47
47
strtof(), abort() */
48
48
#include <stdbool.h> /* bool, false, true */
49
49
#include <string.h> /* strcmp(), strlen(), strerror(),
50
asprintf(), strncpy() */
50
asprintf(), strncpy(), strsignal()
51
52
#include <sys/ioctl.h> /* ioctl */
52
53
#include <sys/types.h> /* socket(), inet_pton(), sockaddr,
53
54
sockaddr_in6, PF_INET6,
57
58
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
59
inet_pton(), connect(),
60
#include <fcntl.h> /* open(), unlinkat() */
61
#include <fcntl.h> /* open(), unlinkat(), AT_REMOVEDIR */
61
62
#include <dirent.h> /* opendir(), struct dirent, readdir()
63
64
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
65
#include <errno.h> /* perror(), errno,
66
#include <errno.h> /* perror(), errno, EINTR, EINVAL,
67
EAI_SYSTEM, ENETUNREACH,
68
EHOSTUNREACH, ECONNREFUSED, EPROTO,
69
EIO, ENOENT, ENXIO, ENOMEM, EISDIR,
66
71
program_invocation_short_name */
67
72
#include <time.h> /* nanosleep(), time(), sleep() */
68
73
#include <net/if.h> /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
513
518
fprintf_plus(stderr, "GnuTLS: %s", string);
516
__attribute__((nonnull, warn_unused_result))
521
__attribute__((nonnull(1, 2, 4), warn_unused_result))
517
522
static int init_gnutls_global(const char *pubkeyfilename,
518
523
const char *seckeyfilename,
519
524
const char *dhparamsfilename,
525
530
fprintf_plus(stderr, "Initializing GnuTLS\n");
528
ret = gnutls_global_init();
529
if(ret != GNUTLS_E_SUCCESS){
530
fprintf_plus(stderr, "GnuTLS global_init: %s\n",
531
safer_gnutls_strerror(ret));
536
534
/* "Use a log level over 10 to enable all debugging options."
537
535
* - GnuTLS manual
823
819
/* Set effective uid to 0, return errno */
824
820
__attribute__((warn_unused_result))
825
error_t raise_privileges(void){
826
error_t old_errno = errno;
827
error_t ret_errno = 0;
821
int raise_privileges(void){
822
int old_errno = errno;
828
824
if(seteuid(0) == -1){
831
827
errno = old_errno;
835
831
/* Set effective and real user ID to 0. Return errno. */
836
832
__attribute__((warn_unused_result))
837
error_t raise_privileges_permanently(void){
838
error_t old_errno = errno;
839
error_t ret_errno = raise_privileges();
833
int raise_privileges_permanently(void){
834
int old_errno = errno;
835
int ret = raise_privileges();
841
837
errno = old_errno;
844
840
if(setuid(0) == -1){
847
843
errno = old_errno;
851
847
/* Set effective user ID to unprivileged saved user ID */
852
848
__attribute__((warn_unused_result))
853
error_t lower_privileges(void){
854
error_t old_errno = errno;
855
error_t ret_errno = 0;
849
int lower_privileges(void){
850
int old_errno = errno;
856
852
if(seteuid(uid) == -1){
859
855
errno = old_errno;
863
859
/* Lower privileges permanently */
864
860
__attribute__((warn_unused_result))
865
error_t lower_privileges_permanently(void){
866
error_t old_errno = errno;
867
error_t ret_errno = 0;
861
int lower_privileges_permanently(void){
862
int old_errno = errno;
868
864
if(setuid(uid) == -1){
871
867
errno = old_errno;
875
871
/* Helper function to add_local_route() and delete_local_route() */
2469
2478
.args_doc = "",
2470
2479
.doc = "Mandos client -- Get and decrypt"
2471
2480
" passwords from a Mandos server" };
2472
ret = argp_parse(&argp, argc, argv,
2473
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2481
ret_errno = argp_parse(&argp, argc, argv,
2482
ARGP_IN_ORDER | ARGP_NO_HELP, 0, NULL);
2480
2489
perror_plus("argp_parse");
2481
2490
exitcode = EX_OSERR;
2900
2909
/* Allocate a new server */
2901
2910
mc.server = avahi_server_new(avahi_simple_poll_get(simple_poll),
2902
&config, NULL, NULL, &ret_errno);
2911
&config, NULL, NULL, &ret);
2904
2913
/* Free the Avahi configuration data */
2905
2914
avahi_server_config_free(&config);
2952
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2961
if(signal_received){
2962
fprintf_plus(stderr, "%s exiting due to signal %d: %s\n",
2963
argv[0], signal_received,
2964
strsignal(signal_received));
2966
fprintf_plus(stderr, "%s exiting\n", argv[0]);
2955
2970
/* Cleanup things */
3034
3048
free(interfaces_to_take_down);
3035
3049
free(interfaces_hooks);
3051
void clean_dir_at(int base, const char * const dirname,
3053
struct dirent **direntries = NULL;
3055
int dir_fd = (int)TEMP_FAILURE_RETRY(openat(base, dirname,
3061
perror_plus("open");
3063
int numentries = scandirat(dir_fd, ".", &direntries,
3064
notdotentries, alphasort);
3065
if(numentries >= 0){
3066
for(int i = 0; i < numentries; i++){
3068
fprintf_plus(stderr, "Unlinking \"%s/%s\"\n",
3069
dirname, direntries[i]->d_name);
3071
dret = unlinkat(dir_fd, direntries[i]->d_name, 0);
3073
if(errno == EISDIR){
3074
dret = unlinkat(dir_fd, direntries[i]->d_name,
3077
if((dret == -1) and (errno == ENOTEMPTY)
3078
and (strcmp(direntries[i]->d_name, "private-keys-v1.d")
3079
== 0) and (level == 0)){
3080
/* Recurse only in this special case */
3081
clean_dir_at(dir_fd, direntries[i]->d_name, level+1);
3085
fprintf_plus(stderr, "unlink(\"%s/%s\"): %s\n", dirname,
3086
direntries[i]->d_name, strerror(errno));
3089
free(direntries[i]);
3092
/* need to clean even if 0 because man page doesn't specify */
3094
if(numentries == -1){
3095
perror_plus("scandirat");
3097
dret = unlinkat(base, dirname, AT_REMOVEDIR);
3098
if(dret == -1 and errno != ENOENT){
3099
perror_plus("rmdir");
3102
perror_plus("scandirat");
3037
3107
/* Removes the GPGME temp directory and all files inside */
3038
3108
if(tempdir != NULL){
3039
struct dirent **direntries = NULL;
3040
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY
3044
if(tempdir_fd == -1){
3045
perror_plus("open");
3047
int numentries = scandirat(tempdir_fd, ".", &direntries,
3048
notdotentries, alphasort);
3049
if(numentries >= 0){
3050
for(int i = 0; i < numentries; i++){
3051
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
3053
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
3054
" \"%s\", 0): %s\n", tempdir,
3055
direntries[i]->d_name, strerror(errno));
3057
free(direntries[i]);
3060
/* need to clean even if 0 because man page doesn't specify */
3062
if(numentries == -1){
3063
perror_plus("scandir");
3065
ret = rmdir(tempdir);
3066
if(ret == -1 and errno != ENOENT){
3067
perror_plus("rmdir");
3109
clean_dir_at(-1, tempdir, 0);