/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.c

  • Committer: Teddy Hogeborn
  • Date: 2018-08-19 01:35:11 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 368.
  • Revision ID: teddy@recompile.se-20180819013511-cku25q9yeub3dnr0
Adapt to changes in cryptsetup; use "cryptroot-unlock" program

* Makefile (install-client-nokey): Also install new script files
  "mandos-to-cryptroot-unlock" and "initramfs-tools-script-stop".
* debian/mandos-client.dirs: Add
  "usr/share/initramfs-tools/scripts/local-premount".
* initramfs-tools-hook: Also copy "mandos-to-cryptroot-unlock".
* initramfs-tools-script: Only modify keyscript setting in cryptroot
  file if the file exists, otherwise start
  "mandos-to-cryptroot-unlock" in background.
* initramfs-tools-script-stop: New script to make sure plugin-runner
  has stopped before continuing.
* mandos-to-cryptroot-unlock: New script to run plugin-runner and feed
  any password it gets into the "cryptroot-unlock" program.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/mandos-client.c
9
9
 * "browse_callback", and parts of "main".
10
10
 * 
11
11
 * Everything else is
12
 
 * Copyright © 2008-2022 Teddy Hogeborn
13
 
 * Copyright © 2008-2022 Björn Påhlsson
 
12
 * Copyright © 2008-2018 Teddy Hogeborn
 
13
 * Copyright © 2008-2018 Björn Påhlsson
14
14
 * 
15
15
 * This file is part of Mandos.
16
16
 * 
38
38
#define _FILE_OFFSET_BITS 64
39
39
#endif  /* not _FILE_OFFSET_BITS */
40
40
 
41
 
#define _GNU_SOURCE             /* program_invocation_short_name,
42
 
                                   TEMP_FAILURE_RETRY(), O_CLOEXEC,
43
 
                                   scandirat(), asprintf() */
 
41
#define _GNU_SOURCE             /* TEMP_FAILURE_RETRY(), asprintf() */
 
42
 
 
43
#include <stdio.h>              /* fprintf(), stderr, fwrite(),
 
44
                                   stdout, ferror() */
 
45
#include <stdint.h>             /* uint16_t, uint32_t, intptr_t */
 
46
#include <stddef.h>             /* NULL, size_t, ssize_t */
 
47
#include <stdlib.h>             /* free(), EXIT_SUCCESS, srand(),
 
48
                                   strtof(), abort() */
44
49
#include <stdbool.h>            /* bool, false, true */
45
 
#include <argp.h>               /* argp_program_version,
46
 
                                   argp_program_bug_address,
47
 
                                   struct argp_option,
48
 
                                   struct argp_state, argp_error(),
49
 
                                   argp_state_help,
50
 
                                   ARGP_HELP_STD_HELP,
51
 
                                   ARGP_HELP_EXIT_ERR,
52
 
                                   ARGP_HELP_EXIT_OK, ARGP_HELP_USAGE,
53
 
                                   argp_err_exit_status,
54
 
                                   ARGP_ERR_UNKNOWN, struct argp,
55
 
                                   argp_parse(), ARGP_IN_ORDER,
56
 
                                   ARGP_NO_HELP */
57
 
#include <stddef.h>             /* NULL, size_t */
58
 
#include <sys/types.h>          /* uid_t, gid_t, sig_atomic_t,
59
 
                                   seteuid(), setuid(), pid_t,
60
 
                                   setgid(), getuid(), getgid() */
61
 
#include <unistd.h>             /* uid_t, gid_t, TEMP_FAILURE_RETRY(),
62
 
                                   seteuid(), setuid(), close(),
63
 
                                   ssize_t, read(), fork(), setgid(),
64
 
                                   _exit(), dup2(), STDIN_FILENO,
65
 
                                   STDERR_FILENO, STDOUT_FILENO,
66
 
                                   fexecve(), write(), getuid(),
67
 
                                   getgid(), fchown(), symlink(),
68
 
                                   sleep(), unlinkat(), pause() */
69
 
#include <netinet/in.h>         /* in_port_t, struct sockaddr_in6,
70
 
                                   sa_family_t, struct sockaddr_in,
71
 
                                   htons(), IN6_IS_ADDR_LINKLOCAL,
72
 
                                   INET_ADDRSTRLEN, INET6_ADDRSTRLEN,
73
 
                                   ntohl(), IPPROTO_IP */
74
 
#include <time.h>               /* struct timespec, clock_gettime(),
75
 
                                   CLOCK_MONOTONIC, time_t, struct tm,
76
 
                                   gmtime_r(), clock_settime(),
77
 
                                   CLOCK_REALTIME, nanosleep() */
78
 
#include <errno.h>              /* errno,
79
 
                                   program_invocation_short_name,
80
 
                                   EINTR, EINVAL, ENETUNREACH,
 
50
#include <string.h>             /* strcmp(), strlen(), strerror(),
 
51
                                   asprintf(), strncpy(), strsignal()
 
52
                                */
 
53
#include <sys/ioctl.h>          /* ioctl */
 
54
#include <sys/types.h>          /* socket(), inet_pton(), sockaddr,
 
55
                                   sockaddr_in6, PF_INET6,
 
56
                                   SOCK_STREAM, uid_t, gid_t, open(),
 
57
                                   opendir(), DIR */
 
58
#include <sys/stat.h>           /* open(), S_ISREG */
 
59
#include <sys/socket.h>         /* socket(), struct sockaddr_in6,
 
60
                                   inet_pton(), connect(),
 
61
                                   getnameinfo() */
 
62
#include <fcntl.h>              /* open(), unlinkat(), AT_REMOVEDIR */
 
63
#include <dirent.h>             /* opendir(), struct dirent, readdir()
 
64
                                 */
 
65
#include <inttypes.h>           /* PRIu16, PRIdMAX, intmax_t,
 
66
                                   strtoimax() */
 
67
#include <errno.h>              /* perror(), errno, EINTR, EINVAL,
 
68
                                   EAI_SYSTEM, ENETUNREACH,
81
69
                                   EHOSTUNREACH, ECONNREFUSED, EPROTO,
82
 
                                   EIO, ENOENT, ENXIO, error_t,
83
 
                                   ENOMEM, EISDIR, ENOTEMPTY */
84
 
#include <stdio.h>              /* fprintf(), stderr, perror(), FILE,
85
 
                                   vfprintf(), off_t, SEEK_SET,
86
 
                                   stdout, fwrite(), ferror(),
87
 
                                   fflush(), asprintf() */
88
 
#include <stdarg.h>             /* va_list, va_start(), vfprintf() */
89
 
#include <stdlib.h>             /* realloc(), free(), malloc(),
90
 
                                   getenv(), EXIT_FAILURE, setenv(),
91
 
                                   EXIT_SUCCESS, strtof(), strtod(),
92
 
                                   srand(), mkdtemp(), abort() */
93
 
#include <string.h>             /* strdup(), strcmp(), strlen(),
94
 
                                   strerror(), strncpy(), strspn(),
95
 
                                   memcpy(), strrchr(), strchr(),
96
 
                                   strsignal() */
97
 
#include <fcntl.h>              /* open(), O_RDONLY, O_DIRECTORY,
98
 
                                   O_PATH, O_CLOEXEC, openat(),
99
 
                                   O_NOFOLLOW, AT_REMOVEDIR */
100
 
#include <iso646.h>             /* or, and, not */
101
 
#include <sys/stat.h>           /* struct stat, fstat(), fstatat(),
102
 
                                   S_ISREG(), S_IXUSR, S_IXGRP,
103
 
                                   S_IXOTH, lstat() */
104
 
#include <net/if.h>             /* IF_NAMESIZE, if_indextoname(),
105
 
                                   if_nametoindex(), SIOCGIFFLAGS,
106
 
                                   IFF_LOOPBACK, IFF_POINTOPOINT,
107
 
                                   IFF_BROADCAST, IFF_NOARP, IFF_UP,
108
 
                                   IFF_RUNNING, SIOCSIFFLAGS */
109
 
#include <sysexits.h>           /* EX_NOPERM, EX_OSERR,
110
 
                                   EX_UNAVAILABLE, EX_USAGE */
 
70
                                   EIO, ENOENT, ENXIO, ENOMEM, EISDIR,
 
71
                                   ENOTEMPTY,
 
72
                                   program_invocation_short_name */
 
73
#include <time.h>               /* nanosleep(), time(), sleep() */
 
74
#include <net/if.h>             /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
 
75
                                   SIOCSIFFLAGS, if_indextoname(),
 
76
                                   if_nametoindex(), IF_NAMESIZE */
 
77
#include <netinet/in.h>         /* IN6_IS_ADDR_LINKLOCAL,
 
78
                                   INET_ADDRSTRLEN, INET6_ADDRSTRLEN
 
79
                                */
 
80
#include <unistd.h>             /* close(), SEEK_SET, off_t, write(),
 
81
                                   getuid(), getgid(), seteuid(),
 
82
                                   setgid(), pause(), _exit(),
 
83
                                   unlinkat() */
 
84
#include <arpa/inet.h>          /* inet_pton(), htons() */
 
85
#include <iso646.h>             /* not, or, and */
 
86
#include <argp.h>               /* struct argp_option, error_t, struct
 
87
                                   argp_state, struct argp,
 
88
                                   argp_parse(), ARGP_KEY_ARG,
 
89
                                   ARGP_KEY_END, ARGP_ERR_UNKNOWN */
 
90
#include <signal.h>             /* sigemptyset(), sigaddset(),
 
91
                                   sigaction(), SIGTERM, sig_atomic_t,
 
92
                                   raise() */
 
93
#include <sysexits.h>           /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
 
94
                                   EX_NOHOST, EX_IOERR, EX_PROTOCOL */
 
95
#include <sys/wait.h>           /* waitpid(), WIFEXITED(),
 
96
                                   WEXITSTATUS(), WTERMSIG() */
111
97
#include <grp.h>                /* setgroups() */
112
 
#include <sys/wait.h>           /* waitpid(), WIFEXITED(),
113
 
                                   WEXITSTATUS(), WIFSIGNALED(),
114
 
                                   WTERMSIG() */
115
 
#include <signal.h>             /* kill(), SIGTERM, struct sigaction,
116
 
                                   SIG_DFL, sigemptyset(),
117
 
                                   sigaddset(), SIGINT, SIGHUP,
118
 
                                   SIG_IGN, raise() */
119
 
#include <sys/socket.h>         /* struct sockaddr_storage, AF_INET6,
120
 
                                   PF_INET6, AF_INET, PF_INET,
121
 
                                   socket(), SOCK_STREAM,
122
 
                                   SOCK_CLOEXEC, struct sockaddr,
123
 
                                   connect(), SOCK_DGRAM */
124
 
#include <argz.h>               /* argz_next(), argz_add_sep(),
125
 
                                   argz_delete(), argz_stringify(),
126
 
                                   argz_add(), argz_count() */
127
 
#include <inttypes.h>           /* PRIuMAX, uintmax_t, uint32_t,
128
 
                                   PRIdMAX, PRIu16, intmax_t,
129
 
                                   strtoimax() */
130
 
#include <arpa/inet.h>          /* inet_pton() */
131
 
#include <stdint.h>             /* uint32_t, intptr_t, uint16_t */
 
98
#include <argz.h>               /* argz_add_sep(), argz_next(),
 
99
                                   argz_delete(), argz_append(),
 
100
                                   argz_stringify(), argz_add(),
 
101
                                   argz_count() */
132
102
#include <netdb.h>              /* getnameinfo(), NI_NUMERICHOST,
133
103
                                   EAI_SYSTEM, gai_strerror() */
134
 
#include <sys/ioctl.h>          /* ioctl() */
135
 
#include <dirent.h>             /* struct dirent, scandirat(),
136
 
                                   alphasort(), scandir() */
137
 
#include <limits.h>             /* INT_MAX */
138
104
 
139
105
#ifdef __linux__
140
106
#include <sys/klog.h>           /* klogctl() */
153
119
 
154
120
/* GnuTLS */
155
121
#include <gnutls/gnutls.h>      /* All GnuTLS types, constants and
156
 
                                   functions: gnutls_*, GNUTLS_* */
157
 
#if GNUTLS_VERSION_NUMBER < 0x030600
 
122
                                   functions:
 
123
                                   gnutls_*
 
124
                                   init_gnutls_session(),
 
125
                                   GNUTLS_* */
158
126
#include <gnutls/openpgp.h>
159
127
                         /* gnutls_certificate_set_openpgp_key_file(),
160
128
                            GNUTLS_OPENPGP_FMT_BASE64 */
161
 
#elif GNUTLS_VERSION_NUMBER >= 0x030606
162
 
#include <gnutls/x509.h>        /* GNUTLS_PKCS_PLAIN,
163
 
                                   GNUTLS_PKCS_NULL_PASSWORD */
164
 
#endif
165
129
 
166
130
/* GPGME */
167
131
#include <gpgme.h>              /* All GPGME types, constants and
168
132
                                   functions:
169
 
                                   gpgme_*, GPG_ERR_NO_*,
170
 
                                   GPGME_IMPORT_*
171
 
                                   GPGME_PROTOCOL_OpenPGP */
 
133
                                   gpgme_*
 
134
                                   GPGME_PROTOCOL_OpenPGP,
 
135
                                   GPG_ERR_NO_* */
172
136
 
173
137
#define BUFFER_SIZE 256
174
138
 
175
139
#define PATHDIR "/conf/conf.d/mandos"
176
140
#define SECKEY "seckey.txt"
177
141
#define PUBKEY "pubkey.txt"
178
 
#define TLS_PRIVKEY "tls-privkey.pem"
179
 
#define TLS_PUBKEY "tls-pubkey.pem"
180
142
#define HOOKDIR "/lib/mandos/network-hooks.d"
181
143
 
182
144
bool debug = false;
426
388
        fprintf_plus(stderr,
427
389
                     "Setting system clock to key file mtime");
428
390
      }
429
 
      if(clock_settime(CLOCK_REALTIME, &keystat.st_mtim) != 0){
430
 
        perror_plus("clock_settime");
 
391
      time_t keytime = keystat.st_mtim.tv_sec;
 
392
      if(stime(&keytime) != 0){
 
393
        perror_plus("stime");
431
394
      }
432
395
      ret = lower_privileges();
433
396
      if(ret != 0){
736
699
                              const char *dhparamsfilename,
737
700
                              mandos_context *mc){
738
701
  int ret;
 
702
  unsigned int uret;
739
703
  
740
704
  if(debug){
741
705
    fprintf_plus(stderr, "Initializing GnuTLS\n");
758
722
  }
759
723
  
760
724
  if(debug){
761
 
    fprintf_plus(stderr, "Attempting to use public key %s and"
762
 
                 " private key %s as GnuTLS credentials\n",
 
725
    fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
 
726
                 " secret key %s as GnuTLS credentials\n",
763
727
                 pubkeyfilename,
764
728
                 seckeyfilename);
765
729
  }
766
730
  
767
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
768
 
  ret = gnutls_certificate_set_rawpk_key_file
769
 
    (mc->cred, pubkeyfilename, seckeyfilename,
770
 
     GNUTLS_X509_FMT_PEM,       /* format */
771
 
     NULL,                      /* pass */
772
 
     /* key_usage */
773
 
     GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
774
 
     NULL,                      /* names */
775
 
     0,                         /* names_length */
776
 
     /* privkey_flags */
777
 
     GNUTLS_PKCS_PLAIN | GNUTLS_PKCS_NULL_PASSWORD,
778
 
     0);                        /* pkcs11_flags */
779
 
#elif GNUTLS_VERSION_NUMBER < 0x030600
780
731
  ret = gnutls_certificate_set_openpgp_key_file
781
732
    (mc->cred, pubkeyfilename, seckeyfilename,
782
733
     GNUTLS_OPENPGP_FMT_BASE64);
783
 
#else
784
 
#error "Needs GnuTLS 3.6.6 or later, or before 3.6.0"
785
 
#endif
786
734
  if(ret != GNUTLS_E_SUCCESS){
787
735
    fprintf_plus(stderr,
788
 
                 "Error[%d] while reading the key pair ('%s',"
 
736
                 "Error[%d] while reading the OpenPGP key pair ('%s',"
789
737
                 " '%s')\n", ret, pubkeyfilename, seckeyfilename);
790
738
    fprintf_plus(stderr, "The GnuTLS error is: %s\n",
791
739
                 safer_gnutls_strerror(ret));
862
810
  }
863
811
  if(dhparamsfilename == NULL){
864
812
    if(mc->dh_bits == 0){
865
 
#if GNUTLS_VERSION_NUMBER < 0x030600
866
813
      /* Find out the optimal number of DH bits */
867
814
      /* Try to read the private key file */
868
815
      gnutls_datum_t buffer = { .data = NULL, .size = 0 };
948
895
          }
949
896
        }
950
897
      }
951
 
      unsigned int uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
 
898
      uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
952
899
      if(uret != 0){
953
900
        mc->dh_bits = uret;
954
901
        if(debug){
966
913
                     safer_gnutls_strerror(ret));
967
914
        goto globalfail;
968
915
      }
969
 
#endif
970
 
    } else {                    /* dh_bits != 0 */
971
 
      if(debug){
972
 
        fprintf_plus(stderr, "DH bits explicitly set to %u\n",
973
 
                     mc->dh_bits);
974
 
      }
975
 
      ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
976
 
      if(ret != GNUTLS_E_SUCCESS){
977
 
        fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
978
 
                     " bits): %s\n", mc->dh_bits,
979
 
                     safer_gnutls_strerror(ret));
980
 
        goto globalfail;
981
 
      }
982
 
      gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
 
916
    } else if(debug){
 
917
      fprintf_plus(stderr, "DH bits explicitly set to %u\n",
 
918
                   mc->dh_bits);
 
919
    }
 
920
    ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
 
921
    if(ret != GNUTLS_E_SUCCESS){
 
922
      fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
 
923
                   " bits): %s\n", mc->dh_bits,
 
924
                   safer_gnutls_strerror(ret));
 
925
      goto globalfail;
983
926
    }
984
927
  }
 
928
  gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
985
929
  
986
930
  return 0;
987
931
  
998
942
  int ret;
999
943
  /* GnuTLS session creation */
1000
944
  do {
1001
 
    ret = gnutls_init(session, (GNUTLS_SERVER
1002
 
#if GNUTLS_VERSION_NUMBER >= 0x030506
1003
 
                                | GNUTLS_NO_TICKETS
1004
 
#endif
1005
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
1006
 
                                | GNUTLS_ENABLE_RAWPK
1007
 
#endif
1008
 
                                ));
 
945
    ret = gnutls_init(session, GNUTLS_SERVER);
1009
946
    if(quit_now){
1010
947
      return -1;
1011
948
    }
1103
1040
      ret = setgid(0);
1104
1041
      if(ret == -1){
1105
1042
        perror_plus("setgid");
1106
 
        close(devnull);
1107
1043
        _exit(EX_NOPERM);
1108
1044
      }
1109
1045
      /* Reset supplementary groups */
1111
1047
      ret = setgroups(0, NULL);
1112
1048
      if(ret == -1){
1113
1049
        perror_plus("setgroups");
1114
 
        close(devnull);
1115
1050
        _exit(EX_NOPERM);
1116
1051
      }
1117
1052
    }
1118
1053
    ret = dup2(devnull, STDIN_FILENO);
1119
1054
    if(ret == -1){
1120
1055
      perror_plus("dup2(devnull, STDIN_FILENO)");
1121
 
      close(devnull);
1122
1056
      _exit(EX_OSERR);
1123
1057
    }
1124
1058
    ret = close(devnull);
1125
1059
    if(ret == -1){
1126
1060
      perror_plus("close");
 
1061
      _exit(EX_OSERR);
1127
1062
    }
1128
1063
    ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1129
1064
    if(ret == -1){
1164
1099
  }
1165
1100
  if(pid == -1){
1166
1101
    perror_plus("fork");
1167
 
    close(devnull);
1168
1102
    return false;
1169
1103
  }
1170
 
  ret = close(devnull);
1171
 
  if(ret == -1){
1172
 
    perror_plus("close");
1173
 
  }
1174
1104
  int status;
1175
1105
  pid_t pret = -1;
1176
1106
  errno = 0;
2497
2427
 
2498
2428
int main(int argc, char *argv[]){
2499
2429
  mandos_context mc = { .server = NULL, .dh_bits = 0,
2500
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2501
 
                        .priority = "SECURE128:!CTYPE-X.509"
2502
 
                        ":+CTYPE-RAWPK:!RSA:!VERS-ALL:+VERS-TLS1.3"
2503
 
                        ":%PROFILE_ULTRA",
2504
 
#elif GNUTLS_VERSION_NUMBER < 0x030600
2505
2430
                        .priority = "SECURE256:!CTYPE-X.509"
2506
2431
                        ":+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256",
2507
 
#else
2508
 
#error "Needs GnuTLS 3.6.6 or later, or before 3.6.0"
2509
 
#endif
2510
2432
                        .current_server = NULL, .interfaces = NULL,
2511
2433
                        .interfaces_size = 0 };
2512
2434
  AvahiSServiceBrowser *sb = NULL;
2523
2445
  AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
2524
2446
  const char *seckey = PATHDIR "/" SECKEY;
2525
2447
  const char *pubkey = PATHDIR "/" PUBKEY;
2526
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2527
 
  const char *tls_privkey = PATHDIR "/" TLS_PRIVKEY;
2528
 
  const char *tls_pubkey = PATHDIR "/" TLS_PUBKEY;
2529
 
#endif
2530
2448
  const char *dh_params_file = NULL;
2531
2449
  char *interfaces_hooks = NULL;
2532
2450
  
2580
2498
      { .name = "pubkey", .key = 'p',
2581
2499
        .arg = "FILE",
2582
2500
        .doc = "OpenPGP public key file base name",
2583
 
        .group = 1 },
2584
 
      { .name = "tls-privkey", .key = 't',
2585
 
        .arg = "FILE",
2586
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2587
 
        .doc = "TLS private key file base name",
2588
 
#else
2589
 
        .doc = "Dummy; ignored (requires GnuTLS 3.6.6)",
2590
 
#endif
2591
 
        .group = 1 },
2592
 
      { .name = "tls-pubkey", .key = 'T',
2593
 
        .arg = "FILE",
2594
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2595
 
        .doc = "TLS public key file base name",
2596
 
#else
2597
 
        .doc = "Dummy; ignored (requires GnuTLS 3.6.6)",
2598
 
#endif
2599
 
        .group = 1 },
 
2501
        .group = 2 },
2600
2502
      { .name = "dh-bits", .key = 129,
2601
2503
        .arg = "BITS",
2602
2504
        .doc = "Bit length of the prime number used in the"
2658
2560
      case 'p':                 /* --pubkey */
2659
2561
        pubkey = arg;
2660
2562
        break;
2661
 
      case 't':                 /* --tls-privkey */
2662
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2663
 
        tls_privkey = arg;
2664
 
#endif
2665
 
        break;
2666
 
      case 'T':                 /* --tls-pubkey */
2667
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2668
 
        tls_pubkey = arg;
2669
 
#endif
2670
 
        break;
2671
2563
      case 129:                 /* --dh-bits */
2672
2564
        errno = 0;
2673
2565
        tmpmax = strtoimax(arg, &tmp, 10);
2708
2600
        argp_state_help(state, state->out_stream,
2709
2601
                        (ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
2710
2602
                        & ~(unsigned int)ARGP_HELP_EXIT_OK);
2711
 
        __builtin_unreachable();
2712
2603
      case -3:                  /* --usage */
2713
2604
        argp_state_help(state, state->out_stream,
2714
2605
                        ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
2715
 
        __builtin_unreachable();
2716
2606
      case 'V':                 /* --version */
2717
2607
        fprintf_plus(state->out_stream, "%s\n", argp_program_version);
2718
2608
        exit(argp_err_exit_status);
2745
2635
  }
2746
2636
  
2747
2637
  {
 
2638
    /* Work around Debian bug #633582:
 
2639
       <https://bugs.debian.org/633582> */
 
2640
    
2748
2641
    /* Re-raise privileges */
2749
2642
    ret = raise_privileges();
2750
2643
    if(ret != 0){
2753
2646
    } else {
2754
2647
      struct stat st;
2755
2648
      
2756
 
      /* Work around Debian bug #633582:
2757
 
         <https://bugs.debian.org/633582> */
2758
 
 
2759
2649
      if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2760
2650
        int seckey_fd = open(seckey, O_RDONLY);
2761
2651
        if(seckey_fd == -1){
2820
2710
        }
2821
2711
      }
2822
2712
      
2823
 
      /* Work around Debian bug #981302
2824
 
         <https://bugs.debian.org/981302> */
2825
 
      if(lstat("/dev/fd", &st) != 0 and errno == ENOENT){
2826
 
        ret = symlink("/proc/self/fd", "/dev/fd");
2827
 
        if(ret == -1){
2828
 
          perror_plus("Failed to create /dev/fd symlink");
2829
 
        }
2830
 
      }
2831
 
 
2832
2713
      /* Lower privileges */
2833
2714
      ret = lower_privileges();
2834
2715
      if(ret != 0){
3038
2919
    goto end;
3039
2920
  }
3040
2921
  
3041
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
3042
 
  ret = init_gnutls_global(tls_pubkey, tls_privkey, dh_params_file, &mc);
3043
 
#elif GNUTLS_VERSION_NUMBER < 0x030600
3044
2922
  ret = init_gnutls_global(pubkey, seckey, dh_params_file, &mc);
3045
 
#else
3046
 
#error "Needs GnuTLS 3.6.6 or later, or before 3.6.0"
3047
 
#endif
3048
2923
  if(ret == -1){
3049
2924
    fprintf_plus(stderr, "init_gnutls_global failed\n");
3050
2925
    exitcode = EX_UNAVAILABLE;