/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to plugin-runner.xml

Four new interrelated features:

1. Support using a different network interface via both initramfs.conf
   (the DEVICE setting) and the kernel command line (sixth field of
   the "ip=" option as in Linux' Documentation/nfsroot.txt).

2. Support connecting to a specified Mandos server directly using a
   kernel command line option ("mandos=connect:<ADDRESS>:<PORT>").

3. Support connecting directly to an IPv4 address (and port) using the
   "--connect" option of mandos-client.

4. Support an empty string to the --interface option to mandos-client.

* Makefile (WARN): Increase strictness by changing to
                   "-Wstrict-aliasing=1".

* debian/mandos-client.README.Debian (Use the Correct Network
  Interface): Changed to refer to initramfs.conf and nfsroot.txt.
  (Test the Server): Improve wording.
  (Non-local Connection): New section.
* initramfs-tools-script: Obey DEVICE environment variable and setting
                          from "/conf/initramfs.conf".  Also let any
                          "ip=" kernel command line option override
                          it.  Support new "mandos=connect" option.
                          Call "configure_networking" to set up IP
                          address on interface if necessary.
* plugin-runner.conf: Change example.
* plugins.d/mandos-client.c: Some whitespace and comment changes.
  (start_mandos_communication): Take an additional argument for
                                address family, all callers changed.
                                Connect to an IPv4 address if address
                                family is AF_INET.  Only set IPv6
                                scope_id for link-local addresses.
  (main): Accept empty interface name; this will not bring up any
         interface and leave the interface as unspecified.  Also do
         not restore kernel log level if lowering it failed.
* plugins.d/mandos-client.xml (OPTIONS): Document that the
                                         "--interface" option accepts
                                         an empty string.
  (EXAMPLE): Change example IPv6 address to a link-local address.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugin-runner.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "plugin-runner">
5
 
<!ENTITY TIMESTAMP "2017-02-23">
 
5
<!ENTITY TIMESTAMP "2009-01-17">
6
6
<!ENTITY % common SYSTEM "common.ent">
7
7
%common;
8
8
]>
19
19
        <firstname>Björn</firstname>
20
20
        <surname>Påhlsson</surname>
21
21
        <address>
22
 
          <email>belorn@recompile.se</email>
 
22
          <email>belorn@fukt.bsnet.se</email>
23
23
        </address>
24
24
      </author>
25
25
      <author>
26
26
        <firstname>Teddy</firstname>
27
27
        <surname>Hogeborn</surname>
28
28
        <address>
29
 
          <email>teddy@recompile.se</email>
 
29
          <email>teddy@fukt.bsnet.se</email>
30
30
        </address>
31
31
      </author>
32
32
    </authorgroup>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
 
      <year>2012</year>
39
 
      <year>2013</year>
40
 
      <year>2014</year>
41
 
      <year>2015</year>
42
 
      <year>2016</year>
43
 
      <year>2017</year>
44
36
      <holder>Teddy Hogeborn</holder>
45
37
      <holder>Björn Påhlsson</holder>
46
38
    </copyright>
121
113
      <arg><option>--plugin-dir=<replaceable
122
114
      >DIRECTORY</replaceable></option></arg>
123
115
      <sbr/>
124
 
      <arg><option>--plugin-helper-dir=<replaceable
125
 
      >DIRECTORY</replaceable></option></arg>
126
 
      <sbr/>
127
116
      <arg><option>--config-file=<replaceable
128
117
      >FILE</replaceable></option></arg>
129
118
      <sbr/>
271
260
            Disable the plugin named
272
261
            <replaceable>PLUGIN</replaceable>.  The plugin will not be
273
262
            started.
274
 
          </para>
 
263
          </para>       
275
264
        </listitem>
276
265
      </varlistentry>
277
266
      
330
319
      </varlistentry>
331
320
      
332
321
      <varlistentry>
333
 
        <term><option>--plugin-helper-dir
334
 
        <replaceable>DIRECTORY</replaceable></option></term>
335
 
        <listitem>
336
 
          <para>
337
 
            Specify a different plugin helper directory.  The default
338
 
            is <filename>/lib/mandos/plugin-helpers</filename>, which
339
 
            will exist in the initial <acronym>RAM</acronym> disk
340
 
            environment.  (This will simply be passed to all plugins
341
 
            via the <envar>MANDOSPLUGINHELPERDIR</envar> environment
342
 
            variable.  See <xref linkend="writing_plugins"/>)
343
 
          </para>
344
 
        </listitem>
345
 
      </varlistentry>
346
 
      
347
 
      <varlistentry>
348
322
        <term><option>--config-file
349
323
        <replaceable>FILE</replaceable></option></term>
350
324
        <listitem>
451
425
      <para>
452
426
        The plugin will run in the initial RAM disk environment, so
453
427
        care must be taken not to depend on any files or running
454
 
        services not available there.  Any helper executables required
455
 
        by the plugin (which are not in the <envar>PATH</envar>) can
456
 
        be placed in the plugin helper directory, the name of which
457
 
        will be made available to the plugin via the
458
 
        <envar>MANDOSPLUGINHELPERDIR</envar> environment variable.
 
428
        services not available there.
459
429
      </para>
460
430
      <para>
461
431
        The plugin must exit cleanly and free all allocated resources
504
474
      only passes on its environment to all the plugins.  The
505
475
      environment passed to plugins can be modified using the
506
476
      <option>--global-env</option> and <option>--env-for</option>
507
 
      options.  Also, the <option>--plugin-helper-dir</option> option
508
 
      will affect the environment variable
509
 
      <envar>MANDOSPLUGINHELPERDIR</envar> for the plugins.
 
477
      options.
510
478
    </para>
511
479
  </refsect1>
512
480
  
545
513
            </para>
546
514
          </listitem>
547
515
        </varlistentry>
548
 
        <varlistentry>
549
 
          <term><filename class="directory"
550
 
          >/lib/mandos/plugins.d</filename></term>
551
 
          <listitem>
552
 
            <para>
553
 
              The default plugin directory; can be changed by the
554
 
              <option>--plugin-dir</option> option.
555
 
            </para>
556
 
          </listitem>
557
 
        </varlistentry>
558
 
        <varlistentry>
559
 
          <term><filename class="directory"
560
 
          >/lib/mandos/plugin-helpers</filename></term>
561
 
          <listitem>
562
 
            <para>
563
 
              The default plugin helper directory; can be changed by
564
 
              the <option>--plugin-helper-dir</option> option.
565
 
            </para>
566
 
          </listitem>
567
 
        </varlistentry>
568
516
      </variablelist>
569
517
    </para>
570
518
  </refsect1>
575
523
      The <option>--config-file</option> option is ignored when
576
524
      specified from within a configuration file.
577
525
    </para>
578
 
    <xi:include href="bugs.xml"/>
579
526
  </refsect1>
580
527
  
581
528
  <refsect1 id="examples">
624
571
    </informalexample>
625
572
    <informalexample>
626
573
      <para>
627
 
        Read a different configuration file, run plugins from a
628
 
        different directory, specify an alternate plugin helper
629
 
        directory and add two options to the
 
574
        Run plugins from a different directory, read a different
 
575
        configuration file, and add two options to the
630
576
        <citerefentry><refentrytitle >mandos-client</refentrytitle>
631
577
        <manvolnum>8mandos</manvolnum></citerefentry> plugin:
632
578
      </para>
633
579
      <para>
634
580
 
635
581
<!-- do not wrap this line -->
636
 
<userinput>cd /etc/keys/mandos; &COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/x86_64-linux-gnu/mandos/plugins.d --plugin-helper-dir /usr/lib/x86_64-linux-gnu/mandos/plugin-helpers --options-for=mandos-client:--pubkey=pubkey.txt,--seckey=seckey.txt</userinput>
 
582
<userinput>cd /etc/keys/mandos; &COMMANDNAME;  --config-file=/etc/mandos/plugin-runner.conf --plugin-dir /usr/lib/mandos/plugins.d --options-for=mandos-client:--pubkey=pubkey.txt,--seckey=seckey.txt</userinput>
637
583
 
638
584
      </para>
639
585
    </informalexample>
671
617
  <refsect1 id="see_also">
672
618
    <title>SEE ALSO</title>
673
619
    <para>
674
 
      <citerefentry><refentrytitle>intro</refentrytitle>
675
 
      <manvolnum>8mandos</manvolnum></citerefentry>,
676
620
      <citerefentry><refentrytitle>cryptsetup</refentrytitle>
677
621
      <manvolnum>8</manvolnum></citerefentry>,
678
622
      <citerefentry><refentrytitle>crypttab</refentrytitle>