src/pwmd.c

   1 /* vim:tw=78:ts=8:sw=4:set ft=c:  */
   2 /*
   3     Copyright (C) 2006-2007 Ben Kibbey <bjk@luxsci.net>
   4
   5     This program is free software; you can redistribute it and/or modify
   6     it under the terms of the GNU General Public License as published by
   7     the Free Software Foundation; either version 2 of the License, or
   8     (at your option) any later version.
   9
  10     This program is distributed in the hope that it will be useful,
  11     but WITHOUT ANY WARRANTY; without even the implied warranty of
  12     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13     GNU General Public License for more details.
  14
  15     You should have received a copy of the GNU General Public License
  16     along with this program; if not, write to the Free Software
  17     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  18 */
  19 #ifdef HAVE_CONFIG_H
  20 #include <config.h>
  21 #endif
  22
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <unistd.h>
  26 #include <err.h>
  27 #include <errno.h>
  28 #include <ctype.h>
  29 #include <string.h>
  30 #include <sys/un.h>
  31 #include <signal.h>
  32 #include <stdarg.h>
  33 #include <string.h>
  34 #include <sys/wait.h>
  35 #include <fcntl.h>
  36 #include <pwd.h>
  37 #include <glib.h>
  38 #include <glib/gprintf.h>
  39 #include <gcrypt.h>
  40 #include <sys/mman.h>
  41 #include <termios.h>
  42 #include <assert.h>
  43 #include <syslog.h>
  44
  45 #ifdef HAVE_SETRLIMIT
  46 #include <sys/time.h>
  47 #include <sys/resource.h>
  48 #endif
  49
  50 #ifdef HAVE_ZLIB_H
  51 #include <zlib.h>
  52 #endif
  53
  54 #ifndef MEM_DEBUG
  55 #include "mem.h"
  56 #endif
  57
  58 #include "xml.h"
  59 #include "common.h"
  60 #include "commands.h"
  61 #include "pwmd_error.h"
  62 #include "cache.h"
  63 #include "pwmd.h"
  64
  65 static void clear_rcfile_key()
  66 {
  67     gsize n;
  68     gchar **groups;
  69     gchar **p;
  70
  71     groups = g_key_file_get_groups(keyfileh, &n);
  72
  73     for (p = groups; *p; p++) {
  74         GError *error = NULL;
  75
  76         if (g_key_file_has_key(keyfileh, *p, "key", &error) == TRUE)
  77              g_key_file_set_string(keyfileh, *p, "key", "");
  78     }
  79
  80     g_strfreev(groups);
  81 }
  82
  83 static void reload_rcfile()
  84 {
  85     log_write(N_("reloading configuration file '%s'"), rcfile);
  86     g_key_file_free(keyfileh);
  87     keyfileh = parse_rcfile(0);
  88     clear_rcfile_key();
  89 }
  90
  91 gpg_error_t send_syserror(assuan_context_t ctx, gint e)
  92 {
  93     gpg_error_t n = gpg_error_from_errno(e);
  94
  95     return assuan_process_done(ctx, assuan_set_error(ctx, n, gpg_strerror(n)));
  96 }
  97
  98 gpg_error_t send_error(assuan_context_t ctx, gpg_error_t e)
  99 {
 100     gpg_err_code_t n = gpg_err_code(e);
 101     gpg_error_t code = gpg_err_make(GPG_ERR_SOURCE_USER_1, n);
 102
 103     if (!e)
 104         return assuan_process_done(ctx, 0);
 105
 106     if (!ctx) {
 107         log_write("%s\n", pwmd_strerror(e));
 108         return e;
 109     }
 110
 111     if (n == EPWMD_LIBXML_ERROR) {
 112         xmlErrorPtr xml_error = xmlGetLastError();
 113         return assuan_process_done(ctx, assuan_set_error(ctx, code, xml_error->message));
 114     }
 115
 116     return assuan_process_done(ctx, assuan_set_error(ctx, code, pwmd_strerror(e)));
 117 }
 118
 119 void log_write(const gchar *fmt, ...)
 120 {
 121     gchar *args, *line;
 122     va_list ap;
 123     struct tm *tm;
 124     time_t now;
 125     gchar tbuf[21];
 126     gint fd = -1;
 127
 128     if ((!logfile && !isatty(STDERR_FILENO) && log_syslog == FALSE) || !fmt)
 129         return;
 130
 131     if (logfile) {
 132         if ((fd = open(logfile, O_WRONLY|O_CREAT|O_APPEND, 0600)) == -1) {
 133             warn(N_("logfile"));
 134             return;
 135         }
 136     }
 137
 138     va_start(ap, fmt);
 139
 140     if (g_vasprintf(&args, fmt, ap) == -1) {
 141         va_end(ap);
 142         return;
 143     }
 144
 145     if (log_syslog == TRUE)
 146         syslog(LOG_INFO, "%s", args);
 147
 148     va_end(ap);
 149     time(&now);
 150     tm = localtime(&now);
 151     strftime(tbuf, sizeof(tbuf), "%b %d %Y %H:%M:%S ", tm);
 152     tbuf[sizeof(tbuf) - 1] = 0;
 153     line = g_strdup_printf("%s %i %s\n", tbuf, getpid(), args);
 154
 155     if (!line) {
 156         if (logfile)
 157             close(fd);
 158
 159         g_free(args);
 160         return;
 161     }
 162
 163     if (logfile) {
 164         write(fd, line, strlen(line));
 165         fsync(fd);
 166         close(fd);
 167     }
 168
 169     if (isatty(STDERR_FILENO)) {
 170         fprintf(stderr, "%s", line);
 171         fflush(stderr);
 172     }
 173
 174     g_free(line);
 175     g_free(args);
 176 }
 177
 178 static void usage(gchar *pn)
 179 {
 180     g_printf(N_(
 181             "Usage: %s [-hvDb] [-f <rcfile>] [-I <filename>] [file1] [...]\n"
 182             "    -b  run as a background process\n"
 183             "    -f  load the specified rcfile (~/.pwmd/config)\n"
 184             "    -I  import an XML file and write the encrypted data to stdout\n"
 185             "    -D  disable use of the LIST and DUMP commands\n"
 186             "    -v  version\n"
 187             "    -h  this help text\n"
 188             ), pn);
 189     exit(EXIT_SUCCESS);
 190 }
 191
 192 #ifndef MEM_DEBUG
 193 static int gcry_SecureCheck(const void *ptr)
 194 {
 195     return 1;
 196 }
 197 #endif
 198
 199 static void setup_gcrypt()
 200 {
 201     gcry_check_version(NULL);
 202
 203 #ifndef MEM_DEBUG
 204     gcry_set_allocation_handler(xmalloc, xmalloc, gcry_SecureCheck, xrealloc,
 205             xfree);
 206 #endif
 207
 208     if (gcry_cipher_algo_info(GCRY_CIPHER_AES256, GCRYCTL_TEST_ALGO, NULL,
 209                 NULL) != 0)
 210         errx(EXIT_FAILURE, N_("Required AES cipher not supported by libgcrypt."));
 211
 212     gcry_cipher_algo_info(GCRY_CIPHER_AES256, GCRYCTL_GET_KEYLEN, NULL, &gcrykeysize);
 213     gcry_cipher_algo_info(GCRY_CIPHER_AES256, GCRYCTL_GET_BLKLEN, NULL, &gcryblocksize);
 214 }
 215
 216 static assuan_context_t new_connection(gint fd)
 217 {
 218     gpg_error_t rc;
 219     gchar ver[ASSUAN_LINELENGTH];
 220     assuan_context_t ctx;
 221
 222     rc = assuan_init_socket_server_ext(&ctx, fd, 2);
 223
 224     if (rc)
 225         goto fail;
 226
 227     g_snprintf(ver, sizeof(ver), "%s", PACKAGE_STRING);
 228     assuan_set_hello_line(ctx, ver);
 229     assuan_register_post_cmd_notify(ctx, command_finalize);
 230     rc = register_commands(ctx);
 231
 232     if (rc)
 233         goto fail;
 234
 235     rc = assuan_accept(ctx);
 236
 237     if (rc)
 238         goto fail;
 239
 240     return ctx;
 241
 242 fail:
 243     assuan_deinit_server(ctx);
 244     log_write("%s", gpg_strerror(rc));
 245     return NULL;
 246 }
 247
 248 void send_cache_status_all()
 249 {
 250     guint i, t;
 251
 252     for (t = g_slist_length(cn_thread_list), i = 0; i < t; i++) {
 253         struct client_thread_s *cn = g_slist_nth_data(cn_thread_list, i);
 254
 255         if (cn->tid == pth_self()) {
 256             send_cache_status(cn->cl->ctx);
 257             continue;
 258         }
 259
 260         pth_raise(cn->tid, SIGUSR2);
 261     }
 262 }
 263
 264 static void *keepalive_thread(void *arg)
 265 {
 266     struct client_thread_s *thd = arg;
 267     pth_event_t ev;
 268     sigset_t set;
 269
 270     sigemptyset(&set);
 271     sigaddset(&set, SIGALRM);
 272
 273     for (;;) {
 274         gint sig = 0;
 275         gpg_error_t error;
 276         gint k = get_key_file_integer("default", "keepalive");
 277
 278         ev = pth_event(PTH_EVENT_TIME, pth_timeout(k <= 0 ? 1 : k, 0));
 279         pth_sigwait_ev(&set, &sig, ev);
 280         pth_event_free(ev, PTH_FREE_THIS);
 281
 282         if (sig)
 283             break;
 284
 285         if (k <= 0)
 286             continue;
 287
 288         error = assuan_write_status(thd->cl->ctx, "KEEPALIVE", NULL);
 289
 290         if (error) {
 291             pth_raise(thd->tid, SIGQUIT);
 292             break;
 293         }
 294     }
 295
 296     return NULL;
 297 }
 298
 299 /*
 300  * Called every time a connection is made via pth_spawn(). This is the thread
 301  * entry point.
 302  */
 303 static void *client_thread(void *data)
 304 {
 305     struct client_thread_s *thd = data;
 306     gint fd = thd->fd;
 307     pth_event_t ev;
 308     struct client_s *cl = g_malloc0(sizeof(struct client_s));
 309     sigset_t set;
 310
 311     if (!cl) {
 312         log_write("%s(%i): %s", __FILE__, __LINE__, strerror(ENOMEM));
 313         goto fail;
 314     }
 315
 316     thd->cl = cl;
 317
 318     /*
 319      * This is a "child" thread. Don't catch any signals. Let the master
 320      * thread take care of signals in server_loop().
 321      */
 322     sigfillset(&set);
 323     pth_sigmask(SIG_BLOCK, &set, NULL);
 324     sigemptyset(&set);
 325     /* Sends a cache status message to the client. */
 326     sigaddset(&set, SIGUSR2);
 327     /* Terminates this thread. Raised from keepalive_thread(). */
 328     sigaddset(&set, SIGQUIT);
 329
 330     cl->ctx = new_connection(fd);
 331     cl->fd = fd;
 332
 333     if (!cl->ctx)
 334         goto fail;
 335
 336     assuan_set_pointer(cl->ctx, cl);
 337
 338 #ifdef HAVE_MLOCKALL
 339     if (disable_mlock == FALSE && mlockall(MCL_FUTURE) == -1) {
 340         log_write("mlockall(): %s", strerror(errno));
 341         goto fail;
 342     }
 343 #endif
 344
 345     send_cache_status(cl->ctx);
 346     ev = pth_event(PTH_EVENT_FD|PTH_UNTIL_FD_READABLE, cl->fd);
 347     thd->keepalive_tid = pth_spawn(NULL, keepalive_thread, thd);
 348
 349     for (;;) {
 350         gpg_error_t rc;
 351         gint sig = 0;
 352
 353         pth_sigwait_ev(&set, &sig, ev);
 354
 355         if (sig > 0) {
 356             switch (sig) {
 357                 case SIGUSR2:
 358                     send_cache_status(cl->ctx);
 359                     continue;
 360                 case SIGQUIT:
 361                     goto done;
 362                 default:
 363                     break;
 364             }
 365         }
 366
 367         if (pth_event_occurred(ev)) {
 368             rc = assuan_process_next(cl->ctx);
 369
 370             if (rc) {
 371                 if (gpg_err_code(rc) == GPG_ERR_EOF)
 372                     goto done;
 373
 374                 log_write("assuan_process_next(): %s", gpg_strerror(rc));
 375                 rc = assuan_process_done(cl->ctx, gpg_err_make(GPG_ERR_SOURCE_USER_1, rc));
 376
 377                 if (rc) {
 378                     log_write("assuan_process_done(): %s", gpg_strerror(rc));
 379                     goto done;
 380                 }
 381             }
 382         }
 383     }
 384
 385     /*
 386      * Client cleanup (including XML data) is done in remove_connection() from
 387      * the cleanup thread.
 388      */
 389 done:
 390     pth_event_free(ev, PTH_FREE_ALL);
 391
 392 fail:
 393     pth_exit(NULL);
 394     return NULL;
 395 }
 396
 397 /*
 398  * Make sure all settings are set to either the specified setting or a
 399  * default.
 400  */
 401 static void set_rcfile_defaults(GKeyFile *kf)
 402 {
 403     gchar buf[PATH_MAX];
 404
 405     if (g_key_file_has_key(kf, "default", "socket_path", NULL) == FALSE) {
 406         snprintf(buf, sizeof(buf), "~/.pwmd/socket");
 407         g_key_file_set_string(kf, "default", "socket_path", buf);
 408     }
 409
 410     if (g_key_file_has_key(kf, "default", "data_directory", NULL) == FALSE) {
 411         snprintf(buf, sizeof(buf), "~/.pwmd/data");
 412         g_key_file_set_string(kf, "default", "data_directory", buf);
 413     }
 414
 415     if (g_key_file_has_key(kf, "default", "log_path", NULL) == FALSE) {
 416         snprintf(buf, sizeof(buf), "~/.pwmd/log");
 417         g_key_file_set_string(kf, "default", "log_path", buf);
 418     }
 419
 420     if (g_key_file_has_key(kf, "default", "enable_logging", NULL) == FALSE)
 421         g_key_file_set_boolean(kf, "default", "enable_logging", FALSE);
 422
 423     if (g_key_file_has_key(kf, "default", "cache_size", NULL) == FALSE)
 424         g_key_file_set_integer(kf, "default", "cache_size", cache_size);
 425
 426 #ifdef HAVE_MLOCKALL
 427     if (g_key_file_has_key(kf, "default", "disable_mlockall", NULL) == FALSE)
 428         g_key_file_set_boolean(kf, "default", "disable_mlockall", TRUE);
 429 #endif
 430
 431     if (g_key_file_has_key(kf, "default", "cache_timeout", NULL) == FALSE)
 432         g_key_file_set_integer(kf, "default", "cache_timeout", -1);
 433
 434     if (g_key_file_has_key(kf, "default", "iterations", NULL) == FALSE)
 435         g_key_file_set_integer(kf, "default", "iterations", 0);
 436
 437     if (g_key_file_has_key(kf, "default", "disable_list_and_dump", NULL) == FALSE)
 438         g_key_file_set_boolean(kf, "default", "disable_list_and_dump", FALSE);
 439
 440     if (g_key_file_has_key(kf, "default", "iteration_progress", NULL) == FALSE)
 441         g_key_file_set_integer(kf, "default", "iteration_progress", 0);
 442
 443     if (g_key_file_has_key(kf, "default", "compression_level", NULL) == FALSE)
 444         g_key_file_set_integer(kf, "default", "compression_level", 6);
 445
 446     if (g_key_file_has_key(kf, "default", "recursion_depth", NULL) == FALSE)
 447         g_key_file_set_integer(kf, "default", "recursion_depth", DEFAULT_RECURSION_DEPTH);
 448
 449     if (g_key_file_has_key(kf, "default", "zlib_bufsize", NULL) == FALSE)
 450         g_key_file_set_integer(kf, "default", "zlib_bufsize", DEFAULT_ZLIB_BUFSIZE);
 451
 452     zlib_bufsize = g_key_file_get_integer(kf, "default", "zlib_bufsize", NULL);
 453
 454     max_recursion_depth = g_key_file_get_integer(kf, "default", "recursion_depth", NULL);
 455     disable_list_and_dump = g_key_file_get_boolean(kf, "default", "disable_list_and_dump", NULL);
 456
 457 #ifdef HAVE_MLOCKALL
 458     disable_mlock = g_key_file_get_boolean(kf, "default", "disable_mlockall", NULL);
 459 #endif
 460
 461     if (g_key_file_has_key(kf, "default", "syslog", NULL) == FALSE)
 462         g_key_file_set_boolean(kf, "default", "syslog", FALSE);
 463
 464     if (g_key_file_has_key(kf, "default", "keepalive", NULL) == FALSE)
 465         g_key_file_set_integer(kf, "default", "keepalive", 5);
 466 }
 467
 468 static GKeyFile *parse_rcfile(int cmdline)
 469 {
 470     GKeyFile *kf = g_key_file_new();
 471     GError *error = NULL;
 472
 473     if (g_key_file_load_from_file(kf, rcfile, G_KEY_FILE_NONE, &error) == FALSE) {
 474         log_write("%s: %s", rcfile, error->message);
 475
 476         if (cmdline)
 477             exit(EXIT_FAILURE);
 478
 479         if (error->code == G_FILE_ERROR_NOENT) {
 480             g_clear_error(&error);
 481             set_rcfile_defaults(kf);
 482             return kf;
 483         }
 484
 485         g_clear_error(&error);
 486         return NULL;
 487     }
 488     else
 489         set_rcfile_defaults(kf);
 490
 491     return kf;
 492 }
 493
 494 static gchar *get_password(const gchar *prompt)
 495 {
 496     gchar buf[LINE_MAX], *p;
 497     struct termios told, tnew;
 498     gchar *key;
 499
 500     if (tcgetattr(STDIN_FILENO, &told) == -1)
 501         err(EXIT_FAILURE, "tcgetattr()");
 502
 503     memcpy(&tnew, &told, sizeof(struct termios));
 504     tnew.c_lflag &= ~(ECHO);
 505     tnew.c_lflag |= ICANON|ECHONL;
 506
 507     if (tcsetattr(STDIN_FILENO, TCSANOW, &tnew) == -1) {
 508         tcsetattr(STDIN_FILENO, TCSANOW, &told);
 509         err(EXIT_FAILURE, "tcsetattr()");
 510     }
 511
 512     fprintf(stderr, "%s", prompt);
 513
 514     if ((p = fgets(buf, sizeof(buf), stdin)) == NULL) {
 515         tcsetattr(STDIN_FILENO, TCSANOW, &told);
 516         return NULL;
 517     }
 518
 519     tcsetattr(STDIN_FILENO, TCSANOW, &told);
 520     p[strlen(p) - 1] = 0;
 521
 522     if (!p || !*p)
 523         return NULL;
 524
 525     key = gcry_malloc(strlen(p) + 1);
 526     sprintf(key, "%s", p);
 527     memset(&buf, 0, sizeof(buf));
 528     return key;
 529 }
 530
 531 static gboolean do_try_xml_decrypt(const gchar *filename, guchar *key)
 532 {
 533     int fd;
 534     struct stat st;
 535     gpg_error_t error;
 536
 537     if ((fd = open_file(filename, &st)) == -1) {
 538         warn("%s", filename);
 539         return FALSE;
 540     }
 541
 542     if (st.st_size == 0) {
 543         warnx(N_("%s: skipping empty file"), filename);
 544         close(fd);
 545         return FALSE;
 546     }
 547
 548     error = try_xml_decrypt(NULL, fd, st, key);
 549     close(fd);
 550     return error ? FALSE : TRUE;
 551 }
 552
 553 static gboolean get_input(const gchar *filename, guchar *key)
 554 {
 555     gint try = 0;
 556     gchar *password;
 557     gchar *prompt;
 558
 559     prompt = g_strdup_printf(N_("Password for '%s': "), filename);
 560
 561 again:
 562     if ((password = get_password(prompt)) == NULL) {
 563         warnx(N_("%s: skipping file"), filename);
 564         g_free(prompt);
 565         return FALSE;
 566     }
 567
 568     gcry_md_hash_buffer(GCRY_MD_SHA256, key, password, strlen(password));
 569     gcry_free(password);
 570
 571     if (do_try_xml_decrypt(filename, key) == FALSE) {
 572         if (try++ == 2) {
 573             warnx(N_("%s: invalid password, skipping"), filename);
 574             g_free(prompt);
 575             return FALSE;
 576         }
 577         else {
 578             warnx(N_("%s: invalid password"), filename);
 579             goto again;
 580         }
 581     }
 582
 583     g_free(prompt);
 584     return TRUE;
 585 }
 586
 587 static gboolean xml_import(const gchar *filename, gint iter)
 588 {
 589     xmlDocPtr doc;
 590     gint fd;
 591     struct stat st;
 592     gint len;
 593     xmlChar *xmlbuf;
 594     xmlChar *xml;
 595     gchar *key = NULL;
 596     gchar *key2 = NULL;
 597     guchar shakey[gcrykeysize];
 598     gcry_cipher_hd_t gh;
 599     gpg_error_t error;
 600     gint level;
 601     glong outsize;
 602     gpointer outbuf;
 603     gint zerror;
 604
 605     if (stat(filename, &st) == -1) {
 606         warn("%s", filename);
 607         return FALSE;
 608     }
 609
 610     if ((error = gcry_cipher_open(&gh, GCRY_CIPHER_AES256, GCRY_CIPHER_MODE_CBC, 0))) {
 611         send_error(NULL, error);
 612         gcry_cipher_close(gh);
 613         log_write("%s(%i): %s", __FUNCTION__, __LINE__, gcry_strerror(error));
 614         return FALSE;
 615     }
 616
 617     if ((key = get_password(N_("New password: "))) == NULL) {
 618         fprintf(stderr, "%s\n", N_("Invalid password."));
 619         gcry_cipher_close(gh);
 620         return FALSE;
 621     }
 622
 623     if ((key2 = get_password(N_("Verify password: "))) == NULL) {
 624         fprintf(stderr, "%s\n", N_("Passwords do not match."));
 625         gcry_free(key);
 626         gcry_cipher_close(gh);
 627         return FALSE;
 628     }
 629
 630     if (g_utf8_collate(key, key2) != 0) {
 631         fprintf(stderr, "%s\n", N_("Passwords do not match."));
 632         gcry_free(key);
 633         gcry_free(key2);
 634         gcry_cipher_close(gh);
 635         return FALSE;
 636     }
 637
 638     gcry_free(key2);
 639
 640     if ((fd = open(filename, O_RDONLY)) == -1) {
 641         gcry_free(key);
 642         warn("%s", filename);
 643         gcry_cipher_close(gh);
 644         return FALSE;
 645     }
 646
 647     if ((xmlbuf = gcry_malloc(st.st_size+1)) == NULL) {
 648         gcry_free(key);
 649         close(fd);
 650         log_write("%s", strerror(ENOMEM));
 651         gcry_cipher_close(gh);
 652         return FALSE;
 653     }
 654
 655     if (read(fd, xmlbuf, st.st_size) == -1) {
 656         error = errno;
 657         close(fd);
 658         gcry_free(key);
 659         gcry_cipher_close(gh);
 660         errno = error;
 661         err(EXIT_FAILURE, "read()");
 662     }
 663
 664     close(fd);
 665     xmlbuf[st.st_size] = 0;
 666
 667     /*
 668      * Make sure the document validates.
 669      */
 670     if ((doc = xmlReadDoc(xmlbuf, NULL, "UTF-8", XML_PARSE_NOBLANKS)) == NULL) {
 671         log_write("xmlReadDoc()");
 672         close(fd);
 673         gcry_free(key);
 674         gcry_free(xmlbuf);
 675         gcry_cipher_close(gh);
 676         return FALSE;
 677     }
 678
 679     gcry_free(xmlbuf);
 680     xmlDocDumpMemory(doc, &xml, &len);
 681     xmlFreeDoc(doc);
 682
 683     level = get_key_file_integer(filename, "compression_level");
 684
 685     if (level < 0)
 686         level = 0;
 687
 688     if (do_compress(NULL, level, xml, len, &outbuf, &outsize, &zerror) == FALSE) {
 689         memset(shakey, 0, sizeof(shakey));
 690         gcry_free(xml);
 691
 692         if (zerror == Z_MEM_ERROR)
 693             warnx("%s", strerror(ENOMEM));
 694         else
 695             warnx("do_compress() failed");
 696
 697         gcry_cipher_close(gh);
 698         return FALSE;
 699     }
 700     else {
 701         gcry_free(xml);
 702         xml = outbuf;
 703         len = outsize;
 704     }
 705
 706     gcry_md_hash_buffer(GCRY_MD_SHA256, shakey, key, strlen(key));
 707     gcry_free(key);
 708     error = do_xml_encrypt(NULL, gh, NULL, xml, len, shakey, iter);
 709     gcry_cipher_close(gh);
 710
 711     if (error) {
 712         memset(shakey, 0, sizeof(shakey));
 713         warnx("%s", gpg_strerror(error));
 714         return FALSE;
 715     }
 716
 717     memset(shakey, 0, sizeof(shakey));
 718     return TRUE;
 719 }
 720
 721 gchar *get_key_file_string(const gchar *section, const gchar *what)
 722 {
 723     gchar *val = NULL;
 724     GError *gerror = NULL;
 725
 726     if (g_key_file_has_key(keyfileh, section, what, NULL) == TRUE) {
 727         val = g_key_file_get_string(keyfileh, section, what, &gerror);
 728
 729         if (gerror) {
 730             log_write("%s(%i): %s", __FILE__, __LINE__, gerror->message);
 731             g_clear_error(&gerror);
 732         }
 733     }
 734     else {
 735         if (g_key_file_has_key(keyfileh, "default", what, NULL) == TRUE) {
 736             val = g_key_file_get_string(keyfileh, "default", what, &gerror);
 737
 738             if (gerror) {
 739                 log_write("%s(%i): %s", __FILE__, __LINE__, gerror->message);
 740                 g_clear_error(&gerror);
 741             }
 742         }
 743     }
 744
 745     return val;
 746 }
 747
 748 gint get_key_file_integer(const gchar *section, const gchar *what)
 749 {
 750     gint val = -1;
 751     GError *gerror = NULL;
 752
 753     if (g_key_file_has_key(keyfileh, section, what, NULL) == TRUE) {
 754         val = g_key_file_get_integer(keyfileh, section, what, &gerror);
 755
 756         if (gerror) {
 757             log_write("%s(%i): %s", __FILE__, __LINE__, gerror->message);
 758             g_clear_error(&gerror);
 759         }
 760     }
 761     else {
 762         if (g_key_file_has_key(keyfileh, "default", what, NULL) == TRUE) {
 763             val = g_key_file_get_integer(keyfileh, "default", what, &gerror);
 764
 765             if (gerror) {
 766                 log_write("%s(%i): %s", __FILE__, __LINE__, gerror->message);
 767                 g_clear_error(&gerror);
 768             }
 769         }
 770     }
 771
 772     return val;
 773 }
 774
 775 gboolean get_key_file_boolean(const gchar *section, const gchar *what)
 776 {
 777     gboolean val = FALSE;
 778     GError *gerror = NULL;
 779
 780     if (g_key_file_has_key(keyfileh, section, what, NULL) == TRUE) {
 781         val = g_key_file_get_boolean(keyfileh, section, what, &gerror);
 782
 783         if (gerror) {
 784             log_write("%s(%i): %s", __FILE__, __LINE__, gerror->message);
 785             g_clear_error(&gerror);
 786         }
 787     }
 788     else {
 789         if (g_key_file_has_key(keyfileh, "default", what, NULL) == TRUE) {
 790             val = g_key_file_get_boolean(keyfileh, "default", what, &gerror);
 791
 792             if (gerror) {
 793                 log_write("%s(%i): %s", __FILE__, __LINE__, gerror->message);
 794                 g_clear_error(&gerror);
 795             }
 796         }
 797     }
 798
 799     return val;
 800 }
 801
 802 gchar *expand_homedir(gchar *str)
 803 {
 804     gchar *p = str;
 805
 806     if (*p++ == '~')
 807         return g_strdup_printf("%s%s", g_get_home_dir(), p);
 808
 809     return g_strdup(str);
 810 }
 811
 812 static gchar *_getline(const gchar *file)
 813 {
 814     FILE *fp;
 815     gchar buf[LINE_MAX], *p;
 816     gchar *str = NULL;
 817
 818     if ((fp = fopen(file, "r")) == NULL) {
 819         warn("%s", file);
 820         return NULL;
 821     }
 822
 823     if ((p = fgets(buf, sizeof(buf), fp)) == NULL) {
 824         warnx(N_("%s: empty file?"), file);
 825         return NULL;
 826     }
 827
 828     fclose(fp);
 829
 830     if (buf[strlen(buf) - 1] == '\n')
 831         buf[strlen(buf) - 1] = 0;
 832
 833     str = gcry_malloc(strlen(p) + 1);
 834     memcpy(str, p, strlen(p));
 835     str[strlen(p)] = 0;
 836     memset(&buf, 0, sizeof(buf));
 837     return str;
 838 }
 839
 840 static gboolean parse_keyfile_key()
 841 {
 842     gsize n;
 843     gchar **groups;
 844     gchar **p;
 845     gchar *str;
 846
 847     groups = g_key_file_get_groups(keyfileh, &n);
 848
 849     for (p = groups; *p; p++) {
 850         GError *error = NULL;
 851
 852         if (g_key_file_has_key(keyfileh, *p, "key", &error) == TRUE) {
 853             str = g_key_file_get_string(keyfileh, *p, "key", &error);
 854
 855             if (!str) {
 856                 if (error) {
 857                     warnx("%s", error->message);
 858                     g_clear_error(&error);
 859                 }
 860
 861                 continue;
 862             }
 863
 864             do_cache_push(*p, str);
 865             g_free(str);
 866             continue;
 867         }
 868
 869         if (error) {
 870             warnx("%s", error->message);
 871             g_clear_error(&error);
 872             continue;
 873         }
 874
 875         if (g_key_file_has_key(keyfileh, *p, "key_file", &error) == TRUE) {
 876             gchar *t;
 877             gchar *file = g_key_file_get_string(keyfileh, *p, "key_file", &error);
 878
 879             if (!file) {
 880                 if (error) {
 881                     warnx("%s", error->message);
 882                     g_clear_error(&error);
 883                 }
 884
 885                 continue;
 886             }
 887
 888             t = expand_homedir(file);
 889             g_free(file);
 890             file = t;
 891
 892             if ((str = _getline(file)) == NULL) {
 893                 g_free(file);
 894                 continue;
 895             }
 896
 897             g_free(file);
 898             do_cache_push(*p, str);
 899             gcry_free(str);
 900             continue;
 901         }
 902
 903         if (error) {
 904             warnx("%s", error->message);
 905             g_clear_error(&error);
 906         }
 907     }
 908
 909     g_strfreev(groups);
 910     return TRUE;
 911 }
 912
 913 static gboolean do_cache_push(const gchar *filename, const gchar *password)
 914 {
 915     guchar *md5file;
 916     guchar *key;
 917     gint timeout;
 918     const gchar *p = filename;
 919
 920     while (isspace(*p))
 921         p++;
 922
 923     if (!*p)
 924         return FALSE;
 925
 926     if (valid_filename(p) == FALSE) {
 927         warnx(N_("%s: invalid characters in filename"), p);
 928         return FALSE;
 929     }
 930
 931     md5file = gcry_malloc(16);
 932     key = gcry_malloc(gcrykeysize);
 933     gcry_md_hash_buffer(GCRY_MD_MD5, md5file, p, strlen(p));
 934
 935     if (cache_iscached(md5file) == TRUE) {
 936         warnx(N_("%s: file already cached, skipping"), p);
 937         gcry_free(md5file);
 938         gcry_free(key);
 939         return FALSE;
 940     }
 941
 942     if (access(p, R_OK|W_OK) != 0) {
 943         gcry_free(md5file);
 944         gcry_free(key);
 945
 946         if (errno != ENOENT) {
 947             warn("%s", p);
 948             return FALSE;
 949         }
 950
 951         warn("%s", p);
 952         return TRUE;
 953     }
 954
 955     if (!password) {
 956         if (get_input(p, key) == FALSE) {
 957             gcry_free(key);
 958             gcry_free(md5file);
 959             return FALSE;
 960         }
 961     }
 962     else {
 963         gcry_md_hash_buffer(GCRY_MD_SHA256, key, password, strlen(password));
 964
 965         if (do_try_xml_decrypt(filename, key) == FALSE) {
 966             warnx(N_("%s: invalid password, skipping"), filename);
 967             gcry_free(key);
 968             gcry_free(md5file);
 969             return FALSE;
 970         }
 971     }
 972
 973     if (cache_add_file(md5file, key) == FALSE) {
 974         warnx("%s: %s", p, pwmd_strerror(EPWMD_MAX_SLOTS));
 975         gcry_free(key);
 976         gcry_free(md5file);
 977         return FALSE;
 978     }
 979
 980     timeout = get_key_file_integer(p, "cache_timeout");
 981     cache_set_timeout(md5file, timeout);
 982     warnx(N_("%s: file added to the cache"), filename);
 983     gcry_free(key);
 984     gcry_free(md5file);
 985     return TRUE;
 986 }
 987
 988 static GSList *remove_connection(GSList *list, struct client_thread_s *cn)
 989 {
 990     gpointer value;
 991     struct client_s *cl = cn->cl;
 992
 993     if (cn->keepalive_tid) {
 994         pth_raise(cn->keepalive_tid, SIGALRM);
 995         pth_join(cn->keepalive_tid, &value);
 996     }
 997
 998     pth_join(cn->tid, &value);
 999     close(cn->fd);
1000
1001     if (cl->freed == FALSE)
1002         cleanup_assuan(cl->ctx);
1003
1004     if (cl->ctx)
1005         assuan_deinit_server(cl->ctx);
1006
1007     if (cl)
1008         g_free(cl);
1009
1010     pth_event_isolate(cn->ev);
1011     pth_event_free(cn->ev, PTH_FREE_THIS);
1012     log_write(N_("client exited: fd=%i"), cn->fd);
1013     list = g_slist_remove(list, cn);
1014     g_free(cn);
1015     return list;
1016 }
1017
1018 /*
1019  * Can't pth_event_concat() to an empty event.
1020  */
1021 static int event_ring_hack(void *data)
1022 {
1023     return FALSE;
1024 }
1025
1026 /*
1027  * See if any thread has entered the DEAD queue and remove it.
1028  */
1029 static GSList *cleanup_dead_queue(GSList *threads, pth_event_t tid_events)
1030 {
1031     guint n, i;
1032
1033     for (n = g_slist_length(threads), i = 0; i < n; i++) {
1034         struct client_thread_s *cn = g_slist_nth_data(threads, i);
1035
1036         if (pth_event_occurred(cn->ev)) {
1037             threads = remove_connection(threads, cn);
1038             return cleanup_dead_queue(threads, tid_events);
1039         }
1040
1041         pth_event_concat(tid_events, cn->ev, NULL);
1042     }
1043
1044     return threads;
1045 }
1046
1047 static void *socket_thread(void *arg)
1048 {
1049     gint sockfd = (gint)arg;
1050     pth_attr_t attr;
1051
1052     /*
1053      * Thread priority is inherited from the calling thread. This thread is
1054      * PTH_PRIO_MAX. Keep the "child" threads at standard priority.
1055      */
1056     attr = pth_attr_new();
1057     pth_attr_set(attr, PTH_ATTR_PRIO, PTH_PRIO_STD);
1058
1059     for (;;) {
1060         socklen_t slen = sizeof(struct sockaddr_un);
1061         struct sockaddr_un raddr;
1062         gint fd = -1;
1063
1064         if ((fd = pth_accept(sockfd, (struct sockaddr *)&raddr, &slen)) == -1) {
1065             if (errno != EAGAIN) {
1066                 if (!quit) // probably EBADF
1067                     log_write("accept(): %s", strerror(errno));
1068
1069                 break;
1070             }
1071         }
1072
1073         if (fd >= 0) {
1074             pth_t tid;
1075             struct client_thread_s *new;
1076
1077             new = g_malloc0(sizeof(struct client_thread_s));
1078
1079             if (!new) {
1080                 log_write("%s", strerror(ENOMEM));
1081                 continue;
1082             }
1083
1084             log_write(N_("new connection: fd=%i"), fd);
1085             new->fd = fd;
1086             tid = pth_spawn(attr, client_thread, new);
1087
1088             if (!tid) {
1089                 g_free(new);
1090                 log_write(N_("pth_spawn() failed"));
1091                 continue;
1092             }
1093
1094             new->tid = tid;
1095             new->fd = fd;
1096             new->ev = pth_event(PTH_EVENT_TID|PTH_UNTIL_TID_DEAD, tid);
1097             pth_mutex_acquire(&cn_mutex, FALSE, NULL);
1098             pth_event_concat(cn_events, new->ev, NULL);
1099             cn_thread_list = g_slist_append(cn_thread_list, new);
1100             pth_mutex_release(&cn_mutex);
1101         }
1102     }
1103
1104     pth_attr_destroy(attr);
1105
1106     /* Just in case pth_accept() failed for some reason other than EBADF */
1107     quit = 1;
1108     pth_exit(PTH_CANCELED);
1109     return NULL;
1110 }
1111
1112 static void *cleanup_thread(void *arg)
1113 {
1114     cn_events = pth_event(PTH_EVENT_TIME, pth_timeout(0, 500000));
1115
1116     for (;;) {
1117         if (pth_wait(cn_events) && pth_event_occurred(cn_events)) {
1118             pth_mutex_acquire(&cn_mutex, FALSE, NULL);
1119             pth_event_isolate(cn_events);
1120             pth_event_free(cn_events, PTH_FREE_THIS);
1121             cn_events = pth_event(PTH_EVENT_TIME, pth_timeout(0, 500000));
1122             cn_thread_list = cleanup_dead_queue(cn_thread_list, cn_events);
1123             pth_mutex_release(&cn_mutex);
1124         }
1125     }
1126
1127     pth_event_isolate(cn_events);
1128     pth_event_free(cn_events, PTH_FREE_THIS);
1129     return NULL;
1130 }
1131
1132 static void *adjust_cache_time_thread(void *arg)
1133 {
1134     CACHE_LOCK(NULL);
1135     cache_adjust_timer();
1136     CACHE_UNLOCK;
1137     return NULL;
1138 }
1139
1140 static void server_loop(int sockfd)
1141 {
1142     pth_t socket_tid, cleanup_tid;
1143     guint n, i;
1144     sigset_t set;
1145     gint n_clients = 0;
1146     pth_attr_t attr;
1147     pth_event_t timeout_event;
1148     gpointer value;
1149
1150     pth_mutex_init(&cn_mutex);
1151     log_write(N_("%s started for user %s"), PACKAGE_STRING, g_get_user_name());
1152
1153     sigemptyset(&set);
1154     sigaddset(&set, SIGTERM);
1155     sigaddset(&set, SIGINT);
1156     sigaddset(&set, SIGUSR1);
1157     sigaddset(&set, SIGHUP);
1158     sigaddset(&set, SIGABRT);
1159
1160     attr = pth_attr_new();
1161     pth_attr_init(attr);
1162     pth_attr_set(attr, PTH_ATTR_PRIO, PTH_PRIO_MAX);
1163     socket_tid = pth_spawn(attr, socket_thread, (void *)sockfd);
1164     pth_attr_set(attr, PTH_ATTR_JOINABLE, FALSE);
1165     pth_attr_set(attr, PTH_ATTR_CANCEL_STATE, PTH_CANCEL_ASYNCHRONOUS);
1166     cleanup_tid = pth_spawn(attr, cleanup_thread, NULL);
1167
1168     /*
1169      * For the cache_timeout configuration parameter. This replaces the old
1170      * SIGALRM stuff and is safer.
1171      */
1172     timeout_event = pth_event(PTH_EVENT_TIME, pth_timeout(1, 0));
1173     pth_attr_init(attr);
1174     pth_attr_set(attr, PTH_ATTR_JOINABLE, FALSE);
1175     pth_attr_set(attr, PTH_ATTR_PRIO, PTH_PRIO_MAX);
1176
1177     do {
1178         gint sig = 0;
1179
1180         pth_sigwait_ev(&set, &sig, timeout_event);
1181
1182         if (pth_event_occurred(timeout_event)) {
1183             /*
1184              * The timer event has expired. Update the file cache. When the
1185              * cache mutex is locked and the timer expires again, the threads
1186              * will stack.
1187              */
1188             pth_spawn(attr, adjust_cache_time_thread, NULL);
1189             pth_event_free(timeout_event, PTH_FREE_THIS);
1190             timeout_event = pth_event(PTH_EVENT_TIME, pth_timeout(1, 0));
1191         }
1192
1193         if (sig > 0) {
1194             log_write(N_("caught signal %i (%s)"), sig, strsignal(sig));
1195
1196             /* Caught a signal. */
1197             switch (sig) {
1198                 case SIGUSR1:
1199                     reload_rcfile();
1200                     break;
1201                 case SIGABRT:
1202                     CACHE_LOCK(NULL);
1203                     cache_clear(NULL, 2);
1204                     CACHE_UNLOCK;
1205 #ifndef MEM_DEBUG
1206                     xpanic();
1207 #endif
1208                     exit(EXIT_FAILURE);
1209                 case SIGHUP:
1210                     CACHE_LOCK(NULL);
1211                     log_write(N_("clearing file cache"));
1212                     cache_clear(NULL, 2);
1213                     CACHE_UNLOCK;
1214                     break;
1215                 default:
1216                     quit = 1;
1217                     shutdown(sockfd, SHUT_RDWR);
1218                     close(sockfd);
1219                     break;
1220             }
1221         }
1222     } while (!quit);
1223
1224     /*
1225      * We're out of the main server loop. This happens when a signal was sent
1226      * to terminate the daemon. We'll wait for all clients to disconnect
1227      * before exiting and ignore any following signals.
1228      */
1229     pth_join(socket_tid, &value);
1230     pth_attr_destroy(attr);
1231     pth_event_free(timeout_event, PTH_FREE_THIS);
1232
1233     n = pth_ctrl(PTH_CTRL_GETTHREADS);
1234
1235     /* 2 because the cleanup thread still exists, plus self. */
1236     if (n > 2)
1237         log_write(N_("waiting for all threads to terminate"));
1238
1239     while (n > 2) {
1240         gint t;
1241         pth_event_t events;
1242
1243         if (n != n_clients) {
1244             log_write(N_("%i threads remain"), n-2);
1245             n_clients = n;
1246         }
1247
1248         events = pth_event(PTH_EVENT_FUNC, event_ring_hack, NULL, pth_timeout(1, 0));
1249         pth_mutex_acquire(&cn_mutex, FALSE, NULL);
1250
1251         for (t = g_slist_length(cn_thread_list), i = 0; i < t; i++) {
1252             struct client_thread_s *cn = g_slist_nth_data(cn_thread_list, i);
1253
1254             pth_event_concat(events, cn->ev, NULL);
1255         }
1256
1257         if (!t)
1258             goto done;
1259
1260         pth_mutex_release(&cn_mutex);
1261         pth_wait(events);
1262         pth_yield(cleanup_tid);
1263 done:
1264         pth_event_isolate(events);
1265         pth_event_free(events, PTH_FREE_THIS);
1266         n = pth_ctrl(PTH_CTRL_GETTHREADS);
1267     }
1268
1269     pth_cancel(cleanup_tid);
1270 }
1271
1272 int main(int argc, char *argv[])
1273 {
1274     gint opt;
1275     struct sockaddr_un addr;
1276     struct passwd *pw = getpwuid(getuid());
1277     gchar buf[PATH_MAX];
1278     gchar *socketpath = NULL, *socketdir, *socketname = NULL;
1279     gchar *socketarg = NULL;
1280     gchar *datadir = NULL;
1281     gboolean n;
1282     gchar *p;
1283     gchar **cache_push = NULL;
1284     gint iter = 0;
1285     gchar *import = NULL;
1286     gint default_timeout;
1287     gint rcfile_spec = 0;
1288     gint estatus = EXIT_FAILURE;
1289     gint sockfd;
1290 #ifndef MEM_DEBUG
1291     GMemVTable mtable = { xmalloc, xrealloc, xfree, xcalloc, NULL, NULL };
1292 #endif
1293     gint do_unlink = 1;
1294     gboolean secure = FALSE;
1295     guint ptotal = 0;
1296     gint background = 0;
1297     sigset_t set;
1298 #ifndef DEBUG
1299 #ifdef HAVE_SETRLIMIT
1300     struct rlimit rl;
1301
1302     rl.rlim_cur = rl.rlim_max = 0;
1303
1304     if (setrlimit(RLIMIT_CORE, &rl) != 0)
1305         err(EXIT_FAILURE, "setrlimit()");
1306 #endif
1307 #endif
1308
1309 #ifdef ENABLE_NLS
1310     setlocale(LC_ALL, "");
1311     bindtextdomain("pwmd", LOCALEDIR);
1312     textdomain("pwmd");
1313 #endif
1314
1315     gpg_err_init();
1316     assuan_set_assuan_err_source(GPG_ERR_SOURCE_DEFAULT);
1317 #ifndef MEM_DEBUG
1318     g_mem_set_vtable(&mtable);
1319     assuan_set_malloc_hooks(xmalloc, xrealloc, xfree);
1320     xmlMemSetup(xfree, xmalloc, xrealloc, xstrdup);
1321     xmlInitMemory();
1322 #endif
1323     pth_init();
1324     snprintf(buf, sizeof(buf), "%s/.pwmd", pw->pw_dir);
1325
1326     if (mkdir(buf, 0700) == -1 && errno != EEXIST)
1327         err(EXIT_FAILURE, "%s", buf);
1328
1329     snprintf(buf, sizeof(buf), "%s/.pwmd/data", pw->pw_dir);
1330
1331     if (mkdir(buf, 0700) == -1 && errno != EEXIST)
1332         err(EXIT_FAILURE, "%s", buf);
1333
1334     rcfile = g_strdup_printf("%s/.pwmd/config", pw->pw_dir);
1335
1336     if ((page_size = sysconf(_SC_PAGESIZE)) == -1)
1337         err(EXIT_FAILURE, "sysconf()");
1338
1339     cache_size = page_size;
1340
1341     while ((opt = getopt(argc, argv, "bI:hvf:D")) != EOF) {
1342         switch (opt) {
1343             case 'b':
1344                 background = 1;
1345                 break;
1346             case 'D':
1347                 secure = TRUE;
1348                 break;
1349             case 'I':
1350                 import = optarg;
1351                 break;
1352             case 'f':
1353                 g_free(rcfile);
1354                 rcfile = g_strdup(optarg);
1355                 rcfile_spec = 1;
1356                 break;
1357             case 'v':
1358                 printf("%s\n%s\n", PACKAGE_STRING, PACKAGE_BUGREPORT);
1359                 exit(EXIT_SUCCESS);
1360             case 'h':
1361             default:
1362                 usage(argv[0]);
1363         }
1364     }
1365
1366     if ((keyfileh = parse_rcfile(rcfile_spec)) == NULL)
1367         exit(EXIT_FAILURE);
1368
1369     if (g_key_file_has_key(keyfileh, "default", "syslog", NULL) == TRUE)
1370         log_syslog = g_key_file_get_boolean(keyfileh, "default", "syslog", NULL);
1371
1372     if (log_syslog == TRUE)
1373         openlog("pwmd", LOG_NDELAY|LOG_PID, LOG_DAEMON);
1374
1375     if (g_key_file_has_key(keyfileh, "default", "iterations", NULL) == TRUE)
1376         iter = g_key_file_get_integer(keyfileh, "default", "iterations", NULL);
1377
1378 #ifdef HAVE_MLOCKALL
1379     if (disable_mlock == FALSE && mlockall(MCL_FUTURE) == -1) {
1380         warn("mlockall()");
1381         goto do_exit;
1382     }
1383 #endif
1384
1385     setup_gcrypt();
1386
1387     if (import) {
1388         opt = xml_import(import, iter);
1389         g_key_file_free(keyfileh);
1390         g_free(rcfile);
1391         exit(opt == FALSE ? EXIT_FAILURE : EXIT_SUCCESS);
1392     }
1393
1394     g_key_file_set_list_separator(keyfileh, ',');
1395
1396     if ((p = g_key_file_get_string(keyfileh, "default", "socket_path", NULL)) == NULL)
1397         errx(EXIT_FAILURE, N_("%s: socket_path not defined"), rcfile);
1398
1399     if (*p == '~') {
1400         p++;
1401         snprintf(buf, sizeof(buf), "%s%s", g_get_home_dir(), p--);
1402         g_free(p);
1403         socketarg = g_strdup(buf);
1404     }
1405     else
1406         socketarg = p;
1407
1408     if ((p = g_key_file_get_string(keyfileh, "default", "data_directory", NULL)) == NULL)
1409         errx(EXIT_FAILURE, N_("%s: data_directory not defined"), rcfile);
1410
1411     datadir = expand_homedir(p);
1412     g_free(p);
1413
1414     if (secure == FALSE && g_key_file_has_key(keyfileh, "default", "disable_list_and_dump", NULL) == TRUE) {
1415         n = g_key_file_get_boolean(keyfileh, "default", "disable_list_and_dump", NULL);
1416         disable_list_and_dump = n;
1417     }
1418     else
1419         disable_list_and_dump = secure;
1420
1421     if (g_key_file_has_key(keyfileh, "default", "cache_timeout", NULL) == TRUE)
1422         default_timeout = g_key_file_get_integer(keyfileh, "default", "cache_timeout", NULL);
1423     else
1424         default_timeout = -1;
1425
1426     if (g_key_file_has_key(keyfileh, "default", "cache_size", NULL) == TRUE) {
1427         cache_size = g_key_file_get_integer(keyfileh, "default", "cache_size", NULL);
1428
1429         if (cache_size < page_size || cache_size % page_size)
1430             errx(EXIT_FAILURE, N_("cache size must be in multiples of %li"), page_size);
1431     }
1432
1433     if (g_key_file_has_key(keyfileh, "default", "log_path", NULL) == TRUE) {
1434         if (g_key_file_has_key(keyfileh, "default", "enable_logging", NULL) == TRUE) {
1435             n = g_key_file_get_boolean(keyfileh, "default", "enable_logging", NULL);
1436
1437             if (n == TRUE) {
1438                 p = g_key_file_get_string(keyfileh, "default", "log_path", NULL);
1439
1440                 if (*p == '~') {
1441                     p++;
1442                     snprintf(buf, sizeof(buf), "%s%s", g_get_home_dir(), p--);
1443                     g_free(p);
1444                     logfile = g_strdup(buf);
1445                 }
1446                 else
1447                     logfile = p;
1448             }
1449         }
1450     }
1451
1452     if (g_key_file_has_key(keyfileh, "default", "cache_push", NULL) == TRUE)
1453         cache_push = g_key_file_get_string_list(keyfileh, "default", "cache_push", NULL, NULL);
1454
1455     if (argc != optind) {
1456         if (cache_push)
1457             ptotal = g_strv_length(cache_push);
1458
1459         for (; optind < argc; optind++) {
1460             if (strv_printf(&cache_push, "%s", argv[optind]) == FALSE)
1461                 errx(EXIT_FAILURE, "%s", strerror(ENOMEM));
1462         }
1463     }
1464
1465     if (strchr(socketarg, '/') == NULL) {
1466         socketdir = g_get_current_dir();
1467         socketname = g_strdup(socketarg);
1468         socketpath = g_strdup_printf("%s/%s", socketdir, socketname);
1469     }
1470     else {
1471         socketname = g_strdup(strrchr(socketarg, '/'));
1472         socketname++;
1473         socketarg[strlen(socketarg) - strlen(socketname) -1] = 0;
1474         socketdir = g_strdup(socketarg);
1475         socketpath = g_strdup_printf("%s/%s", socketdir, socketname);
1476     }
1477
1478     if ((key_cache = mmap(NULL, cache_size, PROT_READ|PROT_WRITE,
1479 #ifdef MMAP_ANONYMOUS
1480                     MAP_PRIVATE|MAP_ANONYMOUS, -1, 0)) == MAP_FAILED) {
1481 #else
1482                     MAP_PRIVATE|MAP_ANON, -1, 0)) == MAP_FAILED) {
1483 #endif
1484         err(EXIT_FAILURE, "mmap()");
1485     }
1486
1487     if (mlock(key_cache, cache_size) == -1)
1488         log_write("mlock(): %s", strerror(errno));
1489
1490     memset(key_cache, 0, cache_size);
1491
1492     if (chdir(datadir)) {
1493         warn("%s", datadir);
1494         unlink(socketpath);
1495         goto do_exit;
1496     }
1497
1498     if (parse_keyfile_key() == FALSE)
1499         goto do_exit;
1500
1501     clear_rcfile_key();
1502
1503     /*
1504      * Set the cache entry for a file. Prompts for the password.
1505      */
1506     if (cache_push) {
1507         for (opt = 0; cache_push[opt]; opt++)
1508             do_cache_push(cache_push[opt], NULL);
1509
1510         g_strfreev(cache_push);
1511         warnx(background ? N_("Done. Daemonizing...") : N_("Done. Waiting for connections..."));
1512     }
1513
1514     /*
1515      * bind() doesn't like the full pathname of the socket or any non alphanum
1516      * characters so change to the directory where the socket is wanted then
1517      * create it then change to datadir.
1518      */
1519     if (chdir(socketdir)) {
1520         warn("%s", socketdir);
1521         goto do_exit;
1522     }
1523
1524     g_free(socketdir);
1525
1526     if ((sockfd = socket(PF_UNIX, SOCK_STREAM, 0)) == -1) {
1527         warn("socket()");
1528         goto do_exit;
1529     }
1530
1531     addr.sun_family = AF_UNIX;
1532     snprintf(addr.sun_path, sizeof(addr.sun_path), "%s", socketname);
1533
1534     if (bind(sockfd, (struct sockaddr *)&addr, sizeof(struct sockaddr)) == -1) {
1535         warn("bind()");
1536
1537         if (errno == EADDRINUSE)
1538             warnx(N_("Either there is another pwmd running or '%s' is a \n"
1539                     "stale socket. Please remove it manually."), socketpath);
1540
1541         do_unlink = 0;
1542         goto do_exit;
1543     }
1544
1545     if (g_key_file_has_key(keyfileh, "default", "socket_perms", NULL) == TRUE) {
1546         gchar *t = g_key_file_get_string(keyfileh, "default", "socket_perms", NULL);
1547         mode_t mode = strtol(t, NULL, 8);
1548         mode_t mask = umask(0);
1549
1550         g_free(t);
1551
1552         if (chmod(socketname, mode) == -1) {
1553             warn("%s", socketname);
1554             close(sockfd);
1555             unlink(socketpath);
1556             umask(mask);
1557             goto do_exit;
1558         }
1559
1560         umask(mask);
1561     }
1562
1563     g_free(--socketname);
1564
1565     if (chdir(datadir)) {
1566         warn("%s", datadir);
1567         close(sockfd);
1568         unlink(socketpath);
1569         goto do_exit;
1570     }
1571
1572     g_free(datadir);
1573     pth_mutex_init(&cache_mutex);
1574
1575     if (listen(sockfd, 0) == -1) {
1576         warn("listen()");
1577         goto do_exit;
1578     }
1579
1580     if (background) {
1581         switch (fork()) {
1582             case -1:
1583                 warn("fork()");
1584                 goto do_exit;
1585             case 0:
1586                 close(0);
1587                 close(1);
1588                 close(2);
1589                 setsid();
1590                 break;
1591             default:
1592                 exit(EXIT_SUCCESS);
1593         }
1594     }
1595
1596     /*
1597      * These are the signals that we use in threads. libpth can catch signals
1598      * itself so ignore them everywhere else. Note that using
1599      * signal(N, SIG_IGN) doesn't work like you might think.
1600      */
1601     sigemptyset(&set);
1602
1603     /* Termination */
1604     sigaddset(&set, SIGTERM);
1605     sigaddset(&set, SIGINT);
1606
1607     /* Configuration file reloading. */
1608     sigaddset(&set, SIGUSR1);
1609
1610     /* Clears the file cache. */
1611     sigaddset(&set, SIGHUP);
1612
1613     /* Caught in client_thread(). Sends a cache status message. */
1614     sigaddset(&set, SIGUSR2);
1615
1616     /* Caught in client_thread(). When keepalive_thread() fails, this signal
1617      * is raised to terminate the client. More of a failsafe than anything. */
1618     sigaddset(&set, SIGQUIT);
1619
1620     /* Ignored everywhere. When a client disconnects abnormally this signal
1621      * gets raised. It isn't needed though because client_thread() will check
1622      * for errors even after the client disconnects. */
1623     signal(SIGPIPE, SIG_IGN);
1624     pth_sigmask(SIG_BLOCK, &set, NULL);
1625     server_loop(sockfd);
1626     estatus = EXIT_SUCCESS;
1627
1628 do_exit:
1629     if (socketpath && do_unlink) {
1630         unlink(socketpath);
1631         g_free(socketpath);
1632     }
1633
1634     g_key_file_free(keyfileh);
1635     g_free(rcfile);
1636
1637     if (key_cache) {
1638         cache_clear(NULL, 2);
1639         memset(key_cache, 0, cache_size);
1640     }
1641
1642     if (key_cache && munmap(key_cache, cache_size) == -1)
1643         log_write("munmap(): %s", strerror(errno));
1644
1645     if (estatus == EXIT_SUCCESS)
1646         log_write(N_("pwmd exiting normally"));
1647
1648     pth_kill();
1649 #if defined(DEBUG) && !defined(MEM_DEBUG)
1650     xdump();
1651 #endif
1652     exit(estatus);
1653 }