libnuclient.c

Go to the documentation of this file.

/*
 ** Copyright 2004-2008 - INL
 ** Written by Eric Leblond <regit@inl.fr>
 **            Vincent Deffontaines <vincent@inl.fr>
 ** INL http://www.inl.fr/
 **
 ** $Id: libnuclient.c 5267 2008-11-20 16:08:36Z pollux $
 **
 ** This program is free software; you can redistribute it and/or modify
 ** it under the terms of the GNU General Public License as published by
 ** the Free Software Foundation, version 3 of the License.
 **
 ** This program is distributed in the hope that it will be useful,
 ** but WITHOUT ANY WARRANTY; without even the implied warranty of
 ** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 ** GNU General Public License for more details.
 **
 ** You should have received a copy of the GNU General Public License
 ** along with this program; if not, write to the Free Software
 ** Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
 */

#define USE_GCRYPT_MALLOC_SECURE

#include "libnuclient.h"
#include "nuclient.h"
#include "nufw_source.h"
#include <sasl/sasl.h>
#include <sasl/saslutil.h>
#include <stdarg.h>             /* va_list, va_start, ... */
#include <langinfo.h>
#include <proto.h>
#include "security.h"
#include "sys_config.h"
#include "internal.h"
#include "tcptable.h"
#include <sys/utsname.h>

#include <nussl.h>
#include <nubase.h>


void nu_exit_clean(nuauth_session_t * session)
{
        if (session->ct) {
                tcptable_free(session->ct);
        }

        if(session->nussl)
        {
                nussl_session_destroy(session->nussl);
                session->nussl = NULL;
        }

        secure_str_free(session->username);
        secure_str_free(session->password);

        free(session);
}

void nu_client_delete(nuauth_session_t * session)
{
        ask_session_end(session);
        /* destroy session */
        nu_exit_clean(session);
}

int nu_client_global_init(nuclient_error_t * err)
{
        int ret;

        if (nussl_init() != NUSSL_OK)
        {
                SET_ERROR(err, INTERNAL_ERROR, NUSSL_INIT_ERR); /* TODO: patch nussl to handle errors correctly in nussl_sock_init */
                return 0;
        }

        /* initialize the sasl library */
        ret = sasl_client_init(NULL);
        if (ret != SASL_OK) {
                SET_ERROR(err, SASL_ERROR, ret);
                return 0;
        }
        /* get local charset */
        nu_locale_charset = nl_langinfo(CODESET);
        if (nu_locale_charset == NULL) {
                fprintf(stderr, "Can't get locale charset!\n");
                exit(EXIT_FAILURE);
        }

        load_sys_config();

        return 1;
}

void nu_client_global_deinit()
{
        sasl_done();
}

void nu_client_set_username(nuauth_session_t *session,
                            const char *username)
{
        char *utf8username = nu_client_to_utf8(username, nu_locale_charset);
        session->username = secure_str_copy(utf8username);
        free(utf8username);
}

void nu_client_set_password(nuauth_session_t *session,
                                    const char *password)
{
        char *utf8pass = nu_client_to_utf8(password, nu_locale_charset);
        session->password = secure_str_copy(utf8pass);
        free(utf8pass);
}

void nu_client_set_debug(nuauth_session_t * session, unsigned char enabled);

char *nu_get_home_dir()
{
        uid_t uid;
        struct passwd *pwd;
        char *dir = NULL;

        uid = getuid();
        if (!(pwd = getpwuid(uid))) {
                printf("Unable to get password file record\n");
                endpwent();
                return NULL;
        }
        dir = strdup(pwd->pw_dir);
        endpwent();
        return dir;
}

char *nu_get_user_name()
{
        uid_t uid;
        struct passwd *pwd;
        char *name = NULL;

        uid = getuid();
        if (!(pwd = getpwuid(uid))) {
                printf("Unable to get password file record\n");
                endpwent();
                return NULL;
        }
        name = strdup(pwd->pw_name);
        endpwent();
        return name;
}

int nu_client_set_key(nuauth_session_t* session, char* keyfile, char* certfile, nuclient_error_t* err)
{
        if (session->pem_key)
                free(session->pem_key);

        if (session->pem_cert)
                free(session->pem_cert);

        if (keyfile)
        {
                session->pem_key = strdup(keyfile);
                printf("Using key: %s\n", keyfile);
        }

        if (certfile)
        {
                session->pem_cert = strdup(certfile);
                printf("Using certificate: %s\n", certfile);
        }

        return 1;
}

int nu_client_set_ca(nuauth_session_t* session, char* cafile, nuclient_error_t* err)
{
        if (session->pem_ca)
                free(session->pem_ca);

        if (cafile)
                session->pem_ca = strdup(cafile);

        printf("Using CA: %s\n", cafile);
        return 1;
}

int nu_client_set_pkcs12(nuauth_session_t* session, char* key_file, char* key_password, nuclient_error_t* err)
{
        if (session->pkcs12_file)
                free(session->pkcs12_file);

        if (session->pkcs12_password)
                free(session->pkcs12_password);

        if (key_file)
        {
                printf("Using key: %s\n", key_file);
                session->pkcs12_file = strdup(key_file);
        }

        if (key_password)
                session->pkcs12_password = strdup(key_password);

        return 1;
}
int nu_client_load_key(nuauth_session_t * session,
                        char *keyfile, char *certfile,
                        nuclient_error_t * err)
{
        char certstring[256];
        char keystring[256];
        char *home = nu_get_home_dir();
        int exit_on_error = 0;
        int ret;

        /* If the user specified a certficate and a key on command line,
         * exit if we fail loading them.
         * Elsewise, try loading certs from ~/.nufw/, but continue if we fail
         */
        if (certfile || keyfile)
                exit_on_error = 1;

        /* compute patch keyfile */
        if (keyfile == NULL && home != NULL) {
                ret = secure_snprintf(keystring, sizeof(keystring),
                                     "%s/.nufw/key.pem", home);
                if (ret)
                        keyfile = keystring;
        }

        if (certfile == NULL && home != NULL) {
                ret = secure_snprintf(certstring, sizeof(certstring),
                                     "%s/.nufw/cert.pem", home);
                if (ret)
                        certfile = certstring;
        }

        if (certfile != NULL || keyfile != NULL) {
                ret =
                    nussl_ssl_set_keypair(session->nussl, certfile, keyfile);

                if (ret != NUSSL_OK) {
                        if (exit_on_error) {
                                if (home)
                                        free(home);
                                SET_ERROR(err, NUSSL_ERR, ret);
                                return 0;
                        }
                        else {
                                printf("Warning: Failed to load default certificate and key.\n");
                        }
                }
        }

        if (home)
                free(home);

        return 1;
}


int nu_client_load_pkcs12(nuauth_session_t * session,
                        char *pkcs12file, char *pkcs12password,
                        nuclient_error_t * err)
{
        int ret = nussl_ssl_set_pkcs12_keypair(session->nussl, pkcs12file, pkcs12password);
        if (ret != NUSSL_OK)
        {
                SET_ERROR(err, NUSSL_ERR, ret);
                return 0;
        }
        return 1;
}


int nu_client_load_ca(nuauth_session_t * session,
                        char *cafile,
                        nuclient_error_t * err)
{
        char castring[256];
        char *home = nu_get_home_dir();
        int exit_on_error = 0;
        int ret;

        if (cafile != NULL)
                exit_on_error = 1;

        if (cafile == NULL && home != NULL) {
                ret = secure_snprintf(castring, sizeof(castring),
                                     "%s/.nufw/cacert.pem", home);
                if (ret)
                        cafile = castring;
        }

        if (cafile != NULL) {
                ret = nussl_ssl_trust_cert_file(session->nussl, cafile);
                if (ret != NUSSL_OK) {
                        if (exit_on_error) {
                                if (home)
                                        free(home);
                                SET_ERROR(err, NUSSL_ERR, ret);
                                return 0;
                        }
                        else {
                                if (!session->suppress_ca_warning) {
                                        fprintf(stderr,"\nWARNING: you have not provided any certificate authority.\n"
                                                        "nutcpc will *NOT* verify server certificate trust.\n"
                                                        "Use the -A <cafile> option to set up CA.\n\n"
                                               );
                                }
                                session->suppress_fqdn_verif = 1;
                                nussl_set_session_flag(session->nussl, NUSSL_SESSFLAG_IGNORE_ID_MISMATCH, 1);
                        }
                }
        } else {
                fprintf(stderr, "Could not load any CA !\n");
                return 0;
        }
        return 1;
}

int nu_client_load_crl(nuauth_session_t *session, const char *crlfile,
        const char *cafile, nuclient_error_t * err)
{
        int ret;
        if (crlfile && *crlfile) {
                ret = nussl_ssl_set_crl_file(session->nussl, crlfile);
                if (ret != NUSSL_OK) {
                        fprintf(stderr,"TLS error with CRL: %s",
                                nussl_get_error(session->nussl));
                        return 0;
                }
                printf("Using crl: %s\n", crlfile);
        }
        return 1;
}

char* nu_client_get_cert_infos(nuauth_session_t * session)
{
        return nussl_get_cert_infos(session->nussl);
}


char* nu_client_get_server_cert_infos(nuauth_session_t * session)
{
        return nussl_get_server_cert_infos(session->nussl);
}


int nu_client_set_nuauth_cert_dn(nuauth_session_t * session,
                                char *nuauth_cert_dn,
                                nuclient_error_t *err)
{
        if (*nuauth_cert_dn) {
                session->nuauth_cert_dn = nuauth_cert_dn;
        }
        return 1;
}

int nu_client_set_crlfile(nuauth_session_t * session,
                char *crlfile,
                nuclient_error_t *err)
{
        if (session->pem_crl)
                free(session->pem_crl);

        if (crlfile)
                session->pem_crl = strdup(crlfile);

        return 1;
}

int nu_client_set_krb5_service(nuauth_session_t * session,
                                char *service)
{
        if (service) {
                session->krb5_service = service;
        }
        return 1;
}

int nu_client_set_ca_suppress_warning(nuauth_session_t * session,
                                int suppress_ca_warning)
{
        session->suppress_ca_warning = suppress_ca_warning;
        return 1;
}

int nu_client_set_fqdn_suppress_verif(nuauth_session_t * session,
                                int suppress_fqdn_verif)
{
        session->suppress_fqdn_verif = suppress_fqdn_verif;
        return 1;
}

void nu_client_set_source(nuauth_session_t *session, struct sockaddr_storage *addr)
{
        session->has_src_addr = 1;
        session->src_addr = *addr;
}

nuauth_session_t *_nu_client_new(nuclient_error_t * err)
{
        conntable_t *new;
        nuauth_session_t *session;

        /* First reset error */
        SET_ERROR(err, INTERNAL_ERROR, NO_ERR);

        /* Allocate a new session */
        session = (nuauth_session_t *) calloc(1, sizeof(nuauth_session_t));
        if (session == NULL) {
                SET_ERROR(err, INTERNAL_ERROR, MEMORY_ERR);
                return NULL;
        }

        /* Set basic fields */
        session->userid = getuid();
        session->connected = 0;
        session->auth_by_default = 1;
        session->packet_seq = 0;
        session->ct = NULL;
        session->debug_mode = 0;
        session->verbose = 1;
        session->timestamp_last_sent = time(NULL);
        session->min_sleep_delay.tv_sec = MIN_DELAY_SEC;
        session->min_sleep_delay.tv_usec = MIN_DELAY_USEC;
        session->max_sleep_delay.tv_sec = MAX_DELAY_SEC;
        session->max_sleep_delay.tv_usec = MAX_DELAY_USEC;
        session->sleep_delay.tv_sec = MIN_DELAY_SEC;
        session->sleep_delay.tv_usec = MIN_DELAY_USEC;

        if (tcptable_init(&new) == 0) {
                SET_ERROR(err, INTERNAL_ERROR, MEMORY_ERR);
                nu_exit_clean(session);
                return NULL;
        }
        session->ct = new;

        return session;
}

nuauth_session_t *nu_client_new_callback(void *username_callback,
                      void *passwd_callback,
                      unsigned char diffie_hellman, nuclient_error_t * err)
{
        nuauth_session_t *session = NULL;

        if (username_callback == NULL || passwd_callback == NULL) {
                SET_ERROR(err, INTERNAL_ERROR, BAD_CREDENTIALS_ERR);
                return NULL;
        }

        session = _nu_client_new(err);

        session->username_callback = username_callback;
        session->passwd_callback = passwd_callback;

        return session;
}

nuauth_session_t *nu_client_new(const char *username,
                      const char *password,
                      unsigned char diffie_hellman, nuclient_error_t * err)
{
        nuauth_session_t *session = NULL;

        if (username == NULL || password == NULL) {
                SET_ERROR(err, INTERNAL_ERROR, BAD_CREDENTIALS_ERR);
                return NULL;
        }

        session = _nu_client_new(err);

        session->username = secure_str_copy(username);
        session->password = secure_str_copy(password);
        if (session->username == NULL || session->password == NULL) {
                SET_ERROR(err, INTERNAL_ERROR, MEMORY_ERR);
                return NULL;
        }

        return session;
}

void nu_client_reset(nuauth_session_t * session)
{
        ask_session_end(session);

        /* reset fields */
        session->connected = 0;
        session->timestamp_last_sent = time(NULL);
}

int nu_client_connect(nuauth_session_t * session,
                      const char *hostname, const char *service,
                      nuclient_error_t * err)
{
        int ret;
        unsigned int port = atoi(service);

        session->nussl = nussl_session_create();

        if (session->suppress_fqdn_verif)
                nussl_set_session_flag(session->nussl, NUSSL_SESSFLAG_IGNORE_ID_MISMATCH, 1);

        nussl_set_hostinfo(session->nussl, hostname, port);
        if(session->pkcs12_file)
        {
                if (!nu_client_load_pkcs12(session, session->pkcs12_file, session->pkcs12_password, err))
                        return 0;
        }
        else
        {
                if (!nu_client_load_key(session, session->pem_key, session->pem_cert, err))
                        return 0;
        }

        if (!nu_client_load_ca(session, session->pem_ca, err))
                return 0;

        if (session->pem_crl) {
                if (!nu_client_load_crl(session, session->pem_crl, session->pem_ca, err))
                        return 0;
        }

        ret = nussl_open_connection(session->nussl);
        if (ret != NUSSL_OK) {
                nussl_session_destroy(session->nussl);
                session->nussl = NULL;
                SET_ERROR(err, NUSSL_ERR, ret);
                return 0;
        }

        if (!init_sasl(session, hostname, err)) {
                return 0;
        }

        if (!send_os(session, err)) {
                return 0;
        }
        session->connected = 1;
        return 1;
}

void nu_client_set_debug(nuauth_session_t * session, unsigned char enabled)
{
        session->debug_mode = enabled;
}


void nu_client_set_verbose(nuauth_session_t * session, unsigned char enabled)
{
        session->verbose = enabled;
}

void nu_client_set_min_delay(nuauth_session_t * session, unsigned int delay)
{
        session->min_sleep_delay.tv_sec = delay / 1000;
        session->min_sleep_delay.tv_usec = (delay * 1000) % 1000000;
}

void nu_client_set_max_delay(nuauth_session_t * session, unsigned int delay)
{
        session->max_sleep_delay.tv_sec = delay / 1000;
        session->max_sleep_delay.tv_usec = (delay * 1000) % 1000000;
}

int nu_client_error_init(nuclient_error_t ** err)
{
        if (*err != NULL)
                return -1;
        *err = malloc(sizeof(nuclient_error_t));
        if (*err == NULL)
                return -1;
        return 0;
}

void nu_client_error_destroy(nuclient_error_t * err)
{
        if (err != NULL)
                free(err);
}

const char *nu_client_strerror(nuauth_session_t * session, nuclient_error_t * err)
{
        if (err == NULL) {
                return "Error structure was not initialised";
        }

        switch (err->family) {
        case NUSSL_ERR:
                if(session == NULL || session->nussl == NULL)
                        return "NuSSL initialization error.";
                return nussl_get_error(session->nussl);
        case SASL_ERROR:
                return sasl_errstring(err->error, NULL, NULL);
                break;
        case INTERNAL_ERROR:
                switch (err->error) {
                case NO_ERR:
                        return "No error";
                case SESSION_NOT_CONNECTED_ERR:
                        return "Session not connected";
                case TIMEOUT_ERR:
                        return "Connection timeout";
                case DNS_RESOLUTION_ERR:
                        return "DNS resolution error";
                case NO_ADDR_ERR:
                        return "Address not recognized";
                case FILE_ACCESS_ERR:
                        return "File access error";
                case CANT_CONNECT_ERR:
                        return "Connection failed";
                case MEMORY_ERR:
                        return "No more memory";
                case TCPTABLE_ERR:
                        return "Unable to read connection table";
                case SEND_ERR:
                        return "Unable to send packet to nuauth";
                case BAD_CREDENTIALS_ERR:
                        return "Bad credentials";
                case BINDING_ERR:
                        return "Binding (source address) error";
                case NUSSL_INIT_ERR:
                        return "NuSSL initialisation failed.";
                default:
                        return "Unknown internal error code";
                }
                break;
        default:
                return "Unknown family error";
        }
}

const char *nu_get_version()
{
        return NUCLIENT_VERSION;
}

int nu_check_version(const char *version)
{
        if (strcmp(NUCLIENT_VERSION, version) == 0)
                return 1;
        else
                return 0;
}

---