end;
811
}
812
813
ret = init_gnutls_global(&mc);
814
if (ret == -1){
815
fprintf(stderr, "init_gnutls_global\n");
816
goto end;
817
}
818
819
uid = getuid();
820
gid = getgid();
821
822
ret = setuid(uid);
823
if (ret == -1){
824
perror("setuid");
825
}
826
827
setgid(gid);
828
if (ret == -1){
829
perror("setgid");
830
}
831
832
if_index = (AvahiIfIndex) if_nametoindex(interface);
666
833
if(if_index == 0){
667
834
fprintf(stderr, "No such interface: \"%s\"\n", interface);
668
835
exit(EXIT_FAILURE);
674
841
char *address = strrchr(connect_to, ':');
675
842
if(address == NULL){
676
843
fprintf(stderr, "No colon in address\n");
677
exit(EXIT_FAILURE);
844
exitcode = EXIT_FAILURE;
845
goto end;
678
846
}
679
847
errno = 0;
680
848
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
681
849
if(errno){
682
850
perror("Bad port number");
683
exit(EXIT_FAILURE);
851
exitcode = EXIT_FAILURE;
852
goto end;
684
853
}
685
854
*address = '\0';
686
855
address = connect_to;
687
ret = start_mandos_communication(address, port, if_index);
856
ret = start_mandos_communication(address, port, if_index, &mc);
688
857
if(ret < 0){
689
exit(EXIT_FAILURE);
858
exitcode = EXIT_FAILURE;
690
859
} else {
691
exit(EXIT_SUCCESS);
692
}
860
exitcode = EXIT_SUCCESS;
861
}
862
goto end;
863
}
864
865
/* If the interface is down, bring it up */
866
{
867
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
868
if(sd < 0) {
869
perror("socket");
870
exitcode = EXIT_FAILURE;
871
goto end;
872
}
873
strcpy(network.ifr_name, interface); /* Spurious warning */
874
ret = ioctl(sd, SIOCGIFFLAGS, &network);
875
if(ret == -1){
876
perror("ioctl SIOCGIFFLAGS");
877
exitcode = EXIT_FAILURE;
878
goto end;
879
}
880
if((network.ifr_flags & IFF_UP) == 0){
881
network.ifr_flags |= IFF_UP;
882
ret = ioctl(sd, SIOCSIFFLAGS, &network);
883
if(ret == -1){
884
perror("ioctl SIOCSIFFLAGS");
885
exitcode = EXIT_FAILURE;
886
goto end;
887
}
888
}
889
close(sd);
693
890
}
694
891
695
892
if (not debug){
696
893
avahi_set_log_function(empty_log);
697
894
}
698
895
699
/* Initialize the psuedo-RNG */
896
/* Initialize the pseudo-RNG for Avahi */
700
897
srand((unsigned int) time(NULL));
701
702
/* Allocate main loop object */
703
if (!(simple_poll = avahi_simple_poll_new())) {
704
fprintf(stderr, "Failed to create simple poll object.\n");
705
706
goto exit;
707
}
708
709
/* Do not publish any local records */
710
avahi_server_config_init(&config);
711
config.publish_hinfo = 0;
712
config.publish_addresses = 0;
713
config.publish_workstation = 0;
714
config.publish_domain = 0;
715
716
/* Allocate a new server */
717
server = avahi_server_new(avahi_simple_poll_get(simple_poll),
718
&config, NULL, NULL, &error);
719
720
/* Free the configuration data */
721
avahi_server_config_free(&config);
722
723
/* Check if creating the server object succeeded */
724
if (!server) {
725
fprintf(stderr, "Failed to create server: %s\n",
898
899
/* Allocate main Avahi loop object */
900
mc.simple_poll = avahi_simple_poll_new();
901
if (mc.simple_poll == NULL) {
902
fprintf(stderr, "Avahi: Failed to create simple poll"
903
" object.\n");
904
exitcode = EXIT_FAILURE;
905
goto end;
906
}
907
908
{
909
AvahiServerConfig config;
910
/* Do not publish any local Zeroconf records */
911
avahi_server_config_init(&config);
912
config.publish_hinfo = 0;
913
config.publish_addresses = 0;
914
config.publish_workstation = 0;
915
config.publish_domain = 0;
916
917
/* Allocate a new server */
918
mc.server = avahi_server_new(avahi_simple_poll_get
919
(mc.simple_poll), &config, NULL,
920
NULL, &error);
921
922
/* Free the Avahi configuration data */
923
avahi_server_config_free(&config);
924
}
925
926
/* Check if creating the Avahi server object succeeded */
927
if (mc.server == NULL) {
928
fprintf(stderr, "Failed to create Avahi server: %s\n",
726
929
avahi_strerror(error));
727
returncode = EXIT_FAILURE;
728
goto exit;
930
exitcode = EXIT_FAILURE;
931
goto end;
729
932
}
730
933
731
/* Create the service browser */
732
sb = avahi_s_service_browser_new(server, (AvahiIfIndex)if_index,
934
/* Create the Avahi service browser */
935
sb = avahi_s_service_browser_new(mc.server, if_index,
733
936
AVAHI_PROTO_INET6,
734
937
"_mandos._tcp", NULL, 0,
735
browse_callback, server);
736
if (!sb) {
938
browse_callback, &mc);
939
if (sb == NULL) {
737
940
fprintf(stderr, "Failed to create service browser: %s\n",
738
avahi_strerror(avahi_server_errno(server)));
739
returncode = EXIT_FAILURE;
740
goto exit;
941
avahi_strerror(avahi_server_errno(mc.server)));
942
exitcode = EXIT_FAILURE;
943
goto end;
741
944
}
742
945
743
946
/* Run the main loop */
744
947
745
948
if (debug){
746
fprintf(stderr, "Starting avahi loop search\n");
949
fprintf(stderr, "Starting Avahi loop search\n");
747
950
}
748
951
749
avahi_simple_poll_loop(simple_poll);
952
avahi_simple_poll_loop(mc.simple_poll);
750
953
751
exit:
954
end:
752
955
753
956
if (debug){
754
957
fprintf(stderr, "%s exiting\n", argv[0]);
755
958
}
756
959
757
960
/* Cleanup things */
758
if (sb)
961
if (sb != NULL)
759
962
avahi_s_service_browser_free(sb);
760
963
761
if (server)
762
avahi_server_free(server);
763
764
if (simple_poll)
765
avahi_simple_poll_free(simple_poll);
766
767
return returncode;
964
if (mc.server != NULL)
965
avahi_server_free(mc.server);
966
967
if (mc.simple_poll != NULL)
968
avahi_simple_poll_free(mc.simple_poll);
969
free(pubkeyfile);
970
free(seckeyfile);
971
972
return exitcode;
768
973
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0