DESCRIPTION

=== modified file 'mandos.conf.xml' --- mandos.conf.xml 2008-09-04 13:36:59 +0000 +++ mandos.conf.xml 2008-08-31 15:06:39 +0000 @@ -4,7 +4,7 @@ /etc/mandos/mandos.conf"> - + ]> @@ -144,7 +144,7 @@ The [DEFAULT] is necessary because the Python built-in module ConfigParser - requires it. + requres it. === modified file 'mandos.xml' --- mandos.xml 2008-09-06 16:31:49 +0000 +++ mandos.xml 2008-09-03 19:13:50 +0000 @@ -3,7 +3,7 @@ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ - + ]> @@ -379,7 +379,7 @@ - /var/run/mandos.pid + /var/run/mandos/mandos.pid The file containing the process id of @@ -434,7 +434,7 @@ Debug mode is conflated with running in the foreground. - The console log messages does not show a time stamp. + The console log messages does not show a timestamp. This server does not check the expire time of clients’ OpenPGP @@ -487,8 +487,8 @@ Running this &COMMANDNAME; server program should not in itself present any security risk to the host - computer running it. The program switches to a non-root user - soon after startup. + computer running it. The program does not need any special + privileges to run, and is designed to run as a non-root user. @@ -529,7 +529,7 @@ For more details on client-side security, see - mandos-client + password-request 8mandos. @@ -543,7 +543,7 @@ 5, mandos.conf 5, - mandos-client + password-request 8mandos, sh1 === modified file 'plugin-runner.c' --- plugin-runner.c 2008-09-07 15:42:11 +0000 +++ plugin-runner.c 2008-09-02 06:13:47 +0000 @@ -96,7 +96,7 @@ static plugin *plugin_list = NULL; -/* Gets an existing plugin based on name, +/* Gets a existing plugin based on name, or if none is found, creates a new one */ static plugin *getplugin(char *name){ /* Check for exiting plugin with that name */ @@ -118,7 +118,7 @@ return NULL; } } - + *new_plugin = (plugin) { .name = copy_name, .argc = 1, .disabled = false, @@ -187,10 +187,10 @@ size_t namelen = (size_t)(strchrnul(def, '=') - def); /* Search for this environment variable */ for(char **e = p->environ; *e != NULL; e++){ - if(strncmp(*e, def, namelen + 1) == 0){ + if(strncmp(*e, def, namelen+1) == 0){ /* It already exists */ if(replace){ - char *new = realloc(*e, strlen(def) + 1); + char *new = realloc(*e, strlen(def)); if(new == NULL){ return false; } @@ -238,7 +238,7 @@ /* No child processes */ break; } - + /* A child exited, find it in process_list */ while(proc != NULL and proc->pid != pid){ proc = proc->next; @@ -255,6 +255,9 @@ /* Prints out a password to stdout */ bool print_out_password(const char *buffer, size_t length){ ssize_t ret; + if(length>0 and buffer[length-1] == '\n'){ + length--; + } for(size_t written = 0; written < length; written += (size_t)ret){ ret = TEMP_FAILURE_RETRY(write(STDOUT_FILENO, buffer + written, length - written)); @@ -394,28 +397,36 @@ if(arg == NULL){ break; } - if(not add_environment(getplugin(NULL), arg, true)){ - perror("add_environment"); + { + char *envdef = strdup(arg); + if(envdef == NULL){ + break; + } + if(not add_environment(getplugin(NULL), envdef, true)){ + perror("add_environment"); + } } break; case 'o': /* --options-for */ if (arg != NULL){ char *p_name = strsep(&arg, ":"); - if(p_name[0] == '\0' or arg == NULL){ + if(p_name[0] == '\0'){ break; } char *opt = strsep(&arg, ":"); - if(opt[0] == '\0' or opt == NULL){ + if(opt[0] == '\0'){ break; } - char *p; - while((p = strsep(&opt, ",")) != NULL){ - if(p[0] == '\0'){ - continue; - } - if(not add_argument(getplugin(p_name), p)){ - perror("add_argument"); - return ARGP_ERR_UNKNOWN; + if(opt != NULL){ + char *p; + while((p = strsep(&opt, ",")) != NULL){ + if(p[0] == '\0'){ + continue; + } + if(not add_argument(getplugin(p_name), p)){ + perror("add_argument"); + return ARGP_ERR_UNKNOWN; + } } } } @@ -429,8 +440,12 @@ if(envdef == NULL){ break; } - *envdef = '\0'; - if(not add_environment(getplugin(arg), envdef+1, true)){ + char *p_name = strndup(arg, (size_t) (envdef-arg)); + if(p_name == NULL){ + break; + } + envdef++; + if(not add_environment(getplugin(p_name), envdef, true)){ perror("add_environment"); } } @@ -454,7 +469,6 @@ } break; case 128: /* --plugin-dir */ - free(plugindir); plugindir = strdup(arg); if(plugindir == NULL){ perror("strdup"); @@ -473,12 +487,7 @@ debug = true; break; case ARGP_KEY_ARG: - /* Cryptsetup always passes an argument, which is an empty - string if "none" was specified in /etc/crypttab. So if - argument was empty, we ignore it silently. */ - if(arg[0] != '\0'){ - fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg); - } + fprintf(stderr, "Ignoring unknown argument \"%s\"\n", arg); break; case ARGP_KEY_END: break; @@ -503,7 +512,6 @@ case 128: /* --plugin-dir */ break; case 129: /* --config-file */ - free(argfile); argfile = strdup(arg); if(argfile == NULL){ perror("strdup"); @@ -739,11 +747,7 @@ } char *filename; - if(plugindir == NULL){ - ret = asprintf(&filename, PDIR "/%s", dirst->d_name); - } else { - ret = asprintf(&filename, "%s/%s", plugindir, dirst->d_name); - } + ret = asprintf(&filename, "%s/%s", plugindir, dirst->d_name); if(ret < 0){ perror("asprintf"); continue; @@ -938,7 +942,7 @@ } /* OK, now either a process completed, or something can be read from one of them */ - for(plugin *proc = plugin_list; proc != NULL;){ + for(plugin *proc = plugin_list; proc != NULL; proc = proc->next){ /* Is this process completely done? */ if(proc->eof and proc->completed){ /* Only accept the plugin output if it exited cleanly */ @@ -971,7 +975,7 @@ exitstatus = EXIT_FAILURE; goto fallback; } - + free_plugin(proc); /* We are done modifying process list, so unblock signal */ ret = sigprocmask (SIG_UNBLOCK, &sigchld_action.sa_mask, NULL); @@ -984,10 +988,6 @@ if(plugin_list == NULL){ break; } - - plugin *next_plugin = proc->next; - free_plugin(proc); - proc = next_plugin; continue; } @@ -1005,7 +1005,6 @@ /* This process has not completed. Does it have any output? */ if(proc->eof or not FD_ISSET(proc->fd, &rfds)){ /* This process had nothing to say at this time */ - proc = proc->next; continue; } /* Before reading, make the process' data buffer large enough */ @@ -1024,7 +1023,6 @@ BUFFER_SIZE); if(ret < 0){ /* Read error from this process; ignore the error */ - proc = proc->next; continue; } if(ret == 0){ @@ -1045,13 +1043,7 @@ bool bret; fprintf(stderr, "Going to fallback mode using getpass(3)\n"); char *passwordbuffer = getpass("Password: "); - size_t len = strlen(passwordbuffer); - /* Strip trailing newline */ - if(len > 0 and passwordbuffer[len-1] == '\n'){ - passwordbuffer[len-1] = '\0'; /* not strictly necessary */ - len--; - } - bret = print_out_password(passwordbuffer, len); + bret = print_out_password(passwordbuffer, strlen(passwordbuffer)); if(not bret){ perror("print_out_password"); exitstatus = EXIT_FAILURE; === removed file 'plugin-runner.conf' --- plugin-runner.conf 2008-09-06 16:31:49 +0000 +++ plugin-runner.conf 1970-01-01 00:00:00 +0000 @@ -1,9 +0,0 @@ -## This is the configuration file for plugin-runner. It should be -## installed as "/etc/mandos/plugin-runner.conf", which will be copied -## to "/conf/conf.d/mandos/plugin-runner.conf" in the initrd.img file. -## -## The default network interface for mandos-client(8mandos) is -## "eth0". Uncomment this line and change it if necessary. -## - -#--options-for=mandos-client:--interface=eth0 === modified file 'plugin-runner.xml' --- plugin-runner.xml 2008-09-06 16:31:49 +0000 +++ plugin-runner.xml 2008-09-02 13:04:42 +0000 @@ -3,7 +3,7 @@ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ - + ]> @@ -45,7 +45,7 @@ &COMMANDNAME; - Run Mandos plugins, pass data from first to succeed. + Run Mandos plugins. Pass data from first succesful one. @@ -140,11 +140,11 @@ DESCRIPTION &COMMANDNAME; is a program which is meant to - be specified as a keyscript for the root disk in - crypttab - 5. The aim of this - program is therefore to output a password, which then - cryptsetup + be specified as keyscript in + crypttab + 5 for the root disk. The + aim of this program is therefore to output a password, which + then cryptsetup 8 will use to unlock the root disk. @@ -272,7 +272,7 @@ Re-enable the plugin named PLUGIN. This is only useful to undo a previous option, maybe - from the configuration file. + from the config file. @@ -416,11 +416,6 @@ console. - If the password is a single-line, manually entered passprase, - a final trailing newline character should - not be printed. - - The plugin will run in the initial RAM disk environment, so care must be taken not to depend on any files or running services not available there. @@ -433,8 +428,8 @@ The plugin must not use resources, like for instance reading - from the standard input, without knowing that no other plugin - is also using it. + from the standard input, without knowing that no other plugins + are also using it. It is useful, but not required, for the plugin to take the @@ -472,7 +467,7 @@ only passes on its environment to all the plugins. The environment passed to plugins can be modified using the and - options. + optins. @@ -515,13 +510,11 @@ - - BUGS - - The option is ignored when - specified from within a configuration file. - - + + + + + EXAMPLE @@ -569,15 +562,15 @@ - Run plugins from a different directory, read a different - configuration file, and add two options to the - mandos-client + Run plugins from a different directory and add a special + option to the password-request 8mandos plugin: -&COMMANDNAME; --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=mandos-client:--pubkey=/etc/keys/mandos/pubkey.txt,--seckey=/etc/keys/mandos/seckey.txt +&COMMANDNAME; --plugin-dir=plugins.d --options-for=password-request:--keydir=keydir @@ -591,16 +584,16 @@ non-privileged. This user and group is then what all plugins will be started as. Therefore, the only way to run a plugin as a privileged user is to have the set-user-ID or set-group-ID bit - set on the plugin executable file (see + set on the plugin executable files (see execve2 ). If this program is used as a keyscript in crypttab5 - , there is a slight risk that if this program - fails to work, there might be no way to boot the system except - for booting from another media and editing the initial RAM disk + , there is a risk that if this program fails to + work, there might be no way to boot the system except for + booting from another media and editing the initial RAM disk image to not run this program. This is, however, unlikely, since the password-prompt8mandos @@ -625,7 +618,7 @@ 8, password-prompt 8mandos, - mandos-client + password-request 8mandos === modified file 'plugins.d/password-prompt.c' --- plugins.d/password-prompt.c 2008-09-07 01:44:44 +0000 +++ plugins.d/password-prompt.c 2008-08-29 05:53:59 +0000 @@ -216,11 +216,6 @@ status = EXIT_SUCCESS; /* Make n = data size instead of allocated buffer size */ n = (size_t)ret; - /* Strip final newline */ - if(n>0 and buffer[n-1] == '\n'){ - buffer[n-1] = '\0'; /* not strictly necessary */ - n--; - } size_t written = 0; while(written < n){ ret = write(STDOUT_FILENO, buffer + written, n - written); @@ -249,8 +244,6 @@ fprintf(stderr, "getline() returned 0, retrying.\n"); } } - - free(buffer); if (debug){ fprintf(stderr, "Restoring terminal attributes\n"); @@ -263,9 +256,6 @@ fprintf(stderr, "%s is exiting with status %d\n", argv[0], status); } - if(status == EXIT_SUCCESS){ - fputc('\n', stderr); - } return status; } === modified file 'plugins.d/password-prompt.xml' --- plugins.d/password-prompt.xml 2008-09-06 16:31:49 +0000 +++ plugins.d/password-prompt.xml 2008-09-01 08:29:23 +0000 @@ -3,7 +3,7 @@ "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [ - + ]> @@ -87,7 +87,7 @@ is not very useful on its own. This program is really meant to run as a plugin in the Mandos client-side system, where it is used as a fallback and - alternative to retrieving passwords from a Mandos server. @@ -240,7 +240,7 @@ Show a prefix before the prompt; in this case, a host name. It might be useful to be reminded of which host needs a - password, in case of KVM switches, etc. + password, in case of KVM switches, etc. @@ -270,7 +270,7 @@ >plugin-runner8mandos , and will, when run standalone, outside, in a normal environment, immediately output on its standard output - any presumably secret password it just received. Therefore, + any presumably secret password it just recieved. Therefore, when running this program standalone (which should never normally be done), take care not to type in any real secret password by force of habit, since it would then immediately be @@ -290,7 +290,7 @@ crypttab 5 - mandos-client + password-request 8mandos plugin-runner 8mandos, === renamed file 'plugins.d/mandos-client.c' => 'plugins.d/password-request.c' --- plugins.d/mandos-client.c 2008-09-07 01:44:44 +0000 +++ plugins.d/password-request.c 2008-09-03 19:04:05 +0000 @@ -107,11 +107,11 @@ #define PATHDIR "/conf/conf.d/mandos" #define SECKEY "seckey.txt" -#define PUBKEY "pubkey.txt" +#define PUBKEY "pupkey.txt" bool debug = false; static const char mandos_protocol_version[] = "1"; -const char *argp_program_version = "mandos-client 1.0"; +const char *argp_program_version = "password-request 1.0"; const char *argp_program_bug_address = ""; /* Used for passing in values through the Avahi callback functions */ @@ -150,7 +150,7 @@ int ret; gpgme_error_t rc; gpgme_engine_info_t engine_info; - + /* * Helper function to insert pub and seckey to the enigne keyring. @@ -171,14 +171,14 @@ gpgme_strsource(rc), gpgme_strerror(rc)); return false; } - + rc = gpgme_op_import(mc->ctx, pgp_data); if (rc != GPG_ERR_NO_ERROR){ fprintf(stderr, "bad gpgme_op_import: %s: %s\n", gpgme_strsource(rc), gpgme_strerror(rc)); return false; } - + ret = TEMP_FAILURE_RETRY(close(fd)); if(ret == -1){ perror("close"); @@ -190,7 +190,7 @@ if (debug){ fprintf(stderr, "Initialize gpgme\n"); } - + /* Init GPGME */ gpgme_check_version(NULL); rc = gpgme_engine_check_version(GPGME_PROTOCOL_OpenPGP); @@ -199,7 +199,7 @@ gpgme_strsource(rc), gpgme_strerror(rc)); return false; } - + /* Set GPGME home directory for the OpenPGP engine only */ rc = gpgme_get_engine_info (&engine_info); if (rc != GPG_ERR_NO_ERROR){ @@ -219,7 +219,7 @@ fprintf(stderr, "Could not set GPGME home dir to %s\n", tempdir); return false; } - + /* Create new GPGME "context" */ rc = gpgme_new(&(mc->ctx)); if (rc != GPG_ERR_NO_ERROR){ @@ -315,7 +315,7 @@ /* Seek back to the beginning of the GPGME plaintext data buffer */ if (gpgme_data_seek(dh_plain, (off_t) 0, SEEK_SET) == -1){ - perror("gpgme_data_seek"); + perror("pgpme_data_seek"); plaintext_length = -1; goto decrypt_end; } @@ -451,7 +451,6 @@ gnutls_certificate_free_credentials(mc->cred); gnutls_global_deinit(); - gnutls_dh_params_deinit(mc->dh_params); return -1; } @@ -831,7 +830,7 @@ .dh_bits = 1024, .priority = "SECURE256" ":!CTYPE-X.509:+CTYPE-OPENPGP" }; bool gnutls_initalized = false; - bool gpgme_initalized = false; + bool pgpme_initalized = false; { struct argp_option options[] = { @@ -919,6 +918,29 @@ } } + ret = init_gnutls_global(&mc, pubkey, seckey); + if (ret == -1){ + fprintf(stderr, "init_gnutls_global failed\n"); + exitcode = EXIT_FAILURE; + goto end; + } else { + gnutls_initalized = true; + } + + if(mkdtemp(tempdir) == NULL){ + perror("mkdtemp"); + tempdir[0] = '\0'; + goto end; + } + + if(not init_gpgme(&mc, pubkey, seckey, tempdir)){ + fprintf(stderr, "pgpme_initalized failed\n"); + exitcode = EXIT_FAILURE; + goto end; + } else { + pgpme_initalized = true; + } + /* If the interface is down, bring it up */ { sd = socket(PF_INET6, SOCK_DGRAM, IPPROTO_IP); @@ -962,29 +984,6 @@ perror("setgid"); } - ret = init_gnutls_global(&mc, pubkey, seckey); - if (ret == -1){ - fprintf(stderr, "init_gnutls_global failed\n"); - exitcode = EXIT_FAILURE; - goto end; - } else { - gnutls_initalized = true; - } - - if(mkdtemp(tempdir) == NULL){ - perror("mkdtemp"); - tempdir[0] = '\0'; - goto end; - } - - if(not init_gpgme(&mc, pubkey, seckey, tempdir)){ - fprintf(stderr, "gpgme_initalized failed\n"); - exitcode = EXIT_FAILURE; - goto end; - } else { - gpgme_initalized = true; - } - if_index = (AvahiIfIndex) if_nametoindex(interface); if(if_index == 0){ fprintf(stderr, "No such interface: \"%s\"\n", interface); @@ -1099,13 +1098,12 @@ if (gnutls_initalized){ gnutls_certificate_free_credentials(mc.cred); gnutls_global_deinit (); - gnutls_dh_params_deinit(mc.dh_params); } - - if(gpgme_initalized){ + + if(pgpme_initalized){ gpgme_release(mc.ctx); } - + /* Removes the temp directory used by GPGME */ if(tempdir[0] != '\0'){ DIR *d; @@ -1135,7 +1133,6 @@ free(fullname); } } - closedir(d); } ret = rmdir(tempdir); if(ret == -1){ === renamed file 'plugins.d/mandos-client.xml' => 'plugins.d/password-request.xml' --- plugins.d/mandos-client.xml 2008-09-06 16:33:08 +0000 +++ plugins.d/password-request.xml 2008-09-03 20:31:19 +0000 @@ -2,8 +2,8 @@ - - + + ]> @@ -45,7 +45,7 @@ &COMMANDNAME; - Client for Mandos + Client for mandos @@ -54,10 +54,10 @@ &COMMANDNAME; @@ -124,7 +124,7 @@ network connectivity, Zeroconf to find servers, and TLS with an OpenPGP key to ensure authenticity and confidentiality. It keeps running, trying all servers on the network, until it - receives a satisfactory reply or a TERM signal is received. + receives a satisfactory reply or a TERM signal is recieved. This program is not meant to be run directly; it is really meant @@ -311,12 +311,10 @@ /etc/crypttab, but it would then be impossible to enter a password for the encrypted root disk at the console, since this program does not read from the console - at all. This is why a separate plugin runner ( - plugin-runner - 8mandos) is used to run - both this program and others in in parallel, - one of which will prompt for passwords on - the system console. + at all. This is why a separate plugin ( + password-prompt + 8mandos) does that, which + will be run in parallell to this one by the plugin runner. @@ -329,7 +327,7 @@ program will exit with a non-zero exit status only if a critical error occurs. Otherwise, it will forever connect to new Mandos servers as they appear, trying - to get a decryptable password and print it. + to get a decryptable password. @@ -388,8 +386,7 @@ - Search for Mandos servers (and connect to them) using another - interface: + Search for Mandos servers on another interface: