Further work on the client code

Trying to get everything in shape, not looking too bad.

Makefile

@@ -1,10 +1,10 @@
-.PHONY: all clean test testclient install parsers
+.PHONY: all clean test_s test_c install parsers
 all: luksrku
 
 BUILD_REVISION := $(shell git describe --abbrev=10 --dirty --always --tags)
 INSTALL_PREFIX := /usr/local/
 CFLAGS := -Wall -Wextra -Wshadow -Wswitch -Wpointer-arith -Wcast-qual -Wstrict-prototypes -Wmissing-prototypes -Werror=implicit-function-declaration -Werror=format -Wno-unused-parameter
-CFLAGS += -O3 -std=c11 -pthread -D_POSIX_SOURCE -D_XOPEN_SOURCE=500 -DBUILD_REVISION='"$(BUILD_REVISION)"'
+CFLAGS += -O3 -std=c11 -pthread -D_POSIX_SOURCE -D_POSIX_C_SOURCE=200112L -D_XOPEN_SOURCE=500 -DBUILD_REVISION='"$(BUILD_REVISION)"'
 CFLAGS += `pkg-config --cflags openssl`
 CFLAGS += -ggdb3 -DDEBUG -fsanitize=address -fsanitize=undefined -fsanitize=leak
 PYPGMOPTS := ../Python/pypgmopts/pypgmopts
@@ -26,14 +26,11 @@ install: all
 clean:
 	rm -f $(OBJS) $(OBJS_CFG) luksrku
 
-test: luksrku
+test_s: luksrku
 	./luksrku server -vv base
 
-gdb: luksrku
+test_c: luksrku
-	gdb --args ./luksrku -v --server-mode -k server_key.bin
+	./luksrku client -vv export 127.0.0.1
-
-testclient: luksrku
-	./luksrku -v --client-mode -k client_keys.bin
 
 .c.o:
 	$(CC) $(CFLAGS) -c -o $@ $<

client.c

@@ -29,6 +29,10 @@
 #include <unistd.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netdb.h>
+
 
 #include "log.h"
 #include "openssl.h"
@@ -36,6 +40,7 @@
 #include "msg.h"
 #include "client.h"
 #include "blacklist.h"
+#include "keydb.h"
 
 #if 0
 static const struct keydb_t *client_keydb;
@@ -207,6 +212,142 @@ static bool tls_client(const struct keydb_t *keydb, const struct options_t *opti
 }
 #endif
 
-bool keyclient_start(const struct pgmopts_client_t *opts) {
+struct keyclient_t {
+	const struct pgmopts_client_t *opts;
+	struct keydb_t *keydb;
+	bool volume_unlocked[MAX_VOLUMES_PER_HOST];
+};
+
+static int psk_client_callback(SSL *ssl, const EVP_MD *md, const unsigned char **id, size_t *idlen, SSL_SESSION **sess) {
+	fprintf(stderr, "CLIENT CALLBACK\n");
+	return 0;
+}
+
+static bool contact_keyserver_socket(struct keyclient_t *keyclient, int sd) {
+	struct generic_tls_ctx_t gctx;
+	if (!create_generic_tls_context(&gctx, false)) {
+		log_msg(LLVL_FATAL, "Failed to create OpenSSL client context.");
+		return false;
+	}
+	SSL_CTX_set_psk_use_session_callback(gctx.ctx, psk_client_callback);
+
+	SSL *ssl = SSL_new(gctx.ctx);
+	if (ssl) {
+		SSL_set_fd(ssl, sd);
+		SSL_set_app_data(ssl, keyclient);
+
+		if (SSL_connect(ssl) == 1) {
+			fprintf(stderr, "OK\n");
+		} else {
+			log_openssl(LLVL_FATAL, "SSL_connect failed");
+		}
+
+	} else {
+		log_openssl(LLVL_FATAL, "Cannot establish SSL context when trying to connect to server");
+	}
+
+	SSL_free(ssl);
+	free_generic_tls_context(&gctx);
 	return true;
 }
+
+static bool contact_keyserver_ipv4(struct keyclient_t *keyclient, struct sockaddr_in *sockaddr_in, unsigned int port) {
+	sockaddr_in->sin_port = htons(port);
+
+	int sd = socket(sockaddr_in->sin_family, SOCK_STREAM, 0);
+	if (sd == -1) {
+		log_libc(LLVL_ERROR, "Failed to create socket(3)");
+		return false;
+	}
+
+	if (connect(sd, (struct sockaddr*)sockaddr_in, sizeof(struct sockaddr_in)) == -1) {
+		log_libc(LLVL_ERROR, "Failed to connect(3) to %d.%d.%d.%d:%d", PRINTF_FORMAT_IP(sockaddr_in), port);
+		close(sd);
+		return false;
+	}
+
+	bool success = contact_keyserver_socket(keyclient, sd);
+
+	shutdown(sd, SHUT_RDWR);
+	close(sd);
+	return success;
+}
+
+static bool contact_keyserver_hostname(struct keyclient_t *keyclient, const char *hostname) {
+	struct addrinfo hints = {
+		.ai_family = AF_INET,
+		.ai_socktype = SOCK_STREAM,
+	};
+	struct addrinfo *result;
+	int resolve_result = getaddrinfo(hostname, NULL, &hints, &result);
+	if (resolve_result) {
+		log_msg(LLVL_ERROR, "Failed to resolve hostname %s using getaddrinfo(3): %s", hostname, gai_strerror(resolve_result));
+		return false;
+	}
+
+	if (result->ai_addr->sa_family != AF_INET) {
+		freeaddrinfo(result);
+		log_msg(LLVL_ERROR, "getaddrinfo(3) returned non-IPv4 entry");
+		return false;
+	}
+
+	struct sockaddr_in *sin_address = (struct sockaddr_in*)result->ai_addr;
+	log_msg(LLVL_DEBUG, "Resolved %s to %d.%d.%d.%d", hostname, PRINTF_FORMAT_IP(sin_address));
+
+	bool success = contact_keyserver_ipv4(keyclient, sin_address, keyclient->opts->port);
+
+	freeaddrinfo(result);
+	return success;
+}
+
+bool keyclient_start(const struct pgmopts_client_t *opts) {
+	/* Load key database first */
+	struct keyclient_t keyclient = {
+		.opts = opts,
+	};
+	bool success = true;
+
+	do {
+		keyclient.keydb = keydb_read(opts->filename);
+		if (!keyclient.keydb) {
+			log_msg(LLVL_FATAL, "Failed to load key database: %s", opts->filename);
+			success = false;
+			break;
+		}
+
+		if (keyclient.keydb->server_database) {
+			log_msg(LLVL_FATAL, "Not an exported key database: %s -- this database contains LUKS passphrases, refusing to work with it!", opts->filename);
+			success = false;
+			break;
+		}
+
+		if (keyclient.keydb->host_count != 1) {
+			log_msg(LLVL_FATAL, "Host count %d in %s -- expected exactly one host entry for an exported database.", keyclient.keydb->host_count, opts->filename);
+			success = false;
+			break;
+		}
+
+		struct host_entry_t *host = &keyclient.keydb->hosts[0];
+		if (host->volume_count == 0) {
+			log_msg(LLVL_FATAL, "No volumes found in exported database %s.", opts->filename);
+			success = false;
+			break;
+		}
+
+		log_msg(LLVL_DEBUG, "Attempting to unlock %d volumes of host \"%s\".", host->volume_count, host->host_name);
+		if (opts->hostname) {
+			if (!contact_keyserver_hostname(&keyclient, opts->hostname)) {
+				log_msg(LLVL_ERROR, "Failed to contact key server: %s", opts->hostname);
+				success = false;
+				break;
+			}
+		} else {
+			/* TODO: Loop until keyserver found */
+		}
+	} while (false);
+
+	if (keyclient.keydb) {
+		keydb_free(keyclient.keydb);
+	}
+	return success;
+}

server.c

@@ -330,6 +330,7 @@ static void client_handler_thread(void *vctx) {
 	struct client_ctx_t *client = (struct client_ctx_t*)vctx;
 
 	SSL *ssl = SSL_new(client->gctx->ctx);
+	if (ssl) {
 		SSL_set_fd(ssl, client->fd);
 		SSL_set_app_data(ssl, client);
 
@@ -356,30 +357,37 @@ static void client_handler_thread(void *vctx) {
 				log_msg(LLVL_FATAL, "Client connected, but no host set.");
 			}
 		}
-
+	} else {
+		log_openssl(LLVL_FATAL, "Cannot establish SSL context for connecting client");
+	}
 	SSL_free(ssl);
 	shutdown(client->fd, SHUT_RDWR);
 	close(client->fd);
 }
 
 bool keyserver_start(const struct pgmopts_server_t *opts) {
+	bool success = true;
+	struct keydb_t* keydb = NULL;
+	struct generic_tls_ctx_t gctx = { 0 };
+	do {
 		/* Load key database first */
-	struct keydb_t* keydb = keydb_read(opts->filename);
+		keydb = keydb_read(opts->filename);
 		if (!keydb) {
 			log_msg(LLVL_FATAL, "Failed to load key database: %s", opts->filename);
-		return false;
+			success = false;
+			break;
 		}
 
 		if (!keydb->server_database) {
 			log_msg(LLVL_FATAL, "Not a server key database: %s", opts->filename);
-		keydb_free(keydb);
+			success = false;
-		return false;
+			break;
 		}
 
-	struct generic_tls_ctx_t gctx;
 		if (!create_generic_tls_context(&gctx, true)) {
 			log_msg(LLVL_FATAL, "Failed to create OpenSSL server context.");
-		return false;
+			success = false;
+			break;
 		}
 
 		SSL_CTX_set_psk_find_session_callback(gctx.ctx, psk_server_callback);
@@ -387,8 +395,8 @@ bool keyserver_start(const struct pgmopts_server_t *opts) {
 		int tcp_sock = create_tcp_server_socket(opts->port);
 		if (tcp_sock == -1) {
 			log_msg(LLVL_ERROR, "Cannot start server without server socket.");
-		free_generic_tls_context(&gctx);
+			success = false;
-		return false;
+			break;
 		}
 
 		while (true) {
@@ -415,7 +423,8 @@ bool keyserver_start(const struct pgmopts_server_t *opts) {
 				return false;
 			}
 		}
-
+	} while (false);
 	free_generic_tls_context(&gctx);
-	return true;
+	keydb_free(keydb);
+	return success;
 }