Skip to content
100644 236 lines (203 sloc) 11.3 KB
bcba9d6 @mrash added CREDITS file, bumped software version, added ChangeLog files
1 Jonathan Bennett
22024fe @mrash try to describe Jonathan's contributions in a better fashion
2 - Major contributor.
bcba9d6 @mrash added CREDITS file, bumped software version, added ChangeLog files
3 - Contributed OpenWRT support - see the extras/openwrt/ directory.
ceb1713 @mrash add --key-gen option to fwknopd (suggested by Jonathan Bennett)
4 - Suggested the addition of the --key-gen option to fwknopd.
29defca @mrash (Jonathan Bennett) added script to create QR codes from…
5 - Contributed the script (in extras/console-qr/) to create
6 QR codes from fwknopd access.conf keys.
e252075 @mrash update CREDITS file to include Fwknop2
7 - Wrote a new fwknop client for Android called "Fwknop2" - see:
22024fe @mrash try to describe Jonathan's contributions in a better fashion
9 - Developed the access.conf %include and %include_folder directives.
bcba9d6 @mrash added CREDITS file, bumped software version, added ChangeLog files
11 Sebastien Jeanquier
12 - Assisted with getting fwknop included in BackTrack Linux - the choice
bfdbb8f @mrash Updated authorship and copyright information
13 distro for pentration testers.
bcba9d6 @mrash added CREDITS file, bumped software version, added ChangeLog files
15 Ozmart
16 - Suggested the idea for setting an access stanza expiration time.
17 - Suggested the abiliy to have certain incoming connections automatically
18 NAT'd through to specific internal systems. The result was the FORCE_NAT
19 mode.
20 - Assisted with getting fwknop running under the Pentoo Linux distro.
22 Max Kastanas
23 - Contributed both an Android and an iPhone fwknop client port - see the
24 top level android/ and iphone/ directories.
5c26c0a @mrash added Ted Wynnychenko for OpenBSD PF testing
26 Ted Wynnychenko
27 - Helped test fwknop PF support on OpenBSD.
ba3b7d1 @mrash Bug fix for multi-stanza key use and replay attack detection
29 Andy Rowland
30 - Reported a bug where the same encryption key used for two stanzas in the
31 access.conf file would result in access requests that matched the second
32 stanza to always be treated as a replay attack. This has been fixed for
33 the fwknop-2.0.1 release.
5387242 @mrash PCAP_LOOP_SLEEP bug fix to 1/10th of a second
35 C Anthony Risinger
36 - Caught a bug where the default PCAP_LOOP_SLEEP value was 1/100th of a
37 second instead of the intended default of 1/10th of a second.
3c533de @mrash updated Debian init script (contributed by Franck Joncourt)
39 Franck Joncourt
40 - fwknop Debian package maintainer.
41 - Contributed a new Debian init script.
67f5d1f @mrash Applied perl FKO module libfko path patch from Franck Joncourt
42 - Contributed a patch to have the perl FKO module link against libfko in
43 the local directory (if it exists) so that it doesn't have to have libfko
44 completely installed in /usr/lib/. This allows the test suite to run FKO
45 tests without installing libfko.
627035f @mrash Patch from Franck Joncourt for setting permissions via open()
46 - Contributed a patch to remove unnecessary chmod() call when creating
47 client rc file and server replay cache file. The permissions are now set
48 appropriately via open(), and at the same time this patch fixes a
49 potential race condition since the previous code used fopen() followed by
50 chmod().
03b222d @mrash [client] (Franck Joncourt) Fixed Ctrl-C problem where SPA packets wer…
51 - Contributed a patch to allow the fwknop client to be stopped with Ctrl-C
52 before sending an SPA packet on the wire.
fd41308 @mrash added info for Franck's latest contribution
53 - Contributed a patch to ensure that duplicate iptables rules are not
54 created even for different SPA packets that arrive at the same time and
55 request the same access.
77c876c @mrash credits and changelog updates
56 - Added support for resolving hostnames in various NAT modes (fixes issue
57 #43 in github).
892ee15 @mrash ChangeLog and credits updates for Franck
58 - Bug fix in the client for resolving hostnames in '-P icmp' mode (fixes
59 issue #64).
77c876c @mrash credits and changelog updates
60 - Added support for saving fwknop client command line arguments via a new
66399fe @mrash Merge remote-tracking branch 'fjoncourt/master'
61 option --save-rc-stanza.
892ee15 @mrash ChangeLog and credits updates for Franck
62 - Added log module support for the client.
66399fe @mrash Merge remote-tracking branch 'fjoncourt/master'
63 - Added the ability to read a passphrase from STDIN and also from a file
64 descriptor via --fd (closes #74).
0ecc2d2 @mrash minor docs update
65 - Added libfko unit tests via the CUnit framework.
7061b7b @mrash added Jonathan Schulz
67 Jonathan Schulz
68 - Submitted patches to change HTTP connection type to 'close' for -R mode
69 in the client and fix a bug for recv() calls against returned HTTP data.
fd30440 @mrash added Aldan Beaubien for reporting the Morpheus NULL IP problem
71 Aldan Beaubien
72 - Reported an issue with the Morpheus client sending SPA packets with NULL
73 IP addresses, and code was added to fwknopd to better validate incoming
74 SPA data as a result of this report.
fbdae50 @mrash added Geoff Carstairs for the FORCE_NAT idea
76 Geoff Carstairs
77 - Suggested a way to redirect valid connection requests to a specific
78 internal service via NAT, configurable by each stanza in access.conf.
79 This allows for better access control for multple users requiring access
80 to multiple internal systems, in a manner that is transparent to the
81 user. The result was the FORCE_NAT mode.
543de16 @mrash [server] iptables 'comment' match check
83 Hank Leininger
45e29f6 @mrash minor edit to credits file for Hank Leininger
84 - Contributed a patch to greatly extend libfko error code descriptions at
85 various places in order to give much better information on what certain
86 error conditions mean. Closes #98.
87 - Suggested the ability to read a passphrase from STDIN and via a new --fd
88 command line argument (github #74) to allow things like:
89 $ gpg -d passphrasefile.pgp | fwknop -R -n myserver
543de16 @mrash [server] iptables 'comment' match check
90 - For iptables firewalls, suggested a check for the 'comment' match to
91 ensure the local environment will properly support fwknopd operations.
92 The result is the new ENABLE_IPT_COMMENT_CHECK functionality.
d46ba1c @mrash (Fernando Arnaboldi, IOActive) Found and fixed several DoS/code execu…
94 Fernando Arnaboldi (IOActive)
95 - Found important buffer overflow conditions for authenticated SPA clients
96 in the fwknopd server (pre-2.0.3). These findings enabled fixes to be
97 developed along with a new fuzzing capability in the test suite.
f4c16bc @mrash [server] Stronger IP validation based on a bug found by Fernando Arna…
98 - Found a condition in which an overly long IP from malicious authenticated
99 clients is not properly validated by the fwknopd server (pre-2.0.3).
e2c0ac4 @mrash [server] Strong access.conf validation
100 - Found a local buffer overflow in --last processing with a maliciously
101 constructed ~/ file. This has been fixed with proper
102 validation of arguments.
103 - Found several conditions in which the server did not properly throw out
104 maliciously constructed variables in the access.conf file. This has been
105 fixed along with new fuzzing tests in the test suite.
591416e @mrash [server] bug fix in --disable-file-cache mode
107 Vlad Glagolev
108 - Submitted a patch to fix ndbm/gdbm usage when --disable-file-cache is
109 used for the autoconf configure script. This functionality was broken in
110 be4193d734850fe60f14a26b547525ea0b9ce1e9 through improper handling of
111 #define macros from --disable-file-cache.
f8374c8 @mrash [server] (Vlad Glagolev) Submitted a patch to fix command exec mode
112 - Submitted a patch to fix command exec mode under SPA message type
113 validity test. Support for command exec mode was also added to the test
114 suite.
05eb197 @mrash added the OpenBSD port from Vlad
115 - Submitted an OpenBSD port for fwknop-2.0.3, and this has been checked in
116 under extras/openbsd/.
b0f25ae @mrash [server] (Vlad Glagolev) Add client timeouts to command open/close cy…
117 - Added client timeouts for open/close command cycles for fwknop-2.6.8.
6f356a9 @mrash Added Sean Greven for his FreeBSD port
119 Sean Greven
120 - Created a port of fwknop for FreeBSD:
2f1768f @mrash minor CREDITS file formatting update
fbbcae3 @mrash [libfko] Don't trundate > 16 byte Rijndael keys
123 Michael T. Dean
124 - Reported the Rijndael key truncation issue for user-supplied keys
125 (passphrases) greater than 16 bytes long.
77c876c @mrash credits and changelog updates
127 George Herlin
128 - Proposed a verification approach to test suite operations, and the result
129 was implemented in a61939c005e2b09d6800e2171f607c9d1948f022. This makes
130 test suite operate equivalently regardless of whether valgrind is used or
131 whether fwknop is being tested on an embedded system with very limited
132 resources.
39115c6 @mrash added Ruhsam Bernhard to the credits file
134 Ruhsam Bernhard
135 - Reported an issue where the message size test would result in long
136 command mode SPA packets not decrypting properly because only GPG decrypt
137 attempts were made. This issue was fixed in
138 7e784df3870373f055a2f0f8d818829501bcb1c0.
5804e15 @mrash Merge remote-tracking branch 'ag4ve/master'
140 Shawn Wilson
141 - Added better SPA source IP logging for various fwknopd logging messages.
142 This helps to make it more clear why certain SPA packets are rejected
143 from some systems.
7cb23c7 @mrash [server] added check to ensure any existing fwknop jump rule is not d…
145 Dan Lauber
146 - Suggested a check for fwknopd to ensure that the jump rule on systems
147 running iptables is not duplicated if it already exists.
6706c53 @mrash [libfko] HMAC comparison timing bug fix
149 Ryman
150 - Reported a timing attack bug in the HMAC comparison operation (#85) and
1c8d247 @mrash ChangeLog update to mention the constant_runtime_cmp() change
151 suggested a fix derived from yaSSL:
6706c53 @mrash [libfko] HMAC comparison timing bug fix
66399fe @mrash Merge remote-tracking branch 'fjoncourt/master'
ffeb285 @mrash [libfko] handle endian detection on PPC (and other) systems
154 Blair Zajac
4d167cd @mrash credit Blair and Tim with MacPorts and Homebrew maintainer status
155 - MacPorts fwknop package maintainer for Mac OS X systems.
ffeb285 @mrash [libfko] handle endian detection on PPC (and other) systems
156 - Contributed patches to handle endian issues on PPC systems.
157 - Reported an issue where strndup() is not available on some PPC systems
158 and the fix is to use the local lib/fko_util.c implementation similarly
159 to Windows builds.
5e3ec3b @mrash [client] in '-M legacy' mode truncate the key to 16 bytes
160 - Suggested throwing an error in '-M legacy' mode to warn users about the
161 inability of older fwknopd daemons to handle Rijndael keys > 16 bytes.
162 Any release after and including 2.5 does not have this limitation.
83952fc @mrash added Radostan Riedel's AppArmor policy note
164 Radostan Riedel
165 - Contributed an AppArmor policy that is known to work on Debian and Ubuntu
166 systems. The policy file is available in extras/apparmor.
3a2c33c @mrash Added Les Aker to credits file
168 Les Aker
169 - Reported an issue with Arch Linux that resulted in fwknopd hanging for a
170 pcap_dispatch() packet count of zero when using libpcap-1.5.1. This
171 issue was tracked on github as issue #110, and the default packet count
172 is now set at 100 as a result.
551b243 @mrash (Marek Wrzosek) Update docs to reflect random 'digits' use instead of…
174 Marek Wrzosek
175 - Suggested doc update to fwknop man pages to accurately describe the usage
176 of digits instead of bytes for SPA random data. About 53 bits of entropy
177 are actually used, although this is in addition to the 64-bit random salt
178 in for key derivation used by PBKDF1 in Rjindael CBC mode.
179 - Various excellent feedback on crypto design, including the need to remove
a347be3 @mrash merged android4.4_support branch
8dfd576 @mrash added Gerry Reno
182 Gerry Reno
183 - Updated the Android client to be compatible with Android-4.4.
184 - Provided guidance on Android client issues along with testing candidate
185 patches to update various things - this work is being tracked in the
186 android4.4_support branch.
aae72a9 @mrash firewalld support from Gerry Reno
187 - Implemented support for firewalld in the fwknopd daemon running on RHEL 7
188 and CentOS 7 systems. This is a major addition to handle yet another
189 firewall architecture.
4d167cd @mrash credit Blair and Tim with MacPorts and Homebrew maintainer status
191 Tim Heckman
192 - Homebrew fwknop package maintainer for Mac OS X systems.
193 - Suggested that fwknop support nftables when it is integrated into the
194 mainline Linux kernel.
74428ad @mrash [server] Bug fix for PF firewalls without ALTQ support on FreeBSD.
196 Barry Allard
197 - Reported bug in PF support on FreeBSD systems where ALTQ is not available
198 would cause new PF rules to not be added (github issue #121).
50434c5 @mrash Use the fwknop User-Agent for wget SSL external IP resolutions
199 - Suggested the abiliy to specify the HTTP User-Agent when wget is used to
200 resolve the external IP via SSL (github issue #134).
00a057a @mrash ChangeLog update for FCS bug fix
202 Bill Stubbs
203 - Submitted a patch to fix a bug where fwknopd could not handle Ethernet
204 frames that include the Frame Check Sequence (FCS) header. This header is
205 four bytes long, and is placed at the end of each Ethernet frame.
206 Normally the FCS header is not visible to libpcap, but some card/driver
207 combinations result in it being included. Bill noticed this on the
208 following platform:
209 BeagleBone Black rev C running 3.8.13-bone50 #1 SMP Tue May 13
210 13:24:52 UTC 2014 armv7l GNU/Linux
c5c263c @mrash add Grant Pannell
212 Grant Pannell
213 - Submitted a patch to add a new access.conf variable "DESTINATION" in
214 order to define the destination address for which an SPA packet will be
215 accepted. The string "ANY" is also accepted if a valid SPA packet should
216 be honored to any destination IP. Similarly to the "SOURCE" variable,
217 networks should be specified in CIDR notation (e.g. ""),
218 and individual IP addresses can be specified as well. Also, multiple IP's
219 and/or networks can be defined as a comma separated list (e.g.
220 ",").
1ce8004 @mrash [server] Bug fix to not include pcap.h in --enable-udp-server mode
222 Alexander Kozhevnikov
223 - Reported a bug when fwknop is compiled with --enable-udp-server where
224 the server was including pcap.h
0ecc2d2 @mrash minor docs update
226 Dan Brooks
227 - Contributed a patch for the Android client app to add the definition of
228 custom server udp port. This is similiar to the --server-port argument
229 offered by the main fwknop client.
89b2e8f @mrash [server] interface goes down will cause fwknopd to exit
231 Github user 'sgh7':
232 - Contributed a patch to have fwknopd exit if the interface it is sniffing
233 on goes down. If this happens, it is expected that the native process
234 monitoring feature in things like systemd or upstart will restart
235 fwknopd.
Something went wrong with that request. Please try again.