/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to plugins.d/mandos-client.xml

  • Committer: Teddy Hogeborn
  • Date: 2015-07-01 20:01:26 UTC
  • mto: This revision was merged to the branch mainline in revision 759.
  • Revision ID: teddy@recompile.se-20150701200126-qb3f6c3jcas2f4og
mandos-client: Try to start a plugin to add and remove a local route.

* debian/mandos-client.README.Debian: Add setting of environment
                                      variable MANDOSPLUGINHELPERDIR
                                      to command line testing
                                      mandos-client.
* mandos-client.c (raise_privileges): Moved to top of file.
                  (raise_privileges_permanently): - '' -
                  (lower_privileges): - '' -
                  (lower_privileges_permanently): - '' -
  (add_remove_local_route, add_local_route, remove_local_route): New.
  (start_mandos_communication): Set SOCK_CLOEXEC flag on socket.  Run
                                the above functions to add (and
                                remove) local route, if the conditions
                                indicates it could help.
  (run_network_hooks): Use O_DIRECTORY, O_PATH, and O_CLOEXEC flags
                       when opening network hook directory. Do
                       TEMP_FAILURE_RETRY around opening of /dev/null
                       and network hook executables.  Move redirecting
                       of stdout and stderr to as late as possible
                       before fexecve().
  (main): Use O_DIRECTORY and O_PATH when opening temporary directory.
* plugins.d/mandos-client.xml (ENVIRONMENT): Document usage of the
                                             MANDOSPLUGINHELPERDIR
                                             environment variable.

Show diffs side-by-side

added added

removed removed

Lines of Context:
plugins.d/mandos-client.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
        "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-client">
5
 
<!ENTITY TIMESTAMP "2018-02-08">
 
5
<!ENTITY TIMESTAMP "2015-06-29">
6
6
<!ENTITY % common SYSTEM "../common.ent">
7
7
%common;
8
8
]>
33
33
    <copyright>
34
34
      <year>2008</year>
35
35
      <year>2009</year>
36
 
      <year>2010</year>
37
 
      <year>2011</year>
38
36
      <year>2012</year>
39
37
      <year>2013</year>
40
38
      <year>2014</year>
41
39
      <year>2015</year>
42
 
      <year>2016</year>
43
 
      <year>2017</year>
44
 
      <year>2018</year>
45
40
      <holder>Teddy Hogeborn</holder>
46
41
      <holder>Björn Påhlsson</holder>
47
42
    </copyright>
104
99
      </arg>
105
100
      <sbr/>
106
101
      <arg>
107
 
        <option>--dh-params <replaceable>FILE</replaceable></option>
108
 
      </arg>
109
 
      <sbr/>
110
 
      <arg>
111
102
        <option>--delay <replaceable>SECONDS</replaceable></option>
112
103
      </arg>
113
104
      <sbr/>
321
312
        <listitem>
322
313
          <para>
323
314
            Sets the number of bits to use for the prime number in the
324
 
            TLS Diffie-Hellman key exchange.  The default value is
325
 
            selected automatically based on the OpenPGP key.  Note
326
 
            that if the <option>--dh-params</option> option is used,
327
 
            the values from that file will be used instead.
328
 
          </para>
329
 
        </listitem>
330
 
      </varlistentry>
331
 
      
332
 
      <varlistentry>
333
 
        <term><option>--dh-params=<replaceable
334
 
        >FILE</replaceable></option></term>
335
 
        <listitem>
336
 
          <para>
337
 
            Specifies a PEM-encoded PKCS#3 file to read the parameters
338
 
            needed by the TLS Diffie-Hellman key exchange from.  If
339
 
            this option is not given, or if the file for some reason
340
 
            could not be used, the parameters will be generated on
341
 
            startup, which will take some time and processing power.
342
 
            Those using servers running under time, power or processor
343
 
            constraints may want to generate such a file in advance
344
 
            and use this option.
 
315
            TLS Diffie-Hellman key exchange.  Default is 1024.
345
316
          </para>
346
317
        </listitem>
347
318
      </varlistentry>
695
666
    </variablelist>
696
667
  </refsect1>
697
668
  
698
 
  <refsect1 id="bugs">
699
 
    <title>BUGS</title>
700
 
    <xi:include href="../bugs.xml"/>
701
 
  </refsect1>
 
669
<!--   <refsect1 id="bugs"> -->
 
670
<!--     <title>BUGS</title> -->
 
671
<!--     <para> -->
 
672
<!--     </para> -->
 
673
<!--   </refsect1> -->
702
674
  
703
675
  <refsect1 id="example">
704
676
    <title>EXAMPLE</title>
844
816
      </varlistentry>
845
817
      <varlistentry>
846
818
        <term>
847
 
          <ulink url="https://www.gnutls.org/">GnuTLS</ulink>
 
819
          <ulink url="http://www.gnu.org/software/gnutls/"
 
820
          >GnuTLS</ulink>
848
821
        </term>
849
822
      <listitem>
850
823
        <para>
856
829
      </varlistentry>
857
830
      <varlistentry>
858
831
        <term>
859
 
          <ulink url="https://www.gnupg.org/related_software/gpgme/"
 
832
          <ulink url="http://www.gnupg.org/related_software/gpgme/"
860
833
                 >GPGME</ulink>
861
834
        </term>
862
835
        <listitem>
900
873
      </varlistentry>
901
874
      <varlistentry>
902
875
        <term>
903
 
          RFC 5246: <citetitle>The Transport Layer Security (TLS)
904
 
          Protocol Version 1.2</citetitle>
 
876
          RFC 4346: <citetitle>The Transport Layer Security (TLS)
 
877
          Protocol Version 1.1</citetitle>
905
878
        </term>
906
879
      <listitem>
907
880
        <para>
908
 
          TLS 1.2 is the protocol implemented by GnuTLS.
 
881
          TLS 1.1 is the protocol implemented by GnuTLS.
909
882
        </para>
910
883
      </listitem>
911
884
      </varlistentry>
922
895
      </varlistentry>
923
896
      <varlistentry>
924
897
        <term>
925
 
          RFC 6091: <citetitle>Using OpenPGP Keys for Transport Layer
 
898
          RFC 5081: <citetitle>Using OpenPGP Keys for Transport Layer
926
899
          Security</citetitle>
927
900
        </term>
928
901
      <listitem>