To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandosclient.c
- browse files at revision 41
- compare with another revision
- download diff
- download tarball
- view history from revision 41
- Committer: Teddy Hogeborn
- Date: 2008-08-03 21:45:14 UTC
- mfrom: (24.1.13 mandos)
- Revision ID: teddy@fukt.bsnet.se-20080803214514-plvvkrpoitwsrxeg
Merge.
- files modified:
- TODO
added
removed
plugins.d/mandosclient.c
32
32
#define _LARGEFILE_SOURCE
33
33
#define _FILE_OFFSET_BITS 64
34
34
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
35
37
#include <stdio.h>
36
38
#include <assert.h>
37
39
#include <stdlib.h>
38
40
#include <time.h>
39
41
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
41
#include <net/if.h> // ioctl, ifreq, SIOCGIFFLAGS, IFF_UP, SIOCSIFFLAGS
42
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
44
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
45
SIOCSIFFLAGS */
42
46
43
47
#include <avahi-core/core.h>
44
48
#include <avahi-core/lookup.h>
47
51
#include <avahi-common/malloc.h>
48
52
#include <avahi-common/error.h>
49
53
50
//mandos client part
54
/* Mandos client part */
51
55
#include <sys/types.h> /* socket(), inet_pton() */
52
56
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
53
57
struct in6_addr, inet_pton() */
60
64
#include <string.h> /* memset */
61
65
#include <arpa/inet.h> /* inet_pton() */
62
66
#include <iso646.h> /* not */
67
#include <net/if.h> /* IF_NAMESIZE */
63
68
64
// gpgme
69
/* GPGME */
65
70
#include <errno.h> /* perror() */
66
71
#include <gpgme.h>
67
72
68
// getopt_long
73
/* getopt_long */
69
74
#include <getopt.h>
70
75
71
76
#define BUFFER_SIZE 256
76
81
77
82
bool debug = false;
78
83
84
const char mandos_protocol_version[] = "1";
85
79
86
/* Used for passing in values through all the callback functions */
80
87
typedef struct {
81
88
AvahiSimplePoll *simple_poll;
82
89
AvahiServer *server;
83
90
gnutls_certificate_credentials_t cred;
84
91
unsigned int dh_bits;
92
gnutls_dh_params_t dh_params;
85
93
const char *priority;
86
94
} mandos_context;
87
95
88
static ssize_t pgp_packet_decrypt (char *packet, size_t packet_size,
89
char **new_packet,
96
size_t adjustbuffer(char **buffer, size_t buffer_length,
97
size_t buffer_capacity){
98
if (buffer_length + BUFFER_SIZE > buffer_capacity){
99
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
100
if (buffer == NULL){
101
return 0;
102
}
103
buffer_capacity += BUFFER_SIZE;
104
}
105
return buffer_capacity;
106
}
107
108
/*
109
* Decrypt OpenPGP data using keyrings in HOMEDIR.
110
* Returns -1 on error
111
*/
112
static ssize_t pgp_packet_decrypt (const char *cryptotext,
113
size_t crypto_size,
114
char **plaintext,
90
115
const char *homedir){
91
116
gpgme_data_t dh_crypto, dh_plain;
92
117
gpgme_ctx_t ctx;
93
118
gpgme_error_t rc;
94
119
ssize_t ret;
95
ssize_t new_packet_capacity = 0;
96
ssize_t new_packet_length = 0;
120
size_t plaintext_capacity = 0;
121
ssize_t plaintext_length = 0;
97
122
gpgme_engine_info_t engine_info;
98
123
99
124
if (debug){
100
fprintf(stderr, "Trying to decrypt OpenPGP packet\n");
125
fprintf(stderr, "Trying to decrypt OpenPGP data\n");
101
126
}
102
127
103
128
/* Init GPGME */
109
134
return -1;
110
135
}
111
136
112
/* Set GPGME home directory */
137
/* Set GPGME home directory for the OpenPGP engine only */
113
138
rc = gpgme_get_engine_info (&engine_info);
114
139
if (rc != GPG_ERR_NO_ERROR){
115
140
fprintf(stderr, "bad gpgme_get_engine_info: %s: %s\n",
125
150
engine_info = engine_info->next;
126
151
}
127
152
if(engine_info == NULL){
128
fprintf(stderr, "Could not set home dir to %s\n", homedir);
153
fprintf(stderr, "Could not set GPGME home dir to %s\n", homedir);
129
154
return -1;
130
155
}
131
156
132
/* Create new GPGME data buffer from packet buffer */
133
rc = gpgme_data_new_from_mem(&dh_crypto, packet, packet_size, 0);
157
/* Create new GPGME data buffer from memory cryptotext */
158
rc = gpgme_data_new_from_mem(&dh_crypto, cryptotext, crypto_size,
159
0);
134
160
if (rc != GPG_ERR_NO_ERROR){
135
161
fprintf(stderr, "bad gpgme_data_new_from_mem: %s: %s\n",
136
162
gpgme_strsource(rc), gpgme_strerror(rc));
142
168
if (rc != GPG_ERR_NO_ERROR){
143
169
fprintf(stderr, "bad gpgme_data_new: %s: %s\n",
144
170
gpgme_strsource(rc), gpgme_strerror(rc));
171
gpgme_data_release(dh_crypto);
145
172
return -1;
146
173
}
147
174
150
177
if (rc != GPG_ERR_NO_ERROR){
151
178
fprintf(stderr, "bad gpgme_new: %s: %s\n",
152
179
gpgme_strsource(rc), gpgme_strerror(rc));
153
return -1;
180
plaintext_length = -1;
181
goto decrypt_end;
154
182
}
155
183
156
/* Decrypt data from the FILE pointer to the plaintext data
157
buffer */
184
/* Decrypt data from the cryptotext data buffer to the plaintext
185
data buffer */
158
186
rc = gpgme_op_decrypt(ctx, dh_crypto, dh_plain);
159
187
if (rc != GPG_ERR_NO_ERROR){
160
188
fprintf(stderr, "bad gpgme_op_decrypt: %s: %s\n",
161
189
gpgme_strsource(rc), gpgme_strerror(rc));
162
return -1;
190
plaintext_length = -1;
191
goto decrypt_end;
163
192
}
164
193
165
194
if(debug){
166
fprintf(stderr, "Decryption of OpenPGP packet succeeded\n");
195
fprintf(stderr, "Decryption of OpenPGP data succeeded\n");
167
196
}
168
197
169
198
if (debug){
170
199
gpgme_decrypt_result_t result;
171
200
result = gpgme_op_decrypt_result(ctx);
195
224
}
196
225
}
197
226
198
/* Delete the GPGME FILE pointer cryptotext data buffer */
199
gpgme_data_release(dh_crypto);
200
201
227
/* Seek back to the beginning of the GPGME plaintext data buffer */
202
228
if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){
203
229
perror("pgpme_data_seek");
230
plaintext_length = -1;
231
goto decrypt_end;
204
232
}
205
233
206
*new_packet = 0;
234
*plaintext = NULL;
207
235
while(true){
208
if (new_packet_length + BUFFER_SIZE > new_packet_capacity){
209
*new_packet = realloc(*new_packet,
210
(unsigned int)new_packet_capacity
211
+ BUFFER_SIZE);
212
if (*new_packet == NULL){
213
perror("realloc");
214
return -1;
215
}
216
new_packet_capacity += BUFFER_SIZE;
236
plaintext_capacity = adjustbuffer(plaintext, (size_t)plaintext_length,
237
plaintext_capacity);
238
if (plaintext_capacity == 0){
239
perror("adjustbuffer");
240
plaintext_length = -1;
241
goto decrypt_end;
217
242
}
218
243
219
ret = gpgme_data_read(dh_plain, *new_packet + new_packet_length,
244
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
220
245
BUFFER_SIZE);
221
246
/* Print the data, if any */
222
247
if (ret == 0){
248
/* EOF */
223
249
break;
224
250
}
225
251
if(ret < 0){
226
252
perror("gpgme_data_read");
227
return -1;
253
plaintext_length = -1;
254
goto decrypt_end;
228
255
}
229
new_packet_length += ret;
256
plaintext_length += ret;
230
257
}
231
258
232
/* FIXME: check characters before printing to screen so to not print
233
terminal control characters */
234
/* if(debug){ */
235
/* fprintf(stderr, "decrypted password is: "); */
236
/* fwrite(*new_packet, 1, new_packet_length, stderr); */
237
/* fprintf(stderr, "\n"); */
238
/* } */
259
if(debug){
260
fprintf(stderr, "Decrypted password is: ");
261
for(ssize_t i = 0; i < plaintext_length; i++){
262
fprintf(stderr, "%02hhX ", (*plaintext)[i]);
263
}
264
fprintf(stderr, "\n");
265
}
266
267
decrypt_end:
268
269
/* Delete the GPGME cryptotext data buffer */
270
gpgme_data_release(dh_crypto);
239
271
240
272
/* Delete the GPGME plaintext data buffer */
241
273
gpgme_data_release(dh_plain);
242
return new_packet_length;
274
return plaintext_length;
243
275
}
244
276
245
277
static const char * safer_gnutls_strerror (int value) {
249
281
return ret;
250
282
}
251
283
284
/* GnuTLS log function callback */
252
285
static void debuggnutls(__attribute__((unused)) int level,
253
286
const char* string){
254
fprintf(stderr, "%s", string);
287
fprintf(stderr, "GnuTLS: %s", string);
255
288
}
256
289
257
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
258
gnutls_dh_params_t *dh_params){
259
const char *err;
290
static int init_gnutls_global(mandos_context *mc){
260
291
int ret;
261
292
262
293
if(debug){
265
296
266
297
if ((ret = gnutls_global_init ())
267
298
!= GNUTLS_E_SUCCESS) {
268
fprintf (stderr, "global_init: %s\n", safer_gnutls_strerror(ret));
299
fprintf (stderr, "GnuTLS global_init: %s\n",
300
safer_gnutls_strerror(ret));
269
301
return -1;
270
302
}
271
303
272
304
if (debug){
305
/* "Use a log level over 10 to enable all debugging options."
306
* - GnuTLS manual
307
*/
273
308
gnutls_global_set_log_level(11);
274
309
gnutls_global_set_log_function(debuggnutls);
275
310
}
276
311
277
/* openpgp credentials */
312
/* OpenPGP credentials */
278
313
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
279
314
!= GNUTLS_E_SUCCESS) {
280
fprintf (stderr, "memory error: %s\n",
315
fprintf (stderr, "GnuTLS memory error: %s\n",
281
316
safer_gnutls_strerror(ret));
282
317
return -1;
283
318
}
291
326
ret = gnutls_certificate_set_openpgp_key_file
292
327
(mc->cred, pubkeyfile, seckeyfile, GNUTLS_OPENPGP_FMT_BASE64);
293
328
if (ret != GNUTLS_E_SUCCESS) {
294
fprintf
295
(stderr, "Error[%d] while reading the OpenPGP key pair ('%s',"
296
" '%s')\n",
297
ret, pubkeyfile, seckeyfile);
298
fprintf(stdout, "The Error is: %s\n",
329
fprintf(stderr,
330
"Error[%d] while reading the OpenPGP key pair ('%s',"
331
" '%s')\n", ret, pubkeyfile, seckeyfile);
332
fprintf(stdout, "The GnuTLS error is: %s\n",
299
333
safer_gnutls_strerror(ret));
300
334
return -1;
301
335
}
302
336
303
//GnuTLS server initialization
304
if ((ret = gnutls_dh_params_init(dh_params))
305
!= GNUTLS_E_SUCCESS) {
306
fprintf (stderr, "Error in dh parameter initialization: %s\n",
307
safer_gnutls_strerror(ret));
308
return -1;
309
}
310
311
if ((ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits))
312
!= GNUTLS_E_SUCCESS) {
313
fprintf (stderr, "Error in prime generation: %s\n",
314
safer_gnutls_strerror(ret));
315
return -1;
316
}
317
318
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
319
320
// GnuTLS session creation
321
if ((ret = gnutls_init(session, GNUTLS_SERVER))
322
!= GNUTLS_E_SUCCESS){
337
/* GnuTLS server initialization */
338
ret = gnutls_dh_params_init(&mc->dh_params);
339
if (ret != GNUTLS_E_SUCCESS) {
340
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
341
" %s\n", safer_gnutls_strerror(ret));
342
return -1;
343
}
344
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
345
if (ret != GNUTLS_E_SUCCESS) {
346
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
347
safer_gnutls_strerror(ret));
348
return -1;
349
}
350
351
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
352
353
return 0;
354
}
355
356
static int init_gnutls_session(mandos_context *mc, gnutls_session_t *session){
357
int ret;
358
/* GnuTLS session creation */
359
ret = gnutls_init(session, GNUTLS_SERVER);
360
if (ret != GNUTLS_E_SUCCESS){
323
361
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
324
362
safer_gnutls_strerror(ret));
325
363
}
326
364
327
if ((ret = gnutls_priority_set_direct(*session, mc->priority, &err))
328
!= GNUTLS_E_SUCCESS) {
329
fprintf(stderr, "Syntax error at: %s\n", err);
330
fprintf(stderr, "GnuTLS error: %s\n",
331
safer_gnutls_strerror(ret));
332
return -1;
365
{
366
const char *err;
367
ret = gnutls_priority_set_direct(*session, mc->priority, &err);
368
if (ret != GNUTLS_E_SUCCESS) {
369
fprintf(stderr, "Syntax error at: %s\n", err);
370
fprintf(stderr, "GnuTLS error: %s\n",
371
safer_gnutls_strerror(ret));
372
return -1;
373
}
333
374
}
334
375
335
if ((ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
336
mc->cred))
337
!= GNUTLS_E_SUCCESS) {
338
fprintf(stderr, "Error setting a credentials set: %s\n",
376
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
377
mc->cred);
378
if (ret != GNUTLS_E_SUCCESS) {
379
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
339
380
safer_gnutls_strerror(ret));
340
381
return -1;
341
382
}
349
390
return 0;
350
391
}
351
392
393
/* Avahi log function callback */
352
394
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
353
395
__attribute__((unused)) const char *txt){}
354
396
397
/* Called when a Mandos server is found */
355
398
static int start_mandos_communication(const char *ip, uint16_t port,
356
399
AvahiIfIndex if_index,
357
400
mandos_context *mc){
362
405
size_t buffer_length = 0;
363
406
size_t buffer_capacity = 0;
364
407
ssize_t decrypted_buffer_size;
365
size_t written = 0;
408
size_t written;
366
409
int retval = 0;
367
410
char interface[IF_NAMESIZE];
368
411
gnutls_session_t session;
369
412
gnutls_dh_params_t dh_params;
370
413
414
ret = init_gnutls_session (mc, &session);
415
if (ret != 0){
416
return -1;
417
}
418
371
419
if(debug){
372
420
fprintf(stderr, "Setting up a tcp connection to %s, port %d\n",
373
421
ip, port);
389
437
390
438
memset(&to,0,sizeof(to)); /* Spurious warning */
391
439
to.sin6_family = AF_INET6;
440
/* It would be nice to have a way to detect if we were passed an
441
IPv4 address here. Now we assume an IPv6 address. */
392
442
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
393
443
if (ret < 0 ){
394
444
perror("inet_pton");
420
470
perror("connect");
421
471
return -1;
422
472
}
423
424
ret = initgnutls (mc, &session, &dh_params);
425
if (ret != 0){
426
retval = -1;
427
return -1;
473
474
const char *out = mandos_protocol_version;
475
written = 0;
476
while (true){
477
size_t out_size = strlen(out);
478
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
479
out_size - written));
480
if (ret == -1){
481
perror("write");
482
retval = -1;
483
goto mandos_end;
484
}
485
written += (size_t)ret;
486
if(written < out_size){
487
continue;
488
} else {
489
if (out == mandos_protocol_version){
490
written = 0;
491
out = "\r\n";
492
} else {
493
break;
494
}
495
}
496
}
497
498
if(debug){
499
fprintf(stderr, "Establishing TLS session with %s\n", ip);
428
500
}
429
501
430
502
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
431
503
432
if(debug){
433
fprintf(stderr, "Establishing TLS session with %s\n", ip);
434
}
435
436
504
ret = gnutls_handshake (session);
437
505
438
506
if (ret != GNUTLS_E_SUCCESS){
439
507
if(debug){
440
fprintf(stderr, "\n*** Handshake failed ***\n");
508
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
441
509
gnutls_perror (ret);
442
510
}
443
511
retval = -1;
444
goto exit;
512
goto mandos_end;
445
513
}
446
514
447
//Retrieve OpenPGP packet that contains the wanted password
515
/* Read OpenPGP packet that contains the wanted password */
448
516
449
517
if(debug){
450
518
fprintf(stderr, "Retrieving pgp encrypted password from %s\n",
452
520
}
453
521
454
522
while(true){
455
if (buffer_length + BUFFER_SIZE > buffer_capacity){
456
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
457
if (buffer == NULL){
458
perror("realloc");
459
goto exit;
460
}
461
buffer_capacity += BUFFER_SIZE;
523
buffer_capacity = adjustbuffer(&buffer, buffer_length, buffer_capacity);
524
if (buffer_capacity == 0){
525
perror("adjustbuffer");
526
retval = -1;
527
goto mandos_end;
462
528
}
463
529
464
530
ret = gnutls_record_recv(session, buffer+buffer_length,
474
540
case GNUTLS_E_REHANDSHAKE:
475
541
ret = gnutls_handshake (session);
476
542
if (ret < 0){
477
fprintf(stderr, "\n*** Handshake failed ***\n");
543
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
478
544
gnutls_perror (ret);
479
545
retval = -1;
480
goto exit;
546
goto mandos_end;
481
547
}
482
548
break;
483
549
default:
484
550
fprintf(stderr, "Unknown error while reading data from"
485
" encrypted session with mandos server\n");
551
" encrypted session with Mandos server\n");
486
552
retval = -1;
487
553
gnutls_bye (session, GNUTLS_SHUT_RDWR);
488
goto exit;
554
goto mandos_end;
489
555
}
490
556
} else {
491
557
buffer_length += (size_t) ret;
492
558
}
493
559
}
494
560
561
if(debug){
562
fprintf(stderr, "Closing TLS session\n");
563
}
564
565
gnutls_bye (session, GNUTLS_SHUT_RDWR);
566
495
567
if (buffer_length > 0){
496
568
decrypted_buffer_size = pgp_packet_decrypt(buffer,
497
569
buffer_length,
498
570
&decrypted_buffer,
499
571
keydir);
500
572
if (decrypted_buffer_size >= 0){
573
written = 0;
501
574
while(written < (size_t) decrypted_buffer_size){
502
575
ret = (int)fwrite (decrypted_buffer + written, 1,
503
576
(size_t)decrypted_buffer_size - written,
517
590
retval = -1;
518
591
}
519
592
}
520
521
//shutdown procedure
522
523
if(debug){
524
fprintf(stderr, "Closing TLS session\n");
525
}
526
593
594
/* Shutdown procedure */
595
596
mandos_end:
527
597
free(buffer);
528
gnutls_bye (session, GNUTLS_SHUT_RDWR);
529
exit:
530
598
close(tcp_sd);
531
599
gnutls_deinit (session);
532
600
gnutls_certificate_free_credentials (mc->cred);
534
602
return retval;
535
603
}
536
604
537
static void resolve_callback( AvahiSServiceResolver *r,
538
AvahiIfIndex interface,
539
AVAHI_GCC_UNUSED AvahiProtocol protocol,
540
AvahiResolverEvent event,
541
const char *name,
542
const char *type,
543
const char *domain,
544
const char *host_name,
545
const AvahiAddress *address,
546
uint16_t port,
547
AVAHI_GCC_UNUSED AvahiStringList *txt,
548
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
549
void* userdata) {
605
static void resolve_callback(AvahiSServiceResolver *r,
606
AvahiIfIndex interface,
607
AVAHI_GCC_UNUSED AvahiProtocol protocol,
608
AvahiResolverEvent event,
609
const char *name,
610
const char *type,
611
const char *domain,
612
const char *host_name,
613
const AvahiAddress *address,
614
uint16_t port,
615
AVAHI_GCC_UNUSED AvahiStringList *txt,
616
AVAHI_GCC_UNUSED AvahiLookupResultFlags
617
flags,
618
void* userdata) {
550
619
mandos_context *mc = userdata;
551
620
assert(r); /* Spurious warning */
552
621
556
625
switch (event) {
557
626
default:
558
627
case AVAHI_RESOLVER_FAILURE:
559
fprintf(stderr, "(Resolver) Failed to resolve service '%s' of"
560
" type '%s' in domain '%s': %s\n", name, type, domain,
628
fprintf(stderr, "(Avahi Resolver) Failed to resolve service '%s'"
629
" of type '%s' in domain '%s': %s\n", name, type, domain,
561
630
avahi_strerror(avahi_server_errno(mc->server)));
562
631
break;
563
632
566
635
char ip[AVAHI_ADDRESS_STR_MAX];
567
636
avahi_address_snprint(ip, sizeof(ip), address);
568
637
if(debug){
569
fprintf(stderr, "Mandos server \"%s\" found on %s (%s) on"
570
" port %d\n", name, host_name, ip, port);
638
fprintf(stderr, "Mandos server \"%s\" found on %s (%s, %d) on"
639
" port %d\n", name, host_name, ip, interface, port);
571
640
}
572
641
int ret = start_mandos_communication(ip, port, interface, mc);
573
642
if (ret == 0){
585
654
const char *name,
586
655
const char *type,
587
656
const char *domain,
588
AVAHI_GCC_UNUSED AvahiLookupResultFlags flags,
657
AVAHI_GCC_UNUSED AvahiLookupResultFlags
658
flags,
589
659
void* userdata) {
590
660
mandos_context *mc = userdata;
591
661
assert(b); /* Spurious warning */
597
667
default:
598
668
case AVAHI_BROWSER_FAILURE:
599
669
600
fprintf(stderr, "(Browser) %s\n",
670
fprintf(stderr, "(Avahi browser) %s\n",
601
671
avahi_strerror(avahi_server_errno(mc->server)));
602
672
avahi_simple_poll_quit(mc->simple_poll);
603
673
return;
604
674
605
675
case AVAHI_BROWSER_NEW:
606
/* We ignore the returned resolver object. In the callback
607
function we free it. If the server is terminated before
608
the callback function is called the server will free
609
the resolver for us. */
676
/* We ignore the returned Avahi resolver object. In the callback
677
function we free it. If the Avahi server is terminated before
678
the callback function is called the Avahi server will free the
679
resolver for us. */
610
680
611
if (!(avahi_s_service_resolver_new(mc->server, interface, protocol, name,
612
type, domain,
681
if (!(avahi_s_service_resolver_new(mc->server, interface,
682
protocol, name, type, domain,
613
683
AVAHI_PROTO_INET6, 0,
614
684
resolve_callback, mc)))
615
fprintf(stderr, "Failed to resolve service '%s': %s\n", name,
616
avahi_strerror(avahi_server_errno(mc->server)));
685
fprintf(stderr, "Avahi: Failed to resolve service '%s': %s\n",
686
name, avahi_strerror(avahi_server_errno(mc->server)));
617
687
break;
618
688
619
689
case AVAHI_BROWSER_REMOVE:
621
691
622
692
case AVAHI_BROWSER_ALL_FOR_NOW:
623
693
case AVAHI_BROWSER_CACHE_EXHAUSTED:
694
if(debug){
695
fprintf(stderr, "No Mandos server found, still searching...\n");
696
}
624
697
break;
625
698
}
626
699
}
646
719
}
647
720
648
721
649
int main(AVAHI_GCC_UNUSED int argc, AVAHI_GCC_UNUSED char*argv[]) {
650
AvahiServerConfig config;
722
int main(int argc, char *argv[]){
651
723
AvahiSServiceBrowser *sb = NULL;
652
724
int error;
653
725
int ret;
654
int debug_int;
655
int returncode = EXIT_SUCCESS;
726
int exitcode = EXIT_SUCCESS;
656
727
const char *interface = "eth0";
657
728
struct ifreq network;
658
729
int sd;
730
uid_t uid;
731
gid_t gid;
659
732
char *connect_to = NULL;
660
733
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
661
734
mandos_context mc = { .simple_poll = NULL, .server = NULL,
662
735
.dh_bits = 1024, .priority = "SECURE256"};
663
736
664
debug_int = debug ? 1 : 0;
665
while (true){
666
struct option long_options[] = {
667
{"debug", no_argument, &debug_int, 1},
668
{"connect", required_argument, NULL, 'c'},
669
{"interface", required_argument, NULL, 'i'},
670
{"keydir", required_argument, NULL, 'd'},
671
{"seckey", required_argument, NULL, 's'},
672
{"pubkey", required_argument, NULL, 'p'},
673
{"dh-bits", required_argument, NULL, 'D'},
674
{"priority", required_argument, NULL, 'P'},
675
{0, 0, 0, 0} };
676
677
int option_index = 0;
678
ret = getopt_long (argc, argv, "i:", long_options,
679
&option_index);
680
681
if (ret == -1){
682
break;
683
}
684
685
switch(ret){
686
case 0:
687
break;
688
case 'i':
689
interface = optarg;
690
break;
691
case 'c':
692
connect_to = optarg;
693
break;
694
case 'd':
695
keydir = optarg;
696
break;
697
case 'p':
698
pubkeyfile = optarg;
699
break;
700
case 's':
701
seckeyfile = optarg;
702
break;
703
case 'D':
704
errno = 0;
705
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
706
if (errno){
707
perror("strtol");
737
{
738
/* Temporary int to get the address of for getopt_long */
739
int debug_int = debug ? 1 : 0;
740
while (true){
741
struct option long_options[] = {
742
{"debug", no_argument, &debug_int, 1},
743
{"connect", required_argument, NULL, 'c'},
744
{"interface", required_argument, NULL, 'i'},
745
{"keydir", required_argument, NULL, 'd'},
746
{"seckey", required_argument, NULL, 's'},
747
{"pubkey", required_argument, NULL, 'p'},
748
{"dh-bits", required_argument, NULL, 'D'},
749
{"priority", required_argument, NULL, 'P'},
750
{0, 0, 0, 0} };
751
752
int option_index = 0;
753
ret = getopt_long (argc, argv, "i:", long_options,
754
&option_index);
755
756
if (ret == -1){
757
break;
758
}
759
760
switch(ret){
761
case 0:
762
break;
763
case 'i':
764
interface = optarg;
765
break;
766
case 'c':
767
connect_to = optarg;
768
break;
769
case 'd':
770
keydir = optarg;
771
break;
772
case 'p':
773
pubkeyfile = optarg;
774
break;
775
case 's':
776
seckeyfile = optarg;
777
break;
778
case 'D':
779
errno = 0;
780
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
781
if (errno){
782
perror("strtol");
783
exit(EXIT_FAILURE);
784
}
785
break;
786
case 'P':
787
mc.priority = optarg;
788
break;
789
case '?':
790
default:
791
/* getopt_long() has already printed a message about the
792
unrcognized option, so just exit. */
708
793
exit(EXIT_FAILURE);
709
794
}
710
break;
711
case 'P':
712
mc.priority = optarg;
713
break;
714
case '?':
715
default:
716
exit(EXIT_FAILURE);
717
795
}
796
/* Set the global debug flag from the temporary int */
797
debug = debug_int ? true : false;
718
798
}
719
debug = debug_int ? true : false;
720
799
721
800
pubkeyfile = combinepath(keydir, pubkeyfile);
722
801
if (pubkeyfile == NULL){
723
802
perror("combinepath");
724
returncode = EXIT_FAILURE;
725
goto exit;
803
exitcode = EXIT_FAILURE;
804
goto end;
726
805
}
727
806
728
807
seckeyfile = combinepath(keydir, seckeyfile);
729
808
if (seckeyfile == NULL){
730
809
perror("combinepath");
731
goto exit;
810
goto end;
811
}
812
813
ret = init_gnutls_global(&mc);
814
if (ret == -1){
815
fprintf(stderr, "init_gnutls_global\n");
816
goto end;
817
}
818
819
uid = getuid();
820
gid = getgid();
821
822
ret = setuid(uid);
823
if (ret == -1){
824
perror("setuid");
825
}
826
827
setgid(gid);
828
if (ret == -1){
829
perror("setgid");
732
830
}
733
831
734
832
if_index = (AvahiIfIndex) if_nametoindex(interface);
743
841
char *address = strrchr(connect_to, ':');
744
842
if(address == NULL){
745
843
fprintf(stderr, "No colon in address\n");
746
exit(EXIT_FAILURE);
844
exitcode = EXIT_FAILURE;
845
goto end;
747
846
}
748
847
errno = 0;
749
848
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
750
849
if(errno){
751
850
perror("Bad port number");
752
exit(EXIT_FAILURE);
851
exitcode = EXIT_FAILURE;
852
goto end;
753
853
}
754
854
*address = '\0';
755
855
address = connect_to;
756
856
ret = start_mandos_communication(address, port, if_index, &mc);
757
857
if(ret < 0){
758
exit(EXIT_FAILURE);
858
exitcode = EXIT_FAILURE;
759
859
} else {
760
exit(EXIT_SUCCESS);
860
exitcode = EXIT_SUCCESS;
761
861
}
862
goto end;
762
863
}
763
864
764
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
765
if(sd < 0) {
766
perror("socket");
767
returncode = EXIT_FAILURE;
768
goto exit;
769
}
770
strcpy(network.ifr_name, interface); /* Spurious warning */
771
ret = ioctl(sd, SIOCGIFFLAGS, &network);
772
if(ret == -1){
773
774
perror("ioctl SIOCGIFFLAGS");
775
returncode = EXIT_FAILURE;
776
goto exit;
777
}
778
if((network.ifr_flags & IFF_UP) == 0){
779
network.ifr_flags |= IFF_UP;
780
ret = ioctl(sd, SIOCSIFFLAGS, &network);
865
/* If the interface is down, bring it up */
866
{
867
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
868
if(sd < 0) {
869
perror("socket");
870
exitcode = EXIT_FAILURE;
871
goto end;
872
}
873
strcpy(network.ifr_name, interface); /* Spurious warning */
874
ret = ioctl(sd, SIOCGIFFLAGS, &network);
781
875
if(ret == -1){
782
perror("ioctl SIOCSIFFLAGS");
783
returncode = EXIT_FAILURE;
784
goto exit;
785
}
876
perror("ioctl SIOCGIFFLAGS");
877
exitcode = EXIT_FAILURE;
878
goto end;
879
}
880
if((network.ifr_flags & IFF_UP) == 0){
881
network.ifr_flags |= IFF_UP;
882
ret = ioctl(sd, SIOCSIFFLAGS, &network);
883
if(ret == -1){
884
perror("ioctl SIOCSIFFLAGS");
885
exitcode = EXIT_FAILURE;
886
goto end;
887
}
888
}
889
close(sd);
786
890
}
787
close(sd);
788
891
789
892
if (not debug){
790
893
avahi_set_log_function(empty_log);
791
894
}
792
895
793
/* Initialize the psuedo-RNG */
896
/* Initialize the pseudo-RNG for Avahi */
794
897
srand((unsigned int) time(NULL));
795
796
/* Allocate main loop object */
797
if (!(mc.simple_poll = avahi_simple_poll_new())) {
798
fprintf(stderr, "Failed to create simple poll object.\n");
799
returncode = EXIT_FAILURE;
800
goto exit;
801
}
802
803
/* Do not publish any local records */
804
avahi_server_config_init(&config);
805
config.publish_hinfo = 0;
806
config.publish_addresses = 0;
807
config.publish_workstation = 0;
808
config.publish_domain = 0;
809
810
/* Allocate a new server */
811
mc.server=avahi_server_new(avahi_simple_poll_get(mc.simple_poll),
812
&config, NULL, NULL, &error);
813
814
/* Free the configuration data */
815
avahi_server_config_free(&config);
816
817
/* Check if creating the server object succeeded */
818
if (!mc.server) {
819
fprintf(stderr, "Failed to create server: %s\n",
898
899
/* Allocate main Avahi loop object */
900
mc.simple_poll = avahi_simple_poll_new();
901
if (mc.simple_poll == NULL) {
902
fprintf(stderr, "Avahi: Failed to create simple poll"
903
" object.\n");
904
exitcode = EXIT_FAILURE;
905
goto end;
906
}
907
908
{
909
AvahiServerConfig config;
910
/* Do not publish any local Zeroconf records */
911
avahi_server_config_init(&config);
912
config.publish_hinfo = 0;
913
config.publish_addresses = 0;
914
config.publish_workstation = 0;
915
config.publish_domain = 0;
916
917
/* Allocate a new server */
918
mc.server = avahi_server_new(avahi_simple_poll_get
919
(mc.simple_poll), &config, NULL,
920
NULL, &error);
921
922
/* Free the Avahi configuration data */
923
avahi_server_config_free(&config);
924
}
925
926
/* Check if creating the Avahi server object succeeded */
927
if (mc.server == NULL) {
928
fprintf(stderr, "Failed to create Avahi server: %s\n",
820
929
avahi_strerror(error));
821
returncode = EXIT_FAILURE;
822
goto exit;
930
exitcode = EXIT_FAILURE;
931
goto end;
823
932
}
824
933
825
/* Create the service browser */
934
/* Create the Avahi service browser */
826
935
sb = avahi_s_service_browser_new(mc.server, if_index,
827
936
AVAHI_PROTO_INET6,
828
937
"_mandos._tcp", NULL, 0,
829
938
browse_callback, &mc);
830
if (!sb) {
939
if (sb == NULL) {
831
940
fprintf(stderr, "Failed to create service browser: %s\n",
832
941
avahi_strerror(avahi_server_errno(mc.server)));
833
returncode = EXIT_FAILURE;
834
goto exit;
942
exitcode = EXIT_FAILURE;
943
goto end;
835
944
}
836
945
837
946
/* Run the main loop */
838
947
839
948
if (debug){
840
fprintf(stderr, "Starting avahi loop search\n");
949
fprintf(stderr, "Starting Avahi loop search\n");
841
950
}
842
951
843
952
avahi_simple_poll_loop(mc.simple_poll);
844
953
845
exit:
954
end:
846
955
847
956
if (debug){
848
957
fprintf(stderr, "%s exiting\n", argv[0]);
849
958
}
850
959
851
960
/* Cleanup things */
852
if (sb)
961
if (sb != NULL)
853
962
avahi_s_service_browser_free(sb);
854
963
855
if (mc.server)
964
if (mc.server != NULL)
856
965
avahi_server_free(mc.server);
857
966
858
if (mc.simple_poll)
967
if (mc.simple_poll != NULL)
859
968
avahi_simple_poll_free(mc.simple_poll);
860
969
free(pubkeyfile);
861
970
free(seckeyfile);
862
971
863
return returncode;
972
return exitcode;
864
973
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0