576
538
safer_gnutls_strerror(ret));
579
/* If a Diffie-Hellman parameters file was given, try to use it */
580
if(dhparamsfilename != NULL){
581
gnutls_datum_t params = { .data = NULL, .size = 0 };
583
int dhpfile = open(dhparamsfilename, O_RDONLY);
586
dhparamsfilename = NULL;
589
size_t params_capacity = 0;
591
params_capacity = incbuffer((char **)¶ms.data,
593
(size_t)params_capacity);
594
if(params_capacity == 0){
595
perror_plus("incbuffer");
598
dhparamsfilename = NULL;
601
ssize_t bytes_read = read(dhpfile,
602
params.data + params.size,
608
/* check bytes_read for failure */
613
dhparamsfilename = NULL;
616
params.size += (unsigned int)bytes_read;
618
if(params.data == NULL){
619
dhparamsfilename = NULL;
621
if(dhparamsfilename == NULL){
624
ret = gnutls_dh_params_import_pkcs3(mc->dh_params, ¶ms,
625
GNUTLS_X509_FMT_PEM);
626
if(ret != GNUTLS_E_SUCCESS){
627
fprintf_plus(stderr, "Failed to parse DH parameters in file"
628
" \"%s\": %s\n", dhparamsfilename,
629
safer_gnutls_strerror(ret));
630
dhparamsfilename = NULL;
634
if(dhparamsfilename == NULL){
635
if(mc->dh_bits == 0){
636
/* Find out the optimal number of DH bits */
637
/* Try to read the private key file */
638
gnutls_datum_t buffer = { .data = NULL, .size = 0 };
640
int secfile = open(seckeyfilename, O_RDONLY);
645
size_t buffer_capacity = 0;
647
buffer_capacity = incbuffer((char **)&buffer.data,
649
(size_t)buffer_capacity);
650
if(buffer_capacity == 0){
651
perror_plus("incbuffer");
656
ssize_t bytes_read = read(secfile,
657
buffer.data + buffer.size,
663
/* check bytes_read for failure */
670
buffer.size += (unsigned int)bytes_read;
674
/* If successful, use buffer to parse private key */
675
gnutls_sec_param_t sec_param = GNUTLS_SEC_PARAM_ULTRA;
676
if(buffer.data != NULL){
678
gnutls_openpgp_privkey_t privkey = NULL;
679
ret = gnutls_openpgp_privkey_init(&privkey);
680
if(ret != GNUTLS_E_SUCCESS){
681
fprintf_plus(stderr, "Error initializing OpenPGP key"
683
safer_gnutls_strerror(ret));
687
ret = gnutls_openpgp_privkey_import
688
(privkey, &buffer, GNUTLS_OPENPGP_FMT_BASE64, "", 0);
689
if(ret != GNUTLS_E_SUCCESS){
690
fprintf_plus(stderr, "Error importing OpenPGP key : %s",
691
safer_gnutls_strerror(ret));
697
/* Use private key to suggest an appropriate
699
sec_param = gnutls_openpgp_privkey_sec_param(privkey);
700
gnutls_openpgp_privkey_deinit(privkey);
702
fprintf_plus(stderr, "This OpenPGP key implies using"
703
" a GnuTLS security parameter \"%s\".\n",
704
safe_string(gnutls_sec_param_get_name
710
if(sec_param == GNUTLS_SEC_PARAM_UNKNOWN){
711
/* Err on the side of caution */
712
sec_param = GNUTLS_SEC_PARAM_ULTRA;
714
fprintf_plus(stderr, "Falling back to security parameter"
716
safe_string(gnutls_sec_param_get_name
721
uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
725
fprintf_plus(stderr, "A \"%s\" GnuTLS security parameter"
726
" implies %u DH bits; using that.\n",
727
safe_string(gnutls_sec_param_get_name
732
fprintf_plus(stderr, "Failed to get implied number of DH"
733
" bits for security parameter \"%s\"): %s\n",
734
safe_string(gnutls_sec_param_get_name
736
safer_gnutls_strerror(ret));
740
fprintf_plus(stderr, "DH bits explicitly set to %u\n",
743
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
744
if(ret != GNUTLS_E_SUCCESS){
745
fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
746
" bits): %s\n", mc->dh_bits,
747
safer_gnutls_strerror(ret));
541
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
542
if(ret != GNUTLS_E_SUCCESS){
543
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
544
safer_gnutls_strerror(ret));
751
548
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
820
618
static void empty_log(__attribute__((unused)) AvahiLogLevel level,
821
619
__attribute__((unused)) const char *txt){}
823
/* Set effective uid to 0, return errno */
824
__attribute__((warn_unused_result))
825
error_t raise_privileges(void){
826
error_t old_errno = errno;
827
error_t ret_errno = 0;
828
if(seteuid(0) == -1){
835
/* Set effective and real user ID to 0. Return errno. */
836
__attribute__((warn_unused_result))
837
error_t raise_privileges_permanently(void){
838
error_t old_errno = errno;
839
error_t ret_errno = raise_privileges();
851
/* Set effective user ID to unprivileged saved user ID */
852
__attribute__((warn_unused_result))
853
error_t lower_privileges(void){
854
error_t old_errno = errno;
855
error_t ret_errno = 0;
856
if(seteuid(uid) == -1){
863
/* Lower privileges permanently */
864
__attribute__((warn_unused_result))
865
error_t lower_privileges_permanently(void){
866
error_t old_errno = errno;
867
error_t ret_errno = 0;
868
if(setuid(uid) == -1){
875
/* Helper function to add_local_route() and delete_local_route() */
876
__attribute__((nonnull, warn_unused_result))
877
static bool add_delete_local_route(const bool add,
879
AvahiIfIndex if_index){
881
char helper[] = "mandos-client-iprouteadddel";
882
char add_arg[] = "add";
883
char delete_arg[] = "delete";
884
char debug_flag[] = "--debug";
885
char *pluginhelperdir = getenv("MANDOSPLUGINHELPERDIR");
886
if(pluginhelperdir == NULL){
888
fprintf_plus(stderr, "MANDOSPLUGINHELPERDIR environment"
889
" variable not set; cannot run helper\n");
894
char interface[IF_NAMESIZE];
895
if(if_indextoname((unsigned int)if_index, interface) == NULL){
896
perror_plus("if_indextoname");
900
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
902
perror_plus("open(\"/dev/null\", O_RDONLY)");
908
/* Raise privileges */
909
errno = raise_privileges_permanently();
911
perror_plus("Failed to raise privileges");
912
/* _exit(EX_NOPERM); */
918
perror_plus("setgid");
921
/* Reset supplementary groups */
923
ret = setgroups(0, NULL);
925
perror_plus("setgroups");
929
ret = dup2(devnull, STDIN_FILENO);
931
perror_plus("dup2(devnull, STDIN_FILENO)");
934
ret = (int)TEMP_FAILURE_RETRY(close(devnull));
936
perror_plus("close");
939
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
941
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
944
int helperdir_fd = (int)TEMP_FAILURE_RETRY(open(pluginhelperdir,
949
if(helperdir_fd == -1){
951
_exit(EX_UNAVAILABLE);
953
int helper_fd = (int)TEMP_FAILURE_RETRY(openat(helperdir_fd,
956
perror_plus("openat");
957
_exit(EX_UNAVAILABLE);
959
TEMP_FAILURE_RETRY(close(helperdir_fd));
961
#pragma GCC diagnostic push
962
#pragma GCC diagnostic ignored "-Wcast-qual"
964
if(fexecve(helper_fd, (char *const [])
965
{ helper, add ? add_arg : delete_arg, (char *)address,
966
interface, debug ? debug_flag : NULL, NULL },
969
#pragma GCC diagnostic pop
971
perror_plus("fexecve");
983
pret = waitpid(pid, &status, 0);
984
if(pret == -1 and errno == EINTR and quit_now){
985
int errno_raising = 0;
986
if((errno = raise_privileges()) != 0){
987
errno_raising = errno;
988
perror_plus("Failed to raise privileges in order to"
989
" kill helper program");
991
if(kill(pid, SIGTERM) == -1){
994
if((errno_raising == 0) and (errno = lower_privileges()) != 0){
995
perror_plus("Failed to lower privileges after killing"
1000
} while(pret == -1 and errno == EINTR);
1002
perror_plus("waitpid");
1005
if(WIFEXITED(status)){
1006
if(WEXITSTATUS(status) != 0){
1007
fprintf_plus(stderr, "Error: iprouteadddel exited"
1008
" with status %d\n", WEXITSTATUS(status));
1013
if(WIFSIGNALED(status)){
1014
fprintf_plus(stderr, "Error: iprouteadddel died by"
1015
" signal %d\n", WTERMSIG(status));
1018
fprintf_plus(stderr, "Error: iprouteadddel crashed\n");
1022
__attribute__((nonnull, warn_unused_result))
1023
static bool add_local_route(const char *address,
1024
AvahiIfIndex if_index){
1026
fprintf_plus(stderr, "Adding route to %s\n", address);
1028
return add_delete_local_route(true, address, if_index);
1031
__attribute__((nonnull, warn_unused_result))
1032
static bool delete_local_route(const char *address,
1033
AvahiIfIndex if_index){
1035
fprintf_plus(stderr, "Removing route to %s\n", address);
1037
return add_delete_local_route(false, address, if_index);
1040
621
/* Called when a Mandos server is found */
1041
__attribute__((nonnull, warn_unused_result))
1042
622
static int start_mandos_communication(const char *ip, in_port_t port,
1043
623
AvahiIfIndex if_index,
1044
624
int af, mandos_context *mc){
1045
625
int ret, tcp_sd = -1;
1047
struct sockaddr_storage to;
628
struct sockaddr_in in;
629
struct sockaddr_in6 in6;
1048
631
char *buffer = NULL;
1049
632
char *decrypted_buffer = NULL;
1050
633
size_t buffer_length = 0;
1188
741
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
1189
742
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
1191
ret = getnameinfo((struct sockaddr *)&to,
1192
sizeof(struct sockaddr_in6),
1193
addrstr, sizeof(addrstr), NULL, 0,
1196
ret = getnameinfo((struct sockaddr *)&to,
1197
sizeof(struct sockaddr_in),
1198
addrstr, sizeof(addrstr), NULL, 0,
1201
if(ret == EAI_SYSTEM){
1202
perror_plus("getnameinfo");
1203
} else if(ret != 0) {
1204
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
1205
} else if(strcmp(addrstr, ip) != 0){
1206
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1217
ret = connect(tcp_sd, (struct sockaddr *)&to,
1218
sizeof(struct sockaddr_in6));
1220
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
1221
sizeof(struct sockaddr_in));
1224
if(errno == ENETUNREACH
1225
and if_index != AVAHI_IF_UNSPEC
1226
and connect_to == NULL
1227
and not route_added and
1228
((af == AF_INET6 and not
1229
IN6_IS_ADDR_LINKLOCAL(&(((struct sockaddr_in6 *)
1231
or (af == AF_INET and
1232
/* Not a a IPv4LL address */
1233
(ntohl(((struct sockaddr_in *)&to)->sin_addr.s_addr)
1234
& 0xFFFF0000L) != 0xA9FE0000L))){
1235
/* Work around Avahi bug - Avahi does not announce link-local
1236
addresses if it has a global address, so local hosts with
1237
*only* a link-local address (e.g. Mandos clients) cannot
1238
connect to a Mandos server announced by Avahi on a server
1239
host with a global address. Work around this by retrying
1240
with an explicit route added with the server's address.
1242
Avahi bug reference:
1243
http://lists.freedesktop.org/archives/avahi/2010-February/001833.html
1244
https://bugs.debian.org/587961
1247
fprintf_plus(stderr, "Mandos server unreachable, trying"
1251
route_added = add_local_route(ip, if_index);
1257
if(errno != ECONNREFUSED or debug){
1259
perror_plus("connect");
745
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
748
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
752
perror_plus("inet_ntop");
754
if(strcmp(addrstr, ip) != 0){
755
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
766
ret = connect(tcp_sd, &to.in6, sizeof(to));
768
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
771
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
773
perror_plus("connect");
1272
784
const char *out = mandos_protocol_version;
1885
1388
ret = avahi_simple_poll_iterate(s, (int)block_time);
1888
if(ret > 0 or errno != EINTR){
1391
if (ret > 0 or errno != EINTR){
1889
1392
return (ret != 1) ? ret : 0;
1895
__attribute__((nonnull))
1896
void run_network_hooks(const char *mode, const char *interface,
1398
/* Set effective uid to 0, return errno */
1399
error_t raise_privileges(void){
1400
error_t old_errno = errno;
1401
error_t ret_errno = 0;
1402
if(seteuid(0) == -1){
1404
perror_plus("seteuid");
1410
/* Set effective and real user ID to 0. Return errno. */
1411
error_t raise_privileges_permanently(void){
1412
error_t old_errno = errno;
1413
error_t ret_errno = raise_privileges();
1418
if(setuid(0) == -1){
1420
perror_plus("seteuid");
1426
/* Set effective user ID to unprivileged saved user ID */
1427
error_t lower_privileges(void){
1428
error_t old_errno = errno;
1429
error_t ret_errno = 0;
1430
if(seteuid(uid) == -1){
1432
perror_plus("seteuid");
1438
/* Lower privileges permanently */
1439
error_t lower_privileges_permanently(void){
1440
error_t old_errno = errno;
1441
error_t ret_errno = 0;
1442
if(setuid(uid) == -1){
1444
perror_plus("setuid");
1450
bool run_network_hooks(const char *mode, const char *interface,
1897
1451
const float delay){
1898
struct dirent **direntries = NULL;
1899
if(hookdir_fd == -1){
1900
hookdir_fd = open(hookdir, O_RDONLY | O_DIRECTORY | O_PATH
1902
if(hookdir_fd == -1){
1903
if(errno == ENOENT){
1905
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1906
" found\n", hookdir);
1909
perror_plus("open");
1915
#if __GLIBC_PREREQ(2, 15)
1916
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1917
runnable_hook, alphasort);
1918
#else /* not __GLIBC_PREREQ(2, 15) */
1919
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1921
#endif /* not __GLIBC_PREREQ(2, 15) */
1922
#else /* not __GLIBC__ */
1923
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1925
#endif /* not __GLIBC__ */
1452
struct dirent **direntries;
1453
struct dirent *direntry;
1455
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1926
1457
if(numhooks == -1){
1927
perror_plus("scandir");
1930
struct dirent *direntry;
1932
int devnull = (int)TEMP_FAILURE_RETRY(open("/dev/null", O_RDONLY));
1934
perror_plus("open(\"/dev/null\", O_RDONLY)");
1937
for(int i = 0; i < numhooks; i++){
1938
direntry = direntries[i];
1940
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1458
if(errno == ENOENT){
1460
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1461
" found\n", hookdir);
1464
perror_plus("scandir");
1943
pid_t hook_pid = fork();
1946
/* Raise privileges */
1947
errno = raise_privileges_permanently();
1949
perror_plus("Failed to raise privileges");
1956
perror_plus("setgid");
1959
/* Reset supplementary groups */
1961
ret = setgroups(0, NULL);
1963
perror_plus("setgroups");
1966
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1968
perror_plus("setenv");
1971
ret = setenv("DEVICE", interface, 1);
1973
perror_plus("setenv");
1976
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1978
perror_plus("setenv");
1981
ret = setenv("MODE", mode, 1);
1983
perror_plus("setenv");
1987
ret = asprintf(&delaystring, "%f", (double)delay);
1467
int devnull = open("/dev/null", O_RDONLY);
1468
for(int i = 0; i < numhooks; i++){
1469
direntry = direntries[i];
1470
char *fullname = NULL;
1471
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1989
1473
perror_plus("asprintf");
1992
ret = setenv("DELAY", delaystring, 1);
1477
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1480
pid_t hook_pid = fork();
1483
/* Raise privileges */
1484
raise_privileges_permanently();
1489
perror_plus("setgid");
1491
/* Reset supplementary groups */
1493
ret = setgroups(0, NULL);
1495
perror_plus("setgroups");
1497
dup2(devnull, STDIN_FILENO);
1499
dup2(STDERR_FILENO, STDOUT_FILENO);
1500
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1502
perror_plus("setenv");
1505
ret = setenv("DEVICE", interface, 1);
1507
perror_plus("setenv");
1510
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1512
perror_plus("setenv");
1515
ret = setenv("MODE", mode, 1);
1517
perror_plus("setenv");
1521
ret = asprintf(&delaystring, "%f", delay);
1523
perror_plus("asprintf");
1526
ret = setenv("DELAY", delaystring, 1);
1529
perror_plus("setenv");
1994
1532
free(delaystring);
1995
perror_plus("setenv");
1999
if(connect_to != NULL){
2000
ret = setenv("CONNECT", connect_to, 1);
2002
perror_plus("setenv");
2006
int hook_fd = (int)TEMP_FAILURE_RETRY(openat(hookdir_fd,
2010
perror_plus("openat");
2011
_exit(EXIT_FAILURE);
2013
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
2014
perror_plus("close");
2015
_exit(EXIT_FAILURE);
2017
ret = dup2(devnull, STDIN_FILENO);
2019
perror_plus("dup2(devnull, STDIN_FILENO)");
2022
ret = (int)TEMP_FAILURE_RETRY(close(devnull));
2024
perror_plus("close");
2027
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
2029
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
2032
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
2034
perror_plus("fexecve");
2035
_exit(EXIT_FAILURE);
2039
perror_plus("fork");
2044
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
2045
perror_plus("waitpid");
2049
if(WIFEXITED(status)){
2050
if(WEXITSTATUS(status) != 0){
2051
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
2052
" with status %d\n", direntry->d_name,
2053
WEXITSTATUS(status));
2057
} else if(WIFSIGNALED(status)){
2058
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
2059
" signal %d\n", direntry->d_name,
1533
if(connect_to != NULL){
1534
ret = setenv("CONNECT", connect_to, 1);
1536
perror_plus("setenv");
1540
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1541
perror_plus("execl");
1542
_exit(EXIT_FAILURE);
2064
fprintf_plus(stderr, "Warning: network hook \"%s\""
2065
" crashed\n", direntry->d_name);
2071
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
2077
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
2078
perror_plus("close");
1546
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1547
perror_plus("waitpid");
1551
if(WIFEXITED(status)){
1552
if(WEXITSTATUS(status) != 0){
1553
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1554
" with status %d\n", direntry->d_name,
1555
WEXITSTATUS(status));
1559
} else if(WIFSIGNALED(status)){
1560
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1561
" signal %d\n", direntry->d_name,
1566
fprintf_plus(stderr, "Warning: network hook \"%s\""
1567
" crashed\n", direntry->d_name);
1574
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
2085
__attribute__((nonnull, warn_unused_result))
2086
1583
error_t bring_up_interface(const char *const interface,
2087
1584
const float delay){
2088
1586
error_t old_errno = errno;
1587
error_t ret_errno = 0;
1588
int ret, ret_setflags;
2090
1589
struct ifreq network;
2091
1590
unsigned int if_index = if_nametoindex(interface);
2092
1591
if(if_index == 0){
2287
1755
int main(int argc, char *argv[]){
2288
mandos_context mc = { .server = NULL, .dh_bits = 0,
1756
mandos_context mc = { .server = NULL, .dh_bits = 1024,
2289
1757
.priority = "SECURE256:!CTYPE-X.509:"
2290
"+CTYPE-OPENPGP:!RSA", .current_server = NULL,
2291
.interfaces = NULL, .interfaces_size = 0 };
1758
"+CTYPE-OPENPGP", .current_server = NULL };
2292
1759
AvahiSServiceBrowser *sb = NULL;
2293
1760
error_t ret_errno;
2295
1762
intmax_t tmpmax;
2297
1764
int exitcode = EXIT_SUCCESS;
1765
char *interfaces = NULL;
1766
size_t interfaces_size = 0;
2298
1767
char *interfaces_to_take_down = NULL;
2299
1768
size_t interfaces_to_take_down_size = 0;
2300
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
2301
char old_tempdir[] = "/tmp/mandosXXXXXX";
2302
char *tempdir = NULL;
1769
char tempdir[] = "/tmp/mandosXXXXXX";
1770
bool tempdir_created = false;
2303
1771
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
2304
1772
const char *seckey = PATHDIR "/" SECKEY;
2305
1773
const char *pubkey = PATHDIR "/" PUBKEY;
2306
const char *dh_params_file = NULL;
2307
1774
char *interfaces_hooks = NULL;
1775
size_t interfaces_hooks_size = 0;
2309
1777
bool gnutls_initialized = false;
2310
1778
bool gpgme_initialized = false;
2669
2129
/* If no interfaces were specified, make a list */
2670
if(mc.interfaces == NULL){
2671
struct dirent **direntries = NULL;
2130
if(interfaces == NULL){
2131
struct dirent **direntries;
2672
2132
/* Look for any good interfaces */
2673
2133
ret = scandir(sys_class_net, &direntries, good_interface,
2676
2136
/* Add all found interfaces to interfaces list */
2677
2137
for(int i = 0; i < ret; ++i){
2678
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2138
ret_errno = argz_add(&interfaces, &interfaces_size,
2679
2139
direntries[i]->d_name);
2680
2140
if(ret_errno != 0){
2682
2141
perror_plus("argz_add");
2683
free(direntries[i]);
2687
2145
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2688
2146
direntries[i]->d_name);
2690
free(direntries[i]);
2692
2149
free(direntries);
2697
2152
fprintf_plus(stderr, "Could not find a network interface\n");
2698
2153
exitcode = EXIT_FAILURE;
2703
/* Bring up interfaces which are down, and remove any "none"s */
2158
/* If we only got one interface, explicitly use only that one */
2159
if(argz_count(interfaces, interfaces_size) == 1){
2161
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2164
if_index = (AvahiIfIndex)if_nametoindex(interfaces);
2167
/* Bring up interfaces which are down */
2168
if(not (argz_count(interfaces, interfaces_size) == 1
2169
and strcmp(interfaces, "none") == 0)){
2705
2170
char *interface = NULL;
2706
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2171
while((interface = argz_next(interfaces, interfaces_size,
2708
/* If interface name is "none", stop bringing up interfaces.
2709
Also remove all instances of "none" from the list */
2710
if(strcmp(interface, "none") == 0){
2711
argz_delete(&mc.interfaces, &mc.interfaces_size,
2714
while((interface = argz_next(mc.interfaces,
2715
mc.interfaces_size, interface))){
2716
if(strcmp(interface, "none") == 0){
2717
argz_delete(&mc.interfaces, &mc.interfaces_size,
2724
2173
bool interface_was_up = interface_is_up(interface);
2725
errno = bring_up_interface(interface, delay);
2174
ret = bring_up_interface(interface, delay);
2726
2175
if(not interface_was_up){
2728
2178
perror_plus("Failed to bring up interface");
2730
errno = argz_add(&interfaces_to_take_down,
2731
&interfaces_to_take_down_size,
2734
perror_plus("argz_add");
2180
ret_errno = argz_add(&interfaces_to_take_down,
2181
&interfaces_to_take_down_size,
2188
interfaces_size = 0;
2739
2189
if(debug and (interfaces_to_take_down == NULL)){
2740
2190
fprintf_plus(stderr, "No interfaces were brought up\n");
2744
/* If we only got one interface, explicitly use only that one */
2745
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2747
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2750
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2757
ret = init_gnutls_global(pubkey, seckey, dh_params_file, &mc);
2198
ret = init_gnutls_global(pubkey, seckey, &mc);
2759
2200
fprintf_plus(stderr, "init_gnutls_global failed\n");
2760
2201
exitcode = EX_UNAVAILABLE;
2963
2394
mc.current_server->prev->next = NULL;
2964
2395
while(mc.current_server != NULL){
2965
2396
server *next = mc.current_server->next;
2967
#pragma GCC diagnostic push
2968
#pragma GCC diagnostic ignored "-Wcast-qual"
2970
free((char *)(mc.current_server->ip));
2972
#pragma GCC diagnostic pop
2974
2397
free(mc.current_server);
2975
2398
mc.current_server = next;
2979
/* Re-raise privileges */
2402
/* Re-raise priviliges */
2981
ret_errno = raise_privileges();
2984
perror_plus("Failed to raise privileges");
2987
/* Run network hooks */
2988
run_network_hooks("stop", interfaces_hooks != NULL ?
2989
interfaces_hooks : "", delay);
2991
/* Take down the network interfaces which were brought up */
2993
char *interface = NULL;
2994
while((interface=argz_next(interfaces_to_take_down,
2995
interfaces_to_take_down_size,
2997
ret_errno = take_down_interface(interface);
3000
perror_plus("Failed to take down interface");
3003
if(debug and (interfaces_to_take_down == NULL)){
3004
fprintf_plus(stderr, "No interfaces needed to be taken"
3010
ret_errno = lower_privileges_permanently();
3013
perror_plus("Failed to lower privileges permanently");
2406
/* Run network hooks */
2407
run_network_hooks("stop", interfaces_hooks != NULL ?
2408
interfaces_hooks : "", delay);
2410
/* Take down the network interfaces which were brought up */
2412
char *interface = NULL;
2413
while((interface=argz_next(interfaces_to_take_down,
2414
interfaces_to_take_down_size,
2416
ret_errno = take_down_interface(interface);
2419
perror_plus("Failed to take down interface");
2422
if(debug and (interfaces_to_take_down == NULL)){
2423
fprintf_plus(stderr, "No interfaces needed to be taken"
2428
lower_privileges_permanently();
3017
2431
free(interfaces_to_take_down);
3018
2432
free(interfaces_hooks);
3020
2434
/* Removes the GPGME temp directory and all files inside */
3021
if(tempdir != NULL){
2435
if(tempdir_created){
3022
2436
struct dirent **direntries = NULL;
3023
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY
3027
if(tempdir_fd == -1){
3028
perror_plus("open");
3031
#if __GLIBC_PREREQ(2, 15)
3032
int numentries = scandirat(tempdir_fd, ".", &direntries,
3033
notdotentries, alphasort);
3034
#else /* not __GLIBC_PREREQ(2, 15) */
3035
int numentries = scandir(tempdir, &direntries, notdotentries,
3037
#endif /* not __GLIBC_PREREQ(2, 15) */
3038
#else /* not __GLIBC__ */
3039
int numentries = scandir(tempdir, &direntries, notdotentries,
3041
#endif /* not __GLIBC__ */
3042
if(numentries >= 0){
3043
for(int i = 0; i < numentries; i++){
3044
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
3046
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
3047
" \"%s\", 0): %s\n", tempdir,
3048
direntries[i]->d_name, strerror(errno));
3050
free(direntries[i]);
3053
/* need to clean even if 0 because man page doesn't specify */
3055
if(numentries == -1){
3056
perror_plus("scandir");
3058
ret = rmdir(tempdir);
3059
if(ret == -1 and errno != ENOENT){
3060
perror_plus("rmdir");
2437
struct dirent *direntry = NULL;
2438
int numentries = scandir(tempdir, &direntries, notdotentries,
2440
if (numentries > 0){
2441
for(int i = 0; i < numentries; i++){
2442
direntry = direntries[i];
2443
char *fullname = NULL;
2444
ret = asprintf(&fullname, "%s/%s", tempdir,
2447
perror_plus("asprintf");
2450
ret = remove(fullname);
2452
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
3063
TEMP_FAILURE_RETRY(close(tempdir_fd));
2459
/* need to clean even if 0 because man page doesn't specify */
2461
if (numentries == -1){
2462
perror_plus("scandir");
2464
ret = rmdir(tempdir);
2465
if(ret == -1 and errno != ENOENT){
2466
perror_plus("rmdir");