DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

apply doc updates to man pages

Browse Source
This commit is contained in:
Michael Rash
2016-05-28 09:29:34 -04:00
parent 74ddbf63b2
commit 919156fdf0
2 changed files with 23 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/fwknop.8.in
+2 -2
View File
@@ -2,12 +2,12 @@
.\" Title: fwknop
.\" Author: [see the "AUTHORS" section]
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\" Date: 05/12/2016
.\" Date: 05/28/2016
.\" Manual: Fwknop Client
.\" Source: Fwknop Client
.\" Language: English
.\"
.TH "FWKNOP" "8" "05/12/2016" "Fwknop Client" "Fwknop Client"
.TH "FWKNOP" "8" "05/28/2016" "Fwknop Client" "Fwknop Client"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
server/fwknopd.8.in
+21 -2
View File
@@ -2,12 +2,12 @@
.\" Title: fwknopd
.\" Author: [see the "AUTHORS" section]
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\" Date: 05/12/2016
.\" Date: 05/28/2016
.\" Manual: Fwknop Server
.\" Source: Fwknop Server
.\" Language: English
.\"
.TH "FWKNOPD" "8" "05/12/2016" "Fwknop Server" "Fwknop Server"
.TH "FWKNOPD" "8" "05/28/2016" "Fwknop Server" "Fwknop Server"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
@@ -480,6 +480,18 @@ When
is sniffing an interface, if the interface is administratively downed or unplugged, fwknopd will cleanly exit and an assumption is made that any process monitoring infrastructure like systemd or upstart will restart it\&. However, if fwknopd is not being monitored by systemd, upstart, or anything else, this behavior can be disabled with the \(lqEXIT_AT_INTF_DOWN\(rq variable\&. If disabled, fwknopd will try to recover when a downed interface comes back up\&.
.RE
.PP
\fBENABLE_RULE_PREPEND\fR \fI<Y/N>\fR
.RS 4
For systems running iptables or firewalld, have
\fBfwknopd\fR
insert new SPA rules at the beginning of the relevant chain (such as \(lqFWKNOP_INPUT\(rq) instead of appending them to the end of the chain\&. This causes newly created rules to have precedence over older ones\&.
.RE
.PP
\fBENABLE_NAT_DNS\fR \fI<Y/N>\fR
.RS 4
Allow fwknopd to resolve hostnames in NAT access messages\&.
.RE
.PP
\fBGPG_HOME_DIR\fR \fI<path>\fR
.RS 4
If GPG keys are used instead of a Rijndael symmetric key, this is the default GPG keys directory\&. Note that each access stanza in
@@ -515,6 +527,13 @@ mode)\&. Note that when this is enabled, the \(lqPCAP_FILTER\(rq variable would
\fBfwknopd\fR\&.
.RE
.PP
\fBENABLE_X_FORWARDED_FOR\fR \fI<Y/N>\fR
.RS 4
Allows
\fBfwknopd\fR
to use the X\-Forwarded\-for header from a captured SPA packet over HTTP as the source IP\&. This can happen when using SPA through an HTTP proxy\&.
.RE
.PP
\fBENABLE_TCP_SERVER\fR \fI<Y/N>\fR
.RS 4
Enable the fwknopd TCP server\&. This is a "dummy" TCP server that will accept TCP connection requests on the specified TCPSERV_PORT\&. If set to "Y", fwknopd will fork off a child process to listen for, and accept incoming TCP request\&. This server only accepts the request\&. It does not otherwise communicate\&. This is only to allow the incoming SPA over TCP packet which is detected via PCAP\&. The connection is closed after 1 second regardless\&. Note that fwknopd still only gets its data via pcap, so the filter defined by PCAP_FILTER needs to be updated to include this TCP port\&.