32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
#ifndef _LARGEFILE_SOURCE
33
34
#define _LARGEFILE_SOURCE
36
#ifndef _FILE_OFFSET_BITS
34
37
#define _FILE_OFFSET_BITS 64
36
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
38
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
39
stdout, ferror(), sscanf(),
43
stdout, ferror(), remove() */
41
44
#include <stdint.h> /* uint16_t, uint32_t */
42
45
#include <stddef.h> /* NULL, size_t, ssize_t */
43
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
45
#include <stdbool.h> /* bool, true */
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
48
#include <stdbool.h> /* bool, false, true */
46
49
#include <string.h> /* memset(), strcmp(), strlen(),
47
50
strerror(), asprintf(), strcpy() */
48
#include <sys/ioctl.h> /* ioctl */
51
#include <sys/ioctl.h> /* ioctl */
49
52
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
50
53
sockaddr_in6, PF_INET6,
51
SOCK_STREAM, INET6_ADDRSTRLEN,
52
uid_t, gid_t, open(), opendir(),
54
SOCK_STREAM, uid_t, gid_t, open(),
54
56
#include <sys/stat.h> /* open() */
55
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
56
struct in6_addr, inet_pton(),
58
inet_pton(), connect() */
58
59
#include <fcntl.h> /* open() */
59
60
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
#include <inttypes.h> /* PRIu16, intmax_t, SCNdMAX */
62
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
62
64
#include <assert.h> /* assert() */
63
65
#include <errno.h> /* perror(), errno */
64
#include <time.h> /* time() */
66
#include <time.h> /* nanosleep(), time() */
65
67
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
66
68
SIOCSIFFLAGS, if_indextoname(),
67
69
if_nametoindex(), IF_NAMESIZE */
68
#include <netinet/in.h>
70
#include <netinet/in.h> /* IN6_IS_ADDR_LINKLOCAL,
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
69
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
70
getuid(), getgid(), setuid(),
74
getuid(), getgid(), seteuid(),
72
76
#include <arpa/inet.h> /* inet_pton(), htons */
73
#include <iso646.h> /* not, and, or */
77
#include <iso646.h> /* not, or, and */
74
78
#include <argp.h> /* struct argp_option, error_t, struct
75
79
argp_state, struct argp,
76
80
argp_parse(), ARGP_KEY_ARG,
77
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sig_atomic_t,
85
#include <sysexits.h> /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
86
EX_NOHOST, EX_IOERR, EX_PROTOCOL */
89
#include <sys/klog.h> /* klogctl() */
90
#endif /* __linux__ */
80
93
/* All Avahi types, constants and functions
1009
/* stop main loop after sigterm has been called */
1010
static void handle_sigterm(int sig){
1015
signal_received = sig;
1016
int old_errno = errno;
1017
if(mc.simple_poll != NULL){
1018
avahi_simple_poll_quit(mc.simple_poll);
821
1023
int main(int argc, char *argv[]){
822
AvahiSServiceBrowser *sb = NULL;
827
int exitcode = EXIT_SUCCESS;
828
const char *interface = "eth0";
829
struct ifreq network;
833
char *connect_to = NULL;
834
char tempdir[] = "/tmp/mandosXXXXXX";
835
bool tempdir_created = false;
836
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
837
const char *seckey = PATHDIR "/" SECKEY;
838
const char *pubkey = PATHDIR "/" PUBKEY;
840
mandos_context mc = { .simple_poll = NULL, .server = NULL,
841
.dh_bits = 1024, .priority = "SECURE256"
842
":!CTYPE-X.509:+CTYPE-OPENPGP" };
843
bool gnutls_initialized = false;
844
bool gpgme_initialized = false;
847
struct argp_option options[] = {
848
{ .name = "debug", .key = 128,
849
.doc = "Debug mode", .group = 3 },
850
{ .name = "connect", .key = 'c',
851
.arg = "ADDRESS:PORT",
852
.doc = "Connect directly to a specific Mandos server",
854
{ .name = "interface", .key = 'i',
856
.doc = "Interface that will be used to search for Mandos"
859
{ .name = "seckey", .key = 's',
861
.doc = "OpenPGP secret key file base name",
863
{ .name = "pubkey", .key = 'p',
865
.doc = "OpenPGP public key file base name",
867
{ .name = "dh-bits", .key = 129,
869
.doc = "Bit length of the prime number used in the"
870
" Diffie-Hellman key exchange",
872
{ .name = "priority", .key = 130,
874
.doc = "GnuTLS priority string for the TLS handshake",
879
error_t parse_opt(int key, char *arg,
880
struct argp_state *state) {
882
case 128: /* --debug */
885
case 'c': /* --connect */
888
case 'i': /* --interface */
891
case 's': /* --seckey */
894
case 'p': /* --pubkey */
897
case 129: /* --dh-bits */
898
ret = sscanf(arg, "%" SCNdMAX "%n", &tmpmax, &numchars);
899
if(ret < 1 or tmpmax != (typeof(mc.dh_bits))tmpmax
900
or arg[numchars] != '\0'){
901
fprintf(stderr, "Bad number of DH bits\n");
904
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
906
case 130: /* --priority */
914
return ARGP_ERR_UNKNOWN;
919
struct argp argp = { .options = options, .parser = parse_opt,
921
.doc = "Mandos client -- Get and decrypt"
922
" passwords from a Mandos server" };
923
ret = argp_parse(&argp, argc, argv, 0, 0, NULL);
924
if(ret == ARGP_ERR_UNKNOWN){
925
fprintf(stderr, "Unknown error while parsing arguments\n");
926
exitcode = EXIT_FAILURE;
931
/* If the interface is down, bring it up */
933
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
936
exitcode = EXIT_FAILURE;
939
strcpy(network.ifr_name, interface);
940
ret = ioctl(sd, SIOCGIFFLAGS, &network);
942
perror("ioctl SIOCGIFFLAGS");
943
exitcode = EXIT_FAILURE;
946
if((network.ifr_flags & IFF_UP) == 0){
947
network.ifr_flags |= IFF_UP;
948
ret = ioctl(sd, SIOCSIFFLAGS, &network);
950
perror("ioctl SIOCSIFFLAGS");
951
exitcode = EXIT_FAILURE;
955
ret = (int)TEMP_FAILURE_RETRY(close(sd));
974
ret = init_gnutls_global(&mc, pubkey, seckey);
976
fprintf(stderr, "init_gnutls_global failed\n");
977
exitcode = EXIT_FAILURE;
980
gnutls_initialized = true;
983
if(mkdtemp(tempdir) == NULL){
987
tempdir_created = true;
989
if(not init_gpgme(&mc, pubkey, seckey, tempdir)){
990
fprintf(stderr, "init_gpgme failed\n");
991
exitcode = EXIT_FAILURE;
994
gpgme_initialized = true;
1024
AvahiSServiceBrowser *sb = NULL;
1029
int exitcode = EXIT_SUCCESS;
1030
const char *interface = "eth0";
1031
struct ifreq network;
1033
bool take_down_interface = false;
1036
char *connect_to = NULL;
1037
char tempdir[] = "/tmp/mandosXXXXXX";
1038
bool tempdir_created = false;
1039
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1040
const char *seckey = PATHDIR "/" SECKEY;
1041
const char *pubkey = PATHDIR "/" PUBKEY;
1043
bool gnutls_initialized = false;
1044
bool gpgme_initialized = false;
1047
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
1048
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
1053
/* Lower any group privileges we might have, just to be safe */
1060
/* Lower user privileges (temporarily) */
1072
struct argp_option options[] = {
1073
{ .name = "debug", .key = 128,
1074
.doc = "Debug mode", .group = 3 },
1075
{ .name = "connect", .key = 'c',
1076
.arg = "ADDRESS:PORT",
1077
.doc = "Connect directly to a specific Mandos server",
1079
{ .name = "interface", .key = 'i',
1081
.doc = "Network interface that will be used to search for"
1084
{ .name = "seckey", .key = 's',
1086
.doc = "OpenPGP secret key file base name",
1088
{ .name = "pubkey", .key = 'p',
1090
.doc = "OpenPGP public key file base name",
1092
{ .name = "dh-bits", .key = 129,
1094
.doc = "Bit length of the prime number used in the"
1095
" Diffie-Hellman key exchange",
1097
{ .name = "priority", .key = 130,
1099
.doc = "GnuTLS priority string for the TLS handshake",
1101
{ .name = "delay", .key = 131,
1103
.doc = "Maximum delay to wait for interface startup",
1106
* These reproduce what we would get without ARGP_NO_HELP
1108
{ .name = "help", .key = '?',
1109
.doc = "Give this help list", .group = -1 },
1110
{ .name = "usage", .key = -3,
1111
.doc = "Give a short usage message", .group = -1 },
1112
{ .name = "version", .key = 'V',
1113
.doc = "Print program version", .group = -1 },
1117
error_t parse_opt(int key, char *arg,
1118
struct argp_state *state){
1121
case 128: /* --debug */
1124
case 'c': /* --connect */
1127
case 'i': /* --interface */
1130
case 's': /* --seckey */
1133
case 'p': /* --pubkey */
1136
case 129: /* --dh-bits */
1138
tmpmax = strtoimax(arg, &tmp, 10);
1139
if(errno != 0 or tmp == arg or *tmp != '\0'
1140
or tmpmax != (typeof(mc.dh_bits))tmpmax){
1141
argp_error(state, "Bad number of DH bits");
1143
mc.dh_bits = (typeof(mc.dh_bits))tmpmax;
1145
case 130: /* --priority */
1148
case 131: /* --delay */
1150
delay = strtof(arg, &tmp);
1151
if(errno != 0 or tmp == arg or *tmp != '\0'){
1152
argp_error(state, "Bad delay");
1156
* These reproduce what we would get without ARGP_NO_HELP
1158
case '?': /* --help */
1159
argp_state_help(state, state->out_stream,
1160
(ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
1161
& ~(unsigned int)ARGP_HELP_EXIT_OK);
1162
case -3: /* --usage */
1163
argp_state_help(state, state->out_stream,
1164
ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
1165
case 'V': /* --version */
1166
fprintf(state->out_stream, "%s\n", argp_program_version);
1167
exit(argp_err_exit_status);
1170
return ARGP_ERR_UNKNOWN;
1175
struct argp argp = { .options = options, .parser = parse_opt,
1177
.doc = "Mandos client -- Get and decrypt"
1178
" passwords from a Mandos server" };
1179
ret = argp_parse(&argp, argc, argv,
1180
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
1187
perror("argp_parse");
1188
exitcode = EX_OSERR;
1191
exitcode = EX_USAGE;
1197
avahi_set_log_function(empty_log);
1200
/* Initialize Avahi early so avahi_simple_poll_quit() can be called
1201
from the signal handler */
1202
/* Initialize the pseudo-RNG for Avahi */
1203
srand((unsigned int) time(NULL));
1204
mc.simple_poll = avahi_simple_poll_new();
1205
if(mc.simple_poll == NULL){
1206
fprintf(stderr, "Avahi: Failed to create simple poll object.\n");
1207
exitcode = EX_UNAVAILABLE;
1211
sigemptyset(&sigterm_action.sa_mask);
1212
ret = sigaddset(&sigterm_action.sa_mask, SIGINT);
1214
perror("sigaddset");
1215
exitcode = EX_OSERR;
1218
ret = sigaddset(&sigterm_action.sa_mask, SIGHUP);
1220
perror("sigaddset");
1221
exitcode = EX_OSERR;
1224
ret = sigaddset(&sigterm_action.sa_mask, SIGTERM);
1226
perror("sigaddset");
1227
exitcode = EX_OSERR;
1230
/* Need to check if the handler is SIG_IGN before handling:
1231
| [[info:libc:Initial Signal Actions]] |
1232
| [[info:libc:Basic Signal Handling]] |
1234
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1236
perror("sigaction");
1239
if(old_sigterm_action.sa_handler != SIG_IGN){
1240
ret = sigaction(SIGINT, &sigterm_action, NULL);
1242
perror("sigaction");
1243
exitcode = EX_OSERR;
1247
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1249
perror("sigaction");
1252
if(old_sigterm_action.sa_handler != SIG_IGN){
1253
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1255
perror("sigaction");
1256
exitcode = EX_OSERR;
1260
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1262
perror("sigaction");
1265
if(old_sigterm_action.sa_handler != SIG_IGN){
1266
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1268
perror("sigaction");
1269
exitcode = EX_OSERR;
1274
/* If the interface is down, bring it up */
1275
if(interface[0] != '\0'){
997
1276
if_index = (AvahiIfIndex) if_nametoindex(interface);
998
1277
if(if_index == 0){
999
1278
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1000
exitcode = EXIT_FAILURE;
1004
if(connect_to != NULL){
1005
/* Connect directly, do not use Zeroconf */
1006
/* (Mainly meant for debugging) */
1007
char *address = strrchr(connect_to, ':');
1008
if(address == NULL){
1009
fprintf(stderr, "No colon in address\n");
1010
exitcode = EXIT_FAILURE;
1014
ret = sscanf(address+1, "%" SCNdMAX "%n", &tmpmax, &numchars);
1015
if(ret < 1 or tmpmax != (uint16_t)tmpmax
1016
or address[numchars+1] != '\0'){
1017
fprintf(stderr, "Bad port number\n");
1018
exitcode = EXIT_FAILURE;
1021
port = (uint16_t)tmpmax;
1023
address = connect_to;
1024
ret = start_mandos_communication(address, port, if_index, &mc);
1026
exitcode = EXIT_FAILURE;
1028
exitcode = EXIT_SUCCESS;
1034
avahi_set_log_function(empty_log);
1037
/* Initialize the pseudo-RNG for Avahi */
1038
srand((unsigned int) time(NULL));
1040
/* Allocate main Avahi loop object */
1041
mc.simple_poll = avahi_simple_poll_new();
1042
if(mc.simple_poll == NULL) {
1043
fprintf(stderr, "Avahi: Failed to create simple poll"
1045
exitcode = EXIT_FAILURE;
1050
AvahiServerConfig config;
1051
/* Do not publish any local Zeroconf records */
1052
avahi_server_config_init(&config);
1053
config.publish_hinfo = 0;
1054
config.publish_addresses = 0;
1055
config.publish_workstation = 0;
1056
config.publish_domain = 0;
1058
/* Allocate a new server */
1059
mc.server = avahi_server_new(avahi_simple_poll_get
1060
(mc.simple_poll), &config, NULL,
1063
/* Free the Avahi configuration data */
1064
avahi_server_config_free(&config);
1067
/* Check if creating the Avahi server object succeeded */
1068
if(mc.server == NULL) {
1069
fprintf(stderr, "Failed to create Avahi server: %s\n",
1070
avahi_strerror(error));
1071
exitcode = EXIT_FAILURE;
1075
/* Create the Avahi service browser */
1076
sb = avahi_s_service_browser_new(mc.server, if_index,
1078
"_mandos._tcp", NULL, 0,
1079
browse_callback, &mc);
1081
fprintf(stderr, "Failed to create service browser: %s\n",
1082
avahi_strerror(avahi_server_errno(mc.server)));
1083
exitcode = EXIT_FAILURE;
1087
/* Run the main loop */
1090
fprintf(stderr, "Starting Avahi loop search\n");
1093
avahi_simple_poll_loop(mc.simple_poll);
1279
exitcode = EX_UNAVAILABLE;
1287
/* Re-raise priviliges */
1295
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1296
messages about the network interface to mess up the prompt */
1297
ret = klogctl(8, NULL, 5);
1298
bool restore_loglevel = true;
1300
restore_loglevel = false;
1303
#endif /* __linux__ */
1305
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1308
exitcode = EX_OSERR;
1310
if(restore_loglevel){
1311
ret = klogctl(7, NULL, 0);
1316
#endif /* __linux__ */
1317
/* Lower privileges */
1325
strcpy(network.ifr_name, interface);
1326
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1328
perror("ioctl SIOCGIFFLAGS");
1330
if(restore_loglevel){
1331
ret = klogctl(7, NULL, 0);
1336
#endif /* __linux__ */
1337
exitcode = EX_OSERR;
1338
/* Lower privileges */
1346
if((network.ifr_flags & IFF_UP) == 0){
1347
network.ifr_flags |= IFF_UP;
1348
take_down_interface = true;
1349
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1351
take_down_interface = false;
1352
perror("ioctl SIOCSIFFLAGS");
1353
exitcode = EX_OSERR;
1355
if(restore_loglevel){
1356
ret = klogctl(7, NULL, 0);
1361
#endif /* __linux__ */
1362
/* Lower privileges */
1371
/* sleep checking until interface is running */
1372
for(int i=0; i < delay * 4; i++){
1373
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1375
perror("ioctl SIOCGIFFLAGS");
1376
} else if(network.ifr_flags & IFF_RUNNING){
1379
struct timespec sleeptime = { .tv_nsec = 250000000 };
1380
ret = nanosleep(&sleeptime, NULL);
1381
if(ret == -1 and errno != EINTR){
1382
perror("nanosleep");
1385
if(not take_down_interface){
1386
/* We won't need the socket anymore */
1387
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1393
if(restore_loglevel){
1394
/* Restores kernel loglevel to default */
1395
ret = klogctl(7, NULL, 0);
1400
#endif /* __linux__ */
1401
/* Lower privileges */
1403
if(take_down_interface){
1404
/* Lower privileges */
1410
/* Lower privileges permanently */
1422
ret = init_gnutls_global(pubkey, seckey);
1424
fprintf(stderr, "init_gnutls_global failed\n");
1425
exitcode = EX_UNAVAILABLE;
1428
gnutls_initialized = true;
1435
tempdir_created = true;
1436
if(mkdtemp(tempdir) == NULL){
1437
tempdir_created = false;
1446
if(not init_gpgme(pubkey, seckey, tempdir)){
1447
fprintf(stderr, "init_gpgme failed\n");
1448
exitcode = EX_UNAVAILABLE;
1451
gpgme_initialized = true;
1458
if(connect_to != NULL){
1459
/* Connect directly, do not use Zeroconf */
1460
/* (Mainly meant for debugging) */
1461
char *address = strrchr(connect_to, ':');
1462
if(address == NULL){
1463
fprintf(stderr, "No colon in address\n");
1464
exitcode = EX_USAGE;
1474
tmpmax = strtoimax(address+1, &tmp, 10);
1475
if(errno != 0 or tmp == address+1 or *tmp != '\0'
1476
or tmpmax != (uint16_t)tmpmax){
1477
fprintf(stderr, "Bad port number\n");
1478
exitcode = EX_USAGE;
1486
port = (uint16_t)tmpmax;
1488
address = connect_to;
1489
/* Colon in address indicates IPv6 */
1491
if(strchr(address, ':') != NULL){
1501
ret = start_mandos_communication(address, port, if_index, af);
1507
exitcode = EX_NOHOST;
1510
exitcode = EX_USAGE;
1513
exitcode = EX_IOERR;
1516
exitcode = EX_PROTOCOL;
1519
exitcode = EX_OSERR;
1523
exitcode = EXIT_SUCCESS;
1533
AvahiServerConfig config;
1534
/* Do not publish any local Zeroconf records */
1535
avahi_server_config_init(&config);
1536
config.publish_hinfo = 0;
1537
config.publish_addresses = 0;
1538
config.publish_workstation = 0;
1539
config.publish_domain = 0;
1541
/* Allocate a new server */
1542
mc.server = avahi_server_new(avahi_simple_poll_get
1543
(mc.simple_poll), &config, NULL,
1546
/* Free the Avahi configuration data */
1547
avahi_server_config_free(&config);
1550
/* Check if creating the Avahi server object succeeded */
1551
if(mc.server == NULL){
1552
fprintf(stderr, "Failed to create Avahi server: %s\n",
1553
avahi_strerror(error));
1554
exitcode = EX_UNAVAILABLE;
1562
/* Create the Avahi service browser */
1563
sb = avahi_s_service_browser_new(mc.server, if_index,
1564
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1565
NULL, 0, browse_callback, NULL);
1567
fprintf(stderr, "Failed to create service browser: %s\n",
1568
avahi_strerror(avahi_server_errno(mc.server)));
1569
exitcode = EX_UNAVAILABLE;
1577
/* Run the main loop */
1580
fprintf(stderr, "Starting Avahi loop search\n");
1583
avahi_simple_poll_loop(mc.simple_poll);
1098
fprintf(stderr, "%s exiting\n", argv[0]);
1101
/* Cleanup things */
1103
avahi_s_service_browser_free(sb);
1105
if(mc.server != NULL)
1106
avahi_server_free(mc.server);
1108
if(mc.simple_poll != NULL)
1109
avahi_simple_poll_free(mc.simple_poll);
1111
if(gnutls_initialized){
1112
gnutls_certificate_free_credentials(mc.cred);
1113
gnutls_global_deinit();
1114
gnutls_dh_params_deinit(mc.dh_params);
1117
if(gpgme_initialized){
1118
gpgme_release(mc.ctx);
1121
/* Removes the temp directory used by GPGME */
1122
if(tempdir_created){
1124
struct dirent *direntry;
1125
d = opendir(tempdir);
1127
if(errno != ENOENT){
1132
direntry = readdir(d);
1133
if(direntry == NULL){
1136
/* Skip "." and ".." */
1137
if(direntry->d_name[0] == '.'
1138
and (direntry->d_name[1] == '\0'
1139
or (direntry->d_name[1] == '.'
1140
and direntry->d_name[2] == '\0'))){
1143
char *fullname = NULL;
1144
ret = asprintf(&fullname, "%s/%s", tempdir,
1150
ret = remove(fullname);
1152
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1159
ret = rmdir(tempdir);
1160
if(ret == -1 and errno != ENOENT){
1588
fprintf(stderr, "%s exiting\n", argv[0]);
1591
/* Cleanup things */
1593
avahi_s_service_browser_free(sb);
1595
if(mc.server != NULL)
1596
avahi_server_free(mc.server);
1598
if(mc.simple_poll != NULL)
1599
avahi_simple_poll_free(mc.simple_poll);
1601
if(gnutls_initialized){
1602
gnutls_certificate_free_credentials(mc.cred);
1603
gnutls_global_deinit();
1604
gnutls_dh_params_deinit(mc.dh_params);
1607
if(gpgme_initialized){
1608
gpgme_release(mc.ctx);
1611
/* Take down the network interface */
1612
if(take_down_interface){
1613
/* Re-raise priviliges */
1620
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1622
perror("ioctl SIOCGIFFLAGS");
1623
} else if(network.ifr_flags & IFF_UP) {
1624
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1625
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1627
perror("ioctl SIOCSIFFLAGS");
1630
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1634
/* Lower privileges permanently */
1643
/* Removes the temp directory used by GPGME */
1644
if(tempdir_created){
1646
struct dirent *direntry;
1647
d = opendir(tempdir);
1649
if(errno != ENOENT){
1654
direntry = readdir(d);
1655
if(direntry == NULL){
1658
/* Skip "." and ".." */
1659
if(direntry->d_name[0] == '.'
1660
and (direntry->d_name[1] == '\0'
1661
or (direntry->d_name[1] == '.'
1662
and direntry->d_name[2] == '\0'))){
1665
char *fullname = NULL;
1666
ret = asprintf(&fullname, "%s/%s", tempdir,
1672
ret = remove(fullname);
1674
fprintf(stderr, "remove(\"%s\"): %s\n", fullname,
1681
ret = rmdir(tempdir);
1682
if(ret == -1 and errno != ENOENT){
1688
sigemptyset(&old_sigterm_action.sa_mask);
1689
old_sigterm_action.sa_handler = SIG_DFL;
1690
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1691
&old_sigterm_action,
1694
perror("sigaction");
1697
ret = raise(signal_received);
1698
} while(ret != 0 and errno == EINTR);
1703
TEMP_FAILURE_RETRY(pause());