/mandos/trunk : changes

» Changes from revision 745

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk

From Revision 745 to 726

expand all

Rev	Summary	Authors	Date
745	mandos-ctl: Do minor formatting and whitespace adjustments. mandos-ctl: Do minor formatting and whitespace adjustments.	Teddy Hogeborn	10 years ago
744	Add "!RSA" also to examples/documentation. Add "!RSA" also to examples/documentation. * mandos.conf (priority): Add "!RSA" to default commented-out value. * mandos.conf.xml (EXAMPLE): Add "!RSA" to example priority setting.	Teddy Hogeborn	10 years ago
743	Automatically determine the number of DH bits in the TLS han... Automatically determine the number of DH bits in the TLS handshake. Instead of using a default value of 1024, check the OpenPGP key and determine an appropriate number of DH bits to use, (using GnuTLS functions made for this). Document this new default behavior. * plugins.d/mandos-client.c (safe_string): New function. (init_gnutls_global): If not specified, determine the number of DH bits to use, based on the OpenPGP key. * plugins.d/mandos-client.xml (OPTIONS): Document this new default of the --dh-bits option. Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.	Teddy Hogeborn	10 years ago
742	Add ":!RSA" to GnuTLS priority string, to disallow non-DHE k... Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx. If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key exchange algorithm in the TLS handshake, any saved network traffic could then be decrypted later if the Mandos client key was obtained. By default, Mandos uses ephemeral DH key exchanges which does not have this problem, but a non-ephemeral key exchange algorithm was still enabled by default. The simplest solution is to simply turn that off, which ensures that Mandos will always use ephemeral DH key exchanges. There is a "PFS" priority string specifier, but we can't use it because: 1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it enables a lot more algorithms than "SECURE256". 2. It is only available since GnuTLS 3.2.4. Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.	Teddy Hogeborn	10 years ago
741	mandos.xml (SEE ALSO): Update links. mandos.xml (SEE ALSO): Update links. Update link to GnuPG home page, change reference from TLS 1.1 to TLS 1.2, and change to latest RFC for using OpenPGP keys with TLS (and use its correct title).	Teddy Hogeborn	10 years ago
740	mandos-keygen: Fix some stylistic quoting issues. mandos-keygen: Fix some stylistic quoting issues.	Teddy Hogeborn	10 years ago
739	mandos (Client.config_parser): Move comment to correct place... mandos (Client.config_parser): Move comment to correct place. A comment was left behind when the code was rewritten; move the comment to the appropriate place.	Teddy Hogeborn	10 years ago
738	Handle local Zeroconf service name collisions. Handle local Zeroconf service name collisions. Service name collisions from other servers have always been handled, but not local name collisions from services on the same host. * mandos (AvahiService/rename): Handle local Zeroconf service name collision. (AvahiServiceToSyslog.rename): Pass on any extra arguments.	Teddy Hogeborn	11 years ago
737	Update Debian package standards version to 3.9.6. Update Debian package standards version to 3.9.6. * debian/control (Standards-Version): Changed to "3.9.6".	Teddy Hogeborn	11 years ago
736	Merge from release branch. Merge from release branch.	Teddy Hogeborn	11 years ago
735	When building Debian package, prefer libgnutls28 to libgnutl... When building Debian package, prefer libgnutls28 to libgnutls26. This is part of the Debian "gnutls28" transition. * debian/control (Build-Depends): Change "libgnutls-dev" to "libgnutls28-dev \| gnutls-dev".	Teddy Hogeborn	11 years ago
734	* mandos.service ([Unit]/Documentation): New. * mandos.service ([Unit]/Documentation): New.	Teddy Hogeborn	11 years ago
733	mandos-client: Bug fix: Check fork() return value. mandos-client: Bug fix: Check fork() return value. When executing network hook scripts, check fork() return value. * plugins.d/mandos-client.c (run_network_hooks): Bug fix: check if fork() returns -1.	Teddy Hogeborn	11 years ago
732	Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChange... Emit D-Bus "org.freedesktop.DBus.Properties.PropertiesChanged" signal. This deprecates the "se.recompile.Mandos.Client.PropertyChanged" signal. The new signal also adds support for noticing changes to the "se.recompile.Mandos.Client.Secret" write-only property. * mandos (dbus_annotations): Fix usage example in doc string. (DBusObjectWithProperties.PropertiesChanged): New; from D-Bus standard. (ClientDBus._interface): Set early instead of later. (ClientDBus.notifychangeproperty): Take new "invalidate_only" parameter, and pass in _interface as a default keyword argument. (ClientDBus.notifychangeproperty/setter): Also emit PropertiesChanged signal; emit new value or invalidation depending on "invalidate_only". (ClientDBus.secret): Apply notifychangeproperty with "invalidate_only=True". (ClientDBus._foo): Removed defunct interface annotation. (ClientDBus.PropertyChanged): Add annotation; this method is now deprecated. (main/MandosDBusService.GetAllClientsWithProperties): Use dictionary comprehension. * DBUS-API (Mandos Client Interface/Signals/PropertyChanged): Removed. * mandos-monitor: Use standard "PropertiesChanged" signal instead of old signal "PropertyChanged". (MandosClientPropertyCache.__init__): Connect to signal PropertiesChanged instead of PropertyChanged. (MandosClientPropertyCache._property_changed): Removed. (MandosClientPropertyCache.property_changed): Renamed to "properties_changed" and adapted to new call signature. (MandosClientWidget.properties_changed): - '' -	Teddy Hogeborn	11 years ago
731	askpass-fifo: Lower privileges after opening FIFO. askpass-fifo: Lower privileges after opening FIFO. * plugins.d/askpass-fifo.c (main): Lower privileges after opening FIFO.	Teddy Hogeborn	11 years ago
730	mandos: Replace unicode() with str(). mandos: Replace unicode() with str(). This is in preparation for the coming Python 3 conversion. * mandos: Replace "str" with "unicode". All callers changed.	Teddy Hogeborn	11 years ago
729	mandos: Stop using str() and remove unnecessary unicode() ca... mandos: Stop using str() and remove unnecessary unicode() calls. * mandos (if_nametoindex): Use "bytes" literal instead of str(). (initlogger): Use a unicode string for log device. (AvahiError.__unicode__): Removed. (DBusPropertyException.__unicode__): - '' - (ClientDBus.Secret_dbus_property): Use bytes() instead of str(). (IPv6_TCPServer.server_bind): Use .encode() instead of str(). (string_to_delta): Removed unnecessary unicode() call. (main): Use "isinstance(x, bytes)" instead of "type(x) is str", use .decode() instead of unicode(), and use .encode() instead of str().	Teddy Hogeborn	11 years ago
728	Merge from release branch. Merge from release branch.	Teddy Hogeborn	11 years ago
727	Bug fix for mandos-keygen: Unquote escaped hostname in SSH c... Bug fix for mandos-keygen: Unquote escaped hostname in SSH checker. %%(host)s is already escaped by re.escape(), and should not be quoted. * mandos-keygen (password): When printing SSH key fingerprinting checker command of the client config section, do not quote %%(host)s.	Teddy Hogeborn	11 years ago
726	Do not set BusName in systemd service file for Mandos server... Do not set BusName in systemd service file for Mandos server. It was not documented what this did for non-"dbus" service types, but apparently systemd now shows a warning about this. * mandos.service (BusName): Commented out.	Teddy Hogeborn	11 years ago

Older »