To get this branch, use:
bzr branch
http://bzr.recompile.se/loggerhead/mandos/trunk
« back to all changes in this revision
Viewing changes to plugins.d/mandos-client.xml
- browse files at revision 828
- compare with another revision
- download diff
- download tarball
- view history from revision 828
- Committer: Teddy Hogeborn
- Date: 2016-03-09 21:23:21 UTC
- Revision ID: teddy@recompile.se-20160309212321-2qlkzj9tecepc8xq
Server: Add Python 3 compatibility
Add Python 3 compatibility by not using the python-avahi module. Also
fix miscellaneous things which differs in Python 3. Especially hard
to fix is loading and saving clients data between Python 3 and 2,
since pickle formats have problems with strings.
* INSTALL: Remove python-avahi (and change python-gobject to
python-gi, which is preferred now).
* debian/control (Source: mandos/Build-Depends-Indep): Remove
"python-avahi".
* mandos: Wrap future_builtins import in try-except clause. Do not
import avahi module. Use codecs.decode(..., "base64) instead of
.decode("base64). Use .keys(), .values(), and .items() instead of
.iterkeys(), .itervalues(), and .iteritems().
(alternate_dbus_interfaces/wrapper): Python 3 still requires the
"black magic", but luckily it still works. The Python 3 type()
constructor requires first argument to be a string, not a byte
string.
(copy_function): New. Use throughout.
(Avahi, avahi): New class and global variable.
(GnuTLS._need_version): Changed to be a byte string.
(main): Decode byte strings loaded from pickle file.
(main/cleanup): Dump using pickle prototoc 2 which Python 2 can
read.
Add Python 3 compatibility by not using the python-avahi module. Also
fix miscellaneous things which differs in Python 3. Especially hard
to fix is loading and saving clients data between Python 3 and 2,
since pickle formats have problems with strings.
* INSTALL: Remove python-avahi (and change python-gobject to
python-gi, which is preferred now).
* debian/control (Source: mandos/Build-Depends-Indep): Remove
"python-avahi".
* mandos: Wrap future_builtins import in try-except clause. Do not
import avahi module. Use codecs.decode(..., "base64) instead of
.decode("base64). Use .keys(), .values(), and .items() instead of
.iterkeys(), .itervalues(), and .iteritems().
(alternate_dbus_interfaces/wrapper): Python 3 still requires the
"black magic", but luckily it still works. The Python 3 type()
constructor requires first argument to be a string, not a byte
string.
(copy_function): New. Use throughout.
(Avahi, avahi): New class and global variable.
(GnuTLS._need_version): Changed to be a byte string.
(main): Decode byte strings loaded from pickle file.
(main/cleanup): Dump using pickle prototoc 2 which Python 2 can
read.
- files added:
- bugs.xml
- debian/upstream
- network-hooks.d
- plugin-helpers
- files modified:
- .bzrignore
added
removed
plugins.d/mandos-client.xml
2
2
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3
3
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4
4
<!ENTITY COMMANDNAME "mandos-client">
5
<!ENTITY TIMESTAMP "2011-10-03">
5
<!ENTITY TIMESTAMP "2016-03-05">
6
6
<!ENTITY % common SYSTEM "../common.ent">
7
7
%common;
8
8
]>
33
33
<copyright>
34
34
<year>2008</year>
35
35
<year>2009</year>
36
<year>2010</year>
36
37
<year>2011</year>
38
<year>2012</year>
39
<year>2013</year>
40
<year>2014</year>
41
<year>2015</year>
42
<year>2016</year>
37
43
<holder>Teddy Hogeborn</holder>
38
44
<holder>Björn Påhlsson</holder>
39
45
</copyright>
64
70
><replaceable>PORT</replaceable></option></arg>
65
71
</group>
66
72
<sbr/>
67
<group>
73
<group rep='repeat'>
68
74
<arg choice="plain"><option>--interface
69
<replaceable>NAME</replaceable></option></arg>
70
<arg choice="plain"><option>-i
71
<replaceable>NAME</replaceable></option></arg>
75
<replaceable>NAME</replaceable><arg rep='repeat'
76
>,<replaceable>NAME</replaceable></arg></option></arg>
77
<arg choice="plain"><option>-i <replaceable>NAME</replaceable
78
><arg rep='repeat'>,<replaceable>NAME</replaceable></arg
79
></option></arg>
72
80
</group>
73
81
<sbr/>
74
82
<group>
94
102
</arg>
95
103
<sbr/>
96
104
<arg>
105
<option>--dh-params <replaceable>FILE</replaceable></option>
106
</arg>
107
<sbr/>
108
<arg>
97
109
<option>--delay <replaceable>SECONDS</replaceable></option>
98
110
</arg>
99
111
<sbr/>
102
114
</arg>
103
115
<sbr/>
104
116
<arg>
117
<option>--network-hook-dir
118
<replaceable>DIR</replaceable></option>
119
</arg>
120
<sbr/>
121
<arg>
105
122
<option>--debug</option>
106
123
</arg>
107
124
</cmdsynopsis>
132
149
communicates with <citerefentry><refentrytitle
133
150
>mandos</refentrytitle><manvolnum>8</manvolnum></citerefentry>
134
151
to get a password. In slightly more detail, this client program
135
brings up a network interface, uses the interface’s IPv6
136
link-local address to get network connectivity, uses Zeroconf to
137
find servers on the local network, and communicates with servers
138
using TLS with an OpenPGP key to ensure authenticity and
152
brings up network interfaces, uses the interfaces’ IPv6
153
link-local addresses to get network connectivity, uses Zeroconf
154
to find servers on the local network, and communicates with
155
servers using TLS with an OpenPGP key to ensure authenticity and
139
156
confidentiality. This client program keeps running, trying all
140
157
servers on the network, until it receives a satisfactory reply
141
158
or a TERM signal. After all servers have been tried, all
143
160
will wait indefinitely for new servers to appear.
144
161
</para>
145
162
<para>
163
The network interfaces are selected like this: If any interfaces
164
are specified using the <option>--interface</option> option,
165
those interface are used. Otherwise,
166
<command>&COMMANDNAME;</command> will use all interfaces that
167
are not loopback interfaces, are not point-to-point interfaces,
168
are capable of broadcasting and do not have the NOARP flag (see
169
<citerefentry><refentrytitle>netdevice</refentrytitle>
170
<manvolnum>7</manvolnum></citerefentry>). (If the
171
<option>--connect</option> option is used, point-to-point
172
interfaces and non-broadcast interfaces are accepted.) If any
173
used interfaces are not up and running, they are first taken up
174
(and later taken down again on program exit).
175
</para>
176
<para>
177
Before network interfaces are selected, all <quote>network
178
hooks</quote> are run; see <xref linkend="network-hooks"/>.
179
</para>
180
<para>
146
181
This program is not meant to be run directly; it is really meant
147
182
to run as a plugin of the <application>Mandos</application>
148
183
<citerefentry><refentrytitle>plugin-runner</refentrytitle>
193
228
assumed to separate the address from the port number.
194
229
</para>
195
230
<para>
196
This option is normally only useful for testing and
197
debugging.
231
Normally, Zeroconf would be used to locate Mandos servers,
232
in which case this option would only be used when testing
233
and debugging.
198
234
</para>
199
235
</listitem>
200
236
</varlistentry>
201
237
202
238
<varlistentry>
203
239
<term><option>--interface=<replaceable
204
>NAME</replaceable></option></term>
240
>NAME</replaceable><arg rep='repeat'>,<replaceable
241
>NAME</replaceable></arg></option></term>
205
242
<term><option>-i
206
<replaceable>NAME</replaceable></option></term>
243
<replaceable>NAME</replaceable><arg rep='repeat'>,<replaceable
244
>NAME</replaceable></arg></option></term>
207
245
<listitem>
208
246
<para>
209
Network interface that will be brought up and scanned for
210
Mandos servers to connect to. The default is the empty
211
string, which will automatically choose an appropriate
212
interface.
247
Comma separated list of network interfaces that will be
248
brought up and scanned for Mandos servers to connect to.
249
The default is the empty string, which will automatically
250
use all appropriate interfaces.
213
251
</para>
214
252
<para>
215
If the <option>--connect</option> option is used, this
216
specifies the interface to use to connect to the address
217
given.
253
If the <option>--connect</option> option is used, and
254
exactly one interface name is specified (except
255
<quote><literal>none</literal></quote>), this specifies
256
the interface to use to connect to the address given.
218
257
</para>
219
258
<para>
220
259
Note that since this program will normally run in the
221
260
initial RAM disk environment, the interface must be an
222
261
interface which exists at that stage. Thus, the interface
223
can not be a pseudo-interface such as <quote>br0</quote>
224
or <quote>tun0</quote>; such interfaces will not exist
225
until much later in the boot process, and can not be used
226
by this program.
262
can normally not be a pseudo-interface such as
263
<quote>br0</quote> or <quote>tun0</quote>; such interfaces
264
will not exist until much later in the boot process, and
265
can not be used by this program, unless created by a
266
<quote>network hook</quote> — see <xref
267
linkend="network-hooks"/>.
227
268
</para>
228
269
<para>
229
270
<replaceable>NAME</replaceable> can be the string
230
<quote><literal>none</literal></quote>; this will not use
231
any specific interface, and will not bring up an interface
232
on startup. This is not recommended, and only meant for
233
advanced users.
271
<quote><literal>none</literal></quote>; this will make
272
<command>&COMMANDNAME;</command> only bring up interfaces
273
specified <emphasis>before</emphasis> this string. This
274
is not recommended, and only meant for advanced users.
234
275
</para>
235
276
</listitem>
236
277
</varlistentry>
278
319
<listitem>
279
320
<para>
280
321
Sets the number of bits to use for the prime number in the
281
TLS Diffie-Hellman key exchange. Default is 1024.
322
TLS Diffie-Hellman key exchange. The default value is
323
selected automatically based on the OpenPGP key. Note
324
that if the <option>--dh-params</option> option is used,
325
the values from that file will be used instead.
326
</para>
327
</listitem>
328
</varlistentry>
329
330
<varlistentry>
331
<term><option>--dh-params=<replaceable
332
>FILE</replaceable></option></term>
333
<listitem>
334
<para>
335
Specifies a PEM-encoded PKCS#3 file to read the parameters
336
needed by the TLS Diffie-Hellman key exchange from. If
337
this option is not given, or if the file for some reason
338
could not be used, the parameters will be generated on
339
startup, which will take some time and processing power.
340
Those using servers running under time, power or processor
341
constraints may want to generate such a file in advance
342
and use this option.
282
343
</para>
283
344
</listitem>
284
345
</varlistentry>
288
349
>SECONDS</replaceable></option></term>
289
350
<listitem>
290
351
<para>
291
After bringing the network interface up, the program waits
352
After bringing a network interface up, the program waits
292
353
for the interface to arrive in a <quote>running</quote>
293
354
state before proceeding. During this time, the kernel log
294
355
level will be lowered to reduce clutter on the system
311
372
</para>
312
373
</listitem>
313
374
</varlistentry>
375
376
<varlistentry>
377
<term><option>--network-hook-dir=<replaceable
378
>DIR</replaceable></option></term>
379
<listitem>
380
<para>
381
Network hook directory. The default directory is
382
<quote><filename class="directory"
383
>/lib/mandos/network-hooks.d</filename></quote>.
384
</para>
385
</listitem>
386
</varlistentry>
314
387
315
388
<varlistentry>
316
389
<term><option>--debug</option></term>
377
450
<refentrytitle>plugin-runner</refentrytitle>
378
451
<manvolnum>8mandos</manvolnum></citerefentry>) is used to run
379
452
both this program and others in in parallel,
380
<emphasis>one</emphasis> of which will prompt for passwords on
381
the system console.
453
<emphasis>one</emphasis> of which (<citerefentry>
454
<refentrytitle>password-prompt</refentrytitle>
455
<manvolnum>8mandos</manvolnum></citerefentry>) will prompt for
456
passwords on the system console.
382
457
</para>
383
458
</refsect1>
384
459
397
472
398
473
<refsect1 id="environment">
399
474
<title>ENVIRONMENT</title>
475
<variablelist>
476
<varlistentry>
477
<term><envar>MANDOSPLUGINHELPERDIR</envar></term>
478
<listitem>
479
<para>
480
This environment variable will be assumed to contain the
481
directory containing any helper executables. The use and
482
nature of these helper executables, if any, is
483
purposefully not documented.
484
</para>
485
</listitem>
486
</varlistentry>
487
</variablelist>
400
488
<para>
401
This program does not use any environment variables, not even
402
the ones provided by <citerefentry><refentrytitle
489
This program does not use any other environment variables, not
490
even the ones provided by <citerefentry><refentrytitle
403
491
>cryptsetup</refentrytitle><manvolnum>8</manvolnum>
404
492
</citerefentry>.
405
493
</para>
406
494
</refsect1>
407
495
496
<refsect1 id="network-hooks">
497
<title>NETWORK HOOKS</title>
498
<para>
499
If a network interface like a bridge or tunnel is required to
500
find a Mandos server, this requires the interface to be up and
501
running before <command>&COMMANDNAME;</command> starts looking
502
for Mandos servers. This can be accomplished by creating a
503
<quote>network hook</quote> program, and placing it in a special
504
directory.
505
</para>
506
<para>
507
Before the network is used (and again before program exit), any
508
runnable programs found in the network hook directory are run
509
with the argument <quote><literal>start</literal></quote> or
510
<quote><literal>stop</literal></quote>. This should bring up or
511
down, respectively, any network interface which
512
<command>&COMMANDNAME;</command> should use.
513
</para>
514
<refsect2 id="hook-requirements">
515
<title>REQUIREMENTS</title>
516
<para>
517
A network hook must be an executable file, and its name must
518
consist entirely of upper and lower case letters, digits,
519
underscores, periods, and hyphens.
520
</para>
521
<para>
522
A network hook will receive one argument, which can be one of
523
the following:
524
</para>
525
<variablelist>
526
<varlistentry>
527
<term><literal>start</literal></term>
528
<listitem>
529
<para>
530
This should make the network hook create (if necessary)
531
and bring up a network interface.
532
</para>
533
</listitem>
534
</varlistentry>
535
<varlistentry>
536
<term><literal>stop</literal></term>
537
<listitem>
538
<para>
539
This should make the network hook take down a network
540
interface, and delete it if it did not exist previously.
541
</para>
542
</listitem>
543
</varlistentry>
544
<varlistentry>
545
<term><literal>files</literal></term>
546
<listitem>
547
<para>
548
This should make the network hook print, <emphasis>one
549
file per line</emphasis>, all the files needed for it to
550
run. (These files will be copied into the initial RAM
551
filesystem.) Typical use is for a network hook which is
552
a shell script to print its needed binaries.
553
</para>
554
<para>
555
It is not necessary to print any non-executable files
556
already in the network hook directory, these will be
557
copied implicitly if they otherwise satisfy the name
558
requirements.
559
</para>
560
</listitem>
561
</varlistentry>
562
<varlistentry>
563
<term><literal>modules</literal></term>
564
<listitem>
565
<para>
566
This should make the network hook print, <emphasis>on
567
separate lines</emphasis>, all the kernel modules needed
568
for it to run. (These modules will be copied into the
569
initial RAM filesystem.) For instance, a tunnel
570
interface needs the
571
<quote><literal>tun</literal></quote> module.
572
</para>
573
</listitem>
574
</varlistentry>
575
</variablelist>
576
<para>
577
The network hook will be provided with a number of environment
578
variables:
579
</para>
580
<variablelist>
581
<varlistentry>
582
<term><envar>MANDOSNETHOOKDIR</envar></term>
583
<listitem>
584
<para>
585
The network hook directory, specified to
586
<command>&COMMANDNAME;</command> by the
587
<option>--network-hook-dir</option> option. Note: this
588
should <emphasis>always</emphasis> be used by the
589
network hook to refer to itself or any files in the hook
590
directory it may require.
591
</para>
592
</listitem>
593
</varlistentry>
594
<varlistentry>
595
<term><envar>DEVICE</envar></term>
596
<listitem>
597
<para>
598
The network interfaces, as specified to
599
<command>&COMMANDNAME;</command> by the
600
<option>--interface</option> option, combined to one
601
string and separated by commas. If this is set, and
602
does not contain the interface a hook will bring up,
603
there is no reason for a hook to continue.
604
</para>
605
</listitem>
606
</varlistentry>
607
<varlistentry>
608
<term><envar>MODE</envar></term>
609
<listitem>
610
<para>
611
This will be the same as the first argument;
612
i.e. <quote><literal>start</literal></quote>,
613
<quote><literal>stop</literal></quote>,
614
<quote><literal>files</literal></quote>, or
615
<quote><literal>modules</literal></quote>.
616
</para>
617
</listitem>
618
</varlistentry>
619
<varlistentry>
620
<term><envar>VERBOSITY</envar></term>
621
<listitem>
622
<para>
623
This will be the <quote><literal>1</literal></quote> if
624
the <option>--debug</option> option is passed to
625
<command>&COMMANDNAME;</command>, otherwise
626
<quote><literal>0</literal></quote>.
627
</para>
628
</listitem>
629
</varlistentry>
630
<varlistentry>
631
<term><envar>DELAY</envar></term>
632
<listitem>
633
<para>
634
This will be the same as the <option>--delay</option>
635
option passed to <command>&COMMANDNAME;</command>. Is
636
only set if <envar>MODE</envar> is
637
<quote><literal>start</literal></quote> or
638
<quote><literal>stop</literal></quote>.
639
</para>
640
</listitem>
641
</varlistentry>
642
<varlistentry>
643
<term><envar>CONNECT</envar></term>
644
<listitem>
645
<para>
646
This will be the same as the <option>--connect</option>
647
option passed to <command>&COMMANDNAME;</command>. Is
648
only set if <option>--connect</option> is passed and
649
<envar>MODE</envar> is
650
<quote><literal>start</literal></quote> or
651
<quote><literal>stop</literal></quote>.
652
</para>
653
</listitem>
654
</varlistentry>
655
</variablelist>
656
<para>
657
A hook may not read from standard input, and should be
658
restrictive in printing to standard output or standard error
659
unless <varname>VERBOSITY</varname> is
660
<quote><literal>1</literal></quote>.
661
</para>
662
</refsect2>
663
</refsect1>
664
408
665
<refsect1 id="files">
409
666
<title>FILES</title>
410
667
<variablelist>
422
679
</para>
423
680
</listitem>
424
681
</varlistentry>
682
<varlistentry>
683
<term><filename
684
class="directory">/lib/mandos/network-hooks.d</filename></term>
685
<listitem>
686
<para>
687
Directory where network hooks are located. Change this
688
with the <option>--network-hook-dir</option> option. See
689
<xref linkend="network-hooks"/>.
690
</para>
691
</listitem>
692
</varlistentry>
425
693
</variablelist>
426
694
</refsect1>
427
695
428
<!-- <refsect1 id="bugs"> -->
429
<!-- <title>BUGS</title> -->
430
<!-- <para> -->
431
<!-- </para> -->
432
<!-- </refsect1> -->
696
<refsect1 id="bugs">
697
<title>BUGS</title>
698
<xi:include href="../bugs.xml"/>
699
</refsect1>
433
700
434
701
<refsect1 id="example">
435
702
<title>EXAMPLE</title>
441
708
</para>
442
709
<informalexample>
443
710
<para>
444
Normal invocation needs no options, if the network interface
445
is <quote>eth0</quote>:
711
Normal invocation needs no options, if the network interfaces
712
can be automatically determined:
446
713
</para>
447
714
<para>
448
715
<userinput>&COMMANDNAME;</userinput>
450
717
</informalexample>
451
718
<informalexample>
452
719
<para>
453
Search for Mandos servers (and connect to them) using another
454
interface:
720
Search for Mandos servers (and connect to them) using one
721
specific interface:
455
722
</para>
456
723
<para>
457
724
<!-- do not wrap this line -->
521
788
<para>
522
789
It will also help if the checker program on the server is
523
790
configured to request something from the client which can not be
524
spoofed by someone else on the network, unlike unencrypted
525
<acronym>ICMP</acronym> echo (<quote>ping</quote>) replies.
791
spoofed by someone else on the network, like SSH server key
792
fingerprints, and unlike unencrypted <acronym>ICMP</acronym>
793
echo (<quote>ping</quote>) replies.
526
794
</para>
527
795
<para>
528
796
<emphasis>Note</emphasis>: This makes it completely insecure to
621
889
<para>
622
890
This client uses IPv6 link-local addresses, which are
623
891
immediately usable since a link-local addresses is
624
automatically assigned to a network interfaces when it
892
automatically assigned to a network interface when it
625
893
is brought up.
626
894
</para>
627
895
</listitem>
Loggerhead is a web-based interface for Breezy
Version: 2.0.2.dev0