src/pt-tls-client/pt-tls-client.c

   1 /*
   2  * Copyright (C) 2010-2013 Martin Willi, revosec AG
   3  * Copyright (C) 2013 Andreas Steffen, HSR Hochschule für Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include <unistd.h>
  17 #include <stdio.h>
  18 #include <sys/types.h>
  19 #include <sys/socket.h>
  20 #include <getopt.h>
  21 #include <errno.h>
  22 #include <string.h>
  23
  24 #include <library.h>
  25 #include <utils/debug.h>
  26 #include <pt_tls.h>
  27 #include <pt_tls_client.h>
  28 #include <tnc/tnc.h>
  29 #include <tls.h>
  30
  31 #include <credentials/sets/mem_cred.h>
  32
  33 /**
  34  * Print usage information
  35  */
  36 static void usage(FILE *out, char *cmd)
  37 {
  38         fprintf(out, "usage:\n");
  39         fprintf(out, "  %s --connect <address> [--port <port>] [--cert <file>]+\n", cmd);
  40         fprintf(out, "               [--client <client-id>] [--secret <password>]\n");
  41 }
  42
  43 /**
  44  * Client routine
  45  */
  46 static int client(char *address, u_int16_t port, char *identity)
  47 {
  48         pt_tls_client_t *assessment;
  49         tls_t *tnccs;
  50         identification_t *server, *client;
  51         host_t *host;
  52         status_t status;
  53
  54         host = host_create_from_dns(address, AF_UNSPEC, port);
  55         if (!host)
  56         {
  57                 return 1;
  58         }
  59         server = identification_create_from_string(address);
  60         client = identification_create_from_string(identity);
  61         tnccs = (tls_t*)tnc->tnccs->create_instance(tnc->tnccs, TNCCS_2_0, FALSE,
  62                                                                                                 server, client, TNC_IFT_TLS_2_0);
  63         if (!tnccs)
  64         {
  65                 fprintf(stderr, "loading TNCCS failed: %s\n", PLUGINS);
  66                 host->destroy(host);
  67                 server->destroy(server);
  68                 client->destroy(client);
  69                 return 1;
  70         }
  71         assessment = pt_tls_client_create(host, server, client);
  72         status = assessment->run_assessment(assessment, (tnccs_t*)tnccs);
  73         assessment->destroy(assessment);
  74         tnccs->destroy(tnccs);
  75         return status;
  76 }
  77
  78
  79 /**
  80  * In-Memory credential set
  81  */
  82 static mem_cred_t *creds;
  83
  84 /**
  85  * Load certificate from file
  86  */
  87 static bool load_certificate(char *filename)
  88 {
  89         certificate_t *cert;
  90
  91         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
  92                                                           BUILD_FROM_FILE, filename, BUILD_END);
  93         if (!cert)
  94         {
  95                 DBG1(DBG_TLS, "loading certificate from '%s' failed", filename);
  96                 return FALSE;
  97         }
  98         creds->add_cert(creds, TRUE, cert);
  99         return TRUE;
 100 }
 101
 102 /**
 103  * Load private key from file
 104  */
 105 static bool load_key(char *filename)
 106 {
 107         private_key_t *key;
 108
 109         key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
 110                                                          BUILD_FROM_FILE, filename, BUILD_END);
 111         if (!key)
 112         {
 113                 DBG1(DBG_TLS, "loading key from '%s' failed", filename);
 114                 return FALSE;
 115         }
 116         creds->add_key(creds, key);
 117         return TRUE;
 118 }
 119
 120 /**
 121  * Debug level
 122  */
 123 static level_t pt_tls_level = 2;
 124
 125 static void dbg_pt_tls(debug_t group, level_t level, char *fmt, ...)
 126 {
 127         if (level <= pt_tls_level)
 128         {
 129                 va_list args;
 130
 131                 va_start(args, fmt);
 132                 vfprintf(stderr, fmt, args);
 133                 fprintf(stderr, "\n");
 134                 va_end(args);
 135         }
 136 }
 137
 138 /**
 139  * Cleanup
 140  */
 141 static void cleanup()
 142 {
 143         lib->processor->cancel(lib->processor);
 144         lib->credmgr->remove_set(lib->credmgr, &creds->set);
 145         creds->destroy(creds);
 146         libtnccs_deinit();
 147         library_deinit();
 148 }
 149
 150 /**
 151  * Initialize library
 152  */
 153 static void init()
 154 {
 155         library_init(NULL);
 156         libtnccs_init();
 157
 158         dbg = dbg_pt_tls;
 159
 160         if (!lib->plugins->load(lib->plugins,
 161                         lib->settings->get_str(lib->settings, "pt-tls-client.load", PLUGINS)))
 162         {
 163                 exit(SS_RC_INITIALIZATION_FAILED);
 164         }
 165
 166         creds = mem_cred_create();
 167         lib->credmgr->add_set(lib->credmgr, &creds->set);
 168
 169         atexit(cleanup);
 170 }
 171
 172 int main(int argc, char *argv[])
 173 {
 174         char *address = NULL, *identity = "%any", *secret = NULL;
 175         int port = PT_TLS_PORT;
 176
 177         init();
 178
 179         while (TRUE)
 180         {
 181                 struct option long_opts[] = {
 182                         {"help",                no_argument,                    NULL,           'h' },
 183                         {"connect",             required_argument,              NULL,           'c' },
 184                         {"client",              required_argument,              NULL,           'i' },
 185                         {"secret",              required_argument,              NULL,           's' },
 186                         {"port",                required_argument,              NULL,           'p' },
 187                         {"cert",                required_argument,              NULL,           'x' },
 188                         {"key",                 required_argument,              NULL,           'k' },
 189                         {"debug",               required_argument,              NULL,           'd' },
 190                         {0,0,0,0 }
 191                 };
 192                 switch (getopt_long(argc, argv, "", long_opts, NULL))
 193                 {
 194                         case EOF:
 195                                 break;
 196                         case 'h':
 197                                 usage(stdout, argv[0]);
 198                                 return 0;
 199                         case 'x':
 200                                 if (!load_certificate(optarg))
 201                                 {
 202                                         return 1;
 203                                 }
 204                                 continue;
 205                         case 'k':
 206                                 if (!load_key(optarg))
 207                                 {
 208                                         return 1;
 209                                 }
 210                                 continue;
 211                         case 'c':
 212                                 if (address)
 213                                 {
 214                                         usage(stderr, argv[0]);
 215                                         return 1;
 216                                 }
 217                                 address = optarg;
 218                                 continue;
 219                         case 'i':
 220                                 identity = optarg;
 221                                 continue;
 222                         case 's':
 223                                 secret = optarg;
 224                                 continue;
 225                         case 'p':
 226                                 port = atoi(optarg);
 227                                 continue;
 228                         case 'd':
 229                                 pt_tls_level = atoi(optarg);
 230                                 continue;
 231                         default:
 232                                 usage(stderr, argv[0]);
 233                                 return 1;
 234                 }
 235                 break;
 236         }
 237         if (!address)
 238         {
 239                 usage(stderr, argv[0]);
 240                 return 1;
 241         }
 242         if (secret)
 243         {
 244                 creds->add_shared(creds, shared_key_create(SHARED_EAP,
 245                                                                                 chunk_clone(chunk_from_str(secret))),
 246                                                         identification_create_from_string(identity), NULL);
 247         }
 248
 249         return client(address, port, identity);
 250 }