From 97faa2dbdf5ba667f4902338398681e28b728bf9 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Tue, 10 Nov 2015 21:40:57 -0500 Subject: [PATCH] minor docs update --- client/fwknop.8.in | 11 +++++++++-- doc/fwknopd.man.asciidoc | 18 ++++++++---------- server/fwknopd.8.in | 23 ++++++++++++++++++++--- 3 files changed, 37 insertions(+), 15 deletions(-) diff --git a/client/fwknop.8.in b/client/fwknop.8.in index c0bc4d93..7c36145f 100644 --- a/client/fwknop.8.in +++ b/client/fwknop.8.in @@ -2,12 +2,12 @@ .\" Title: fwknop .\" Author: [see the "AUTHORS" section] .\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 08/24/2015 +.\" Date: 11/10/2015 .\" Manual: Fwknop Client .\" Source: Fwknop Client .\" Language: English .\" -.TH "FWKNOP" "8" "08/24/2015" "Fwknop Client" "Fwknop Client" +.TH "FWKNOP" "8" "11/10/2015" "Fwknop Client" "Fwknop Client" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -571,6 +571,13 @@ are mutually exclusive\&. Set the source port for outgoing SPA packet\&. .RE .PP +\fB\-\-server\-resolve\-ipv4\fR +.RS 4 +This option forces the +\fBfwknop\fR +client to only accept an IPv4 address from DNS when a hostname is used for the SPA server\&. This is necessary in some cases where DNS may return both IPv6 and IPv4 addresses\&. +.RE +.PP \fB\-f, \-\-fw\-timeout\fR=\fI\fR .RS 4 Specify the length of time (seconds) that the remote firewall rule that grants access to a service is to remain active\&. The default maintained by diff --git a/doc/fwknopd.man.asciidoc b/doc/fwknopd.man.asciidoc index 1748fb10..fdd9be44 100644 --- a/doc/fwknopd.man.asciidoc +++ b/doc/fwknopd.man.asciidoc @@ -585,16 +585,14 @@ directive starts a new stanza. or ACL's that are not natively supported, and facilitate the same access model as for the main supported firewalls such as iptables. That is, a command is executed to open the firewall or ACL, and then a corresponding - close command is executed after a timer expires. - - Both the ``CMD_CYCLE_OPEN'' and ``CMD_CYCLE_CLOSE'' variables support - special substitution strings to allow values to be taken from the SPA - payload and used on the command line of the executed command. These strings - begin with a ``$'' character, and include ``$IP'' (the allow IP decrypted - from the SPA payload), ``$SRC'' (synonym for ``$IP'') , ``$PKT_SRC'' (the - source IP in the network layer header of the SPA packet), ``$DST'' (the - destination IP), ``$PORT'' (the allow port), and ``$PROTO'' (the allow - protocol). + close command is executed after a timer expires. Both the + ``CMD_CYCLE_OPEN'' and ``CMD_CYCLE_CLOSE'' variables support special + substitution strings to allow values to be taken from the SPA payload and + used on the command line of the executed command. These strings begin with + a ``$'' character, and include ``$IP'' (the allow IP decrypted from the + SPA payload), ``$SRC'' (synonym for ``$IP'') , ``$PKT_SRC'' (the source IP + in the network layer header of the SPA packet), ``$DST'' (the destination + IP), ``$PORT'' (the allow port), and ``$PROTO'' (the allow protocol). *CMD_CYCLE_CLOSE* '':: Specify the close command that corresponds to the open command set by the diff --git a/server/fwknopd.8.in b/server/fwknopd.8.in index 66131ed4..72862151 100644 --- a/server/fwknopd.8.in +++ b/server/fwknopd.8.in @@ -2,12 +2,12 @@ .\" Title: fwknopd .\" Author: [see the "AUTHORS" section] .\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 08/24/2015 +.\" Date: 11/10/2015 .\" Manual: Fwknop Server .\" Source: Fwknop Server .\" Language: English .\" -.TH "FWKNOPD" "8" "08/24/2015" "Fwknop Server" "Fwknop Server" +.TH "FWKNOPD" "8" "11/10/2015" "Fwknop Server" "Fwknop Server" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -707,7 +707,24 @@ Specify the group (via setgid) that will execute a command contained within a SP .PP \fBCMD_SUDO_EXEC_GROUP\fR \fI\fR .RS 4 -Specify the group (via \(lqsudo \-gu \(rq) that will execute a command contained within a SPA packet\&. If this variable is not given, fwknopd will assume the command should be executed as root\&. +Specify the group (via \(lqsudo \-g \(rq) that will execute a command contained within a SPA packet\&. If this variable is not given, fwknopd will assume the command should be executed as root\&. +.RE +.PP +\fBCMD_CYCLE_OPEN\fR \fI\fR +.RS 4 +Specify a command open/close cycle to be executed upon receipt of a valid SPA packet\&. This directive sets the initial command, and is meant to be used in conjunction with the \(lqCMD_CYCLE_CLOSE\(rq variable below\&. The main application of this feature is to allow +\fBfwknopd\fR +to interact with firewall or ACL\(cqs that are not natively supported, and facilitate the same access model as for the main supported firewalls such as iptables\&. That is, a command is executed to open the firewall or ACL, and then a corresponding close command is executed after a timer expires\&. Both the \(lqCMD_CYCLE_OPEN\(rq and \(lqCMD_CYCLE_CLOSE\(rq variables support special substitution strings to allow values to be taken from the SPA payload and used on the command line of the executed command\&. These strings begin with a \(lq$\(rq character, and include \(lq$IP\(rq (the allow IP decrypted from the SPA payload), \(lq$SRC\(rq (synonym for \(lq$IP\(rq) , \(lq$PKT_SRC\(rq (the source IP in the network layer header of the SPA packet), \(lq$DST\(rq (the destination IP), \(lq$PORT\(rq (the allow port), and \(lq$PROTO\(rq (the allow protocol)\&. +.RE +.PP +\fBCMD_CYCLE_CLOSE\fR \fI\fR +.RS 4 +Specify the close command that corresponds to the open command set by the \(lqCMD_CYCLE_OPEN\(rq variable described above\&. The same string substitutions such as \(lq$IP\(rq, \(lq$PORT\(rq, and \(lq$PROTO\(rq are supported\&. In addition, the special value \(lqNONE\(rq can be set to allow no close command to be executed after the open command\&. This might be handy in certain situations where, say, indefinite access is desired and allowed\&. +.RE +.PP +\fBCMD_CYCLE_TIMER\fR \fI\fR +.RS 4 +Set the number of seconds after which the close command set in \(lqCMD_CYCLE_CLOSE\(rq will be executed\&. This defines the open/close timer interval\&. .RE .PP \fBSUDO_EXE\fR \fI\fR