224
235
perror_plus("strdup");
238
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
240
perror_plus("clock_gettime");
227
243
/* Special case of first server */
228
244
if(*current_server == NULL){
229
245
new_server->next = new_server;
230
246
new_server->prev = new_server;
231
247
*current_server = new_server;
232
/* Place the new server last in the list */
249
/* Place the new server last in the list */
234
250
new_server->next = *current_server;
235
251
new_server->prev = (*current_server)->prev;
236
252
new_server->prev->next = new_server;
237
253
(*current_server)->prev = new_server;
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
241
perror_plus("clock_gettime");
248
259
* Initialize GPGME.
250
static bool init_gpgme(const char *seckey, const char *pubkey,
251
const char *tempdir, mandos_context *mc){
261
__attribute__((nonnull, warn_unused_result))
262
static bool init_gpgme(const char * const seckey,
263
const char * const pubkey,
264
const char * const tempdir,
252
266
gpgme_error_t rc;
253
267
gpgme_engine_info_t engine_info;
256
270
* Helper function to insert pub and seckey to the engine keyring.
258
bool import_key(const char *filename){
272
bool import_key(const char * const filename){
261
275
gpgme_data_t pgp_data;
775
789
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
776
790
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
778
791
if(af == AF_INET6){
779
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
792
ret = getnameinfo((struct sockaddr *)&to,
793
sizeof(struct sockaddr_in6),
794
addrstr, sizeof(addrstr), NULL, 0,
782
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
797
ret = getnameinfo((struct sockaddr *)&to,
798
sizeof(struct sockaddr_in),
799
addrstr, sizeof(addrstr), NULL, 0,
786
perror_plus("inet_ntop");
788
if(strcmp(addrstr, ip) != 0){
789
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
802
if(ret == EAI_SYSTEM){
803
perror_plus("getnameinfo");
804
} else if(ret != 0) {
805
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
806
} else if(strcmp(addrstr, ip) != 0){
807
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1481
1514
return ret_errno;
1484
bool run_network_hooks(const char *mode, const char *interface,
1519
* Based on the example in the GNU LibC manual chapter 13.13 "File
1520
* Descriptor Flags".
1521
| [[info:libc:Descriptor%20Flags][File Descriptor Flags]] |
1523
__attribute__((warn_unused_result))
1524
static int set_cloexec_flag(int fd){
1525
int ret = (int)TEMP_FAILURE_RETRY(fcntl(fd, F_GETFD, 0));
1526
/* If reading the flags failed, return error indication now. */
1530
/* Store modified flag word in the descriptor. */
1531
return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,
1534
#endif /* not O_CLOEXEC */
1536
__attribute__((nonnull))
1537
void run_network_hooks(const char *mode, const char *interface,
1485
1538
const float delay){
1486
1539
struct dirent **direntries;
1540
if(hookdir_fd == -1){
1541
hookdir_fd = open(hookdir, O_RDONLY |
1544
#else /* not O_CLOEXEC */
1546
#endif /* not O_CLOEXEC */
1548
if(hookdir_fd == -1){
1549
if(errno == ENOENT){
1551
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1552
" found\n", hookdir);
1555
perror_plus("open");
1560
if(set_cloexec_flag(hookdir_fd) < 0){
1561
perror_plus("set_cloexec_flag");
1562
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1563
perror_plus("close");
1569
#endif /* not O_CLOEXEC */
1572
#if __GLIBC_PREREQ(2, 15)
1573
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1574
runnable_hook, alphasort);
1575
#else /* not __GLIBC_PREREQ(2, 15) */
1576
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1578
#endif /* not __GLIBC_PREREQ(2, 15) */
1579
#else /* not __GLIBC__ */
1580
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1582
#endif /* not __GLIBC__ */
1584
perror_plus("scandir");
1487
1587
struct dirent *direntry;
1489
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1492
if(errno == ENOENT){
1494
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1495
" found\n", hookdir);
1498
perror_plus("scandir");
1501
int devnull = open("/dev/null", O_RDONLY);
1502
for(int i = 0; i < numhooks; i++){
1503
direntry = direntries[i];
1504
char *fullname = NULL;
1505
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1589
int devnull = open("/dev/null", O_RDONLY);
1590
for(int i = 0; i < numhooks; i++){
1591
direntry = direntries[i];
1592
char *fullname = NULL;
1593
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1595
perror_plus("asprintf");
1599
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1602
pid_t hook_pid = fork();
1605
/* Raise privileges */
1606
if(raise_privileges_permanently() != 0){
1607
perror_plus("Failed to raise privileges");
1614
perror_plus("setgid");
1617
/* Reset supplementary groups */
1619
ret = setgroups(0, NULL);
1621
perror_plus("setgroups");
1624
ret = dup2(devnull, STDIN_FILENO);
1626
perror_plus("dup2(devnull, STDIN_FILENO)");
1629
ret = close(devnull);
1631
perror_plus("close");
1634
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1636
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1639
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1641
perror_plus("setenv");
1644
ret = setenv("DEVICE", interface, 1);
1646
perror_plus("setenv");
1649
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1651
perror_plus("setenv");
1654
ret = setenv("MODE", mode, 1);
1656
perror_plus("setenv");
1660
ret = asprintf(&delaystring, "%f", (double)delay);
1507
1662
perror_plus("asprintf");
1511
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1514
pid_t hook_pid = fork();
1517
/* Raise privileges */
1518
raise_privileges_permanently();
1523
perror_plus("setgid");
1525
/* Reset supplementary groups */
1527
ret = setgroups(0, NULL);
1529
perror_plus("setgroups");
1531
dup2(devnull, STDIN_FILENO);
1533
dup2(STDERR_FILENO, STDOUT_FILENO);
1534
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1536
perror_plus("setenv");
1539
ret = setenv("DEVICE", interface, 1);
1541
perror_plus("setenv");
1544
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1546
perror_plus("setenv");
1549
ret = setenv("MODE", mode, 1);
1551
perror_plus("setenv");
1555
ret = asprintf(&delaystring, "%f", delay);
1557
perror_plus("asprintf");
1560
ret = setenv("DELAY", delaystring, 1);
1563
perror_plus("setenv");
1665
ret = setenv("DELAY", delaystring, 1);
1566
1667
free(delaystring);
1567
if(connect_to != NULL){
1568
ret = setenv("CONNECT", connect_to, 1);
1570
perror_plus("setenv");
1574
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1575
perror_plus("execl");
1576
_exit(EXIT_FAILURE);
1668
perror_plus("setenv");
1672
if(connect_to != NULL){
1673
ret = setenv("CONNECT", connect_to, 1);
1675
perror_plus("setenv");
1679
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1680
perror_plus("execl");
1681
_exit(EXIT_FAILURE);
1685
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1686
perror_plus("waitpid");
1690
if(WIFEXITED(status)){
1691
if(WEXITSTATUS(status) != 0){
1692
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1693
" with status %d\n", direntry->d_name,
1694
WEXITSTATUS(status));
1698
} else if(WIFSIGNALED(status)){
1699
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1700
" signal %d\n", direntry->d_name,
1580
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1581
perror_plus("waitpid");
1585
if(WIFEXITED(status)){
1586
if(WEXITSTATUS(status) != 0){
1587
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1588
" with status %d\n", direntry->d_name,
1589
WEXITSTATUS(status));
1593
} else if(WIFSIGNALED(status)){
1594
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1595
" signal %d\n", direntry->d_name,
1600
fprintf_plus(stderr, "Warning: network hook \"%s\""
1601
" crashed\n", direntry->d_name);
1608
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1705
fprintf_plus(stderr, "Warning: network hook \"%s\""
1706
" crashed\n", direntry->d_name);
1713
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1717
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1718
perror_plus("close");
1725
__attribute__((nonnull, warn_unused_result))
1617
1726
error_t bring_up_interface(const char *const interface,
1618
1727
const float delay){
1620
1728
error_t old_errno = errno;
1621
error_t ret_errno = 0;
1622
int ret, ret_setflags;
1623
1730
struct ifreq network;
1624
1731
unsigned int if_index = if_nametoindex(interface);
1625
1732
if(if_index == 0){
2445
/* Re-raise priviliges */
2596
/* Re-raise privileges */
2449
/* Run network hooks */
2450
run_network_hooks("stop", interfaces_hooks != NULL ?
2451
interfaces_hooks : "", delay);
2453
/* Take down the network interfaces which were brought up */
2455
char *interface = NULL;
2456
while((interface=argz_next(interfaces_to_take_down,
2457
interfaces_to_take_down_size,
2459
ret_errno = take_down_interface(interface);
2462
perror_plus("Failed to take down interface");
2465
if(debug and (interfaces_to_take_down == NULL)){
2466
fprintf_plus(stderr, "No interfaces needed to be taken"
2471
lower_privileges_permanently();
2598
ret_errno = raise_privileges();
2600
perror_plus("Failed to raise privileges");
2603
/* Run network hooks */
2604
run_network_hooks("stop", interfaces_hooks != NULL ?
2605
interfaces_hooks : "", delay);
2607
/* Take down the network interfaces which were brought up */
2609
char *interface = NULL;
2610
while((interface=argz_next(interfaces_to_take_down,
2611
interfaces_to_take_down_size,
2613
ret_errno = take_down_interface(interface);
2616
perror_plus("Failed to take down interface");
2619
if(debug and (interfaces_to_take_down == NULL)){
2620
fprintf_plus(stderr, "No interfaces needed to be taken"
2626
ret_errno = lower_privileges_permanently();
2628
perror_plus("Failed to lower privileges permanently");
2474
2632
free(interfaces_to_take_down);
2475
2633
free(interfaces_hooks);
2477
2635
/* Removes the GPGME temp directory and all files inside */
2478
if(tempdir_created){
2636
if(tempdir != NULL){
2479
2637
struct dirent **direntries = NULL;
2480
2638
struct dirent *direntry = NULL;
2481
2639
int numentries = scandir(tempdir, &direntries, notdotentries,
2483
if (numentries > 0){
2484
2642
for(int i = 0; i < numentries; i++){
2485
2643
direntry = direntries[i];
2486
2644
char *fullname = NULL;