/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.c

  • Committer: Teddy Hogeborn
  • Date: 2014-06-22 02:19:30 UTC
  • Revision ID: teddy@recompile.se-20140622021930-icl7h4cm97blhjml
mandos-keygen: Generate "checker" option to use SSH fingerprints.

To turn this off, use a new "--no-ssh" option to mandos-keygen.

* INSTALL (Mandos Server, Mandos Client): Document new suggested
                                          installation of SSH.
* Makefile (confdir/clients.conf): Use new "--no-ssh" option to
                                   "mandos-keygen".
* debian/control (mandos/Depends): Changed to "fping | ssh-client".
  (mandos-client/Recommends): New; set to "ssh".
* intro.xml (FREQUENTLY ASKED QUESTIONS): Rename and rewrite section
                                          called "Faking ping
                                          replies?" to address new
                                          default behavior.
* mandos-clients.conf.xml (OPTIONS/checker): Briefly discuss new
                                             behavior of
                                             mandos-keygen.
* mandos-keygen: Bug fix: Suppress failure output of "shred" to remove
                 "sec*", since no such files may exist.
 (password mode): Scan for SSH key fingerprints and output as new
                  "checker" and "ssh_fingerprint" options, unless new
                  "--no-ssh" option is given.
* mandos-keygen.xml (SYNOPSIS/--force): Bug fix: Document short form.
  (OPTIONS/--no-ssh): New.
  (SEE ALSO): Add reference "ssh-keyscan(1)".
* plugins.d/mandos-client.xml (SECURITY): Briefly mention the
                                          possibility of using SSH key
                                          fingerprints for checking.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/mandos-client.c
234
234
                          .af = af };
235
235
  if(new_server->ip == NULL){
236
236
    perror_plus("strdup");
237
 
    free(new_server);
238
237
    return false;
239
238
  }
240
239
  ret = clock_gettime(CLOCK_MONOTONIC, &(new_server->last_seen));
241
240
  if(ret == -1){
242
241
    perror_plus("clock_gettime");
243
 
#ifdef __GNUC__
244
 
#pragma GCC diagnostic push
245
 
#pragma GCC diagnostic ignored "-Wcast-qual"
246
 
#endif
247
 
    free((char *)(new_server->ip));
248
 
#ifdef __GNUC__
249
 
#pragma GCC diagnostic pop
250
 
#endif
251
 
    free(new_server);
252
242
    return false;
253
243
  }
254
244
  /* Special case of first server */
1076
1066
     timed out */
1077
1067
  
1078
1068
  if(quit_now){
1079
 
    avahi_s_service_resolver_free(r);
1080
1069
    return;
1081
1070
  }
1082
1071
  
1650
1639
        _exit(EXIT_FAILURE);
1651
1640
      }
1652
1641
    } else {
1653
 
      if(hook_pid == -1){
1654
 
        perror_plus("fork");
1655
 
        free(direntry);
1656
 
        continue;
1657
 
      }
1658
1642
      int status;
1659
1643
      if(TEMP_FAILURE_RETRY(waitpid(hook_pid, &status, 0)) == -1){
1660
1644
        perror_plus("waitpid");
1661
 
        free(direntry);
1662
1645
        continue;
1663
1646
      }
1664
1647
      if(WIFEXITED(status)){
1666
1649
          fprintf_plus(stderr, "Warning: network hook \"%s\" exited"
1667
1650
                       " with status %d\n", direntry->d_name,
1668
1651
                       WEXITSTATUS(status));
1669
 
          free(direntry);
1670
1652
          continue;
1671
1653
        }
1672
1654
      } else if(WIFSIGNALED(status)){
1673
1655
        fprintf_plus(stderr, "Warning: network hook \"%s\" died by"
1674
1656
                     " signal %d\n", direntry->d_name,
1675
1657
                     WTERMSIG(status));
1676
 
        free(direntry);
1677
1658
        continue;
1678
1659
      } else {
1679
1660
        fprintf_plus(stderr, "Warning: network hook \"%s\""
1680
1661
                     " crashed\n", direntry->d_name);
1681
 
        free(direntry);
1682
1662
        continue;
1683
1663
      }
1684
1664
    }
1686
1666
      fprintf_plus(stderr, "Network hook \"%s\" ran successfully\n",
1687
1667
                   direntry->d_name);
1688
1668
    }
1689
 
    free(direntry);
1690
1669
  }
1691
1670
  free(direntries);
1692
1671
  if((int)TEMP_FAILURE_RETRY(close(hookdir_fd)) == -1){
2286
2265
        if(ret_errno != 0){
2287
2266
          errno = ret_errno;
2288
2267
          perror_plus("argz_add");
2289
 
          free(direntries[i]);
2290
2268
          continue;
2291
2269
        }
2292
2270
        if(debug){
2293
2271
          fprintf_plus(stderr, "Will use interface \"%s\"\n",
2294
2272
                       direntries[i]->d_name);
2295
2273
        }
2296
 
        free(direntries[i]);
2297
2274
      }
2298
2275
      free(direntries);
2299
2276
    } else {
2569
2546
    mc.current_server->prev->next = NULL;
2570
2547
    while(mc.current_server != NULL){
2571
2548
      server *next = mc.current_server->next;
2572
 
#ifdef __GNUC__
2573
 
#pragma GCC diagnostic push
2574
 
#pragma GCC diagnostic ignored "-Wcast-qual"
2575
 
#endif
2576
 
      free((char *)(mc.current_server->ip));
2577
 
#ifdef __GNUC__
2578
 
#pragma GCC diagnostic pop
2579
 
#endif
2580
2549
      free(mc.current_server);
2581
2550
      mc.current_server = next;
2582
2551
    }
2651
2620
                         " \"%s\", 0): %s\n", tempdir,
2652
2621
                         direntries[i]->d_name, strerror(errno));
2653
2622
          }
2654
 
          free(direntries[i]);
2655
2623
        }
2656
2624
        
2657
2625
        /* need to clean even if 0 because man page doesn't specify */