gobby · tyll · Aug 23, 2014 · Aug 24, 2014 · Aug 24, 2014 · Aug 24, 2014
diff --git a/.travis.yml b/.travis.yml
@@ -3,6 +3,6 @@ compiler:
     - gcc
     - clang
 before_install:
-    - sudo apt-get update -qq
-    - sudo apt-get install -qq gtk-doc-tools libgnutls-dev libgsasl7-dev libxml2-dev libgtk-3-dev libavahi-client-dev libdaemon-dev libpam-dev
+    - sudo DEBIAN_FRONTEND=noninteractive apt-get update -qq
+    - sudo DEBIAN_FRONTEND=noninteractive apt-get install -qq gtk-doc-tools libgnutls-dev libgsasl7-dev libxml2-dev libgtk-3-dev libavahi-client-dev libdaemon-dev libpam-dev
 script: ./autogen.sh --with-gtk3 --with-infgtk --with-inftextgtk --with-avahi --with-libdaemon --enable-gtk-doc && make && make check
diff --git a/Makefile.am b/Makefile.am
@@ -22,6 +22,8 @@ endif
 
 SUBDIRS += pixmaps test docs po
 
+EXTRA_DIST = README.md
+
 DISTCHECK_CONFIGURE_FLAGS=--enable-gtk-doc
 
 MAINTAINERCLEANFILES = \

diff --git a/NEWS b/NEWS
@@ -1,3 +1,51 @@
+libinfinity 0.6.7:
+	* Fix a possible crash when an entry is removed from the document
+	  browser.
+	* Fix a possible crash in infinoted when access control lists are
+	  enabled.
+	* Fix an assertion failure when operating with text documents and
+	  using glib 2.46 or newer.
+
+libinfinity 0.6.6:
+	* Fix certificates being only verified for expiration and other
+	  criteria such as weak algorithms if the CA is not trusted.
+	  (gobby #61)
+	* Fix some assertion failures and inconsistencies in
+	  InfTextFixlineBuffer.
+	* Fix a client-side crash when the server shuts down ordinarily
+	  while still connected.
+
+libinfinity 0.6.5:
+	* Fix memory corruption in InfTextFixlineBuffer.
+	* infinoted: Fix error message in server log when a client certificate
+	  is not trusted.
+	* Fix various crashes related to sending data to already closed
+	  connections.
+	* Build fix when res_query is provided by libc, not libresolv, such
+	  as on FreeBSD (gobby #23, Samantha Michelle Smith).
+
+libinfinity 0.6.4:
+	* Build fixes for Mac OS X (#7, Dominyk Tiller).
+
+libinfinity 0.6.3:
+	* infinoted: Fix a possible timing attack on the server password
+	  (Jann Horn).
+	* infinoted: Use mode 0777 instead of 0700 when creating directories
+	  in the directory-sync plugin.
+	* Write certificates not seen before into the known hosts file.
+
+libinfinity 0.6.2:
+	* Fix accounts being deleted when a plugin overrides the default
+	  account storage.
+	* The infinoted manual page has been corrected for the syntax of the
+	  --plugins option.
+	* A crash has been fixed when a connection is closed for which the
+	  the certificate dialog was shown.
+
+libinfinity 0.6.1:
+	* Explicitly link against libresolv on unix-based systems, to avoid
+	  a possible build failure.
+
 libinfinity 0.6.0:
 
 	* infinoted: Introduced a plugin infrastructure, and ported some of

diff --git a/configure.ac b/configure.ac
@@ -1,4 +1,4 @@
-m4_define([libinfinity_version], [0.6.0])
+m4_define([libinfinity_version], [0.6.8])
 m4_define([libinfinity_api_version], [0.6])
 m4_define([libinfinity_libtool_version], [0:0:0])
 
@@ -124,6 +124,42 @@ PKG_CHECK_MODULES([inftext], [glib-2.0 >= 2.16 gobject-2.0 >= 2.16 libxml-2.0])
 
 if test $platform = 'win32'; then
   infinity_LIBS="$infinity_LIBS -lws2_32 -ldnsapi"
+else
+  # Check whether we need libresolv for res_query()
+  # Can't use AC_SEARCH_LIBS because res_query is a macro defined in
+  # resolv.h
+  AC_MSG_CHECKING(for res_query)
+  AC_TRY_LINK(
+    [
+      #include <sys/types.h>
+      #include <netinet/in.h>
+      #include <arpa/nameser.h>
+      #include <resolv.h>
+    ],
+    [res_query(NULL, 0, 0, NULL, 0);],
+    [
+      # res_init() available in libc
+      AC_MSG_RESULT(yes)
+    ],
+    [
+      LIBS="-lresolv"
+      AC_TRY_LINK(
+        [
+          #include <sys/types.h>
+          #include <netinet/in.h>
+          #include <arpa/nameser.h>
+          #include <resolv.h>
+        ],
+        [res_query(NULL, 0, 0, NULL, 0);],
+        [
+          AC_MSG_RESULT(in libresolv)
+          LIBS=""
+          infinity_LIBS="$infinity_LIBS -lresolv" # res_init available in libresolv
+        ],
+        [AC_MSG_ERROR(res_query not provided by either libc or libresolv)]
+      )
+    ]
+  )
 fi
 
 ###################################

diff --git a/docs/reference/Makefile.am b/docs/reference/Makefile.am
@@ -1,4 +1,16 @@
-SUBDIRS = . libinfinity libinftext libinfgtk libinftextgtk libinfinoted-plugin-manager
+SUBDIRS = . libinfinity libinftext
+
+if WITH_INFGTK
+SUBDIRS += libinfgtk
+endif
+
+if WITH_INFTEXTGTK
+SUBDIRS += libinftextgtk
+endif
+
+if WITH_INFINOTED
+SUBDIRS += libinfinoted-plugin-manager
+endif
 
 # Note that nodist doesn't work here actually because gtk-doc pulls them
 # in anyway (see content_files in a subdirectory's Makefile.am)
@@ -7,9 +19,11 @@ nodist_noinst_DATA = version.xml api_version.xml
 # Remove the trailing newline of the version files, to have the entities
 # in the docbook XML substituted without it.
 version.xml: version.xml.in
+	rm -f version.xml
 	echo -n `cat version.xml.in` > version.xml
 
 api_version.xml: api_version.xml.in
+	rm -f api_version.xml
 	echo -n `cat api_version.xml.in` > api_version.xml
 
 CLEANFILES = version.xml api_version.xml

diff --git a/infinoted/infinoted-0.6.man b/infinoted/infinoted-0.6.man
@@ -32,7 +32,7 @@ The server's private key
 The server's certificate
 .TP
 \fB\-\-certificate\-chain\fR
-The certificate chain to the root certificate, if not included in the file given in --certificate-file.
+The certificate chain to the root certificate, if not included in the file given in \-\-certificate\-file.
 .TP
 \fB\-\-create\-key\fR
 Creates a new random private key
@@ -55,13 +55,13 @@ to this, when the autosave plugin is enabled, it is possible to save
 sessions into the tree periodically. The default directory is
 ~/.infinote.
 .TP
-\fB\-\-plugins\fR=\fIPLUGIN1;PLUGIN2;...\fR
-Additional plugins to load, separated by semi-colon. Plugin options can be configured in the configuration file (one section for each plugin), or with the --plugin-parameter option.
+\fB\-\-plugins\fR=\fIPLUGIN\fR
+Additional plugin to load. Repeat the option on the command-line to specify multiple plugins and semi-colons in the configuration file. Plugin options can be configured in the configuration file (one section for each plugin), or with the \-\-plugin\-parameter option.
 .TP
 \fB\-\-plugin-parameter\fR=\fIPLUGIN:KEY:VALUE\fR
 Sets the option KEY for plugin PLUGIN to the given VALUE. Normally, plugin
 options are specified in the configuration file, but this command line
-option allows to set or override plugin options on the command line.
+option allows one to set or override plugin options on the command line.
 .TP
 \fB\-P\fR, \fB\-\-password\fR=\fIPASSWORD\fR
 Require given password on connections

diff --git a/infinoted/infinoted-options.c b/infinoted/infinoted-options.c
@@ -229,6 +229,9 @@ infinoted_options_validate(InfinotedOptions* options,
   requires_password = requires_password || options->pam_service != NULL;
 #endif /* LIBINFINITY_HAVE_PAM */
 
+  if(options->password != NULL)
+    options->password_len = strlen(options->password);
+
   if(requires_password &&
      options->security_policy == INF_XMPP_CONNECTION_SECURITY_ONLY_UNSECURED)
   {
@@ -702,7 +705,7 @@ infinoted_options_load(InfinotedOptions* options,
     }, {
       "plugin-parameter", 0, 0,
       G_OPTION_ARG_STRING_ARRAY, &plugin_parameters,
-      N_("Allows to override configuration entries for plugins from the "
+      N_("Allows one to override configuration entries for plugins from the "
          "command line. The syntax is --plugin-parameter=plugin:key:value, "
          "where plugin is the name of the plugin for which to override a "
          "configuration parameter, key is the parameter which to override "
@@ -971,6 +974,7 @@ infinoted_options_new(const gchar* const* config_files,
   options->plugins[0] = g_strdup("note-text");
   options->plugins[1] = NULL;
   options->password = NULL;
+  options->password_len = 0;
 #ifdef LIBINFINITY_HAVE_PAM
   options->pam_service = NULL;
   options->pam_allowed_users = NULL;

diff --git a/infinoted/infinoted-options.h b/infinoted/infinoted-options.h
@@ -45,6 +45,7 @@ struct _InfinotedOptions {
   gchar** plugins;
 
   gchar* password;
+  gsize password_len;
 #ifdef LIBINFINITY_HAVE_PAM
   gchar* pam_service;
   gchar** pam_allowed_users;

diff --git a/infinoted/infinoted-plugin-manager.c b/infinoted/infinoted-plugin-manager.c
@@ -781,6 +781,8 @@ infinoted_plugin_manager_finalize(GObject* object)
   g_hash_table_unref(priv->connections);
   g_hash_table_unref(priv->sessions);
 
+  g_free(priv->path);
+
   G_OBJECT_CLASS(parent_class)->finalize(object);
 }
 

diff --git a/infinoted/infinoted-run.c b/infinoted/infinoted-run.c
@@ -51,23 +51,6 @@ infinoted_run_load_directory(InfinotedRun* run,
 
   storage = infd_filesystem_storage_new(startup->options->root_directory);
 
-  /* Set an account storage, too. This can be replaced by something more fancy
-   * by a plugin. */
-  account_storage = infd_filesystem_account_storage_new();
-
-  result = infd_filesystem_account_storage_set_filesystem(
-    account_storage,
-    storage,
-    error
-  );
-
-  if(result == FALSE)
-  {
-    g_object_unref(account_storage);
-    g_object_unref(storage);
-    return FALSE;
-  }
-
   communication_manager = inf_communication_manager_new();
 
   run->io = inf_standalone_io_new();
@@ -78,17 +61,8 @@ infinoted_run_load_directory(InfinotedRun* run,
     communication_manager
   );
 
-  g_object_set(
-    G_OBJECT(run->directory),
-    "account-storage",
-    account_storage,
-    NULL
-  );
-
   infd_directory_enable_chat(run->directory, TRUE);
 
-  g_object_unref(storage);
-  g_object_unref(account_storage);
   g_object_unref(communication_manager);
 
   /* Load server plugins via plugin manager */
@@ -119,6 +93,8 @@ infinoted_run_load_directory(InfinotedRun* run,
 
   if(result == FALSE)
   {
+    g_object_unref(storage);
+
     g_object_unref(run->plugin_manager);
     g_object_unref(run->directory);
     g_object_unref(run->io);
@@ -128,6 +104,47 @@ infinoted_run_load_directory(InfinotedRun* run,
     return FALSE;
   }
 
+  /* Set an account storage, too. This can be replaced by something more fancy
+   * by a plugin. */
+  /* TODO: This filesystem storage should be moved into a plugin, so that
+   * users can enable it optionally. */
+  g_object_get(G_OBJECT(run->directory), "account-storage", &account_storage, NULL);
+  if(account_storage == NULL)
+  {
+    account_storage = infd_filesystem_account_storage_new();
+
+    result = infd_filesystem_account_storage_set_filesystem(
+      account_storage,
+      storage,
+      error
+    );
+
+    if(result == FALSE)
+    {
+      g_object_unref(storage);
+      g_object_unref(account_storage);
+
+      g_object_unref(run->plugin_manager);
+      g_object_unref(run->directory);
+      g_object_unref(run->io);
+      run->plugin_manager = NULL;
+      run->directory = NULL;
+      run->io = NULL;
+
+      return FALSE;
+    }
+
+    g_object_set(
+      G_OBJECT(run->directory),
+      "account-storage",
+      account_storage,
+      NULL
+    );
+  }
+
+  g_object_unref(storage);
+  g_object_unref(account_storage);
+
   return TRUE;
 }
 

diff --git a/infinoted/infinoted-startup.c b/infinoted/infinoted-startup.c
@@ -290,6 +290,9 @@ infinoted_startup_sasl_callback(InfSaslContextSession* session,
   const char* username;
   const char* password;
   InfXmppConnection* xmpp;
+  gchar cmp;
+  gsize password_len;
+  gsize i;
 
 #ifdef LIBINFINITY_HAVE_PAM
   const gchar* pam_service;
@@ -367,7 +370,22 @@ infinoted_startup_sasl_callback(InfSaslContextSession* session,
 #endif /* LIBINFINITY_HAVE_PAM */
     {
       g_assert(startup->options->password != NULL);
-      if(strcmp(startup->options->password, password) == 0)
+
+      /* length-independent string compare */
+      cmp = 0;
+      password_len = strlen(password);
+      for(i = 0; i < startup->options->password_len; ++i)
+      {
+        if(i < password_len)
+          cmp |= (startup->options->password[i] ^ password[i]);
+        else
+          cmp |= (startup->options->password[i] ^ 0x00);
+      }
+
+      if(startup->options->password_len != password_len)
+        cmp |= 0xFF;
+
+      if(cmp == 0)
       {
         infinoted_log_info(
           startup->log,

diff --git a/infinoted/infinoted-util.c b/infinoted/infinoted-util.c
@@ -90,7 +90,7 @@ infinoted_util_create_dirname(const gchar* path,
   gboolean result;
 
   dirname = g_path_get_dirname(path);
-  result = inf_file_util_create_directory(dirname, 0700, error);
+  result = inf_file_util_create_directory(dirname, 0777, error);
   g_free(dirname);
 
   return result;

diff --git a/infinoted/plugins/infinoted-plugin-certificate-auth.c b/infinoted/plugins/infinoted-plugin-certificate-auth.c
@@ -136,7 +136,7 @@ infinoted_plugin_certificate_auth_certificate_func(InfXmppConnection* xmpp,
     if(res != GNUTLS_E_SUCCESS)
       inf_gnutls_set_error(&error, res);
     else if( (verify_result & GNUTLS_CERT_INVALID) != 0)
-      inf_gnutls_certificate_verification_set_error(&error, res);
+      inf_gnutls_certificate_verification_set_error(&error, verify_result);
 
     if(error != NULL)
     {

diff --git a/infinoted/plugins/infinoted-plugin-directory-sync.c b/infinoted/plugins/infinoted-plugin-directory-sync.c
@@ -449,7 +449,7 @@ infinoted_plugin_directory_sync_initialize(InfinotedPluginManager* manager,
 
   plugin->manager = manager;
 
-  if(inf_file_util_create_directory(plugin->directory, 0700, error) == FALSE)
+  if(inf_file_util_create_directory(plugin->directory, 0777, error) == FALSE)
     return FALSE;
 
   g_signal_connect(