237
256
new_server->next = new_server;
238
257
new_server->prev = new_server;
239
258
*current_server = new_server;
240
/* Place the new server last in the list */
260
/* Place the new server last in the list */
242
261
new_server->next = *current_server;
243
262
new_server->prev = (*current_server)->prev;
244
263
new_server->prev->next = new_server;
245
264
(*current_server)->prev = new_server;
247
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
249
perror_plus("clock_gettime");
256
270
* Initialize GPGME.
258
static bool init_gpgme(const char *seckey, const char *pubkey,
259
const char *tempdir, mandos_context *mc){
272
__attribute__((nonnull, warn_unused_result))
273
static bool init_gpgme(const char * const seckey,
274
const char * const pubkey,
275
const char * const tempdir,
260
277
gpgme_error_t rc;
261
278
gpgme_engine_info_t engine_info;
264
281
* Helper function to insert pub and seckey to the engine keyring.
266
bool import_key(const char *filename){
283
bool import_key(const char * const filename){
269
286
gpgme_data_t pgp_data;
1465
1486
if(setuid(0) == -1){
1466
1487
ret_errno = errno;
1467
perror_plus("seteuid");
1469
1489
errno = old_errno;
1470
1490
return ret_errno;
1473
1493
/* Set effective user ID to unprivileged saved user ID */
1494
__attribute__((warn_unused_result))
1474
1495
error_t lower_privileges(void){
1475
1496
error_t old_errno = errno;
1476
1497
error_t ret_errno = 0;
1477
1498
if(seteuid(uid) == -1){
1478
1499
ret_errno = errno;
1479
perror_plus("seteuid");
1481
1501
errno = old_errno;
1482
1502
return ret_errno;
1485
1505
/* Lower privileges permanently */
1506
__attribute__((warn_unused_result))
1486
1507
error_t lower_privileges_permanently(void){
1487
1508
error_t old_errno = errno;
1488
1509
error_t ret_errno = 0;
1489
1510
if(setuid(uid) == -1){
1490
1511
ret_errno = errno;
1491
perror_plus("setuid");
1493
1513
errno = old_errno;
1494
1514
return ret_errno;
1497
bool run_network_hooks(const char *mode, const char *interface,
1517
__attribute__((nonnull))
1518
void run_network_hooks(const char *mode, const char *interface,
1498
1519
const float delay){
1499
struct dirent **direntries;
1500
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1520
struct dirent **direntries = NULL;
1521
if(hookdir_fd == -1){
1522
hookdir_fd = open(hookdir, O_RDONLY);
1523
if(hookdir_fd == -1){
1524
if(errno == ENOENT){
1526
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1527
" found\n", hookdir);
1530
perror_plus("open");
1536
#if __GLIBC_PREREQ(2, 15)
1537
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1538
runnable_hook, alphasort);
1539
#else /* not __GLIBC_PREREQ(2, 15) */
1540
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1542
#endif /* not __GLIBC_PREREQ(2, 15) */
1543
#else /* not __GLIBC__ */
1544
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1546
#endif /* not __GLIBC__ */
1502
1547
if(numhooks == -1){
1503
if(errno == ENOENT){
1505
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1506
" found\n", hookdir);
1509
perror_plus("scandir");
1548
perror_plus("scandir");
1551
struct dirent *direntry;
1553
int devnull = open("/dev/null", O_RDONLY);
1554
for(int i = 0; i < numhooks; i++){
1555
direntry = direntries[i];
1557
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1512
struct dirent *direntry;
1514
int devnull = open("/dev/null", O_RDONLY);
1515
for(int i = 0; i < numhooks; i++){
1516
direntry = direntries[i];
1517
char *fullname = NULL;
1518
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1560
pid_t hook_pid = fork();
1563
/* Raise privileges */
1564
errno = raise_privileges_permanently();
1566
perror_plus("Failed to raise privileges");
1573
perror_plus("setgid");
1576
/* Reset supplementary groups */
1578
ret = setgroups(0, NULL);
1580
perror_plus("setgroups");
1583
ret = dup2(devnull, STDIN_FILENO);
1585
perror_plus("dup2(devnull, STDIN_FILENO)");
1588
ret = close(devnull);
1590
perror_plus("close");
1593
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1595
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1598
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1600
perror_plus("setenv");
1603
ret = setenv("DEVICE", interface, 1);
1605
perror_plus("setenv");
1608
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1610
perror_plus("setenv");
1613
ret = setenv("MODE", mode, 1);
1615
perror_plus("setenv");
1619
ret = asprintf(&delaystring, "%f", (double)delay);
1520
1621
perror_plus("asprintf");
1524
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1527
pid_t hook_pid = fork();
1530
/* Raise privileges */
1531
raise_privileges_permanently();
1536
perror_plus("setgid");
1538
/* Reset supplementary groups */
1540
ret = setgroups(0, NULL);
1542
perror_plus("setgroups");
1544
dup2(devnull, STDIN_FILENO);
1546
dup2(STDERR_FILENO, STDOUT_FILENO);
1547
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1549
perror_plus("setenv");
1552
ret = setenv("DEVICE", interface, 1);
1554
perror_plus("setenv");
1557
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1559
perror_plus("setenv");
1562
ret = setenv("MODE", mode, 1);
1564
perror_plus("setenv");
1568
ret = asprintf(&delaystring, "%f", delay);
1570
perror_plus("asprintf");
1573
ret = setenv("DELAY", delaystring, 1);
1576
perror_plus("setenv");
1624
ret = setenv("DELAY", delaystring, 1);
1579
1626
free(delaystring);
1580
if(connect_to != NULL){
1581
ret = setenv("CONNECT", connect_to, 1);
1583
perror_plus("setenv");
1587
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1588
perror_plus("execl");
1589
_exit(EXIT_FAILURE);
1627
perror_plus("setenv");
1631
if(connect_to != NULL){
1632
ret = setenv("CONNECT", connect_to, 1);
1634
perror_plus("setenv");
1638
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1640
perror_plus("openat");
1641
_exit(EXIT_FAILURE);
1643
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1644
perror_plus("close");
1645
_exit(EXIT_FAILURE);
1647
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1649
perror_plus("fexecve");
1650
_exit(EXIT_FAILURE);
1654
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1655
perror_plus("waitpid");
1659
if(WIFEXITED(status)){
1660
if(WEXITSTATUS(status) != 0){
1661
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1662
" with status %d\n", direntry->d_name,
1663
WEXITSTATUS(status));
1667
} else if(WIFSIGNALED(status)){
1668
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1669
" signal %d\n", direntry->d_name,
1593
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1594
perror_plus("waitpid");
1598
if(WIFEXITED(status)){
1599
if(WEXITSTATUS(status) != 0){
1600
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1601
" with status %d\n", direntry->d_name,
1602
WEXITSTATUS(status));
1606
} else if(WIFSIGNALED(status)){
1607
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1608
" signal %d\n", direntry->d_name,
1613
fprintf_plus(stderr, "Warning: network hook \"%s\""
1614
" crashed\n", direntry->d_name);
1621
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1674
fprintf_plus(stderr, "Warning: network hook \"%s\""
1675
" crashed\n", direntry->d_name);
1681
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1687
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1688
perror_plus("close");
1695
__attribute__((nonnull, warn_unused_result))
1630
1696
error_t bring_up_interface(const char *const interface,
1631
1697
const float delay){
1633
1698
error_t old_errno = errno;
1634
error_t ret_errno = 0;
1635
int ret, ret_setflags;
1636
1700
struct ifreq network;
1637
1701
unsigned int if_index = if_nametoindex(interface);
1638
1702
if(if_index == 0){
2450
2564
mc.current_server->prev->next = NULL;
2451
2565
while(mc.current_server != NULL){
2452
2566
server *next = mc.current_server->next;
2568
#pragma GCC diagnostic push
2569
#pragma GCC diagnostic ignored "-Wcast-qual"
2571
free((char *)(mc.current_server->ip));
2573
#pragma GCC diagnostic pop
2453
2575
free(mc.current_server);
2454
2576
mc.current_server = next;
2458
/* Re-raise priviliges */
2580
/* Re-raise privileges */
2462
/* Run network hooks */
2463
run_network_hooks("stop", interfaces_hooks != NULL ?
2464
interfaces_hooks : "", delay);
2466
/* Take down the network interfaces which were brought up */
2468
char *interface = NULL;
2469
while((interface=argz_next(interfaces_to_take_down,
2470
interfaces_to_take_down_size,
2472
ret_errno = take_down_interface(interface);
2475
perror_plus("Failed to take down interface");
2478
if(debug and (interfaces_to_take_down == NULL)){
2479
fprintf_plus(stderr, "No interfaces needed to be taken"
2484
lower_privileges_permanently();
2582
ret_errno = raise_privileges();
2585
perror_plus("Failed to raise privileges");
2588
/* Run network hooks */
2589
run_network_hooks("stop", interfaces_hooks != NULL ?
2590
interfaces_hooks : "", delay);
2592
/* Take down the network interfaces which were brought up */
2594
char *interface = NULL;
2595
while((interface=argz_next(interfaces_to_take_down,
2596
interfaces_to_take_down_size,
2598
ret_errno = take_down_interface(interface);
2601
perror_plus("Failed to take down interface");
2604
if(debug and (interfaces_to_take_down == NULL)){
2605
fprintf_plus(stderr, "No interfaces needed to be taken"
2611
ret_errno = lower_privileges_permanently();
2614
perror_plus("Failed to lower privileges permanently");
2487
2618
free(interfaces_to_take_down);
2488
2619
free(interfaces_hooks);
2490
2621
/* Removes the GPGME temp directory and all files inside */
2491
if(tempdir_created){
2622
if(tempdir != NULL){
2492
2623
struct dirent **direntries = NULL;
2493
struct dirent *direntry = NULL;
2494
int numentries = scandir(tempdir, &direntries, notdotentries,
2496
if (numentries > 0){
2497
for(int i = 0; i < numentries; i++){
2498
direntry = direntries[i];
2499
char *fullname = NULL;
2500
ret = asprintf(&fullname, "%s/%s", tempdir,
2503
perror_plus("asprintf");
2506
ret = remove(fullname);
2508
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2624
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2626
if(tempdir_fd == -1){
2627
perror_plus("open");
2630
#if __GLIBC_PREREQ(2, 15)
2631
int numentries = scandirat(tempdir_fd, ".", &direntries,
2632
notdotentries, alphasort);
2633
#else /* not __GLIBC_PREREQ(2, 15) */
2634
int numentries = scandir(tempdir, &direntries, notdotentries,
2636
#endif /* not __GLIBC_PREREQ(2, 15) */
2637
#else /* not __GLIBC__ */
2638
int numentries = scandir(tempdir, &direntries, notdotentries,
2640
#endif /* not __GLIBC__ */
2641
if(numentries >= 0){
2642
for(int i = 0; i < numentries; i++){
2643
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2645
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2646
" \"%s\", 0): %s\n", tempdir,
2647
direntries[i]->d_name, strerror(errno));
2649
free(direntries[i]);
2652
/* need to clean even if 0 because man page doesn't specify */
2654
if(numentries == -1){
2655
perror_plus("scandir");
2657
ret = rmdir(tempdir);
2658
if(ret == -1 and errno != ENOENT){
2659
perror_plus("rmdir");
2515
/* need to clean even if 0 because man page doesn't specify */
2517
if (numentries == -1){
2518
perror_plus("scandir");
2520
ret = rmdir(tempdir);
2521
if(ret == -1 and errno != ENOENT){
2522
perror_plus("rmdir");
2662
TEMP_FAILURE_RETRY(close(tempdir_fd));