=== modified file 'mandos.xml' --- mandos.xml 2008-09-05 16:24:33 +0000 +++ mandos.xml 2008-09-06 16:31:49 +0000 @@ -3,7 +3,7 @@ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ - + ]> @@ -529,7 +529,7 @@ For more details on client-side security, see - password-request + mandos-client 8mandos. @@ -543,7 +543,7 @@ 5, mandos.conf 5, - password-request + mandos-client 8mandos, sh1 === modified file 'plugin-runner.c' --- plugin-runner.c 2008-09-06 15:34:21 +0000 +++ plugin-runner.c 2008-09-07 01:44:44 +0000 @@ -394,14 +394,8 @@ if(arg == NULL){ break; } - { - char *envdef = strdup(arg); - if(envdef == NULL){ - break; - } - if(not add_environment(getplugin(NULL), envdef, true)){ - perror("add_environment"); - } + if(not add_environment(getplugin(NULL), arg, true)){ + perror("add_environment"); } break; case 'o': /* --options-for */ @@ -435,12 +429,8 @@ if(envdef == NULL){ break; } - char *p_name = strndup(arg, (size_t) (envdef-arg)); - if(p_name == NULL){ - break; - } - envdef++; - if(not add_environment(getplugin(p_name), envdef, true)){ + *envdef = '\0'; + if(not add_environment(getplugin(arg), envdef+1, true)){ perror("add_environment"); } } @@ -464,6 +454,7 @@ } break; case 128: /* --plugin-dir */ + free(plugindir); plugindir = strdup(arg); if(plugindir == NULL){ perror("strdup"); @@ -507,6 +498,7 @@ case 128: /* --plugin-dir */ break; case 129: /* --config-file */ + free(argfile); argfile = strdup(arg); if(argfile == NULL){ perror("strdup"); @@ -742,7 +734,11 @@ } char *filename; - ret = asprintf(&filename, "%s/%s", plugindir, dirst->d_name); + if(plugindir == NULL){ + ret = asprintf(&filename, PDIR "/%s", dirst->d_name); + } else { + ret = asprintf(&filename, "%s/%s", plugindir, dirst->d_name); + } if(ret < 0){ perror("asprintf"); continue; @@ -937,7 +933,7 @@ } /* OK, now either a process completed, or something can be read from one of them */ - for(plugin *proc = plugin_list; proc != NULL; proc = proc->next){ + for(plugin *proc = plugin_list; proc != NULL;){ /* Is this process completely done? */ if(proc->eof and proc->completed){ /* Only accept the plugin output if it exited cleanly */ @@ -970,7 +966,7 @@ exitstatus = EXIT_FAILURE; goto fallback; } - free_plugin(proc); + /* We are done modifying process list, so unblock signal */ ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask, NULL); @@ -983,6 +979,10 @@ if(plugin_list == NULL){ break; } + + plugin *next_plugin = proc->next; + free_plugin(proc); + proc = next_plugin; continue; } @@ -1000,6 +1000,7 @@ /* This process has not completed. Does it have any output? */ if(proc->eof or not FD_ISSET(proc->fd, &rfds)){ /* This process had nothing to say at this time */ + proc = proc->next; continue; } /* Before reading, make the process' data buffer large enough */ @@ -1018,6 +1019,7 @@ BUFFER_SIZE); if(ret < 0){ /* Read error from this process; ignore the error */ + proc = proc->next; continue; } if(ret == 0){ === modified file 'plugin-runner.conf' --- plugin-runner.conf 2008-09-05 07:11:24 +0000 +++ plugin-runner.conf 2008-09-06 16:31:49 +0000 @@ -2,8 +2,8 @@ ## installed as "/etc/mandos/plugin-runner.conf", which will be copied ## to "/conf/conf.d/mandos/plugin-runner.conf" in the initrd.img file. ## -## The default network interface for password-request(8mandos) is +## The default network interface for mandos-client(8mandos) is ## "eth0". Uncomment this line and change it if necessary. ## -#--options-for=password-request:--interface=eth0 +#--options-for=mandos-client:--interface=eth0 === modified file 'plugin-runner.xml' --- plugin-runner.xml 2008-09-06 15:34:21 +0000 +++ plugin-runner.xml 2008-09-06 16:31:49 +0000 @@ -571,13 +571,13 @@ Run plugins from a different directory, read a different configuration file, and add two options to the - password-request + mandos-client 8mandos plugin: -&COMMANDNAME; --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=password-request:--pubkey=/etc/keys/mandos/pubkey.txt,--seckey=/etc/keys/mandos/seckey.txt +&COMMANDNAME; --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=mandos-client:--pubkey=/etc/keys/mandos/pubkey.txt,--seckey=/etc/keys/mandos/seckey.txt @@ -625,7 +625,7 @@ 8, password-prompt 8mandos, - password-request + mandos-client 8mandos === renamed file 'plugins.d/password-request.c' => 'plugins.d/mandos-client.c' --- plugins.d/password-request.c 2008-09-06 15:34:21 +0000 +++ plugins.d/mandos-client.c 2008-09-07 01:44:44 +0000 @@ -111,7 +111,7 @@ bool debug = false; static const char mandos_protocol_version[] = "1"; -const char *argp_program_version = "password-request 1.0"; +const char *argp_program_version = "mandos-client 1.0"; const char *argp_program_bug_address = ""; /* Used for passing in values through the Avahi callback functions */ @@ -315,7 +315,7 @@ /* Seek back to the beginning of the GPGME plaintext data buffer */ if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){ - perror("pgpme_data_seek"); + perror("gpgme_data_seek"); plaintext_length = -1; goto decrypt_end; } @@ -451,6 +451,7 @@ gnutls_certificate_free_credentials(mc->cred); gnutls_global_deinit(); + gnutls_dh_params_deinit(mc->dh_params); return -1; } @@ -830,7 +831,7 @@ .dh_bits = 1024, .priority = "SECURE256" ":!CTYPE-X.509:+CTYPE-OPENPGP" }; bool gnutls_initalized = false; - bool pgpme_initalized = false; + bool gpgme_initalized = false; { struct argp_option options[] = { @@ -977,11 +978,11 @@ } if(not init_gpgme(&mc, pubkey, seckey, tempdir)){ - fprintf(stderr, "pgpme_initalized failed\n"); + fprintf(stderr, "gpgme_initalized failed\n"); exitcode = EXIT_FAILURE; goto end; } else { - pgpme_initalized = true; + gpgme_initalized = true; } if_index = (AvahiIfIndex) if_nametoindex(interface); @@ -1098,9 +1099,10 @@ if (gnutls_initalized){ gnutls_certificate_free_credentials(mc.cred); gnutls_global_deinit (); + gnutls_dh_params_deinit(mc.dh_params); } - if(pgpme_initalized){ + if(gpgme_initalized){ gpgme_release(mc.ctx); } @@ -1133,6 +1135,7 @@ free(fullname); } } + closedir(d); } ret = rmdir(tempdir); if(ret == -1){ === renamed file 'plugins.d/password-request.xml' => 'plugins.d/mandos-client.xml' --- plugins.d/password-request.xml 2008-09-04 14:12:10 +0000 +++ plugins.d/mandos-client.xml 2008-09-06 16:33:08 +0000 @@ -2,8 +2,8 @@ - - + + ]> @@ -45,7 +45,7 @@ &COMMANDNAME; - Client for mandos + Client for Mandos @@ -311,10 +311,12 @@ /etc/crypttab, but it would then be impossible to enter a password for the encrypted root disk at the console, since this program does not read from the console - at all. This is why a separate plugin ( - password-prompt - 8mandos) does that, which - will be run in parallel to this one by the plugin runner. + at all. This is why a separate plugin runner ( + plugin-runner + 8mandos) is used to run + both this program and others in in parallel, + one of which will prompt for passwords on + the system console. @@ -327,7 +329,7 @@ program will exit with a non-zero exit status only if a critical error occurs. Otherwise, it will forever connect to new Mandos servers as they appear, trying - to get a decryptable password. + to get a decryptable password and print it. === modified file 'plugins.d/password-prompt.c' --- plugins.d/password-prompt.c 2008-09-06 15:34:21 +0000 +++ plugins.d/password-prompt.c 2008-09-07 01:44:44 +0000 @@ -249,6 +249,8 @@ fprintf(stderr, "getline() returned 0, retrying.\n"); } } + + free(buffer); if (debug){ fprintf(stderr, "Restoring terminal attributes\n"); === modified file 'plugins.d/password-prompt.xml' --- plugins.d/password-prompt.xml 2008-09-04 13:36:59 +0000 +++ plugins.d/password-prompt.xml 2008-09-06 16:31:49 +0000 @@ -3,7 +3,7 @@ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ - + ]> @@ -290,7 +290,7 @@ crypttab 5 - password-request + mandos-client 8mandos plugin-runner 8mandos,