/mandos/release : changes

» Changes from revision 237.7.800

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

From Revision 237.7.780 to 237.7.761

expand all

Rev	Summary	Authors	Date
237.7.780	Fix issue with french translation Fix issue with french translation Initial white space was missing in both msgid and msgstr of the french translation, leading to checking tools reporing an incomplete translation. The string is a raw command line command, and therefore did not need translation, so this was never a user-visible issue. * debian/po/fr.po: Add missing whitespace to the id and translation for msgid " mandos-keygen -F/dev/null\|grep ^key_id".	Teddy Hogeborn	3 years ago
237.7.779	Work around Debian bug #981302 Work around Debian bug #981302 * plugin-runner.c (main): If the /dev/fd symlink is missing, create it. * plugins.d/mandos-client.c (main): - '' - Reported-By: Eero Häkkinen <+debian-bts-2021@eero.xn--hkkinen-5wa.fi> Suggested-by: Eero Häkkinen <+debian-bts-2021@eero.xn--hkkinen-5wa.fi> Thanks: Eero Häkkinen for bug report and analysis	Teddy Hogeborn	3 years ago
237.7.778	Minor code cleanup Minor code cleanup * dracut-module/password-agent.c (test_send_password_to_socket_EMSGSIZE): Replace a free()/malloc() pair with single realloc() call.	Teddy Hogeborn	4 years ago
237.7.777	Minor fix of a test function Minor fix of a test function In dracut-module/password-agent, the test function test_send_password_to_socket_EMSGSIZE() (which tests that the send_password_to_socket() task function aborts properly when getting EMSGSIZE when writing to the password socket), part of the test code is supposed to find a message size which definitely does trigger EMSGSIZE when send()ing to a socket. Without a "break" in the proper place, however, the size given is always exactly 1024 bytes too large. This is very probably not a problem, since a too large message will still be too large if it is increased by 1024 bytes, and send(2) in practice checks the size before reading the buffer. The biggest issue would be if some version of send(2) would try to look at the last 1024 bytes of the message buffer before checking the message size; this would then lead to a buffer over-read when running this test function. (But even then there would be no security implications since the tests are not run in the normal operation of the program.) * dracut-module/password-agent.c (test_send_password_to_socket_EMSGSIZE): Break out early when ssret < 0 and errno == EMSGSIZE; don't allow loop to increase message_size again.	teddy at recompile	4 years ago
237.7.776	Merge from release branch Merge from release branch	Teddy Hogeborn	4 years ago
237.7.775	Update Debian Policy version to 4.5.1; no other changes nece... Update Debian Policy version to 4.5.1; no other changes necessary. * debian/control (Standards-Version): Change to "4.5.1".	teddy at recompile	4 years ago
237.7.774	Fix debconf template syntax Fix debconf template syntax * debian/mandos-client.templates: Rename "_description" header to "_Description".	teddy at recompile	4 years ago
237.7.773	Revert commit 1222 Revert commit 1222	Teddy Hogeborn	4 years ago
237.7.772	Fix flaky test in password-agent Fix flaky test in password-agent The test_send_password_to_socket_EMSGSIZE function should not use a hard-coded constant to trigger an EMSGSIZE error from send(). * dracut-module/password-agent.c (send_password_to_socket): Only save errno from send() if it returned < 0. Show strerror(errno) if send() does return EMSGSIZE. Show number of bytes sent if send() sends less than all bytes. (test_send_password_to_socket_EMSGSIZE): Do not skip this test on non-AMD64 platforms. Try to find a suitable message size to trigger EMSGSIZE before testing send_password_to_socket(), and only skip this test if such a triggering message size is not found. Reported-By: Simon McVittie <smcv@debian.org> Closes: #975457	teddy at recompile	4 years ago
237.7.771	Fix spelling in comments Fix spelling in comments * dracut-module/password-agent.c (test_connect_question_socket_usable, test_send_password_to_socket_EMSGSIZE): Fix spelling from "procotol" to "protocol" in comment.	teddy at recompile	4 years ago
237.7.770	Fix debconf template syntax Fix debconf template syntax * debian/mandos-client.templates: Rename "_description" header to "Description". * debian/mandos.templates: - '' -	teddy at recompile	4 years ago
237.7.769	Change URL of systemd "Password Agents" specification Change URL of systemd "Password Agents" specification The URL of the systemd "Password Agents" specification changed from <https://www.freedesktop.org/wiki/Software/systemd/PasswordAgents> to <https://systemd.io/PASSWORD_AGENTS/>. * dracut-module/password-agent.c: Change URL in code comments. * dracut-module/password-agent.xml: Change URL. * intro.xml (SYSTEMD): - '' -	teddy at recompile	4 years ago
237.7.768	mandos: Shorten or break long lines mandos: Shorten or break long lines * mandos: Shorten or break long lines.	teddy at recompile	4 years ago
237.7.767	Merge from release branch Merge from release branch	teddy at recompile	4 years ago
237.7.766	Update copyright year Update copyright year * DBUS-API: Update copyright year to 2020 * debian/copyright: - '' - * dracut-module/ask-password-mandos.service: - '' - * dracut-module/password-agent.c: - '' - * mandos: - '' - * mandos-ctl: - '' - * plugin-runner.c: - '' - * plugins.d/mandos-client.c: - '' - * plugins.d/plymouth.c: - '' - * mandos-to-cryptroot-unlock: Update copyright year to 2019.	teddy at recompile	4 years ago
237.7.765	mandos-client.c: Use clock_settime() instead of stime() mandos-client.c: Use clock_settime() instead of stime() From: Aurelien Jarno <aurel32@debian.org> * plugins.d/mandos-client.c (init_gpgme/import_key): Use clock_settime() instead of stime(). Reported-by: Aurelien Jarno <aurel32@debian.org> Suggested-by: Aurelien Jarno <aurel32@debian.org> Closes: #964226 Reviewed-by: Teddy Hogeborn <teddy@recompile.se> Signed-off-by: Teddy Hogeborn <teddy@recompile.se> Fixes: 951 ("mandos-client: Set system clock if necessary")	teddy at recompile	4 years ago
237.7.764	mandos-ctl: Correct and add some comments mandos-ctl: Correct and add some comments * mandos-ctl: Correct program description in file header comment. (dbussy_adapter.SystemBus.call_method): Correct comment about DBussy return values. (dbussy_adapter.SystemBus.type_filter): Add comment about the representation of DBussy "Variant" values.	teddy at recompile	4 years ago
237.7.763	In initramfs-tools boots, only use setsid when available In initramfs-tools boots, only use setsid when available * initramfs-tools-script: If available, use setsid to start mandos-to-cryptroot-unlock.	teddy at recompile	4 years ago
237.7.762	Merge from release branch Merge from release branch	teddy at recompile	4 years ago
237.7.761	Fix file descriptor leak in mandos-client Fix file descriptor leak in mandos-client When the local network has Mandos servers announcing themselves using real, globally reachable, IPv6 addresses (i.e. not link-local addresses), but there is no router on the local network providing IPv6 RA (Router Advertisement) packets, the client cannot reach the server by normal means, since the client only has a link-local IPv6 address, and has no usable route to reach the server's global IPv6 address. (This is not a common situation, and usually only happens when the router itself reboots and runs a Mandos client, since it cannot then give RA packets to itself.) The client code has a solution for this, which consists of adding a temporary local route to reach the address of the server during communication, and removing this temporary route afterwards. This solution with a temporary route works, but has a file descriptor leak; it leaks one file descriptor for each addition and for each removal of a route. If one server requiring an added route is present on the network, but no servers gives a password, making the client retry after the default ten seconds, and we furthermore assume a default 1024 open files limit, the client runs out of file descriptors after about 90 minutes, after which time the client process will be useless and fail to retrieve any passwords, necessitating manual password entry via the keyboard. Fix this by eliminating the file descriptor leak in the client. * plugins.d/mandos-client.c (add_delete_local_route): Do close(devnull) also in parent process, also if fork() fails, and on any failure in child process.	teddy at recompile	4 years ago