To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.c
- browse files at revision 749.1.1
- compare with another revision
- download diff
- download tarball
- view history from revision 749.1.1
- Committer: Teddy Hogeborn
- Date: 2015-05-23 20:18:34 UTC
- mto: This revision was merged to the branch mainline in revision 756.
- Revision ID: teddy@recompile.se-20150523201834-e89ex4ito93yni8x
mandos: Use multiprocessing module to run checkers.
For a long time, the Mandos server has occasionally logged the message
"ERROR: Child process vanished". This was never a fatal error, but it
has been annoying and slightly worrying, since a definite cause was
not found. One potential cause could be the "multiprocessing" and
"subprocess" modules conflicting w.r.t. SIGCHLD. To avoid this,
change the running of checkers from using subprocess.Popen
asynchronously to instead first create a multiprocessing.Process()
(which is asynchronous) calling a function, and have that function
then call subprocess.call() (which is synchronous). In this way, the
only thing using any asynchronous subprocesses is the multiprocessing
module.
This makes it necessary to change one small thing in the D-Bus API,
since the subprocesses.call() function does not expose the raw wait(2)
status value.
DBUS-API (CheckerCompleted): Change the second value provided by this
D-Bus signal from the raw wait(2) status
to the actual terminating signal number.
mandos (subprocess_call_pipe): New function to be called by
multiprocessing.Process (starting a
separate process).
(Client.last_checker signal): New attribute for signal which
terminated last checker. Like
last_checker_status, only not accessible
via D-Bus.
(Client.checker_callback): Take new "connection" argument and use it
to get returncode; set last_checker_signal.
Return False so gobject does not call this
callback again.
(Client.start_checker): Start checker using a multiprocessing.Process
instead of a subprocess.Popen.
(ClientDBus.checker_callback): Take new "connection" argument. Call
Client.checker_callback early to have
it set last_checker_status and
last_checker_signal; use those. Change
second value provided to D-Bus signal
CheckerCompleted to use
last_checker_signal if checker was
terminated by signal.
mandos-monitor: Update to reflect DBus API change.
(MandosClientWidget.checker_completed): Take "signal" instead of
"condition" argument. Use it
accordingly. Remove dead code
(os.WCOREDUMP case).
For a long time, the Mandos server has occasionally logged the message
"ERROR: Child process vanished". This was never a fatal error, but it
has been annoying and slightly worrying, since a definite cause was
not found. One potential cause could be the "multiprocessing" and
"subprocess" modules conflicting w.r.t. SIGCHLD. To avoid this,
change the running of checkers from using subprocess.Popen
asynchronously to instead first create a multiprocessing.Process()
(which is asynchronous) calling a function, and have that function
then call subprocess.call() (which is synchronous). In this way, the
only thing using any asynchronous subprocesses is the multiprocessing
module.
This makes it necessary to change one small thing in the D-Bus API,
since the subprocesses.call() function does not expose the raw wait(2)
status value.
DBUS-API (CheckerCompleted): Change the second value provided by this
D-Bus signal from the raw wait(2) status
to the actual terminating signal number.
mandos (subprocess_call_pipe): New function to be called by
multiprocessing.Process (starting a
separate process).
(Client.last_checker signal): New attribute for signal which
terminated last checker. Like
last_checker_status, only not accessible
via D-Bus.
(Client.checker_callback): Take new "connection" argument and use it
to get returncode; set last_checker_signal.
Return False so gobject does not call this
callback again.
(Client.start_checker): Start checker using a multiprocessing.Process
instead of a subprocess.Popen.
(ClientDBus.checker_callback): Take new "connection" argument. Call
Client.checker_callback early to have
it set last_checker_status and
last_checker_signal; use those. Change
second value provided to D-Bus signal
CheckerCompleted to use
last_checker_signal if checker was
terminated by signal.
mandos-monitor: Update to reflect DBus API change.
(MandosClientWidget.checker_completed): Take "signal" instead of
"condition" argument. Use it
accordingly. Remove dead code
(os.WCOREDUMP case).
- files added:
- debian/upstream
- files removed:
- debian/upstream-signing-key.pgp
- files modified:
- DBUS-API
added
removed
plugins.d/mandos-client.c
9
9
* "browse_callback", and parts of "main".
10
10
*
11
11
* Everything else is
12
* Copyright © 2008-2013 Teddy Hogeborn
13
* Copyright © 2008-2013 Björn Påhlsson
12
* Copyright © 2008-2014 Teddy Hogeborn
13
* Copyright © 2008-2014 Björn Påhlsson
14
14
*
15
15
* This program is free software: you can redistribute it and/or
16
16
* modify it under the terms of the GNU General Public License as
32
32
/* Needed by GPGME, specifically gpgme_data_seek() */
33
33
#ifndef _LARGEFILE_SOURCE
34
34
#define _LARGEFILE_SOURCE
35
#endif
35
#endif /* not _LARGEFILE_SOURCE */
36
36
#ifndef _FILE_OFFSET_BITS
37
37
#define _FILE_OFFSET_BITS 64
38
#endif
38
#endif /* not _FILE_OFFSET_BITS */
39
39
40
40
#define _GNU_SOURCE /* TEMP_FAILURE_RETRY(), asprintf() */
41
41
42
42
#include <stdio.h> /* fprintf(), stderr, fwrite(),
43
stdout, ferror(), remove() */
43
stdout, ferror() */
44
44
#include <stdint.h> /* uint16_t, uint32_t, intptr_t */
45
45
#include <stddef.h> /* NULL, size_t, ssize_t */
46
46
#include <stdlib.h> /* free(), EXIT_SUCCESS, srand(),
57
57
#include <sys/socket.h> /* socket(), struct sockaddr_in6,
58
58
inet_pton(), connect(),
59
59
getnameinfo() */
60
#include <fcntl.h> /* open() */
60
#include <fcntl.h> /* open(), unlinkat() */
61
61
#include <dirent.h> /* opendir(), struct dirent, readdir()
62
62
*/
63
63
#include <inttypes.h> /* PRIu16, PRIdMAX, intmax_t,
73
73
*/
74
74
#include <unistd.h> /* close(), SEEK_SET, off_t, write(),
75
75
getuid(), getgid(), seteuid(),
76
setgid(), pause(), _exit() */
76
setgid(), pause(), _exit(),
77
unlinkat() */
77
78
#include <arpa/inet.h> /* inet_pton(), htons() */
78
79
#include <iso646.h> /* not, or, and */
79
80
#include <argp.h> /* struct argp_option, error_t, struct
141
142
static const char sys_class_net[] = "/sys/class/net";
142
143
char *connect_to = NULL;
143
144
const char *hookdir = HOOKDIR;
145
int hookdir_fd = -1;
144
146
uid_t uid = 65534;
145
147
gid_t gid = 65534;
146
148
183
185
perror(print_text);
184
186
}
185
187
186
__attribute__((format (gnu_printf, 2, 3)))
188
__attribute__((format (gnu_printf, 2, 3), nonnull))
187
189
int fprintf_plus(FILE *stream, const char *format, ...){
188
190
va_list ap;
189
191
va_start (ap, format);
198
200
* bytes. "buffer_capacity" is how much is currently allocated,
199
201
* "buffer_length" is how much is already used.
200
202
*/
203
__attribute__((nonnull, warn_unused_result))
201
204
size_t incbuffer(char **buffer, size_t buffer_length,
202
205
size_t buffer_capacity){
203
206
if(buffer_length + BUFFER_SIZE > buffer_capacity){
216
219
}
217
220
218
221
/* Add server to set of servers to retry periodically */
222
__attribute__((nonnull, warn_unused_result))
219
223
bool add_server(const char *ip, in_port_t port, AvahiIfIndex if_index,
220
224
int af, server **current_server){
221
225
int ret;
230
234
.af = af };
231
235
if(new_server->ip == NULL){
232
236
perror_plus("strdup");
237
free(new_server);
233
238
return false;
234
239
}
235
240
ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
236
241
if(ret == -1){
237
242
perror_plus("clock_gettime");
243
#ifdef __GNUC__
244
#pragma GCC diagnostic push
245
#pragma GCC diagnostic ignored "-Wcast-qual"
246
#endif
247
free((char *)(new_server->ip));
248
#ifdef __GNUC__
249
#pragma GCC diagnostic pop
250
#endif
251
free(new_server);
238
252
return false;
239
253
}
240
254
/* Special case of first server */
242
256
new_server->next = new_server;
243
257
new_server->prev = new_server;
244
258
*current_server = new_server;
245
/* Place the new server last in the list */
246
259
} else {
260
/* Place the new server last in the list */
247
261
new_server->next = *current_server;
248
262
new_server->prev = (*current_server)->prev;
249
263
new_server->prev->next = new_server;
255
269
/*
256
270
* Initialize GPGME.
257
271
*/
258
static bool init_gpgme(const char *seckey, const char *pubkey,
259
const char *tempdir, mandos_context *mc){
272
__attribute__((nonnull, warn_unused_result))
273
static bool init_gpgme(const char * const seckey,
274
const char * const pubkey,
275
const char * const tempdir,
276
mandos_context *mc){
260
277
gpgme_error_t rc;
261
278
gpgme_engine_info_t engine_info;
262
279
263
280
/*
264
281
* Helper function to insert pub and seckey to the engine keyring.
265
282
*/
266
bool import_key(const char *filename){
283
bool import_key(const char * const filename){
267
284
int ret;
268
285
int fd;
269
286
gpgme_data_t pgp_data;
350
367
* Decrypt OpenPGP data.
351
368
* Returns -1 on error
352
369
*/
370
__attribute__((nonnull, warn_unused_result))
353
371
static ssize_t pgp_packet_decrypt(const char *cryptotext,
354
372
size_t crypto_size,
355
373
char **plaintext,
475
493
return plaintext_length;
476
494
}
477
495
478
static const char * safer_gnutls_strerror(int value){
496
__attribute__((warn_unused_result, const))
497
static const char *safe_string(const char *str){
498
if(str == NULL)
499
return "(unknown)";
500
return str;
501
}
502
503
__attribute__((warn_unused_result))
504
static const char *safer_gnutls_strerror(int value){
479
505
const char *ret = gnutls_strerror(value);
480
if(ret == NULL)
481
ret = "(unknown)";
482
return ret;
506
return safe_string(ret);
483
507
}
484
508
485
509
/* GnuTLS log function callback */
510
__attribute__((nonnull))
486
511
static void debuggnutls(__attribute__((unused)) int level,
487
512
const char* string){
488
513
fprintf_plus(stderr, "GnuTLS: %s", string);
489
514
}
490
515
516
__attribute__((nonnull, warn_unused_result))
491
517
static int init_gnutls_global(const char *pubkeyfilename,
492
518
const char *seckeyfilename,
493
519
mandos_context *mc){
494
520
int ret;
521
unsigned int uret;
495
522
496
523
if(debug){
497
524
fprintf_plus(stderr, "Initializing GnuTLS\n");
548
575
safer_gnutls_strerror(ret));
549
576
goto globalfail;
550
577
}
578
if(mc->dh_bits == 0){
579
/* Find out the optimal number of DH bits */
580
/* Try to read the private key file */
581
gnutls_datum_t buffer = { .data = NULL, .size = 0 };
582
{
583
int secfile = open(seckeyfilename, O_RDONLY);
584
size_t buffer_capacity = 0;
585
while(true){
586
buffer_capacity = incbuffer((char **)&buffer.data,
587
(size_t)buffer.size,
588
(size_t)buffer_capacity);
589
if(buffer_capacity == 0){
590
perror_plus("incbuffer");
591
free(buffer.data);
592
buffer.data = NULL;
593
break;
594
}
595
ssize_t bytes_read = read(secfile, buffer.data + buffer.size,
596
BUFFER_SIZE);
597
/* EOF */
598
if(bytes_read == 0){
599
break;
600
}
601
/* check bytes_read for failure */
602
if(bytes_read < 0){
603
perror_plus("read");
604
free(buffer.data);
605
buffer.data = NULL;
606
break;
607
}
608
buffer.size += (unsigned int)bytes_read;
609
}
610
close(secfile);
611
}
612
/* If successful, use buffer to parse private key */
613
gnutls_sec_param_t sec_param = GNUTLS_SEC_PARAM_ULTRA;
614
if(buffer.data != NULL){
615
{
616
gnutls_openpgp_privkey_t privkey = NULL;
617
ret = gnutls_openpgp_privkey_init(&privkey);
618
if(ret != GNUTLS_E_SUCCESS){
619
fprintf_plus(stderr, "Error initializing OpenPGP key"
620
" structure: %s", safer_gnutls_strerror(ret));
621
free(buffer.data);
622
buffer.data = NULL;
623
} else {
624
ret = gnutls_openpgp_privkey_import(privkey, &buffer,
625
GNUTLS_OPENPGP_FMT_BASE64,
626
"", 0);
627
if(ret != GNUTLS_E_SUCCESS){
628
fprintf_plus(stderr, "Error importing OpenPGP key : %s",
629
safer_gnutls_strerror(ret));
630
privkey = NULL;
631
}
632
free(buffer.data);
633
buffer.data = NULL;
634
if(privkey != NULL){
635
/* Use private key to suggest an appropriate sec_param */
636
sec_param = gnutls_openpgp_privkey_sec_param(privkey);
637
gnutls_openpgp_privkey_deinit(privkey);
638
if(debug){
639
fprintf_plus(stderr, "This OpenPGP key implies using a"
640
" GnuTLS security parameter \"%s\".\n",
641
safe_string(gnutls_sec_param_get_name
642
(sec_param)));
643
}
644
}
645
}
646
}
647
if(sec_param == GNUTLS_SEC_PARAM_UNKNOWN){
648
/* Err on the side of caution */
649
sec_param = GNUTLS_SEC_PARAM_ULTRA;
650
if(debug){
651
fprintf_plus(stderr, "Falling back to security parameter"
652
" \"%s\"\n",
653
safe_string(gnutls_sec_param_get_name
654
(sec_param)));
655
}
656
}
657
}
658
uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
659
if(uret != 0){
660
mc->dh_bits = uret;
661
if(debug){
662
fprintf_plus(stderr, "A \"%s\" GnuTLS security parameter"
663
" implies %u DH bits; using that.\n",
664
safe_string(gnutls_sec_param_get_name
665
(sec_param)),
666
mc->dh_bits);
667
}
668
} else {
669
fprintf_plus(stderr, "Failed to get implied number of DH"
670
" bits for security parameter \"%s\"): %s\n",
671
safe_string(gnutls_sec_param_get_name(sec_param)),
672
safer_gnutls_strerror(ret));
673
goto globalfail;
674
}
675
} else if(debug){
676
fprintf_plus(stderr, "DH bits explicitly set to %u\n",
677
mc->dh_bits);
678
}
551
679
ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
552
680
if(ret != GNUTLS_E_SUCCESS){
553
fprintf_plus(stderr, "Error in GnuTLS prime generation: %s\n",
554
safer_gnutls_strerror(ret));
681
fprintf_plus(stderr, "Error in GnuTLS prime generation (%u bits):"
682
" %s\n", mc->dh_bits, safer_gnutls_strerror(ret));
555
683
goto globalfail;
556
684
}
557
685
567
695
return -1;
568
696
}
569
697
698
__attribute__((nonnull, warn_unused_result))
570
699
static int init_gnutls_session(gnutls_session_t *session,
571
700
mandos_context *mc){
572
701
int ret;
629
758
__attribute__((unused)) const char *txt){}
630
759
631
760
/* Called when a Mandos server is found */
761
__attribute__((nonnull, warn_unused_result))
632
762
static int start_mandos_communication(const char *ip, in_port_t port,
633
763
AvahiIfIndex if_index,
634
764
int af, mandos_context *mc){
740
870
goto mandos_end;
741
871
}
742
872
if(af == AF_INET6){
743
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
873
((struct sockaddr_in6 *)&to)->sin6_port = htons(port);
744
874
if(IN6_IS_ADDR_LINKLOCAL
745
875
(&((struct sockaddr_in6 *)&to)->sin6_addr)){
746
876
if(if_index == AVAHI_IF_UNSPEC){
809
939
sizeof(struct sockaddr_in));
810
940
}
811
941
if(ret < 0){
812
if ((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
942
if((errno != ECONNREFUSED and errno != ENETUNREACH) or debug){
813
943
int e = errno;
814
944
perror_plus("connect");
815
945
errno = e;
1030
1160
return retval;
1031
1161
}
1032
1162
1163
__attribute__((nonnull))
1033
1164
static void resolve_callback(AvahiSServiceResolver *r,
1034
1165
AvahiIfIndex interface,
1035
1166
AvahiProtocol proto,
1043
1174
AVAHI_GCC_UNUSED AvahiStringList *txt,
1044
1175
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1045
1176
flags,
1046
void* mc){
1177
void *mc){
1047
1178
if(r == NULL){
1048
1179
return;
1049
1180
}
1052
1183
timed out */
1053
1184
1054
1185
if(quit_now){
1186
avahi_s_service_resolver_free(r);
1055
1187
return;
1056
1188
}
1057
1189
1102
1234
const char *domain,
1103
1235
AVAHI_GCC_UNUSED AvahiLookupResultFlags
1104
1236
flags,
1105
void* mc){
1237
void *mc){
1106
1238
if(b == NULL){
1107
1239
return;
1108
1240
}
1168
1300
errno = old_errno;
1169
1301
}
1170
1302
1303
__attribute__((nonnull, warn_unused_result))
1171
1304
bool get_flags(const char *ifname, struct ifreq *ifr){
1172
1305
int ret;
1173
1306
error_t ret_errno;
1192
1325
return true;
1193
1326
}
1194
1327
1328
__attribute__((nonnull, warn_unused_result))
1195
1329
bool good_flags(const char *ifname, const struct ifreq *ifr){
1196
1330
1197
1331
/* Reject the loopback device */
1239
1373
* corresponds to an acceptable network device.
1240
1374
* (This function is passed to scandir(3) as a filter function.)
1241
1375
*/
1376
__attribute__((nonnull, warn_unused_result))
1242
1377
int good_interface(const struct dirent *if_entry){
1243
1378
if(if_entry->d_name[0] == '.'){
1244
1379
return 0;
1262
1397
/*
1263
1398
* This function determines if a network interface is up.
1264
1399
*/
1400
__attribute__((nonnull, warn_unused_result))
1265
1401
bool interface_is_up(const char *interface){
1266
1402
struct ifreq ifr;
1267
1403
if(not get_flags(interface, &ifr)){
1278
1414
/*
1279
1415
* This function determines if a network interface is running
1280
1416
*/
1417
__attribute__((nonnull, warn_unused_result))
1281
1418
bool interface_is_running(const char *interface){
1282
1419
struct ifreq ifr;
1283
1420
if(not get_flags(interface, &ifr)){
1291
1428
return (bool)(ifr.ifr_flags & IFF_RUNNING);
1292
1429
}
1293
1430
1431
__attribute__((nonnull, pure, warn_unused_result))
1294
1432
int notdotentries(const struct dirent *direntry){
1295
1433
/* Skip "." and ".." */
1296
1434
if(direntry->d_name[0] == '.'
1303
1441
}
1304
1442
1305
1443
/* Is this directory entry a runnable program? */
1444
__attribute__((nonnull, warn_unused_result))
1306
1445
int runnable_hook(const struct dirent *direntry){
1307
1446
int ret;
1308
1447
size_t sret;
1316
1455
sret = strspn(direntry->d_name, "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
1317
1456
"abcdefghijklmnopqrstuvwxyz"
1318
1457
"0123456789"
1319
"_-");
1458
"_.-");
1320
1459
if((direntry->d_name)[sret] != '\0'){
1321
1460
/* Contains non-allowed characters */
1322
1461
if(debug){
1326
1465
return 0;
1327
1466
}
1328
1467
1329
char *fullname = NULL;
1330
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1331
if(ret < 0){
1332
perror_plus("asprintf");
1333
return 0;
1334
}
1335
1336
ret = stat(fullname, &st);
1468
ret = fstatat(hookdir_fd, direntry->d_name, &st, 0);
1337
1469
if(ret == -1){
1338
1470
if(debug){
1339
1471
perror_plus("Could not stat hook");
1363
1495
return 1;
1364
1496
}
1365
1497
1498
__attribute__((nonnull, warn_unused_result))
1366
1499
int avahi_loop_with_timeout(AvahiSimplePoll *s, int retry_interval,
1367
1500
mandos_context *mc){
1368
1501
int ret;
1372
1505
1373
1506
while(true){
1374
1507
if(mc->current_server == NULL){
1375
if (debug){
1508
if(debug){
1376
1509
fprintf_plus(stderr, "Wait until first server is found."
1377
1510
" No timeout!\n");
1378
1511
}
1379
1512
ret = avahi_simple_poll_iterate(s, -1);
1380
1513
} else {
1381
if (debug){
1514
if(debug){
1382
1515
fprintf_plus(stderr, "Check current_server if we should run"
1383
1516
" it, or wait\n");
1384
1517
}
1401
1534
- ((intmax_t)waited_time.tv_sec * 1000))
1402
1535
- ((intmax_t)waited_time.tv_nsec / 1000000));
1403
1536
1404
if (debug){
1537
if(debug){
1405
1538
fprintf_plus(stderr, "Blocking for %" PRIdMAX " ms\n",
1406
1539
block_time);
1407
1540
}
1429
1562
ret = avahi_simple_poll_iterate(s, (int)block_time);
1430
1563
}
1431
1564
if(ret != 0){
1432
if (ret > 0 or errno != EINTR){
1565
if(ret > 0 or errno != EINTR){
1433
1566
return (ret != 1) ? ret : 0;
1434
1567
}
1435
1568
}
1437
1570
}
1438
1571
1439
1572
/* Set effective uid to 0, return errno */
1573
__attribute__((warn_unused_result))
1440
1574
error_t raise_privileges(void){
1441
1575
error_t old_errno = errno;
1442
1576
error_t ret_errno = 0;
1443
1577
if(seteuid(0) == -1){
1444
1578
ret_errno = errno;
1445
perror_plus("seteuid");
1446
1579
}
1447
1580
errno = old_errno;
1448
1581
return ret_errno;
1449
1582
}
1450
1583
1451
1584
/* Set effective and real user ID to 0. Return errno. */
1585
__attribute__((warn_unused_result))
1452
1586
error_t raise_privileges_permanently(void){
1453
1587
error_t old_errno = errno;
1454
1588
error_t ret_errno = raise_privileges();
1458
1592
}
1459
1593
if(setuid(0) == -1){
1460
1594
ret_errno = errno;
1461
perror_plus("seteuid");
1462
1595
}
1463
1596
errno = old_errno;
1464
1597
return ret_errno;
1465
1598
}
1466
1599
1467
1600
/* Set effective user ID to unprivileged saved user ID */
1601
__attribute__((warn_unused_result))
1468
1602
error_t lower_privileges(void){
1469
1603
error_t old_errno = errno;
1470
1604
error_t ret_errno = 0;
1471
1605
if(seteuid(uid) == -1){
1472
1606
ret_errno = errno;
1473
perror_plus("seteuid");
1474
1607
}
1475
1608
errno = old_errno;
1476
1609
return ret_errno;
1477
1610
}
1478
1611
1479
1612
/* Lower privileges permanently */
1613
__attribute__((warn_unused_result))
1480
1614
error_t lower_privileges_permanently(void){
1481
1615
error_t old_errno = errno;
1482
1616
error_t ret_errno = 0;
1483
1617
if(setuid(uid) == -1){
1484
1618
ret_errno = errno;
1485
perror_plus("setuid");
1486
1619
}
1487
1620
errno = old_errno;
1488
1621
return ret_errno;
1489
1622
}
1490
1623
1491
bool run_network_hooks(const char *mode, const char *interface,
1624
__attribute__((nonnull))
1625
void run_network_hooks(const char *mode, const char *interface,
1492
1626
const float delay){
1493
struct dirent **direntries;
1494
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1495
alphasort);
1627
struct dirent **direntries = NULL;
1628
if(hookdir_fd == -1){
1629
hookdir_fd = open(hookdir, O_RDONLY);
1630
if(hookdir_fd == -1){
1631
if(errno == ENOENT){
1632
if(debug){
1633
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1634
" found\n", hookdir);
1635
}
1636
} else {
1637
perror_plus("open");
1638
}
1639
return;
1640
}
1641
}
1642
#ifdef __GLIBC__
1643
#if __GLIBC_PREREQ(2, 15)
1644
int numhooks = scandirat(hookdir_fd, ".", &direntries,
1645
runnable_hook, alphasort);
1646
#else /* not __GLIBC_PREREQ(2, 15) */
1647
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1648
alphasort);
1649
#endif /* not __GLIBC_PREREQ(2, 15) */
1650
#else /* not __GLIBC__ */
1651
int numhooks = scandir(hookdir, &direntries, runnable_hook,
1652
alphasort);
1653
#endif /* not __GLIBC__ */
1496
1654
if(numhooks == -1){
1497
if(errno == ENOENT){
1498
if(debug){
1499
fprintf_plus(stderr, "Network hook directory \"%s\" not"
1500
" found\n", hookdir);
1501
}
1502
} else {
1503
perror_plus("scandir");
1655
perror_plus("scandir");
1656
return;
1657
}
1658
struct dirent *direntry;
1659
int ret;
1660
int devnull = open("/dev/null", O_RDONLY);
1661
for(int i = 0; i < numhooks; i++){
1662
direntry = direntries[i];
1663
if(debug){
1664
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1665
direntry->d_name);
1504
1666
}
1505
} else {
1506
struct dirent *direntry;
1507
int ret;
1508
int devnull = open("/dev/null", O_RDONLY);
1509
for(int i = 0; i < numhooks; i++){
1510
direntry = direntries[i];
1511
char *fullname = NULL;
1512
ret = asprintf(&fullname, "%s/%s", hookdir, direntry->d_name);
1513
if(ret < 0){
1667
pid_t hook_pid = fork();
1668
if(hook_pid == 0){
1669
/* Child */
1670
/* Raise privileges */
1671
errno = raise_privileges_permanently();
1672
if(errno != 0){
1673
perror_plus("Failed to raise privileges");
1674
_exit(EX_NOPERM);
1675
}
1676
/* Set group */
1677
errno = 0;
1678
ret = setgid(0);
1679
if(ret == -1){
1680
perror_plus("setgid");
1681
_exit(EX_NOPERM);
1682
}
1683
/* Reset supplementary groups */
1684
errno = 0;
1685
ret = setgroups(0, NULL);
1686
if(ret == -1){
1687
perror_plus("setgroups");
1688
_exit(EX_NOPERM);
1689
}
1690
ret = dup2(devnull, STDIN_FILENO);
1691
if(ret == -1){
1692
perror_plus("dup2(devnull, STDIN_FILENO)");
1693
_exit(EX_OSERR);
1694
}
1695
ret = close(devnull);
1696
if(ret == -1){
1697
perror_plus("close");
1698
_exit(EX_OSERR);
1699
}
1700
ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1701
if(ret == -1){
1702
perror_plus("dup2(STDERR_FILENO, STDOUT_FILENO)");
1703
_exit(EX_OSERR);
1704
}
1705
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1706
if(ret == -1){
1707
perror_plus("setenv");
1708
_exit(EX_OSERR);
1709
}
1710
ret = setenv("DEVICE", interface, 1);
1711
if(ret == -1){
1712
perror_plus("setenv");
1713
_exit(EX_OSERR);
1714
}
1715
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1716
if(ret == -1){
1717
perror_plus("setenv");
1718
_exit(EX_OSERR);
1719
}
1720
ret = setenv("MODE", mode, 1);
1721
if(ret == -1){
1722
perror_plus("setenv");
1723
_exit(EX_OSERR);
1724
}
1725
char *delaystring;
1726
ret = asprintf(&delaystring, "%f", (double)delay);
1727
if(ret == -1){
1514
1728
perror_plus("asprintf");
1515
continue;
1516
}
1517
if(debug){
1518
fprintf_plus(stderr, "Running network hook \"%s\"\n",
1519
direntry->d_name);
1520
}
1521
pid_t hook_pid = fork();
1522
if(hook_pid == 0){
1523
/* Child */
1524
/* Raise privileges */
1525
raise_privileges_permanently();
1526
/* Set group */
1527
errno = 0;
1528
ret = setgid(0);
1529
if(ret == -1){
1530
perror_plus("setgid");
1531
}
1532
/* Reset supplementary groups */
1533
errno = 0;
1534
ret = setgroups(0, NULL);
1535
if(ret == -1){
1536
perror_plus("setgroups");
1537
}
1538
dup2(devnull, STDIN_FILENO);
1539
close(devnull);
1540
dup2(STDERR_FILENO, STDOUT_FILENO);
1541
ret = setenv("MANDOSNETHOOKDIR", hookdir, 1);
1542
if(ret == -1){
1543
perror_plus("setenv");
1544
_exit(EX_OSERR);
1545
}
1546
ret = setenv("DEVICE", interface, 1);
1547
if(ret == -1){
1548
perror_plus("setenv");
1549
_exit(EX_OSERR);
1550
}
1551
ret = setenv("VERBOSITY", debug ? "1" : "0", 1);
1552
if(ret == -1){
1553
perror_plus("setenv");
1554
_exit(EX_OSERR);
1555
}
1556
ret = setenv("MODE", mode, 1);
1557
if(ret == -1){
1558
perror_plus("setenv");
1559
_exit(EX_OSERR);
1560
}
1561
char *delaystring;
1562
ret = asprintf(&delaystring, "%f", delay);
1563
if(ret == -1){
1564
perror_plus("asprintf");
1565
_exit(EX_OSERR);
1566
}
1567
ret = setenv("DELAY", delaystring, 1);
1568
if(ret == -1){
1569
free(delaystring);
1570
perror_plus("setenv");
1571
_exit(EX_OSERR);
1572
}
1729
_exit(EX_OSERR);
1730
}
1731
ret = setenv("DELAY", delaystring, 1);
1732
if(ret == -1){
1573
1733
free(delaystring);
1574
if(connect_to != NULL){
1575
ret = setenv("CONNECT", connect_to, 1);
1576
if(ret == -1){
1577
perror_plus("setenv");
1578
_exit(EX_OSERR);
1579
}
1580
}
1581
if(execl(fullname, direntry->d_name, mode, NULL) == -1){
1582
perror_plus("execl");
1583
_exit(EXIT_FAILURE);
1584
}
1734
perror_plus("setenv");
1735
_exit(EX_OSERR);
1736
}
1737
free(delaystring);
1738
if(connect_to != NULL){
1739
ret = setenv("CONNECT", connect_to, 1);
1740
if(ret == -1){
1741
perror_plus("setenv");
1742
_exit(EX_OSERR);
1743
}
1744
}
1745
int hook_fd = openat(hookdir_fd, direntry->d_name, O_RDONLY);
1746
if(hook_fd == -1){
1747
perror_plus("openat");
1748
_exit(EXIT_FAILURE);
1749
}
1750
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1751
perror_plus("close");
1752
_exit(EXIT_FAILURE);
1753
}
1754
if(fexecve(hook_fd, (char *const []){ direntry->d_name, NULL },
1755
environ) == -1){
1756
perror_plus("fexecve");
1757
_exit(EXIT_FAILURE);
1758
}
1759
} else {
1760
if(hook_pid == -1){
1761
perror_plus("fork");
1762
free(direntry);
1763
continue;
1764
}
1765
int status;
1766
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1767
perror_plus("waitpid");
1768
free(direntry);
1769
continue;
1770
}
1771
if(WIFEXITED(status)){
1772
if(WEXITSTATUS(status) != 0){
1773
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1774
" with status %d\n", direntry->d_name,
1775
WEXITSTATUS(status));
1776
free(direntry);
1777
continue;
1778
}
1779
} else if(WIFSIGNALED(status)){
1780
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1781
" signal %d\n", direntry->d_name,
1782
WTERMSIG(status));
1783
free(direntry);
1784
continue;
1585
1785
} else {
1586
int status;
1587
if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1588
perror_plus("waitpid");
1589
free(fullname);
1590
continue;
1591
}
1592
if(WIFEXITED(status)){
1593
if(WEXITSTATUS(status) != 0){
1594
fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1595
" with status %d\n", direntry->d_name,
1596
WEXITSTATUS(status));
1597
free(fullname);
1598
continue;
1599
}
1600
} else if(WIFSIGNALED(status)){
1601
fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1602
" signal %d\n", direntry->d_name,
1603
WTERMSIG(status));
1604
free(fullname);
1605
continue;
1606
} else {
1607
fprintf_plus(stderr, "Warning: network hook \"%s\""
1608
" crashed\n", direntry->d_name);
1609
free(fullname);
1610
continue;
1611
}
1612
}
1613
free(fullname);
1614
if(debug){
1615
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1616
direntry->d_name);
1617
}
1618
}
1619
close(devnull);
1620
}
1621
return true;
1786
fprintf_plus(stderr, "Warning: network hook \"%s\""
1787
" crashed\n", direntry->d_name);
1788
free(direntry);
1789
continue;
1790
}
1791
}
1792
if(debug){
1793
fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1794
direntry->d_name);
1795
}
1796
free(direntry);
1797
}
1798
free(direntries);
1799
if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
1800
perror_plus("close");
1801
} else {
1802
hookdir_fd = -1;
1803
}
1804
close(devnull);
1622
1805
}
1623
1806
1807
__attribute__((nonnull, warn_unused_result))
1624
1808
error_t bring_up_interface(const char *const interface,
1625
1809
const float delay){
1626
int sd = -1;
1627
1810
error_t old_errno = errno;
1628
error_t ret_errno = 0;
1629
int ret, ret_setflags;
1811
int ret;
1630
1812
struct ifreq network;
1631
1813
unsigned int if_index = if_nametoindex(interface);
1632
1814
if(if_index == 0){
1641
1823
}
1642
1824
1643
1825
if(not interface_is_up(interface)){
1644
if(not get_flags(interface, &network) and debug){
1826
error_t ret_errno = 0, ioctl_errno = 0;
1827
if(not get_flags(interface, &network)){
1645
1828
ret_errno = errno;
1646
1829
fprintf_plus(stderr, "Failed to get flags for interface "
1647
1830
"\"%s\"\n", interface);
1831
errno = old_errno;
1648
1832
return ret_errno;
1649
1833
}
1650
network.ifr_flags |= IFF_UP;
1834
network.ifr_flags |= IFF_UP; /* set flag */
1651
1835
1652
sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1653
if(sd < 0){
1836
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1837
if(sd == -1){
1654
1838
ret_errno = errno;
1655
1839
perror_plus("socket");
1656
1840
errno = old_errno;
1657
1841
return ret_errno;
1658
1842
}
1659
1843
1660
1844
if(quit_now){
1661
close(sd);
1845
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1846
if(ret == -1){
1847
perror_plus("close");
1848
}
1662
1849
errno = old_errno;
1663
1850
return EINTR;
1664
1851
}
1668
1855
interface);
1669
1856
}
1670
1857
1671
/* Raise priviliges */
1672
raise_privileges();
1858
/* Raise privileges */
1859
ret_errno = raise_privileges();
1860
if(ret_errno != 0){
1861
errno = ret_errno;
1862
perror_plus("Failed to raise privileges");
1863
}
1673
1864
1674
1865
#ifdef __linux__
1675
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1676
messages about the network interface to mess up the prompt */
1677
int ret_linux = klogctl(8, NULL, 5);
1678
bool restore_loglevel = true;
1679
if(ret_linux == -1){
1680
restore_loglevel = false;
1681
perror_plus("klogctl");
1866
int ret_linux;
1867
bool restore_loglevel = false;
1868
if(ret_errno == 0){
1869
/* Lower kernel loglevel to KERN_NOTICE to avoid KERN_INFO
1870
messages about the network interface to mess up the prompt */
1871
ret_linux = klogctl(8, NULL, 5);
1872
if(ret_linux == -1){
1873
perror_plus("klogctl");
1874
} else {
1875
restore_loglevel = true;
1876
}
1682
1877
}
1683
1878
#endif /* __linux__ */
1684
ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1685
ret_errno = errno;
1879
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1880
ioctl_errno = errno;
1686
1881
#ifdef __linux__
1687
1882
if(restore_loglevel){
1688
1883
ret_linux = klogctl(7, NULL, 0);
1692
1887
}
1693
1888
#endif /* __linux__ */
1694
1889
1695
/* Lower privileges */
1696
lower_privileges();
1890
/* If raise_privileges() succeeded above */
1891
if(ret_errno == 0){
1892
/* Lower privileges */
1893
ret_errno = lower_privileges();
1894
if(ret_errno != 0){
1895
errno = ret_errno;
1896
perror_plus("Failed to lower privileges");
1897
}
1898
}
1697
1899
1698
1900
/* Close the socket */
1699
1901
ret = (int)TEMP_FAILURE_RETRY(close(sd));
1702
1904
}
1703
1905
1704
1906
if(ret_setflags == -1){
1705
errno = ret_errno;
1907
errno = ioctl_errno;
1706
1908
perror_plus("ioctl SIOCSIFFLAGS +IFF_UP");
1707
1909
errno = old_errno;
1708
return ret_errno;
1910
return ioctl_errno;
1709
1911
}
1710
1912
} else if(debug){
1711
1913
fprintf_plus(stderr, "Interface \"%s\" is already up; good\n",
1729
1931
return 0;
1730
1932
}
1731
1933
1934
__attribute__((nonnull, warn_unused_result))
1732
1935
error_t take_down_interface(const char *const interface){
1733
1936
error_t old_errno = errno;
1734
1937
struct ifreq network;
1739
1942
return ENXIO;
1740
1943
}
1741
1944
if(interface_is_up(interface)){
1742
error_t ret_errno = 0;
1945
error_t ret_errno = 0, ioctl_errno = 0;
1743
1946
if(not get_flags(interface, &network) and debug){
1744
1947
ret_errno = errno;
1745
1948
fprintf_plus(stderr, "Failed to get flags for interface "
1746
1949
"\"%s\"\n", interface);
1950
errno = old_errno;
1747
1951
return ret_errno;
1748
1952
}
1749
1953
network.ifr_flags &= ~(short)IFF_UP; /* clear flag */
1750
1954
1751
1955
int sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP);
1752
if(sd < 0){
1956
if(sd == -1){
1753
1957
ret_errno = errno;
1754
1958
perror_plus("socket");
1755
1959
errno = old_errno;
1761
1965
interface);
1762
1966
}
1763
1967
1764
/* Raise priviliges */
1765
raise_privileges();
1968
/* Raise privileges */
1969
ret_errno = raise_privileges();
1970
if(ret_errno != 0){
1971
errno = ret_errno;
1972
perror_plus("Failed to raise privileges");
1973
}
1766
1974
1767
1975
int ret_setflags = ioctl(sd, SIOCSIFFLAGS, &network);
1768
ret_errno = errno;
1976
ioctl_errno = errno;
1769
1977
1770
/* Lower privileges */
1771
lower_privileges();
1978
/* If raise_privileges() succeeded above */
1979
if(ret_errno == 0){
1980
/* Lower privileges */
1981
ret_errno = lower_privileges();
1982
if(ret_errno != 0){
1983
errno = ret_errno;
1984
perror_plus("Failed to lower privileges");
1985
}
1986
}
1772
1987
1773
1988
/* Close the socket */
1774
1989
int ret = (int)TEMP_FAILURE_RETRY(close(sd));
1777
1992
}
1778
1993
1779
1994
if(ret_setflags == -1){
1780
errno = ret_errno;
1995
errno = ioctl_errno;
1781
1996
perror_plus("ioctl SIOCSIFFLAGS -IFF_UP");
1782
1997
errno = old_errno;
1783
return ret_errno;
1998
return ioctl_errno;
1784
1999
}
1785
2000
} else if(debug){
1786
2001
fprintf_plus(stderr, "Interface \"%s\" is already down; odd\n",
1792
2007
}
1793
2008
1794
2009
int main(int argc, char *argv[]){
1795
mandos_context mc = { .server = NULL, .dh_bits = 1024,
2010
mandos_context mc = { .server = NULL, .dh_bits = 0,
1796
2011
.priority = "SECURE256:!CTYPE-X.509:"
1797
"+CTYPE-OPENPGP", .current_server = NULL,
2012
"+CTYPE-OPENPGP:!RSA", .current_server = NULL,
1798
2013
.interfaces = NULL, .interfaces_size = 0 };
1799
2014
AvahiSServiceBrowser *sb = NULL;
1800
2015
error_t ret_errno;
1804
2019
int exitcode = EXIT_SUCCESS;
1805
2020
char *interfaces_to_take_down = NULL;
1806
2021
size_t interfaces_to_take_down_size = 0;
1807
char tempdir[] = "/tmp/mandosXXXXXX";
1808
bool tempdir_created = false;
2022
char run_tempdir[] = "/run/tmp/mandosXXXXXX";
2023
char old_tempdir[] = "/tmp/mandosXXXXXX";
2024
char *tempdir = NULL;
1809
2025
AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
1810
2026
const char *seckey = PATHDIR "/" SECKEY;
1811
2027
const char *pubkey = PATHDIR "/" PUBKEY;
1993
2209
/* Work around Debian bug #633582:
1994
2210
<http://bugs.debian.org/633582> */
1995
2211
1996
/* Re-raise priviliges */
1997
if(raise_privileges() == 0){
2212
/* Re-raise privileges */
2213
ret_errno = raise_privileges();
2214
if(ret_errno != 0){
2215
errno = ret_errno;
2216
perror_plus("Failed to raise privileges");
2217
} else {
1998
2218
struct stat st;
1999
2219
2000
2220
if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2040
2260
}
2041
2261
2042
2262
/* Lower privileges */
2043
lower_privileges();
2263
ret_errno = lower_privileges();
2264
if(ret_errno != 0){
2265
errno = ret_errno;
2266
perror_plus("Failed to lower privileges");
2267
}
2044
2268
}
2045
2269
}
2046
2270
2072
2296
memcpy(interfaces_hooks, mc.interfaces, mc.interfaces_size);
2073
2297
argz_stringify(interfaces_hooks, mc.interfaces_size, (int)',');
2074
2298
}
2075
if(not run_network_hooks("start", interfaces_hooks != NULL ?
2076
interfaces_hooks : "", delay)){
2077
goto end;
2078
}
2299
run_network_hooks("start", interfaces_hooks != NULL ?
2300
interfaces_hooks : "", delay);
2079
2301
}
2080
2302
2081
2303
if(not debug){
2159
2381
2160
2382
/* If no interfaces were specified, make a list */
2161
2383
if(mc.interfaces == NULL){
2162
struct dirent **direntries;
2384
struct dirent **direntries = NULL;
2163
2385
/* Look for any good interfaces */
2164
2386
ret = scandir(sys_class_net, &direntries, good_interface,
2165
2387
alphasort);
2171
2393
if(ret_errno != 0){
2172
2394
errno = ret_errno;
2173
2395
perror_plus("argz_add");
2396
free(direntries[i]);
2174
2397
continue;
2175
2398
}
2176
2399
if(debug){
2177
2400
fprintf_plus(stderr, "Will use interface \"%s\"\n",
2178
2401
direntries[i]->d_name);
2179
2402
}
2403
free(direntries[i]);
2180
2404
}
2181
2405
free(direntries);
2182
2406
} else {
2183
free(direntries);
2407
if(ret == 0){
2408
free(direntries);
2409
}
2184
2410
fprintf_plus(stderr, "Could not find a network interface\n");
2185
2411
exitcode = EXIT_FAILURE;
2186
2412
goto end;
2209
2435
break;
2210
2436
}
2211
2437
bool interface_was_up = interface_is_up(interface);
2212
ret = bring_up_interface(interface, delay);
2438
errno = bring_up_interface(interface, delay);
2213
2439
if(not interface_was_up){
2214
if(ret != 0){
2215
errno = ret;
2440
if(errno != 0){
2216
2441
perror_plus("Failed to bring up interface");
2217
2442
} else {
2218
ret_errno = argz_add(&interfaces_to_take_down,
2219
&interfaces_to_take_down_size,
2220
interface);
2221
if(ret_errno != 0){
2222
errno = ret_errno;
2443
errno = argz_add(&interfaces_to_take_down,
2444
&interfaces_to_take_down_size,
2445
interface);
2446
if(errno != 0){
2223
2447
perror_plus("argz_add");
2224
2448
}
2225
2449
}
2256
2480
goto end;
2257
2481
}
2258
2482
2259
if(mkdtemp(tempdir) == NULL){
2483
/* Try /run/tmp before /tmp */
2484
tempdir = mkdtemp(run_tempdir);
2485
if(tempdir == NULL and errno == ENOENT){
2486
if(debug){
2487
fprintf_plus(stderr, "Tempdir %s did not work, trying %s\n",
2488
run_tempdir, old_tempdir);
2489
}
2490
tempdir = mkdtemp(old_tempdir);
2491
}
2492
if(tempdir == NULL){
2260
2493
perror_plus("mkdtemp");
2261
2494
goto end;
2262
2495
}
2263
tempdir_created = true;
2264
2496
2265
2497
if(quit_now){
2266
2498
goto end;
2341
2573
sleep((unsigned int)retry_interval);
2342
2574
}
2343
2575
2344
if (not quit_now){
2576
if(not quit_now){
2345
2577
exitcode = EXIT_SUCCESS;
2346
2578
}
2347
2579
2402
2634
if(debug){
2403
2635
fprintf_plus(stderr, "Starting Avahi loop search\n");
2404
2636
}
2405
2637
2406
2638
ret = avahi_loop_with_timeout(simple_poll,
2407
2639
(int)(retry_interval * 1000), &mc);
2408
2640
if(debug){
2444
2676
mc.current_server->prev->next = NULL;
2445
2677
while(mc.current_server != NULL){
2446
2678
server *next = mc.current_server->next;
2679
#ifdef __GNUC__
2680
#pragma GCC diagnostic push
2681
#pragma GCC diagnostic ignored "-Wcast-qual"
2682
#endif
2683
free((char *)(mc.current_server->ip));
2684
#ifdef __GNUC__
2685
#pragma GCC diagnostic pop
2686
#endif
2447
2687
free(mc.current_server);
2448
2688
mc.current_server = next;
2449
2689
}
2450
2690
}
2451
2691
2452
/* Re-raise priviliges */
2692
/* Re-raise privileges */
2453
2693
{
2454
raise_privileges();
2455
2456
/* Run network hooks */
2457
run_network_hooks("stop", interfaces_hooks != NULL ?
2458
interfaces_hooks : "", delay);
2459
2460
/* Take down the network interfaces which were brought up */
2461
{
2462
char *interface = NULL;
2463
while((interface=argz_next(interfaces_to_take_down,
2464
interfaces_to_take_down_size,
2465
interface))){
2466
ret_errno = take_down_interface(interface);
2467
if(ret_errno != 0){
2468
errno = ret_errno;
2469
perror_plus("Failed to take down interface");
2470
}
2471
}
2472
if(debug and (interfaces_to_take_down == NULL)){
2473
fprintf_plus(stderr, "No interfaces needed to be taken"
2474
" down\n");
2475
}
2476
}
2477
2478
lower_privileges_permanently();
2694
ret_errno = raise_privileges();
2695
if(ret_errno != 0){
2696
errno = ret_errno;
2697
perror_plus("Failed to raise privileges");
2698
} else {
2699
2700
/* Run network hooks */
2701
run_network_hooks("stop", interfaces_hooks != NULL ?
2702
interfaces_hooks : "", delay);
2703
2704
/* Take down the network interfaces which were brought up */
2705
{
2706
char *interface = NULL;
2707
while((interface=argz_next(interfaces_to_take_down,
2708
interfaces_to_take_down_size,
2709
interface))){
2710
ret_errno = take_down_interface(interface);
2711
if(ret_errno != 0){
2712
errno = ret_errno;
2713
perror_plus("Failed to take down interface");
2714
}
2715
}
2716
if(debug and (interfaces_to_take_down == NULL)){
2717
fprintf_plus(stderr, "No interfaces needed to be taken"
2718
" down\n");
2719
}
2720
}
2721
}
2722
2723
ret_errno = lower_privileges_permanently();
2724
if(ret_errno != 0){
2725
errno = ret_errno;
2726
perror_plus("Failed to lower privileges permanently");
2727
}
2479
2728
}
2480
2729
2481
2730
free(interfaces_to_take_down);
2482
2731
free(interfaces_hooks);
2483
2732
2484
2733
/* Removes the GPGME temp directory and all files inside */
2485
if(tempdir_created){
2734
if(tempdir != NULL){
2486
2735
struct dirent **direntries = NULL;
2487
struct dirent *direntry = NULL;
2488
int numentries = scandir(tempdir, &direntries, notdotentries,
2489
alphasort);
2490
if (numentries > 0){
2491
for(int i = 0; i < numentries; i++){
2492
direntry = direntries[i];
2493
char *fullname = NULL;
2494
ret = asprintf(&fullname, "%s/%s", tempdir,
2495
direntry->d_name);
2496
if(ret < 0){
2497
perror_plus("asprintf");
2498
continue;
2499
}
2500
ret = remove(fullname);
2501
if(ret == -1){
2502
fprintf_plus(stderr, "remove(\"%s\"): %s\n", fullname,
2503
strerror(errno));
2504
}
2505
free(fullname);
2736
int tempdir_fd = (int)TEMP_FAILURE_RETRY(open(tempdir, O_RDONLY |
2737
O_NOFOLLOW));
2738
if(tempdir_fd == -1){
2739
perror_plus("open");
2740
} else {
2741
#ifdef __GLIBC__
2742
#if __GLIBC_PREREQ(2, 15)
2743
int numentries = scandirat(tempdir_fd, ".", &direntries,
2744
notdotentries, alphasort);
2745
#else /* not __GLIBC_PREREQ(2, 15) */
2746
int numentries = scandir(tempdir, &direntries, notdotentries,
2747
alphasort);
2748
#endif /* not __GLIBC_PREREQ(2, 15) */
2749
#else /* not __GLIBC__ */
2750
int numentries = scandir(tempdir, &direntries, notdotentries,
2751
alphasort);
2752
#endif /* not __GLIBC__ */
2753
if(numentries >= 0){
2754
for(int i = 0; i < numentries; i++){
2755
ret = unlinkat(tempdir_fd, direntries[i]->d_name, 0);
2756
if(ret == -1){
2757
fprintf_plus(stderr, "unlinkat(open(\"%s\", O_RDONLY),"
2758
" \"%s\", 0): %s\n", tempdir,
2759
direntries[i]->d_name, strerror(errno));
2760
}
2761
free(direntries[i]);
2762
}
2763
2764
/* need to clean even if 0 because man page doesn't specify */
2765
free(direntries);
2766
if(numentries == -1){
2767
perror_plus("scandir");
2768
}
2769
ret = rmdir(tempdir);
2770
if(ret == -1 and errno != ENOENT){
2771
perror_plus("rmdir");
2772
}
2506
2773
}
2507
}
2508
2509
/* need to clean even if 0 because man page doesn't specify */
2510
free(direntries);
2511
if (numentries == -1){
2512
perror_plus("scandir");
2513
}
2514
ret = rmdir(tempdir);
2515
if(ret == -1 and errno != ENOENT){
2516
perror_plus("rmdir");
2774
TEMP_FAILURE_RETRY(close(tempdir_fd));
2517
2775
}
2518
2776
}
2519
2777
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0