57
58
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
59
inet_pton(), connect(),
60
#include <fcntl.h> /* open(), unlinkat() */
61
#include <fcntl.h> /* open(), unlinkat(), AT_REMOVEDIR */
61
62
#include <dirent.h> /* opendir(), struct dirent, readdir()
63
64
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
65
#include <errno.h> /* perror(), errno,
66
#include <errno.h> /* perror(), errno, EINTR, EINVAL,
67
EAI_SYSTEM, ENETUNREACH,
68
EHOSTUNREACH, ECONNREFUSED, EPROTO,
69
EIO, ENOENT, ENXIO, ENOMEM, EISDIR,
66
71
program_invocation_short_name */
67
72
#include <time.h> /* nanosleep(), time(), sleep() */
68
73
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
513
518
fprintf_plus(stderr, "GnuTLS: %s", string);
516
__attribute__((nonnull, warn_unused_result))
521
__attribute__((nonnull(1, 2, 4), warn_unused_result))
517
522
static int init_gnutls_global(const char *pubkeyfilename,
518
523
const char *seckeyfilename,
519
524
const char *dhparamsfilename,
823
819
/* Set effective uid to 0, return errno */
824
820
__attribute__((warn_unused_result))
825
error_t raise_privileges(void){
826
error_t old_errno = errno;
827
error_t ret_errno = 0;
821
int raise_privileges(void){
822
int old_errno = errno;
828
824
if(seteuid(0) == -1){
831
827
errno = old_errno;
835
831
/* Set effective and real user ID to 0. Return errno. */
836
832
__attribute__((warn_unused_result))
837
error_t raise_privileges_permanently(void){
838
error_t old_errno = errno;
839
error_t ret_errno = raise_privileges();
833
int raise_privileges_permanently(void){
834
int old_errno = errno;
835
int ret = raise_privileges();
841
837
errno = old_errno;
844
840
if(setuid(0) == -1){
847
843
errno = old_errno;
851
847
/* Set effective user ID to unprivileged saved user ID */
852
848
__attribute__((warn_unused_result))
853
error_t lower_privileges(void){
854
error_t old_errno = errno;
855
error_t ret_errno = 0;
849
int lower_privileges(void){
850
int old_errno = errno;
856
852
if(seteuid(uid) == -1){
859
855
errno = old_errno;
863
859
/* Lower privileges permanently */
864
860
__attribute__((warn_unused_result))
865
error_t lower_privileges_permanently(void){
866
error_t old_errno = errno;
867
error_t ret_errno = 0;
861
int lower_privileges_permanently(void){
862
int old_errno = errno;
868
864
if(setuid(uid) == -1){
871
867
errno = old_errno;
875
871
/* Helper function to add_local_route() and delete_local_route() */
1627
1635
__attribute__((nonnull, warn_unused_result))
1628
1636
bool get_flags(const char *ifname, struct ifreq *ifr){
1632
1640
int s = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1635
1643
perror_plus("socket");
1639
strcpy(ifr->ifr_name, ifname);
1647
strncpy(ifr->ifr_name, ifname, IF_NAMESIZE);
1648
ifr->ifr_name[IF_NAMESIZE-1] = '\0'; /* NUL terminate */
1640
1649
ret = ioctl(s, SIOCGIFFLAGS, ifr);
1644
1653
perror_plus("ioctl SIOCGIFFLAGS");
1916
#if __GLIBC_PREREQ(2, 15)
1917
1924
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1918
1925
runnable_hook, alphasort);
1919
#else /* not __GLIBC_PREREQ(2, 15) */
1920
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1922
#endif /* not __GLIBC_PREREQ(2, 15) */
1923
#else /* not __GLIBC__ */
1924
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1926
#endif /* not __GLIBC__ */
1927
1926
if(numhooks == -1){
1928
1927
perror_plus("scandir");
2288
2289
int main(int argc, char *argv[]){
2289
2290
mandos_context mc = { .server = NULL, .dh_bits = 0,
2290
.priority = "SECURE256:!CTYPE-X.509:"
2291
"+CTYPE-OPENPGP:!RSA", .current_server = NULL,
2292
.interfaces = NULL, .interfaces_size = 0 };
2291
.priority = "SECURE256:!CTYPE-X.509"
2292
":+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256",
2293
.current_server = NULL, .interfaces = NULL,
2294
.interfaces_size = 0 };
2293
2295
AvahiSServiceBrowser *sb = NULL;
2294
2296
error_t ret_errno;
2476
2478
.args_doc = "",
2477
2479
.doc = "Mandos client -- Get and decrypt"
2478
2480
" passwords from a Mandos server" };
2479
ret = argp_parse(&argp, argc, argv,
2480
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2481
ret_errno = argp_parse(&argp, argc, argv,
2482
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2487
2489
perror_plus("argp_parse");
2488
2490
exitcode = EX_OSERR;
3040
3048
free(interfaces_to_take_down);
3041
3049
free(interfaces_hooks);
3051
void clean_dir_at(int base, const char * const dirname,
3053
struct dirent **direntries = NULL;
3055
int dir_fd = (int)TEMP_FAILURE_RETRY(openat(base, dirname,
3061
perror_plus("open");
3063
int numentries = scandirat(dir_fd, ".", &direntries,
3064
notdotentries, alphasort);
3065
if(numentries >= 0){
3066
for(int i = 0; i < numentries; i++){
3068
fprintf_plus(stderr, "Unlinking \"%s/%s\"\n",
3069
dirname, direntries[i]->d_name);
3071
dret = unlinkat(dir_fd, direntries[i]->d_name, 0);
3073
if(errno == EISDIR){
3074
dret = unlinkat(dir_fd, direntries[i]->d_name,
3077
if((dret == -1) and (errno == ENOTEMPTY)
3078
and (strcmp(direntries[i]->d_name, "private-keys-v1.d")
3079
== 0) and (level == 0)){
3080
/* Recurse only in this special case */
3081
clean_dir_at(dir_fd, direntries[i]->d_name, level+1);
3085
fprintf_plus(stderr, "unlink(\"%s/%s\"): %s\n", dirname,
3086
direntries[i]->d_name, strerror(errno));
3089
free(direntries[i]);
3092
/* need to clean even if 0 because man page doesn't specify */
3094
if(numentries == -1){
3095
perror_plus("scandirat");
3097
dret = unlinkat(base, dirname, AT_REMOVEDIR);
3098
if(dret == -1 and errno != ENOENT){
3099
perror_plus("rmdir");
3102
perror_plus("scandirat");
3043
3107
/* Removes the GPGME temp directory and all files inside */
3044
3108
if(tempdir != NULL){
3045
struct dirent **direntries = NULL;
3046
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY
3050
if(tempdir_fd == -1){
3051
perror_plus("open");
3054
#if __GLIBC_PREREQ(2, 15)
3055
int numentries = scandirat(tempdir_fd, ".", &direntries,
3056
notdotentries, alphasort);
3057
#else /* not __GLIBC_PREREQ(2, 15) */
3058
int numentries = scandir(tempdir, &direntries, notdotentries,
3060
#endif /* not __GLIBC_PREREQ(2, 15) */
3061
#else /* not __GLIBC__ */
3062
int numentries = scandir(tempdir, &direntries, notdotentries,
3064
#endif /* not __GLIBC__ */
3065
if(numentries >= 0){
3066
for(int i = 0; i < numentries; i++){
3067
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
3069
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
3070
" \"%s\", 0): %s\n", tempdir,
3071
direntries[i]->d_name, strerror(errno));
3073
free(direntries[i]);
3076
/* need to clean even if 0 because man page doesn't specify */
3078
if(numentries == -1){
3079
perror_plus("scandir");
3081
ret = rmdir(tempdir);
3082
if(ret == -1 and errno != ENOENT){
3083
perror_plus("rmdir");
3086
TEMP_FAILURE_RETRY(close(tempdir_fd));
3109
clean_dir_at(-1, tempdir, 0);