src/pt-tls-client/pt-tls-client.c

   1 /*
   2  * Copyright (C) 2010-2013 Martin Willi, revosec AG
   3  * Copyright (C) 2013-2014 Andreas Steffen
   4  * HSR Hochschule für Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <unistd.h>
  18 #include <stdio.h>
  19 #include <sys/types.h>
  20 #include <getopt.h>
  21 #include <errno.h>
  22 #include <string.h>
  23 #include <stdlib.h>
  24 #ifdef HAVE_SYSLOG
  25 #include <syslog.h>
  26 #endif
  27
  28 #include <pt_tls.h>
  29 #include <pt_tls_client.h>
  30 #include <tnc/tnc.h>
  31 #include <tls.h>
  32
  33 #include <library.h>
  34 #include <utils/debug.h>
  35 #include <credentials/sets/mem_cred.h>
  36 #include <utils/optionsfrom.h>
  37
  38 /**
  39  * Print usage information
  40  */
  41 static void usage(FILE *out)
  42 {
  43         fprintf(out,
  44                 "Usage: pt-tls  --connect <hostname|address> [--port <port>]\n"
  45                 "              [--cert <file>]+ [--key <file>]\n"
  46                 "              [--client <client-id>] [--secret <password>]\n"
  47                 "              [--optionsfrom <filename>] [--quiet] [--debug <level>]\n");
  48 }
  49
  50 /**
  51  * Client routine
  52  */
  53 static int client(char *address, u_int16_t port, char *identity)
  54 {
  55         pt_tls_client_t *assessment;
  56         tls_t *tnccs;
  57         identification_t *server, *client;
  58         host_t *host;
  59         status_t status;
  60
  61         host = host_create_from_dns(address, AF_UNSPEC, port);
  62         if (!host)
  63         {
  64                 return 1;
  65         }
  66         server = identification_create_from_string(address);
  67         client = identification_create_from_string(identity);
  68         tnccs = (tls_t*)tnc->tnccs->create_instance(tnc->tnccs, TNCCS_2_0, FALSE,
  69                                                                 server, client, TNC_IFT_TLS_2_0, NULL);
  70         if (!tnccs)
  71         {
  72                 fprintf(stderr, "loading TNCCS failed: %s\n", PLUGINS);
  73                 host->destroy(host);
  74                 server->destroy(server);
  75                 client->destroy(client);
  76                 return 1;
  77         }
  78         assessment = pt_tls_client_create(host, server, client);
  79         status = assessment->run_assessment(assessment, (tnccs_t*)tnccs);
  80         assessment->destroy(assessment);
  81         tnccs->destroy(tnccs);
  82         return status;
  83 }
  84
  85
  86 /**
  87  * In-Memory credential set
  88  */
  89 static mem_cred_t *creds;
  90
  91 /**
  92  * Load certificate from file
  93  */
  94 static bool load_certificate(char *filename)
  95 {
  96         certificate_t *cert;
  97
  98         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
  99                                                           BUILD_FROM_FILE, filename, BUILD_END);
 100         if (!cert)
 101         {
 102                 DBG1(DBG_TLS, "loading certificate from '%s' failed", filename);
 103                 return FALSE;
 104         }
 105         creds->add_cert(creds, TRUE, cert);
 106         return TRUE;
 107 }
 108
 109 /**
 110  * Load private key from file
 111  */
 112 static bool load_key(char *filename)
 113 {
 114         private_key_t *key;
 115
 116         key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, KEY_RSA,
 117                                                          BUILD_FROM_FILE, filename, BUILD_END);
 118         if (!key)
 119         {
 120                 DBG1(DBG_TLS, "loading key from '%s' failed", filename);
 121                 return FALSE;
 122         }
 123         creds->add_key(creds, key);
 124         return TRUE;
 125 }
 126
 127 /**
 128  * Logging and debug level
 129  */
 130 static bool log_to_stderr = TRUE;
 131 #ifdef HAVE_SYSLOG
 132 static bool log_to_syslog = TRUE;
 133 #endif /* HAVE_SYSLOG */
 134 static level_t default_loglevel = 1;
 135
 136 static void dbg_pt_tls(debug_t group, level_t level, char *fmt, ...)
 137 {
 138         va_list args;
 139
 140         if (level <= default_loglevel)
 141         {
 142                 if (log_to_stderr)
 143                 {
 144                         va_start(args, fmt);
 145                         vfprintf(stderr, fmt, args);
 146                         va_end(args);
 147                         fprintf(stderr, "\n");
 148                 }
 149 #ifdef HAVE_SYSLOG
 150                 if (log_to_syslog)
 151                 {
 152                         char buffer[8192];
 153                         char *current = buffer, *next;
 154
 155                         /* write in memory buffer first */
 156                         va_start(args, fmt);
 157                         vsnprintf(buffer, sizeof(buffer), fmt, args);
 158                         va_end(args);
 159
 160                         /* do a syslog with every line */
 161                         while (current)
 162                         {
 163                                 next = strchr(current, '\n');
 164                                 if (next)
 165                                 {
 166                                         *(next++) = '\0';
 167                                 }
 168                                 syslog(LOG_INFO, "%s\n", current);
 169                                 current = next;
 170                         }
 171                 }
 172 #endif /* HAVE_SYSLOG */
 173         }
 174 }
 175
 176 /**
 177  * Initialize logging to stderr/syslog
 178  */
 179 static void init_log(const char *program)
 180 {
 181         dbg = dbg_pt_tls;
 182
 183         if (log_to_stderr)
 184         {
 185                 setbuf(stderr, NULL);
 186         }
 187 #ifdef HAVE_SYSLOG
 188         if (log_to_syslog)
 189         {
 190                 openlog(program, LOG_CONS | LOG_NDELAY | LOG_PID, LOG_AUTHPRIV);
 191         }
 192 #endif /* HAVE_SYSLOG */
 193 }
 194
 195 /**
 196  * Handles --optionsfrom arguments
 197  */
 198 options_t *options;
 199
 200 /**
 201  * Cleanup
 202  */
 203 static void cleanup()
 204 {
 205         lib->processor->cancel(lib->processor);
 206         lib->credmgr->remove_set(lib->credmgr, &creds->set);
 207         creds->destroy(creds);
 208         options->destroy(options);
 209         libtnccs_deinit();
 210         library_deinit();
 211 }
 212
 213 /**
 214  * Initialize library
 215  */
 216 static void init()
 217 {
 218         plugin_feature_t features[] = {
 219                 PLUGIN_NOOP,
 220                         PLUGIN_PROVIDE(CUSTOM, "pt-tls-client"),
 221                                 PLUGIN_DEPENDS(CUSTOM, "tnccs-manager"),
 222         };
 223         library_init(NULL, "pt-tls-client");
 224         libtnccs_init();
 225
 226         init_log("pt-tls-client");
 227         options = options_create();
 228
 229         lib->plugins->add_static_features(lib->plugins, "pt-tls-client", features,
 230                                                                           countof(features), TRUE, NULL, NULL);
 231         if (!lib->plugins->load(lib->plugins,
 232                         lib->settings->get_str(lib->settings, "pt-tls-client.load", PLUGINS)))
 233         {
 234                 exit(SS_RC_INITIALIZATION_FAILED);
 235         }
 236         lib->plugins->status(lib->plugins, LEVEL_CTRL);
 237
 238         creds = mem_cred_create();
 239         lib->credmgr->add_set(lib->credmgr, &creds->set);
 240
 241         atexit(cleanup);
 242 }
 243
 244 int main(int argc, char *argv[])
 245 {
 246         char *address = NULL, *identity = "%any", *secret = NULL;
 247         int port = PT_TLS_PORT;
 248
 249         init();
 250
 251         while (TRUE)
 252         {
 253                 struct option long_opts[] = {
 254                         {"help",                no_argument,                    NULL,           'h' },
 255                         {"connect",             required_argument,              NULL,           'c' },
 256                         {"client",              required_argument,              NULL,           'i' },
 257                         {"secret",              required_argument,              NULL,           's' },
 258                         {"port",                required_argument,              NULL,           'p' },
 259                         {"cert",                required_argument,              NULL,           'x' },
 260                         {"key",                 required_argument,              NULL,           'k' },
 261                         {"quiet",               no_argument,                    NULL,           'q' },
 262                         {"debug",               required_argument,              NULL,           'd' },
 263                         {"optionsfrom", required_argument,              NULL,           '+' },
 264                         {0,0,0,0 }
 265                 };
 266                 switch (getopt_long(argc, argv, "", long_opts, NULL))
 267                 {
 268                         case EOF:
 269                                 break;
 270                         case 'h':                       /* --help */
 271                                 usage(stdout);
 272                                 return 0;
 273                         case 'x':                       /* --cert <file> */
 274                                 if (!load_certificate(optarg))
 275                                 {
 276                                         return 1;
 277                                 }
 278                                 continue;
 279                         case 'k':                       /* --key <file> */
 280                                 if (!load_key(optarg))
 281                                 {
 282                                         return 1;
 283                                 }
 284                                 continue;
 285                         case 'c':                       /* --connect <hostname|address> */
 286                                 if (address)
 287                                 {
 288                                         usage(stderr);
 289                                         return 1;
 290                                 }
 291                                 address = optarg;
 292                                 continue;
 293                         case 'i':                       /* --client <client-id> */
 294                                 identity = optarg;
 295                                 continue;
 296                         case 's':                       /* --secret <password> */
 297                                 secret = optarg;
 298                                 continue;
 299                         case 'p':                       /* --port <port> */
 300                                 port = atoi(optarg);
 301                                 continue;
 302                         case 'q':               /* --quiet */
 303                                 log_to_stderr = FALSE;
 304                                 continue;
 305                         case 'd':                       /* --debug <level> */
 306                                 default_loglevel = atoi(optarg);
 307                                 continue;
 308                         case '+':                       /* --optionsfrom <filename> */
 309                                 if (!options->from(options, optarg, &argc, &argv, optind))
 310                                 {
 311                                         return 1;
 312                                 }
 313                                 continue;
 314                         default:
 315                                 usage(stderr);
 316                                 return 1;
 317                 }
 318                 break;
 319         }
 320         if (!address)
 321         {
 322                 usage(stderr);
 323                 return 1;
 324         }
 325         if (secret)
 326         {
 327                 creds->add_shared(creds, shared_key_create(SHARED_EAP,
 328                                                                                 chunk_clone(chunk_from_str(secret))),
 329                                                         identification_create_from_string(identity), NULL);
 330         }
 331
 332         return client(address, port, identity);
 333 }