225
235
if(new_server->ip == NULL){
226
236
perror_plus("strdup");
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
242
perror_plus("clock_gettime");
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
247
free((char *)(new_server->ip));
249
#pragma GCC diagnostic pop
229
254
/* Special case of first server */
230
if (mc.current_server == NULL){
255
if(*current_server == NULL){
231
256
new_server->next = new_server;
232
257
new_server->prev = new_server;
233
mc.current_server = new_server;
234
/* Place the new server last in the list */
258
*current_server = new_server;
236
new_server->next = mc.current_server;
237
new_server->prev = mc.current_server->prev;
260
/* Place the new server last in the list */
261
new_server->next = *current_server;
262
new_server->prev = (*current_server)->prev;
238
263
new_server->prev->next = new_server;
239
mc.current_server->prev = new_server;
241
ret = clock_gettime(CLOCK_MONOTONIC, &mc.current_server->last_seen);
243
perror_plus("clock_gettime");
264
(*current_server)->prev = new_server;
536
564
/* GnuTLS server initialization */
537
ret = gnutls_dh_params_init(&mc.dh_params);
565
ret = gnutls_dh_params_init(&mc->dh_params);
538
566
if(ret != GNUTLS_E_SUCCESS){
539
567
fprintf_plus(stderr, "Error in GnuTLS DH parameter"
540
568
" initialization: %s\n",
541
569
safer_gnutls_strerror(ret));
544
ret = gnutls_dh_params_generate2(mc.dh_params, mc.dh_bits);
572
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
545
573
if(ret != GNUTLS_E_SUCCESS){
546
574
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
547
575
safer_gnutls_strerror(ret));
551
gnutls_certificate_set_dh_params(mc.cred, mc.dh_params);
579
gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
557
gnutls_certificate_free_credentials(mc.cred);
585
gnutls_certificate_free_credentials(mc->cred);
558
586
gnutls_global_deinit();
559
gnutls_dh_params_deinit(mc.dh_params);
587
gnutls_dh_params_deinit(mc->dh_params);
563
static int init_gnutls_session(gnutls_session_t *session){
591
__attribute__((nonnull, warn_unused_result))
592
static int init_gnutls_session(gnutls_session_t *session,
565
595
/* GnuTLS session creation */
743
800
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
744
801
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
746
802
if(af == AF_INET6){
747
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
803
ret = getnameinfo((struct sockaddr *)&to,
804
sizeof(struct sockaddr_in6),
805
addrstr, sizeof(addrstr), NULL, 0,
750
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
808
ret = getnameinfo((struct sockaddr *)&to,
809
sizeof(struct sockaddr_in),
810
addrstr, sizeof(addrstr), NULL, 0,
754
perror_plus("inet_ntop");
756
if(strcmp(addrstr, ip) != 0){
757
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
813
if(ret == EAI_SYSTEM){
814
perror_plus("getnameinfo");
815
} else if(ret != 0) {
816
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
817
} else if(strcmp(addrstr, ip) != 0){
818
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
1413
1486
if(setuid(0) == -1){
1414
1487
ret_errno = errno;
1415
perror_plus("seteuid");
1417
1489
errno = old_errno;
1418
1490
return ret_errno;
1421
1493
/* Set effective user ID to unprivileged saved user ID */
1494
__attribute__((warn_unused_result))
1422
1495
error_t lower_privileges(void){
1423
1496
error_t old_errno = errno;
1424
1497
error_t ret_errno = 0;
1425
1498
if(seteuid(uid) == -1){
1426
1499
ret_errno = errno;
1427
perror_plus("seteuid");
1429
1501
errno = old_errno;
1430
1502
return ret_errno;
1433
1505
/* Lower privileges permanently */
1506
__attribute__((warn_unused_result))
1434
1507
error_t lower_privileges_permanently(void){
1435
1508
error_t old_errno = errno;
1436
1509
error_t ret_errno = 0;
1437
1510
if(setuid(uid) == -1){
1438
1511
ret_errno = errno;
1439
perror_plus("setuid");
1441
1513
errno = old_errno;
1442
1514
return ret_errno;
1445
bool run_network_hooks(const char *mode, const char *interface,
1517
__attribute__((nonnull))
1518
void run_network_hooks(const char *mode, const char *interface,
1446
1519
const float delay){
1447
struct dirent **direntries;
1520
struct dirent **direntries = NULL;
1521
if(hookdir_fd == -1){
1522
hookdir_fd = open(hookdir, O_RDONLY);
1523
if(hookdir_fd == -1){
1524
if(errno == ENOENT){
1526
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1527
" found\n", hookdir);
1530
perror_plus("open");
1536
#if __GLIBC_PREREQ(2, 15)
1537
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1538
runnable_hook, alphasort);
1539
#else /* not __GLIBC_PREREQ(2, 15) */
1540
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1542
#endif /* not __GLIBC_PREREQ(2, 15) */
1543
#else /* not __GLIBC__ */
1544
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1546
#endif /* not __GLIBC__ */
1548
perror_plus("scandir");
1448
1551
struct dirent *direntry;
1450
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1453
if(errno == ENOENT){
1455
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1456
" found\n", hookdir);
1459
perror_plus("scandir");
1553
int devnull = open("/dev/null", O_RDONLY);
1554
for(int i = 0; i < numhooks; i++){
1555
direntry = direntries[i];
1557
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1462
int devnull = open("/dev/null", O_RDONLY);
1463
for(int i = 0; i < numhooks; i++){
1464
direntry = direntries[i];
1465
char *fullname = NULL;
1466
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1560
pid_t hook_pid = fork();
1563
/* Raise privileges */
1564
errno = raise_privileges_permanently();
1566
perror_plus("Failed to raise privileges");
1573
perror_plus("setgid");
1576
/* Reset supplementary groups */
1578
ret = setgroups(0, NULL);
1580
perror_plus("setgroups");
1583
ret = dup2(devnull, STDIN_FILENO);
1585
perror_plus("dup2(devnull, STDIN_FILENO)");
1588
ret = close(devnull);
1590
perror_plus("close");
1593
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1595
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1598
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1600
perror_plus("setenv");
1603
ret = setenv("DEVICE", interface, 1);
1605
perror_plus("setenv");
1608
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1610
perror_plus("setenv");
1613
ret = setenv("MODE", mode, 1);
1615
perror_plus("setenv");
1619
ret = asprintf(&delaystring, "%f", (double)delay);
1468
1621
perror_plus("asprintf");
1472
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1475
pid_t hook_pid = fork();
1478
/* Raise privileges */
1479
raise_privileges_permanently();
1484
perror_plus("setgid");
1486
/* Reset supplementary groups */
1488
ret = setgroups(0, NULL);
1490
perror_plus("setgroups");
1492
dup2(devnull, STDIN_FILENO);
1494
dup2(STDERR_FILENO, STDOUT_FILENO);
1495
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1497
perror_plus("setenv");
1500
ret = setenv("DEVICE", interface, 1);
1502
perror_plus("setenv");
1505
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1507
perror_plus("setenv");
1510
ret = setenv("MODE", mode, 1);
1512
perror_plus("setenv");
1516
ret = asprintf(&delaystring, "%f", delay);
1518
perror_plus("asprintf");
1521
ret = setenv("DELAY", delaystring, 1);
1524
perror_plus("setenv");
1624
ret = setenv("DELAY", delaystring, 1);
1527
1626
free(delaystring);
1528
if(connect_to != NULL){
1529
ret = setenv("CONNECT", connect_to, 1);
1531
perror_plus("setenv");
1535
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1536
perror_plus("execl");
1537
_exit(EXIT_FAILURE);
1627
perror_plus("setenv");
1631
if(connect_to != NULL){
1632
ret = setenv("CONNECT", connect_to, 1);
1634
perror_plus("setenv");
1638
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1640
perror_plus("openat");
1641
_exit(EXIT_FAILURE);
1643
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1644
perror_plus("close");
1645
_exit(EXIT_FAILURE);
1647
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1649
perror_plus("fexecve");
1650
_exit(EXIT_FAILURE);
1654
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1655
perror_plus("waitpid");
1659
if(WIFEXITED(status)){
1660
if(WEXITSTATUS(status) != 0){
1661
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1662
" with status %d\n", direntry->d_name,
1663
WEXITSTATUS(status));
1667
} else if(WIFSIGNALED(status)){
1668
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1669
" signal %d\n", direntry->d_name,
1541
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1542
perror_plus("waitpid");
1546
if(WIFEXITED(status)){
1547
if(WEXITSTATUS(status) != 0){
1548
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1549
" with status %d\n", direntry->d_name,
1550
WEXITSTATUS(status));
1554
} else if(WIFSIGNALED(status)){
1555
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1556
" signal %d\n", direntry->d_name,
1561
fprintf_plus(stderr, "Warning: network hook \"%s\""
1562
" crashed\n", direntry->d_name);
1569
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1674
fprintf_plus(stderr, "Warning: network hook \"%s\""
1675
" crashed\n", direntry->d_name);
1681
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1687
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1688
perror_plus("close");
1695
__attribute__((nonnull, warn_unused_result))
1578
1696
error_t bring_up_interface(const char *const interface,
1579
1697
const float delay){
1581
1698
error_t old_errno = errno;
1582
error_t ret_errno = 0;
1583
int ret, ret_setflags;
1584
1700
struct ifreq network;
1585
1701
unsigned int if_index = if_nametoindex(interface);
1586
1702
if(if_index == 0){
2116
2270
/* If no interfaces were specified, make a list */
2117
if(interfaces == NULL){
2118
struct dirent **direntries;
2271
if(mc.interfaces == NULL){
2272
struct dirent **direntries = NULL;
2119
2273
/* Look for any good interfaces */
2120
2274
ret = scandir(sys_class_net, &direntries, good_interface,
2123
2277
/* Add all found interfaces to interfaces list */
2124
2278
for(int i = 0; i < ret; ++i){
2125
ret_errno = argz_add(&interfaces, &interfaces_size,
2279
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2126
2280
direntries[i]->d_name);
2127
2281
if(ret_errno != 0){
2128
2283
perror_plus("argz_add");
2284
free(direntries[i]);
2132
2288
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2133
2289
direntries[i]->d_name);
2291
free(direntries[i]);
2136
2293
free(direntries);
2139
2298
fprintf_plus(stderr, "Could not find a network interface\n");
2140
2299
exitcode = EXIT_FAILURE;
2145
/* If we only got one interface, explicitly use only that one */
2146
if(argz_count(interfaces, interfaces_size) == 1){
2148
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2151
if_index = (AvahiIfIndex)if_nametoindex(interfaces);
2154
/* Bring up interfaces which are down */
2155
if(not (argz_count(interfaces, interfaces_size) == 1
2156
and strcmp(interfaces, "none") == 0)){
2304
/* Bring up interfaces which are down, and remove any "none"s */
2157
2306
char *interface = NULL;
2158
while((interface = argz_next(interfaces, interfaces_size,
2307
while((interface = argz_next(mc.interfaces, mc.interfaces_size,
2309
/* If interface name is "none", stop bringing up interfaces.
2310
Also remove all instances of "none" from the list */
2311
if(strcmp(interface, "none") == 0){
2312
argz_delete(&mc.interfaces, &mc.interfaces_size,
2315
while((interface = argz_next(mc.interfaces,
2316
mc.interfaces_size, interface))){
2317
if(strcmp(interface, "none") == 0){
2318
argz_delete(&mc.interfaces, &mc.interfaces_size,
2160
2325
bool interface_was_up = interface_is_up(interface);
2161
ret = bring_up_interface(interface, delay);
2326
errno = bring_up_interface(interface, delay);
2162
2327
if(not interface_was_up){
2165
2329
perror_plus("Failed to bring up interface");
2167
ret_errno = argz_add(&interfaces_to_take_down,
2168
&interfaces_to_take_down_size,
2331
errno = argz_add(&interfaces_to_take_down,
2332
&interfaces_to_take_down_size,
2335
perror_plus("argz_add");
2175
interfaces_size = 0;
2176
2340
if(debug and (interfaces_to_take_down == NULL)){
2177
2341
fprintf_plus(stderr, "No interfaces were brought up\n");
2345
/* If we only got one interface, explicitly use only that one */
2346
if(argz_count(mc.interfaces, mc.interfaces_size) == 1){
2348
fprintf_plus(stderr, "Using only interface \"%s\"\n",
2351
if_index = (AvahiIfIndex)if_nametoindex(mc.interfaces);
2185
ret = init_gnutls_global(pubkey, seckey);
2358
ret = init_gnutls_global(pubkey, seckey, &mc);
2187
2360
fprintf_plus(stderr, "init_gnutls_global failed\n");
2188
2361
exitcode = EX_UNAVAILABLE;
2380
2564
mc.current_server->prev->next = NULL;
2381
2565
while(mc.current_server != NULL){
2382
2566
server *next = mc.current_server->next;
2568
#pragma GCC diagnostic push
2569
#pragma GCC diagnostic ignored "-Wcast-qual"
2571
free((char *)(mc.current_server->ip));
2573
#pragma GCC diagnostic pop
2383
2575
free(mc.current_server);
2384
2576
mc.current_server = next;
2388
/* Re-raise priviliges */
2580
/* Re-raise privileges */
2392
/* Run network hooks */
2393
run_network_hooks("stop", interfaces_hooks, delay);
2395
/* Take down the network interfaces which were brought up */
2397
char *interface = NULL;
2398
while((interface=argz_next(interfaces_to_take_down,
2399
interfaces_to_take_down_size,
2401
ret_errno = take_down_interface(interface);
2404
perror_plus("Failed to take down interface");
2407
if(debug and (interfaces_to_take_down == NULL)){
2408
fprintf_plus(stderr, "No interfaces needed to be taken"
2413
lower_privileges_permanently();
2582
ret_errno = raise_privileges();
2585
perror_plus("Failed to raise privileges");
2588
/* Run network hooks */
2589
run_network_hooks("stop", interfaces_hooks != NULL ?
2590
interfaces_hooks : "", delay);
2592
/* Take down the network interfaces which were brought up */
2594
char *interface = NULL;
2595
while((interface=argz_next(interfaces_to_take_down,
2596
interfaces_to_take_down_size,
2598
ret_errno = take_down_interface(interface);
2601
perror_plus("Failed to take down interface");
2604
if(debug and (interfaces_to_take_down == NULL)){
2605
fprintf_plus(stderr, "No interfaces needed to be taken"
2611
ret_errno = lower_privileges_permanently();
2614
perror_plus("Failed to lower privileges permanently");
2416
2618
free(interfaces_to_take_down);
2417
2619
free(interfaces_hooks);
2419
2621
/* Removes the GPGME temp directory and all files inside */
2420
if(tempdir_created){
2622
if(tempdir != NULL){
2421
2623
struct dirent **direntries = NULL;
2422
struct dirent *direntry = NULL;
2423
int numentries = scandir(tempdir, &direntries, notdotentries,
2425
if (numentries > 0){
2426
for(int i = 0; i < numentries; i++){
2427
direntry = direntries[i];
2428
char *fullname = NULL;
2429
ret = asprintf(&fullname, "%s/%s", tempdir,
2432
perror_plus("asprintf");
2435
ret = remove(fullname);
2437
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2624
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2626
if(tempdir_fd == -1){
2627
perror_plus("open");
2630
#if __GLIBC_PREREQ(2, 15)
2631
int numentries = scandirat(tempdir_fd, ".", &direntries,
2632
notdotentries, alphasort);
2633
#else /* not __GLIBC_PREREQ(2, 15) */
2634
int numentries = scandir(tempdir, &direntries, notdotentries,
2636
#endif /* not __GLIBC_PREREQ(2, 15) */
2637
#else /* not __GLIBC__ */
2638
int numentries = scandir(tempdir, &direntries, notdotentries,
2640
#endif /* not __GLIBC__ */
2641
if(numentries >= 0){
2642
for(int i = 0; i < numentries; i++){
2643
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2645
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2646
" \"%s\", 0): %s\n", tempdir,
2647
direntries[i]->d_name, strerror(errno));
2649
free(direntries[i]);
2652
/* need to clean even if 0 because man page doesn't specify */
2654
if(numentries == -1){
2655
perror_plus("scandir");
2657
ret = rmdir(tempdir);
2658
if(ret == -1 and errno != ENOENT){
2659
perror_plus("rmdir");
2444
/* need to clean even if 0 because man page doesn't specify */
2446
if (numentries == -1){
2447
perror_plus("scandir");
2449
ret = rmdir(tempdir);
2450
if(ret == -1 and errno != ENOENT){
2451
perror_plus("rmdir");
2662
TEMP_FAILURE_RETRY(close(tempdir_fd));