/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to dracut-module/cmdline-mandos.sh

  • Committer: Teddy Hogeborn
  • Date: 2021-03-21 20:46:40 UTC
  • mto: This revision was merged to the branch mainline in revision 406.
  • Revision ID: teddy@recompile.se-20210321204640-lpsyen8jr9lw1jma
Some cleanup of GnuTLS interface

Rename opaque internal GnuTLS structures named *_int to also start
with underscore (_), as is the custom in Python programs.

Decode byte strings from UTF-8 where needed.  (Fixing, among other
things, all "DEBUG: GnuTLS" lines having a "b'" prefix in Python 3.)

Simplify calling C functions by:
1. Using the "_as_parameter_" attribute to store the ctypes object.
2. Creating and using helper classes to automatically create pointers
   or cast typed pointers to pointers to void.
3. Providing the "from_param()" method on relevant classes.

Remove "restype" attribute on C functions where "errcheck" attribute
is already set.

* mandos (gnutls.session_int): Rename to start with "_".
  (gnutls.openpgp_crt_int): - '' -
  (gnutls.Error.__init__): Decode byte string from gnutls.strerror().
  (gnutls.PointerTo): New helper class.
  (gnutls.CastToVoidPointer): - '' -
  (gnutls.With_from_param): - '' -
  (gnutls.Credentials): Inherit from "With_from_param" and store the
  ctypes object in the "_as_parameter_" attribute instead of
  "_c_object".
  (gnutls._error_code): Use "gnutls.E_SUCCESS" instead of the unadorned
  numerical constant "0".
  (gnutls._retry_on_error): - '' -
  (gnutls.priority_set_direct.argtypes): Use "ClientSession" instead
  of "session_t", and change all callers to match.
  (gnutls.init.argtypes): Use "PointerTo(ClientSession)" instead of
  "ctypes.POINTER(session_t)", and change all callers to match.
  (gnutls.set_default_priority.argtypes): Use "ClientSession" instead
  of "session_t", and change all callers to match.
  (gnutls.record_send.argtypes): - '' -
  (gnutls.certificate_allocate_credentials.argtypes): Use
  "PointerTo(Credentials)" instead of
  "ctypes.POINTER(certificate_credentials_t)", and change all callers
  to match.
  (gnutls.certificate_free_credentials.argtypes): Use "Credentials"
  instead of "certificate_credentials_t", and change all callers to
  match.
  (gnutls.handshake_set_private_extensions.argtypes): Use
  "ClientSession" instead of "session_t", and change all callers to
  match.
  (gnutls.credentials_set.argtypes): Use
  "CastToVoidPointer(Credentials)" instead of "ctypes.c_void_p", and
  change all callers to match.
  (gnutls.certificate_type_get.argtypes): Use "ClientSession" instead
  of "session_t", and change all callers to match.
  (gnutls.certificate_get_peers.argtypes): - '' -
  (gnutls.deinit.argtypes): - '' -
  (gnutls.handshake.argtypes): - '' -
  (gnutls.handshake.restype): Change from "_error_code" to
  "ctypes.c_int".
  (gnutls.transport_set_ptr.argtypes): Use "ClientSession" instead of
  "session_t", and change all callers to match.
  (gnutls.bye.argtypes): - '' -
  (gnutls.bye.restype): Change from "_error_code" to "ctypes.c_int".
  (gnutls.certificate_type_get2.argtypes): Use "ClientSession" instead
  of "session_t", and change all callers to match.
  (ClientHandler.handle): Decode "key_id" bytes to string before
  logging it in the debug log.
  (main.debug_gnutls): Decode GnuTLS log message from bytes to string
  before logging it in the debug log.

Show diffs side-by-side

added added

removed removed

Lines of Context:
 
1
#!/bin/sh
 
2
#
 
3
# This file should be present in the root file system directory
 
4
# /usr/lib/dracut/modules.d/90mandos.  When dracut creates the
 
5
# initramfs image, dracut will run the "module-setup.sh" file in the
 
6
# same directory, which (when *not* using the "systemd" dracut module)
 
7
# will copy this file ("cmdline-mandos.sh") into the initramfs as
 
8
# "/lib/dracut/hooks/cmdline/20-cmdline-mandos.sh".
 
9
 
10
# Despite the above #!/bin/sh line and the executable flag, this file
 
11
# is not executed; this file is sourced by the /init script in the
 
12
# initramfs image created by dracut.
 
13
 
 
14
if getargbool 1 mandos && [ -e /lib/dracut-crypt-lib.sh ]; then
 
15
    cat >> /lib/dracut-crypt-lib.sh <<- "EOF"
 
16
        ask_for_password(){
 
17
            local cmd; local prompt; local tries=3
 
18
            local ply_cmd; local ply_prompt; local ply_tries=3
 
19
            local tty_cmd; local tty_prompt; local tty_tries=3
 
20
            local ret
 
21
        
 
22
            while [ $# -gt 0 ]; do
 
23
                case "$1" in
 
24
                    --cmd) ply_cmd="$2"; tty_cmd="$2"; shift;;
 
25
                    --ply-cmd) ply_cmd="$2"; shift;;
 
26
                    --tty-cmd) tty_cmd="$2"; shift;;
 
27
                    --prompt) ply_prompt="$2"; tty_prompt="$2"; shift;;
 
28
                    --ply-prompt) ply_prompt="$2"; shift;;
 
29
                    --tty-prompt) tty_prompt="$2"; shift;;
 
30
                    --tries) ply_tries="$2"; tty_tries="$2"; shift;;
 
31
                    --ply-tries) ply_tries="$2"; shift;;
 
32
                    --tty-tries) tty_tries="$2"; shift;;
 
33
                    --tty-echo-off) tty_echo_off=yes;;
 
34
                    -*) :;;
 
35
                esac
 
36
                shift
 
37
            done
 
38
            if [ -z "$ply_cmd" ]; then
 
39
                ply_cmd="$tty_cmd"
 
40
            fi
 
41
            # Extract device and luksname from $ply_cmd
 
42
            set -- $ply_cmd
 
43
            shift
 
44
            for arg in "$@"; do
 
45
                case "$arg" in
 
46
                    -*) :;;
 
47
                    *)
 
48
                        if [ -z "$device" ]; then
 
49
                            device="$arg"
 
50
                        else
 
51
                            luksname="$arg"
 
52
                            break
 
53
                        fi
 
54
                        ;;
 
55
                esac
 
56
            done
 
57
            { flock -s 9;
 
58
              if [ -z "$ply_prompt" ]; then
 
59
                  if [ -z "$tty_prompt" ]; then
 
60
                      CRYPTTAB_SOURCE="$device" cryptsource="$device" CRYPTTAB_NAME="$luksname" crypttarget="$luksname" /lib/mandos/plugin-runner --config-file=/etc/mandos/plugin-runner.conf | $ply_cmd
 
61
                  else
 
62
                      CRYPTTAB_SOURCE="$device" cryptsource="$device" CRYPTTAB_NAME="$luksname" crypttarget="$luksname" /lib/mandos/plugin-runner --options-for=password-prompt:--prompt="${tty_prompt}" --config-file=/etc/mandos/plugin-runner.conf | $ply_cmd
 
63
                  fi
 
64
              else
 
65
                  if [ -z "$tty_prompt" ]; then
 
66
                      CRYPTTAB_SOURCE="$device" cryptsource="$device" CRYPTTAB_NAME="$luksname" crypttarget="$luksname" /lib/mandos/plugin-runner --options-for=plymouth:--prompt="${ply_prompt}" --config-file=/etc/mandos/plugin-runner.conf | $ply_cmd
 
67
                  else
 
68
                      CRYPTTAB_SOURCE="$device" cryptsource="$device" CRYPTTAB_NAME="$luksname" crypttarget="$luksname" /lib/mandos/plugin-runner --options-for=password-prompt:--prompt="${tty_prompt}" --options-for=plymouth:--prompt="${ply_prompt}" --config-file=/etc/mandos/plugin-runner.conf | $ply_cmd
 
69
                  fi
 
70
              fi
 
71
            } 9>/.console_lock
 
72
        }
 
73
        EOF
 
74
fi