src/pt-tls-client/pt-tls-client.c

   1 /*
   2  * Copyright (C) 2010-2013 Martin Willi, revosec AG
   3  * Copyright (C) 2013-2015 Andreas Steffen
   4  * HSR Hochschule für Technik Rapperswil
   5  *
   6  * This program is free software; you can redistribute it and/or modify it
   7  * under the terms of the GNU General Public License as published by the
   8  * Free Software Foundation; either version 2 of the License, or (at your
   9  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  10  *
  11  * This program is distributed in the hope that it will be useful, but
  12  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * for more details.
  15  */
  16
  17 #include <unistd.h>
  18 #include <stdio.h>
  19 #include <sys/types.h>
  20 #include <getopt.h>
  21 #include <errno.h>
  22 #include <string.h>
  23 #include <stdlib.h>
  24 #ifdef HAVE_SYSLOG
  25 #include <syslog.h>
  26 #endif
  27
  28 #include <pt_tls.h>
  29 #include <pt_tls_client.h>
  30 #include <tnc/tnc.h>
  31 #include <tls.h>
  32
  33 #include <library.h>
  34 #include <utils/debug.h>
  35 #include <credentials/sets/mem_cred.h>
  36 #include <utils/optionsfrom.h>
  37
  38 /**
  39  * Print usage information
  40  */
  41 static void usage(FILE *out)
  42 {
  43         fprintf(out,
  44                 "Usage: pt-tls  --connect <hostname|address> [--port <port>]\n"
  45                 "              [--cert <file>]+ [--key <file>] [--key-type rsa|ecdsa]\n"
  46                 "              [--client <client-id>] [--secret <password>]\n"
  47                 "              [--optionsfrom <filename>] [--quiet] [--debug <level>]\n");
  48 }
  49
  50 /**
  51  * Client routine
  52  */
  53 static int client(char *address, uint16_t port, char *identity)
  54 {
  55         pt_tls_client_t *assessment;
  56         tls_t *tnccs;
  57         identification_t *server_id, *client_id;
  58         host_t *server_ip, *client_ip;
  59         status_t status;
  60
  61         server_ip = host_create_from_dns(address, AF_UNSPEC, port);
  62         if (!server_ip)
  63         {
  64                 return 1;
  65         }
  66
  67         client_ip = host_create_any(server_ip->get_family(server_ip));
  68         if (!client_ip)
  69         {
  70                 server_ip->destroy(server_ip);
  71                 return 1;
  72         }
  73         server_id = identification_create_from_string(address);
  74         client_id = identification_create_from_string(identity);
  75
  76         tnccs = (tls_t*)tnc->tnccs->create_instance(tnc->tnccs, TNCCS_2_0, FALSE,
  77                                                                 server_id, client_id, server_ip, client_ip,
  78                                                                 TNC_IFT_TLS_2_0, NULL);
  79         client_ip->destroy(client_ip);
  80
  81         if (!tnccs)
  82         {
  83                 fprintf(stderr, "loading TNCCS failed: %s\n", PLUGINS);
  84                 server_ip->destroy(server_ip);
  85                 server_id->destroy(server_id);
  86                 client_id->destroy(client_id);
  87                 return 1;
  88         }
  89         assessment = pt_tls_client_create(server_ip, server_id, client_id);
  90         status = assessment->run_assessment(assessment, (tnccs_t*)tnccs);
  91         assessment->destroy(assessment);
  92         tnccs->destroy(tnccs);
  93
  94         return (status != SUCCESS);
  95 }
  96
  97
  98 /**
  99  * In-Memory credential set
 100  */
 101 static mem_cred_t *creds;
 102
 103 /**
 104  * Load certificate from file
 105  */
 106 static bool load_certificate(char *filename)
 107 {
 108         certificate_t *cert;
 109
 110         cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
 111                                                           BUILD_FROM_FILE, filename, BUILD_END);
 112         if (!cert)
 113         {
 114                 DBG1(DBG_TLS, "loading certificate from '%s' failed", filename);
 115                 return FALSE;
 116         }
 117         creds->add_cert(creds, TRUE, cert);
 118         return TRUE;
 119 }
 120
 121 /**
 122  * Load private key from file
 123  */
 124 static bool load_key(char *filename, key_type_t type)
 125 {
 126         private_key_t *key;
 127
 128         key = lib->creds->create(lib->creds, CRED_PRIVATE_KEY, type,
 129                                                          BUILD_FROM_FILE, filename, BUILD_END);
 130         if (!key)
 131         {
 132                 DBG1(DBG_TLS, "loading key from '%s' failed", filename);
 133                 return FALSE;
 134         }
 135         creds->add_key(creds, key);
 136         return TRUE;
 137 }
 138
 139 /**
 140  * Logging and debug level
 141  */
 142 static bool log_to_stderr = TRUE;
 143 #ifdef HAVE_SYSLOG
 144 static bool log_to_syslog = TRUE;
 145 #endif /* HAVE_SYSLOG */
 146 static level_t default_loglevel = 1;
 147
 148 static void dbg_pt_tls(debug_t group, level_t level, char *fmt, ...)
 149 {
 150         va_list args;
 151
 152         if (level <= default_loglevel)
 153         {
 154                 if (log_to_stderr)
 155                 {
 156                         va_start(args, fmt);
 157                         vfprintf(stderr, fmt, args);
 158                         va_end(args);
 159                         fprintf(stderr, "\n");
 160                 }
 161 #ifdef HAVE_SYSLOG
 162                 if (log_to_syslog)
 163                 {
 164                         char buffer[8192];
 165                         char *current = buffer, *next;
 166
 167                         /* write in memory buffer first */
 168                         va_start(args, fmt);
 169                         vsnprintf(buffer, sizeof(buffer), fmt, args);
 170                         va_end(args);
 171
 172                         /* do a syslog with every line */
 173                         while (current)
 174                         {
 175                                 next = strchr(current, '\n');
 176                                 if (next)
 177                                 {
 178                                         *(next++) = '\0';
 179                                 }
 180                                 syslog(LOG_INFO, "%s\n", current);
 181                                 current = next;
 182                         }
 183                 }
 184 #endif /* HAVE_SYSLOG */
 185         }
 186 }
 187
 188 /**
 189  * Initialize logging to stderr/syslog
 190  */
 191 static void init_log(const char *program)
 192 {
 193         dbg = dbg_pt_tls;
 194
 195         if (log_to_stderr)
 196         {
 197                 setbuf(stderr, NULL);
 198         }
 199 #ifdef HAVE_SYSLOG
 200         if (log_to_syslog)
 201         {
 202                 openlog(program, LOG_CONS | LOG_NDELAY | LOG_PID, LOG_AUTHPRIV);
 203         }
 204 #endif /* HAVE_SYSLOG */
 205 }
 206
 207 /**
 208  * Handles --optionsfrom arguments
 209  */
 210 options_t *options;
 211
 212 /**
 213  * Cleanup
 214  */
 215 static void cleanup()
 216 {
 217         lib->processor->cancel(lib->processor);
 218         lib->credmgr->remove_set(lib->credmgr, &creds->set);
 219         creds->destroy(creds);
 220         options->destroy(options);
 221         libtnccs_deinit();
 222         library_deinit();
 223 }
 224
 225 /**
 226  * Initialize library
 227  */
 228 static void init()
 229 {
 230         plugin_feature_t features[] = {
 231                 PLUGIN_NOOP,
 232                         PLUGIN_PROVIDE(CUSTOM, "pt-tls-client"),
 233                                 PLUGIN_DEPENDS(CUSTOM, "tnccs-manager"),
 234         };
 235         library_init(NULL, "pt-tls-client");
 236         libtnccs_init();
 237
 238         init_log("pt-tls-client");
 239         options = options_create();
 240
 241         lib->plugins->add_static_features(lib->plugins, "pt-tls-client", features,
 242                                                                           countof(features), TRUE, NULL, NULL);
 243         if (!lib->plugins->load(lib->plugins,
 244                         lib->settings->get_str(lib->settings, "pt-tls-client.load", PLUGINS)))
 245         {
 246                 exit(SS_RC_INITIALIZATION_FAILED);
 247         }
 248         lib->plugins->status(lib->plugins, LEVEL_CTRL);
 249
 250         creds = mem_cred_create();
 251         lib->credmgr->add_set(lib->credmgr, &creds->set);
 252
 253         atexit(cleanup);
 254 }
 255
 256 int main(int argc, char *argv[])
 257 {
 258         char *address = NULL, *identity = "%any", *secret = NULL, *key_file = NULL;
 259         key_type_t key_type = KEY_RSA;
 260         int port = PT_TLS_PORT;
 261
 262         init();
 263
 264         while (TRUE)
 265         {
 266                 struct option long_opts[] = {
 267                         {"help",                no_argument,                    NULL,           'h' },
 268                         {"connect",             required_argument,              NULL,           'c' },
 269                         {"client",              required_argument,              NULL,           'i' },
 270                         {"secret",              required_argument,              NULL,           's' },
 271                         {"port",                required_argument,              NULL,           'p' },
 272                         {"cert",                required_argument,              NULL,           'x' },
 273                         {"key",                 required_argument,              NULL,           'k' },
 274                         {"key-type",            required_argument,              NULL,           't' },
 275                         {"mutual",              no_argument,                    NULL,           'm' },
 276                         {"quiet",               no_argument,                    NULL,           'q' },
 277                         {"debug",               required_argument,              NULL,           'd' },
 278                         {"optionsfrom", required_argument,              NULL,           '+' },
 279                         {0,0,0,0 }
 280                 };
 281                 switch (getopt_long(argc, argv, "", long_opts, NULL))
 282                 {
 283                         case EOF:
 284                                 break;
 285                         case 'h':                       /* --help */
 286                                 usage(stdout);
 287                                 return 0;
 288                         case 'x':                       /* --cert <file> */
 289                                 if (!load_certificate(optarg))
 290                                 {
 291                                         return 1;
 292                                 }
 293                                 continue;
 294                         case 'k':                       /* --key <file> */
 295                                 key_file = optarg;
 296                                 continue;
 297                         case 't':                       /* --key-type <type> */
 298                                 if (strcaseeq(optarg, "ecdsa"))
 299                                 {
 300                                         key_type = KEY_ECDSA;
 301                                 }
 302                                 else if (strcaseeq(optarg, "rsa"))
 303                                 {
 304                                         key_type = KEY_RSA;
 305                                 }
 306                                 else
 307                                 {
 308                                         key_type = KEY_ANY;
 309                                 }
 310                                 continue;
 311                         case 'c':                       /* --connect <hostname|address> */
 312                                 if (address)
 313                                 {
 314                                         usage(stderr);
 315                                         return 1;
 316                                 }
 317                                 address = optarg;
 318                                 continue;
 319                         case 'i':                       /* --client <client-id> */
 320                                 identity = optarg;
 321                                 continue;
 322                         case 's':                       /* --secret <password> */
 323                                 secret = optarg;
 324                                 continue;
 325                         case 'p':                       /* --port <port> */
 326                                 port = atoi(optarg);
 327                                 continue;
 328                         case 'm':                       /* --mutual */
 329                                 lib->settings->set_bool(lib->settings,
 330                                                                 "%s.plugins.tnccs-20.mutual", TRUE, lib->ns);
 331                                 continue;
 332                         case 'q':               /* --quiet */
 333                                 log_to_stderr = FALSE;
 334                                 continue;
 335                         case 'd':                       /* --debug <level> */
 336                                 default_loglevel = atoi(optarg);
 337                                 continue;
 338                         case '+':                       /* --optionsfrom <filename> */
 339                                 if (!options->from(options, optarg, &argc, &argv, optind))
 340                                 {
 341                                         return 1;
 342                                 }
 343                                 continue;
 344                         default:
 345                                 usage(stderr);
 346                                 return 1;
 347                 }
 348                 break;
 349         }
 350         if (!address)
 351         {
 352                 usage(stderr);
 353                 return 1;
 354         }
 355         if (key_file && !load_key(key_file, key_type))
 356         {
 357                 return 1;
 358         }
 359         if (secret)
 360         {
 361                 creds->add_shared(creds, shared_key_create(SHARED_EAP,
 362                                                                                 chunk_clone(chunk_from_str(secret))),
 363                                                         identification_create_from_string(identity), NULL);
 364         }
 365         return client(address, port, identity);
 366 }