/mandos/trunk

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/trunk

« back to all changes in this revision

Viewing changes to Makefile

  • Committer: Teddy Hogeborn
  • Date: 2015-03-10 18:03:38 UTC
  • Revision ID: teddy@recompile.se-20150310180338-pcxw6r2qmw9k6br9
Add ":!RSA" to GnuTLS priority string, to disallow non-DHE kx.

If Mandos was somehow made to use a non-ephemeral Diffie-Hellman key
exchange algorithm in the TLS handshake, any saved network traffic
could then be decrypted later if the Mandos client key was obtained.
By default, Mandos uses ephemeral DH key exchanges which does not have
this problem, but a non-ephemeral key exchange algorithm was still
enabled by default.  The simplest solution is to simply turn that off,
which ensures that Mandos will always use ephemeral DH key exchanges.

There is a "PFS" priority string specifier, but we can't use it because:

1. Security-wise, it is a mix between "NORMAL" and "SECURE128" - it
   enables a lot more algorithms than "SECURE256".

2. It is only available since GnuTLS 3.2.4.

Thanks to Andreas Fischer <af@bantuX.org> for reporting this issue.

Show diffs side-by-side

added added

removed removed

Lines of Context:
Makefile
14
14
# For info about _FORTIFY_SOURCE, see feature_test_macros(7)
15
15
# and <http://gcc.gnu.org/ml/gcc-patches/2004-09/msg02055.html>.
16
16
FORTIFY=-D_FORTIFY_SOURCE=2 -fstack-protector-all -fPIC
17
 
# <https://developerblog.redhat.com/2014/10/16/gcc-undefined-behavior-sanitizer-ubsan/>
18
 
ALL_SANITIZE_OPTIONS:=-fsanitize=address -fsanitize=undefined \
19
 
        -fsanitize=shift -fsanitize=integer-divide-by-zero \
20
 
        -fsanitize=unreachable -fsanitize=vla-bound -fsanitize=null \
21
 
        -fsanitize=return -fsanitize=signed-integer-overflow \
22
 
        -fsanitize=bounds -fsanitize=alignment \
23
 
        -fsanitize=object-size -fsanitize=float-divide-by-zero \
24
 
        -fsanitize=float-cast-overflow -fsanitize=nonnull-attribute \
25
 
        -fsanitize=returns-nonnull-attribute -fsanitize=bool \
26
 
        -fsanitize=enum
27
 
# Check which sanitizing options can be used
28
 
SANITIZE:=$(foreach option,$(ALL_SANITIZE_OPTIONS),$(shell \
29
 
        echo 'int main(){}' | $(CC) --language=c $(option) /dev/stdin \
30
 
        -o /dev/null >/dev/null 2>&1 && echo $(option)))
31
17
LINK_FORTIFY_LD=-z relro -z now
32
18
LINK_FORTIFY=
33
19
 
38
24
endif
39
25
#COVERAGE=--coverage
40
26
OPTIMIZE=-Os -fno-strict-aliasing
41
 
LANGUAGE=-std=gnu11
 
27
LANGUAGE=-std=gnu99
42
28
htmldir=man
43
 
version=1.7.7
 
29
version=1.6.9
44
30
SED=sed
45
31
 
46
32
USER=$(firstword $(subst :, ,$(shell getent passwd _mandos || getent passwd nobody || echo 65534)))
47
 
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nogroup || echo 65534)))
 
33
GROUP=$(firstword $(subst :, ,$(shell getent group _mandos || getent group nobody || echo 65534)))
48
34
 
49
35
## Use these settings for a traditional /usr/local install
50
36
# PREFIX=$(DESTDIR)/usr/local
75
61
##
76
62
 
77
63
SYSTEMD=$(DESTDIR)$(shell pkg-config systemd --variable=systemdsystemunitdir)
78
 
TMPFILES=$(DESTDIR)$(shell pkg-config systemd --variable=tmpfilesdir)
79
64
 
80
65
GNUTLS_CFLAGS=$(shell pkg-config --cflags-only-I gnutls)
81
66
GNUTLS_LIBS=$(shell pkg-config --libs gnutls)
84
69
GPGME_CFLAGS=$(shell gpgme-config --cflags; getconf LFS_CFLAGS)
85
70
GPGME_LIBS=$(shell gpgme-config --libs; getconf LFS_LIBS; \
86
71
        getconf LFS_LDFLAGS)
87
 
LIBNL3_CFLAGS=$(shell pkg-config --cflags-only-I libnl-route-3.0)
88
 
LIBNL3_LIBS=$(shell pkg-config --libs libnl-route-3.0)
89
72
 
90
73
# Do not change these two
91
 
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(SANITIZE) $(COVERAGE) \
92
 
        $(OPTIMIZE) $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) \
93
 
        $(GPGME_CFLAGS) -DVERSION='"$(version)"'
 
74
CFLAGS+=$(WARN) $(DEBUG) $(FORTIFY) $(COVERAGE) $(OPTIMIZE) \
 
75
        $(LANGUAGE) $(GNUTLS_CFLAGS) $(AVAHI_CFLAGS) $(GPGME_CFLAGS) \
 
76
        -DVERSION='"$(version)"'
94
77
LDFLAGS+=-Xlinker --as-needed $(COVERAGE) $(LINK_FORTIFY) $(foreach flag,$(LINK_FORTIFY_LD),-Xlinker $(flag))
95
78
 
96
79
# Commands to format a DocBook <refentry> document into a manual page
123
106
PLUGINS=plugins.d/password-prompt plugins.d/mandos-client \
124
107
        plugins.d/usplash plugins.d/splashy plugins.d/askpass-fifo \
125
108
        plugins.d/plymouth
126
 
PLUGIN_HELPERS=plugin-helpers/mandos-client-iprouteadddel
127
 
CPROGS=plugin-runner $(PLUGINS) $(PLUGIN_HELPERS)
 
109
CPROGS=plugin-runner $(PLUGINS)
128
110
PROGS=mandos mandos-keygen mandos-ctl mandos-monitor $(CPROGS)
129
111
DOCS=mandos.8 mandos-keygen.8 mandos-monitor.8 mandos-ctl.8 \
130
112
        mandos.conf.5 mandos-clients.conf.5 plugin-runner.8mandos \
257
239
        $(LINK.c) $^ -lrt $(GNUTLS_LIBS) $(AVAHI_LIBS) $(strip\
258
240
                ) $(GPGME_LIBS) $(LOADLIBES) $(LDLIBS) -o $@
259
241
 
260
 
plugin-helpers/mandos-client-iprouteadddel: plugin-helpers/mandos-client-iprouteadddel.c
261
 
        $(LINK.c) $(LIBNL3_CFLAGS) $^ $(LIBNL3_LIBS) $(strip\
262
 
                ) $(LOADLIBES) $(LDLIBS) -o $@
263
 
 
264
242
.PHONY : all doc html clean distclean mostlyclean maintainer-clean \
265
243
        check run-client run-server install install-html \
266
244
        install-server install-client-nokey install-client uninstall \
295
273
        @echo "###################################################################"
296
274
# We set GNOME_KEYRING_CONTROL to block pam_gnome_keyring
297
275
        ./plugin-runner --plugin-dir=plugins.d \
298
 
                --plugin-helper-dir=plugin-helpers \
299
276
                --config-file=plugin-runner.conf \
300
277
                --options-for=mandos-client:--seckey=keydir/seckey.txt,--pubkey=keydir/pubkey.txt,--network-hook-dir=network-hooks.d \
301
278
                --env-for=mandos-client:GNOME_KEYRING_CONTROL= \
338
315
        elif install --directory --mode=u=rwx $(STATEDIR); then \
339
316
                chown -- $(USER):$(GROUP) $(STATEDIR) || :; \
340
317
        fi
341
 
        if [ "$(TMPFILES)" != "$(DESTDIR)" -a -d "$(TMPFILES)" ]; then \
342
 
                install --mode=u=rw,go=r tmpfiles.d-mandos.conf \
343
 
                        $(TMPFILES)/mandos.conf; \
344
 
        fi
345
318
        install --mode=u=rwx,go=rx mandos $(PREFIX)/sbin/mandos
346
319
        install --mode=u=rwx,go=rx --target-directory=$(PREFIX)/sbin \
347
320
                mandos-ctl
379
352
install-client-nokey: all doc
380
353
        install --directory $(LIBDIR)/mandos $(CONFDIR)
381
354
        install --directory --mode=u=rwx $(KEYDIR) \
382
 
                $(LIBDIR)/mandos/plugins.d \
383
 
                $(LIBDIR)/mandos/plugin-helpers
 
355
                $(LIBDIR)/mandos/plugins.d
384
356
        if [ "$(CONFDIR)" != "$(LIBDIR)/mandos" ]; then \
385
357
                install --mode=u=rwx \
386
 
                        --directory "$(CONFDIR)/plugins.d" \
387
 
                        "$(CONFDIR)/plugin-helpers"; \
 
358
                        --directory "$(CONFDIR)/plugins.d"; \
388
359
        fi
389
360
        install --mode=u=rwx,go=rx --directory \
390
361
                "$(CONFDIR)/network-hooks.d"
410
381
        install --mode=u=rwxs,go=rx \
411
382
                --target-directory=$(LIBDIR)/mandos/plugins.d \
412
383
                plugins.d/plymouth
413
 
        install --mode=u=rwx,go=rx \
414
 
                --target-directory=$(LIBDIR)/mandos/plugin-helpers \
415
 
                plugin-helpers/mandos-client-iprouteadddel
416
384
        install initramfs-tools-hook \
417
385
                $(INITRAMFSTOOLS)/hooks/mandos
418
386
        install --mode=u=rw,go=r initramfs-tools-hook-conf \
436
404
                > $(MANDIR)/man8/askpass-fifo.8mandos.gz
437
405
        gzip --best --to-stdout plugins.d/plymouth.8mandos \
438
406
                > $(MANDIR)/man8/plymouth.8mandos.gz
439
 
        gzip --best --to-stdout intro.8mandos \
440
 
                > $(MANDIR)/man8/intro.8mandos.gz
441
407
 
442
408
install-client: install-client-nokey
443
409
# Post-installation stuff