Don't print newline after reading password if interrupted by signal.
Avoids an extra newline when the user presses ^C or ^\ at the
password prompt. OK deraadt@
Stop using SOCK_NONBLOCK for the unix socket
There is no reason to use SOCK_NONBLOCK for AF_UNIX sockets since
connect(2) will not return EINPROGRESS. UNIX sockets don't need a
three way handshake and the connect will only wait for resources.
Remove the warnx in the connect error case since it will be shown
at the end of the run.
OK tb@
Check rtrx_sock filedesc against -1 and not < 0.
Also do this for the socket and connect return value. These functions
only return -1 on failure.
OK tb@
Revert "httpd: convert imsg handling to imsg_get_ and remove... " r.1.79
It looks like having multiple "listen" blocks can cause configuration
errors because the IMSG has already been consumed. The previous behavior
simply copied the IMSG.
To be on the safe side, revert all IMSG changes.
Spotted by aja, hint by tb@
rpki-client: guard JSON output of ca->aki with a NULL check
While this is about non-functional CAs and TAs are never considered as
such, this block may well be copied around and then end in tears.
discussed with claudio
Add safegaurd: only consider intermediates when storing NCA state on disk
The detection & backoff related to non-functional CAs is only intended to
apply to intermediates (not the trust anchor or end-entity certs). Better
to explicitly check the ca's purpose.
OK tb@
Add safe guard: don't initially mark trust anchors as nonfunctional CAs
The detection & backoff for non-functional CAs is only intended to apply
to intermediates, not the trust anchor itself.
OK tb@
Pinning the validation time implies offline mode
The -P option is merely intended to help research whether the
deterministic validation process produces expected results. The only
scenario where use of -P is productive is in offline mode.
OK tb@ claudio@
In offline mode don't consider state related to non-functional CAs
If '-n' is specified there won't be any network synchronisation anyway.
This help avoid nuking the on-disk state in some scenarios.
OK tb@
x509_verify: cache extensions before allocating chain
Avoid allocating current_chain before extension caching can fail, so the
failure path needs no chain cleanup.
Drop the misleading OUT_OF_MEM error assignment. The common error path
supplies UNSPECIFIED.
pointed out by tb@
ok tb@ beck@
privdrop to _ypbind. The late use of daemon() until YP binding succeeds
(to wait in the rc script, but also allow ^C if the admin wants to fix
a mess) was a problem. Now it opens a pipe[], forks the parent which
does half of daemon up front, the remaining parts happen upon binding
success. If the parent gets tty signals, it must forward to the child
who has already called setsid(). unveils and pledges have been moved around.
tested by jmatthew
