/mandos/trunk : revision 693

40

#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */

41

42

#include <stdio.h> /* fprintf(), stderr, fwrite(),

43

stdout, ferror() */

43

stdout, ferror(), remove() */

44

#include <stdint.h> /* uint16_t, uint32_t, intptr_t */

45

#include <stddef.h> /* NULL, size_t, ssize_t */

46

#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),

57

#include <sys/socket.h> /* socket(), struct sockaddr_in6,

58

inet_pton(), connect(),

59

getnameinfo() */

60

#include <fcntl.h> /* open(), unlinkat() */

60

#include <fcntl.h> /* open() */

61

#include <dirent.h> /* opendir(), struct dirent, readdir()

62

*/

63

#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,

73

*/

74

#include <unistd.h> /* close(), SEEK_SET, off_t, write(),

75

getuid(), getgid(), seteuid(),

76

setgid(), pause(), _exit(),

77

unlinkat() */

76

setgid(), pause(), _exit() */

78

77

#include <arpa/inet.h> /* inet_pton(), htons() */

79

78

#include <iso646.h> /* not, or, and */

80

79

#include <argp.h> /* struct argp_option, error_t, struct

234

233

.af = af };

235

234

if(new_server->ip == NULL){

236

235

perror_plus("strdup");

237

free(new_server);

238

236

return false;

239

237

}

240

238

ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));

241

239

if(ret == -1){

242

240

perror_plus("clock_gettime");

243

free(new_server->ip);

244

free(new_server);

245

241

return false;

246

242

}

247

243

/* Special case of first server */

1461

1457

error_t ret_errno = 0;

1462

1458

if(seteuid(0) == -1){

1463

1459

ret_errno = errno;

1460

perror_plus("seteuid");

1464

1461

}

1465

1462

errno = old_errno;

1466

1463

return ret_errno;

1477

1474

}

1478

1475

if(setuid(0) == -1){

1479

1476

ret_errno = errno;

1477

perror_plus("seteuid");

1480

1478

}

1481

1479

errno = old_errno;

1482

1480

return ret_errno;

1489

1487

error_t ret_errno = 0;

1490

1488

if(seteuid(uid) == -1){

1491

1489

ret_errno = errno;

1490

perror_plus("seteuid");

1492

1491

}

1493

1492

errno = old_errno;

1494

1493

return ret_errno;

1501

1500

error_t ret_errno = 0;

1502

1501

if(setuid(uid) == -1){

1503

1502

ret_errno = errno;

1503

perror_plus("setuid");

1504

}

1505

errno = old_errno;

1506

return ret_errno;

1507

}

1508

1509

#ifndef O_CLOEXEC

1510

/*

1511

* Based on the example in the GNU LibC manual chapter 13.13 "File

1512

* Descriptor Flags".

1513

| [[info:libc:Descriptor%20Flags][File Descriptor Flags]] |

1514

*/

1515

__attribute__((warn_unused_result))

1516

static int set_cloexec_flag(int fd){

1517

int ret = (int)TEMP_FAILURE_RETRY(fcntl(fd, F_GETFD, 0));

1518

/* If reading the flags failed, return error indication now. */

1519

if(ret < 0){

1520

return ret;

1521

}

1522

/* Store modified flag word in the descriptor. */

1523

return (int)TEMP_FAILURE_RETRY(fcntl(fd, F_SETFD,

1524

ret | FD_CLOEXEC));

1525

}

1526

#endif /* not O_CLOEXEC */

1527

1509

1528

__attribute__((nonnull))

1510

1529

void run_network_hooks(const char *mode, const char *interface,

1511

1530

const float delay){

1512

struct dirent **direntries = NULL;

1531

struct dirent **direntries;

1513

1532

if(hookdir_fd == -1){

1514

hookdir_fd = open(hookdir, O_RDONLY);

1533

hookdir_fd = open(hookdir, O_RDONLY |

1534

#ifdef O_CLOEXEC

1535

O_CLOEXEC

1536

#else /* not O_CLOEXEC */

1537

0

1538

#endif /* not O_CLOEXEC */

1539

);

1515

1540

if(hookdir_fd == -1){

1516

1541

if(errno == ENOENT){

1517

1542

if(debug){

1523

1548

}

1524

1549

return;

1525

1550

}

1551

#ifndef O_CLOEXEC

1552

if(set_cloexec_flag(hookdir_fd) < 0){

1553

perror_plus("set_cloexec_flag");

1554

if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){

1555

perror_plus("close");

1556

} else {

1557

hookdir_fd = -1;

1558

}

1559

return;

1560

}

1561

#endif /* not O_CLOEXEC */

1526

1562

}

1527

1563

#ifdef __GLIBC__

1528

1564

#if __GLIBC_PREREQ(2, 15)

1553

1589

if(hook_pid == 0){

1554

1590

/* Child */

1555

1591

/* Raise privileges */

1556

errno = raise_privileges_permanently();

1557

if(errno != 0){

1592

if(raise_privileges_permanently() != 0){

1558

1593

perror_plus("Failed to raise privileges");

1559

1594

_exit(EX_NOPERM);

1560

1595

}

1627

1662

_exit(EX_OSERR);

1628

1663

}

1629

1664

}

1630

int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);

1631

if(hook_fd == -1){

1632

perror_plus("openat");

1633

_exit(EXIT_FAILURE);

1634

}

1635

if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){

1636

perror_plus("close");

1637

_exit(EXIT_FAILURE);

1638

}

1639

if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },

1640

environ) == -1){

1665

if(fexecve(hookdir_fd, (char *const [])

1666

{ direntry->d_name, NULL }, environ) == -1){

1641

1667

perror_plus("fexecve");

1642

1668

_exit(EXIT_FAILURE);

1643

1669

}

1670

1696

direntry->d_name);

1671

1697

}

1672

1698

}

1673

free(direntries);

1674

1699

if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){

1675

1700

perror_plus("close");

1676

1701

} else {

1733

1758

/* Raise privileges */

1734

1759

ret_errno = raise_privileges();

1735

1760

if(ret_errno != 0){

1736

errno = ret_errno;

1737

1761

perror_plus("Failed to raise privileges");

1738

1762

}

1739

1763

1843

1867

/* Raise privileges */

1844

1868

ret_errno = raise_privileges();

1845

1869

if(ret_errno != 0){

1846

errno = ret_errno;

1847

1870

perror_plus("Failed to raise privileges");

1848

1871

}

1849

1872

2256

2279

2257

2280

/* If no interfaces were specified, make a list */

2258

2281

if(mc.interfaces == NULL){

2259

struct dirent **direntries = NULL;

2282

struct dirent **direntries;

2260

2283

/* Look for any good interfaces */

2261

2284

ret = scandir(sys_class_net, &direntries, good_interface,

2262

2285

alphasort);

2277

2300

}

2278

2301

free(direntries);

2279

2302

} else {

2280

if(ret == 0){

2281

free(direntries);

2282

}

2303

free(direntries);

2283

2304

fprintf_plus(stderr, "Could not find a network interface\n");

2284

2305

exitcode = EXIT_FAILURE;

2285

2306

goto end;

2558

2579

{

2559

2580

ret_errno = raise_privileges();

2560

2581

if(ret_errno != 0){

2561

errno = ret_errno;

2562

2582

perror_plus("Failed to raise privileges");

2563

2583

} else {

2564

2584

2587

2607

2588

2608

ret_errno = lower_privileges_permanently();

2589

2609

if(ret_errno != 0){

2590

errno = ret_errno;

2591

2610

perror_plus("Failed to lower privileges permanently");

2592

2611

}

2593

2612

}

2598

2617

/* Removes the GPGME temp directory and all files inside */

2599

2618

if(tempdir != NULL){

2600

2619

struct dirent **direntries = NULL;

2601

int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |

2602

O_NOFOLLOW));

2603

if(tempdir_fd == -1){

2604

perror_plus("open");

2605

} else {

2606

#ifdef __GLIBC__

2607

#if __GLIBC_PREREQ(2, 15)

2608

int numentries = scandirat(tempdir_fd, ".", &direntries,

2609

notdotentries, alphasort);

2610

#else /* not __GLIBC_PREREQ(2, 15) */

2611

int numentries = scandir(tempdir, &direntries, notdotentries,

2612

alphasort);

2613

#endif /* not __GLIBC_PREREQ(2, 15) */

2614

#else /* not __GLIBC__ */

2615

int numentries = scandir(tempdir, &direntries, notdotentries,

2616

alphasort);

2617

#endif /* not __GLIBC__ */

2618

if(numentries >= 0){

2619

for(int i = 0; i < numentries; i++){

2620

ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);

2621

if(ret == -1){

2622

fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"

2623

" \"%s\", 0): %s\n", tempdir,

2624

direntries[i]->d_name, strerror(errno));

2625

}

2626

}

2627

2628

/* need to clean even if 0 because man page doesn't specify */

2629

free(direntries);

2630

if(numentries == -1){

2631

perror_plus("scandir");

2632

}

2633

ret = rmdir(tempdir);

2634

if(ret == -1 and errno != ENOENT){

2635

perror_plus("rmdir");

2636

}

2620

struct dirent *direntry = NULL;

2621

int numentries = scandir(tempdir, &direntries, notdotentries,

2622

alphasort);

2623

if(numentries > 0){

2624

for(int i = 0; i < numentries; i++){

2625

direntry = direntries[i];

2626

char *fullname = NULL;

2627

ret = asprintf(&fullname, "%s/%s", tempdir,

2628

direntry->d_name);

2629

if(ret < 0){

2630

perror_plus("asprintf");

2631

continue;

2632

}

2633

ret = remove(fullname);

2634

if(ret == -1){

2635

fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,

2636

strerror(errno));

2637

}

2638

free(fullname);

2637

2639

}

2638

TEMP_FAILURE_RETRY(close(tempdir_fd));

2640

}

2641

2642

/* need to clean even if 0 because man page doesn't specify */

2643

free(direntries);

2644

if(numentries == -1){

2645

perror_plus("scandir");

2646

}

2647

ret = rmdir(tempdir);

2648

if(ret == -1 and errno != ENOENT){

2649

perror_plus("rmdir");

2639

2650

}

2640

2651

}

2641

2652