534
554
/* GnuTLS server initialization */
535
ret = gnutls_dh_params_init(&mc.dh_params);
555
ret = gnutls_dh_params_init(&mc->dh_params);
536
556
if(ret != GNUTLS_E_SUCCESS){
537
557
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
538
558
" initialization: %s\n",
539
559
safer_gnutls_strerror(ret));
542
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
562
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
543
563
if(ret != GNUTLS_E_SUCCESS){
544
564
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
545
565
safer_gnutls_strerror(ret));
549
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
569
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
555
gnutls_certificate_free_credentials(mc.cred);
575
gnutls_certificate_free_credentials(mc->cred);
556
576
gnutls_global_deinit();
557
gnutls_dh_params_deinit(mc.dh_params);
577
gnutls_dh_params_deinit(mc->dh_params);
561
static int init_gnutls_session(gnutls_session_t *session){
581
__attribute__((nonnull, warn_unused_result))
582
static int init_gnutls_session(gnutls_session_t *session,
563
585
/* GnuTLS session creation */
741
790
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
742
791
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
744
792
if(af == AF_INET6){
745
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
793
ret = getnameinfo((struct sockaddr *)&to,
794
sizeof(struct sockaddr_in6),
795
addrstr, sizeof(addrstr), NULL, 0,
748
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
798
ret = getnameinfo((struct sockaddr *)&to,
799
sizeof(struct sockaddr_in),
800
addrstr, sizeof(addrstr), NULL, 0,
752
perror_plus("inet_ntop");
754
if(strcmp(addrstr, ip) != 0){
755
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
803
if(ret == EAI_SYSTEM){
804
perror_plus("getnameinfo");
805
} else if(ret != 0) {
806
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
807
} else if(strcmp(addrstr, ip) != 0){
808
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1411
1475
if(setuid(0) == -1){
1412
1476
ret_errno = errno;
1413
perror_plus("seteuid");
1415
1478
errno = old_errno;
1416
1479
return ret_errno;
1419
1482
/* Set effective user ID to unprivileged saved user ID */
1483
__attribute__((warn_unused_result))
1420
1484
error_t lower_privileges(void){
1421
1485
error_t old_errno = errno;
1422
1486
error_t ret_errno = 0;
1423
1487
if(seteuid(uid) == -1){
1424
1488
ret_errno = errno;
1425
perror_plus("seteuid");
1427
1490
errno = old_errno;
1428
1491
return ret_errno;
1431
1494
/* Lower privileges permanently */
1495
__attribute__((warn_unused_result))
1432
1496
error_t lower_privileges_permanently(void){
1433
1497
error_t old_errno = errno;
1434
1498
error_t ret_errno = 0;
1435
1499
if(setuid(uid) == -1){
1436
1500
ret_errno = errno;
1437
perror_plus("setuid");
1439
1502
errno = old_errno;
1440
1503
return ret_errno;
1443
bool run_network_hooks(const char *mode, const char *interface,
1506
__attribute__((nonnull))
1507
void run_network_hooks(const char *mode, const char *interface,
1444
1508
const float delay){
1445
struct dirent **direntries;
1509
struct dirent **direntries = NULL;
1510
if(hookdir_fd == -1){
1511
hookdir_fd = open(hookdir, O_RDONLY);
1512
if(hookdir_fd == -1){
1513
if(errno == ENOENT){
1515
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1516
" found\n", hookdir);
1519
perror_plus("open");
1525
#if __GLIBC_PREREQ(2, 15)
1526
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1527
runnable_hook, alphasort);
1528
#else /* not __GLIBC_PREREQ(2, 15) */
1529
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1531
#endif /* not __GLIBC_PREREQ(2, 15) */
1532
#else /* not __GLIBC__ */
1533
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1535
#endif /* not __GLIBC__ */
1537
perror_plus("scandir");
1446
1540
struct dirent *direntry;
1448
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1451
if(errno == ENOENT){
1453
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1454
" found\n", hookdir);
1457
perror_plus("scandir");
1542
int devnull = open("/dev/null", O_RDONLY);
1543
for(int i = 0; i < numhooks; i++){
1544
direntry = direntries[i];
1546
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1460
int devnull = open("/dev/null", O_RDONLY);
1461
for(int i = 0; i < numhooks; i++){
1462
direntry = direntries[i];
1463
char *fullname = NULL;
1464
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1549
pid_t hook_pid = fork();
1552
/* Raise privileges */
1553
errno = raise_privileges_permanently();
1555
perror_plus("Failed to raise privileges");
1562
perror_plus("setgid");
1565
/* Reset supplementary groups */
1567
ret = setgroups(0, NULL);
1569
perror_plus("setgroups");
1572
ret = dup2(devnull, STDIN_FILENO);
1574
perror_plus("dup2(devnull, STDIN_FILENO)");
1577
ret = close(devnull);
1579
perror_plus("close");
1582
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1584
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1587
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1589
perror_plus("setenv");
1592
ret = setenv("DEVICE", interface, 1);
1594
perror_plus("setenv");
1597
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1599
perror_plus("setenv");
1602
ret = setenv("MODE", mode, 1);
1604
perror_plus("setenv");
1608
ret = asprintf(&delaystring, "%f", (double)delay);
1466
1610
perror_plus("asprintf");
1470
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1473
pid_t hook_pid = fork();
1476
/* Raise privileges */
1477
raise_privileges_permanently();
1482
perror_plus("setgid");
1484
/* Reset supplementary groups */
1486
ret = setgroups(0, NULL);
1488
perror_plus("setgroups");
1490
dup2(devnull, STDIN_FILENO);
1492
dup2(STDERR_FILENO, STDOUT_FILENO);
1493
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1495
perror_plus("setenv");
1498
ret = setenv("DEVICE", interface, 1);
1500
perror_plus("setenv");
1503
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1505
perror_plus("setenv");
1508
ret = setenv("MODE", mode, 1);
1510
perror_plus("setenv");
1514
ret = asprintf(&delaystring, "%f", delay);
1516
perror_plus("asprintf");
1519
ret = setenv("DELAY", delaystring, 1);
1522
perror_plus("setenv");
1613
ret = setenv("DELAY", delaystring, 1);
1525
1615
free(delaystring);
1526
if(connect_to != NULL){
1527
ret = setenv("CONNECT", connect_to, 1);
1529
perror_plus("setenv");
1533
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1534
perror_plus("execl");
1535
_exit(EXIT_FAILURE);
1616
perror_plus("setenv");
1620
if(connect_to != NULL){
1621
ret = setenv("CONNECT", connect_to, 1);
1623
perror_plus("setenv");
1627
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1629
perror_plus("openat");
1630
_exit(EXIT_FAILURE);
1632
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1633
perror_plus("close");
1634
_exit(EXIT_FAILURE);
1636
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1638
perror_plus("fexecve");
1639
_exit(EXIT_FAILURE);
1643
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1644
perror_plus("waitpid");
1647
if(WIFEXITED(status)){
1648
if(WEXITSTATUS(status) != 0){
1649
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1650
" with status %d\n", direntry->d_name,
1651
WEXITSTATUS(status));
1654
} else if(WIFSIGNALED(status)){
1655
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1656
" signal %d\n", direntry->d_name,
1539
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1540
perror_plus("waitpid");
1544
if(WIFEXITED(status)){
1545
if(WEXITSTATUS(status) != 0){
1546
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1547
" with status %d\n", direntry->d_name,
1548
WEXITSTATUS(status));
1552
} else if(WIFSIGNALED(status)){
1553
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1554
" signal %d\n", direntry->d_name,
1559
fprintf_plus(stderr, "Warning: network hook \"%s\""
1560
" crashed\n", direntry->d_name);
1567
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1660
fprintf_plus(stderr, "Warning: network hook \"%s\""
1661
" crashed\n", direntry->d_name);
1666
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1671
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1672
perror_plus("close");
1679
__attribute__((nonnull, warn_unused_result))
1576
1680
error_t bring_up_interface(const char *const interface,
1577
1681
const float delay){
1579
1682
error_t old_errno = errno;
1580
error_t ret_errno = 0;
1581
int ret, ret_setflags;
1582
1684
struct ifreq network;
1583
1685
unsigned int if_index = if_nametoindex(interface);
1584
1686
if(if_index == 0){
2139
2275
free(direntries);
2142
2280
fprintf_plus(stderr, "Could not find a network interface\n");
2143
2281
exitcode = EXIT_FAILURE;
2148
/* If we only got one interface, explicitly use only that one */
2149
if(argz_count(interfaces, interfaces_size) == 1){
2151
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2154
if_index = (AvahiIfIndex)if_nametoindex(interfaces);
2157
/* Bring up interfaces which are down */
2158
if(not (argz_count(interfaces, interfaces_size) == 1
2159
and strcmp(interfaces, "none") == 0)){
2286
/* Bring up interfaces which are down, and remove any "none"s */
2160
2288
char *interface = NULL;
2161
while((interface = argz_next(interfaces, interfaces_size,
2289
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2291
/* If interface name is "none", stop bringing up interfaces.
2292
Also remove all instances of "none" from the list */
2293
if(strcmp(interface, "none") == 0){
2294
argz_delete(&mc.interfaces, &mc.interfaces_size,
2297
while((interface = argz_next(mc.interfaces,
2298
mc.interfaces_size, interface))){
2299
if(strcmp(interface, "none") == 0){
2300
argz_delete(&mc.interfaces, &mc.interfaces_size,
2163
2307
bool interface_was_up = interface_is_up(interface);
2164
ret = bring_up_interface(interface, delay);
2308
errno = bring_up_interface(interface, delay);
2165
2309
if(not interface_was_up){
2168
2311
perror_plus("Failed to bring up interface");
2170
ret_errno = argz_add(&interfaces_to_take_down,
2171
&interfaces_to_take_down_size,
2313
errno = argz_add(&interfaces_to_take_down,
2314
&interfaces_to_take_down_size,
2317
perror_plus("argz_add");
2178
interfaces_size = 0;
2179
2322
if(debug and (interfaces_to_take_down == NULL)){
2180
2323
fprintf_plus(stderr, "No interfaces were brought up\n");
2327
/* If we only got one interface, explicitly use only that one */
2328
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2330
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2333
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2188
ret = init_gnutls_global(pubkey, seckey);
2340
ret = init_gnutls_global(pubkey, seckey, &mc);
2190
2342
fprintf_plus(stderr, "init_gnutls_global failed\n");
2191
2343
exitcode = EX_UNAVAILABLE;
2390
/* Re-raise priviliges */
2554
/* Re-raise privileges */
2394
/* Run network hooks */
2395
run_network_hooks("stop", interfaces_hooks != NULL ?
2396
interfaces_hooks : "", delay);
2398
/* Take down the network interfaces which were brought up */
2400
char *interface = NULL;
2401
while((interface=argz_next(interfaces_to_take_down,
2402
interfaces_to_take_down_size,
2404
ret_errno = take_down_interface(interface);
2407
perror_plus("Failed to take down interface");
2410
if(debug and (interfaces_to_take_down == NULL)){
2411
fprintf_plus(stderr, "No interfaces needed to be taken"
2416
lower_privileges_permanently();
2556
ret_errno = raise_privileges();
2559
perror_plus("Failed to raise privileges");
2562
/* Run network hooks */
2563
run_network_hooks("stop", interfaces_hooks != NULL ?
2564
interfaces_hooks : "", delay);
2566
/* Take down the network interfaces which were brought up */
2568
char *interface = NULL;
2569
while((interface=argz_next(interfaces_to_take_down,
2570
interfaces_to_take_down_size,
2572
ret_errno = take_down_interface(interface);
2575
perror_plus("Failed to take down interface");
2578
if(debug and (interfaces_to_take_down == NULL)){
2579
fprintf_plus(stderr, "No interfaces needed to be taken"
2585
ret_errno = lower_privileges_permanently();
2588
perror_plus("Failed to lower privileges permanently");
2419
2592
free(interfaces_to_take_down);
2420
2593
free(interfaces_hooks);
2422
2595
/* Removes the GPGME temp directory and all files inside */
2423
if(tempdir_created){
2596
if(tempdir != NULL){
2424
2597
struct dirent **direntries = NULL;
2425
struct dirent *direntry = NULL;
2426
int numentries = scandir(tempdir, &direntries, notdotentries,
2428
if (numentries > 0){
2429
for(int i = 0; i < numentries; i++){
2430
direntry = direntries[i];
2431
char *fullname = NULL;
2432
ret = asprintf(&fullname, "%s/%s", tempdir,
2435
perror_plus("asprintf");
2438
ret = remove(fullname);
2440
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2598
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2600
if(tempdir_fd == -1){
2601
perror_plus("open");
2604
#if __GLIBC_PREREQ(2, 15)
2605
int numentries = scandirat(tempdir_fd, ".", &direntries,
2606
notdotentries, alphasort);
2607
#else /* not __GLIBC_PREREQ(2, 15) */
2608
int numentries = scandir(tempdir, &direntries, notdotentries,
2610
#endif /* not __GLIBC_PREREQ(2, 15) */
2611
#else /* not __GLIBC__ */
2612
int numentries = scandir(tempdir, &direntries, notdotentries,
2614
#endif /* not __GLIBC__ */
2615
if(numentries >= 0){
2616
for(int i = 0; i < numentries; i++){
2617
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2619
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2620
" \"%s\", 0): %s\n", tempdir,
2621
direntries[i]->d_name, strerror(errno));
2625
/* need to clean even if 0 because man page doesn't specify */
2627
if(numentries == -1){
2628
perror_plus("scandir");
2630
ret = rmdir(tempdir);
2631
if(ret == -1 and errno != ENOENT){
2632
perror_plus("rmdir");
2447
/* need to clean even if 0 because man page doesn't specify */
2449
if (numentries == -1){
2450
perror_plus("scandir");
2452
ret = rmdir(tempdir);
2453
if(ret == -1 and errno != ENOENT){
2454
perror_plus("rmdir");
2635
TEMP_FAILURE_RETRY(close(tempdir_fd));