To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 741
- compare with another revision
- download diff
- download tarball
- view history from revision 741
- Committer: Teddy Hogeborn
- Date: 2015-01-25 00:02:51 UTC
- Revision ID: teddy@recompile.se-20150125000251-j2bw50gfq9smqyxe
mandos.xml (SEE ALSO): Update links.
Update link to GnuPG home page, change reference from TLS 1.1 to TLS
1.2, and change to latest RFC for using OpenPGP keys with TLS (and use
its correct title).
Update link to GnuPG home page, change reference from TLS 1.1 to TLS
1.2, and change to latest RFC for using OpenPGP keys with TLS (and use
its correct title).
- files added:
- debian/upstream
- files modified:
- DBUS-API
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2013 Teddy Hogeborn
13
* Copyright © 2008-2013 Björn Påhlsson
12
* Copyright © 2008-2014 Teddy Hogeborn
13
* Copyright © 2008-2014 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif
35
#endif /* not _LARGEFILE_SOURCE */
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif
38
#endif /* not _FILE_OFFSET_BITS */
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
43
stdout, ferror() */
44
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
55
55
opendir(), DIR */
56
56
#include <sys/stat.h> /* open(), S_ISREG */
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
inet_pton(), connect() */
59
#include <fcntl.h> /* open() */
58
inet_pton(), connect(),
59
getnameinfo() */
60
#include <fcntl.h> /* open(), unlinkat() */
60
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
61
62
*/
62
63
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
72
73
*/
73
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
74
75
getuid(), getgid(), seteuid(),
75
setgid(), pause(), _exit() */
76
#include <arpa/inet.h> /* inet_pton(), htons, inet_ntop() */
76
setgid(), pause(), _exit(),
77
unlinkat() */
78
#include <arpa/inet.h> /* inet_pton(), htons() */
77
79
#include <iso646.h> /* not, or, and */
78
80
#include <argp.h> /* struct argp_option, error_t, struct
79
81
argp_state, struct argp,
91
93
argz_delete(), argz_append(),
92
94
argz_stringify(), argz_add(),
93
95
argz_count() */
96
#include <netdb.h> /* getnameinfo(), NI_NUMERICHOST,
97
EAI_SYSTEM, gai_strerror() */
94
98
95
99
#ifdef __linux__
96
100
#include <sys/klog.h> /* klogctl() */
138
142
static const char sys_class_net[] = "/sys/class/net";
139
143
char *connect_to = NULL;
140
144
const char *hookdir = HOOKDIR;
145
int hookdir_fd = -1;
141
146
uid_t uid = 65534;
142
147
gid_t gid = 65534;
143
148
180
185
perror(print_text);
181
186
}
182
187
183
__attribute__((format (gnu_printf, 2, 3)))
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
184
189
int fprintf_plus(FILE *stream, const char *format, ...){
185
190
va_list ap;
186
191
va_start (ap, format);
195
200
* bytes. "buffer_capacity" is how much is currently allocated,
196
201
* "buffer_length" is how much is already used.
197
202
*/
203
__attribute__((nonnull, warn_unused_result))
198
204
size_t incbuffer(char **buffer, size_t buffer_length,
199
205
size_t buffer_capacity){
200
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
201
*buffer = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
202
if(buffer == NULL){
207
char *new_buf = realloc(*buffer, buffer_capacity + BUFFER_SIZE);
208
if(new_buf == NULL){
209
int old_errno = errno;
210
free(*buffer);
211
errno = old_errno;
212
*buffer = NULL;
203
213
return 0;
204
214
}
215
*buffer = new_buf;
205
216
buffer_capacity += BUFFER_SIZE;
206
217
}
207
218
return buffer_capacity;
208
219
}
209
220
210
221
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
211
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
212
224
int af, server **current_server){
213
225
int ret;
222
234
.af = af };
223
235
if(new_server->ip == NULL){
224
236
perror_plus("strdup");
237
free(new_server);
238
return false;
239
}
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
if(ret == -1){
242
perror_plus("clock_gettime");
243
#ifdef __GNUC__
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
246
#endif
247
free((char *)(new_server->ip));
248
#ifdef __GNUC__
249
#pragma GCC diagnostic pop
250
#endif
251
free(new_server);
225
252
return false;
226
253
}
227
254
/* Special case of first server */
229
256
new_server->next = new_server;
230
257
new_server->prev = new_server;
231
258
*current_server = new_server;
232
/* Place the new server last in the list */
233
259
} else {
260
/* Place the new server last in the list */
234
261
new_server->next = *current_server;
235
262
new_server->prev = (*current_server)->prev;
236
263
new_server->prev->next = new_server;
237
264
(*current_server)->prev = new_server;
238
265
}
239
ret = clock_gettime(CLOCK_MONOTONIC, &(*current_server)->last_seen);
240
if(ret == -1){
241
perror_plus("clock_gettime");
242
return false;
243
}
244
266
return true;
245
267
}
246
268
247
269
/*
248
270
* Initialize GPGME.
249
271
*/
250
static bool init_gpgme(const char *seckey, const char *pubkey,
251
const char *tempdir, mandos_context *mc){
272
__attribute__((nonnull, warn_unused_result))
273
static bool init_gpgme(const char * const seckey,
274
const char * const pubkey,
275
const char * const tempdir,
276
mandos_context *mc){
252
277
gpgme_error_t rc;
253
278
gpgme_engine_info_t engine_info;
254
279
255
280
/*
256
281
* Helper function to insert pub and seckey to the engine keyring.
257
282
*/
258
bool import_key(const char *filename){
283
bool import_key(const char * const filename){
259
284
int ret;
260
285
int fd;
261
286
gpgme_data_t pgp_data;
342
367
* Decrypt OpenPGP data.
343
368
* Returns -1 on error
344
369
*/
370
__attribute__((nonnull, warn_unused_result))
345
371
static ssize_t pgp_packet_decrypt(const char *cryptotext,
346
372
size_t crypto_size,
347
373
char **plaintext,
467
493
return plaintext_length;
468
494
}
469
495
470
static const char * safer_gnutls_strerror(int value){
496
__attribute__((warn_unused_result))
497
static const char *safer_gnutls_strerror(int value){
471
498
const char *ret = gnutls_strerror(value);
472
499
if(ret == NULL)
473
500
ret = "(unknown)";
475
502
}
476
503
477
504
/* GnuTLS log function callback */
505
__attribute__((nonnull))
478
506
static void debuggnutls(__attribute__((unused)) int level,
479
507
const char* string){
480
508
fprintf_plus(stderr, "GnuTLS: %s", string);
481
509
}
482
510
511
__attribute__((nonnull, warn_unused_result))
483
512
static int init_gnutls_global(const char *pubkeyfilename,
484
513
const char *seckeyfilename,
485
514
mandos_context *mc){
559
588
return -1;
560
589
}
561
590
591
__attribute__((nonnull, warn_unused_result))
562
592
static int init_gnutls_session(gnutls_session_t *session,
563
593
mandos_context *mc){
564
594
int ret;
621
651
__attribute__((unused)) const char *txt){}
622
652
623
653
/* Called when a Mandos server is found */
654
__attribute__((nonnull, warn_unused_result))
624
655
static int start_mandos_communication(const char *ip, in_port_t port,
625
656
AvahiIfIndex if_index,
626
657
int af, mandos_context *mc){
627
658
int ret, tcp_sd = -1;
628
659
ssize_t sret;
629
union {
630
struct sockaddr_in in;
631
struct sockaddr_in6 in6;
632
} to;
660
struct sockaddr_storage to;
633
661
char *buffer = NULL;
634
662
char *decrypted_buffer = NULL;
635
663
size_t buffer_length = 0;
716
744
717
745
memset(&to, 0, sizeof(to));
718
746
if(af == AF_INET6){
719
to.in6.sin6_family = (sa_family_t)af;
720
ret = inet_pton(af, ip, &to.in6.sin6_addr);
747
((struct sockaddr_in6 *)&to)->sin6_family = (sa_family_t)af;
748
ret = inet_pton(af, ip, &((struct sockaddr_in6 *)&to)->sin6_addr);
721
749
} else { /* IPv4 */
722
to.in.sin_family = (sa_family_t)af;
723
ret = inet_pton(af, ip, &to.in.sin_addr);
750
((struct sockaddr_in *)&to)->sin_family = (sa_family_t)af;
751
ret = inet_pton(af, ip, &((struct sockaddr_in *)&to)->sin_addr);
724
752
}
725
753
if(ret < 0 ){
726
754
int e = errno;
735
763
goto mandos_end;
736
764
}
737
765
if(af == AF_INET6){
738
to.in6.sin6_port = htons(port);
739
if(IN6_IS_ADDR_LINKLOCAL /* Spurious warnings from */
740
(&to.in6.sin6_addr)){ /* -Wstrict-aliasing=2 or lower and
741
-Wunreachable-code*/
766
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
767
if(IN6_IS_ADDR_LINKLOCAL
768
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
742
769
if(if_index == AVAHI_IF_UNSPEC){
743
770
fprintf_plus(stderr, "An IPv6 link-local address is"
744
771
" incomplete without a network interface\n");
746
773
goto mandos_end;
747
774
}
748
775
/* Set the network interface number as scope */
749
to.in6.sin6_scope_id = (uint32_t)if_index;
776
((struct sockaddr_in6 *)&to)->sin6_scope_id = (uint32_t)if_index;
750
777
}
751
778
} else {
752
to.in.sin_port = htons(port); /* Spurious warnings from
753
-Wconversion and
754
-Wunreachable-code */
779
((struct sockaddr_in *)&to)->sin_port = htons(port);
755
780
}
756
781
757
782
if(quit_now){
774
799
}
775
800
char addrstr[(INET_ADDRSTRLEN > INET6_ADDRSTRLEN) ?
776
801
INET_ADDRSTRLEN : INET6_ADDRSTRLEN] = "";
777
const char *pcret;
778
802
if(af == AF_INET6){
779
pcret = inet_ntop(af, &(to.in6.sin6_addr), addrstr,
780
sizeof(addrstr));
803
ret = getnameinfo((struct sockaddr *)&to,
804
sizeof(struct sockaddr_in6),
805
addrstr, sizeof(addrstr), NULL, 0,
806
NI_NUMERICHOST);
781
807
} else {
782
pcret = inet_ntop(af, &(to.in.sin_addr), addrstr,
783
sizeof(addrstr));
808
ret = getnameinfo((struct sockaddr *)&to,
809
sizeof(struct sockaddr_in),
810
addrstr, sizeof(addrstr), NULL, 0,
811
NI_NUMERICHOST);
784
812
}
785
if(pcret == NULL){
786
perror_plus("inet_ntop");
787
} else {
788
if(strcmp(addrstr, ip) != 0){
789
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
790
}
813
if(ret == EAI_SYSTEM){
814
perror_plus("getnameinfo");
815
} else if(ret != 0) {
816
fprintf_plus(stderr, "getnameinfo: %s", gai_strerror(ret));
817
} else if(strcmp(addrstr, ip) != 0){
818
fprintf_plus(stderr, "Canonical address form: %s\n", addrstr);
791
819
}
792
820
}
793
821
797
825
}
798
826
799
827
if(af == AF_INET6){
800
ret = connect(tcp_sd, &to.in6, sizeof(to));
828
ret = connect(tcp_sd, (struct sockaddr *)&to,
829
sizeof(struct sockaddr_in6));
801
830
} else {
802
ret = connect(tcp_sd, &to.in, sizeof(to)); /* IPv4 */
831
ret = connect(tcp_sd, (struct sockaddr *)&to, /* IPv4 */
832
sizeof(struct sockaddr_in));
803
833
}
804
834
if(ret < 0){
805
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
835
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
806
836
int e = errno;
807
837
perror_plus("connect");
808
838
errno = e;
1023
1053
return retval;
1024
1054
}
1025
1055
1056
__attribute__((nonnull))
1026
1057
static void resolve_callback(AvahiSServiceResolver *r,
1027
1058
AvahiIfIndex interface,
1028
1059
AvahiProtocol proto,
1036
1067
AVAHI_GCC_UNUSED AvahiStringList *txt,
1037
1068
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1038
1069
flags,
1039
void* mc){
1070
void *mc){
1040
1071
if(r == NULL){
1041
1072
return;
1042
1073
}
1045
1076
timed out */
1046
1077
1047
1078
if(quit_now){
1079
avahi_s_service_resolver_free(r);
1048
1080
return;
1049
1081
}
1050
1082
1095
1127
const char *domain,
1096
1128
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1097
1129
flags,
1098
void* mc){
1130
void *mc){
1099
1131
if(b == NULL){
1100
1132
return;
1101
1133
}
1161
1193
errno = old_errno;
1162
1194
}
1163
1195
1196
__attribute__((nonnull, warn_unused_result))
1164
1197
bool get_flags(const char *ifname, struct ifreq *ifr){
1165
1198
int ret;
1166
1199
error_t ret_errno;
1185
1218
return true;
1186
1219
}
1187
1220
1221
__attribute__((nonnull, warn_unused_result))
1188
1222
bool good_flags(const char *ifname, const struct ifreq *ifr){
1189
1223
1190
1224
/* Reject the loopback device */
1232
1266
* corresponds to an acceptable network device.
1233
1267
* (This function is passed to scandir(3) as a filter function.)
1234
1268
*/
1269
__attribute__((nonnull, warn_unused_result))
1235
1270
int good_interface(const struct dirent *if_entry){
1236
1271
if(if_entry->d_name[0] == '.'){
1237
1272
return 0;
1255
1290
/*
1256
1291
* This function determines if a network interface is up.
1257
1292
*/
1293
__attribute__((nonnull, warn_unused_result))
1258
1294
bool interface_is_up(const char *interface){
1259
1295
struct ifreq ifr;
1260
1296
if(not get_flags(interface, &ifr)){
1271
1307
/*
1272
1308
* This function determines if a network interface is running
1273
1309
*/
1310
__attribute__((nonnull, warn_unused_result))
1274
1311
bool interface_is_running(const char *interface){
1275
1312
struct ifreq ifr;
1276
1313
if(not get_flags(interface, &ifr)){
1284
1321
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1285
1322
}
1286
1323
1324
__attribute__((nonnull, pure, warn_unused_result))
1287
1325
int notdotentries(const struct dirent *direntry){
1288
1326
/* Skip "." and ".." */
1289
1327
if(direntry->d_name[0] == '.'
1296
1334
}
1297
1335
1298
1336
/* Is this directory entry a runnable program? */
1337
__attribute__((nonnull, warn_unused_result))
1299
1338
int runnable_hook(const struct dirent *direntry){
1300
1339
int ret;
1301
1340
size_t sret;
1309
1348
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1310
1349
"abcdefghijklmnopqrstuvwxyz"
1311
1350
"0123456789"
1312
"_-");
1351
"_.-");
1313
1352
if((direntry->d_name)[sret] != '\0'){
1314
1353
/* Contains non-allowed characters */
1315
1354
if(debug){
1319
1358
return 0;
1320
1359
}
1321
1360
1322
char *fullname = NULL;
1323
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1324
if(ret < 0){
1325
perror_plus("asprintf");
1326
return 0;
1327
}
1328
1329
ret = stat(fullname, &st);
1361
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1330
1362
if(ret == -1){
1331
1363
if(debug){
1332
1364
perror_plus("Could not stat hook");
1356
1388
return 1;
1357
1389
}
1358
1390
1391
__attribute__((nonnull, warn_unused_result))
1359
1392
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1360
1393
mandos_context *mc){
1361
1394
int ret;
1365
1398
1366
1399
while(true){
1367
1400
if(mc->current_server == NULL){
1368
if (debug){
1401
if(debug){
1369
1402
fprintf_plus(stderr, "Wait until first server is found."
1370
1403
" No timeout!\n");
1371
1404
}
1372
1405
ret = avahi_simple_poll_iterate(s, -1);
1373
1406
} else {
1374
if (debug){
1407
if(debug){
1375
1408
fprintf_plus(stderr, "Check current_server if we should run"
1376
1409
" it, or wait\n");
1377
1410
}
1394
1427
- ((intmax_t)waited_time.tv_sec * 1000))
1395
1428
- ((intmax_t)waited_time.tv_nsec / 1000000));
1396
1429
1397
if (debug){
1430
if(debug){
1398
1431
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1399
1432
block_time);
1400
1433
}
1422
1455
ret = avahi_simple_poll_iterate(s, (int)block_time);
1423
1456
}
1424
1457
if(ret != 0){
1425
if (ret > 0 or errno != EINTR){
1458
if(ret > 0 or errno != EINTR){
1426
1459
return (ret != 1) ? ret : 0;
1427
1460
}
1428
1461
}
1430
1463
}
1431
1464
1432
1465
/* Set effective uid to 0, return errno */
1466
__attribute__((warn_unused_result))
1433
1467
error_t raise_privileges(void){
1434
1468
error_t old_errno = errno;
1435
1469
error_t ret_errno = 0;
1436
1470
if(seteuid(0) == -1){
1437
1471
ret_errno = errno;
1438
perror_plus("seteuid");
1439
1472
}
1440
1473
errno = old_errno;
1441
1474
return ret_errno;
1442
1475
}
1443
1476
1444
1477
/* Set effective and real user ID to 0. Return errno. */
1478
__attribute__((warn_unused_result))
1445
1479
error_t raise_privileges_permanently(void){
1446
1480
error_t old_errno = errno;
1447
1481
error_t ret_errno = raise_privileges();
1451
1485
}
1452
1486
if(setuid(0) == -1){
1453
1487
ret_errno = errno;
1454
perror_plus("seteuid");
1455
1488
}
1456
1489
errno = old_errno;
1457
1490
return ret_errno;
1458
1491
}
1459
1492
1460
1493
/* Set effective user ID to unprivileged saved user ID */
1494
__attribute__((warn_unused_result))
1461
1495
error_t lower_privileges(void){
1462
1496
error_t old_errno = errno;
1463
1497
error_t ret_errno = 0;
1464
1498
if(seteuid(uid) == -1){
1465
1499
ret_errno = errno;
1466
perror_plus("seteuid");
1467
1500
}
1468
1501
errno = old_errno;
1469
1502
return ret_errno;
1470
1503
}
1471
1504
1472
1505
/* Lower privileges permanently */
1506
__attribute__((warn_unused_result))
1473
1507
error_t lower_privileges_permanently(void){
1474
1508
error_t old_errno = errno;
1475
1509
error_t ret_errno = 0;
1476
1510
if(setuid(uid) == -1){
1477
1511
ret_errno = errno;
1478
perror_plus("setuid");
1479
1512
}
1480
1513
errno = old_errno;
1481
1514
return ret_errno;
1482
1515
}
1483
1516
1484
bool run_network_hooks(const char *mode, const char *interface,
1517
__attribute__((nonnull))
1518
void run_network_hooks(const char *mode, const char *interface,
1485
1519
const float delay){
1486
struct dirent **direntries;
1520
struct dirent **direntries = NULL;
1521
if(hookdir_fd == -1){
1522
hookdir_fd = open(hookdir, O_RDONLY);
1523
if(hookdir_fd == -1){
1524
if(errno == ENOENT){
1525
if(debug){
1526
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1527
" found\n", hookdir);
1528
}
1529
} else {
1530
perror_plus("open");
1531
}
1532
return;
1533
}
1534
}
1535
#ifdef __GLIBC__
1536
#if __GLIBC_PREREQ(2, 15)
1537
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1538
runnable_hook, alphasort);
1539
#else /* not __GLIBC_PREREQ(2, 15) */
1540
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1541
alphasort);
1542
#endif /* not __GLIBC_PREREQ(2, 15) */
1543
#else /* not __GLIBC__ */
1544
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1545
alphasort);
1546
#endif /* not __GLIBC__ */
1547
if(numhooks == -1){
1548
perror_plus("scandir");
1549
return;
1550
}
1487
1551
struct dirent *direntry;
1488
1552
int ret;
1489
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1490
alphasort);
1491
if(numhooks == -1){
1492
if(errno == ENOENT){
1493
if(debug){
1494
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1495
" found\n", hookdir);
1496
}
1497
} else {
1498
perror_plus("scandir");
1553
int devnull = open("/dev/null", O_RDONLY);
1554
for(int i = 0; i < numhooks; i++){
1555
direntry = direntries[i];
1556
if(debug){
1557
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1558
direntry->d_name);
1499
1559
}
1500
} else {
1501
int devnull = open("/dev/null", O_RDONLY);
1502
for(int i = 0; i < numhooks; i++){
1503
direntry = direntries[i];
1504
char *fullname = NULL;
1505
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1506
if(ret < 0){
1560
pid_t hook_pid = fork();
1561
if(hook_pid == 0){
1562
/* Child */
1563
/* Raise privileges */
1564
errno = raise_privileges_permanently();
1565
if(errno != 0){
1566
perror_plus("Failed to raise privileges");
1567
_exit(EX_NOPERM);
1568
}
1569
/* Set group */
1570
errno = 0;
1571
ret = setgid(0);
1572
if(ret == -1){
1573
perror_plus("setgid");
1574
_exit(EX_NOPERM);
1575
}
1576
/* Reset supplementary groups */
1577
errno = 0;
1578
ret = setgroups(0, NULL);
1579
if(ret == -1){
1580
perror_plus("setgroups");
1581
_exit(EX_NOPERM);
1582
}
1583
ret = dup2(devnull, STDIN_FILENO);
1584
if(ret == -1){
1585
perror_plus("dup2(devnull, STDIN_FILENO)");
1586
_exit(EX_OSERR);
1587
}
1588
ret = close(devnull);
1589
if(ret == -1){
1590
perror_plus("close");
1591
_exit(EX_OSERR);
1592
}
1593
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1594
if(ret == -1){
1595
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1596
_exit(EX_OSERR);
1597
}
1598
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1599
if(ret == -1){
1600
perror_plus("setenv");
1601
_exit(EX_OSERR);
1602
}
1603
ret = setenv("DEVICE", interface, 1);
1604
if(ret == -1){
1605
perror_plus("setenv");
1606
_exit(EX_OSERR);
1607
}
1608
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1609
if(ret == -1){
1610
perror_plus("setenv");
1611
_exit(EX_OSERR);
1612
}
1613
ret = setenv("MODE", mode, 1);
1614
if(ret == -1){
1615
perror_plus("setenv");
1616
_exit(EX_OSERR);
1617
}
1618
char *delaystring;
1619
ret = asprintf(&delaystring, "%f", (double)delay);
1620
if(ret == -1){
1507
1621
perror_plus("asprintf");
1508
continue;
1509
}
1510
if(debug){
1511
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1512
direntry->d_name);
1513
}
1514
pid_t hook_pid = fork();
1515
if(hook_pid == 0){
1516
/* Child */
1517
/* Raise privileges */
1518
raise_privileges_permanently();
1519
/* Set group */
1520
errno = 0;
1521
ret = setgid(0);
1522
if(ret == -1){
1523
perror_plus("setgid");
1524
}
1525
/* Reset supplementary groups */
1526
errno = 0;
1527
ret = setgroups(0, NULL);
1528
if(ret == -1){
1529
perror_plus("setgroups");
1530
}
1531
dup2(devnull, STDIN_FILENO);
1532
close(devnull);
1533
dup2(STDERR_FILENO, STDOUT_FILENO);
1534
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1535
if(ret == -1){
1536
perror_plus("setenv");
1537
_exit(EX_OSERR);
1538
}
1539
ret = setenv("DEVICE", interface, 1);
1540
if(ret == -1){
1541
perror_plus("setenv");
1542
_exit(EX_OSERR);
1543
}
1544
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1545
if(ret == -1){
1546
perror_plus("setenv");
1547
_exit(EX_OSERR);
1548
}
1549
ret = setenv("MODE", mode, 1);
1550
if(ret == -1){
1551
perror_plus("setenv");
1552
_exit(EX_OSERR);
1553
}
1554
char *delaystring;
1555
ret = asprintf(&delaystring, "%f", delay);
1556
if(ret == -1){
1557
perror_plus("asprintf");
1558
_exit(EX_OSERR);
1559
}
1560
ret = setenv("DELAY", delaystring, 1);
1561
if(ret == -1){
1562
free(delaystring);
1563
perror_plus("setenv");
1564
_exit(EX_OSERR);
1565
}
1622
_exit(EX_OSERR);
1623
}
1624
ret = setenv("DELAY", delaystring, 1);
1625
if(ret == -1){
1566
1626
free(delaystring);
1567
if(connect_to != NULL){
1568
ret = setenv("CONNECT", connect_to, 1);
1569
if(ret == -1){
1570
perror_plus("setenv");
1571
_exit(EX_OSERR);
1572
}
1573
}
1574
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1575
perror_plus("execl");
1576
_exit(EXIT_FAILURE);
1577
}
1627
perror_plus("setenv");
1628
_exit(EX_OSERR);
1629
}
1630
free(delaystring);
1631
if(connect_to != NULL){
1632
ret = setenv("CONNECT", connect_to, 1);
1633
if(ret == -1){
1634
perror_plus("setenv");
1635
_exit(EX_OSERR);
1636
}
1637
}
1638
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1639
if(hook_fd == -1){
1640
perror_plus("openat");
1641
_exit(EXIT_FAILURE);
1642
}
1643
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1644
perror_plus("close");
1645
_exit(EXIT_FAILURE);
1646
}
1647
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1648
environ) == -1){
1649
perror_plus("fexecve");
1650
_exit(EXIT_FAILURE);
1651
}
1652
} else {
1653
if(hook_pid == -1){
1654
perror_plus("fork");
1655
free(direntry);
1656
continue;
1657
}
1658
int status;
1659
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1660
perror_plus("waitpid");
1661
free(direntry);
1662
continue;
1663
}
1664
if(WIFEXITED(status)){
1665
if(WEXITSTATUS(status) != 0){
1666
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1667
" with status %d\n", direntry->d_name,
1668
WEXITSTATUS(status));
1669
free(direntry);
1670
continue;
1671
}
1672
} else if(WIFSIGNALED(status)){
1673
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1674
" signal %d\n", direntry->d_name,
1675
WTERMSIG(status));
1676
free(direntry);
1677
continue;
1578
1678
} else {
1579
int status;
1580
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1581
perror_plus("waitpid");
1582
free(fullname);
1583
continue;
1584
}
1585
if(WIFEXITED(status)){
1586
if(WEXITSTATUS(status) != 0){
1587
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1588
" with status %d\n", direntry->d_name,
1589
WEXITSTATUS(status));
1590
free(fullname);
1591
continue;
1592
}
1593
} else if(WIFSIGNALED(status)){
1594
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1595
" signal %d\n", direntry->d_name,
1596
WTERMSIG(status));
1597
free(fullname);
1598
continue;
1599
} else {
1600
fprintf_plus(stderr, "Warning: network hook \"%s\""
1601
" crashed\n", direntry->d_name);
1602
free(fullname);
1603
continue;
1604
}
1605
}
1606
free(fullname);
1607
if(debug){
1608
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1609
direntry->d_name);
1610
}
1611
}
1612
close(devnull);
1613
}
1614
return true;
1679
fprintf_plus(stderr, "Warning: network hook \"%s\""
1680
" crashed\n", direntry->d_name);
1681
free(direntry);
1682
continue;
1683
}
1684
}
1685
if(debug){
1686
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1687
direntry->d_name);
1688
}
1689
free(direntry);
1690
}
1691
free(direntries);
1692
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1693
perror_plus("close");
1694
} else {
1695
hookdir_fd = -1;
1696
}
1697
close(devnull);
1615
1698
}
1616
1699
1700
__attribute__((nonnull, warn_unused_result))
1617
1701
error_t bring_up_interface(const char *const interface,
1618
1702
const float delay){
1619
int sd = -1;
1620
1703
error_t old_errno = errno;
1621
error_t ret_errno = 0;
1622
int ret, ret_setflags;
1704
int ret;
1623
1705
struct ifreq network;
1624
1706
unsigned int if_index = if_nametoindex(interface);
1625
1707
if(if_index == 0){
1634
1716
}
1635
1717
1636
1718
if(not interface_is_up(interface)){
1637
if(not get_flags(interface, &network) and debug){
1719
error_t ret_errno = 0, ioctl_errno = 0;
1720
if(not get_flags(interface, &network)){
1638
1721
ret_errno = errno;
1639
1722
fprintf_plus(stderr, "Failed to get flags for interface "
1640
1723
"\"%s\"\n", interface);
1724
errno = old_errno;
1641
1725
return ret_errno;
1642
1726
}
1643
network.ifr_flags |= IFF_UP;
1727
network.ifr_flags |= IFF_UP; /* set flag */
1644
1728
1645
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1646
if(sd < 0){
1729
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1730
if(sd == -1){
1647
1731
ret_errno = errno;
1648
1732
perror_plus("socket");
1649
1733
errno = old_errno;
1650
1734
return ret_errno;
1651
1735
}
1652
1736
1653
1737
if(quit_now){
1654
close(sd);
1738
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1739
if(ret == -1){
1740
perror_plus("close");
1741
}
1655
1742
errno = old_errno;
1656
1743
return EINTR;
1657
1744
}
1661
1748
interface);
1662
1749
}
1663
1750
1664
/* Raise priviliges */
1665
raise_privileges();
1751
/* Raise privileges */
1752
ret_errno = raise_privileges();
1753
if(ret_errno != 0){
1754
errno = ret_errno;
1755
perror_plus("Failed to raise privileges");
1756
}
1666
1757
1667
1758
#ifdef __linux__
1668
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1669
messages about the network interface to mess up the prompt */
1670
int ret_linux = klogctl(8, NULL, 5);
1671
bool restore_loglevel = true;
1672
if(ret_linux == -1){
1673
restore_loglevel = false;
1674
perror_plus("klogctl");
1759
int ret_linux;
1760
bool restore_loglevel = false;
1761
if(ret_errno == 0){
1762
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1763
messages about the network interface to mess up the prompt */
1764
ret_linux = klogctl(8, NULL, 5);
1765
if(ret_linux == -1){
1766
perror_plus("klogctl");
1767
} else {
1768
restore_loglevel = true;
1769
}
1675
1770
}
1676
1771
#endif /* __linux__ */
1677
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1678
ret_errno = errno;
1772
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1773
ioctl_errno = errno;
1679
1774
#ifdef __linux__
1680
1775
if(restore_loglevel){
1681
1776
ret_linux = klogctl(7, NULL, 0);
1685
1780
}
1686
1781
#endif /* __linux__ */
1687
1782
1688
/* Lower privileges */
1689
lower_privileges();
1783
/* If raise_privileges() succeeded above */
1784
if(ret_errno == 0){
1785
/* Lower privileges */
1786
ret_errno = lower_privileges();
1787
if(ret_errno != 0){
1788
errno = ret_errno;
1789
perror_plus("Failed to lower privileges");
1790
}
1791
}
1690
1792
1691
1793
/* Close the socket */
1692
1794
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1695
1797
}
1696
1798
1697
1799
if(ret_setflags == -1){
1698
errno = ret_errno;
1800
errno = ioctl_errno;
1699
1801
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1700
1802
errno = old_errno;
1701
return ret_errno;
1803
return ioctl_errno;
1702
1804
}
1703
1805
} else if(debug){
1704
1806
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1722
1824
return 0;
1723
1825
}
1724
1826
1827
__attribute__((nonnull, warn_unused_result))
1725
1828
error_t take_down_interface(const char *const interface){
1726
int sd = -1;
1727
1829
error_t old_errno = errno;
1728
error_t ret_errno = 0;
1729
int ret, ret_setflags;
1730
1830
struct ifreq network;
1731
1831
unsigned int if_index = if_nametoindex(interface);
1732
1832
if(if_index == 0){
1735
1835
return ENXIO;
1736
1836
}
1737
1837
if(interface_is_up(interface)){
1838
error_t ret_errno = 0, ioctl_errno = 0;
1738
1839
if(not get_flags(interface, &network) and debug){
1739
1840
ret_errno = errno;
1740
1841
fprintf_plus(stderr, "Failed to get flags for interface "
1741
1842
"\"%s\"\n", interface);
1843
errno = old_errno;
1742
1844
return ret_errno;
1743
1845
}
1744
1846
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1745
1847
1746
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1747
if(sd < 0){
1848
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1849
if(sd == -1){
1748
1850
ret_errno = errno;
1749
1851
perror_plus("socket");
1750
1852
errno = old_errno;
1756
1858
interface);
1757
1859
}
1758
1860
1759
/* Raise priviliges */
1760
raise_privileges();
1761
1762
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1763
ret_errno = errno;
1764
1765
/* Lower privileges */
1766
lower_privileges();
1861
/* Raise privileges */
1862
ret_errno = raise_privileges();
1863
if(ret_errno != 0){
1864
errno = ret_errno;
1865
perror_plus("Failed to raise privileges");
1866
}
1867
1868
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1869
ioctl_errno = errno;
1870
1871
/* If raise_privileges() succeeded above */
1872
if(ret_errno == 0){
1873
/* Lower privileges */
1874
ret_errno = lower_privileges();
1875
if(ret_errno != 0){
1876
errno = ret_errno;
1877
perror_plus("Failed to lower privileges");
1878
}
1879
}
1767
1880
1768
1881
/* Close the socket */
1769
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1882
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1770
1883
if(ret == -1){
1771
1884
perror_plus("close");
1772
1885
}
1773
1886
1774
1887
if(ret_setflags == -1){
1775
errno = ret_errno;
1888
errno = ioctl_errno;
1776
1889
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1777
1890
errno = old_errno;
1778
return ret_errno;
1891
return ioctl_errno;
1779
1892
}
1780
1893
} else if(debug){
1781
1894
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1789
1902
int main(int argc, char *argv[]){
1790
1903
mandos_context mc = { .server = NULL, .dh_bits = 1024,
1791
1904
.priority = "SECURE256:!CTYPE-X.509:"
1792
"+CTYPE-OPENPGP", .current_server = NULL,
1905
"+CTYPE-OPENPGP", .current_server = NULL,
1793
1906
.interfaces = NULL, .interfaces_size = 0 };
1794
1907
AvahiSServiceBrowser *sb = NULL;
1795
1908
error_t ret_errno;
1799
1912
int exitcode = EXIT_SUCCESS;
1800
1913
char *interfaces_to_take_down = NULL;
1801
1914
size_t interfaces_to_take_down_size = 0;
1802
char tempdir[] = "/tmp/mandosXXXXXX";
1803
bool tempdir_created = false;
1915
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
1916
char old_tempdir[] = "/tmp/mandosXXXXXX";
1917
char *tempdir = NULL;
1804
1918
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1805
1919
const char *seckey = PATHDIR "/" SECKEY;
1806
1920
const char *pubkey = PATHDIR "/" PUBKEY;
1807
1921
char *interfaces_hooks = NULL;
1808
size_t interfaces_hooks_size = 0;
1809
1922
1810
1923
bool gnutls_initialized = false;
1811
1924
bool gpgme_initialized = false;
1989
2102
/* Work around Debian bug #633582:
1990
2103
<http://bugs.debian.org/633582> */
1991
2104
1992
/* Re-raise priviliges */
1993
if(raise_privileges() == 0){
2105
/* Re-raise privileges */
2106
ret_errno = raise_privileges();
2107
if(ret_errno != 0){
2108
errno = ret_errno;
2109
perror_plus("Failed to raise privileges");
2110
} else {
1994
2111
struct stat st;
1995
2112
1996
2113
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2036
2153
}
2037
2154
2038
2155
/* Lower privileges */
2039
lower_privileges();
2156
ret_errno = lower_privileges();
2157
if(ret_errno != 0){
2158
errno = ret_errno;
2159
perror_plus("Failed to lower privileges");
2160
}
2040
2161
}
2041
2162
}
2042
2163
2066
2187
goto end;
2067
2188
}
2068
2189
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2069
interfaces_hooks_size = mc.interfaces_size;
2070
argz_stringify(interfaces_hooks, interfaces_hooks_size,
2071
(int)',');
2072
}
2073
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2074
interfaces_hooks : "", delay)){
2075
goto end;
2076
}
2190
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2191
}
2192
run_network_hooks("start", interfaces_hooks != NULL ?
2193
interfaces_hooks : "", delay);
2077
2194
}
2078
2195
2079
2196
if(not debug){
2157
2274
2158
2275
/* If no interfaces were specified, make a list */
2159
2276
if(mc.interfaces == NULL){
2160
struct dirent **direntries;
2277
struct dirent **direntries = NULL;
2161
2278
/* Look for any good interfaces */
2162
2279
ret = scandir(sys_class_net, &direntries, good_interface,
2163
2280
alphasort);
2167
2284
ret_errno = argz_add(&mc.interfaces, &mc.interfaces_size,
2168
2285
direntries[i]->d_name);
2169
2286
if(ret_errno != 0){
2287
errno = ret_errno;
2170
2288
perror_plus("argz_add");
2289
free(direntries[i]);
2171
2290
continue;
2172
2291
}
2173
2292
if(debug){
2174
2293
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2175
2294
direntries[i]->d_name);
2176
2295
}
2296
free(direntries[i]);
2177
2297
}
2178
2298
free(direntries);
2179
2299
} else {
2180
free(direntries);
2300
if(ret == 0){
2301
free(direntries);
2302
}
2181
2303
fprintf_plus(stderr, "Could not find a network interface\n");
2182
2304
exitcode = EXIT_FAILURE;
2183
2305
goto end;
2206
2328
break;
2207
2329
}
2208
2330
bool interface_was_up = interface_is_up(interface);
2209
ret = bring_up_interface(interface, delay);
2331
errno = bring_up_interface(interface, delay);
2210
2332
if(not interface_was_up){
2211
if(ret != 0){
2212
errno = ret;
2333
if(errno != 0){
2213
2334
perror_plus("Failed to bring up interface");
2214
2335
} else {
2215
ret_errno = argz_add(&interfaces_to_take_down,
2216
&interfaces_to_take_down_size,
2217
interface);
2336
errno = argz_add(&interfaces_to_take_down,
2337
&interfaces_to_take_down_size,
2338
interface);
2339
if(errno != 0){
2340
perror_plus("argz_add");
2341
}
2218
2342
}
2219
2343
}
2220
2344
}
2249
2373
goto end;
2250
2374
}
2251
2375
2252
if(mkdtemp(tempdir) == NULL){
2376
/* Try /run/tmp before /tmp */
2377
tempdir = mkdtemp(run_tempdir);
2378
if(tempdir == NULL and errno == ENOENT){
2379
if(debug){
2380
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2381
run_tempdir, old_tempdir);
2382
}
2383
tempdir = mkdtemp(old_tempdir);
2384
}
2385
if(tempdir == NULL){
2253
2386
perror_plus("mkdtemp");
2254
2387
goto end;
2255
2388
}
2256
tempdir_created = true;
2257
2389
2258
2390
if(quit_now){
2259
2391
goto end;
2334
2466
sleep((unsigned int)retry_interval);
2335
2467
}
2336
2468
2337
if (not quit_now){
2469
if(not quit_now){
2338
2470
exitcode = EXIT_SUCCESS;
2339
2471
}
2340
2472
2395
2527
if(debug){
2396
2528
fprintf_plus(stderr, "Starting Avahi loop search\n");
2397
2529
}
2398
2530
2399
2531
ret = avahi_loop_with_timeout(simple_poll,
2400
2532
(int)(retry_interval * 1000), &mc);
2401
2533
if(debug){
2437
2569
mc.current_server->prev->next = NULL;
2438
2570
while(mc.current_server != NULL){
2439
2571
server *next = mc.current_server->next;
2572
#ifdef __GNUC__
2573
#pragma GCC diagnostic push
2574
#pragma GCC diagnostic ignored "-Wcast-qual"
2575
#endif
2576
free((char *)(mc.current_server->ip));
2577
#ifdef __GNUC__
2578
#pragma GCC diagnostic pop
2579
#endif
2440
2580
free(mc.current_server);
2441
2581
mc.current_server = next;
2442
2582
}
2443
2583
}
2444
2584
2445
/* Re-raise priviliges */
2585
/* Re-raise privileges */
2446
2586
{
2447
raise_privileges();
2448
2449
/* Run network hooks */
2450
run_network_hooks("stop", interfaces_hooks != NULL ?
2451
interfaces_hooks : "", delay);
2452
2453
/* Take down the network interfaces which were brought up */
2454
{
2455
char *interface = NULL;
2456
while((interface=argz_next(interfaces_to_take_down,
2457
interfaces_to_take_down_size,
2458
interface))){
2459
ret_errno = take_down_interface(interface);
2460
if(ret_errno != 0){
2461
errno = ret_errno;
2462
perror_plus("Failed to take down interface");
2463
}
2464
}
2465
if(debug and (interfaces_to_take_down == NULL)){
2466
fprintf_plus(stderr, "No interfaces needed to be taken"
2467
" down\n");
2468
}
2469
}
2470
2471
lower_privileges_permanently();
2587
ret_errno = raise_privileges();
2588
if(ret_errno != 0){
2589
errno = ret_errno;
2590
perror_plus("Failed to raise privileges");
2591
} else {
2592
2593
/* Run network hooks */
2594
run_network_hooks("stop", interfaces_hooks != NULL ?
2595
interfaces_hooks : "", delay);
2596
2597
/* Take down the network interfaces which were brought up */
2598
{
2599
char *interface = NULL;
2600
while((interface=argz_next(interfaces_to_take_down,
2601
interfaces_to_take_down_size,
2602
interface))){
2603
ret_errno = take_down_interface(interface);
2604
if(ret_errno != 0){
2605
errno = ret_errno;
2606
perror_plus("Failed to take down interface");
2607
}
2608
}
2609
if(debug and (interfaces_to_take_down == NULL)){
2610
fprintf_plus(stderr, "No interfaces needed to be taken"
2611
" down\n");
2612
}
2613
}
2614
}
2615
2616
ret_errno = lower_privileges_permanently();
2617
if(ret_errno != 0){
2618
errno = ret_errno;
2619
perror_plus("Failed to lower privileges permanently");
2620
}
2472
2621
}
2473
2622
2474
2623
free(interfaces_to_take_down);
2475
2624
free(interfaces_hooks);
2476
2625
2477
2626
/* Removes the GPGME temp directory and all files inside */
2478
if(tempdir_created){
2627
if(tempdir != NULL){
2479
2628
struct dirent **direntries = NULL;
2480
struct dirent *direntry = NULL;
2481
int numentries = scandir(tempdir, &direntries, notdotentries,
2482
alphasort);
2483
if (numentries > 0){
2484
for(int i = 0; i < numentries; i++){
2485
direntry = direntries[i];
2486
char *fullname = NULL;
2487
ret = asprintf(&fullname, "%s/%s", tempdir,
2488
direntry->d_name);
2489
if(ret < 0){
2490
perror_plus("asprintf");
2491
continue;
2492
}
2493
ret = remove(fullname);
2494
if(ret == -1){
2495
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2496
strerror(errno));
2497
}
2498
free(fullname);
2629
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2630
O_NOFOLLOW));
2631
if(tempdir_fd == -1){
2632
perror_plus("open");
2633
} else {
2634
#ifdef __GLIBC__
2635
#if __GLIBC_PREREQ(2, 15)
2636
int numentries = scandirat(tempdir_fd, ".", &direntries,
2637
notdotentries, alphasort);
2638
#else /* not __GLIBC_PREREQ(2, 15) */
2639
int numentries = scandir(tempdir, &direntries, notdotentries,
2640
alphasort);
2641
#endif /* not __GLIBC_PREREQ(2, 15) */
2642
#else /* not __GLIBC__ */
2643
int numentries = scandir(tempdir, &direntries, notdotentries,
2644
alphasort);
2645
#endif /* not __GLIBC__ */
2646
if(numentries >= 0){
2647
for(int i = 0; i < numentries; i++){
2648
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2649
if(ret == -1){
2650
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2651
" \"%s\", 0): %s\n", tempdir,
2652
direntries[i]->d_name, strerror(errno));
2653
}
2654
free(direntries[i]);
2655
}
2656
2657
/* need to clean even if 0 because man page doesn't specify */
2658
free(direntries);
2659
if(numentries == -1){
2660
perror_plus("scandir");
2661
}
2662
ret = rmdir(tempdir);
2663
if(ret == -1 and errno != ENOENT){
2664
perror_plus("rmdir");
2665
}
2499
2666
}
2500
}
2501
2502
/* need to clean even if 0 because man page doesn't specify */
2503
free(direntries);
2504
if (numentries == -1){
2505
perror_plus("scandir");
2506
}
2507
ret = rmdir(tempdir);
2508
if(ret == -1 and errno != ENOENT){
2509
perror_plus("rmdir");
2667
TEMP_FAILURE_RETRY(close(tempdir_fd));
2510
2668
}
2511
2669
}
2512
2670
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0