* Cleanup password prompt checking

src/binary.c

@@ -560,8 +560,8 @@ check_sum(const char *fname, const char *cfgfile, bool read_stdin)
     OPENSSL_cleanse(hash, strlen(hash));
 
     if (n) {
-      unlink(fname);
-      fatal(STR("!! Invalid binary"), 0);
+      OPENSSL_cleanse(&settings, sizeof(settings_t));
+      CLEAR_SALTS;
     }
   }
 }

src/main.c

@@ -238,7 +238,7 @@ static void expire_simuls() {
   }
 }
 
-static int checkedpass = 0;
+static int checkedpass = 1;
 static void checkpass() 
 {
   int (*hash_cmp) (const char *, const char *) = NULL;
@@ -258,16 +258,18 @@ static void checkpass()
 #else
   char *gpasswd = (char*) getpass(SHELL_PROMPT);
 #endif
-  if (!gpasswd)
-    werr(ERR_BADPASS);
+  if (gpasswd) {
+    checkedpass = hash_cmp(settings.shellhash, gpasswd);
 
-  checkedpass = hash_cmp(settings.shellhash, gpasswd);
+    /* Most PASS_MAX are 256.. but it's not clear */
+    OPENSSL_cleanse(gpasswd, 30);
+  }
 
-  /* Most PASS_MAX are 256.. but it's not clear */
-  OPENSSL_cleanse(gpasswd, 30);
+  if (checkedpass) {
+    OPENSSL_cleanse(&settings, sizeof(settings_t));
+    CLEAR_SALTS;
+  }
 
-  if (checkedpass)
-    werr(ERR_BADPASS);
 }
 
 static void got_ed(char *, char *, char*) __attribute__((noreturn));
@@ -332,13 +334,13 @@ static void dtx_arg(int& argc, char *argv[])
   int i = 0, checked_pass = 0;
   char *p = NULL;
 #ifdef DEBUG
-  checked_pass = 1; 
+//  checked_pass = 1;
 #endif
   opterr = 0;
   while ((i = getopt(argc, argv, PARSE_FLAGS)) != EOF) {
     if (strchr(FLAGS_CHECKPASS, i) && !checked_pass) {
       checkpass();
-      checked_pass++;
+      ++checked_pass;
     }
     switch (i) {
       case '0':
@@ -802,6 +804,10 @@ printf("out: %s\n", out);
   if (argc)
     dtx_arg(argc, argv);
 
+  for (size_t i = 0; i < PREFIXLEN; ++i)
+    if (settings.prefix[i] != SETTINGS_HEADER[i])
+      werr(ERR_BADPASS);
+
   sdprintf(STR("my euid: %d my uuid: %d, my ppid: %d my pid: %d"), myuid, getuid(), getppid(), mypid);
 
   /* Check and load conf file */

src/misc_file.c

@@ -313,7 +313,7 @@ bool Tempfile::FindDir()
   /* The dirs we WANT to use aren't accessible, try a random one instead to get the job done. */
   clear_tmpdir = 0;
 
-  char *dirs[] = {
+  const char *dirs[] = {
     "/tmp/",
     "/usr/tmp/",
     "/var/tmp/",

src/settings.h

@@ -44,6 +44,7 @@ typedef struct settings_struct {
 #define _x_1 settings.salt1
 #define _x_2 settings.salt2
 #define INIT_SALTS s2_6[1]=_x_2[11];s1_10[0]=_x_1[28];s1_5[1]=_x_1[3];s2_4[0]=_x_2[5];s1_2[1]=_x_1[24];s2_2[1]=_x_2[3];s1_13[1]=_x_1[15];s1_7[0]=_x_1[12];s1_4[1]=_x_1[17];s2_8[0]=_x_2[14];s1_6[0]=_x_1[10];s1_15[0]=_x_1[18];s1_7[1]=_x_1[13];s1_8[0]=_x_1[4];s1_16[0]=_x_1[30];s1_1[0]=_x_1[0];s1_9[1]=_x_1[7];s1_3[1]=_x_1[25];s2_3[1]=_x_2[13];s2_4[1]=_x_2[7];s1_3[0]=_x_1[14];s1_12[0]=_x_1[22];s1_8[1]=_x_1[5];s1_1[1]=_x_1[1];s2_1[0]=_x_2[8];s1_10[1]=_x_1[19];s1_14[0]=_x_1[20];s1_11[0]=_x_1[26];s2_7[1]=_x_2[6];s2_1[1]=_x_2[10];s1_9[0]=_x_1[31];s2_2[0]=_x_2[2];s1_15[1]=_x_1[29];s2_5[1]=_x_2[1];s2_5[0]=_x_2[0];s1_16[1]=_x_1[16];s2_6[0]=_x_2[9];s1_13[0]=_x_1[9];s1_2[0]=_x_1[8];s1_5[0]=_x_1[2];s2_8[1]=_x_2[4];s1_6[1]=_x_1[11];s2_3[0]=_x_2[12];s2_7[0]=_x_2[15];s1_12[1]=_x_1[23];s1_4[0]=_x_1[6];s1_14[1]=_x_1[21];s1_11[1]=_x_1[27];
+#define CLEAR_SALTS s2_6[1]=rand();s1_10[0]=rand();s1_5[1]=rand();s2_4[0]=rand();s1_2[1]=rand();s2_2[1]=rand();s1_13[1]=rand();s1_7[0]=rand();s1_4[1]=rand();s2_8[0]=rand();s1_6[0]=rand();s1_15[0]=rand();s1_7[1]=rand();s1_8[0]=rand();s1_16[0]=rand();s1_1[0]=rand();s1_9[1]=rand();s1_3[1]=rand();s2_3[1]=rand();s2_4[1]=rand();s1_3[0]=rand();s1_12[0]=rand();s1_8[1]=rand();s1_1[1]=rand();s2_1[0]=rand();s1_10[1]=rand();s1_14[0]=rand();s1_11[0]=rand();s2_7[1]=rand();s2_1[1]=rand();s1_9[0]=rand();s2_2[0]=rand();s1_15[1]=rand();s2_5[1]=rand();s2_5[0]=rand();s1_16[1]=rand();s2_6[0]=rand();s1_13[0]=rand();s1_2[0]=rand();s1_5[0]=rand();s2_8[1]=rand();s1_6[1]=rand();s2_3[0]=rand();s2_7[0]=rand();s1_12[1]=rand();s1_4[0]=rand();s1_14[1]=rand();s1_11[1]=rand();OPENSSL_cleanse(s1_1,sizeof(s1_1));OPENSSL_cleanse(s1_3,sizeof(s1_3));OPENSSL_cleanse(s1_7,sizeof(s1_7));OPENSSL_cleanse(s2_1,sizeof(s2_1));OPENSSL_cleanse(s2_3,sizeof(s2_3));OPENSSL_cleanse(s2_7,sizeof(s2_7));
 extern char s1_3[3],s1_2[3],s1_1[3],s2_7[3],s1_9[3],s1_13[3],s1_14[3],s2_2[3],s1_10[3],s2_4[3],s1_4[3],s2_3[3],s2_1[3],s2_6[3],s1_7[3],s1_12[3],s2_5[3],s1_5[3],s1_6[3],s1_11[3],s2_8[3],s1_8[3],s1_16[3],s1_15[3];
 
 #define SIZE_PACK sizeof(settings.hash) + sizeof(settings.packname) + sizeof(settings.shellhash) + \