(root)/mandos/release
» Revision
237.23.1
(compared to revision 237.7.196)
: plugins.d/mandos-client.c
To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/release
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 237.23.1
- compare with another revision
- download diff
- download tarball
- view history from revision 237.23.1
- Committer: Teddy Hogeborn
- Date: 2014-07-25 22:44:20 UTC
- mto: (237.7.272 trunk)
- mto: This revision was merged to the branch mainline in revision 321.
- Revision ID: teddy@recompile.se-20140725224420-4a5ct2ptt0hsc92z
Require Python 2.7.
This is in preparation for the eventual move to Python 3, which will
happen as soon as all Python modules required by Mandos are available.
The mandos-ctl and mandos-monitor programs are already portable
between Python 2.6 and Python 3 without changes; this change will
bring the requirement up to Python 2.7.
* INSTALL (Prerequisites/Libraries/Mandos Server): Document
requirement of
Python 2.7; remove
Python-argparse
which is in the
Python 2.7 standard
library.
* debian/control (Source: mandos/Build-Depends-Indep): Depend on
exactly the
python2.7
package and all
the Python 2.7
versions of the
python modules.
(Package: mandos/Depends): - '' - but still depend on python (<=2.7)
and the generic versions of the Python
modules; this is for mandos-ctl and
mandos-monitor, both of which are
compatible with Python 3, and use
#!/usr/bin/python.
* mandos: Use #!/usr/bin/python2.7 instead of #!/usr/bin/python.
This is in preparation for the eventual move to Python 3, which will
happen as soon as all Python modules required by Mandos are available.
The mandos-ctl and mandos-monitor programs are already portable
between Python 2.6 and Python 3 without changes; this change will
bring the requirement up to Python 2.7.
* INSTALL (Prerequisites/Libraries/Mandos Server): Document
requirement of
Python 2.7; remove
Python-argparse
which is in the
Python 2.7 standard
library.
* debian/control (Source: mandos/Build-Depends-Indep): Depend on
exactly the
python2.7
package and all
the Python 2.7
versions of the
python modules.
(Package: mandos/Depends): - '' - but still depend on python (<=2.7)
and the generic versions of the Python
modules; this is for mandos-ctl and
mandos-monitor, both of which are
compatible with Python 3, and use
#!/usr/bin/python.
* mandos: Use #!/usr/bin/python2.7 instead of #!/usr/bin/python.
- files added:
- debian/upstream
- files modified:
- INSTALL
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2013 Teddy Hogeborn
13
* Copyright © 2008-2013 Björn Påhlsson
12
* Copyright © 2008-2014 Teddy Hogeborn
13
* Copyright © 2008-2014 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif
35
#endif /* not _LARGEFILE_SOURCE */
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif
38
#endif /* not _FILE_OFFSET_BITS */
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
43
stdout, ferror() */
44
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
55
55
opendir(), DIR */
56
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
58
inet_pton(), connect(),
59
getnameinfo() */
60
#include <fcntl.h> /* open(), unlinkat() */
60
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
62
*/
62
63
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
72
73
*/
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
setgid(), pause(), _exit() */
76
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
76
setgid(), pause(), _exit(),
77
unlinkat() */
78
#include <arpa/inet.h> /* inet_pton(), htons() */
77
79
#include <iso646.h> /* not, or, and */
78
80
#include <argp.h> /* struct argp_option, error_t, struct
79
81
argp_state, struct argp,
91
93
argz_delete(), argz_append(),
92
94
argz_stringify(), argz_add(),
93
95
argz_count() */
96
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
97
EAI_SYSTEM, gai_strerror() */
94
98
95
99
#ifdef __linux__
96
100
#include <sys/klog.h> /* klogctl() */
138
142
static const char sys_class_net[] = "/sys/class/net";
139
143
char *connect_to = NULL;
140
144
const char *hookdir = HOOKDIR;
145
int hookdir_fd = -1;
141
146
uid_t uid = 65534;
142
147
gid_t gid = 65534;
143
148
180
185
perror(print_text);
181
186
}
182
187
183
__attribute__((format (gnu_printf, 2, 3)))
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
184
189
int fprintf_plus(FILE *stream, const char *format, ...){
185
190
va_list ap;
186
191
va_start (ap, format);
195
200
* bytes. "buffer_capacity" is how much is currently allocated,
196
201
* "buffer_length" is how much is already used.
197
202
*/
203
__attribute__((nonnull, warn_unused_result))
198
204
size_t incbuffer(char **buffer, size_t buffer_length,
199
205
size_t buffer_capacity){
200
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
201
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
202
if(buffer == NULL){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
208
if(new_buf == NULL){
209
int old_errno = errno;
210
free(*buffer);
211
errno = old_errno;
212
*buffer = NULL;
203
213
return 0;
204
214
}
215
*buffer = new_buf;
205
216
buffer_capacity += BUFFER_SIZE;
206
217
}
207
218
return buffer_capacity;
208
219
}
209
220
210
221
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
211
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
212
224
int af, server **current_server){
213
225
int ret;
222
234
.af = af };
223
235
if(new_server->ip == NULL){
224
236
perror_plus("strdup");
237
free(new_server);
238
return false;
239
}
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
if(ret == -1){
242
perror_plus("clock_gettime");
243
#ifdef __GNUC__
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
246
#endif
247
free((char *)(new_server->ip));
248
#ifdef __GNUC__
249
#pragma GCC diagnostic pop
250
#endif
251
free(new_server);
225
252
return false;
226
253
}
227
254
/* Special case of first server */
229
256
new_server->next = new_server;
230
257
new_server->prev = new_server;
231
258
*current_server = new_server;
232
/* Place the new server last in the list */
233
259
} else {
260
/* Place the new server last in the list */
234
261
new_server->next = *current_server;
235
262
new_server->prev = (*current_server)->prev;
236
263
new_server->prev->next = new_server;
237
264
(*current_server)->prev = new_server;
238
265
}
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
240
if(ret == -1){
241
perror_plus("clock_gettime");
242
return false;
243
}
244
266
return true;
245
267
}
246
268
247
269
/*
248
270
* Initialize GPGME.
249
271
*/
250
static bool init_gpgme(const char *seckey, const char *pubkey,
251
const char *tempdir, mandos_context *mc){
272
__attribute__((nonnull, warn_unused_result))
273
static bool init_gpgme(const char * const seckey,
274
const char * const pubkey,
275
const char * const tempdir,
276
mandos_context *mc){
252
277
gpgme_error_t rc;
253
278
gpgme_engine_info_t engine_info;
254
279
255
280
/*
256
281
* Helper function to insert pub and seckey to the engine keyring.
257
282
*/
258
bool import_key(const char *filename){
283
bool import_key(const char * const filename){
259
284
int ret;
260
285
int fd;
261
286
gpgme_data_t pgp_data;
342
367
* Decrypt OpenPGP data.
343
368
* Returns -1 on error
344
369
*/
370
__attribute__((nonnull, warn_unused_result))
345
371
static ssize_t pgp_packet_decrypt(const char *cryptotext,
346
372
size_t crypto_size,
347
373
char **plaintext,
467
493
return plaintext_length;
468
494
}
469
495
470
static const char * safer_gnutls_strerror(int value){
496
__attribute__((warn_unused_result))
497
static const char *safer_gnutls_strerror(int value){
471
498
const char *ret = gnutls_strerror(value);
472
499
if(ret == NULL)
473
500
ret = "(unknown)";
475
502
}
476
503
477
504
/* GnuTLS log function callback */
505
__attribute__((nonnull))
478
506
static void debuggnutls(__attribute__((unused)) int level,
479
507
const char* string){
480
508
fprintf_plus(stderr, "GnuTLS: %s", string);
481
509
}
482
510
511
__attribute__((nonnull, warn_unused_result))
483
512
static int init_gnutls_global(const char *pubkeyfilename,
484
513
const char *seckeyfilename,
485
514
mandos_context *mc){
559
588
return -1;
560
589
}
561
590
591
__attribute__((nonnull, warn_unused_result))
562
592
static int init_gnutls_session(gnutls_session_t *session,
563
593
mandos_context *mc){
564
594
int ret;
621
651
__attribute__((unused)) const char *txt){}
622
652
623
653
/* Called when a Mandos server is found */
654
__attribute__((nonnull, warn_unused_result))
624
655
static int start_mandos_communication(const char *ip, in_port_t port,
625
656
AvahiIfIndex if_index,
626
657
int af, mandos_context *mc){
627
658
int ret, tcp_sd = -1;
628
659
ssize_t sret;
629
union {
630
struct sockaddr_in in;
631
struct sockaddr_in6 in6;
632
} to;
660
struct sockaddr_storage to;
633
661
char *buffer = NULL;
634
662
char *decrypted_buffer = NULL;
635
663
size_t buffer_length = 0;
716
744
717
745
memset(&to, 0, sizeof(to));
718
746
if(af == AF_INET6){
719
to.in6.sin6_family = (sa_family_t)af;
720
ret = inet_pton(af, ip, &to.in6.sin6_addr);
747
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
748
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
721
749
} else { /* IPv4 */
722
to.in.sin_family = (sa_family_t)af;
723
ret = inet_pton(af, ip, &to.in.sin_addr);
750
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
751
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
724
752
}
725
753
if(ret < 0 ){
726
754
int e = errno;
735
763
goto mandos_end;
736
764
}
737
765
if(af == AF_INET6){
738
to.in6.sin6_port = htons(port);
739
#ifdef __GNUC__
740
#pragma GCC diagnostic push
741
#pragma GCC diagnostic ignored "-Wstrict-aliasing"
742
#endif
743
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
744
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower */
745
#ifdef __GNUC__
746
#pragma GCC diagnostic pop
747
#endif
766
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
767
if(IN6_IS_ADDR_LINKLOCAL
768
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
748
769
if(if_index == AVAHI_IF_UNSPEC){
749
770
fprintf_plus(stderr, "An IPv6 link-local address is"
750
771
" incomplete without a network interface\n");
752
773
goto mandos_end;
753
774
}
754
775
/* Set the network interface number as scope */
755
to.in6.sin6_scope_id = (uint32_t)if_index;
776
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
756
777
}
757
778
} else {
758
to.in.sin_port = htons(port);
779
((struct sockaddr_in *)&to)->sin_port = htons(port);
759
780
}
760
781
761
782
if(quit_now){
778
799
}
779
800
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
780
801
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
781
const char *pcret;
782
802
if(af == AF_INET6){
783
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
784
sizeof(addrstr));
803
ret = getnameinfo((struct sockaddr *)&to,
804
sizeof(struct sockaddr_in6),
805
addrstr, sizeof(addrstr), NULL, 0,
806
NI_NUMERICHOST);
785
807
} else {
786
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
787
sizeof(addrstr));
808
ret = getnameinfo((struct sockaddr *)&to,
809
sizeof(struct sockaddr_in),
810
addrstr, sizeof(addrstr), NULL, 0,
811
NI_NUMERICHOST);
788
812
}
789
if(pcret == NULL){
790
perror_plus("inet_ntop");
791
} else {
792
if(strcmp(addrstr, ip) != 0){
793
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
794
}
813
if(ret == EAI_SYSTEM){
814
perror_plus("getnameinfo");
815
} else if(ret != 0) {
816
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
817
} else if(strcmp(addrstr, ip) != 0){
818
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
795
819
}
796
820
}
797
821
801
825
}
802
826
803
827
if(af == AF_INET6){
804
ret = connect(tcp_sd, &to.in6, sizeof(to));
828
ret = connect(tcp_sd, (struct sockaddr *)&to,
829
sizeof(struct sockaddr_in6));
805
830
} else {
806
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
831
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
832
sizeof(struct sockaddr_in));
807
833
}
808
834
if(ret < 0){
809
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
835
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
810
836
int e = errno;
811
837
perror_plus("connect");
812
838
errno = e;
1027
1053
return retval;
1028
1054
}
1029
1055
1056
__attribute__((nonnull))
1030
1057
static void resolve_callback(AvahiSServiceResolver *r,
1031
1058
AvahiIfIndex interface,
1032
1059
AvahiProtocol proto,
1040
1067
AVAHI_GCC_UNUSED AvahiStringList *txt,
1041
1068
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1042
1069
flags,
1043
void* mc){
1070
void *mc){
1044
1071
if(r == NULL){
1045
1072
return;
1046
1073
}
1049
1076
timed out */
1050
1077
1051
1078
if(quit_now){
1079
avahi_s_service_resolver_free(r);
1052
1080
return;
1053
1081
}
1054
1082
1099
1127
const char *domain,
1100
1128
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1101
1129
flags,
1102
void* mc){
1130
void *mc){
1103
1131
if(b == NULL){
1104
1132
return;
1105
1133
}
1165
1193
errno = old_errno;
1166
1194
}
1167
1195
1196
__attribute__((nonnull, warn_unused_result))
1168
1197
bool get_flags(const char *ifname, struct ifreq *ifr){
1169
1198
int ret;
1170
1199
error_t ret_errno;
1189
1218
return true;
1190
1219
}
1191
1220
1221
__attribute__((nonnull, warn_unused_result))
1192
1222
bool good_flags(const char *ifname, const struct ifreq *ifr){
1193
1223
1194
1224
/* Reject the loopback device */
1236
1266
* corresponds to an acceptable network device.
1237
1267
* (This function is passed to scandir(3) as a filter function.)
1238
1268
*/
1269
__attribute__((nonnull, warn_unused_result))
1239
1270
int good_interface(const struct dirent *if_entry){
1240
1271
if(if_entry->d_name[0] == '.'){
1241
1272
return 0;
1259
1290
/*
1260
1291
* This function determines if a network interface is up.
1261
1292
*/
1293
__attribute__((nonnull, warn_unused_result))
1262
1294
bool interface_is_up(const char *interface){
1263
1295
struct ifreq ifr;
1264
1296
if(not get_flags(interface, &ifr)){
1275
1307
/*
1276
1308
* This function determines if a network interface is running
1277
1309
*/
1310
__attribute__((nonnull, warn_unused_result))
1278
1311
bool interface_is_running(const char *interface){
1279
1312
struct ifreq ifr;
1280
1313
if(not get_flags(interface, &ifr)){
1288
1321
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1289
1322
}
1290
1323
1324
__attribute__((nonnull, pure, warn_unused_result))
1291
1325
int notdotentries(const struct dirent *direntry){
1292
1326
/* Skip "." and ".." */
1293
1327
if(direntry->d_name[0] == '.'
1300
1334
}
1301
1335
1302
1336
/* Is this directory entry a runnable program? */
1337
__attribute__((nonnull, warn_unused_result))
1303
1338
int runnable_hook(const struct dirent *direntry){
1304
1339
int ret;
1305
1340
size_t sret;
1313
1348
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1314
1349
"abcdefghijklmnopqrstuvwxyz"
1315
1350
"0123456789"
1316
"_-");
1351
"_.-");
1317
1352
if((direntry->d_name)[sret] != '\0'){
1318
1353
/* Contains non-allowed characters */
1319
1354
if(debug){
1323
1358
return 0;
1324
1359
}
1325
1360
1326
char *fullname = NULL;
1327
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1328
if(ret < 0){
1329
perror_plus("asprintf");
1330
return 0;
1331
}
1332
1333
ret = stat(fullname, &st);
1361
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1334
1362
if(ret == -1){
1335
1363
if(debug){
1336
1364
perror_plus("Could not stat hook");
1360
1388
return 1;
1361
1389
}
1362
1390
1391
__attribute__((nonnull, warn_unused_result))
1363
1392
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1364
1393
mandos_context *mc){
1365
1394
int ret;
1369
1398
1370
1399
while(true){
1371
1400
if(mc->current_server == NULL){
1372
if (debug){
1401
if(debug){
1373
1402
fprintf_plus(stderr, "Wait until first server is found."
1374
1403
" No timeout!\n");
1375
1404
}
1376
1405
ret = avahi_simple_poll_iterate(s, -1);
1377
1406
} else {
1378
if (debug){
1407
if(debug){
1379
1408
fprintf_plus(stderr, "Check current_server if we should run"
1380
1409
" it, or wait\n");
1381
1410
}
1398
1427
- ((intmax_t)waited_time.tv_sec * 1000))
1399
1428
- ((intmax_t)waited_time.tv_nsec / 1000000));
1400
1429
1401
if (debug){
1430
if(debug){
1402
1431
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1403
1432
block_time);
1404
1433
}
1426
1455
ret = avahi_simple_poll_iterate(s, (int)block_time);
1427
1456
}
1428
1457
if(ret != 0){
1429
if (ret > 0 or errno != EINTR){
1458
if(ret > 0 or errno != EINTR){
1430
1459
return (ret != 1) ? ret : 0;
1431
1460
}
1432
1461
}
1434
1463
}
1435
1464
1436
1465
/* Set effective uid to 0, return errno */
1466
__attribute__((warn_unused_result))
1437
1467
error_t raise_privileges(void){
1438
1468
error_t old_errno = errno;
1439
1469
error_t ret_errno = 0;
1440
1470
if(seteuid(0) == -1){
1441
1471
ret_errno = errno;
1442
perror_plus("seteuid");
1443
1472
}
1444
1473
errno = old_errno;
1445
1474
return ret_errno;
1446
1475
}
1447
1476
1448
1477
/* Set effective and real user ID to 0. Return errno. */
1478
__attribute__((warn_unused_result))
1449
1479
error_t raise_privileges_permanently(void){
1450
1480
error_t old_errno = errno;
1451
1481
error_t ret_errno = raise_privileges();
1455
1485
}
1456
1486
if(setuid(0) == -1){
1457
1487
ret_errno = errno;
1458
perror_plus("seteuid");
1459
1488
}
1460
1489
errno = old_errno;
1461
1490
return ret_errno;
1462
1491
}
1463
1492
1464
1493
/* Set effective user ID to unprivileged saved user ID */
1494
__attribute__((warn_unused_result))
1465
1495
error_t lower_privileges(void){
1466
1496
error_t old_errno = errno;
1467
1497
error_t ret_errno = 0;
1468
1498
if(seteuid(uid) == -1){
1469
1499
ret_errno = errno;
1470
perror_plus("seteuid");
1471
1500
}
1472
1501
errno = old_errno;
1473
1502
return ret_errno;
1474
1503
}
1475
1504
1476
1505
/* Lower privileges permanently */
1506
__attribute__((warn_unused_result))
1477
1507
error_t lower_privileges_permanently(void){
1478
1508
error_t old_errno = errno;
1479
1509
error_t ret_errno = 0;
1480
1510
if(setuid(uid) == -1){
1481
1511
ret_errno = errno;
1482
perror_plus("setuid");
1483
1512
}
1484
1513
errno = old_errno;
1485
1514
return ret_errno;
1486
1515
}
1487
1516
1488
bool run_network_hooks(const char *mode, const char *interface,
1517
__attribute__((nonnull))
1518
void run_network_hooks(const char *mode, const char *interface,
1489
1519
const float delay){
1490
struct dirent **direntries;
1520
struct dirent **direntries = NULL;
1521
if(hookdir_fd == -1){
1522
hookdir_fd = open(hookdir, O_RDONLY);
1523
if(hookdir_fd == -1){
1524
if(errno == ENOENT){
1525
if(debug){
1526
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1527
" found\n", hookdir);
1528
}
1529
} else {
1530
perror_plus("open");
1531
}
1532
return;
1533
}
1534
}
1535
#ifdef __GLIBC__
1536
#if __GLIBC_PREREQ(2, 15)
1537
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1538
runnable_hook, alphasort);
1539
#else /* not __GLIBC_PREREQ(2, 15) */
1540
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1541
alphasort);
1542
#endif /* not __GLIBC_PREREQ(2, 15) */
1543
#else /* not __GLIBC__ */
1544
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1545
alphasort);
1546
#endif /* not __GLIBC__ */
1547
if(numhooks == -1){
1548
perror_plus("scandir");
1549
return;
1550
}
1491
1551
struct dirent *direntry;
1492
1552
int ret;
1493
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1494
alphasort);
1495
if(numhooks == -1){
1496
if(errno == ENOENT){
1497
if(debug){
1498
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1499
" found\n", hookdir);
1500
}
1501
} else {
1502
perror_plus("scandir");
1553
int devnull = open("/dev/null", O_RDONLY);
1554
for(int i = 0; i < numhooks; i++){
1555
direntry = direntries[i];
1556
if(debug){
1557
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1558
direntry->d_name);
1503
1559
}
1504
} else {
1505
int devnull = open("/dev/null", O_RDONLY);
1506
for(int i = 0; i < numhooks; i++){
1507
direntry = direntries[i];
1508
char *fullname = NULL;
1509
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1510
if(ret < 0){
1560
pid_t hook_pid = fork();
1561
if(hook_pid == 0){
1562
/* Child */
1563
/* Raise privileges */
1564
errno = raise_privileges_permanently();
1565
if(errno != 0){
1566
perror_plus("Failed to raise privileges");
1567
_exit(EX_NOPERM);
1568
}
1569
/* Set group */
1570
errno = 0;
1571
ret = setgid(0);
1572
if(ret == -1){
1573
perror_plus("setgid");
1574
_exit(EX_NOPERM);
1575
}
1576
/* Reset supplementary groups */
1577
errno = 0;
1578
ret = setgroups(0, NULL);
1579
if(ret == -1){
1580
perror_plus("setgroups");
1581
_exit(EX_NOPERM);
1582
}
1583
ret = dup2(devnull, STDIN_FILENO);
1584
if(ret == -1){
1585
perror_plus("dup2(devnull, STDIN_FILENO)");
1586
_exit(EX_OSERR);
1587
}
1588
ret = close(devnull);
1589
if(ret == -1){
1590
perror_plus("close");
1591
_exit(EX_OSERR);
1592
}
1593
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1594
if(ret == -1){
1595
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1596
_exit(EX_OSERR);
1597
}
1598
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1599
if(ret == -1){
1600
perror_plus("setenv");
1601
_exit(EX_OSERR);
1602
}
1603
ret = setenv("DEVICE", interface, 1);
1604
if(ret == -1){
1605
perror_plus("setenv");
1606
_exit(EX_OSERR);
1607
}
1608
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1609
if(ret == -1){
1610
perror_plus("setenv");
1611
_exit(EX_OSERR);
1612
}
1613
ret = setenv("MODE", mode, 1);
1614
if(ret == -1){
1615
perror_plus("setenv");
1616
_exit(EX_OSERR);
1617
}
1618
char *delaystring;
1619
ret = asprintf(&delaystring, "%f", (double)delay);
1620
if(ret == -1){
1511
1621
perror_plus("asprintf");
1512
continue;
1513
}
1514
if(debug){
1515
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1516
direntry->d_name);
1517
}
1518
pid_t hook_pid = fork();
1519
if(hook_pid == 0){
1520
/* Child */
1521
/* Raise privileges */
1522
raise_privileges_permanently();
1523
/* Set group */
1524
errno = 0;
1525
ret = setgid(0);
1526
if(ret == -1){
1527
perror_plus("setgid");
1528
}
1529
/* Reset supplementary groups */
1530
errno = 0;
1531
ret = setgroups(0, NULL);
1532
if(ret == -1){
1533
perror_plus("setgroups");
1534
}
1535
dup2(devnull, STDIN_FILENO);
1536
close(devnull);
1537
dup2(STDERR_FILENO, STDOUT_FILENO);
1538
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1539
if(ret == -1){
1540
perror_plus("setenv");
1541
_exit(EX_OSERR);
1542
}
1543
ret = setenv("DEVICE", interface, 1);
1544
if(ret == -1){
1545
perror_plus("setenv");
1546
_exit(EX_OSERR);
1547
}
1548
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1549
if(ret == -1){
1550
perror_plus("setenv");
1551
_exit(EX_OSERR);
1552
}
1553
ret = setenv("MODE", mode, 1);
1554
if(ret == -1){
1555
perror_plus("setenv");
1556
_exit(EX_OSERR);
1557
}
1558
char *delaystring;
1559
ret = asprintf(&delaystring, "%f", delay);
1560
if(ret == -1){
1561
perror_plus("asprintf");
1562
_exit(EX_OSERR);
1563
}
1564
ret = setenv("DELAY", delaystring, 1);
1565
if(ret == -1){
1566
free(delaystring);
1567
perror_plus("setenv");
1568
_exit(EX_OSERR);
1569
}
1622
_exit(EX_OSERR);
1623
}
1624
ret = setenv("DELAY", delaystring, 1);
1625
if(ret == -1){
1570
1626
free(delaystring);
1571
if(connect_to != NULL){
1572
ret = setenv("CONNECT", connect_to, 1);
1573
if(ret == -1){
1574
perror_plus("setenv");
1575
_exit(EX_OSERR);
1576
}
1577
}
1578
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1579
perror_plus("execl");
1580
_exit(EXIT_FAILURE);
1581
}
1627
perror_plus("setenv");
1628
_exit(EX_OSERR);
1629
}
1630
free(delaystring);
1631
if(connect_to != NULL){
1632
ret = setenv("CONNECT", connect_to, 1);
1633
if(ret == -1){
1634
perror_plus("setenv");
1635
_exit(EX_OSERR);
1636
}
1637
}
1638
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1639
if(hook_fd == -1){
1640
perror_plus("openat");
1641
_exit(EXIT_FAILURE);
1642
}
1643
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1644
perror_plus("close");
1645
_exit(EXIT_FAILURE);
1646
}
1647
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1648
environ) == -1){
1649
perror_plus("fexecve");
1650
_exit(EXIT_FAILURE);
1651
}
1652
} else {
1653
int status;
1654
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1655
perror_plus("waitpid");
1656
free(direntry);
1657
continue;
1658
}
1659
if(WIFEXITED(status)){
1660
if(WEXITSTATUS(status) != 0){
1661
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1662
" with status %d\n", direntry->d_name,
1663
WEXITSTATUS(status));
1664
free(direntry);
1665
continue;
1666
}
1667
} else if(WIFSIGNALED(status)){
1668
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1669
" signal %d\n", direntry->d_name,
1670
WTERMSIG(status));
1671
free(direntry);
1672
continue;
1582
1673
} else {
1583
int status;
1584
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1585
perror_plus("waitpid");
1586
free(fullname);
1587
continue;
1588
}
1589
if(WIFEXITED(status)){
1590
if(WEXITSTATUS(status) != 0){
1591
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1592
" with status %d\n", direntry->d_name,
1593
WEXITSTATUS(status));
1594
free(fullname);
1595
continue;
1596
}
1597
} else if(WIFSIGNALED(status)){
1598
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1599
" signal %d\n", direntry->d_name,
1600
WTERMSIG(status));
1601
free(fullname);
1602
continue;
1603
} else {
1604
fprintf_plus(stderr, "Warning: network hook \"%s\""
1605
" crashed\n", direntry->d_name);
1606
free(fullname);
1607
continue;
1608
}
1609
}
1610
free(fullname);
1611
if(debug){
1612
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1613
direntry->d_name);
1614
}
1615
}
1616
close(devnull);
1617
}
1618
return true;
1674
fprintf_plus(stderr, "Warning: network hook \"%s\""
1675
" crashed\n", direntry->d_name);
1676
free(direntry);
1677
continue;
1678
}
1679
}
1680
if(debug){
1681
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1682
direntry->d_name);
1683
}
1684
free(direntry);
1685
}
1686
free(direntries);
1687
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1688
perror_plus("close");
1689
} else {
1690
hookdir_fd = -1;
1691
}
1692
close(devnull);
1619
1693
}
1620
1694
1695
__attribute__((nonnull, warn_unused_result))
1621
1696
error_t bring_up_interface(const char *const interface,
1622
1697
const float delay){
1623
int sd = -1;
1624
1698
error_t old_errno = errno;
1625
error_t ret_errno = 0;
1626
int ret, ret_setflags;
1699
int ret;
1627
1700
struct ifreq network;
1628
1701
unsigned int if_index = if_nametoindex(interface);
1629
1702
if(if_index == 0){
1638
1711
}
1639
1712
1640
1713
if(not interface_is_up(interface)){
1641
if(not get_flags(interface, &network) and debug){
1714
error_t ret_errno = 0, ioctl_errno = 0;
1715
if(not get_flags(interface, &network)){
1642
1716
ret_errno = errno;
1643
1717
fprintf_plus(stderr, "Failed to get flags for interface "
1644
1718
"\"%s\"\n", interface);
1719
errno = old_errno;
1645
1720
return ret_errno;
1646
1721
}
1647
network.ifr_flags |= IFF_UP;
1722
network.ifr_flags |= IFF_UP; /* set flag */
1648
1723
1649
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1650
if(sd < 0){
1724
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1725
if(sd == -1){
1651
1726
ret_errno = errno;
1652
1727
perror_plus("socket");
1653
1728
errno = old_errno;
1654
1729
return ret_errno;
1655
1730
}
1656
1731
1657
1732
if(quit_now){
1658
close(sd);
1733
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1734
if(ret == -1){
1735
perror_plus("close");
1736
}
1659
1737
errno = old_errno;
1660
1738
return EINTR;
1661
1739
}
1665
1743
interface);
1666
1744
}
1667
1745
1668
/* Raise priviliges */
1669
raise_privileges();
1746
/* Raise privileges */
1747
ret_errno = raise_privileges();
1748
if(ret_errno != 0){
1749
errno = ret_errno;
1750
perror_plus("Failed to raise privileges");
1751
}
1670
1752
1671
1753
#ifdef __linux__
1672
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1673
messages about the network interface to mess up the prompt */
1674
int ret_linux = klogctl(8, NULL, 5);
1675
bool restore_loglevel = true;
1676
if(ret_linux == -1){
1677
restore_loglevel = false;
1678
perror_plus("klogctl");
1754
int ret_linux;
1755
bool restore_loglevel = false;
1756
if(ret_errno == 0){
1757
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1758
messages about the network interface to mess up the prompt */
1759
ret_linux = klogctl(8, NULL, 5);
1760
if(ret_linux == -1){
1761
perror_plus("klogctl");
1762
} else {
1763
restore_loglevel = true;
1764
}
1679
1765
}
1680
1766
#endif /* __linux__ */
1681
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1682
ret_errno = errno;
1767
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1768
ioctl_errno = errno;
1683
1769
#ifdef __linux__
1684
1770
if(restore_loglevel){
1685
1771
ret_linux = klogctl(7, NULL, 0);
1689
1775
}
1690
1776
#endif /* __linux__ */
1691
1777
1692
/* Lower privileges */
1693
lower_privileges();
1778
/* If raise_privileges() succeeded above */
1779
if(ret_errno == 0){
1780
/* Lower privileges */
1781
ret_errno = lower_privileges();
1782
if(ret_errno != 0){
1783
errno = ret_errno;
1784
perror_plus("Failed to lower privileges");
1785
}
1786
}
1694
1787
1695
1788
/* Close the socket */
1696
1789
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1699
1792
}
1700
1793
1701
1794
if(ret_setflags == -1){
1702
errno = ret_errno;
1795
errno = ioctl_errno;
1703
1796
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1704
1797
errno = old_errno;
1705
return ret_errno;
1798
return ioctl_errno;
1706
1799
}
1707
1800
} else if(debug){
1708
1801
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1726
1819
return 0;
1727
1820
}
1728
1821
1822
__attribute__((nonnull, warn_unused_result))
1729
1823
error_t take_down_interface(const char *const interface){
1730
int sd = -1;
1731
1824
error_t old_errno = errno;
1732
error_t ret_errno = 0;
1733
int ret, ret_setflags;
1734
1825
struct ifreq network;
1735
1826
unsigned int if_index = if_nametoindex(interface);
1736
1827
if(if_index == 0){
1739
1830
return ENXIO;
1740
1831
}
1741
1832
if(interface_is_up(interface)){
1833
error_t ret_errno = 0, ioctl_errno = 0;
1742
1834
if(not get_flags(interface, &network) and debug){
1743
1835
ret_errno = errno;
1744
1836
fprintf_plus(stderr, "Failed to get flags for interface "
1745
1837
"\"%s\"\n", interface);
1838
errno = old_errno;
1746
1839
return ret_errno;
1747
1840
}
1748
1841
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1749
1842
1750
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1751
if(sd < 0){
1843
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1844
if(sd == -1){
1752
1845
ret_errno = errno;
1753
1846
perror_plus("socket");
1754
1847
errno = old_errno;
1760
1853
interface);
1761
1854
}
1762
1855
1763
/* Raise priviliges */
1764
raise_privileges();
1765
1766
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1767
ret_errno = errno;
1768
1769
/* Lower privileges */
1770
lower_privileges();
1856
/* Raise privileges */
1857
ret_errno = raise_privileges();
1858
if(ret_errno != 0){
1859
errno = ret_errno;
1860
perror_plus("Failed to raise privileges");
1861
}
1862
1863
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1864
ioctl_errno = errno;
1865
1866
/* If raise_privileges() succeeded above */
1867
if(ret_errno == 0){
1868
/* Lower privileges */
1869
ret_errno = lower_privileges();
1870
if(ret_errno != 0){
1871
errno = ret_errno;
1872
perror_plus("Failed to lower privileges");
1873
}
1874
}
1771
1875
1772
1876
/* Close the socket */
1773
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1877
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1774
1878
if(ret == -1){
1775
1879
perror_plus("close");
1776
1880
}
1777
1881
1778
1882
if(ret_setflags == -1){
1779
errno = ret_errno;
1883
errno = ioctl_errno;
1780
1884
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1781
1885
errno = old_errno;
1782
return ret_errno;
1886
return ioctl_errno;
1783
1887
}
1784
1888
} else if(debug){
1785
1889
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1793
1897
int main(int argc, char *argv[]){
1794
1898
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1795
1899
.priority = "SECURE256:!CTYPE-X.509:"
1796
"+CTYPE-OPENPGP", .current_server = NULL,
1900
"+CTYPE-OPENPGP", .current_server = NULL,
1797
1901
.interfaces = NULL, .interfaces_size = 0 };
1798
1902
AvahiSServiceBrowser *sb = NULL;
1799
1903
error_t ret_errno;
1803
1907
int exitcode = EXIT_SUCCESS;
1804
1908
char *interfaces_to_take_down = NULL;
1805
1909
size_t interfaces_to_take_down_size = 0;
1806
char tempdir[] = "/tmp/mandosXXXXXX";
1807
bool tempdir_created = false;
1910
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1911
char old_tempdir[] = "/tmp/mandosXXXXXX";
1912
char *tempdir = NULL;
1808
1913
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1809
1914
const char *seckey = PATHDIR "/" SECKEY;
1810
1915
const char *pubkey = PATHDIR "/" PUBKEY;
1811
1916
char *interfaces_hooks = NULL;
1812
size_t interfaces_hooks_size = 0;
1813
1917
1814
1918
bool gnutls_initialized = false;
1815
1919
bool gpgme_initialized = false;
1993
2097
/* Work around Debian bug #633582:
1994
2098
<http://bugs.debian.org/633582> */
1995
2099
1996
/* Re-raise priviliges */
1997
if(raise_privileges() == 0){
2100
/* Re-raise privileges */
2101
ret_errno = raise_privileges();
2102
if(ret_errno != 0){
2103
errno = ret_errno;
2104
perror_plus("Failed to raise privileges");
2105
} else {
1998
2106
struct stat st;
1999
2107
2000
2108
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2040
2148
}
2041
2149
2042
2150
/* Lower privileges */
2043
lower_privileges();
2151
ret_errno = lower_privileges();
2152
if(ret_errno != 0){
2153
errno = ret_errno;
2154
perror_plus("Failed to lower privileges");
2155
}
2044
2156
}
2045
2157
}
2046
2158
2070
2182
goto end;
2071
2183
}
2072
2184
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2073
interfaces_hooks_size = mc.interfaces_size;
2074
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2075
(int)',');
2076
}
2077
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2078
interfaces_hooks : "", delay)){
2079
goto end;
2080
}
2185
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2186
}
2187
run_network_hooks("start", interfaces_hooks != NULL ?
2188
interfaces_hooks : "", delay);
2081
2189
}
2082
2190
2083
2191
if(not debug){
2161
2269
2162
2270
/* If no interfaces were specified, make a list */
2163
2271
if(mc.interfaces == NULL){
2164
struct dirent **direntries;
2272
struct dirent **direntries = NULL;
2165
2273
/* Look for any good interfaces */
2166
2274
ret = scandir(sys_class_net, &direntries, good_interface,
2167
2275
alphasort);
2171
2279
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2172
2280
direntries[i]->d_name);
2173
2281
if(ret_errno != 0){
2282
errno = ret_errno;
2174
2283
perror_plus("argz_add");
2284
free(direntries[i]);
2175
2285
continue;
2176
2286
}
2177
2287
if(debug){
2178
2288
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2179
2289
direntries[i]->d_name);
2180
2290
}
2291
free(direntries[i]);
2181
2292
}
2182
2293
free(direntries);
2183
2294
} else {
2184
free(direntries);
2295
if(ret == 0){
2296
free(direntries);
2297
}
2185
2298
fprintf_plus(stderr, "Could not find a network interface\n");
2186
2299
exitcode = EXIT_FAILURE;
2187
2300
goto end;
2210
2323
break;
2211
2324
}
2212
2325
bool interface_was_up = interface_is_up(interface);
2213
ret = bring_up_interface(interface, delay);
2326
errno = bring_up_interface(interface, delay);
2214
2327
if(not interface_was_up){
2215
if(ret != 0){
2216
errno = ret;
2328
if(errno != 0){
2217
2329
perror_plus("Failed to bring up interface");
2218
2330
} else {
2219
ret_errno = argz_add(&interfaces_to_take_down,
2220
&interfaces_to_take_down_size,
2221
interface);
2331
errno = argz_add(&interfaces_to_take_down,
2332
&interfaces_to_take_down_size,
2333
interface);
2334
if(errno != 0){
2335
perror_plus("argz_add");
2336
}
2222
2337
}
2223
2338
}
2224
2339
}
2253
2368
goto end;
2254
2369
}
2255
2370
2256
if(mkdtemp(tempdir) == NULL){
2371
/* Try /run/tmp before /tmp */
2372
tempdir = mkdtemp(run_tempdir);
2373
if(tempdir == NULL and errno == ENOENT){
2374
if(debug){
2375
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2376
run_tempdir, old_tempdir);
2377
}
2378
tempdir = mkdtemp(old_tempdir);
2379
}
2380
if(tempdir == NULL){
2257
2381
perror_plus("mkdtemp");
2258
2382
goto end;
2259
2383
}
2260
tempdir_created = true;
2261
2384
2262
2385
if(quit_now){
2263
2386
goto end;
2338
2461
sleep((unsigned int)retry_interval);
2339
2462
}
2340
2463
2341
if (not quit_now){
2464
if(not quit_now){
2342
2465
exitcode = EXIT_SUCCESS;
2343
2466
}
2344
2467
2399
2522
if(debug){
2400
2523
fprintf_plus(stderr, "Starting Avahi loop search\n");
2401
2524
}
2402
2525
2403
2526
ret = avahi_loop_with_timeout(simple_poll,
2404
2527
(int)(retry_interval * 1000), &mc);
2405
2528
if(debug){
2441
2564
mc.current_server->prev->next = NULL;
2442
2565
while(mc.current_server != NULL){
2443
2566
server *next = mc.current_server->next;
2567
#ifdef __GNUC__
2568
#pragma GCC diagnostic push
2569
#pragma GCC diagnostic ignored "-Wcast-qual"
2570
#endif
2571
free((char *)(mc.current_server->ip));
2572
#ifdef __GNUC__
2573
#pragma GCC diagnostic pop
2574
#endif
2444
2575
free(mc.current_server);
2445
2576
mc.current_server = next;
2446
2577
}
2447
2578
}
2448
2579
2449
/* Re-raise priviliges */
2580
/* Re-raise privileges */
2450
2581
{
2451
raise_privileges();
2452
2453
/* Run network hooks */
2454
run_network_hooks("stop", interfaces_hooks != NULL ?
2455
interfaces_hooks : "", delay);
2456
2457
/* Take down the network interfaces which were brought up */
2458
{
2459
char *interface = NULL;
2460
while((interface=argz_next(interfaces_to_take_down,
2461
interfaces_to_take_down_size,
2462
interface))){
2463
ret_errno = take_down_interface(interface);
2464
if(ret_errno != 0){
2465
errno = ret_errno;
2466
perror_plus("Failed to take down interface");
2467
}
2468
}
2469
if(debug and (interfaces_to_take_down == NULL)){
2470
fprintf_plus(stderr, "No interfaces needed to be taken"
2471
" down\n");
2472
}
2473
}
2474
2475
lower_privileges_permanently();
2582
ret_errno = raise_privileges();
2583
if(ret_errno != 0){
2584
errno = ret_errno;
2585
perror_plus("Failed to raise privileges");
2586
} else {
2587
2588
/* Run network hooks */
2589
run_network_hooks("stop", interfaces_hooks != NULL ?
2590
interfaces_hooks : "", delay);
2591
2592
/* Take down the network interfaces which were brought up */
2593
{
2594
char *interface = NULL;
2595
while((interface=argz_next(interfaces_to_take_down,
2596
interfaces_to_take_down_size,
2597
interface))){
2598
ret_errno = take_down_interface(interface);
2599
if(ret_errno != 0){
2600
errno = ret_errno;
2601
perror_plus("Failed to take down interface");
2602
}
2603
}
2604
if(debug and (interfaces_to_take_down == NULL)){
2605
fprintf_plus(stderr, "No interfaces needed to be taken"
2606
" down\n");
2607
}
2608
}
2609
}
2610
2611
ret_errno = lower_privileges_permanently();
2612
if(ret_errno != 0){
2613
errno = ret_errno;
2614
perror_plus("Failed to lower privileges permanently");
2615
}
2476
2616
}
2477
2617
2478
2618
free(interfaces_to_take_down);
2479
2619
free(interfaces_hooks);
2480
2620
2481
2621
/* Removes the GPGME temp directory and all files inside */
2482
if(tempdir_created){
2622
if(tempdir != NULL){
2483
2623
struct dirent **direntries = NULL;
2484
struct dirent *direntry = NULL;
2485
int numentries = scandir(tempdir, &direntries, notdotentries,
2486
alphasort);
2487
if (numentries > 0){
2488
for(int i = 0; i < numentries; i++){
2489
direntry = direntries[i];
2490
char *fullname = NULL;
2491
ret = asprintf(&fullname, "%s/%s", tempdir,
2492
direntry->d_name);
2493
if(ret < 0){
2494
perror_plus("asprintf");
2495
continue;
2496
}
2497
ret = remove(fullname);
2498
if(ret == -1){
2499
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2500
strerror(errno));
2501
}
2502
free(fullname);
2624
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2625
O_NOFOLLOW));
2626
if(tempdir_fd == -1){
2627
perror_plus("open");
2628
} else {
2629
#ifdef __GLIBC__
2630
#if __GLIBC_PREREQ(2, 15)
2631
int numentries = scandirat(tempdir_fd, ".", &direntries,
2632
notdotentries, alphasort);
2633
#else /* not __GLIBC_PREREQ(2, 15) */
2634
int numentries = scandir(tempdir, &direntries, notdotentries,
2635
alphasort);
2636
#endif /* not __GLIBC_PREREQ(2, 15) */
2637
#else /* not __GLIBC__ */
2638
int numentries = scandir(tempdir, &direntries, notdotentries,
2639
alphasort);
2640
#endif /* not __GLIBC__ */
2641
if(numentries >= 0){
2642
for(int i = 0; i < numentries; i++){
2643
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2644
if(ret == -1){
2645
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2646
" \"%s\", 0): %s\n", tempdir,
2647
direntries[i]->d_name, strerror(errno));
2648
}
2649
free(direntries[i]);
2650
}
2651
2652
/* need to clean even if 0 because man page doesn't specify */
2653
free(direntries);
2654
if(numentries == -1){
2655
perror_plus("scandir");
2656
}
2657
ret = rmdir(tempdir);
2658
if(ret == -1 and errno != ENOENT){
2659
perror_plus("rmdir");
2660
}
2503
2661
}
2504
}
2505
2506
/* need to clean even if 0 because man page doesn't specify */
2507
free(direntries);
2508
if (numentries == -1){
2509
perror_plus("scandir");
2510
}
2511
ret = rmdir(tempdir);
2512
if(ret == -1 and errno != ENOENT){
2513
perror_plus("rmdir");
2662
TEMP_FAILURE_RETRY(close(tempdir_fd));
2514
2663
}
2515
2664
}
2516
2665
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0