/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • mto: (237.7.304 trunk)
  • mto: This revision was merged to the branch mainline in revision 325.
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
69
69
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
70
70
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
71
71
        getconf LFS_LDFLAGS)
72
 
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
73
 
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
74
72
 
75
73
# Do not change these two
76
74
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
108
106
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
109
107
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
110
108
        plugins.d/plymouth
111
 
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
112
 
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
109
CPROGS=plugin-runner $(PLUGINS)
113
110
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
114
111
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
115
112
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
242
239
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
243
240
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
244
241
 
245
 
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
246
 
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
247
 
                ) $(LOADLIBES) $(LDLIBS) -o $@
248
 
 
249
242
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
250
243
        check run-client run-server install install-html \
251
244
        install-server install-client-nokey install-client uninstall \
280
273
        @echo "###################################################################"
281
274
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
282
275
        ./plugin-runner --plugin-dir=plugins.d \
283
 
                --plugin-helper-dir=plugin-helpers \
284
276
                --config-file=plugin-runner.conf \
285
277
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
286
278
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
360
352
install-client-nokey: all doc
361
353
        install --directory $(LIBDIR)/mandos $(CONFDIR)
362
354
        install --directory --mode=u=rwx $(KEYDIR) \
363
 
                $(LIBDIR)/mandos/plugins.d \
364
 
                $(LIBDIR)/mandos/plugin-helpers
 
355
                $(LIBDIR)/mandos/plugins.d
365
356
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
366
357
                install --mode=u=rwx \
367
358
                        --directory "$(CONFDIR)/plugins.d"; \
368
 
                install --directory "$(CONFDIR)/plugin-helpers"; \
369
359
        fi
370
360
        install --mode=u=rwx,go=rx --directory \
371
361
                "$(CONFDIR)/network-hooks.d"
391
381
        install --mode=u=rwxs,go=rx \
392
382
                --target-directory=$(LIBDIR)/mandos/plugins.d \
393
383
                plugins.d/plymouth
394
 
        install --mode=u=rwxs,go=rx \
395
 
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
396
 
                plugin-helpers/mandos-client-iprouteadddel
397
384
        install initramfs-tools-hook \
398
385
                $(INITRAMFSTOOLS)/hooks/mandos
399
386
        install --mode=u=rw,go=r initramfs-tools-hook-conf \