To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 390
- compare with another revision
- download diff
- download tarball
- view history from revision 390
- Committer: Teddy Hogeborn
- Date: 2009-10-18 16:09:05 UTC
- Revision ID: teddy@fukt.bsnet.se-20091018160905-ep07o5cwedsegz9x
* plugins.d/askpass-fifo.c: Do close(STDOUT_FILENO) before exiting to
check its return code. Use exit codes
from <sysexits.h>.
* plugins.d/splashy.c: Use exit codes from <sysexits.h> in the fork to
exec the "splashy_update" command.
check its return code. Use exit codes
from <sysexits.h>.
* plugins.d/splashy.c: Use exit codes from <sysexits.h> in the fork to
exec the "splashy_update" command.
- files modified:
- Makefile
added
removed
plugins.d/mandos-client.c
44
44
#include <stdint.h> /* uint16_t, uint32_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, EXIT_FAILURE,
47
srand(), strtof() */
47
srand(), strtof(), abort() */
48
48
#include <stdbool.h> /* bool, false, true */
49
49
#include <string.h> /* memset(), strcmp(), strlen(),
50
50
strerror(), asprintf(), strcpy() */
71
71
INET_ADDRSTRLEN, INET6_ADDRSTRLEN
72
72
*/
73
73
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
getuid(), getgid(), setuid(),
75
setgid() */
74
getuid(), getgid(), seteuid(),
75
setgid(), pause() */
76
76
#include <arpa/inet.h> /* inet_pton(), htons */
77
77
#include <iso646.h> /* not, or, and */
78
78
#include <argp.h> /* struct argp_option, error_t, struct
80
80
argp_parse(), ARGP_KEY_ARG,
81
81
ARGP_KEY_END, ARGP_ERR_UNKNOWN */
82
82
#include <signal.h> /* sigemptyset(), sigaddset(),
83
sigaction(), SIGTERM, sigaction,
84
sig_atomic_t */
83
sigaction(), SIGTERM, sig_atomic_t,
84
raise() */
85
85
86
86
#ifdef __linux__
87
87
#include <sys/klog.h> /* klogctl() */
142
142
.dh_bits = 1024, .priority = "SECURE256"
143
143
":!CTYPE-X.509:+CTYPE-OPENPGP" };
144
144
145
sig_atomic_t quit_now = 0;
146
int signal_received = 0;
147
145
148
/*
146
149
* Make additional room in "buffer" for at least BUFFER_SIZE more
147
150
* bytes. "buffer_capacity" is how much is currently allocated,
164
167
*/
165
168
static bool init_gpgme(const char *seckey,
166
169
const char *pubkey, const char *tempdir){
167
int ret;
168
170
gpgme_error_t rc;
169
171
gpgme_engine_info_t engine_info;
170
172
173
175
* Helper function to insert pub and seckey to the engine keyring.
174
176
*/
175
177
bool import_key(const char *filename){
178
int ret;
176
179
int fd;
177
180
gpgme_data_t pgp_data;
178
181
249
252
return false;
250
253
}
251
254
252
return true;
255
return true;
253
256
}
254
257
255
258
/*
309
312
}
310
313
gpgme_recipient_t recipient;
311
314
recipient = result->recipients;
312
if(recipient){
313
while(recipient != NULL){
314
fprintf(stderr, "Public key algorithm: %s\n",
315
gpgme_pubkey_algo_name(recipient->pubkey_algo));
316
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
317
fprintf(stderr, "Secret key available: %s\n",
318
recipient->status == GPG_ERR_NO_SECKEY
319
? "No" : "Yes");
320
recipient = recipient->next;
321
}
315
while(recipient != NULL){
316
fprintf(stderr, "Public key algorithm: %s\n",
317
gpgme_pubkey_algo_name(recipient->pubkey_algo));
318
fprintf(stderr, "Key ID: %s\n", recipient->keyid);
319
fprintf(stderr, "Secret key available: %s\n",
320
recipient->status == GPG_ERR_NO_SECKEY
321
? "No" : "Yes");
322
recipient = recipient->next;
322
323
}
323
324
}
324
325
}
476
477
static int init_gnutls_session(gnutls_session_t *session){
477
478
int ret;
478
479
/* GnuTLS session creation */
479
ret = gnutls_init(session, GNUTLS_SERVER);
480
do {
481
ret = gnutls_init(session, GNUTLS_SERVER);
482
if(quit_now){
483
return -1;
484
}
485
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
480
486
if(ret != GNUTLS_E_SUCCESS){
481
487
fprintf(stderr, "Error in GnuTLS session initialization: %s\n",
482
488
safer_gnutls_strerror(ret));
484
490
485
491
{
486
492
const char *err;
487
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
493
do {
494
ret = gnutls_priority_set_direct(*session, mc.priority, &err);
495
if(quit_now){
496
gnutls_deinit(*session);
497
return -1;
498
}
499
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
488
500
if(ret != GNUTLS_E_SUCCESS){
489
501
fprintf(stderr, "Syntax error at: %s\n", err);
490
502
fprintf(stderr, "GnuTLS error: %s\n",
494
506
}
495
507
}
496
508
497
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
498
mc.cred);
509
do {
510
ret = gnutls_credentials_set(*session, GNUTLS_CRD_CERTIFICATE,
511
mc.cred);
512
if(quit_now){
513
gnutls_deinit(*session);
514
return -1;
515
}
516
} while(ret == GNUTLS_E_INTERRUPTED or ret == GNUTLS_E_AGAIN);
499
517
if(ret != GNUTLS_E_SUCCESS){
500
518
fprintf(stderr, "Error setting GnuTLS credentials: %s\n",
501
519
safer_gnutls_strerror(ret));
504
522
}
505
523
506
524
/* ignore client certificate if any. */
507
gnutls_certificate_server_set_request(*session,
508
GNUTLS_CERT_IGNORE);
525
gnutls_certificate_server_set_request(*session, GNUTLS_CERT_IGNORE);
509
526
510
527
gnutls_dh_set_prime_bits(*session, mc.dh_bits);
511
528
520
537
static int start_mandos_communication(const char *ip, uint16_t port,
521
538
AvahiIfIndex if_index,
522
539
int af){
523
int ret, tcp_sd;
540
int ret, tcp_sd = -1;
524
541
ssize_t sret;
525
542
union {
526
543
struct sockaddr_in in;
527
544
struct sockaddr_in6 in6;
528
545
} to;
529
546
char *buffer = NULL;
530
char *decrypted_buffer;
547
char *decrypted_buffer = NULL;
531
548
size_t buffer_length = 0;
532
549
size_t buffer_capacity = 0;
533
ssize_t decrypted_buffer_size;
534
550
size_t written;
535
int retval = 0;
551
int retval = -1;
536
552
gnutls_session_t session;
537
553
int pf; /* Protocol family */
538
554
555
if(quit_now){
556
return -1;
557
}
558
539
559
switch(af){
540
560
case AF_INET6:
541
561
pf = PF_INET6;
561
581
tcp_sd = socket(pf, SOCK_STREAM, 0);
562
582
if(tcp_sd < 0){
563
583
perror("socket");
564
return -1;
584
goto mandos_end;
585
}
586
587
if(quit_now){
588
goto mandos_end;
565
589
}
566
590
567
591
memset(&to, 0, sizeof(to));
574
598
}
575
599
if(ret < 0 ){
576
600
perror("inet_pton");
577
return -1;
601
goto mandos_end;
578
602
}
579
603
if(ret == 0){
580
604
fprintf(stderr, "Bad address: %s\n", ip);
581
return -1;
605
goto mandos_end;
582
606
}
583
607
if(af == AF_INET6){
584
608
to.in6.sin6_port = htons(port); /* Spurious warnings from
591
615
if(if_index == AVAHI_IF_UNSPEC){
592
616
fprintf(stderr, "An IPv6 link-local address is incomplete"
593
617
" without a network interface\n");
594
return -1;
618
goto mandos_end;
595
619
}
596
620
/* Set the network interface number as scope */
597
621
to.in6.sin6_scope_id = (uint32_t)if_index;
602
626
-Wunreachable-code */
603
627
}
604
628
629
if(quit_now){
630
goto mandos_end;
631
}
632
605
633
if(debug){
606
634
if(af == AF_INET6 and if_index != AVAHI_IF_UNSPEC){
607
635
char interface[IF_NAMESIZE];
634
662
}
635
663
}
636
664
665
if(quit_now){
666
goto mandos_end;
667
}
668
637
669
if(af == AF_INET6){
638
670
ret = connect(tcp_sd, &to.in6, sizeof(to));
639
671
} else {
641
673
}
642
674
if(ret < 0){
643
675
perror("connect");
644
return -1;
676
goto mandos_end;
677
}
678
679
if(quit_now){
680
goto mandos_end;
645
681
}
646
682
647
683
const char *out = mandos_protocol_version;
652
688
out_size - written));
653
689
if(ret == -1){
654
690
perror("write");
655
retval = -1;
656
691
goto mandos_end;
657
692
}
658
693
written += (size_t)ret;
666
701
break;
667
702
}
668
703
}
704
705
if(quit_now){
706
goto mandos_end;
707
}
669
708
}
670
709
671
710
if(debug){
672
711
fprintf(stderr, "Establishing TLS session with %s\n", ip);
673
712
}
674
713
714
if(quit_now){
715
goto mandos_end;
716
}
717
675
718
gnutls_transport_set_ptr(session, (gnutls_transport_ptr_t) tcp_sd);
676
719
677
do{
720
if(quit_now){
721
goto mandos_end;
722
}
723
724
do {
678
725
ret = gnutls_handshake(session);
726
if(quit_now){
727
goto mandos_end;
728
}
679
729
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
680
730
681
731
if(ret != GNUTLS_E_SUCCESS){
683
733
fprintf(stderr, "*** GnuTLS Handshake failed ***\n");
684
734
gnutls_perror(ret);
685
735
}
686
retval = -1;
687
736
goto mandos_end;
688
737
}
689
738
695
744
}
696
745
697
746
while(true){
747
748
if(quit_now){
749
goto mandos_end;
750
}
751
698
752
buffer_capacity = incbuffer(&buffer, buffer_length,
699
753
buffer_capacity);
700
754
if(buffer_capacity == 0){
701
755
perror("incbuffer");
702
retval = -1;
756
goto mandos_end;
757
}
758
759
if(quit_now){
703
760
goto mandos_end;
704
761
}
705
762
714
771
case GNUTLS_E_AGAIN:
715
772
break;
716
773
case GNUTLS_E_REHANDSHAKE:
717
do{
774
do {
718
775
ret = gnutls_handshake(session);
776
777
if(quit_now){
778
goto mandos_end;
779
}
719
780
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
720
781
if(ret < 0){
721
782
fprintf(stderr, "*** GnuTLS Re-handshake failed ***\n");
722
783
gnutls_perror(ret);
723
retval = -1;
724
784
goto mandos_end;
725
785
}
726
786
break;
727
787
default:
728
788
fprintf(stderr, "Unknown error while reading data from"
729
789
" encrypted session with Mandos server\n");
730
retval = -1;
731
790
gnutls_bye(session, GNUTLS_SHUT_RDWR);
732
791
goto mandos_end;
733
792
}
740
799
fprintf(stderr, "Closing TLS session\n");
741
800
}
742
801
743
gnutls_bye(session, GNUTLS_SHUT_RDWR);
802
if(quit_now){
803
goto mandos_end;
804
}
805
806
do {
807
ret = gnutls_bye(session, GNUTLS_SHUT_RDWR);
808
if(quit_now){
809
goto mandos_end;
810
}
811
} while(ret == GNUTLS_E_AGAIN or ret == GNUTLS_E_INTERRUPTED);
744
812
745
813
if(buffer_length > 0){
814
ssize_t decrypted_buffer_size;
746
815
decrypted_buffer_size = pgp_packet_decrypt(buffer,
747
816
buffer_length,
748
817
&decrypted_buffer);
749
818
if(decrypted_buffer_size >= 0){
819
750
820
written = 0;
751
821
while(written < (size_t) decrypted_buffer_size){
822
if(quit_now){
823
goto mandos_end;
824
}
825
752
826
ret = (int)fwrite(decrypted_buffer + written, 1,
753
827
(size_t)decrypted_buffer_size - written,
754
828
stdout);
757
831
fprintf(stderr, "Error writing encrypted data: %s\n",
758
832
strerror(errno));
759
833
}
760
retval = -1;
761
break;
834
goto mandos_end;
762
835
}
763
836
written += (size_t)ret;
764
837
}
765
free(decrypted_buffer);
766
} else {
767
retval = -1;
838
retval = 0;
768
839
}
769
} else {
770
retval = -1;
771
840
}
772
841
773
842
/* Shutdown procedure */
774
843
775
844
mandos_end:
845
free(decrypted_buffer);
776
846
free(buffer);
777
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
847
if(tcp_sd >= 0){
848
ret = (int)TEMP_FAILURE_RETRY(close(tcp_sd));
849
}
778
850
if(ret == -1){
779
851
perror("close");
780
852
}
781
853
gnutls_deinit(session);
854
if(quit_now){
855
retval = -1;
856
}
782
857
return retval;
783
858
}
784
859
801
876
/* Called whenever a service has been resolved successfully or
802
877
timed out */
803
878
879
if(quit_now){
880
return;
881
}
882
804
883
switch(event){
805
884
default:
806
885
case AVAHI_RESOLVER_FAILURE:
843
922
/* Called whenever a new services becomes available on the LAN or
844
923
is removed from the LAN */
845
924
925
if(quit_now){
926
return;
927
}
928
846
929
switch(event){
847
930
default:
848
931
case AVAHI_BROWSER_FAILURE:
877
960
}
878
961
}
879
962
880
sig_atomic_t quit_now = 0;
881
882
963
/* stop main loop after sigterm has been called */
883
static void handle_sigterm(__attribute__((unused)) int sig){
964
static void handle_sigterm(int sig){
884
965
if(quit_now){
885
966
return;
886
967
}
887
968
quit_now = 1;
969
signal_received = sig;
888
970
int old_errno = errno;
889
971
if(mc.simple_poll != NULL){
890
972
avahi_simple_poll_quit(mc.simple_poll);
901
983
int exitcode = EXIT_SUCCESS;
902
984
const char *interface = "eth0";
903
985
struct ifreq network;
904
int sd;
986
int sd = -1;
987
bool take_down_interface = false;
905
988
uid_t uid;
906
989
gid_t gid;
907
990
char *connect_to = NULL;
915
998
bool gpgme_initialized = false;
916
999
float delay = 2.5f;
917
1000
918
struct sigaction old_sigterm_action;
1001
struct sigaction old_sigterm_action = { .sa_handler = SIG_DFL };
919
1002
struct sigaction sigterm_action = { .sa_handler = handle_sigterm };
920
1003
1004
uid = getuid();
1005
gid = getgid();
1006
1007
/* Lower any group privileges we might have, just to be safe */
1008
errno = 0;
1009
ret = setgid(gid);
1010
if(ret == -1){
1011
perror("setgid");
1012
}
1013
1014
/* Lower user privileges (temporarily) */
1015
errno = 0;
1016
ret = seteuid(uid);
1017
if(ret == -1){
1018
perror("seteuid");
1019
}
1020
1021
if(quit_now){
1022
goto end;
1023
}
1024
921
1025
{
922
1026
struct argp_option options[] = {
923
1027
{ .name = "debug", .key = 128,
1050
1154
exitcode = EXIT_FAILURE;
1051
1155
goto end;
1052
1156
}
1053
ret = sigaction(SIGTERM, &sigterm_action, &old_sigterm_action);
1054
if(ret == -1){
1055
perror("sigaction");
1056
exitcode = EXIT_FAILURE;
1057
goto end;
1058
}
1157
/* Need to check if the handler is SIG_IGN before handling:
1158
| [[info:libc:Initial Signal Actions]] |
1159
| [[info:libc:Basic Signal Handling]] |
1160
*/
1161
ret = sigaction(SIGINT, NULL, &old_sigterm_action);
1162
if(ret == -1){
1163
perror("sigaction");
1164
return EXIT_FAILURE;
1165
}
1166
if(old_sigterm_action.sa_handler != SIG_IGN){
1167
ret = sigaction(SIGINT, &sigterm_action, NULL);
1168
if(ret == -1){
1169
perror("sigaction");
1170
exitcode = EXIT_FAILURE;
1171
goto end;
1172
}
1173
}
1174
ret = sigaction(SIGHUP, NULL, &old_sigterm_action);
1175
if(ret == -1){
1176
perror("sigaction");
1177
return EXIT_FAILURE;
1178
}
1179
if(old_sigterm_action.sa_handler != SIG_IGN){
1180
ret = sigaction(SIGHUP, &sigterm_action, NULL);
1181
if(ret == -1){
1182
perror("sigaction");
1183
exitcode = EXIT_FAILURE;
1184
goto end;
1185
}
1186
}
1187
ret = sigaction(SIGTERM, NULL, &old_sigterm_action);
1188
if(ret == -1){
1189
perror("sigaction");
1190
return EXIT_FAILURE;
1191
}
1192
if(old_sigterm_action.sa_handler != SIG_IGN){
1193
ret = sigaction(SIGTERM, &sigterm_action, NULL);
1194
if(ret == -1){
1195
perror("sigaction");
1196
exitcode = EXIT_FAILURE;
1197
goto end;
1198
}
1199
}
1059
1200
1060
1201
/* If the interface is down, bring it up */
1061
1202
if(interface[0] != '\0'){
1203
if_index = (AvahiIfIndex) if_nametoindex(interface);
1204
if(if_index == 0){
1205
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1206
exitcode = EXIT_FAILURE;
1207
goto end;
1208
}
1209
1210
if(quit_now){
1211
goto end;
1212
}
1213
1214
/* Re-raise priviliges */
1215
errno = 0;
1216
ret = seteuid(0);
1217
if(ret == -1){
1218
perror("seteuid");
1219
}
1220
1062
1221
#ifdef __linux__
1063
1222
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1064
1223
messages to mess up the prompt */
1082
1241
}
1083
1242
}
1084
1243
#endif /* __linux__ */
1244
/* Lower privileges */
1245
errno = 0;
1246
ret = seteuid(uid);
1247
if(ret == -1){
1248
perror("seteuid");
1249
}
1085
1250
goto end;
1086
1251
}
1087
1252
strcpy(network.ifr_name, interface);
1097
1262
}
1098
1263
#endif /* __linux__ */
1099
1264
exitcode = EXIT_FAILURE;
1265
/* Lower privileges */
1266
errno = 0;
1267
ret = seteuid(uid);
1268
if(ret == -1){
1269
perror("seteuid");
1270
}
1100
1271
goto end;
1101
1272
}
1102
1273
if((network.ifr_flags & IFF_UP) == 0){
1103
1274
network.ifr_flags |= IFF_UP;
1275
take_down_interface = true;
1104
1276
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1105
1277
if(ret == -1){
1278
take_down_interface = false;
1106
1279
perror("ioctl SIOCSIFFLAGS");
1107
1280
exitcode = EXIT_FAILURE;
1108
1281
#ifdef __linux__
1113
1286
}
1114
1287
}
1115
1288
#endif /* __linux__ */
1289
/* Lower privileges */
1290
errno = 0;
1291
ret = seteuid(uid);
1292
if(ret == -1){
1293
perror("seteuid");
1294
}
1116
1295
goto end;
1117
1296
}
1118
1297
}
1130
1309
perror("nanosleep");
1131
1310
}
1132
1311
}
1133
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1134
if(ret == -1){
1135
perror("close");
1312
if(not take_down_interface){
1313
/* We won't need the socket anymore */
1314
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1315
if(ret == -1){
1316
perror("close");
1317
}
1136
1318
}
1137
1319
#ifdef __linux__
1138
1320
if(restore_loglevel){
1143
1325
}
1144
1326
}
1145
1327
#endif /* __linux__ */
1146
}
1147
1148
uid = getuid();
1149
gid = getgid();
1150
1151
errno = 0;
1152
setgid(gid);
1153
if(ret == -1){
1154
perror("setgid");
1155
}
1156
1157
ret = setuid(uid);
1158
if(ret == -1){
1159
perror("setuid");
1328
/* Lower privileges */
1329
errno = 0;
1330
if(take_down_interface){
1331
/* Lower privileges */
1332
ret = seteuid(uid);
1333
if(ret == -1){
1334
perror("seteuid");
1335
}
1336
} else {
1337
/* Lower privileges permanently */
1338
ret = setuid(uid);
1339
if(ret == -1){
1340
perror("setuid");
1341
}
1342
}
1343
}
1344
1345
if(quit_now){
1346
goto end;
1160
1347
}
1161
1348
1162
1349
ret = init_gnutls_global(pubkey, seckey);
1168
1355
gnutls_initialized = true;
1169
1356
}
1170
1357
1358
if(quit_now){
1359
goto end;
1360
}
1361
1362
tempdir_created = true;
1171
1363
if(mkdtemp(tempdir) == NULL){
1364
tempdir_created = false;
1172
1365
perror("mkdtemp");
1173
1366
goto end;
1174
1367
}
1175
tempdir_created = true;
1368
1369
if(quit_now){
1370
goto end;
1371
}
1176
1372
1177
1373
if(not init_gpgme(pubkey, seckey, tempdir)){
1178
1374
fprintf(stderr, "init_gpgme failed\n");
1182
1378
gpgme_initialized = true;
1183
1379
}
1184
1380
1185
if(interface[0] != '\0'){
1186
if_index = (AvahiIfIndex) if_nametoindex(interface);
1187
if(if_index == 0){
1188
fprintf(stderr, "No such interface: \"%s\"\n", interface);
1189
exitcode = EXIT_FAILURE;
1190
goto end;
1191
}
1381
if(quit_now){
1382
goto end;
1192
1383
}
1193
1384
1194
1385
if(connect_to != NULL){
1200
1391
exitcode = EXIT_FAILURE;
1201
1392
goto end;
1202
1393
}
1394
1395
if(quit_now){
1396
goto end;
1397
}
1398
1203
1399
uint16_t port;
1204
1400
errno = 0;
1205
1401
tmpmax = strtoimax(address+1, &tmp, 10);
1209
1405
exitcode = EXIT_FAILURE;
1210
1406
goto end;
1211
1407
}
1408
1409
if(quit_now){
1410
goto end;
1411
}
1412
1212
1413
port = (uint16_t)tmpmax;
1213
1414
*address = '\0';
1214
1415
address = connect_to;
1219
1420
} else {
1220
1421
af = AF_INET;
1221
1422
}
1423
1424
if(quit_now){
1425
goto end;
1426
}
1427
1222
1428
ret = start_mandos_communication(address, port, if_index, af);
1223
1429
if(ret < 0){
1224
1430
exitcode = EXIT_FAILURE;
1227
1433
}
1228
1434
goto end;
1229
1435
}
1230
1436
1437
if(quit_now){
1438
goto end;
1439
}
1440
1231
1441
{
1232
1442
AvahiServerConfig config;
1233
1443
/* Do not publish any local Zeroconf records */
1254
1464
goto end;
1255
1465
}
1256
1466
1467
if(quit_now){
1468
goto end;
1469
}
1470
1257
1471
/* Create the Avahi service browser */
1258
1472
sb = avahi_s_service_browser_new(mc.server, if_index,
1259
1473
AVAHI_PROTO_UNSPEC, "_mandos._tcp",
1265
1479
goto end;
1266
1480
}
1267
1481
1482
if(quit_now){
1483
goto end;
1484
}
1485
1268
1486
/* Run the main loop */
1269
1487
1270
1488
if(debug){
1299
1517
gpgme_release(mc.ctx);
1300
1518
}
1301
1519
1520
/* Take down the network interface */
1521
if(take_down_interface){
1522
/* Re-raise priviliges */
1523
errno = 0;
1524
ret = seteuid(0);
1525
if(ret == -1){
1526
perror("seteuid");
1527
}
1528
if(geteuid() == 0){
1529
ret = ioctl(sd, SIOCGIFFLAGS, &network);
1530
if(ret == -1){
1531
perror("ioctl SIOCGIFFLAGS");
1532
} else if(network.ifr_flags & IFF_UP) {
1533
network.ifr_flags &= ~IFF_UP; /* clear flag */
1534
ret = ioctl(sd, SIOCSIFFLAGS, &network);
1535
if(ret == -1){
1536
perror("ioctl SIOCSIFFLAGS");
1537
}
1538
}
1539
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1540
if(ret == -1){
1541
perror("close");
1542
}
1543
/* Lower privileges permanently */
1544
errno = 0;
1545
ret = setuid(uid);
1546
if(ret == -1){
1547
perror("setuid");
1548
}
1549
}
1550
}
1551
1302
1552
/* Removes the temp directory used by GPGME */
1303
1553
if(tempdir_created){
1304
1554
DIR *d;
1343
1593
}
1344
1594
}
1345
1595
1596
if(quit_now){
1597
sigemptyset(&old_sigterm_action.sa_mask);
1598
old_sigterm_action.sa_handler = SIG_DFL;
1599
ret = (int)TEMP_FAILURE_RETRY(sigaction(signal_received,
1600
&old_sigterm_action,
1601
NULL));
1602
if(ret == -1){
1603
perror("sigaction");
1604
}
1605
do {
1606
ret = raise(signal_received);
1607
} while(ret != 0 and errno == EINTR);
1608
if(ret != 0){
1609
perror("raise");
1610
abort();
1611
}
1612
TEMP_FAILURE_RETRY(pause());
1613
}
1614
1346
1615
return exitcode;
1347
1616
}
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0