534
554
/* GnuTLS server initialization */
535
ret = gnutls_dh_params_init(&mc.dh_params);
555
ret = gnutls_dh_params_init(&mc->dh_params);
536
556
if(ret != GNUTLS_E_SUCCESS){
537
557
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
538
558
" initialization: %s\n",
539
559
safer_gnutls_strerror(ret));
542
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
562
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
543
563
if(ret != GNUTLS_E_SUCCESS){
544
564
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
545
565
safer_gnutls_strerror(ret));
549
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
569
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
555
gnutls_certificate_free_credentials(mc.cred);
575
gnutls_certificate_free_credentials(mc->cred);
556
576
gnutls_global_deinit();
557
gnutls_dh_params_deinit(mc.dh_params);
577
gnutls_dh_params_deinit(mc->dh_params);
561
static int init_gnutls_session(gnutls_session_t *session){
581
__attribute__((nonnull, warn_unused_result))
582
static int init_gnutls_session(gnutls_session_t *session,
563
585
/* GnuTLS session creation */
734
780
if(if_indextoname((unsigned int)if_index, interface) == NULL){
735
781
perror_plus("if_indextoname");
737
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIu16
738
"\n", ip, interface, port);
783
fprintf_plus(stderr, "Connection to: %s%%%s, port %" PRIuMAX
784
"\n", ip, interface, (uintmax_t)port);
741
fprintf_plus(stderr, "Connection to: %s, port %" PRIu16 "\n",
787
fprintf_plus(stderr, "Connection to: %s, port %" PRIuMAX "\n",
788
ip, (uintmax_t)port);
744
790
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
745
791
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
747
792
if(af == AF_INET6){
748
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
793
ret = getnameinfo((struct sockaddr *)&to,
794
sizeof(struct sockaddr_in6),
795
addrstr, sizeof(addrstr), NULL, 0,
751
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
798
ret = getnameinfo((struct sockaddr *)&to,
799
sizeof(struct sockaddr_in),
800
addrstr, sizeof(addrstr), NULL, 0,
755
perror_plus("inet_ntop");
757
if(strcmp(addrstr, ip) != 0){
758
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
803
if(ret == EAI_SYSTEM){
804
perror_plus("getnameinfo");
805
} else if(ret != 0) {
806
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
807
} else if(strcmp(addrstr, ip) != 0){
808
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1209
* This function determines if a directory entry in /sys/class/net
1210
* corresponds to an acceptable network device which is up.
1211
* (This function is passed to scandir(3) as a filter function.)
1213
int up_interface(const struct dirent *if_entry){
1214
if(if_entry->d_name[0] == '.'){
1219
if(not get_flags(if_entry->d_name, &ifr)){
1221
fprintf_plus(stderr, "Failed to get flags for interface "
1222
"\"%s\"\n", if_entry->d_name);
1227
/* Reject down interfaces */
1228
if(not (ifr.ifr_flags & IFF_UP)){
1230
fprintf_plus(stderr, "Rejecting down interface \"%s\"\n",
1236
/* Reject non-running interfaces */
1237
if(not (ifr.ifr_flags & IFF_RUNNING)){
1239
fprintf_plus(stderr, "Rejecting non-running interface \"%s\"\n",
1245
if(not good_flags(if_entry->d_name, &ifr)){
1280
* This function determines if a network interface is up.
1282
__attribute__((nonnull, warn_unused_result))
1283
bool interface_is_up(const char *interface){
1285
if(not get_flags(interface, &ifr)){
1287
fprintf_plus(stderr, "Failed to get flags for interface "
1288
"\"%s\"\n", interface);
1293
return (bool)(ifr.ifr_flags & IFF_UP);
1297
* This function determines if a network interface is running
1299
__attribute__((nonnull, warn_unused_result))
1300
bool interface_is_running(const char *interface){
1302
if(not get_flags(interface, &ifr)){
1304
fprintf_plus(stderr, "Failed to get flags for interface "
1305
"\"%s\"\n", interface);
1310
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1313
__attribute__((nonnull, pure, warn_unused_result))
1251
1314
int notdotentries(const struct dirent *direntry){
1252
1315
/* Skip "." and ".." */
1253
1316
if(direntry->d_name[0] == '.'
1415
1475
if(setuid(0) == -1){
1416
1476
ret_errno = errno;
1417
perror_plus("seteuid");
1419
1478
errno = old_errno;
1420
1479
return ret_errno;
1423
1482
/* Set effective user ID to unprivileged saved user ID */
1483
__attribute__((warn_unused_result))
1424
1484
error_t lower_privileges(void){
1425
1485
error_t old_errno = errno;
1426
1486
error_t ret_errno = 0;
1427
1487
if(seteuid(uid) == -1){
1428
1488
ret_errno = errno;
1429
perror_plus("seteuid");
1435
bool run_network_hooks(const char *mode, const char *interface,
1494
/* Lower privileges permanently */
1495
__attribute__((warn_unused_result))
1496
error_t lower_privileges_permanently(void){
1497
error_t old_errno = errno;
1498
error_t ret_errno = 0;
1499
if(setuid(uid) == -1){
1506
__attribute__((nonnull))
1507
void run_network_hooks(const char *mode, const char *interface,
1436
1508
const float delay){
1437
struct dirent **direntries;
1438
struct dirent *direntry;
1440
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1509
struct dirent **direntries = NULL;
1510
if(hookdir_fd == -1){
1511
hookdir_fd = open(hookdir, O_RDONLY);
1512
if(hookdir_fd == -1){
1513
if(errno == ENOENT){
1515
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1516
" found\n", hookdir);
1519
perror_plus("open");
1525
#if __GLIBC_PREREQ(2, 15)
1526
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1527
runnable_hook, alphasort);
1528
#else /* not __GLIBC_PREREQ(2, 15) */
1529
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1531
#endif /* not __GLIBC_PREREQ(2, 15) */
1532
#else /* not __GLIBC__ */
1533
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1535
#endif /* not __GLIBC__ */
1442
1536
if(numhooks == -1){
1443
1537
perror_plus("scandir");
1445
int devnull = open("/dev/null", O_RDONLY);
1446
for(int i = 0; i < numhooks; i++){
1447
direntry = direntries[i];
1448
char *fullname = NULL;
1449
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1540
struct dirent *direntry;
1542
int devnull = open("/dev/null", O_RDONLY);
1543
for(int i = 0; i < numhooks; i++){
1544
direntry = direntries[i];
1546
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1549
pid_t hook_pid = fork();
1552
/* Raise privileges */
1553
errno = raise_privileges_permanently();
1555
perror_plus("Failed to raise privileges");
1562
perror_plus("setgid");
1565
/* Reset supplementary groups */
1567
ret = setgroups(0, NULL);
1569
perror_plus("setgroups");
1572
ret = dup2(devnull, STDIN_FILENO);
1574
perror_plus("dup2(devnull, STDIN_FILENO)");
1577
ret = close(devnull);
1579
perror_plus("close");
1582
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1584
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1587
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1589
perror_plus("setenv");
1592
ret = setenv("DEVICE", interface, 1);
1594
perror_plus("setenv");
1597
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1599
perror_plus("setenv");
1602
ret = setenv("MODE", mode, 1);
1604
perror_plus("setenv");
1608
ret = asprintf(&delaystring, "%f", (double)delay);
1451
1610
perror_plus("asprintf");
1455
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1458
pid_t hook_pid = fork();
1461
/* Raise privileges */
1462
raise_privileges_permanently();
1467
perror_plus("setgid");
1469
/* Reset supplementary groups */
1471
ret = setgroups(0, NULL);
1473
perror_plus("setgroups");
1475
dup2(devnull, STDIN_FILENO);
1477
dup2(STDERR_FILENO, STDOUT_FILENO);
1478
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1480
perror_plus("setenv");
1483
ret = setenv("DEVICE", interface, 1);
1485
perror_plus("setenv");
1488
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1490
perror_plus("setenv");
1493
ret = setenv("MODE", mode, 1);
1495
perror_plus("setenv");
1499
ret = asprintf(&delaystring, "%f", delay);
1501
perror_plus("asprintf");
1504
ret = setenv("DELAY", delaystring, 1);
1507
perror_plus("setenv");
1613
ret = setenv("DELAY", delaystring, 1);
1510
1615
free(delaystring);
1511
if(connect_to != NULL){
1512
ret = setenv("CONNECT", connect_to, 1);
1514
perror_plus("setenv");
1518
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1519
perror_plus("execl");
1520
_exit(EXIT_FAILURE);
1616
perror_plus("setenv");
1620
if(connect_to != NULL){
1621
ret = setenv("CONNECT", connect_to, 1);
1623
perror_plus("setenv");
1627
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1629
perror_plus("openat");
1630
_exit(EXIT_FAILURE);
1632
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1633
perror_plus("close");
1634
_exit(EXIT_FAILURE);
1636
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1638
perror_plus("fexecve");
1639
_exit(EXIT_FAILURE);
1643
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1644
perror_plus("waitpid");
1647
if(WIFEXITED(status)){
1648
if(WEXITSTATUS(status) != 0){
1649
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1650
" with status %d\n", direntry->d_name,
1651
WEXITSTATUS(status));
1654
} else if(WIFSIGNALED(status)){
1655
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1656
" signal %d\n", direntry->d_name,
1524
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1525
perror_plus("waitpid");
1529
if(WIFEXITED(status)){
1530
if(WEXITSTATUS(status) != 0){
1531
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1532
" with status %d\n", direntry->d_name,
1533
WEXITSTATUS(status));
1537
} else if(WIFSIGNALED(status)){
1538
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1539
" signal %d\n", direntry->d_name,
1544
fprintf_plus(stderr, "Warning: network hook \"%s\""
1545
" crashed\n", direntry->d_name);
1552
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1660
fprintf_plus(stderr, "Warning: network hook \"%s\""
1661
" crashed\n", direntry->d_name);
1666
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1671
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1672
perror_plus("close");
1561
int bring_up_interface(const char *const interface,
1564
int old_errno = errno;
1679
__attribute__((nonnull, warn_unused_result))
1680
error_t bring_up_interface(const char *const interface,
1682
error_t old_errno = errno;
1567
1684
struct ifreq network;
1568
AvahiIfIndex if_index = (AvahiIfIndex)if_nametoindex(interface);
1685
unsigned int if_index = if_nametoindex(interface);
1569
1686
if(if_index == 0){
1570
1687
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1571
1688
errno = old_errno;
1580
/* Re-raise priviliges */
1584
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1585
messages about the network interface to mess up the prompt */
1586
ret = klogctl(8, NULL, 5);
1587
bool restore_loglevel = true;
1589
restore_loglevel = false;
1590
perror_plus("klogctl");
1592
#endif /* __linux__ */
1594
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1597
perror_plus("socket");
1599
if(restore_loglevel){
1600
ret = klogctl(7, NULL, 0);
1602
perror_plus("klogctl");
1605
#endif /* __linux__ */
1606
/* Lower privileges */
1611
strcpy(network.ifr_name, interface);
1612
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1615
perror_plus("ioctl SIOCGIFFLAGS");
1617
if(restore_loglevel){
1618
ret = klogctl(7, NULL, 0);
1620
perror_plus("klogctl");
1623
#endif /* __linux__ */
1624
/* Lower privileges */
1629
if((network.ifr_flags & IFF_UP) == 0){
1630
network.ifr_flags |= IFF_UP;
1631
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1697
if(not interface_is_up(interface)){
1698
error_t ret_errno = 0, ioctl_errno = 0;
1699
if(not get_flags(interface, &network)){
1701
fprintf_plus(stderr, "Failed to get flags for interface "
1702
"\"%s\"\n", interface);
1706
network.ifr_flags |= IFF_UP; /* set flag */
1708
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1711
perror_plus("socket");
1717
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1719
perror_plus("close");
1726
fprintf_plus(stderr, "Bringing up interface \"%s\"\n",
1730
/* Raise privileges */
1731
ret_errno = raise_privileges();
1734
perror_plus("Failed to raise privileges");
1739
bool restore_loglevel = false;
1741
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1742
messages about the network interface to mess up the prompt */
1743
ret_linux = klogctl(8, NULL, 5);
1744
if(ret_linux == -1){
1745
perror_plus("klogctl");
1747
restore_loglevel = true;
1750
#endif /* __linux__ */
1751
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1752
ioctl_errno = errno;
1754
if(restore_loglevel){
1755
ret_linux = klogctl(7, NULL, 0);
1756
if(ret_linux == -1){
1757
perror_plus("klogctl");
1760
#endif /* __linux__ */
1762
/* If raise_privileges() succeeded above */
1764
/* Lower privileges */
1765
ret_errno = lower_privileges();
1768
perror_plus("Failed to lower privileges");
1772
/* Close the socket */
1773
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1775
perror_plus("close");
1778
if(ret_setflags == -1){
1779
errno = ioctl_errno;
1634
1780
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1636
if(restore_loglevel){
1637
ret = klogctl(7, NULL, 0);
1639
perror_plus("klogctl");
1642
#endif /* __linux__ */
1643
/* Lower privileges */
1645
1781
errno = old_errno;
1785
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1649
1789
/* Sleep checking until interface is running.
1650
1790
Check every 0.25s, up to total time of delay */
1651
1791
for(int i=0; i < delay * 4; i++){
1652
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1654
perror_plus("ioctl SIOCGIFFLAGS");
1655
} else if(network.ifr_flags & IFF_RUNNING){
1792
if(interface_is_running(interface)){
1658
1795
struct timespec sleeptime = { .tv_nsec = 250000000 };
1661
1798
perror_plus("nanosleep");
1664
/* Close the socket */
1665
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1667
perror_plus("close");
1806
__attribute__((nonnull, warn_unused_result))
1807
error_t take_down_interface(const char *const interface){
1808
error_t old_errno = errno;
1809
struct ifreq network;
1810
unsigned int if_index = if_nametoindex(interface);
1812
fprintf_plus(stderr, "No such interface: \"%s\"\n", interface);
1670
if(restore_loglevel){
1671
/* Restores kernel loglevel to default */
1672
ret = klogctl(7, NULL, 0);
1816
if(interface_is_up(interface)){
1817
error_t ret_errno = 0, ioctl_errno = 0;
1818
if(not get_flags(interface, &network) and debug){
1820
fprintf_plus(stderr, "Failed to get flags for interface "
1821
"\"%s\"\n", interface);
1825
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1827
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1830
perror_plus("socket");
1836
fprintf_plus(stderr, "Taking down interface \"%s\"\n",
1840
/* Raise privileges */
1841
ret_errno = raise_privileges();
1844
perror_plus("Failed to raise privileges");
1847
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1848
ioctl_errno = errno;
1850
/* If raise_privileges() succeeded above */
1852
/* Lower privileges */
1853
ret_errno = lower_privileges();
1856
perror_plus("Failed to lower privileges");
1860
/* Close the socket */
1861
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1674
perror_plus("klogctl");
1863
perror_plus("close");
1866
if(ret_setflags == -1){
1867
errno = ioctl_errno;
1868
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1873
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1677
#endif /* __linux__ */
1678
/* Lower privileges */
1680
1877
errno = old_errno;
1684
1881
int main(int argc, char *argv[]){
1882
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1883
.priority = "SECURE256:!CTYPE-X.509:"
1884
"+CTYPE-OPENPGP", .current_server = NULL,
1885
.interfaces = NULL, .interfaces_size = 0 };
1685
1886
AvahiSServiceBrowser *sb = NULL;
1688
1889
intmax_t tmpmax;
1690
1891
int exitcode = EXIT_SUCCESS;
1691
const char *interface = "";
1692
struct ifreq network;
1694
bool take_down_interface = false;
1695
char tempdir[] = "/tmp/mandosXXXXXX";
1696
bool tempdir_created = false;
1892
char *interfaces_to_take_down = NULL;
1893
size_t interfaces_to_take_down_size = 0;
1894
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1895
char old_tempdir[] = "/tmp/mandosXXXXXX";
1896
char *tempdir = NULL;
1697
1897
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1698
1898
const char *seckey = PATHDIR "/" SECKEY;
1699
1899
const char *pubkey = PATHDIR "/" PUBKEY;
1900
char *interfaces_hooks = NULL;
1701
1902
bool gnutls_initialized = false;
1702
1903
bool gpgme_initialized = false;
1925
2134
/* Lower privileges */
1929
perror_plus("seteuid");
2135
ret_errno = lower_privileges();
2138
perror_plus("Failed to lower privileges");
2143
/* Remove invalid interface names (except "none") */
2145
char *interface = NULL;
2146
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2148
if(strcmp(interface, "none") != 0
2149
and if_nametoindex(interface) == 0){
2150
if(interface[0] != '\0'){
2151
fprintf_plus(stderr, "Not using nonexisting interface"
2152
" \"%s\"\n", interface);
2154
argz_delete(&mc.interfaces, &mc.interfaces_size, interface);
1934
2160
/* Run network hooks */
1935
if(not run_network_hooks("start", interface, delay)){
2162
if(mc.interfaces != NULL){
2163
interfaces_hooks = malloc(mc.interfaces_size);
2164
if(interfaces_hooks == NULL){
2165
perror_plus("malloc");
2168
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2169
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2171
run_network_hooks("start", interfaces_hooks != NULL ?
2172
interfaces_hooks : "", delay);
1940
2176
avahi_set_log_function(empty_log);
1943
if(interface[0] == '\0'){
1944
struct dirent **direntries;
1945
/* First look for interfaces that are up */
1946
ret = scandir(sys_class_net, &direntries, up_interface,
1949
/* No up interfaces, look for any good interfaces */
1951
ret = scandir(sys_class_net, &direntries, good_interface,
1955
/* Pick the first interface returned */
1956
interface = strdup(direntries[0]->d_name);
1958
fprintf_plus(stderr, "Using interface \"%s\"\n", interface);
1960
if(interface == NULL){
1961
perror_plus("malloc");
1963
exitcode = EXIT_FAILURE;
1969
fprintf_plus(stderr, "Could not find a network interface\n");
1970
exitcode = EXIT_FAILURE;
1975
2179
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1976
2180
from the signal handler */
1977
2181
/* Initialize the pseudo-RNG for Avahi */
1978
2182
srand((unsigned int) time(NULL));
1979
mc.simple_poll = avahi_simple_poll_new();
1980
if(mc.simple_poll == NULL){
2183
simple_poll = avahi_simple_poll_new();
2184
if(simple_poll == NULL){
1981
2185
fprintf_plus(stderr,
1982
2186
"Avahi: Failed to create simple poll object.\n");
1983
2187
exitcode = EX_UNAVAILABLE;
2050
/* If the interface is down, bring it up */
2051
if((interface[0] != '\0') and (strcmp(interface, "none") != 0)){
2052
ret = bring_up_interface(interface, delay);
2055
perror_plus("Failed to bring up interface");
2254
/* If no interfaces were specified, make a list */
2255
if(mc.interfaces == NULL){
2256
struct dirent **direntries = NULL;
2257
/* Look for any good interfaces */
2258
ret = scandir(sys_class_net, &direntries, good_interface,
2261
/* Add all found interfaces to interfaces list */
2262
for(int i = 0; i < ret; ++i){
2263
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2264
direntries[i]->d_name);
2267
perror_plus("argz_add");
2271
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2272
direntries[i]->d_name);
2280
fprintf_plus(stderr, "Could not find a network interface\n");
2281
exitcode = EXIT_FAILURE;
2286
/* Bring up interfaces which are down, and remove any "none"s */
2288
char *interface = NULL;
2289
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2291
/* If interface name is "none", stop bringing up interfaces.
2292
Also remove all instances of "none" from the list */
2293
if(strcmp(interface, "none") == 0){
2294
argz_delete(&mc.interfaces, &mc.interfaces_size,
2297
while((interface = argz_next(mc.interfaces,
2298
mc.interfaces_size, interface))){
2299
if(strcmp(interface, "none") == 0){
2300
argz_delete(&mc.interfaces, &mc.interfaces_size,
2307
bool interface_was_up = interface_is_up(interface);
2308
errno = bring_up_interface(interface, delay);
2309
if(not interface_was_up){
2311
perror_plus("Failed to bring up interface");
2313
errno = argz_add(&interfaces_to_take_down,
2314
&interfaces_to_take_down_size,
2317
perror_plus("argz_add");
2322
if(debug and (interfaces_to_take_down == NULL)){
2323
fprintf_plus(stderr, "No interfaces were brought up\n");
2327
/* If we only got one interface, explicitly use only that one */
2328
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2330
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2333
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2063
ret = init_gnutls_global(pubkey, seckey);
2340
ret = init_gnutls_global(pubkey, seckey, &mc);
2065
2342
fprintf_plus(stderr, "init_gnutls_global failed\n");
2066
2343
exitcode = EX_UNAVAILABLE;
2266
/* Run network hooks */
2267
run_network_hooks("stop", interface, delay);
2269
/* Re-raise priviliges */
2554
/* Re-raise privileges */
2556
ret_errno = raise_privileges();
2559
perror_plus("Failed to raise privileges");
2562
/* Run network hooks */
2563
run_network_hooks("stop", interfaces_hooks != NULL ?
2564
interfaces_hooks : "", delay);
2566
/* Take down the network interfaces which were brought up */
2568
char *interface = NULL;
2569
while((interface=argz_next(interfaces_to_take_down,
2570
interfaces_to_take_down_size,
2572
ret_errno = take_down_interface(interface);
2575
perror_plus("Failed to take down interface");
2578
if(debug and (interfaces_to_take_down == NULL)){
2579
fprintf_plus(stderr, "No interfaces needed to be taken"
2273
/* Take down the network interface */
2274
if(take_down_interface and geteuid() == 0){
2275
ret = ioctl(sd, SIOCGIFFLAGS, &network);
2277
perror_plus("ioctl SIOCGIFFLAGS");
2278
} else if(network.ifr_flags & IFF_UP){
2279
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
2280
ret = ioctl(sd, SIOCSIFFLAGS, &network);
2282
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
2285
ret = (int)TEMP_FAILURE_RETRY(close(sd));
2287
perror_plus("close");
2585
ret_errno = lower_privileges_permanently();
2588
perror_plus("Failed to lower privileges permanently");
2291
/* Lower privileges permanently */
2295
perror_plus("setuid");
2592
free(interfaces_to_take_down);
2593
free(interfaces_hooks);
2298
2595
/* Removes the GPGME temp directory and all files inside */
2299
if(tempdir_created){
2596
if(tempdir != NULL){
2300
2597
struct dirent **direntries = NULL;
2301
struct dirent *direntry = NULL;
2302
int numentries = scandir(tempdir, &direntries, notdotentries,
2304
if (numentries > 0){
2305
for(int i = 0; i < numentries; i++){
2306
direntry = direntries[i];
2307
char *fullname = NULL;
2308
ret = asprintf(&fullname, "%s/%s", tempdir,
2311
perror_plus("asprintf");
2314
ret = remove(fullname);
2316
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2598
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2600
if(tempdir_fd == -1){
2601
perror_plus("open");
2604
#if __GLIBC_PREREQ(2, 15)
2605
int numentries = scandirat(tempdir_fd, ".", &direntries,
2606
notdotentries, alphasort);
2607
#else /* not __GLIBC_PREREQ(2, 15) */
2608
int numentries = scandir(tempdir, &direntries, notdotentries,
2610
#endif /* not __GLIBC_PREREQ(2, 15) */
2611
#else /* not __GLIBC__ */
2612
int numentries = scandir(tempdir, &direntries, notdotentries,
2614
#endif /* not __GLIBC__ */
2615
if(numentries >= 0){
2616
for(int i = 0; i < numentries; i++){
2617
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2619
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2620
" \"%s\", 0): %s\n", tempdir,
2621
direntries[i]->d_name, strerror(errno));
2625
/* need to clean even if 0 because man page doesn't specify */
2627
if(numentries == -1){
2628
perror_plus("scandir");
2630
ret = rmdir(tempdir);
2631
if(ret == -1 and errno != ENOENT){
2632
perror_plus("rmdir");
2323
/* need to clean even if 0 because man page doesn't specify */
2325
if (numentries == -1){
2326
perror_plus("scandir");
2328
ret = rmdir(tempdir);
2329
if(ret == -1 and errno != ENOENT){
2330
perror_plus("rmdir");
2635
TEMP_FAILURE_RETRY(close(tempdir_fd));