236
224
perror_plus("strdup");
239
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
perror_plus("clock_gettime");
244
227
/* Special case of first server */
245
228
if(*current_server == NULL){
246
229
new_server->next = new_server;
247
230
new_server->prev = new_server;
248
231
*current_server = new_server;
232
/* Place the new server last in the list */
250
/* Place the new server last in the list */
251
234
new_server->next = *current_server;
252
235
new_server->prev = (*current_server)->prev;
253
236
new_server->prev->next = new_server;
254
237
(*current_server)->prev = new_server;
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
241
perror_plus("clock_gettime");
260
248
* Initialize GPGME.
262
__attribute__((nonnull, warn_unused_result))
263
static bool init_gpgme(const char * const seckey,
264
const char * const pubkey,
265
const char * const tempdir,
250
static bool init_gpgme(const char *seckey, const char *pubkey,
251
const char *tempdir, mandos_context *mc){
267
252
gpgme_error_t rc;
268
253
gpgme_engine_info_t engine_info;
271
256
* Helper function to insert pub and seckey to the engine keyring.
273
bool import_key(const char * const filename){
258
bool import_key(const char *filename){
276
261
gpgme_data_t pgp_data;
790
779
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
791
780
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
792
782
if(af == AF_INET6){
793
ret = getnameinfo((struct sockaddr *)&to,
794
sizeof(struct sockaddr_in6),
795
addrstr, sizeof(addrstr), NULL, 0,
783
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
798
ret = getnameinfo((struct sockaddr *)&to,
799
sizeof(struct sockaddr_in),
800
addrstr, sizeof(addrstr), NULL, 0,
786
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
803
if(ret == EAI_SYSTEM){
804
perror_plus("getnameinfo");
805
} else if(ret != 0) {
806
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
807
} else if(strcmp(addrstr, ip) != 0){
808
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
790
perror_plus("inet_ntop");
792
if(strcmp(addrstr, ip) != 0){
793
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1507
1485
return ret_errno;
1510
__attribute__((nonnull))
1511
void run_network_hooks(const char *mode, const char *interface,
1488
bool run_network_hooks(const char *mode, const char *interface,
1512
1489
const float delay){
1513
1490
struct dirent **direntries;
1514
if(hookdir_fd == -1){
1515
hookdir_fd = open(hookdir, O_RDONLY);
1516
if(hookdir_fd == -1){
1517
if(errno == ENOENT){
1519
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1520
" found\n", hookdir);
1523
perror_plus("open");
1529
#if __GLIBC_PREREQ(2, 15)
1530
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1531
runnable_hook, alphasort);
1532
#else /* not __GLIBC_PREREQ(2, 15) */
1533
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1535
#endif /* not __GLIBC_PREREQ(2, 15) */
1536
#else /* not __GLIBC__ */
1537
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1539
#endif /* not __GLIBC__ */
1491
struct dirent *direntry;
1493
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1540
1495
if(numhooks == -1){
1541
perror_plus("scandir");
1544
struct dirent *direntry;
1546
int devnull = open("/dev/null", O_RDONLY);
1547
for(int i = 0; i < numhooks; i++){
1548
direntry = direntries[i];
1550
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1496
if(errno == ENOENT){
1498
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1499
" found\n", hookdir);
1502
perror_plus("scandir");
1553
pid_t hook_pid = fork();
1556
/* Raise privileges */
1557
if(raise_privileges_permanently() != 0){
1558
perror_plus("Failed to raise privileges");
1565
perror_plus("setgid");
1568
/* Reset supplementary groups */
1570
ret = setgroups(0, NULL);
1572
perror_plus("setgroups");
1575
ret = dup2(devnull, STDIN_FILENO);
1577
perror_plus("dup2(devnull, STDIN_FILENO)");
1580
ret = close(devnull);
1582
perror_plus("close");
1585
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1587
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1590
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1592
perror_plus("setenv");
1595
ret = setenv("DEVICE", interface, 1);
1597
perror_plus("setenv");
1600
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1602
perror_plus("setenv");
1605
ret = setenv("MODE", mode, 1);
1607
perror_plus("setenv");
1611
ret = asprintf(&delaystring, "%f", (double)delay);
1505
int devnull = open("/dev/null", O_RDONLY);
1506
for(int i = 0; i < numhooks; i++){
1507
direntry = direntries[i];
1508
char *fullname = NULL;
1509
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1613
1511
perror_plus("asprintf");
1616
ret = setenv("DELAY", delaystring, 1);
1515
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1518
pid_t hook_pid = fork();
1521
/* Raise privileges */
1522
raise_privileges_permanently();
1527
perror_plus("setgid");
1529
/* Reset supplementary groups */
1531
ret = setgroups(0, NULL);
1533
perror_plus("setgroups");
1535
dup2(devnull, STDIN_FILENO);
1537
dup2(STDERR_FILENO, STDOUT_FILENO);
1538
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1540
perror_plus("setenv");
1543
ret = setenv("DEVICE", interface, 1);
1545
perror_plus("setenv");
1548
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1550
perror_plus("setenv");
1553
ret = setenv("MODE", mode, 1);
1555
perror_plus("setenv");
1559
ret = asprintf(&delaystring, "%f", delay);
1561
perror_plus("asprintf");
1564
ret = setenv("DELAY", delaystring, 1);
1567
perror_plus("setenv");
1618
1570
free(delaystring);
1619
perror_plus("setenv");
1623
if(connect_to != NULL){
1624
ret = setenv("CONNECT", connect_to, 1);
1626
perror_plus("setenv");
1630
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1632
perror_plus("openat");
1633
_exit(EXIT_FAILURE);
1635
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1636
perror_plus("close");
1637
_exit(EXIT_FAILURE);
1639
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1641
perror_plus("fexecve");
1642
_exit(EXIT_FAILURE);
1646
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1647
perror_plus("waitpid");
1650
if(WIFEXITED(status)){
1651
if(WEXITSTATUS(status) != 0){
1652
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1653
" with status %d\n", direntry->d_name,
1654
WEXITSTATUS(status));
1657
} else if(WIFSIGNALED(status)){
1658
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1659
" signal %d\n", direntry->d_name,
1571
if(connect_to != NULL){
1572
ret = setenv("CONNECT", connect_to, 1);
1574
perror_plus("setenv");
1578
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1579
perror_plus("execl");
1580
_exit(EXIT_FAILURE);
1663
fprintf_plus(stderr, "Warning: network hook \"%s\""
1664
" crashed\n", direntry->d_name);
1669
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1673
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1674
perror_plus("close");
1584
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1585
perror_plus("waitpid");
1589
if(WIFEXITED(status)){
1590
if(WEXITSTATUS(status) != 0){
1591
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1592
" with status %d\n", direntry->d_name,
1593
WEXITSTATUS(status));
1597
} else if(WIFSIGNALED(status)){
1598
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1599
" signal %d\n", direntry->d_name,
1604
fprintf_plus(stderr, "Warning: network hook \"%s\""
1605
" crashed\n", direntry->d_name);
1612
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1681
__attribute__((nonnull, warn_unused_result))
1682
1621
error_t bring_up_interface(const char *const interface,
1683
1622
const float delay){
1684
1624
error_t old_errno = errno;
1625
error_t ret_errno = 0;
1626
int ret, ret_setflags;
1686
1627
struct ifreq network;
1687
1628
unsigned int if_index = if_nametoindex(interface);
1688
1629
if(if_index == 0){
2552
/* Re-raise privileges */
2449
/* Re-raise priviliges */
2554
ret_errno = raise_privileges();
2556
perror_plus("Failed to raise privileges");
2559
/* Run network hooks */
2560
run_network_hooks("stop", interfaces_hooks != NULL ?
2561
interfaces_hooks : "", delay);
2563
/* Take down the network interfaces which were brought up */
2565
char *interface = NULL;
2566
while((interface=argz_next(interfaces_to_take_down,
2567
interfaces_to_take_down_size,
2569
ret_errno = take_down_interface(interface);
2572
perror_plus("Failed to take down interface");
2575
if(debug and (interfaces_to_take_down == NULL)){
2576
fprintf_plus(stderr, "No interfaces needed to be taken"
2582
ret_errno = lower_privileges_permanently();
2584
perror_plus("Failed to lower privileges permanently");
2453
/* Run network hooks */
2454
run_network_hooks("stop", interfaces_hooks != NULL ?
2455
interfaces_hooks : "", delay);
2457
/* Take down the network interfaces which were brought up */
2459
char *interface = NULL;
2460
while((interface=argz_next(interfaces_to_take_down,
2461
interfaces_to_take_down_size,
2463
ret_errno = take_down_interface(interface);
2466
perror_plus("Failed to take down interface");
2469
if(debug and (interfaces_to_take_down == NULL)){
2470
fprintf_plus(stderr, "No interfaces needed to be taken"
2475
lower_privileges_permanently();
2588
2478
free(interfaces_to_take_down);
2589
2479
free(interfaces_hooks);
2591
2481
/* Removes the GPGME temp directory and all files inside */
2592
if(tempdir != NULL){
2482
if(tempdir_created){
2593
2483
struct dirent **direntries = NULL;
2594
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2596
if(tempdir_fd == -1){
2597
perror_plus("open");
2600
#if __GLIBC_PREREQ(2, 15)
2601
int numentries = scandirat(tempdir_fd, ".", &direntries,
2602
notdotentries, alphasort);
2603
#else /* not __GLIBC_PREREQ(2, 15) */
2604
int numentries = scandir(tempdir, &direntries, notdotentries,
2606
#endif /* not __GLIBC_PREREQ(2, 15) */
2607
#else /* not __GLIBC__ */
2608
int numentries = scandir(tempdir, &direntries, notdotentries,
2610
#endif /* not __GLIBC__ */
2612
for(int i = 0; i < numentries; i++){
2613
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2615
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2616
" \"%s\", 0): %s\n", tempdir,
2617
direntries[i]->d_name, strerror(errno));
2621
/* need to clean even if 0 because man page doesn't specify */
2623
if(numentries == -1){
2624
perror_plus("scandir");
2626
ret = rmdir(tempdir);
2627
if(ret == -1 and errno != ENOENT){
2628
perror_plus("rmdir");
2484
struct dirent *direntry = NULL;
2485
int numentries = scandir(tempdir, &direntries, notdotentries,
2487
if (numentries > 0){
2488
for(int i = 0; i < numentries; i++){
2489
direntry = direntries[i];
2490
char *fullname = NULL;
2491
ret = asprintf(&fullname, "%s/%s", tempdir,
2494
perror_plus("asprintf");
2497
ret = remove(fullname);
2499
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2631
TEMP_FAILURE_RETRY(close(tempdir_fd));
2506
/* need to clean even if 0 because man page doesn't specify */
2508
if (numentries == -1){
2509
perror_plus("scandir");
2511
ret = rmdir(tempdir);
2512
if(ret == -1 and errno != ENOENT){
2513
perror_plus("rmdir");