2 * Copyright (C) 2010-2013 Martin Willi, revosec AG
3 * Copyright (C) 2013-2015 Andreas Steffen
4 * HSR Hochschule für Technik Rapperswil
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation; either version 2 of the License, or (at your
9 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
11 * This program is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
13 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
19 #include <sys/types.h>
29 #include <pt_tls_client.h>
34 #include <utils/debug.h>
35 #include <credentials/sets/mem_cred.h>
36 #include <utils/optionsfrom.h>
39 * Print usage information
41 static void usage(FILE *out
)
44 "Usage: pt-tls --connect <hostname|address> [--port <port>]\n"
45 " [--cert <file>]+ [--key <file>] [--key-type rsa|ecdsa]\n"
46 " [--client <client-id>] [--secret <password>]\n"
47 " [--optionsfrom <filename>] [--quiet] [--debug <level>]\n");
53 static int client(char *address
, uint16_t port
, char *identity
)
55 pt_tls_client_t
*assessment
;
57 identification_t
*server_id
, *client_id
;
58 host_t
*server_ip
, *client_ip
;
61 server_ip
= host_create_from_dns(address
, AF_UNSPEC
, port
);
67 client_ip
= host_create_any(server_ip
->get_family(server_ip
));
70 server_ip
->destroy(server_ip
);
73 server_id
= identification_create_from_string(address
);
74 client_id
= identification_create_from_string(identity
);
76 tnccs
= (tls_t
*)tnc
->tnccs
->create_instance(tnc
->tnccs
, TNCCS_2_0
, FALSE
,
77 server_id
, client_id
, server_ip
, client_ip
,
78 TNC_IFT_TLS_2_0
, NULL
);
79 client_ip
->destroy(client_ip
);
83 fprintf(stderr
, "loading TNCCS failed: %s\n", PLUGINS
);
84 server_ip
->destroy(server_ip
);
85 server_id
->destroy(server_id
);
86 client_id
->destroy(client_id
);
89 assessment
= pt_tls_client_create(server_ip
, server_id
, client_id
);
90 status
= assessment
->run_assessment(assessment
, (tnccs_t
*)tnccs
);
91 assessment
->destroy(assessment
);
92 tnccs
->destroy(tnccs
);
94 return (status
!= SUCCESS
);
99 * In-Memory credential set
101 static mem_cred_t
*creds
;
104 * Load certificate from file
106 static bool load_certificate(char *filename
)
110 cert
= lib
->creds
->create(lib
->creds
, CRED_CERTIFICATE
, CERT_X509
,
111 BUILD_FROM_FILE
, filename
, BUILD_END
);
114 DBG1(DBG_TLS
, "loading certificate from '%s' failed", filename
);
117 creds
->add_cert(creds
, TRUE
, cert
);
122 * Load private key from file
124 static bool load_key(char *filename
, key_type_t type
)
128 key
= lib
->creds
->create(lib
->creds
, CRED_PRIVATE_KEY
, type
,
129 BUILD_FROM_FILE
, filename
, BUILD_END
);
132 DBG1(DBG_TLS
, "loading key from '%s' failed", filename
);
135 creds
->add_key(creds
, key
);
140 * Logging and debug level
142 static bool log_to_stderr
= TRUE
;
144 static bool log_to_syslog
= TRUE
;
145 #endif /* HAVE_SYSLOG */
146 static level_t default_loglevel
= 1;
148 static void dbg_pt_tls(debug_t group
, level_t level
, char *fmt
, ...)
152 if (level
<= default_loglevel
)
157 vfprintf(stderr
, fmt
, args
);
159 fprintf(stderr
, "\n");
165 char *current
= buffer
, *next
;
167 /* write in memory buffer first */
169 vsnprintf(buffer
, sizeof(buffer
), fmt
, args
);
172 /* do a syslog with every line */
175 next
= strchr(current
, '\n');
180 syslog(LOG_INFO
, "%s\n", current
);
184 #endif /* HAVE_SYSLOG */
189 * Initialize logging to stderr/syslog
191 static void init_log(const char *program
)
197 setbuf(stderr
, NULL
);
202 openlog(program
, LOG_CONS
| LOG_NDELAY
| LOG_PID
, LOG_AUTHPRIV
);
204 #endif /* HAVE_SYSLOG */
208 * Handles --optionsfrom arguments
215 static void cleanup()
217 lib
->processor
->cancel(lib
->processor
);
218 lib
->credmgr
->remove_set(lib
->credmgr
, &creds
->set
);
219 creds
->destroy(creds
);
220 options
->destroy(options
);
230 plugin_feature_t features
[] = {
232 PLUGIN_PROVIDE(CUSTOM
, "pt-tls-client"),
233 PLUGIN_DEPENDS(CUSTOM
, "tnccs-manager"),
235 library_init(NULL
, "pt-tls-client");
238 init_log("pt-tls-client");
239 options
= options_create();
241 lib
->plugins
->add_static_features(lib
->plugins
, "pt-tls-client", features
,
242 countof(features
), TRUE
, NULL
, NULL
);
243 if (!lib
->plugins
->load(lib
->plugins
,
244 lib
->settings
->get_str(lib
->settings
, "pt-tls-client.load", PLUGINS
)))
246 exit(SS_RC_INITIALIZATION_FAILED
);
248 lib
->plugins
->status(lib
->plugins
, LEVEL_CTRL
);
250 creds
= mem_cred_create();
251 lib
->credmgr
->add_set(lib
->credmgr
, &creds
->set
);
256 int main(int argc
, char *argv
[])
258 char *address
= NULL
, *identity
= "%any", *secret
= NULL
, *key_file
= NULL
;
259 key_type_t key_type
= KEY_RSA
;
260 int port
= PT_TLS_PORT
;
266 struct option long_opts
[] = {
267 {"help", no_argument
, NULL
, 'h' },
268 {"connect", required_argument
, NULL
, 'c' },
269 {"client", required_argument
, NULL
, 'i' },
270 {"secret", required_argument
, NULL
, 's' },
271 {"port", required_argument
, NULL
, 'p' },
272 {"cert", required_argument
, NULL
, 'x' },
273 {"key", required_argument
, NULL
, 'k' },
274 {"key-type", required_argument
, NULL
, 't' },
275 {"mutual", no_argument
, NULL
, 'm' },
276 {"quiet", no_argument
, NULL
, 'q' },
277 {"debug", required_argument
, NULL
, 'd' },
278 {"optionsfrom", required_argument
, NULL
, '+' },
281 switch (getopt_long(argc
, argv
, "", long_opts
, NULL
))
285 case 'h': /* --help */
288 case 'x': /* --cert <file> */
289 if (!load_certificate(optarg
))
294 case 'k': /* --key <file> */
297 case 't': /* --key-type <type> */
298 if (strcaseeq(optarg
, "ecdsa"))
300 key_type
= KEY_ECDSA
;
302 else if (strcaseeq(optarg
, "rsa"))
311 case 'c': /* --connect <hostname|address> */
319 case 'i': /* --client <client-id> */
322 case 's': /* --secret <password> */
325 case 'p': /* --port <port> */
328 case 'm': /* --mutual */
329 lib
->settings
->set_bool(lib
->settings
,
330 "%s.plugins.tnccs-20.mutual", TRUE
, lib
->ns
);
332 case 'q': /* --quiet */
333 log_to_stderr
= FALSE
;
335 case 'd': /* --debug <level> */
336 default_loglevel
= atoi(optarg
);
338 case '+': /* --optionsfrom <filename> */
339 if (!options
->from(options
, optarg
, &argc
, &argv
, optind
))
355 if (key_file
&& !load_key(key_file
, key_type
))
361 creds
->add_shared(creds
, shared_key_create(SHARED_EAP
,
362 chunk_clone(chunk_from_str(secret
))),
363 identification_create_from_string(identity
), NULL
);
365 return client(address
, port
, identity
);