=== modified file 'Makefile' --- Makefile 2008-07-29 03:35:39 +0000 +++ Makefile 2008-08-07 21:45:41 +0000 @@ -11,21 +11,35 @@ CFLAGS=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) $(LANGUAGE) LDFLAGS=$(COVERAGE) -PROGS=plugbasedclient plugins.d/mandosclient plugins.d/passprompt +PROGS=mandos-client plugins.d/password-request plugins.d/password-prompt objects=$(shell for p in $(PROGS); do echo $${p}.o; done) all: $(PROGS) -plugbasedclient: plugbasedclient.o +mandos-client: mandos-client.o $(LINK.o) -lgnutls $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@ -plugins.d/mandosclient: plugins.d/mandosclient.o +plugins.d/password-request: plugins.d/password-request.o $(LINK.o) -lgnutls -lavahi-core -lgpgme $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@ -plugins.d/passprompt: plugins.d/passprompt.o +plugins.d/password-prompt: plugins.d/password-prompt.o $(LINK.o) $(COMMON) $^ $(LOADLIBES) $(LDLIBS) -o $@ -.PHONY : clean +.PHONY : all clean distclean run-client run-server + clean: - -rm -f $(PROGS) $(objects) core + -rm --force $(PROGS) $(objects) core + +distclean: clean +mostlyclean: clean +maintainer-clean: clean + +check: all + ./mandos --check + +run-client: all + ./mandos-client --plugin-dir=plugins.d --options-for=password-request:--keydir=keydir + +run-server: all + ./mandos --debug --configdir=. === modified file 'TODO' --- TODO 2008-08-04 21:25:55 +0000 +++ TODO 2008-08-07 21:45:41 +0000 @@ -2,29 +2,36 @@ * README file -* Mandos client -** [#A] Man page -** [#A] check exit codes of all system calls +* COPYING file + [[file:/usr/share/common-licenses/GPL-3][GPLv3]] + +* Mandos-client +** [#A] Man page: man8/mandos-client.8mandos +** [#A] check return codes of all system calls +** [#B] header files/symbols tally +** use strsep instead of strtok? +** use config file in addition to arguments +** pass things in environment, like device name, etc + +* Password-request +** [#A] Man page: man8/password-request.8mandos +** [#A] check return codes of all system calls ** [#B] header files/symbols tally ** IPv4 support ** use strsep instead of strtok? ** Do not depend on GPG key rings on disk This would mean creating new GPG key rings with GPGME by importing - the key files from scratch every time we start the program. - -* Passprompt -** [#A] Man page - -* Pluginbasedclient -** [#A] Man page -** [#A] check exit codes of all system calls -** [#B] header files/symbols tally -** use strsep instead of strtok? -** use config file in addition to arguments -** pass things in environment, like device name, etc + the key files from scratch on every program start. + +* Password-prompt +** [#A] Man page: man8/password-prompt.8mandos +** Use getpass(3)? + [[info:libc:getpass][GNU LibC Manual: Reading Passwords]] * Server -** [#A] Man page +** [#A] Command man page: man8/mandos.8 +** [#A] Config file man page: man5/mandos.conf (mandos.conf) +** [#A] Config file man page: man5/mandos-clients.conf (clients.conf) ** [#A] write PID file ** [#A] /etc/init.d/mandos-server ** Better comments in config files @@ -34,6 +41,10 @@ ** config for TXT record ** Run-time communication with server probably using D-Bus +** Implement --foreground + [[info:standards:Option%20Table][Table of Long Options]] +** Implement --socket + [[info:standards:Option%20Table][Table of Long Options]] * Mandos-tools/utilities All of this probably using D-Bus @@ -42,8 +53,8 @@ ** Disable client * Installer -** Change initrd.img file to not be publically readable -** Create GPG key ring files in initrd +** [#A] Change initrd.img file to not be publically readable +** [#A] Create GPG key ring files in initrd #+STARTUP: showall === renamed file 'server.py' => 'mandos' --- server.py 2008-08-04 23:38:26 +0000 +++ mandos 2008-08-07 21:45:41 +0000 @@ -616,7 +616,7 @@ return if_nametoindex(interface) -def daemon(nochdir, noclose): +def daemon(nochdir = False, noclose = False): """See daemon(3). Standard BSD Unix function. This should really exist as os.daemon, but it doesn't (yet).""" if os.fork(): @@ -683,7 +683,7 @@ # Parse config file for server-global settings server_config = ConfigParser.SafeConfigParser(server_defaults) del server_defaults - server_config.read(os.path.join(options.configdir, "server.conf")) + server_config.read(os.path.join(options.configdir, "mandos.conf")) server_section = "server" # Convert the SafeConfigParser object to a dict server_settings = dict(server_config.items(server_section)) @@ -753,7 +753,7 @@ for section in client_config.sections())) if not debug: - daemon(False, False) + daemon() def cleanup(): "Cleanup function; run on exit" === renamed file 'plugbasedclient.c' => 'mandos-client.c' === renamed file 'server.conf' => 'mandos.conf' === modified file 'network-protocol.txt' --- network-protocol.txt 2008-08-04 23:38:26 +0000 +++ network-protocol.txt 2008-08-07 21:45:41 +0000 @@ -1,14 +1,18 @@ -Network Protocol Version 1 +The Mandos server announces itself as a Zeroconf service of type +"_mandos._tcp". The Mandos client sends a line of text where the first +whitespace-separated field is the protocol version, which currently is +"1". The client and server then start a TLS protocol handshake with a +slight quirk: the Mandos server program acts as a TLS "client" while +the connecting Mandos client acts as a TLS "server". The Mandos +client must supply an OpenPGP certificate, and the fingerprint of this +certificate is used by the Mandos server to look up (in a list read +from a file at start time) which binary blob to give the client. No +other authentication or authorization is done by the server. -The server announces itself as an IPv6 Zeroconf service of type -"_mandos._tcp". A connecting client sends a line of text where the -first whitespace-separated field is the protocol version, which -currently is "1". The client and server then start a TLS handshake, -with the unusual property that the server program acts as a TLS -"client" and the connecting client acts as a TLS "server". In this -TLS handshake the client must supply an OpenPGP certificate, and the -fingerprint of this certificate is used by the server to look up (in a -list read from file at start time) which binary blob to give the -client. No other authentication or authorization is done by the -server. After the binary blob is sent by the server to the client, -the server closes the connection. +| Mandos server | | Mandos client | +| | | | +| | <- | "1\r\n" | +| | <-> | | +| | <- | OpenPGP public key (part of TLS handshake) | +| | -> | | +| | | | === renamed file 'plugins.d/passprompt.c' => 'plugins.d/password-prompt.c' === renamed file 'plugins.d/mandosclient.c' => 'plugins.d/password-request.c'