/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.c

  • Committer: Teddy Hogeborn
  • Date: 2018-08-15 09:26:02 UTC
  • Revision ID: teddy@recompile.se-20180815092602-xoyb5s6gf8376i7u
http://bugs.debian.org/894495
mandos-client: Set system clock if necessary

* plugins.d/mandos-client.c (init_gpgme/import_key): If the system
  clock is not set, or set to january 1970, set the system clock to
  the more plausible value that is the mtime of the key file.  This is
  required by GnuPG to be able to import the keys.  (We can't pass the
  --ignore-time-conflict or the --ignore-valid-from options though
  GPGME.)

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/mandos-client.c
9
9
 * "browse_callback", and parts of "main".
10
10
 * 
11
11
 * Everything else is
12
 
 * Copyright © 2008-2022 Teddy Hogeborn
13
 
 * Copyright © 2008-2022 Björn Påhlsson
 
12
 * Copyright © 2008-2018 Teddy Hogeborn
 
13
 * Copyright © 2008-2018 Björn Påhlsson
14
14
 * 
15
15
 * This file is part of Mandos.
16
16
 * 
38
38
#define _FILE_OFFSET_BITS 64
39
39
#endif  /* not _FILE_OFFSET_BITS */
40
40
 
41
 
#define _GNU_SOURCE             /* program_invocation_short_name,
42
 
                                   TEMP_FAILURE_RETRY(), O_CLOEXEC,
43
 
                                   scandirat(), asprintf() */
 
41
#define _GNU_SOURCE             /* TEMP_FAILURE_RETRY(), asprintf() */
 
42
 
 
43
#include <stdio.h>              /* fprintf(), stderr, fwrite(),
 
44
                                   stdout, ferror() */
 
45
#include <stdint.h>             /* uint16_t, uint32_t, intptr_t */
 
46
#include <stddef.h>             /* NULL, size_t, ssize_t */
 
47
#include <stdlib.h>             /* free(), EXIT_SUCCESS, srand(),
 
48
                                   strtof(), abort() */
44
49
#include <stdbool.h>            /* bool, false, true */
45
 
#include <argp.h>               /* argp_program_version,
46
 
                                   argp_program_bug_address,
47
 
                                   struct argp_option,
48
 
                                   struct argp_state, argp_error(),
49
 
                                   argp_state_help,
50
 
                                   ARGP_HELP_STD_HELP,
51
 
                                   ARGP_HELP_EXIT_ERR,
52
 
                                   ARGP_HELP_EXIT_OK, ARGP_HELP_USAGE,
53
 
                                   argp_err_exit_status,
54
 
                                   ARGP_ERR_UNKNOWN, struct argp,
55
 
                                   argp_parse(), ARGP_IN_ORDER,
56
 
                                   ARGP_NO_HELP */
57
 
#include <stddef.h>             /* NULL, size_t */
58
 
#include <sys/types.h>          /* uid_t, gid_t, sig_atomic_t,
59
 
                                   seteuid(), setuid(), pid_t,
60
 
                                   setgid(), getuid(), getgid() */
61
 
#include <unistd.h>             /* uid_t, gid_t, TEMP_FAILURE_RETRY(),
62
 
                                   seteuid(), setuid(), close(),
63
 
                                   ssize_t, read(), fork(), setgid(),
64
 
                                   _exit(), dup2(), STDIN_FILENO,
65
 
                                   STDERR_FILENO, STDOUT_FILENO,
66
 
                                   fexecve(), write(), getuid(),
67
 
                                   getgid(), fchown(), symlink(),
68
 
                                   sleep(), unlinkat(), pause() */
69
 
#include <netinet/in.h>         /* in_port_t, struct sockaddr_in6,
70
 
                                   sa_family_t, struct sockaddr_in,
71
 
                                   htons(), IN6_IS_ADDR_LINKLOCAL,
72
 
                                   INET_ADDRSTRLEN, INET6_ADDRSTRLEN,
73
 
                                   ntohl(), IPPROTO_IP */
74
 
#include <time.h>               /* struct timespec, clock_gettime(),
75
 
                                   CLOCK_MONOTONIC, time_t, struct tm,
76
 
                                   gmtime_r(), clock_settime(),
77
 
                                   CLOCK_REALTIME, nanosleep() */
78
 
#include <errno.h>              /* errno,
79
 
                                   program_invocation_short_name,
80
 
                                   EINTR, EINVAL, ENETUNREACH,
 
50
#include <string.h>             /* strcmp(), strlen(), strerror(),
 
51
                                   asprintf(), strncpy(), strsignal()
 
52
                                */
 
53
#include <sys/ioctl.h>          /* ioctl */
 
54
#include <sys/types.h>          /* socket(), inet_pton(), sockaddr,
 
55
                                   sockaddr_in6, PF_INET6,
 
56
                                   SOCK_STREAM, uid_t, gid_t, open(),
 
57
                                   opendir(), DIR */
 
58
#include <sys/stat.h>           /* open(), S_ISREG */
 
59
#include <sys/socket.h>         /* socket(), struct sockaddr_in6,
 
60
                                   inet_pton(), connect(),
 
61
                                   getnameinfo() */
 
62
#include <fcntl.h>              /* open(), unlinkat(), AT_REMOVEDIR */
 
63
#include <dirent.h>             /* opendir(), struct dirent, readdir()
 
64
                                 */
 
65
#include <inttypes.h>           /* PRIu16, PRIdMAX, intmax_t,
 
66
                                   strtoimax() */
 
67
#include <errno.h>              /* perror(), errno, EINTR, EINVAL,
 
68
                                   EAI_SYSTEM, ENETUNREACH,
81
69
                                   EHOSTUNREACH, ECONNREFUSED, EPROTO,
82
 
                                   EIO, ENOENT, ENXIO, error_t,
83
 
                                   ENOMEM, EISDIR, ENOTEMPTY */
84
 
#include <stdio.h>              /* fprintf(), stderr, perror(), FILE,
85
 
                                   vfprintf(), off_t, SEEK_SET,
86
 
                                   stdout, fwrite(), ferror(),
87
 
                                   fflush(), asprintf() */
88
 
#include <stdarg.h>             /* va_list, va_start(), vfprintf() */
89
 
#include <stdlib.h>             /* realloc(), free(), malloc(),
90
 
                                   getenv(), EXIT_FAILURE, setenv(),
91
 
                                   EXIT_SUCCESS, strtof(), strtod(),
92
 
                                   srand(), mkdtemp(), abort() */
93
 
#include <string.h>             /* strdup(), strcmp(), strlen(),
94
 
                                   strerror(), strncpy(), strspn(),
95
 
                                   memcpy(), strrchr(), strchr(),
96
 
                                   strsignal() */
97
 
#include <fcntl.h>              /* open(), O_RDONLY, O_DIRECTORY,
98
 
                                   O_PATH, O_CLOEXEC, openat(),
99
 
                                   O_NOFOLLOW, AT_REMOVEDIR */
100
 
#include <iso646.h>             /* or, and, not */
101
 
#include <sys/stat.h>           /* struct stat, fstat(), fstatat(),
102
 
                                   S_ISREG(), S_IXUSR, S_IXGRP,
103
 
                                   S_IXOTH, lstat() */
104
 
#include <net/if.h>             /* IF_NAMESIZE, if_indextoname(),
105
 
                                   if_nametoindex(), SIOCGIFFLAGS,
106
 
                                   IFF_LOOPBACK, IFF_POINTOPOINT,
107
 
                                   IFF_BROADCAST, IFF_NOARP, IFF_UP,
108
 
                                   IFF_RUNNING, SIOCSIFFLAGS */
109
 
#include <sysexits.h>           /* EX_NOPERM, EX_OSERR,
110
 
                                   EX_UNAVAILABLE, EX_USAGE */
 
70
                                   EIO, ENOENT, ENXIO, ENOMEM, EISDIR,
 
71
                                   ENOTEMPTY,
 
72
                                   program_invocation_short_name */
 
73
#include <time.h>               /* nanosleep(), time(), sleep() */
 
74
#include <net/if.h>             /* ioctl, ifreq, SIOCGIFFLAGS, IFF_UP,
 
75
                                   SIOCSIFFLAGS, if_indextoname(),
 
76
                                   if_nametoindex(), IF_NAMESIZE */
 
77
#include <netinet/in.h>         /* IN6_IS_ADDR_LINKLOCAL,
 
78
                                   INET_ADDRSTRLEN, INET6_ADDRSTRLEN
 
79
                                */
 
80
#include <unistd.h>             /* close(), SEEK_SET, off_t, write(),
 
81
                                   getuid(), getgid(), seteuid(),
 
82
                                   setgid(), pause(), _exit(),
 
83
                                   unlinkat() */
 
84
#include <arpa/inet.h>          /* inet_pton(), htons() */
 
85
#include <iso646.h>             /* not, or, and */
 
86
#include <argp.h>               /* struct argp_option, error_t, struct
 
87
                                   argp_state, struct argp,
 
88
                                   argp_parse(), ARGP_KEY_ARG,
 
89
                                   ARGP_KEY_END, ARGP_ERR_UNKNOWN */
 
90
#include <signal.h>             /* sigemptyset(), sigaddset(),
 
91
                                   sigaction(), SIGTERM, sig_atomic_t,
 
92
                                   raise() */
 
93
#include <sysexits.h>           /* EX_OSERR, EX_USAGE, EX_UNAVAILABLE,
 
94
                                   EX_NOHOST, EX_IOERR, EX_PROTOCOL */
 
95
#include <sys/wait.h>           /* waitpid(), WIFEXITED(),
 
96
                                   WEXITSTATUS(), WTERMSIG() */
111
97
#include <grp.h>                /* setgroups() */
112
 
#include <sys/wait.h>           /* waitpid(), WIFEXITED(),
113
 
                                   WEXITSTATUS(), WIFSIGNALED(),
114
 
                                   WTERMSIG() */
115
 
#include <signal.h>             /* kill(), SIGTERM, struct sigaction,
116
 
                                   SIG_DFL, sigemptyset(),
117
 
                                   sigaddset(), SIGINT, SIGHUP,
118
 
                                   SIG_IGN, raise() */
119
 
#include <sys/socket.h>         /* struct sockaddr_storage, AF_INET6,
120
 
                                   PF_INET6, AF_INET, PF_INET,
121
 
                                   socket(), SOCK_STREAM,
122
 
                                   SOCK_CLOEXEC, struct sockaddr,
123
 
                                   connect(), SOCK_DGRAM */
124
 
#include <argz.h>               /* argz_next(), argz_add_sep(),
125
 
                                   argz_delete(), argz_stringify(),
126
 
                                   argz_add(), argz_count() */
127
 
#include <inttypes.h>           /* PRIuMAX, uintmax_t, uint32_t,
128
 
                                   PRIdMAX, PRIu16, intmax_t,
129
 
                                   strtoimax() */
130
 
#include <arpa/inet.h>          /* inet_pton() */
131
 
#include <stdint.h>             /* uint32_t, intptr_t, uint16_t */
 
98
#include <argz.h>               /* argz_add_sep(), argz_next(),
 
99
                                   argz_delete(), argz_append(),
 
100
                                   argz_stringify(), argz_add(),
 
101
                                   argz_count() */
132
102
#include <netdb.h>              /* getnameinfo(), NI_NUMERICHOST,
133
103
                                   EAI_SYSTEM, gai_strerror() */
134
 
#include <sys/ioctl.h>          /* ioctl() */
135
 
#include <dirent.h>             /* struct dirent, scandirat(),
136
 
                                   alphasort(), scandir() */
137
 
#include <limits.h>             /* INT_MAX */
138
104
 
139
105
#ifdef __linux__
140
106
#include <sys/klog.h>           /* klogctl() */
153
119
 
154
120
/* GnuTLS */
155
121
#include <gnutls/gnutls.h>      /* All GnuTLS types, constants and
156
 
                                   functions: gnutls_*, GNUTLS_* */
157
 
#if GNUTLS_VERSION_NUMBER < 0x030600
 
122
                                   functions:
 
123
                                   gnutls_*
 
124
                                   init_gnutls_session(),
 
125
                                   GNUTLS_* */
158
126
#include <gnutls/openpgp.h>
159
127
                         /* gnutls_certificate_set_openpgp_key_file(),
160
128
                            GNUTLS_OPENPGP_FMT_BASE64 */
161
 
#elif GNUTLS_VERSION_NUMBER >= 0x030606
162
 
#include <gnutls/x509.h>        /* GNUTLS_PKCS_PLAIN,
163
 
                                   GNUTLS_PKCS_NULL_PASSWORD */
164
 
#endif
165
129
 
166
130
/* GPGME */
167
131
#include <gpgme.h>              /* All GPGME types, constants and
168
132
                                   functions:
169
 
                                   gpgme_*, GPG_ERR_NO_*,
170
 
                                   GPGME_IMPORT_*
171
 
                                   GPGME_PROTOCOL_OpenPGP */
 
133
                                   gpgme_*
 
134
                                   GPGME_PROTOCOL_OpenPGP,
 
135
                                   GPG_ERR_NO_* */
172
136
 
173
137
#define BUFFER_SIZE 256
174
138
 
175
139
#define PATHDIR "/conf/conf.d/mandos"
176
140
#define SECKEY "seckey.txt"
177
141
#define PUBKEY "pubkey.txt"
178
 
#define TLS_PRIVKEY "tls-privkey.pem"
179
 
#define TLS_PUBKEY "tls-pubkey.pem"
180
142
#define HOOKDIR "/lib/mandos/network-hooks.d"
181
143
 
182
144
bool debug = false;
426
388
        fprintf_plus(stderr,
427
389
                     "Setting system clock to key file mtime");
428
390
      }
429
 
      if(clock_settime(CLOCK_REALTIME, &keystat.st_mtim) != 0){
430
 
        perror_plus("clock_settime");
 
391
      time_t keytime = keystat.st_mtim.tv_sec;
 
392
      if(stime(&keytime) != 0){
 
393
        perror_plus("stime");
431
394
      }
432
395
      ret = lower_privileges();
433
396
      if(ret != 0){
736
699
                              const char *dhparamsfilename,
737
700
                              mandos_context *mc){
738
701
  int ret;
 
702
  unsigned int uret;
739
703
  
740
704
  if(debug){
741
705
    fprintf_plus(stderr, "Initializing GnuTLS\n");
758
722
  }
759
723
  
760
724
  if(debug){
761
 
    fprintf_plus(stderr, "Attempting to use public key %s and"
762
 
                 " private key %s as GnuTLS credentials\n",
 
725
    fprintf_plus(stderr, "Attempting to use OpenPGP public key %s and"
 
726
                 " secret key %s as GnuTLS credentials\n",
763
727
                 pubkeyfilename,
764
728
                 seckeyfilename);
765
729
  }
766
730
  
767
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
768
 
  ret = gnutls_certificate_set_rawpk_key_file
769
 
    (mc->cred, pubkeyfilename, seckeyfilename,
770
 
     GNUTLS_X509_FMT_PEM,       /* format */
771
 
     NULL,                      /* pass */
772
 
     /* key_usage */
773
 
     GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
774
 
     NULL,                      /* names */
775
 
     0,                         /* names_length */
776
 
     /* privkey_flags */
777
 
     GNUTLS_PKCS_PLAIN | GNUTLS_PKCS_NULL_PASSWORD,
778
 
     0);                        /* pkcs11_flags */
779
 
#elif GNUTLS_VERSION_NUMBER < 0x030600
780
731
  ret = gnutls_certificate_set_openpgp_key_file
781
732
    (mc->cred, pubkeyfilename, seckeyfilename,
782
733
     GNUTLS_OPENPGP_FMT_BASE64);
783
 
#else
784
 
#error "Needs GnuTLS 3.6.6 or later, or before 3.6.0"
785
 
#endif
786
734
  if(ret != GNUTLS_E_SUCCESS){
787
735
    fprintf_plus(stderr,
788
 
                 "Error[%d] while reading the key pair ('%s',"
 
736
                 "Error[%d] while reading the OpenPGP key pair ('%s',"
789
737
                 " '%s')\n", ret, pubkeyfilename, seckeyfilename);
790
738
    fprintf_plus(stderr, "The GnuTLS error is: %s\n",
791
739
                 safer_gnutls_strerror(ret));
862
810
  }
863
811
  if(dhparamsfilename == NULL){
864
812
    if(mc->dh_bits == 0){
865
 
#if GNUTLS_VERSION_NUMBER < 0x030600
866
813
      /* Find out the optimal number of DH bits */
867
814
      /* Try to read the private key file */
868
815
      gnutls_datum_t buffer = { .data = NULL, .size = 0 };
948
895
          }
949
896
        }
950
897
      }
951
 
      unsigned int uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
 
898
      uret = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, sec_param);
952
899
      if(uret != 0){
953
900
        mc->dh_bits = uret;
954
901
        if(debug){
966
913
                     safer_gnutls_strerror(ret));
967
914
        goto globalfail;
968
915
      }
969
 
#endif
970
 
    } else {                    /* dh_bits != 0 */
971
 
      if(debug){
972
 
        fprintf_plus(stderr, "DH bits explicitly set to %u\n",
973
 
                     mc->dh_bits);
974
 
      }
975
 
      ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
976
 
      if(ret != GNUTLS_E_SUCCESS){
977
 
        fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
978
 
                     " bits): %s\n", mc->dh_bits,
979
 
                     safer_gnutls_strerror(ret));
980
 
        goto globalfail;
981
 
      }
982
 
      gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
 
916
    } else if(debug){
 
917
      fprintf_plus(stderr, "DH bits explicitly set to %u\n",
 
918
                   mc->dh_bits);
 
919
    }
 
920
    ret = gnutls_dh_params_generate2(mc->dh_params, mc->dh_bits);
 
921
    if(ret != GNUTLS_E_SUCCESS){
 
922
      fprintf_plus(stderr, "Error in GnuTLS prime generation (%u"
 
923
                   " bits): %s\n", mc->dh_bits,
 
924
                   safer_gnutls_strerror(ret));
 
925
      goto globalfail;
983
926
    }
984
927
  }
 
928
  gnutls_certificate_set_dh_params(mc->cred, mc->dh_params);
985
929
  
986
930
  return 0;
987
931
  
998
942
  int ret;
999
943
  /* GnuTLS session creation */
1000
944
  do {
1001
 
    ret = gnutls_init(session, (GNUTLS_SERVER
1002
 
#if GNUTLS_VERSION_NUMBER >= 0x030506
1003
 
                                | GNUTLS_NO_TICKETS
1004
 
#endif
1005
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
1006
 
                                | GNUTLS_ENABLE_RAWPK
1007
 
#endif
1008
 
                                ));
 
945
    ret = gnutls_init(session, GNUTLS_SERVER);
1009
946
    if(quit_now){
1010
947
      return -1;
1011
948
    }
1103
1040
      ret = setgid(0);
1104
1041
      if(ret == -1){
1105
1042
        perror_plus("setgid");
1106
 
        close(devnull);
1107
1043
        _exit(EX_NOPERM);
1108
1044
      }
1109
1045
      /* Reset supplementary groups */
1111
1047
      ret = setgroups(0, NULL);
1112
1048
      if(ret == -1){
1113
1049
        perror_plus("setgroups");
1114
 
        close(devnull);
1115
1050
        _exit(EX_NOPERM);
1116
1051
      }
1117
1052
    }
1118
1053
    ret = dup2(devnull, STDIN_FILENO);
1119
1054
    if(ret == -1){
1120
1055
      perror_plus("dup2(devnull, STDIN_FILENO)");
1121
 
      close(devnull);
1122
1056
      _exit(EX_OSERR);
1123
1057
    }
1124
1058
    ret = close(devnull);
1125
1059
    if(ret == -1){
1126
1060
      perror_plus("close");
 
1061
      _exit(EX_OSERR);
1127
1062
    }
1128
1063
    ret = dup2(STDERR_FILENO, STDOUT_FILENO);
1129
1064
    if(ret == -1){
1164
1099
  }
1165
1100
  if(pid == -1){
1166
1101
    perror_plus("fork");
1167
 
    close(devnull);
1168
1102
    return false;
1169
1103
  }
1170
 
  ret = close(devnull);
1171
 
  if(ret == -1){
1172
 
    perror_plus("close");
1173
 
  }
1174
1104
  int status;
1175
1105
  pid_t pret = -1;
1176
1106
  errno = 0;
2497
2427
 
2498
2428
int main(int argc, char *argv[]){
2499
2429
  mandos_context mc = { .server = NULL, .dh_bits = 0,
2500
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2501
 
                        .priority = "SECURE128:!CTYPE-X.509"
2502
 
                        ":+CTYPE-RAWPK:!RSA:!VERS-ALL:+VERS-TLS1.3"
2503
 
                        ":%PROFILE_ULTRA",
2504
 
#elif GNUTLS_VERSION_NUMBER < 0x030600
2505
2430
                        .priority = "SECURE256:!CTYPE-X.509"
2506
2431
                        ":+CTYPE-OPENPGP:!RSA:+SIGN-DSA-SHA256",
2507
 
#else
2508
 
#error "Needs GnuTLS 3.6.6 or later, or before 3.6.0"
2509
 
#endif
2510
2432
                        .current_server = NULL, .interfaces = NULL,
2511
2433
                        .interfaces_size = 0 };
2512
2434
  AvahiSServiceBrowser *sb = NULL;
2523
2445
  AvahiIfIndex if_index = AVAHI_IF_UNSPEC;
2524
2446
  const char *seckey = PATHDIR "/" SECKEY;
2525
2447
  const char *pubkey = PATHDIR "/" PUBKEY;
2526
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2527
 
  const char *tls_privkey = PATHDIR "/" TLS_PRIVKEY;
2528
 
  const char *tls_pubkey = PATHDIR "/" TLS_PUBKEY;
2529
 
#endif
2530
2448
  const char *dh_params_file = NULL;
2531
2449
  char *interfaces_hooks = NULL;
2532
2450
  
2580
2498
      { .name = "pubkey", .key = 'p',
2581
2499
        .arg = "FILE",
2582
2500
        .doc = "OpenPGP public key file base name",
2583
 
        .group = 1 },
2584
 
      { .name = "tls-privkey", .key = 't',
2585
 
        .arg = "FILE",
2586
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2587
 
        .doc = "TLS private key file base name",
2588
 
#else
2589
 
        .doc = "Dummy; ignored (requires GnuTLS 3.6.6)",
2590
 
#endif
2591
 
        .group = 1 },
2592
 
      { .name = "tls-pubkey", .key = 'T',
2593
 
        .arg = "FILE",
2594
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2595
 
        .doc = "TLS public key file base name",
2596
 
#else
2597
 
        .doc = "Dummy; ignored (requires GnuTLS 3.6.6)",
2598
 
#endif
2599
 
        .group = 1 },
 
2501
        .group = 2 },
2600
2502
      { .name = "dh-bits", .key = 129,
2601
2503
        .arg = "BITS",
2602
2504
        .doc = "Bit length of the prime number used in the"
2658
2560
      case 'p':                 /* --pubkey */
2659
2561
        pubkey = arg;
2660
2562
        break;
2661
 
      case 't':                 /* --tls-privkey */
2662
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2663
 
        tls_privkey = arg;
2664
 
#endif
2665
 
        break;
2666
 
      case 'T':                 /* --tls-pubkey */
2667
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
2668
 
        tls_pubkey = arg;
2669
 
#endif
2670
 
        break;
2671
2563
      case 129:                 /* --dh-bits */
2672
2564
        errno = 0;
2673
2565
        tmpmax = strtoimax(arg, &tmp, 10);
2708
2600
        argp_state_help(state, state->out_stream,
2709
2601
                        (ARGP_HELP_STD_HELP | ARGP_HELP_EXIT_ERR)
2710
2602
                        & ~(unsigned int)ARGP_HELP_EXIT_OK);
2711
 
        __builtin_unreachable();
2712
2603
      case -3:                  /* --usage */
2713
2604
        argp_state_help(state, state->out_stream,
2714
2605
                        ARGP_HELP_USAGE | ARGP_HELP_EXIT_ERR);
2715
 
        __builtin_unreachable();
2716
2606
      case 'V':                 /* --version */
2717
2607
        fprintf_plus(state->out_stream, "%s\n", argp_program_version);
2718
2608
        exit(argp_err_exit_status);
2745
2635
  }
2746
2636
  
2747
2637
  {
 
2638
    /* Work around Debian bug #633582:
 
2639
       <https://bugs.debian.org/633582> */
 
2640
    
2748
2641
    /* Re-raise privileges */
2749
2642
    ret = raise_privileges();
2750
2643
    if(ret != 0){
2753
2646
    } else {
2754
2647
      struct stat st;
2755
2648
      
2756
 
      /* Work around Debian bug #633582:
2757
 
         <https://bugs.debian.org/633582> */
2758
 
 
2759
2649
      if(strcmp(seckey, PATHDIR "/" SECKEY) == 0){
2760
2650
        int seckey_fd = open(seckey, O_RDONLY);
2761
2651
        if(seckey_fd == -1){
2820
2710
        }
2821
2711
      }
2822
2712
      
2823
 
      /* Work around Debian bug #981302
2824
 
         <https://bugs.debian.org/981302> */
2825
 
      if(lstat("/dev/fd", &st) != 0 and errno == ENOENT){
2826
 
        ret = symlink("/proc/self/fd", "/dev/fd");
2827
 
        if(ret == -1){
2828
 
          perror_plus("Failed to create /dev/fd symlink");
2829
 
        }
2830
 
      }
2831
 
 
2832
2713
      /* Lower privileges */
2833
2714
      ret = lower_privileges();
2834
2715
      if(ret != 0){
3038
2919
    goto end;
3039
2920
  }
3040
2921
  
3041
 
#if GNUTLS_VERSION_NUMBER >= 0x030606
3042
 
  ret = init_gnutls_global(tls_pubkey, tls_privkey, dh_params_file, &mc);
3043
 
#elif GNUTLS_VERSION_NUMBER < 0x030600
3044
2922
  ret = init_gnutls_global(pubkey, seckey, dh_params_file, &mc);
3045
 
#else
3046
 
#error "Needs GnuTLS 3.6.6 or later, or before 3.6.0"
3047
 
#endif
3048
2923
  if(ret == -1){
3049
2924
    fprintf_plus(stderr, "init_gnutls_global failed\n");
3050
2925
    exitcode = EX_UNAVAILABLE;