tincctl: restrict umask argument for FORTIFY

[tinc] / src / tincctl.c

diff --git a/src/tincctl.c b/src/tincctl.c
index 08f3018..99a34c7 100644 (file)
--- a/src/tincctl.c
+++ b/src/tincctl.c
@@ -40,6 +40,7 @@
 #include "tincctl.h"
 #include "top.h"
 #include "version.h"
+#include "subnet.h"
 
 #ifndef MSG_NOSIGNAL
 #define MSG_NOSIGNAL 0
@@ -237,7 +238,7 @@ static bool parse_options(int argc, char **argv) {
 FILE *fopenmask(const char *filename, const char *mode, mode_t perms) {
        mode_t mask = umask(0);
        perms &= ~mask;
-       umask(~perms);
+       umask(~perms & 0777);
        FILE *f = fopen(filename, mode);
 
        if(!f) {
@@ -262,19 +263,21 @@ static void disable_old_keys(const char *filename, const char *what) {
        bool disabled = false;
        bool block = false;
        bool error = false;
-       FILE *r, *w;
 
-       r = fopen(filename, "r");
+       FILE *r = fopen(filename, "r");
+       FILE *w = NULL;
 
        if(!r) {
                return;
        }
 
-       snprintf(tmpfile, sizeof(tmpfile), "%s.tmp", filename);
+       int result = snprintf(tmpfile, sizeof(tmpfile), "%s.tmp", filename);
 
-       struct stat st = {.st_mode = 0600};
-       fstat(fileno(r), &st);
-       w = fopenmask(tmpfile, "w", st.st_mode);
+       if(result < sizeof(tmpfile)) {
+               struct stat st = {.st_mode = 0600};
+               fstat(fileno(r), &st);
+               w = fopenmask(tmpfile, "w", st.st_mode);
+       }
 
        while(fgets(buf, sizeof(buf), r)) {
                if(!block && !strncmp(buf, "-----BEGIN ", 11)) {
@@ -1886,6 +1889,19 @@ static int cmd_config(int argc, char *argv[]) {
                found = true;
                variable = (char *)variables[i].name;
 
+               if(!strcasecmp(variable, "Subnet")) {
+                       subnet_t s = {0};
+
+                       if(!str2net(&s, value)) {
+                               fprintf(stderr, "Malformed subnet definition %s\n", value);
+                       }
+
+                       if(!subnetcheck(s)) {
+                               fprintf(stderr, "Network address and prefix length do not match: %s\n", value);
+                               return 1;
+                       }
+               }
+
                /* Discourage use of obsolete variables. */
 
                if(variables[i].type & VAR_OBSOLETE && action >= 0) {