/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.c

  • Committer: Teddy Hogeborn
  • Date: 2014-06-22 02:19:30 UTC
  • Revision ID: teddy@recompile.se-20140622021930-icl7h4cm97blhjml
mandos-keygen: Generate "checker" option to use SSH fingerprints.

To turn this off, use a new "--no-ssh" option to mandos-keygen.

* INSTALL (Mandos Server, Mandos Client): Document new suggested
                                          installation of SSH.
* Makefile (confdir/clients.conf): Use new "--no-ssh" option to
                                   "mandos-keygen".
* debian/control (mandos/Depends): Changed to "fping | ssh-client".
  (mandos-client/Recommends): New; set to "ssh".
* intro.xml (FREQUENTLY ASKED QUESTIONS): Rename and rewrite section
                                          called "Faking ping
                                          replies?" to address new
                                          default behavior.
* mandos-clients.conf.xml (OPTIONS/checker): Briefly discuss new
                                             behavior of
                                             mandos-keygen.
* mandos-keygen: Bug fix: Suppress failure output of "shred" to remove
                 "sec*", since no such files may exist.
 (password mode): Scan for SSH key fingerprints and output as new
                  "checker" and "ssh_fingerprint" options, unless new
                  "--no-ssh" option is given.
* mandos-keygen.xml (SYNOPSIS/--force): Bug fix: Document short form.
  (OPTIONS/--no-ssh): New.
  (SEE ALSO): Add reference "ssh-keyscan(1)".
* plugins.d/mandos-client.xml (SECURITY): Briefly mention the
                                          possibility of using SSH key
                                          fingerprints for checking.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/mandos-client.c
234
234
                          .af = af };
235
235
  if(new_server->ip == NULL){
236
236
    perror_plus("strdup");
237
 
    free(new_server);
238
237
    return false;
239
238
  }
240
239
  ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
240
  if(ret == -1){
242
241
    perror_plus("clock_gettime");
243
 
#ifdef __GNUC__
244
 
#pragma GCC diagnostic push
245
 
#pragma GCC diagnostic ignored "-Wcast-qual"
246
 
#endif
247
 
    free((char *)(new_server->ip));
248
 
#ifdef __GNUC__
249
 
#pragma GCC diagnostic pop
250
 
#endif
251
 
    free(new_server);
252
242
    return false;
253
243
  }
254
244
  /* Special case of first server */
1076
1066
     timed out */
1077
1067
  
1078
1068
  if(quit_now){
1079
 
    avahi_s_service_resolver_free(r);
1080
1069
    return;
1081
1070
  }
1082
1071
  
1653
1642
      int status;
1654
1643
      if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1655
1644
        perror_plus("waitpid");
1656
 
        free(direntry);
1657
1645
        continue;
1658
1646
      }
1659
1647
      if(WIFEXITED(status)){
1661
1649
          fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1662
1650
                       " with status %d\n", direntry->d_name,
1663
1651
                       WEXITSTATUS(status));
1664
 
          free(direntry);
1665
1652
          continue;
1666
1653
        }
1667
1654
      } else if(WIFSIGNALED(status)){
1668
1655
        fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1669
1656
                     " signal %d\n", direntry->d_name,
1670
1657
                     WTERMSIG(status));
1671
 
        free(direntry);
1672
1658
        continue;
1673
1659
      } else {
1674
1660
        fprintf_plus(stderr, "Warning: network hook \"%s\""
1675
1661
                     " crashed\n", direntry->d_name);
1676
 
        free(direntry);
1677
1662
        continue;
1678
1663
      }
1679
1664
    }
1681
1666
      fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1682
1667
                   direntry->d_name);
1683
1668
    }
1684
 
    free(direntry);
1685
1669
  }
1686
1670
  free(direntries);
1687
1671
  if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
2281
2265
        if(ret_errno != 0){
2282
2266
          errno = ret_errno;
2283
2267
          perror_plus("argz_add");
2284
 
          free(direntries[i]);
2285
2268
          continue;
2286
2269
        }
2287
2270
        if(debug){
2288
2271
          fprintf_plus(stderr, "Will use interface \"%s\"\n",
2289
2272
                       direntries[i]->d_name);
2290
2273
        }
2291
 
        free(direntries[i]);
2292
2274
      }
2293
2275
      free(direntries);
2294
2276
    } else {
2564
2546
    mc.current_server->prev->next = NULL;
2565
2547
    while(mc.current_server != NULL){
2566
2548
      server *next = mc.current_server->next;
2567
 
#ifdef __GNUC__
2568
 
#pragma GCC diagnostic push
2569
 
#pragma GCC diagnostic ignored "-Wcast-qual"
2570
 
#endif
2571
 
      free((char *)(mc.current_server->ip));
2572
 
#ifdef __GNUC__
2573
 
#pragma GCC diagnostic pop
2574
 
#endif
2575
2549
      free(mc.current_server);
2576
2550
      mc.current_server = next;
2577
2551
    }
2646
2620
                         " \"%s\", 0): %s\n", tempdir,
2647
2621
                         direntries[i]->d_name, strerror(errno));
2648
2622
          }
2649
 
          free(direntries[i]);
2650
2623
        }
2651
2624
        
2652
2625
        /* need to clean even if 0 because man page doesn't specify */