1 /* vim:tw=78:ts=8:sw=4:set ft=c: */
3 Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012
4 Ben Kibbey <bjk@luxsci.net>
6 This file is part of pwmd.
8 Pwmd is free software: you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation, either version 2 of the License, or
11 (at your option) any later version.
13 Pwmd is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with Pwmd. If not, see <http://www.gnu.org/licenses/>.
41 #include <glib/gprintf.h>
46 #include <netinet/in.h>
47 #include <arpa/inet.h>
50 #include <sys/resource.h>
59 #ifdef HAVE_PR_SET_NAME
60 #include <sys/prctl.h>
63 #include "pwmd-error.h"
78 static gboolean exiting
;
79 static gboolean cmdline
;
81 static gboolean nofork
;
82 static pthread_cond_t quit_cond
;
83 static pthread_mutex_t quit_mutex
;
84 static gboolean no_passphrase_file
= FALSE
;
88 static pthread_t tls_tid
;
89 static pthread_t tls6_tid
;
91 static gboolean
start_stop_tls(gboolean term
);
94 static gboolean
do_cache_push(const gchar
*filename
, struct crypto_s
*crypto
);
95 static gboolean
signal_loop(sigset_t sigset
);
97 GCRY_THREAD_OPTION_PTHREAD_IMPL
;
99 static void cache_push_from_rcfile()
101 struct crypto_s
*crypto
;
102 gpg_error_t rc
= init_client_crypto(&crypto
);
105 log_write("%s: %s", __FUNCTION__
, pwmd_strerror(rc
));
109 rc
= set_agent_option(crypto
->agent
, "pinentry-mode", "error");
111 log_write("%s: %s", __FUNCTION__
, pwmd_strerror(rc
));
115 if (g_key_file_has_key(keyfileh
, "global", "cache_push", NULL
)) {
116 gchar
**cache_push
= g_key_file_get_string_list(keyfileh
, "global",
117 "cache_push", NULL
, NULL
);
120 for (p
= cache_push
; *p
; p
++) {
121 (void)do_cache_push(*p
, crypto
);
122 cleanup_crypto_stage1(crypto
);
125 g_strfreev(cache_push
);
128 (void)kill_scd(crypto
->agent
);
129 cleanup_crypto(&crypto
);
132 static void *reload_rcfile_thread(void *arg
)
134 #ifdef HAVE_PR_SET_NAME
135 prctl(PR_SET_NAME
, "reload rcfile");
137 pthread_setspecific(thread_name_key
, g_strdup(__FUNCTION__
));
138 MUTEX_LOCK(&rcfile_mutex
);
141 gboolean b
= disable_list_and_dump
;
145 pthread_cond_wait(&rcfile_cond
, &rcfile_mutex
);
146 users
= g_key_file_get_string_list(keyfileh
, "global", "allowed", NULL
, NULL
);
147 log_write(_("reloading configuration file '%s'"), rcfile
);
148 k
= parse_rcfile(FALSE
, cmdline
);
150 g_key_file_free(keyfileh
);
152 cache_push_from_rcfile();
156 disable_list_and_dump
= !disable_list_and_dump
? b
: TRUE
;
157 g_key_file_set_string_list(keyfileh
, "global", "allowed",
158 (const gchar
**)users
, g_strv_length(users
));
161 /* Kill existing listening threads since the configured listening
162 * protocols may have changed. */
163 start_stop_tls(TRUE
);
164 start_stop_tls(FALSE
);
171 gpg_error_t
send_error(assuan_context_t ctx
, gpg_error_t e
)
173 struct client_s
*client
= assuan_get_pointer(ctx
);
175 if (gpg_err_source(e
) == GPG_ERR_SOURCE_UNKNOWN
)
182 return assuan_process_done(ctx
, 0);
185 log_write("%s", pwmd_strerror(e
));
189 if (gpg_err_code(e
) == GPG_ERR_BAD_DATA
) {
190 xmlErrorPtr xe
= client
->xml_error
;
193 xe
= xmlGetLastError();
195 log_write("%s", xe
->message
);
196 if (client
->last_error
)
197 g_free(client
->last_error
);
199 client
->last_error
= g_strdup(xe
->message
);
202 e
= assuan_process_done(ctx
, assuan_set_error(ctx
, e
,
203 xe
? xe
->message
: NULL
));
205 if (xe
== client
->xml_error
)
210 client
->xml_error
= NULL
;
214 return assuan_process_done(ctx
, assuan_set_error(ctx
, e
, pwmd_strerror(e
)));
217 int assuan_log_cb(assuan_context_t ctx
, void *data
, unsigned cat
,
220 static pthread_mutex_t m
= PTHREAD_MUTEX_INITIALIZER
;
222 gboolean match
= FALSE
;
224 pthread_mutex_lock(&m
);
225 pthread_cleanup_push((void (*)(void *))pthread_mutex_unlock
, &m
);
226 t
= g_strv_length(debug_level
);
228 for (i
= 0; i
< t
; i
++) {
229 if (!g_ascii_strcasecmp(debug_level
[i
], (gchar
*)"init")
230 && cat
== ASSUAN_LOG_INIT
) {
235 if (!g_ascii_strcasecmp(debug_level
[i
], (gchar
*)"ctx")
236 && cat
== ASSUAN_LOG_CTX
) {
241 if (!g_ascii_strcasecmp(debug_level
[i
], (gchar
*)"engine")
242 && cat
== ASSUAN_LOG_ENGINE
) {
247 if (!g_ascii_strcasecmp(debug_level
[i
], (gchar
*)"data")
248 && cat
== ASSUAN_LOG_DATA
) {
253 if (!g_ascii_strcasecmp(debug_level
[i
], (gchar
*)"sysio")
254 && cat
== ASSUAN_LOG_SYSIO
) {
259 if (!g_ascii_strcasecmp(debug_level
[i
], (gchar
*)"control")
260 && cat
== ASSUAN_LOG_CONTROL
) {
270 if ((fd
= open(logfile
, O_WRONLY
|O_CREAT
|O_APPEND
, 0600)) == -1)
273 pthread_cleanup_push(cleanup_fd_cb
, &fd
);
274 write(fd
, msg
, strlen(msg
));
275 pthread_cleanup_pop(1);
280 fprintf(stderr
, "%s%s", data
? (gchar
*)data
: "", msg
);
285 pthread_cleanup_pop(1);
289 void log_write(const gchar
*fmt
, ...)
299 pthread_t tid
= pthread_self();
300 static pthread_mutex_t m
= PTHREAD_MUTEX_INITIALIZER
;
302 if ((!logfile
&& !isatty(STDERR_FILENO
) && !log_syslog
) || !fmt
)
305 pthread_mutex_lock(&m
);
306 pthread_cleanup_push((void (*)(void *))pthread_mutex_unlock
, &m
);
307 pthread_cleanup_push(cleanup_fd_cb
, &fd
);
309 if (!cmdline
&& logfile
) {
310 if ((fd
= open(logfile
, O_WRONLY
|O_CREAT
|O_APPEND
, 0600)) == -1)
316 if (g_vasprintf(&args
, fmt
, ap
) != -1) {
318 pthread_cleanup_push(g_free
, args
);
319 fprintf(stderr
, "%s\n", args
);
321 pthread_cleanup_pop(1);
324 pthread_cleanup_push(g_free
, args
);
325 name
= pthread_getspecific(thread_name_key
);
326 name
= print_fmt(buf
, sizeof(buf
), "%s(%p): ",
327 name
? name
: _("unknown"), (pthread_t
*)tid
);
329 if (!cmdline
&& log_syslog
&& !nofork
)
330 syslog(LOG_INFO
, "%s%s", name
, args
);
333 tm
= localtime(&now
);
334 strftime(tbuf
, sizeof(tbuf
), "%b %d %Y %H:%M:%S ", tm
);
335 tbuf
[sizeof(tbuf
) - 1] = 0;
337 if (args
[strlen(args
)-1] == '\n')
338 args
[strlen(args
)-1] = 0;
340 line
= g_strdup_printf("%s %i %s%s\n", tbuf
, getpid(), name
,
342 pthread_cleanup_pop(1);
344 pthread_cleanup_push(g_free
, line
);
345 if (logfile
&& fd
!= -1) {
346 write(fd
, line
, strlen(line
));
351 fprintf(stdout
, "%s", line
);
355 pthread_cleanup_pop(1);
361 pthread_cleanup_pop(1);
362 pthread_cleanup_pop(0);
363 pthread_mutex_unlock(&m
);
367 static gint
secure_mem_check(const void *arg
)
373 static gpg_error_t
setup_crypto()
375 gcry_control(GCRYCTL_SET_THREAD_CBS
, &gcry_threads_pthread
);
377 if (!gcry_check_version(GCRYPT_VERSION
)) {
378 fprintf(stderr
, _("gcry_check_version(): Incompatible libgcrypt. "
379 "Wanted %s, got %s.\n"), GCRYPT_VERSION
,
380 gcry_check_version(NULL
));
381 return GPG_ERR_UNKNOWN_VERSION
;
384 gcry_set_allocation_handler(g_malloc
, g_malloc
, NULL
, g_realloc
, g_free
);
388 static gpg_error_t
validate_peer(struct client_s
*cl
)
391 gboolean allowed
= FALSE
;
392 assuan_peercred_t peercred
;
400 rc
= assuan_get_peercred(cl
->ctx
, &peercred
);
404 users
= g_key_file_get_string_list(keyfileh
, "global", "allowed", NULL
, NULL
);
407 for (gchar
**p
= users
; *p
; p
++) {
408 struct passwd pw
, *result
;
409 struct group gr
, *gresult
;
413 size_t len
= sysconf(_SC_GETGR_R_SIZE_MAX
);
422 return GPG_ERR_ENOMEM
;
425 if (!getgrnam_r(*(p
)+1, &gr
, buf
, len
, &gresult
) && gresult
) {
426 if (gresult
->gr_gid
== peercred
->gid
) {
432 len
= sysconf(_SC_GETPW_R_SIZE_MAX
);
437 gchar
*tbuf
= g_malloc(len
);
439 for (gchar
**t
= gresult
->gr_mem
; *t
; t
++) {
440 if (!getpwnam_r(*t
, &pw
, tbuf
, len
, &result
) && result
) {
441 if (result
->pw_uid
== peercred
->uid
) {
456 size_t len
= sysconf(_SC_GETPW_R_SIZE_MAX
);
465 return GPG_ERR_ENOMEM
;
468 if (!getpwnam_r(*p
, &pw
, buf
, len
, &result
) && result
) {
469 if (result
->pw_uid
== peercred
->uid
) {
483 log_write("peer %s: uid=%i, gid=%i, pid=%i",
484 allowed
? _("accepted") : _("rejected"), peercred
->uid
,
485 peercred
->gid
, peercred
->pid
);
486 return allowed
? 0 : GPG_ERR_INV_USER_ID
;
489 static void xml_error_cb(void *data
, xmlErrorPtr e
)
491 struct client_s
*client
= data
;
494 * Keep the first reported error as the one to show in the error
495 * description. Reset in send_error().
497 if (client
->xml_error
)
500 xmlCopyError(e
, client
->xml_error
);
503 static pid_t
hook_waitpid(assuan_context_t ctx
, pid_t pid
, int action
,
504 int *status
, int options
)
506 return waitpid(pid
, status
, options
);
509 static ssize_t
hook_read(assuan_context_t ctx
, assuan_fd_t fd
, void *data
,
513 struct client_s
*client
= assuan_get_pointer(ctx
);
515 if (client
->thd
->remote
)
516 return tls_read_hook(ctx
, (gint
)fd
, data
, len
);
519 return read((gint
)fd
, data
, len
);
522 static ssize_t
hook_write(assuan_context_t ctx
, assuan_fd_t fd
,
523 const void *data
, size_t len
)
526 struct client_s
*client
= assuan_get_pointer(ctx
);
528 if (client
->thd
->remote
)
529 return tls_write_hook(ctx
, (gint
)fd
, data
, len
);
532 return write((gint
)fd
, data
, len
);
535 static gboolean
new_connection(struct client_s
*cl
)
538 static struct assuan_malloc_hooks mhooks
= { g_malloc
, g_realloc
, g_free
};
539 static struct assuan_system_hooks shooks
= {
540 ASSUAN_SYSTEM_HOOKS_VERSION
,
548 NULL
, //sendmsg both are used for FD passing
557 if (cl
->thd
->remote
) {
558 gchar
*prio
= get_key_file_string("global", "tls_cipher_suite");
560 cl
->thd
->tls
= tls_init(cl
->thd
->fd
, prio
);
567 rc
= assuan_new_ext(&cl
->ctx
, GPG_ERR_SOURCE_DEFAULT
, &mhooks
,
568 debug_level
? assuan_log_cb
: NULL
, NULL
);
572 assuan_ctx_set_system_hooks(cl
->ctx
, &shooks
);
573 rc
= assuan_init_socket_server(cl
->ctx
, cl
->thd
->fd
, 2);
577 assuan_set_pointer(cl
->ctx
, cl
);
578 assuan_set_hello_line(cl
->ctx
, PACKAGE_STRING
);
579 rc
= register_commands(cl
->ctx
);
583 rc
= assuan_accept(cl
->ctx
);
587 rc
= validate_peer(cl
);
588 /* May not be implemented on all platforms. */
589 if (rc
&& gpg_err_code(rc
) != GPG_ERR_ASS_GENERAL
)
592 rc
= init_client_crypto(&cl
->crypto
);
596 cl
->crypto
->agent
->client_ctx
= cl
->ctx
;
597 cl
->crypto
->client_ctx
= cl
->ctx
;
598 xmlSetStructuredErrorFunc(cl
, xml_error_cb
);
602 log_write("%s", pwmd_strerror(rc
));
607 * This is called after a client_thread() terminates. Set with
608 * pthread_cleanup_push().
610 static void cleanup_cb(void *arg
)
612 struct client_thread_s
*cn
= arg
;
613 struct client_s
*cl
= cn
->cl
;
615 MUTEX_LOCK(&cn_mutex
);
616 cn_thread_list
= g_slist_remove(cn_thread_list
, cn
);
617 MUTEX_UNLOCK(&cn_mutex
);
624 gnutls_deinit(cn
->tls
->ses
);
631 assuan_release(cl
->ctx
);
632 else if (cl
->thd
&& cl
->thd
->fd
!= -1)
636 cleanup_crypto(&cl
->crypto
);
645 while (cn
->msg_queue
) {
646 struct status_msg_s
*msg
= cn
->msg_queue
;
648 cn
->msg_queue
= msg
->next
;
653 if (cn
->status_msg_pipe
[0] != -1)
654 close(cn
->status_msg_pipe
[0]);
656 if (cn
->status_msg_pipe
[1] != -1)
657 close(cn
->status_msg_pipe
[1]);
659 pthread_mutex_destroy(&cn
->status_mutex
);
660 log_write(_("exiting, fd=%i"), cn
->fd
);
662 send_status_all(STATUS_CLIENTS
, NULL
);
663 pthread_cond_signal(&quit_cond
);
666 static gpg_error_t
send_msg_queue(struct client_thread_s
*thd
)
668 MUTEX_LOCK(&thd
->status_mutex
);
672 read(thd
->status_msg_pipe
[0], &c
, 1);
674 while (thd
->msg_queue
) {
675 struct status_msg_s
*msg
= thd
->msg_queue
;
677 thd
->msg_queue
= thd
->msg_queue
->next
;
678 MUTEX_UNLOCK(&thd
->status_mutex
);
679 rc
= send_status(thd
->cl
->ctx
, msg
->s
, msg
->line
);
680 MUTEX_LOCK(&thd
->status_mutex
);
688 MUTEX_UNLOCK(&thd
->status_mutex
);
692 static void *client_thread(void *data
)
694 struct client_thread_s
*thd
= data
;
695 struct client_s
*cl
= g_malloc0(sizeof(struct client_s
));
697 #ifdef HAVE_PR_SET_NAME
698 prctl(PR_SET_NAME
, "client");
700 pthread_setspecific(thread_name_key
, g_strdup(__FUNCTION__
));
703 log_write("%s(%i): %s", __FILE__
, __LINE__
,
704 pwmd_strerror(GPG_ERR_ENOMEM
));
708 MUTEX_LOCK(&cn_mutex
);
709 pthread_cleanup_push(cleanup_cb
, thd
);
712 MUTEX_UNLOCK(&cn_mutex
);
714 if (new_connection(cl
)) {
715 gboolean finished
= FALSE
;
718 send_status_all(STATUS_CLIENTS
, NULL
);
719 rc
= send_status(cl
->ctx
, STATUS_CACHE
, NULL
);
721 log_write("%s(%i): %s", __FILE__
, __LINE__
, pwmd_strerror(rc
));
731 FD_SET(thd
->fd
, &rfds
);
732 FD_SET(thd
->status_msg_pipe
[0], &rfds
);
733 n
= thd
->fd
> thd
->status_msg_pipe
[0] ? thd
->fd
: thd
->status_msg_pipe
[0];
735 n
= select(n
+1, &rfds
, NULL
, NULL
, NULL
);
737 log_write("%s", strerror(errno
));
741 if (FD_ISSET(thd
->status_msg_pipe
[0], &rfds
)) {
742 rc
= send_msg_queue(thd
);
743 if (rc
&& gpg_err_code(rc
) != GPG_ERR_EPIPE
) {
744 log_write("%s(%i): %s", __FUNCTION__
, __LINE__
,
750 if (!FD_ISSET(thd
->fd
, &rfds
))
753 rc
= assuan_process_next(cl
->ctx
, &eof
);
755 if (gpg_err_code(rc
) == GPG_ERR_EOF
|| eof
)
758 log_write("assuan_process_next(): %s", pwmd_strerror(rc
));
759 rc
= send_error(cl
->ctx
, rc
);
762 log_write("assuan_process_done(): %s", pwmd_strerror(rc
));
767 /* Since the msg queue pipe fd's are non-blocking, check for
768 * pending status msgs here. GPG_ERR_EPIPE can be seen when the
769 * client has already disconnected and will be converted to
770 * GPG_ERR_EOF during assuan_process_next().
772 rc
= send_msg_queue(thd
);
773 if (rc
&& gpg_err_code(rc
) != GPG_ERR_EPIPE
) {
774 log_write("%s(%i): %s", __FUNCTION__
, __LINE__
,
781 pthread_cleanup_pop(1);
785 static gboolean
xml_import(const gchar
*filename
, const gchar
*outfile
,
786 const gchar
*keygrip
, const char *sign_keygrip
, const gchar
*keyfile
,
787 gboolean no_passphrase
, const gchar
*cipher
, const gchar
*params
,
797 struct crypto_s
*crypto
;
798 gint algo
= cipher
? cipher_string_to_gcrypt((gchar
*)cipher
) :
802 log_write("%s", pwmd_strerror(GPG_ERR_CIPHER_ALGO
));
806 if (stat(filename
, &st
) == -1) {
807 log_write("%s: %s", filename
, pwmd_strerror(gpg_error_from_syserror()));
811 rc
= init_client_crypto(&crypto
);
815 memcpy(&crypto
->save
.hdr
, &crypto
->hdr
, sizeof(file_header_t
));
816 crypto
->save
.hdr
.flags
= set_cipher_flag(crypto
->save
.hdr
.flags
, algo
);
817 log_write(_("Importing XML from '%s'. Output will be written to '%s' ..."),
820 if ((fd
= open(filename
, O_RDONLY
)) == -1) {
821 log_write("%s: %s", filename
, pwmd_strerror(gpg_error_from_syserror()));
825 if ((xmlbuf
= xmalloc(st
.st_size
+1)) == NULL
) {
827 log_write("%s(%i): %s", __FILE__
, __LINE__
, pwmd_strerror(GPG_ERR_ENOMEM
));
831 if (read(fd
, xmlbuf
, st
.st_size
) == -1) {
832 rc
= gpg_error_from_syserror();
834 log_write("%s: %s", filename
, pwmd_strerror(rc
));
839 xmlbuf
[st
.st_size
] = 0;
841 * Make sure the document validates.
843 if ((doc
= xmlReadDoc(xmlbuf
, NULL
, "UTF-8", XML_PARSE_NOBLANKS
)) == NULL
) {
844 log_write("xmlReadDoc() failed");
850 xmlNodePtr n
= xmlDocGetRootElement(doc
);
851 if (strcmp((gchar
*)n
->name
, (gchar
*)"pwmd")) {
852 log_write(_("Could not find root \"pwmd\" element."));
853 rc
= GPG_ERR_BAD_DATA
;
857 rc
= validate_import(n
? n
->children
: n
);
860 log_write("%s", pwmd_strerror(rc
));
865 xmlDocDumpMemory(doc
, &xml
, &len
);
867 crypto
->save
.s2k_count
= (gulong
)s2k_count
;
868 rc
= set_pinentry_options(crypto
->agent
);
870 rc
= export_common(crypto
, keygrip
, sign_keygrip
, no_passphrase
, xml
,
871 len
, outfile
, params
, keyfile
);
875 send_error(NULL
, rc
);
879 cleanup_crypto(&crypto
);
883 cleanup_crypto(&crypto
);
887 static gboolean
do_cache_push(const gchar
*filename
, struct crypto_s
*crypto
)
894 struct cache_data_s
*cdata
;
898 log_write(_("Trying to add datafile '%s' to the file cache ..."),
901 if (valid_filename(filename
) == FALSE
) {
902 log_write(_("%s: Invalid characters in filename"), filename
);
906 rc
= read_data_file(filename
, crypto
);
908 log_write("%s", pwmd_strerror(rc
));
912 if ((key
= get_key_file_string(filename
, "passphrase"))) {
913 log_write(_("Trying the passphrase specified in config ..."));
914 keylen
= strlen(key
);
916 else if ((key
= get_key_file_string(filename
, "passphrase_file"))) {
917 gint fd
= open((gchar
*)key
, O_RDONLY
);
920 log_write(_("Trying the passphrase using file '%s' ..."), key
);
922 log_write("%s: %s", key
, pwmd_strerror(gpg_error_from_syserror()));
927 stat((gchar
*)key
, &st
);
929 key
= g_malloc(st
.st_size
);
930 if (read(fd
, key
, st
.st_size
) != st
.st_size
) {
931 log_write("short read() count");
941 rc
= set_agent_passphrase(crypto
, key
, keylen
);
944 log_write("%s", pwmd_strerror(rc
));
949 crypto
->filename
= g_strdup(filename
);
950 rc
= decrypt_data(NULL
, crypto
);
952 log_write("%s", pwmd_strerror(rc
));
956 doc
= parse_doc((gchar
*)crypto
->plaintext
, crypto
->plaintext_len
);
958 log_write("%s", pwmd_strerror(GPG_ERR_ENOMEM
));
962 gcry_md_hash_buffer(GCRY_MD_MD5
, md5file
, filename
, strlen(filename
));
963 cdata
= g_malloc0(sizeof(struct cache_data_s
));
966 log_write("%s", pwmd_strerror(GPG_ERR_ENOMEM
));
970 rc
= get_checksum(filename
, &crc
, &len
);
972 log_write("%s", pwmd_strerror(rc
));
974 free_cache_data_once(cdata
);
979 rc
= encrypt_xml(NULL
, cache_key
, cache_keysize
, GCRY_CIPHER_AES
,
980 crypto
->plaintext
, crypto
->plaintext_len
, &cdata
->doc
,
981 &cdata
->doclen
, &cache_iv
, &cache_blocksize
, 0);
983 log_write("%s", pwmd_strerror(rc
));
985 free_cache_data_once(cdata
);
989 gcry_sexp_build((gcry_sexp_t
*)&cdata
->pubkey
, NULL
, "%S", crypto
->pkey_sexp
);
990 gcry_sexp_build((gcry_sexp_t
*)&cdata
->sigkey
, NULL
, "%S", crypto
->sigpkey_sexp
);
991 gint timeout
= get_key_file_integer(filename
, "cache_timeout");
992 cache_add_file(md5file
, crypto
->grip
, cdata
, timeout
);
993 log_write(_("Successfully added '%s' to the cache."), filename
);
997 static gpg_error_t
init_client_thread(gint fd
, const gchar
*addr
)
1000 struct client_thread_s
*new = g_malloc0(sizeof(struct client_thread_s
));
1004 return GPG_ERR_ENOMEM
;
1007 MUTEX_LOCK(&cn_mutex
);
1008 pthread_cleanup_push(cleanup_mutex_cb
, &cn_mutex
);
1010 if (pipe(new->status_msg_pipe
) == -1)
1011 rc
= gpg_error_from_syserror();
1014 fcntl(new->status_msg_pipe
[0], F_SETFL
, O_NONBLOCK
);
1015 fcntl(new->status_msg_pipe
[1], F_SETFL
, O_NONBLOCK
);
1016 pthread_mutex_init(&new->status_mutex
, NULL
);
1021 new->remote
= addr
? TRUE
: FALSE
;
1024 rc
= create_thread(client_thread
, new, &new->tid
, TRUE
);
1026 close(new->status_msg_pipe
[0]);
1027 close(new->status_msg_pipe
[1]);
1028 pthread_mutex_destroy(&new->status_mutex
);
1033 cn_thread_list
= g_slist_append(cn_thread_list
, new);
1035 log_write(_("new connection: tid=%p, fd=%i, addr=%s"),
1036 (pthread_t
*)new->tid
, fd
, addr
);
1038 log_write(_("new connection: tid=%p, fd=%i"),
1039 (pthread_t
*)new->tid
, fd
);
1042 pthread_cleanup_pop(1);
1047 log_write("%s(%i): pthread_create(): %s", __FILE__
, __LINE__
,
1054 /* From Beej's Guide to Network Programming. It's a good tutorial. */
1055 static void *get_in_addr(struct sockaddr
*sa
)
1057 if (sa
->sa_family
== AF_INET
)
1058 return &(((struct sockaddr_in
*)sa
)->sin_addr
);
1060 return &(((struct sockaddr_in6
*)sa
)->sin6_addr
);
1063 static void *tcp_accept_thread(void *arg
)
1065 gint sockfd
= *(gint
*)arg
;
1067 #ifdef HAVE_PR_SET_NAME
1068 prctl(PR_SET_NAME
, "tcp_accept");
1070 pthread_setspecific(thread_name_key
, g_strdup(__FUNCTION__
));
1073 struct sockaddr_storage raddr
;
1074 socklen_t slen
= sizeof(raddr
);
1078 gchar s
[INET6_ADDRSTRLEN
];
1080 fd
= accept(sockfd
, (struct sockaddr
*)&raddr
, &slen
);
1082 if (errno
!= EAGAIN
) {
1083 if (!quit
) // probably EBADF
1084 log_write("accept(): %s", strerror(errno
));
1095 inet_ntop(raddr
.ss_family
, get_in_addr((struct sockaddr
*)&raddr
),
1097 (void)init_client_thread(fd
, s
);
1098 t
= get_key_file_string("global", "tcp_wait");
1099 n
= strtol(t
, NULL
, 10);
1105 /* Just in case accept() failed for some reason other than EBADF */
1110 static gboolean
start_stop_tls_with_protocol(gboolean ipv6
, gboolean term
)
1112 struct addrinfo hints
, *servinfo
, *p
;
1113 gint port
= get_key_file_integer("global", "tcp_port");
1117 gint
*fd
= ipv6
? &tls6_fd
: &tls_fd
;
1119 if (term
|| get_key_file_boolean("global", "enable_tcp") == FALSE
) {
1120 if (tls6_fd
!= -1) {
1121 pthread_cancel(tls6_tid
);
1122 pthread_join(tls6_tid
, NULL
);
1123 shutdown(tls6_fd
, SHUT_RDWR
);
1129 pthread_cancel(tls_tid
);
1130 pthread_join(tls_tid
, NULL
);
1131 shutdown(tls_fd
, SHUT_RDWR
);
1136 /* A client may still be connected. */
1137 if (!quit
&& x509_cred
!= NULL
)
1138 tls_deinit_params();
1143 if ((ipv6
&& tls6_fd
!= -1) || (!ipv6
&& tls_fd
!= -1))
1146 memset(&hints
, 0, sizeof(hints
));
1147 hints
.ai_family
= ipv6
? AF_INET6
: AF_INET
;
1148 hints
.ai_socktype
= SOCK_STREAM
;
1149 hints
.ai_flags
= AI_PASSIVE
;
1151 if ((n
= getaddrinfo(NULL
, print_fmt(buf
, sizeof(buf
), "%i", port
),
1152 &hints
, &servinfo
)) == -1) {
1153 log_write("getaddrinfo(): %s", gai_strerror(n
));
1157 for (n
= 0, p
= servinfo
; p
!= NULL
; p
= p
->ai_next
) {
1158 if ((ipv6
&& p
->ai_family
!= AF_INET6
)
1159 || (!ipv6
&& p
->ai_family
!= AF_INET
))
1162 if ((*fd
= socket(p
->ai_family
, p
->ai_socktype
,
1163 p
->ai_protocol
)) == -1) {
1164 log_write("socket(): %s", strerror(errno
));
1168 if (setsockopt(*fd
, SOL_SOCKET
, SO_REUSEADDR
, &n
,
1169 sizeof(int)) == -1) {
1170 log_write("setsockopt(): %s", strerror(errno
));
1171 freeaddrinfo(servinfo
);
1175 if (bind(*fd
, p
->ai_addr
, p
->ai_addrlen
) == -1) {
1177 log_write("bind(): %s", strerror(errno
));
1185 freeaddrinfo(servinfo
);
1188 log_write("%s", _("could not bind"));
1192 #ifdef HAVE_DECL_SO_BINDTODEVICE
1193 if (g_key_file_has_key(keyfileh
, "global", "tcp_interface", NULL
)) {
1194 gchar
*tmp
= get_key_file_string("global", "tcp_interface");
1196 if (setsockopt(*fd
, SOL_SOCKET
, SO_BINDTODEVICE
, tmp
, 1)
1198 log_write("setsockopt(): %s", strerror(errno
));
1207 if (x509_cred
== NULL
) {
1208 rc
= tls_init_params();
1213 if (listen(*fd
, 0) == -1) {
1214 log_write("listen(): %s", strerror(errno
));
1219 rc
= create_thread(tcp_accept_thread
, fd
, &tls6_tid
, FALSE
);
1221 rc
= create_thread(tcp_accept_thread
, fd
, &tls_tid
, FALSE
);
1224 log_write("%s(%i): pthread_create(): %s", __FILE__
, __LINE__
,
1232 start_stop_tls_with_protocol(FALSE
, TRUE
);
1244 static gboolean
start_stop_tls(gboolean term
)
1246 gchar
*s
= get_key_file_string("global", "tcp_bind");
1252 if (!strcmp(s
, "any")) {
1253 b
= start_stop_tls_with_protocol(FALSE
, term
);
1255 b
= start_stop_tls_with_protocol(TRUE
, term
);
1257 else if (!strcmp(s
, "ipv4"))
1258 b
= start_stop_tls_with_protocol(FALSE
, term
);
1259 else if (!strcmp(s
, "ipv6"))
1260 b
= start_stop_tls_with_protocol(TRUE
, term
);
1269 static void *accept_thread(void *arg
)
1271 gint sockfd
= *(gint
*)arg
;
1273 #ifdef HAVE_PR_SET_NAME
1274 prctl(PR_SET_NAME
, "accept");
1276 pthread_setspecific(thread_name_key
, g_strdup(__FUNCTION__
));
1279 socklen_t slen
= sizeof(struct sockaddr_un
);
1280 struct sockaddr_un raddr
;
1283 fd
= accept(sockfd
, (struct sockaddr
*)&raddr
, &slen
);
1285 if (errno
!= EAGAIN
) {
1286 if (!quit
) // probably EBADF
1287 log_write("accept(): %s", pwmd_strerror(gpg_error_from_syserror()));
1294 (void)init_client_thread(fd
, NULL
);
1297 /* Just in case accept() failed for some reason other than EBADF */
1302 static void *cache_timer_thread(void *arg
)
1304 #ifdef HAVE_PR_SET_NAME
1305 prctl(PR_SET_NAME
, "cache timer");
1307 pthread_setspecific(thread_name_key
, g_strdup(__FUNCTION__
));
1311 cache_adjust_timeout();
1317 static void catch_sigabrt(int sig
)
1325 static gboolean
signal_loop(sigset_t sigset
)
1327 gboolean done
= FALSE
;
1328 gboolean sigint
= FALSE
;
1331 gint sig
= sigwaitinfo(&sigset
, NULL
);
1334 if (errno
!= EAGAIN
)
1335 log_write("sigwaitinfo(): %s", strerror(errno
));
1340 log_write(_("caught signal %i (%s)"), sig
, strsignal(sig
));
1344 pthread_cond_signal(&rcfile_cond
);
1347 // not really handled here.
1348 catch_sigabrt(SIGABRT
);
1351 log_write(_("clearing file cache"));
1353 send_status_all(STATUS_CACHE
, NULL
);
1368 static void catchsig(int sig
)
1370 log_write("Caught SIGSEGV. Exiting.");
1371 #ifdef HAVE_BACKTRACE
1372 BACKTRACE(__FUNCTION__
);
1377 static void *waiting_for_exit(void *arg
)
1379 #ifdef HAVE_PR_SET_NAME
1380 prctl(PR_SET_NAME
, "exiting");
1382 pthread_setspecific(thread_name_key
, g_strdup(__FUNCTION__
));
1383 log_write(_("waiting for all clients to disconnect"));
1384 MUTEX_LOCK(&quit_mutex
);
1385 pthread_cleanup_push(cleanup_mutex_cb
, &quit_mutex
);
1388 MUTEX_LOCK(&cn_mutex
);
1389 gint n
= g_slist_length(cn_thread_list
);
1390 MUTEX_UNLOCK(&cn_mutex
);
1394 log_write(_("%i clients remain"), n
);
1395 pthread_cond_wait(&quit_cond
, &quit_mutex
);
1398 pthread_cleanup_pop(1);
1399 kill(getpid(), SIGUSR2
);
1403 static gboolean
server_loop(gint sockfd
, gchar
**socketpath
)
1405 pthread_t accept_tid
;
1406 pthread_t cache_timeout_tid
;
1409 gboolean segv
= FALSE
;
1413 sigemptyset(&sigset
);
1416 sigaddset(&sigset
, SIGTERM
);
1417 sigaddset(&sigset
, SIGINT
);
1419 /* Clears the file cache. */
1420 sigaddset(&sigset
, SIGUSR1
);
1422 /* Configuration file reloading. */
1423 sigaddset(&sigset
, SIGHUP
);
1425 /* For exiting cleanly. */
1426 sigaddset(&sigset
, SIGUSR2
);
1428 /* Clears the cache and exits when something bad happens. */
1429 signal(SIGABRT
, catch_sigabrt
);
1430 sigaddset(&sigset
, SIGABRT
);
1431 sigprocmask(SIG_BLOCK
, &sigset
, NULL
);
1433 /* Ignored everywhere. When a client disconnects abnormally this signal
1434 * gets raised. It isn't needed though because client_thread() will check
1435 * for rcs even after the client disconnects. */
1436 signal(SIGPIPE
, SIG_IGN
);
1438 /* Can show a backtrace of the stack in the log. */
1439 signal(SIGSEGV
, catchsig
);
1442 /* Needs to be done after the fork(). */
1443 if (!start_stop_tls(FALSE
)) {
1449 pthread_mutex_init(&quit_mutex
, NULL
);
1450 pthread_cond_init(&quit_cond
, NULL
);
1451 log_write(_("%s started for user %s"), PACKAGE_STRING
, g_get_user_name());
1452 #ifndef HAVE_DECL_SO_PEERCRED
1453 log_write(_("Peer credential checking is NOT supported on this OS."));
1456 if (get_key_file_boolean("global", "enable_tcp"))
1457 log_write(_("Listening on %s and TCP port %i"), *socketpath
,
1458 get_key_file_integer("global", "tcp_port"));
1460 log_write(_("Listening on %s"), *socketpath
);
1462 log_write(_("Listening on %s"), *socketpath
);
1465 rc
= create_thread(reload_rcfile_thread
, NULL
, &rcfile_tid
, FALSE
);
1467 log_write("%s(%i): pthread_create(): %s", __FILE__
, __LINE__
,
1472 rc
= create_thread(cache_timer_thread
, NULL
, &cache_timeout_tid
, TRUE
);
1474 log_write("%s(%i): pthread_create(): %s", __FILE__
, __LINE__
,
1479 rc
= create_thread(accept_thread
, &sockfd
, &accept_tid
, TRUE
);
1481 log_write("%s(%i): pthread_create(): %s", __FILE__
, __LINE__
,
1486 sigdelset(&sigset
, SIGUSR2
);
1488 signal_loop(sigset
);
1494 * We're out of the main server loop. This happens when a signal was sent
1495 * to terminate the daemon. We'll wait for all clients to disconnect
1496 * before exiting but exit immediately if another termination signal is
1499 pthread_cancel(accept_tid
);
1500 shutdown(sockfd
, SHUT_RDWR
);
1502 unlink(*socketpath
);
1503 g_free(*socketpath
);
1505 MUTEX_LOCK(&cn_mutex
);
1506 n
= g_slist_length(cn_thread_list
);
1507 MUTEX_UNLOCK(&cn_mutex
);
1512 rc
= create_thread(waiting_for_exit
, NULL
, &tid
, TRUE
);
1514 sigaddset(&sigset
, SIGUSR2
);
1515 if (signal_loop(sigset
)) {
1516 log_write(_("Received second termination request. Exiting."));
1517 pthread_cancel(tid
);
1521 log_write("%s(%i): pthread_create(): %s", __FILE__
, __LINE__
,
1525 pthread_cancel(cache_timeout_tid
);
1526 MUTEX_LOCK(&cn_mutex
);
1528 n
= g_slist_length(cn_thread_list
);
1530 for (i
= 0; i
< n
; i
++) {
1531 struct client_thread_s
*thd
= g_slist_nth_data(cn_thread_list
, i
);
1533 if (thd
->fd
!= -1) {
1540 MUTEX_UNLOCK(&cn_mutex
);
1542 start_stop_tls(TRUE
);
1546 pthread_cond_destroy(&quit_cond
);
1547 pthread_mutex_destroy(&quit_mutex
);
1548 return segv
? EXIT_FAILURE
: EXIT_SUCCESS
;;
1551 static void startup_failure()
1553 log_write(_("Failed to add a file to the cache. Use --ignore to force startup. Exiting."));
1557 /* This is called from cache.c:clear_once(). See
1558 * command.c:clearcache_command() for details about lock checking.
1560 static gpg_error_t
free_cache_data(file_cache_t
*cache
)
1562 gpg_error_t rc
= GPG_ERR_NO_DATA
;
1564 struct client_thread_s
*found
= NULL
;
1565 gboolean self
= FALSE
;
1571 MUTEX_LOCK(&cn_mutex
);
1572 pthread_cleanup_push(cleanup_mutex_cb
, &cn_mutex
);
1573 t
= g_slist_length(cn_thread_list
);
1575 for (i
= 0; i
< t
; i
++) {
1576 struct client_thread_s
*thd
= g_slist_nth_data(cn_thread_list
, i
);
1581 if (!memcmp(thd
->cl
->md5file
, cache
->filename
,
1582 sizeof(cache
->filename
))) {
1583 if (pthread_equal(pthread_self(), thd
->tid
)) {
1589 /* Continue trying to find a client who has the same file open and
1590 * also has a lock. */
1591 rc
= cache_lock_mutex(thd
->cl
->ctx
, thd
->cl
->md5file
, -1, FALSE
, -1);
1600 if (self
&& (!rc
|| rc
== GPG_ERR_NO_DATA
))
1601 rc
= cache_lock_mutex(found
->cl
->ctx
, found
->cl
->md5file
, -1, FALSE
, -1);
1603 if (exiting
|| !rc
|| rc
== GPG_ERR_NO_DATA
) {
1604 free_cache_data_once(cache
->data
);
1606 cache
->defer_clear
= FALSE
;
1607 cache
->timeout
= -1;
1610 cache_unlock_mutex(found
->cl
->md5file
, FALSE
);
1616 cache
->defer_clear
= TRUE
;
1618 pthread_cleanup_pop(1);
1623 static gboolean
convert_v2_datafile(const gchar
*filename
, const gchar
*cipher
,
1624 const gchar
*keyfile
, const gchar
*keygrip
, const gchar
*sign_keygrip
,
1625 gboolean nopass
, const gchar
*outfile
, const gchar
*keyparam
,
1629 gpointer data
= NULL
;
1631 struct crypto_s
*crypto
= NULL
;
1635 if (outfile
[0] == '-' && outfile
[1] == 0)
1638 log_write(_("Converting version 2 data file \"%s\" ..."), filename
);
1639 if (access(filename
, R_OK
) == -1) {
1640 log_write("%s: %s", filename
, pwmd_strerror(gpg_error_from_syserror()));
1645 log_write(_("Using passphrase file \"%s\" for decryption ..."),
1647 if (access(keyfile
, R_OK
) == -1) {
1648 log_write("%s: %s", keyfile
,
1649 pwmd_strerror(gpg_error_from_syserror()));
1654 rc
= read_v2_datafile(filename
, keyfile
, &data
, &datalen
, &ver
, &algo
);
1656 log_write("%s", pwmd_strerror(rc
));
1661 algo
= cipher_string_to_gcrypt(cipher
);
1663 rc
= GPG_ERR_CIPHER_ALGO
;
1669 xmlDocPtr doc
= parse_doc(data
, datalen
);
1672 rc
= GPG_ERR_BAD_DATA
;
1676 rc
= convert_pre_212_elements(doc
);
1680 xmlDocDumpFormatMemory(doc
, (xmlChar
**)&data
, (gint
*)&datalen
, 0);
1682 rc
= GPG_ERR_ENOMEM
;
1690 rc
= init_client_crypto(&crypto
);
1692 rc
= set_pinentry_options(crypto
->agent
);
1694 memcpy(&crypto
->save
.hdr
, &crypto
->hdr
,
1695 sizeof(file_header_t
));
1696 crypto
->save
.hdr
.flags
= set_cipher_flag(crypto
->save
.hdr
.flags
, algo
);
1697 crypto
->save
.s2k_count
= (gulong
)s2k_count
;
1698 rc
= export_common(crypto
, keygrip
, sign_keygrip
, nopass
, data
,
1699 datalen
, outfile
, keyparam
,
1700 no_passphrase_file
? NULL
: keyfile
);
1702 log_write(_("Output written to \"%s\"."), outfile
);
1711 cleanup_crypto(&crypto
);
1714 log_write("%s", pwmd_strerror(rc
));
1715 return rc
? FALSE
: TRUE
;
1718 int main(int argc
, char *argv
[])
1721 struct sockaddr_un addr
;
1722 gchar buf
[PATH_MAX
];
1723 gchar
*socketpath
= NULL
, *socketdir
, *socketname
= NULL
;
1724 gchar
*socketarg
= NULL
;
1725 gchar
*datadir
= NULL
;
1729 gchar
**cache_push
= NULL
;
1730 gchar
*import
= NULL
, *keygrip
= NULL
, *sign_keygrip
= NULL
;
1731 gchar
*keyparam
= NULL
;
1732 gboolean rcfile_spec
= FALSE
;
1733 gint estatus
= EXIT_FAILURE
;
1735 gchar
*outfile
= NULL
;
1736 GMemVTable mtable
= { xmalloc
, xrealloc
, xfree
, xcalloc
, NULL
, NULL
};
1738 gboolean secure
= FALSE
;
1739 gint show_version
= 0;
1740 gboolean force
= FALSE
;
1741 gboolean no_passphrase
= FALSE
;
1743 gchar
*convertfile
= NULL
;
1744 gchar
*cipher
= NULL
;
1745 gchar
*keyfile
= NULL
;
1746 glong s2k_count
= -1;
1747 GError
*error
= NULL
;
1748 gchar
*debug_level_opt
= NULL
;
1749 GOptionContext
*context
;
1750 GOptionEntry options
[] =
1752 { "version", 0, 0, G_OPTION_ARG_NONE
, &show_version
,
1753 "version information", NULL
},
1754 { "no-fork", 'n', 0, G_OPTION_ARG_NONE
, &nofork
,
1755 "run as a foreground process", NULL
},
1756 { "disable-dump", 'D', 0, G_OPTION_ARG_NONE
, &secure
,
1757 "disable the LIST, XPATH and DUMP commands", NULL
},
1758 { "rcfile", 'f', 0, G_OPTION_ARG_FILENAME
, &rcfile
,
1759 "load the specified rcfile (~/.pwmd/config)", "filename" },
1760 { "ignore", 0, 0, G_OPTION_ARG_NONE
, &force
,
1761 "ignore cache failures on startup", NULL
},
1762 { "outfile", 'o', 0, G_OPTION_ARG_FILENAME
, &outfile
,
1763 "output file when importing (- for stdout)", "filename" },
1764 { "convert", 'C', 0, G_OPTION_ARG_FILENAME
, &convertfile
,
1765 "convert a version 2 data file to version 3", "filename" },
1766 { "passphrase-file", 'k', 0, G_OPTION_ARG_FILENAME
, &keyfile
,
1767 "for decryption when converting", "filename" },
1768 { "no-passphrase-file", 0, 0, G_OPTION_ARG_NONE
, &no_passphrase_file
,
1769 "no --passphrase-file after conversion", NULL
},
1770 { "import", 'I', 0, G_OPTION_ARG_FILENAME
, &import
,
1771 "import an XML file", "filename" },
1772 { "keygrip", 0, 0, G_OPTION_ARG_STRING
, &keygrip
,
1773 "the public keygrip to use for encryption", "hexstring"},
1774 { "sign-keygrip", 0, 0, G_OPTION_ARG_STRING
, &sign_keygrip
,
1775 "the keygrip to use for signing of the data", "hexstring"},
1776 { "keyparam", 0, 0, G_OPTION_ARG_STRING
, &keyparam
,
1777 "alternate key parameters to use (RSA-2048)", "s-exp"},
1778 { "no-passphrase", 0, 0, G_OPTION_ARG_NONE
, &no_passphrase
,
1779 "for the imported/converted keypair", NULL
},
1780 { "cipher", 0, 0, G_OPTION_ARG_STRING
, &cipher
,
1781 "encryption cipher, see man page (AES-256)", "string" },
1782 { "s2k-count", 0, 0, G_OPTION_ARG_INT64
, &s2k_count
,
1783 "hash iteration count >65536 (calibrated)", "iterations" },
1784 { "debug-level", 0, 0, G_OPTION_ARG_STRING
, &debug_level_opt
,
1785 "protocol output, see man page", "keywords"},
1790 #ifdef HAVE_SETRLIMIT
1793 rl
.rlim_cur
= rl
.rlim_max
= 0;
1795 if (setrlimit(RLIMIT_CORE
, &rl
) != 0)
1796 err(EXIT_FAILURE
, "setrlimit()");
1801 setlocale(LC_ALL
, "");
1802 bindtextdomain("pwmd", LOCALEDIR
);
1809 g_mem_set_vtable(&mtable
);
1810 g_thread_init(NULL
);
1817 gnutls_global_set_mem_functions(g_malloc
, g_malloc
, secure_mem_check
,
1819 gnutls_global_init();
1820 gnutls_global_set_log_function(tls_log
);
1821 gnutls_global_set_log_level(1);
1825 xmlMemSetup(g_free
, g_malloc
, g_realloc
, g_strdup
);
1830 g_snprintf(buf
, sizeof(buf
), "%s/.pwmd", g_get_home_dir());
1831 if (mkdir(buf
, 0700) == -1 && errno
!= EEXIST
)
1832 err(EXIT_FAILURE
, "%s", buf
);
1834 g_snprintf(buf
, sizeof(buf
), "%s/.pwmd/data", g_get_home_dir());
1835 if (mkdir(buf
, 0700) == -1 && errno
!= EEXIST
)
1836 err(EXIT_FAILURE
, "%s", buf
);
1839 context
= g_option_context_new("- Password Manager Daemon");
1840 g_option_context_add_main_entries(context
, options
, NULL
);
1841 if (!g_option_context_parse(context
, &argc
, &argv
, &error
))
1843 g_print("Option parsing failed: %s\n", error
->message
);
1849 "Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012\n"
1851 "Released under the terms of the GPL v2. Use at your own risk.\n\n"
1852 "Compile time features:\n%s"), PACKAGE_STRING
, PACKAGE_BUGREPORT
,
1882 pthread_mutexattr_t attr
;
1883 pthread_mutexattr_init(&attr
);
1884 pthread_mutexattr_settype(&attr
, PTHREAD_MUTEX_RECURSIVE
);
1885 pthread_mutex_init(&rcfile_mutex
, &attr
);
1886 pthread_cond_init(&rcfile_cond
, NULL
);
1887 pthread_mutex_init(&cn_mutex
, &attr
);
1888 pthread_mutexattr_destroy(&attr
);
1889 pthread_key_create(&last_error_key
, free_key
);
1892 rcfile
= g_strdup_printf("%s/.pwmd/config", g_get_home_dir());
1896 if ((keyfileh
= parse_rcfile(rcfile_spec
, cmdline
)) == NULL
)
1899 if (debug_level_opt
)
1900 debug_level
= g_strsplit(debug_level_opt
, ",", 0);
1902 if (g_key_file_has_key(keyfileh
, "global", "syslog", NULL
) == TRUE
)
1903 log_syslog
= g_key_file_get_boolean(keyfileh
, "global", "syslog", NULL
);
1905 if (log_syslog
== TRUE
)
1906 openlog("pwmd", LOG_NDELAY
|LOG_PID
, LOG_DAEMON
);
1908 if (g_key_file_has_key(keyfileh
, "global", "priority", NULL
)) {
1909 x
= g_key_file_get_integer(keyfileh
, "global", "priority", NULL
);
1912 if (setpriority(PRIO_PROCESS
, 0, x
) == -1) {
1913 log_write("setpriority(): %s", pwmd_strerror(gpg_error_from_syserror()));
1918 #ifdef HAVE_MLOCKALL
1919 if (disable_mlock
== FALSE
&& mlockall(MCL_CURRENT
|MCL_FUTURE
) == -1) {
1920 log_write("mlockall(): %s", pwmd_strerror(gpg_error_from_syserror()));
1925 rc
= cache_init(free_cache_data
);
1927 log_write("pwmd: gpg-agent: %s",
1928 gpg_err_code(rc
) == GPG_ERR_UNKNOWN_VERSION
1929 ? _("incompatible version: 2.1.0 or later required")
1930 : pwmd_strerror(rc
));
1934 if (s2k_count
== -1)
1935 s2k_count
= get_key_file_ulong(NULL
, "s2k_count");
1939 gchar
*tmp
= g_option_context_get_help(context
, TRUE
, NULL
);
1940 fprintf(stderr
, "%s", tmp
);
1945 estatus
= convert_v2_datafile(convertfile
, cipher
, keyfile
, keygrip
,
1946 sign_keygrip
, no_passphrase
, outfile
, keyparam
,
1948 g_key_file_free(keyfileh
);
1955 gchar
*tmp
= g_option_context_get_help(context
, TRUE
, NULL
);
1956 fprintf(stderr
, "%s", tmp
);
1961 if (outfile
[0] == '-' && outfile
[1] == 0)
1964 estatus
= xml_import(import
, outfile
, keygrip
, sign_keygrip
, keyfile
,
1965 no_passphrase
, cipher
, keyparam
, (gulong
)s2k_count
);
1966 g_key_file_free(keyfileh
);
1971 g_option_context_free(context
);
1972 if ((p
= g_key_file_get_string(keyfileh
, "global", "socket_path", NULL
)) == NULL
)
1973 errx(EXIT_FAILURE
, _("%s: socket_path not defined"), rcfile
);
1975 socketarg
= expand_homedir(p
);
1978 if ((p
= g_key_file_get_string(keyfileh
, "global", "data_directory", NULL
)) == NULL
)
1979 errx(EXIT_FAILURE
, _("%s: data_directory not defined"), rcfile
);
1981 datadir
= expand_homedir(p
);
1984 if (secure
== FALSE
&& g_key_file_has_key(keyfileh
, "global", "disable_list_and_dump", NULL
) == TRUE
) {
1985 n
= g_key_file_get_boolean(keyfileh
, "global", "disable_list_and_dump", NULL
);
1986 disable_list_and_dump
= n
;
1989 disable_list_and_dump
= secure
;
1991 setup_logging(keyfileh
);
1993 if (g_key_file_has_key(keyfileh
, "global", "cache_push", NULL
) == TRUE
)
1994 cache_push
= g_key_file_get_string_list(keyfileh
, "global", "cache_push", NULL
, NULL
);
1996 for (gint n
= 1; n
< argc
; n
++) {
1997 if (strv_printf(&cache_push
, "%s", argv
[n
]) == FALSE
)
1998 errx(EXIT_FAILURE
, "%s", pwmd_strerror(GPG_ERR_ENOMEM
));
2001 if (strchr(socketarg
, '/') == NULL
) {
2002 socketdir
= g_get_current_dir();
2003 socketname
= g_strdup(socketarg
);
2004 socketpath
= g_strdup_printf("%s/%s", socketdir
, socketname
);
2007 socketname
= g_strdup(strrchr(socketarg
, '/'));
2009 socketarg
[strlen(socketarg
) - strlen(socketname
) -1] = 0;
2010 socketdir
= g_strdup(socketarg
);
2011 socketpath
= g_strdup_printf("%s/%s", socketdir
, socketname
);
2014 if (chdir(datadir
)) {
2015 log_write("%s: %s", datadir
, pwmd_strerror(gpg_error_from_syserror()));
2021 * Set the cache entry for a file. Prompts for the password.
2024 struct crypto_s
*crypto
;
2025 gpg_error_t rc
= init_client_crypto(&crypto
);
2028 estatus
= EXIT_FAILURE
;
2032 rc
= set_pinentry_options(crypto
->agent
);
2034 estatus
= EXIT_FAILURE
;
2038 for (opt
= 0; cache_push
[opt
]; opt
++) {
2039 if (!do_cache_push(cache_push
[opt
], crypto
) && !force
) {
2040 g_strfreev(cache_push
);
2042 estatus
= EXIT_FAILURE
;
2043 cleanup_crypto(&crypto
);
2047 cleanup_crypto_stage1(crypto
);
2050 (void)kill_scd(crypto
->agent
);
2051 cleanup_crypto(&crypto
);
2052 g_strfreev(cache_push
);
2053 log_write(!nofork
? _("Done. Daemonizing...") : _("Done. Waiting for connections..."));
2056 clear_rcfile_keys();
2059 * bind() doesn't like the full pathname of the socket or any non alphanum
2060 * characters so change to the directory where the socket is wanted then
2061 * create it then change to datadir.
2063 if (chdir(socketdir
)) {
2064 log_write("%s: %s", socketdir
, pwmd_strerror(gpg_error_from_syserror()));
2070 if ((sockfd
= socket(PF_UNIX
, SOCK_STREAM
, 0)) == -1) {
2071 log_write("socket(): %s", pwmd_strerror(gpg_error_from_syserror()));
2075 addr
.sun_family
= AF_UNIX
;
2076 g_snprintf(addr
.sun_path
, sizeof(addr
.sun_path
), "%s", socketname
);
2078 if (bind(sockfd
, (struct sockaddr
*)&addr
, sizeof(struct sockaddr
)) == -1) {
2079 log_write("bind(): %s", pwmd_strerror(gpg_error_from_syserror()));
2081 if (errno
== EADDRINUSE
)
2082 log_write(_("Either there is another pwmd running or '%s' is a \n"
2083 "stale socket. Please remove it manually."), socketpath
);
2089 if (g_key_file_has_key(keyfileh
, "global", "socket_perms", NULL
) == TRUE
) {
2090 gchar
*t
= g_key_file_get_string(keyfileh
, "global", "socket_perms", NULL
);
2091 mode_t mode
= strtol(t
, NULL
, 8);
2092 mode_t mask
= umask(0);
2096 if (chmod(socketname
, mode
) == -1) {
2097 log_write("%s: %s", socketname
, pwmd_strerror(gpg_error_from_syserror()));
2107 g_free(--socketname
);
2109 if (chdir(datadir
)) {
2110 log_write("%s: %s", datadir
, pwmd_strerror(gpg_error_from_syserror()));
2118 if (listen(sockfd
, 0) == -1) {
2119 log_write("listen(): %s", pwmd_strerror(gpg_error_from_syserror()));
2128 log_write("fork(): %s", pwmd_strerror(gpg_error_from_syserror()));
2137 _exit(EXIT_SUCCESS
);
2141 pthread_key_create(&thread_name_key
, free_key
);
2142 pthread_setspecific(thread_name_key
, g_strdup("main"));
2143 estatus
= server_loop(sockfd
, &socketpath
);
2146 if (socketpath
&& do_unlink
) {
2153 gnutls_global_deinit();
2156 g_key_file_free(keyfileh
);
2158 pthread_cancel(rcfile_tid
);
2159 pthread_join(rcfile_tid
, NULL
);
2160 pthread_cond_destroy(&rcfile_cond
);
2161 pthread_mutex_destroy(&rcfile_mutex
);
2164 xmlCleanupGlobals();
2166 if (estatus
== EXIT_SUCCESS
)
2167 log_write(_("pwmd exiting normally"));
2169 #if defined(DEBUG) && !defined(MEM_DEBUG)