/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to intro.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-05-23 20:18:34 UTC
  • mto: (237.7.304 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150523201834-e89ex4ito93yni8x
mandos: Use multiprocessing module to run checkers.

For a long time, the Mandos server has occasionally logged the message
"ERROR: Child process vanished".  This was never a fatal error, but it
has been annoying and slightly worrying, since a definite cause was
not found.  One potential cause could be the "multiprocessing" and
"subprocess" modules conflicting w.r.t. SIGCHLD.  To avoid this,
change the running of checkers from using subprocess.Popen
asynchronously to instead first create a multiprocessing.Process()
(which is asynchronous) calling a function, and have that function
then call subprocess.call() (which is synchronous).  In this way, the
only thing using any asynchronous subprocesses is the multiprocessing
module.

This makes it necessary to change one small thing in the D-Bus API,
since the subprocesses.call() function does not expose the raw wait(2)
status value.

DBUS-API (CheckerCompleted): Change the second value provided by this
                             D-Bus signal from the raw wait(2) status
                             to the actual terminating signal number.
mandos (subprocess_call_pipe): New function to be called by
                               multiprocessing.Process (starting a
                               separate process).
(Client.last_checker signal): New attribute for signal which
                              terminated last checker.  Like
                              last_checker_status, only not accessible
                              via D-Bus.
(Client.checker_callback): Take new "connection" argument and use it
                           to get returncode; set last_checker_signal.
                           Return False so gobject does not call this
                           callback again.
(Client.start_checker): Start checker using a multiprocessing.Process
                        instead of a subprocess.Popen.
(ClientDBus.checker_callback): Take new "connection" argument.        Call
                               Client.checker_callback early to have
                               it set last_checker_status and
                               last_checker_signal; use those.  Change
                               second value provided to D-Bus signal
                               CheckerCompleted to use
                               last_checker_signal if checker was
                               terminated by signal.
mandos-monitor: Update to reflect DBus API change.
(MandosClientWidget.checker_completed): Take "signal" instead of
                                        "condition" argument.  Use it
                                        accordingly.  Remove dead code
                                        (os.WCOREDUMP case).

Show diffs side-by-side

added added

removed removed

Lines of Context:
1
1
<?xml version="1.0" encoding="UTF-8"?>
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
 
<!ENTITY TIMESTAMP "2011-08-08">
 
4
<!ENTITY TIMESTAMP "2015-03-08">
5
5
<!ENTITY % common SYSTEM "common.ent">
6
6
%common;
7
7
]>
18
18
        <firstname>Björn</firstname>
19
19
        <surname>Påhlsson</surname>
20
20
        <address>
21
 
          <email>belorn@fukt.bsnet.se</email>
 
21
          <email>belorn@recompile.se</email>
22
22
        </address>
23
23
      </author>
24
24
      <author>
25
25
        <firstname>Teddy</firstname>
26
26
        <surname>Hogeborn</surname>
27
27
        <address>
28
 
          <email>teddy@fukt.bsnet.se</email>
 
28
          <email>teddy@recompile.se</email>
29
29
        </address>
30
30
      </author>
31
31
    </authorgroup>
32
32
    <copyright>
33
33
      <year>2011</year>
 
34
      <year>2012</year>
34
35
      <holder>Teddy Hogeborn</holder>
35
36
      <holder>Björn Påhlsson</holder>
36
37
    </copyright>
196
197
      </para>
197
198
    </refsect2>
198
199
    
 
200
    <refsect2 id="sniff">
 
201
      <title>How about sniffing the network traffic and decrypting it
 
202
      later by physically grabbing the Mandos client and using its
 
203
      key?</title>
 
204
      <para>
 
205
        We only use <acronym>PFS</acronym> (Perfect Forward Security)
 
206
        key exchange algorithms in TLS, which protects against this.
 
207
      </para>
 
208
    </refsect2>
 
209
    
199
210
    <refsect2 id="physgrab">
200
211
      <title>Physically grabbing the Mandos server computer?</title>
201
212
      <para>
214
225
      </para>
215
226
    </refsect2>
216
227
    
217
 
    <refsect2 id="fakeping">
218
 
      <title>Faking ping replies?</title>
 
228
    <refsect2 id="fakecheck">
 
229
      <title>Faking checker results?</title>
219
230
      <para>
220
 
        The default for the server is to use
 
231
        If the Mandos client does not have an SSH server, the default
 
232
        is for the Mandos server to use
221
233
        <quote><literal>fping</literal></quote>, the replies to which
222
234
        could be faked to eliminate the timeout.  But this could
223
235
        easily be changed to any shell command, with any security
224
 
        measures you like.  It could, for instance, be changed to an
225
 
        SSH command with strict keychecking, which could not be faked.
226
 
        Or IPsec could be used for the ping packets, making them
227
 
        secure.
 
236
        measures you like.  If the Mandos client
 
237
        <emphasis>has</emphasis> an SSH server, the default
 
238
        configuration (as generated by
 
239
        <command>mandos-keygen</command> with the
 
240
        <option>--password</option> option) is for the Mandos server
 
241
        to use an <command>ssh-keyscan</command> command with strict
 
242
        keychecking, which can not be faked.  Alternatively, IPsec
 
243
        could be used for the ping packets, making them secure.
228
244
      </para>
229
245
    </refsect2>
230
246
  </refsect1>
392
408
    <variablelist>
393
409
      <varlistentry>
394
410
        <term>
395
 
          <ulink url="http://www.fukt.bsnet.se/mandos">Mandos</ulink>
 
411
          <ulink url="http://www.recompile.se/mandos">Mandos</ulink>
396
412
        </term>
397
413
        <listitem>
398
414
          <para>