X-Git-Url: https://git.distorted.org.uk/~mdw/tripe/blobdiff_plain/48b845698dcf3ec4b9f8b9f1848a157f0245d7cc..61682d3405e6b7c72ec8295fec1467333e336b65:/server/tripe-admin.5.in diff --git a/server/tripe-admin.5.in b/server/tripe-admin.5.in index e921cfcf..0ab6711b 100644 --- a/server/tripe-admin.5.in +++ b/server/tripe-admin.5.in @@ -354,6 +354,16 @@ Use the public key to authenticate the peer. The default is to use the key tagged .IR peer . .TP +.B "\-mobile" +The peer is a mobile device, and is likely to change address rapidly. +If a packet arrives from an unknown address, the server's usual response +is to log a warning and discard it. If the server knows of any mobile +peers, however, it will attempt to decrypt the packet using their keys, +and if one succeeds, the server will update its idea of the peer's +address and emit an +.B NEWADDR +notification. +.TP .BI "\-tunnel " tunnel Use the named tunnel driver, rather than the default. .\"-opts @@ -1082,6 +1092,12 @@ Key exchange with has begun or restarted. If key exchange keeps failing, this message will be repeated periodically. .SP +.BI "NEWADDR " peer " " address +The given mobile +.IR peer 's +IP address has been changed to +.IR address . +.SP .BI "NEWIFNAME " peer " " old-name " " new-name The given .IR peer 's @@ -1176,58 +1192,101 @@ up to something! Challenge received was old, but maybe not actually a replay. Try again. .SS "KEYMGMT warnings" These indicate a problem with the keyring files, or the keys stored in -them. -.SP -.BI "KEYMGMT bad-private-key " message -The private key could not be read, or failed a consistency check. If -there was a problem with the file, usually there will have been -.B key-file-error -warnings before this. -.SP -.BI "KEYMGMT bad-public-keyring " message -The public keyring couldn't be read. Usually, there will have been -.B key-file-error -warnings before this. -.SP -.BI "KEYMGMT key-file-error " file ":" line " " message -Reports a specific error with the named keyring file. This probably -indicates a bug in -.BR key (1). -.SP -.BI "KEYMGMT public-key " tag " " tokens\fR... -These messages all indicate a problem with the public key named -.IR tag . -.SP -.BI "KEYMGMT public-key " tag " algorithm-mismatch" -The algorithms specified on the public key don't match the ones for our -private key. All the peers in a network have to use the same -algorithms. -.SP -.BI "KEYMGMT public-key " tag " bad " message -The public key couldn't be read, or is invalid. -.SP -.BI "KEYMGMT public-key " tag " bad-public-group-element" -The public key is invalid. This may indicate a malicious attempt to -introduce a bogus key. -.SP -.BI "KEYMGMT public-key " tag " bad-algorithm-selection" -The algorithms listed on the public key couldn't be understood. The -algorithm selection attributes are probably malformed and need fixing. +them. The first token is either +.B private-keyring +or +.B public-keyring +(notated +.IB which -keyring +in the descriptions below) indicating which keyring file is problematic, +and the second token is the filename of the keyring. Frequently a key +tag may be given next, preceded by the token +.BR key . +.SP +.BI "KEYMGMT public-keyring " file " key " tag " algorithm-mismatch" +A peer's public key doesn't request the same algorithms as our private +key. +.SP +.BI "KEYMGMT " which "-keyring " file " key " tag " bad-tag-length " len +The key attributes specify the length of MAC tag as +.I len +but this is an invalid value \(en either too large or not a multiple of +eight. +.SP +.BI "KEYMGMT " which "-keyring " file " key " tag " bad-tag-length-string " str +The key attributes contain +.I str +where a MAC tag length was expected. The key was generated wrongly. +.SP +.BI "KEYMGMT private-keyring " file " key " tag " changed-group" +The private keyring has been changed, but the new private key can't be +used because it uses a different group for Diffie\(enHellman key +exchange. +.SP +.BI "KEYMGMT " which "-keyring " file " io-error " ecode " " message +A system error occurred while opening or reading the keyring file. +.SP +.BI "KEYMGMT " which "-keyring " file " key " tag " unknown-cipher " cipher +The key specifies the use of an unknown symmetric encryption algorithm +.IR cipher . +Maybe the key was generated wrongly, or maybe the version of +Catacomb installed is too old. +.SP +.BI "KEYMGMT " which "-keyring " file " key " tag " unknown-group-type " type +The key specifies the use of a Diffie\(enHellman group of an unknown +.IR type . +Maybe the key was generated wrongly, or maybe the version of +.BR tripe (8) +is too old. +.SP +.BI "KEYMGMT " which "-keyring " file " key " tag " unknown-hash " hash +The key specifies the use of an unknown hash function +.IR hash . +Maybe the key was generated wrongly, or maybe the version of Catacomb +installed is too old. +.SP +.BI "KEYMGMT " which "-keyring " file " key " tag " unknown-mac " mac +The key specifies the use of an unknown message authentication code +.IR mac . +Maybe the key was generated wrongly, or maybe the version of Catacomb +installed is too old. +.SP +.BI "KEYMGMT " which "-keyring " file " key " tag " unknown-mgf-cipher " mgf +The key specifies the use of an unknown symmetric encryption function +.I mgf +for mask generation. Maybe the key was generated wrongly, or maybe the +version of Catacomb installed is too old. +.SP +.BI "KEYMGMT " which "-keyring " file " key " tag " no-hmac-for-hash " hash +No message authentication code was given explicitly, and there's no +implementation of HMAC for the selected hash function +.IR hash . +.SP +.BI "KEYMGMT " which "-keyring " file " key " tag " " alg " " name " no-key-size " hashsz +The +.I alg +token is either +.B cipher +or +.BR mac . +The named algorithm requires more key material than the hash function +can provide. You must change either the hash function, or the cipher or +MAC. .SP -.BI "KEYMGMT public-key " tag " incorrect-group" -The public key doesn't use the same group as our private key. All the -peers in a network have to use the same group. +.BI "KEYMGMT " which "-keyring " file " key " tag " mgf " mgf " restrictive-key-schedule" +The cipher selected for mask-generation is unsuitable because it can't +accept arbitrary-sized keys. .SP -.BI "KEYMGMT public-key " tag " not-found" -The public key for peer +.BI "KEYMGMT " which "-keyring " file " key-not-found " tag +A key named .I tag -wasn't in the public keyring. +couldn't be found in the keyring. .SP -.BI "KEYMGMT public-key " tag " unknown-type" -The type of the public key isn't understood. Maybe you need to upgrade -your copy of -.BR tripe . -(Even if you do, you'll have to regenerate your keys.) +.BI "KEYMGMT " which "-keyring " file " line " line " " message +The contents of the keyring file are invalid. There may well be a bug +in the +.BR key (1) +program. .SS "KX warnings" These indicate problems during key-exchange. Many indicate either a bug in the server (either yours or the remote one), or some kind of attack @@ -1436,6 +1495,9 @@ Configuring the Linux TUN/TAP interface failed. .BI "TUN " ifname " " tun-name " read-error " ecode " " message Reading from the tunnel device failed. .SP +.BI "TUN " ifname " " tun-name " write-error " ecode " " message +Writing from the tunnel device failed. +.SP .BI "TUN " ifname " slip bad-escape" The SLIP driver encountered a escaped byte it wasn't expecting to see. The erroneous packet will be ignored.