/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos

  • Committer: Teddy Hogeborn
  • Date: 2019-07-18 00:02:43 UTC
  • mto: This revision was merged to the branch mainline in revision 384.
  • Revision ID: teddy@recompile.se-20190718000243-okz4s9xao1r1tfnx
Document bug in mandos-keygen which strips white space from passwords

Passwords, as read by mandos-keygen when given the --password or -p
options, are stripped of white space from the start and from the end
of the password.  This is because mandos-keygen is a shell script, and
the Bourne Shell "read" builtin does not seem to have a way to avoid
this.  Document this bug.

* manods-keygen.xml (OPTIONS): Document the white space-stripping
                               nature of the --password/-p option, and
                               also note in the description of
                               --passfile and -F that they avoid this
                               behavior.
  (BUGS): Again mention the problem with the --password and -p
          options, and suggest --passfile as a possible workaround.

Show diffs side-by-side

added added

removed removed

Lines of Context:
mandos
80
80
 
81
81
import dbus
82
82
import dbus.service
83
 
import gi
84
83
from gi.repository import GLib
85
84
from dbus.mainloop.glib import DBusGMainLoop
86
85
import ctypes
116
115
if sys.version_info.major == 2:
117
116
    str = unicode
118
117
 
119
 
if sys.version_info < (3, 2):
120
 
    configparser.Configparser = configparser.SafeConfigParser
121
 
 
122
 
version = "1.8.7"
 
118
version = "1.8.4"
123
119
stored_state_file = "clients.pickle"
124
120
 
125
121
logger = logging.getLogger()
590
586
        def __init__(self, socket, credentials=None):
591
587
            self._c_object = gnutls.session_t()
592
588
            gnutls_flags = gnutls.CLIENT
593
 
            if gnutls.check_version(b"3.5.6"):
 
589
            if gnutls.check_version("3.5.6"):
594
590
                gnutls_flags |= gnutls.NO_TICKETS
595
591
            if gnutls.has_rawpk:
596
592
                gnutls_flags |= gnutls.ENABLE_RAWPK
798
794
                                                    ctypes.c_size_t)]
799
795
        openpgp_crt_get_fingerprint.restype = _error_code
800
796
 
801
 
    if check_version(b"3.6.4"):
 
797
    if check_version("3.6.4"):
802
798
        certificate_type_get2 = _library.gnutls_certificate_type_get2
803
799
        certificate_type_get2.argtypes = [session_t, ctypes.c_int]
804
800
        certificate_type_get2.restype = _error_code
825
821
    approved:   bool(); 'None' if not yet approved/disapproved
826
822
    approval_delay: datetime.timedelta(); Time to wait for approval
827
823
    approval_duration: datetime.timedelta(); Duration of one approval
828
 
    checker: multiprocessing.Process(); a running checker process used
829
 
             to see if the client lives. 'None' if no process is
830
 
             running.
 
824
    checker:    subprocess.Popen(); a running checker process used
 
825
                                    to see if the client lives.
 
826
                                    'None' if no process is running.
831
827
    checker_callback_tag: a GLib event source tag, or None
832
828
    checker_command: string; External command which is run to check
833
829
                     if client lives.  %() expansions are done at
1040
1036
    def checker_callback(self, source, condition, connection,
1041
1037
                         command):
1042
1038
        """The checker has completed, so take appropriate actions."""
 
1039
        self.checker_callback_tag = None
 
1040
        self.checker = None
1043
1041
        # Read return code from connection (see call_pipe)
1044
1042
        returncode = connection.recv()
1045
1043
        connection.close()
1046
 
        self.checker.join()
1047
 
        self.checker_callback_tag = None
1048
 
        self.checker = None
1049
1044
 
1050
1045
        if returncode >= 0:
1051
1046
            self.last_checker_status = returncode
2292
2287
            approval_required = False
2293
2288
            try:
2294
2289
                if gnutls.has_rawpk:
2295
 
                    fpr = b""
 
2290
                    fpr = ""
2296
2291
                    try:
2297
2292
                        key_id = self.key_id(
2298
2293
                            self.peer_certificate(session))
2302
2297
                    logger.debug("Key ID: %s", key_id)
2303
2298
 
2304
2299
                else:
2305
 
                    key_id = b""
 
2300
                    key_id = ""
2306
2301
                    try:
2307
2302
                        fpr = self.fingerprint(
2308
2303
                            self.peer_certificate(session))
3002
2997
    del priority
3003
2998
 
3004
2999
    # Parse config file for server-global settings
3005
 
    server_config = configparser.ConfigParser(server_defaults)
 
3000
    server_config = configparser.SafeConfigParser(server_defaults)
3006
3001
    del server_defaults
3007
3002
    server_config.read(os.path.join(options.configdir, "mandos.conf"))
3008
 
    # Convert the ConfigParser object to a dict
 
3003
    # Convert the SafeConfigParser object to a dict
3009
3004
    server_settings = server_config.defaults()
3010
3005
    # Use the appropriate methods on the non-string config options
3011
3006
    for option in ("debug", "use_dbus", "use_ipv6", "restore",
3083
3078
                                  server_settings["servicename"])))
3084
3079
 
3085
3080
    # Parse config file with clients
3086
 
    client_config = configparser.ConfigParser(Client.client_defaults)
 
3081
    client_config = configparser.SafeConfigParser(Client
 
3082
                                                  .client_defaults)
3087
3083
    client_config.read(os.path.join(server_settings["configdir"],
3088
3084
                                    "clients.conf"))
3089
3085
 
3160
3156
        # Close all input and output, do double fork, etc.
3161
3157
        daemon()
3162
3158
 
3163
 
    if gi.version_info < (3, 10, 2):
3164
 
        # multiprocessing will use threads, so before we use GLib we
3165
 
        # need to inform GLib that threads will be used.
3166
 
        GLib.threads_init()
 
3159
    # multiprocessing will use threads, so before we use GLib we need
 
3160
    # to inform GLib that threads will be used.
 
3161
    GLib.threads_init()
3167
3162
 
3168
3163
    global main_loop
3169
3164
    # From the Avahi example code
3249
3244
                        for k in ("name", "host"):
3250
3245
                            if isinstance(value[k], bytes):
3251
3246
                                value[k] = value[k].decode("utf-8")
3252
 
                        if "key_id" not in value:
 
3247
                        if not value.has_key("key_id"):
3253
3248
                            value["key_id"] = ""
3254
 
                        elif "fingerprint" not in value:
 
3249
                        elif not value.has_key("fingerprint"):
3255
3250
                            value["fingerprint"] = ""
3256
3251
                    #  old_client_settings
3257
3252
                    # .keys()