From 919156fdf028a4977b8ed50a0a85ed0849cd53d8 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Sat, 28 May 2016 09:29:34 -0400 Subject: [PATCH] apply doc updates to man pages --- client/fwknop.8.in | 4 ++-- server/fwknopd.8.in | 23 +++++++++++++++++++++-- 2 files changed, 23 insertions(+), 4 deletions(-) diff --git a/client/fwknop.8.in b/client/fwknop.8.in index cc9020ff..610f0cb0 100644 --- a/client/fwknop.8.in +++ b/client/fwknop.8.in @@ -2,12 +2,12 @@ .\" Title: fwknop .\" Author: [see the "AUTHORS" section] .\" Generator: DocBook XSL Stylesheets v1.79.1 -.\" Date: 05/12/2016 +.\" Date: 05/28/2016 .\" Manual: Fwknop Client .\" Source: Fwknop Client .\" Language: English .\" -.TH "FWKNOP" "8" "05/12/2016" "Fwknop Client" "Fwknop Client" +.TH "FWKNOP" "8" "05/28/2016" "Fwknop Client" "Fwknop Client" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- diff --git a/server/fwknopd.8.in b/server/fwknopd.8.in index a83535ae..1215a8e7 100644 --- a/server/fwknopd.8.in +++ b/server/fwknopd.8.in @@ -2,12 +2,12 @@ .\" Title: fwknopd .\" Author: [see the "AUTHORS" section] .\" Generator: DocBook XSL Stylesheets v1.79.1 -.\" Date: 05/12/2016 +.\" Date: 05/28/2016 .\" Manual: Fwknop Server .\" Source: Fwknop Server .\" Language: English .\" -.TH "FWKNOPD" "8" "05/12/2016" "Fwknop Server" "Fwknop Server" +.TH "FWKNOPD" "8" "05/28/2016" "Fwknop Server" "Fwknop Server" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -480,6 +480,18 @@ When is sniffing an interface, if the interface is administratively downed or unplugged, fwknopd will cleanly exit and an assumption is made that any process monitoring infrastructure like systemd or upstart will restart it\&. However, if fwknopd is not being monitored by systemd, upstart, or anything else, this behavior can be disabled with the \(lqEXIT_AT_INTF_DOWN\(rq variable\&. If disabled, fwknopd will try to recover when a downed interface comes back up\&. .RE .PP +\fBENABLE_RULE_PREPEND\fR \fI\fR +.RS 4 +For systems running iptables or firewalld, have +\fBfwknopd\fR +insert new SPA rules at the beginning of the relevant chain (such as \(lqFWKNOP_INPUT\(rq) instead of appending them to the end of the chain\&. This causes newly created rules to have precedence over older ones\&. +.RE +.PP +\fBENABLE_NAT_DNS\fR \fI\fR +.RS 4 +Allow fwknopd to resolve hostnames in NAT access messages\&. +.RE +.PP \fBGPG_HOME_DIR\fR \fI\fR .RS 4 If GPG keys are used instead of a Rijndael symmetric key, this is the default GPG keys directory\&. Note that each access stanza in @@ -515,6 +527,13 @@ mode)\&. Note that when this is enabled, the \(lqPCAP_FILTER\(rq variable would \fBfwknopd\fR\&. .RE .PP +\fBENABLE_X_FORWARDED_FOR\fR \fI\fR +.RS 4 +Allows +\fBfwknopd\fR +to use the X\-Forwarded\-for header from a captured SPA packet over HTTP as the source IP\&. This can happen when using SPA through an HTTP proxy\&. +.RE +.PP \fBENABLE_TCP_SERVER\fR \fI\fR .RS 4 Enable the fwknopd TCP server\&. This is a "dummy" TCP server that will accept TCP connection requests on the specified TCPSERV_PORT\&. If set to "Y", fwknopd will fork off a child process to listen for, and accept incoming TCP request\&. This server only accepts the request\&. It does not otherwise communicate\&. This is only to allow the incoming SPA over TCP packet which is detected via PCAP\&. The connection is closed after 1 second regardless\&. Note that fwknopd still only gets its data via pcap, so the filter defined by PCAP_FILTER needs to be updated to include this TCP port\&.