/mandos/trunk : changes

» Changes from revision 1316

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 1230 to 1211

expand all

Rev	Summary	Authors	Date
1230	Minor code cleanup Minor code cleanup * dracut-module/password-agent.c (test_send_password_to_socket_EMSGSIZE): Replace a free()/malloc() pair with single realloc() call.	Teddy Hogeborn	3 years ago
1229	Minor fix of a test function Minor fix of a test function In dracut-module/password-agent, the test function test_send_password_to_socket_EMSGSIZE() (which tests that the send_password_to_socket() task function aborts properly when getting EMSGSIZE when writing to the password socket), part of the test code is supposed to find a message size which definitely does trigger EMSGSIZE when send()ing to a socket. Without a "break" in the proper place, however, the size given is always exactly 1024 bytes too large. This is very probably not a problem, since a too large message will still be too large if it is increased by 1024 bytes, and send(2) in practice checks the size before reading the buffer. The biggest issue would be if some version of send(2) would try to look at the last 1024 bytes of the message buffer before checking the message size; this would then lead to a buffer over-read when running this test function. (But even then there would be no security implications since the tests are not run in the normal operation of the program.) * dracut-module/password-agent.c (test_send_password_to_socket_EMSGSIZE): Break out early when ssret < 0 and errno == EMSGSIZE; don't allow loop to increase message_size again.	teddy at recompile	3 years ago
1228	Merge from release branch Merge from release branch	Teddy Hogeborn	3 years ago
1227	Update Debian Policy version to 4.5.1; no other changes nece... Update Debian Policy version to 4.5.1; no other changes necessary. * debian/control (Standards-Version): Change to "4.5.1".	teddy at recompile	3 years ago
1226	Fix debconf template syntax Fix debconf template syntax * debian/mandos-client.templates: Rename "_description" header to "_Description".	teddy at recompile	3 years ago
1225	Revert commit 1222 Revert commit 1222	Teddy Hogeborn	3 years ago
1224	Fix flaky test in password-agent Fix flaky test in password-agent The test_send_password_to_socket_EMSGSIZE function should not use a hard-coded constant to trigger an EMSGSIZE error from send(). * dracut-module/password-agent.c (send_password_to_socket): Only save errno from send() if it returned < 0. Show strerror(errno) if send() does return EMSGSIZE. Show number of bytes sent if send() sends less than all bytes. (test_send_password_to_socket_EMSGSIZE): Do not skip this test on non-AMD64 platforms. Try to find a suitable message size to trigger EMSGSIZE before testing send_password_to_socket(), and only skip this test if such a triggering message size is not found. Reported-By: Simon McVittie <smcv@debian.org> Closes: #975457	teddy at recompile	3 years ago
1223	Fix spelling in comments Fix spelling in comments * dracut-module/password-agent.c (test_connect_question_socket_usable, test_send_password_to_socket_EMSGSIZE): Fix spelling from "procotol" to "protocol" in comment.	teddy at recompile	3 years ago
1222	Fix debconf template syntax Fix debconf template syntax * debian/mandos-client.templates: Rename "_description" header to "Description". * debian/mandos.templates: - '' -	teddy at recompile	3 years ago
1221	Change URL of systemd "Password Agents" specification Change URL of systemd "Password Agents" specification The URL of the systemd "Password Agents" specification changed from <https://www.freedesktop.org/wiki/Software/systemd/PasswordAgents> to <https://systemd.io/PASSWORD_AGENTS/>. * dracut-module/password-agent.c: Change URL in code comments. * dracut-module/password-agent.xml: Change URL. * intro.xml (SYSTEMD): - '' -	teddy at recompile	4 years ago
1220	mandos: Shorten or break long lines mandos: Shorten or break long lines * mandos: Shorten or break long lines.	teddy at recompile	4 years ago
1219	Merge from release branch Merge from release branch	teddy at recompile	4 years ago
1218	Update copyright year Update copyright year * DBUS-API: Update copyright year to 2020 * debian/copyright: - '' - * dracut-module/ask-password-mandos.service: - '' - * dracut-module/password-agent.c: - '' - * mandos: - '' - * mandos-ctl: - '' - * plugin-runner.c: - '' - * plugins.d/mandos-client.c: - '' - * plugins.d/plymouth.c: - '' - * mandos-to-cryptroot-unlock: Update copyright year to 2019.	teddy at recompile	4 years ago
1217	mandos-client.c: Use clock_settime() instead of stime() mandos-client.c: Use clock_settime() instead of stime() From: Aurelien Jarno <aurel32@debian.org> * plugins.d/mandos-client.c (init_gpgme/import_key): Use clock_settime() instead of stime(). Reported-by: Aurelien Jarno <aurel32@debian.org> Suggested-by: Aurelien Jarno <aurel32@debian.org> Closes: #964226 Reviewed-by: Teddy Hogeborn <teddy@recompile.se> Signed-off-by: Teddy Hogeborn <teddy@recompile.se> Fixes: 951 ("mandos-client: Set system clock if necessary")	teddy at recompile	4 years ago
1216	mandos-ctl: Correct and add some comments mandos-ctl: Correct and add some comments * mandos-ctl: Correct program description in file header comment. (dbussy_adapter.SystemBus.call_method): Correct comment about DBussy return values. (dbussy_adapter.SystemBus.type_filter): Add comment about the representation of DBussy "Variant" values.	teddy at recompile	4 years ago
1215	In initramfs-tools boots, only use setsid when available In initramfs-tools boots, only use setsid when available * initramfs-tools-script: If available, use setsid to start mandos-to-cryptroot-unlock.	teddy at recompile	4 years ago
1214	Merge from release branch Merge from release branch	teddy at recompile	4 years ago
1213	Fix file descriptor leak in mandos-client Fix file descriptor leak in mandos-client When the local network has Mandos servers announcing themselves using real, globally reachable, IPv6 addresses (i.e. not link-local addresses), but there is no router on the local network providing IPv6 RA (Router Advertisement) packets, the client cannot reach the server by normal means, since the client only has a link-local IPv6 address, and has no usable route to reach the server's global IPv6 address. (This is not a common situation, and usually only happens when the router itself reboots and runs a Mandos client, since it cannot then give RA packets to itself.) The client code has a solution for this, which consists of adding a temporary local route to reach the address of the server during communication, and removing this temporary route afterwards. This solution with a temporary route works, but has a file descriptor leak; it leaks one file descriptor for each addition and for each removal of a route. If one server requiring an added route is present on the network, but no servers gives a password, making the client retry after the default ten seconds, and we furthermore assume a default 1024 open files limit, the client runs out of file descriptors after about 90 minutes, after which time the client process will be useless and fail to retrieve any passwords, necessitating manual password entry via the keyboard. Fix this by eliminating the file descriptor leak in the client. * plugins.d/mandos-client.c (add_delete_local_route): Do close(devnull) also in parent process, also if fork() fails, and on any failure in child process.	teddy at recompile	4 years ago
1212	Merge from release branch Merge from release branch	Teddy Hogeborn	4 years ago
1211	Update Debian Policy version to 4.5.0; no other changes nece... Update Debian Policy version to 4.5.0; no other changes necessary. * debian/control (Standards-Version): Change to "4.5.0".	teddy at recompile	4 years ago