To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/password-request.c
- browse files at revision 55
- compare with another revision
- download diff
- download tarball
- view history from revision 55
- Committer: Teddy Hogeborn
- Date: 2008-08-09 20:29:39 UTC
- Revision ID: teddy@fukt.bsnet.se-20080809202939-xn04n8dmrgjt9ftc
* TODO: More notes.
- files added:
- mandos-client.xml
- files removed:
- ca.pem
- files renamed:
- server.py => mandos
- plugbasedclient.c => mandos-client.c
- server.conf => mandos.conf
- plugins.d/passprompt.c => plugins.d/password-prompt.c
- plugins.d/mandosclient.c => plugins.d/password-request.c
- files modified:
- Makefile
added
removed
plugins.d/password-request.c
32
32
#define _LARGEFILE_SOURCE
33
33
#define _FILE_OFFSET_BITS 64
34
34
35
#include <stdio.h>
36
#include <assert.h>
37
#include <stdlib.h>
38
#include <time.h>
39
#include <net/if.h> /* if_nametoindex */
40
#include <sys/ioctl.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
41
SIOCSIFFLAGS */
35
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY() */
36
37
#include <stdio.h> /* fprintf(), stderr, fwrite(), stdout,
38
ferror() */
39
#include <stdint.h> /* uint16_t, uint32_t */
40
#include <stddef.h> /* NULL, size_t, ssize_t */
41
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
42
srand() */
43
#include <stdbool.h> /* bool, true */
44
#include <string.h> /* memset(), strcmp(), strlen(),
45
strerror(), memcpy(), strcpy() */
46
#include <sys/ioctl.h> /* ioctl */
47
#include <net/if.h> /* ifreq, SIOCGIFFLAGS, SIOCSIFFLAGS,
48
IFF_UP */
49
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, INET6_ADDRSTRLEN,
52
uid_t, gid_t */
53
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
54
struct in6_addr, inet_pton(),
55
connect() */
56
#include <assert.h> /* assert() */
57
#include <errno.h> /* perror(), errno */
58
#include <time.h> /* time() */
42
59
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
43
SIOCSIFFLAGS */
60
SIOCSIFFLAGS, if_indextoname(),
61
if_nametoindex(), IF_NAMESIZE */
62
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
63
getuid(), getgid(), setuid(),
64
setgid() */
65
#include <netinet/in.h>
66
#include <arpa/inet.h> /* inet_pton(), htons */
67
#include <iso646.h> /* not, and */
68
#include <argp.h> /* struct argp_option, error_t, struct
69
argp_state, struct argp,
70
argp_parse(), ARGP_KEY_ARG,
71
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
44
72
73
/* Avahi */
74
/* All Avahi types, constants and functions
75
Avahi*, avahi_*,
76
AVAHI_* */
45
77
#include <avahi-core/core.h>
46
78
#include <avahi-core/lookup.h>
47
79
#include <avahi-core/log.h>
49
81
#include <avahi-common/malloc.h>
50
82
#include <avahi-common/error.h>
51
83
52
/* Mandos client part */
53
#include <sys/types.h> /* socket(), inet_pton() */
54
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
55
struct in6_addr, inet_pton() */
56
#include <gnutls/gnutls.h> /* All GnuTLS stuff */
57
#include <gnutls/openpgp.h> /* GnuTLS with openpgp stuff */
58
59
#include <unistd.h> /* close() */
60
#include <netinet/in.h>
61
#include <stdbool.h> /* true */
62
#include <string.h> /* memset */
63
#include <arpa/inet.h> /* inet_pton() */
64
#include <iso646.h> /* not */
65
#include <net/if.h> /* IF_NAMESIZE */
84
/* GnuTLS */
85
#include <gnutls/gnutls.h> /* All GnuTLS types, constants and functions
86
gnutls_*
87
init_gnutls_session(),
88
GNUTLS_* */
89
#include <gnutls/openpgp.h> /* gnutls_certificate_set_openpgp_key_file(),
90
GNUTLS_OPENPGP_FMT_BASE64 */
66
91
67
92
/* GPGME */
68
#include <errno.h> /* perror() */
69
#include <gpgme.h>
70
71
/* getopt_long */
72
#include <getopt.h>
93
#include <gpgme.h> /* All GPGME types, constants and functions
94
gpgme_*
95
GPGME_PROTOCOL_OpenPGP,
96
GPG_ERR_NO_* */
73
97
74
98
#define BUFFER_SIZE 256
75
99
100
bool debug = false;
76
101
static const char *keydir = "/conf/conf.d/mandos";
77
static const char *pubkeyfile = "pubkey.txt";
78
static const char *seckeyfile = "seckey.txt";
79
80
bool debug = false;
81
82
/* Used for passing in values through all the callback functions */
102
static const char mandos_protocol_version[] = "1";
103
const char *argp_program_version = "mandosclient 0.9";
104
const char *argp_program_bug_address = "<mandos@fukt.bsnet.se>";
105
106
/* Used for passing in values through the Avahi callback functions */
83
107
typedef struct {
84
108
AvahiSimplePoll *simple_poll;
85
109
AvahiServer *server;
86
110
gnutls_certificate_credentials_t cred;
87
111
unsigned int dh_bits;
112
gnutls_dh_params_t dh_params;
88
113
const char *priority;
89
114
} mandos_context;
90
115
116
/*
117
* Make room in "buffer" for at least BUFFER_SIZE additional bytes.
118
* "buffer_capacity" is how much is currently allocated,
119
* "buffer_length" is how much is already used.
120
*/
121
size_t adjustbuffer(char **buffer, size_t buffer_length,
122
size_t buffer_capacity){
123
if (buffer_length + BUFFER_SIZE > buffer_capacity){
124
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
125
if (buffer == NULL){
126
return 0;
127
}
128
buffer_capacity += BUFFER_SIZE;
129
}
130
return buffer_capacity;
131
}
132
91
133
/*
92
134
* Decrypt OpenPGP data using keyrings in HOMEDIR.
93
135
* Returns -1 on error
216
258
217
259
*plaintext = NULL;
218
260
while(true){
219
if (plaintext_length + BUFFER_SIZE
220
> (ssize_t) plaintext_capacity){
221
*plaintext = realloc(*plaintext, plaintext_capacity
222
+ BUFFER_SIZE);
223
if (*plaintext == NULL){
224
perror("realloc");
261
plaintext_capacity = adjustbuffer(plaintext,
262
(size_t)plaintext_length,
263
plaintext_capacity);
264
if (plaintext_capacity == 0){
265
perror("adjustbuffer");
225
266
plaintext_length = -1;
226
267
goto decrypt_end;
227
}
228
plaintext_capacity += BUFFER_SIZE;
229
268
}
230
269
231
270
ret = gpgme_data_read(dh_plain, *plaintext + plaintext_length,
274
313
fprintf(stderr, "GnuTLS: %s", string);
275
314
}
276
315
277
static int initgnutls(mandos_context *mc, gnutls_session_t *session,
278
gnutls_dh_params_t *dh_params){
316
static int init_gnutls_global(mandos_context *mc,
317
const char *pubkeyfile,
318
const char *seckeyfile){
279
319
int ret;
280
320
281
321
if(debug){
282
322
fprintf(stderr, "Initializing GnuTLS\n");
283
323
}
284
285
if ((ret = gnutls_global_init ())
286
!= GNUTLS_E_SUCCESS) {
324
325
ret = gnutls_global_init();
326
if (ret != GNUTLS_E_SUCCESS) {
287
327
fprintf (stderr, "GnuTLS global_init: %s\n",
288
328
safer_gnutls_strerror(ret));
289
329
return -1;
298
338
}
299
339
300
340
/* OpenPGP credentials */
301
if ((ret = gnutls_certificate_allocate_credentials (&mc->cred))
302
!= GNUTLS_E_SUCCESS) {
341
gnutls_certificate_allocate_credentials(&mc->cred);
342
if (ret != GNUTLS_E_SUCCESS){
303
343
fprintf (stderr, "GnuTLS memory error: %s\n",
304
344
safer_gnutls_strerror(ret));
345
gnutls_global_deinit ();
305
346
return -1;
306
347
}
307
348
319
360
" '%s')\n", ret, pubkeyfile, seckeyfile);
320
361
fprintf(stdout, "The GnuTLS error is: %s\n",
321
362
safer_gnutls_strerror(ret));
322
return -1;
363
goto globalfail;
323
364
}
324
365
325
366
/* GnuTLS server initialization */
326
ret = gnutls_dh_params_init(dh_params);
367
ret = gnutls_dh_params_init(&mc->dh_params);
327
368
if (ret != GNUTLS_E_SUCCESS) {
328
369
fprintf (stderr, "Error in GnuTLS DH parameter initialization:"
329
370
" %s\n", safer_gnutls_strerror(ret));
330
return -1;
371
goto globalfail;
331
372
}
332
ret = gnutls_dh_params_generate2(*dh_params, mc->dh_bits);
373
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
333
374
if (ret != GNUTLS_E_SUCCESS) {
334
375
fprintf (stderr, "Error in GnuTLS prime generation: %s\n",
335
376
safer_gnutls_strerror(ret));
336
return -1;
377
goto globalfail;
337
378
}
338
379
339
gnutls_certificate_set_dh_params(mc->cred, *dh_params);
340
380
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
381
382
return 0;
383
384
globalfail:
385
386
gnutls_certificate_free_credentials(mc->cred);
387
gnutls_global_deinit();
388
return -1;
389
390
}
391
392
static int init_gnutls_session(mandos_context *mc,
393
gnutls_session_t *session){
394
int ret;
341
395
/* GnuTLS session creation */
342
396
ret = gnutls_init(session, GNUTLS_SERVER);
343
397
if (ret != GNUTLS_E_SUCCESS){
352
406
fprintf(stderr, "Syntax error at: %s\n", err);
353
407
fprintf(stderr, "GnuTLS error: %s\n",
354
408
safer_gnutls_strerror(ret));
409
gnutls_deinit (*session);
355
410
return -1;
356
411
}
357
412
}
361
416
if (ret != GNUTLS_E_SUCCESS) {
362
417
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
363
418
safer_gnutls_strerror(ret));
419
gnutls_deinit (*session);
364
420
return -1;
365
421
}
366
422
382
438
AvahiIfIndex if_index,
383
439
mandos_context *mc){
384
440
int ret, tcp_sd;
385
struct sockaddr_in6 to;
441
union { struct sockaddr in; struct sockaddr_in6 in6; } to;
386
442
char *buffer = NULL;
387
443
char *decrypted_buffer;
388
444
size_t buffer_length = 0;
389
445
size_t buffer_capacity = 0;
390
446
ssize_t decrypted_buffer_size;
391
size_t written = 0;
447
size_t written;
392
448
int retval = 0;
393
449
char interface[IF_NAMESIZE];
394
450
gnutls_session_t session;
395
gnutls_dh_params_t dh_params;
396
451
397
ret = initgnutls (mc, &session, &dh_params);
452
ret = init_gnutls_session (mc, &session);
398
453
if (ret != 0){
399
454
return -1;
400
455
}
419
474
}
420
475
421
476
memset(&to,0,sizeof(to)); /* Spurious warning */
422
to.sin6_family = AF_INET6;
477
to.in6.sin6_family = AF_INET6;
423
478
/* It would be nice to have a way to detect if we were passed an
424
479
IPv4 address here. Now we assume an IPv6 address. */
425
ret = inet_pton(AF_INET6, ip, &to.sin6_addr);
480
ret = inet_pton(AF_INET6, ip, &to.in6.sin6_addr);
426
481
if (ret < 0 ){
427
482
perror("inet_pton");
428
483
return -1;
431
486
fprintf(stderr, "Bad address: %s\n", ip);
432
487
return -1;
433
488
}
434
to.sin6_port = htons(port); /* Spurious warning */
489
to.in6.sin6_port = htons(port); /* Spurious warning */
435
490
436
to.sin6_scope_id = (uint32_t)if_index;
491
to.in6.sin6_scope_id = (uint32_t)if_index;
437
492
438
493
if(debug){
439
494
fprintf(stderr, "Connection to: %s, port %d\n", ip, port);
440
495
char addrstr[INET6_ADDRSTRLEN] = "";
441
if(inet_ntop(to.sin6_family, &(to.sin6_addr), addrstr,
496
if(inet_ntop(to.in6.sin6_family, &(to.in6.sin6_addr), addrstr,
442
497
sizeof(addrstr)) == NULL){
443
498
perror("inet_ntop");
444
499
} else {
448
503
}
449
504
}
450
505
451
ret = connect(tcp_sd, (struct sockaddr *) &to, sizeof(to));
506
ret = connect(tcp_sd, &to.in, sizeof(to));
452
507
if (ret < 0){
453
508
perror("connect");
454
509
return -1;
455
510
}
456
511
512
const char *out = mandos_protocol_version;
513
written = 0;
514
while (true){
515
size_t out_size = strlen(out);
516
ret = TEMP_FAILURE_RETRY(write(tcp_sd, out + written,
517
out_size - written));
518
if (ret == -1){
519
perror("write");
520
retval = -1;
521
goto mandos_end;
522
}
523
written += (size_t)ret;
524
if(written < out_size){
525
continue;
526
} else {
527
if (out == mandos_protocol_version){
528
written = 0;
529
out = "\r\n";
530
} else {
531
break;
532
}
533
}
534
}
535
457
536
if(debug){
458
537
fprintf(stderr, "Establishing TLS session with %s\n", ip);
459
538
}
460
539
461
540
gnutls_transport_set_ptr (session, (gnutls_transport_ptr_t) tcp_sd);
462
463
ret = gnutls_handshake (session);
541
542
do{
543
ret = gnutls_handshake (session);
544
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
464
545
465
546
if (ret != GNUTLS_E_SUCCESS){
466
547
if(debug){
479
560
}
480
561
481
562
while(true){
482
if (buffer_length + BUFFER_SIZE > buffer_capacity){
483
buffer = realloc(buffer, buffer_capacity + BUFFER_SIZE);
484
if (buffer == NULL){
485
perror("realloc");
486
retval = -1;
487
goto mandos_end;
488
}
489
buffer_capacity += BUFFER_SIZE;
563
buffer_capacity = adjustbuffer(&buffer, buffer_length,
564
buffer_capacity);
565
if (buffer_capacity == 0){
566
perror("adjustbuffer");
567
retval = -1;
568
goto mandos_end;
490
569
}
491
570
492
571
ret = gnutls_record_recv(session, buffer+buffer_length,
500
579
case GNUTLS_E_AGAIN:
501
580
break;
502
581
case GNUTLS_E_REHANDSHAKE:
503
ret = gnutls_handshake (session);
582
do{
583
ret = gnutls_handshake (session);
584
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
504
585
if (ret < 0){
505
586
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
506
587
gnutls_perror (ret);
532
613
&decrypted_buffer,
533
614
keydir);
534
615
if (decrypted_buffer_size >= 0){
616
written = 0;
535
617
while(written < (size_t) decrypted_buffer_size){
536
618
ret = (int)fwrite (decrypted_buffer + written, 1,
537
619
(size_t)decrypted_buffer_size - written,
558
640
free(buffer);
559
641
close(tcp_sd);
560
642
gnutls_deinit (session);
561
gnutls_certificate_free_credentials (mc->cred);
562
gnutls_global_deinit ();
563
643
return retval;
564
644
}
565
645
688
768
const char *interface = "eth0";
689
769
struct ifreq network;
690
770
int sd;
771
uid_t uid;
772
gid_t gid;
691
773
char *connect_to = NULL;
692
774
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
775
const char *pubkeyfile = "pubkey.txt";
776
const char *seckeyfile = "seckey.txt";
693
777
mandos_context mc = { .simple_poll = NULL, .server = NULL,
694
778
.dh_bits = 1024, .priority = "SECURE256"};
779
bool gnutls_initalized = false;
695
780
696
781
{
697
/* Temporary int to get the address of for getopt_long */
698
int debug_int = debug ? 1 : 0;
699
while (true){
700
struct option long_options[] = {
701
{"debug", no_argument, &debug_int, 1},
702
{"connect", required_argument, NULL, 'c'},
703
{"interface", required_argument, NULL, 'i'},
704
{"keydir", required_argument, NULL, 'd'},
705
{"seckey", required_argument, NULL, 's'},
706
{"pubkey", required_argument, NULL, 'p'},
707
{"dh-bits", required_argument, NULL, 'D'},
708
{"priority", required_argument, NULL, 'P'},
709
{0, 0, 0, 0} };
710
711
int option_index = 0;
712
ret = getopt_long (argc, argv, "i:", long_options,
713
&option_index);
714
715
if (ret == -1){
782
struct argp_option options[] = {
783
{ .name = "debug", .key = 128,
784
.doc = "Debug mode", .group = 3 },
785
{ .name = "connect", .key = 'c',
786
.arg = "IP",
787
.doc = "Connect directly to a sepcified mandos server",
788
.group = 1 },
789
{ .name = "interface", .key = 'i',
790
.arg = "INTERFACE",
791
.doc = "Interface that Avahi will conntect through",
792
.group = 1 },
793
{ .name = "keydir", .key = 'd',
794
.arg = "KEYDIR",
795
.doc = "Directory where the openpgp keyring is",
796
.group = 1 },
797
{ .name = "seckey", .key = 's',
798
.arg = "SECKEY",
799
.doc = "Secret openpgp key for gnutls authentication",
800
.group = 1 },
801
{ .name = "pubkey", .key = 'p',
802
.arg = "PUBKEY",
803
.doc = "Public openpgp key for gnutls authentication",
804
.group = 2 },
805
{ .name = "dh-bits", .key = 129,
806
.arg = "BITS",
807
.doc = "dh-bits to use in gnutls communication",
808
.group = 2 },
809
{ .name = "priority", .key = 130,
810
.arg = "PRIORITY",
811
.doc = "GNUTLS priority", .group = 1 },
812
{ .name = NULL }
813
};
814
815
816
error_t parse_opt (int key, char *arg,
817
struct argp_state *state) {
818
/* Get the INPUT argument from `argp_parse', which we know is
819
a pointer to our plugin list pointer. */
820
switch (key) {
821
case 128:
822
debug = true;
716
823
break;
717
}
718
719
switch(ret){
720
case 0:
824
case 'c':
825
connect_to = arg;
721
826
break;
722
827
case 'i':
723
interface = optarg;
724
break;
725
case 'c':
726
connect_to = optarg;
828
interface = arg;
727
829
break;
728
830
case 'd':
729
keydir = optarg;
831
keydir = arg;
832
break;
833
case 's':
834
seckeyfile = arg;
730
835
break;
731
836
case 'p':
732
pubkeyfile = optarg;
733
break;
734
case 's':
735
seckeyfile = optarg;
736
break;
737
case 'D':
837
pubkeyfile = arg;
838
break;
839
case 129:
738
840
errno = 0;
739
mc.dh_bits = (unsigned int) strtol(optarg, NULL, 10);
841
mc.dh_bits = (unsigned int) strtol(arg, NULL, 10);
740
842
if (errno){
741
843
perror("strtol");
742
844
exit(EXIT_FAILURE);
743
845
}
744
846
break;
745
case 'P':
746
mc.priority = optarg;
747
break;
748
case '?':
847
case 130:
848
mc.priority = arg;
849
break;
850
case ARGP_KEY_ARG:
851
argp_usage (state);
852
break;
853
case ARGP_KEY_END:
854
break;
749
855
default:
750
/* getopt_long() has already printed a message about the
751
unrcognized option, so just exit. */
752
exit(EXIT_FAILURE);
856
return ARGP_ERR_UNKNOWN;
753
857
}
754
}
755
/* Set the global debug flag from the temporary int */
756
debug = debug_int ? true : false;
858
return 0;
859
}
860
861
struct argp argp = { .options = options, .parser = parse_opt,
862
.args_doc = "",
863
.doc = "Mandos client -- Get and decrypt"
864
" passwords from mandos server" };
865
ret = argp_parse (&argp, argc, argv, 0, 0, NULL);
866
if (ret == ARGP_ERR_UNKNOWN){
867
fprintf(stderr, "Unkown error while parsing arguments\n");
868
exitcode = EXIT_FAILURE;
869
goto end;
870
}
757
871
}
758
872
759
873
pubkeyfile = combinepath(keydir, pubkeyfile);
760
874
if (pubkeyfile == NULL){
761
875
perror("combinepath");
768
882
perror("combinepath");
769
883
goto end;
770
884
}
885
886
ret = init_gnutls_global(&mc, pubkeyfile, seckeyfile);
887
if (ret == -1){
888
fprintf(stderr, "init_gnutls_global\n");
889
goto end;
890
} else {
891
gnutls_initalized = true;
892
}
893
894
uid = getuid();
895
gid = getgid();
896
897
ret = setuid(uid);
898
if (ret == -1){
899
perror("setuid");
900
}
901
902
setgid(gid);
903
if (ret == -1){
904
perror("setgid");
905
}
771
906
772
907
if_index = (AvahiIfIndex) if_nametoindex(interface);
773
908
if(if_index == 0){
781
916
char *address = strrchr(connect_to, ':');
782
917
if(address == NULL){
783
918
fprintf(stderr, "No colon in address\n");
784
exit(EXIT_FAILURE);
919
exitcode = EXIT_FAILURE;
920
goto end;
785
921
}
786
922
errno = 0;
787
923
uint16_t port = (uint16_t) strtol(address+1, NULL, 10);
788
924
if(errno){
789
925
perror("Bad port number");
790
exit(EXIT_FAILURE);
926
exitcode = EXIT_FAILURE;
927
goto end;
791
928
}
792
929
*address = '\0';
793
930
address = connect_to;
794
931
ret = start_mandos_communication(address, port, if_index, &mc);
795
932
if(ret < 0){
796
exit(EXIT_FAILURE);
933
exitcode = EXIT_FAILURE;
797
934
} else {
798
exit(EXIT_SUCCESS);
935
exitcode = EXIT_SUCCESS;
799
936
}
937
goto end;
800
938
}
801
939
802
940
/* If the interface is down, bring it up */
905
1043
avahi_simple_poll_free(mc.simple_poll);
906
1044
free(pubkeyfile);
907
1045
free(seckeyfile);
1046
1047
if (gnutls_initalized){
1048
gnutls_certificate_free_credentials(mc.cred);
1049
gnutls_global_deinit ();
1050
}
908
1051
909
1052
return exitcode;
910
1053
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0