Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

487 lines (349 sloc) 17.083 kb
commit f7e84da340a8f154edc27bcac9bb576bf35c220b (HEAD, refs/heads/master)
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sat Aug 18 15:03:04 2012 -0400
fwknop-2.0.2 release
ChangeLog | 2 +-
VERSION | 2 +-
configure.ac | 2 +-
todo.org | 6 ++++++
4 files changed, 9 insertions(+), 3 deletions(-)
commit 38feb8d7b953ad1b2e4e2ff23d6b8113a6b1bcff (refs/remotes/origin/master)
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 17 21:02:24 2012 -0400
Better --resolve-url handling
Chop any trailing '/' char, be more careful about handling incoming large HTTP
responses, print the HTTP request and response in --verbose --verbose mode.
client/http_resolve_host.c | 22 ++++++++++++++++++----
1 file changed, 18 insertions(+), 4 deletions(-)
commit 760162a40a0796b25a9dba1e00e2e171d3505986
Author: Michael Rash <mbr@cipherdyne.org>
Date: Thu Aug 16 22:30:09 2012 -0400
ipfw active/expire test bug fix (atoi() for config vars)
server/config_init.c | 8 ++++----
test/test-fwknop.pl | 3 +--
2 files changed, 5 insertions(+), 6 deletions(-)
commit 2c55773bdbcf473fac1cec6a4c0765a9b38a9db2
Author: Michael Rash <mbr@cipherdyne.org>
Date: Thu Aug 16 22:19:39 2012 -0400
added test/conf/ipfw_active_expire_equal_fwknopd.conf file
Makefile.am | 1 +
1 file changed, 1 insertion(+)
commit 3afd1aa762f1aa66bef9cdf875aea4b8bb23e567
Author: Michael Rash <mbr@cipherdyne.org>
Date: Thu Aug 16 22:16:36 2012 -0400
[server] ipfw active/expire sets cannot be the same
test/conf/ipfw_active_expire_equal_fwknopd.conf | 6 +++
test/test-fwknop.pl | 55 ++++++++++++++++++-----
todo.org | 7 +--
3 files changed, 53 insertions(+), 15 deletions(-)
commit fda5759b2b045aaa96ee1fa6d14fb3c17fe0fd01
Author: Michael Rash <mbr@cipherdyne.org>
Date: Thu Aug 16 21:18:11 2012 -0400
todo.org notes update
todo.org | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
commit 3af8e4c51769495a702a28bd630abf37162ada6c
Author: Michael Rash <mbr@cipherdyne.org>
Date: Wed Aug 15 22:49:29 2012 -0400
[client] Added cipherdyne.com backup check in -R mode.
Added backup check against a cipherdyne.com 'myip' cgi instance in -R mode if
the normal check against cipherdyne.org fails.
ChangeLog | 2 +
client/fwknop.c | 2 +
client/fwknop_common.h | 3 +-
client/http_resolve_host.c | 225 ++++++++++++++++++++++++--------------------
4 files changed, 131 insertions(+), 101 deletions(-)
commit a646a024d98f660f32991baa532bcbae1eceec60
Author: Michael Rash <mbr@cipherdyne.org>
Date: Wed Aug 15 22:46:49 2012 -0400
added 'Pragma: no-cache' header
extras/myip/myip.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
commit 419fbafa0442caa1e9bd071bf4b178082fcc4a54
Author: Michael Rash <mbr@cipherdyne.org>
Date: Tue Aug 14 22:52:24 2012 -0400
added extras/myip/myip.c
Makefile.am | 1 +
1 file changed, 1 insertion(+)
commit 37950df66f40e04cb428519f313f4697a198de45
Author: Michael Rash <mbr@cipherdyne.org>
Date: Tue Aug 14 22:35:02 2012 -0400
bumped version to fwknop-2.0.2-pre3
VERSION | 2 +-
configure.ac | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
commit c272339707229fa23d65e303d2ef7b163d855ec6
Author: Michael Rash <mbr@cipherdyne.org>
Date: Tue Aug 14 22:34:03 2012 -0400
todo.org notes update
todo.org | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
commit 7ae45ecad109ebf9dc21c2d8a966e05b6c5c5b78
Author: Michael Rash <mbr@cipherdyne.org>
Date: Tue Aug 14 22:31:03 2012 -0400
Added GPG_ALLOW_NO_PW to the fwknopd man page
doc/fwknopd.man.asciidoc | 10 ++++++++++
1 file changed, 10 insertions(+)
commit 66187a22af035425ded6df60dbf9f50cdab53938
Author: Michael Rash <mbr@cipherdyne.org>
Date: Tue Aug 14 22:21:34 2012 -0400
minor defensive fko_destroy() calls in two error condition blocks
server/incoming_spa.c | 4 ++++
1 file changed, 4 insertions(+)
commit dfe6679c5750b577ae3e923ecbd140d935628864
Author: Michael Rash <mbr@cipherdyne.org>
Date: Tue Aug 14 21:51:00 2012 -0400
Added the extras/myip/ directory for client IP resolution code
The myip.c file is deployed at http://www.cipherdyne.org/cgi-bin/myip
for fwknop client IP resolution.
extras/myip/myip.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
commit 385396b845c87997ce5b3506ae9e56c0184007a6
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Aug 13 22:53:29 2012 -0400
Added --enable-distcheck for 'make distcheck' verification
test/test-fwknop.pl | 28 ++++++++++++++++++++++++++++
1 file changed, 28 insertions(+)
commit 863838d0ba54c666150d98c643c7cc0456404e18
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Aug 13 22:39:03 2012 -0400
[server] Preserve any existing config files in /etc/fwknop/
Updated the 'make install' step to not overwrite any existing config files in
/etc/fwknop/ and instead install new copies from the source tree at
/etc/fwknop/fwknopd.conf.inst and /etc/fwknop/access.conf.inst
ChangeLog | 5 +-
ChangeLog.git | 313 ++++++++++++++++++++++++++++++++++++++++++++++
Makefile.am | 41 +++++-
server/Makefile.am | 3 +-
server/access.conf.inst | 1 +
server/fwknopd.conf.inst | 1 +
todo.org | 8 ++
7 files changed, 366 insertions(+), 6 deletions(-)
commit 8fafd4b80bf215da311dc2b53f33b0e4cd269944
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Aug 12 19:57:11 2012 -0400
[server] 'make install' permissions fix
Set restrictive permissions on /etc/fwknop/ directory and /etc/fwknop/* files.
Current default permissions on /etc/fwknop/ and /etc/fwknop/* are too lax.
ChangeLog | 2 ++
Makefile.am | 3 +++
todo.org | 5 +++--
3 files changed, 8 insertions(+), 2 deletions(-)
commit 543de16613b89723ef1350df3e59df126586800e
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Aug 12 15:44:13 2012 -0400
[server] iptables 'comment' match check
Implemented a new check to ensure that the iptables 'comment' match exists to
ensure the proper environment for fwknopd operations. This check is controlled
by the new ENABLE_IPT_COMMENT_CHECK variable, and was suggested by Hank
Leininger.
CREDITS | 5 +++
ChangeLog | 4 +++
server/cmd_opts.h | 1 +
server/config_init.c | 6 ++++
server/fw_util.h | 1 +
server/fw_util_iptables.c | 75 ++++++++++++++++++++++++++++++++++++++++++++-
server/fw_util_iptables.h | 1 +
server/fwknopd.conf | 9 ++++++
server/fwknopd_common.h | 26 ++++++++--------
todo.org | 5 ++-
10 files changed, 119 insertions(+), 14 deletions(-)
commit a087b11887ff4fffb4057198e559d448b016ac0e
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Aug 12 15:23:38 2012 -0400
todo update
todo.org | 8 ++++++++
1 file changed, 8 insertions(+)
commit a686d96d444ab739742e31967153b2bf02b62f0d
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Aug 12 09:29:51 2012 -0400
Added todo.org org mode file
The todo.org mode file was built with vim and the VimOrganizer project:
https://github.com/hsitz/VimOrganizer
Makefile.am | 1 +
todo.org | 10 ++++++++++
2 files changed, 11 insertions(+)
commit dc23c640bb2f757a2121ea0a83d18648dcaec32f (tag: refs/tags/fwknop-2.0.2-pre2)
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sat Aug 11 09:33:54 2012 -0400
added gpg_no_pw_access.conf file for no password gpg tests
Makefile.am | 1 +
1 file changed, 1 insertion(+)
commit 72229b5f46084e9cfca36bb2e1ba23c4b7f09b66
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sat Aug 11 09:21:49 2012 -0400
bumped version to fwknop-2.0.2-pre2
VERSION | 2 +-
configure.ac | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
commit 27ccfe35d36c7ba1d94734fb21a46c77aaf30719
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 10 21:52:09 2012 -0400
[server] Added GPG_ALLOW_NO_PW variable and associated test suite support
For GPG mode, added a new access.conf variable "GPG_ALLOW_NO_PW" to make it
possible to leverage a server-side GPG key pair that has no associated
password. This comes in handy when a system requires the user to leverage
gpg-agent / pinentry which can present a problem in automated environments as
required by the fwknopd server. Now, it might seem like a problem to remove
the passphrase from a GPG key pair, but it's important to note that simply
doing this is little worse than storing the passphrase in the clear on disk
anyway in the access.conf file. Further, this link help provides additional
detail:
http://www.gnupg.org/faq/GnuPG-FAQ.html#how-can-i-use-gnupg-in-an-automated-environment
ChangeLog | 23 +++++
Makefile.am | 12 ++-
server/access.c | 13 +++
server/incoming_spa.c | 2 +-
test/conf/client-gpg-no-pw/pubring.gpg | Bin 0 -> 2480 bytes
test/conf/client-gpg-no-pw/secring.gpg | Bin 0 -> 1274 bytes
test/conf/client-gpg-no-pw/trustdb.gpg | Bin 0 -> 1360 bytes
test/conf/gpg_no_pw_access.conf | 7 ++
test/conf/server-gpg-no-pw/pubring.gpg | Bin 0 -> 2480 bytes
test/conf/server-gpg-no-pw/secring.gpg | Bin 0 -> 1276 bytes
test/conf/server-gpg-no-pw/trustdb.gpg | Bin 0 -> 1360 bytes
test/test-fwknop.pl | 176 ++++++++++++++++++++++++++++++++
12 files changed, 229 insertions(+), 4 deletions(-)
commit 0af3bd0ee10768f6838aafe9fdc66187e5be9ee4
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 10 21:48:02 2012 -0400
[server] Added FLUSH_IPFW_AT_INIT and FLUSH_IPFW_AT_EXIT
Added FLUSH_IPFW_AT_INIT and FLUSH_IPFW_AT_EXIT for ipfw firewalls to emulate
the corresponding functionality that is implemented for iptables firewalls.
Bug fix for ipfw firewalls to ensure that if the ipfw expire set is zero, then
do not disable this set whenever the FLUSH_IPFW* variables are enabled.
These changes were suggested by Jonathan Schulz.
server/cmd_opts.h | 2 +
server/config_init.c | 26 +++++++++++-
server/fw_util_ipfw.c | 46 ++++++++++++--------
server/fwknopd.conf | 108 ++++++++++++++++++++++++++---------------------
server/fwknopd_common.h | 4 ++
5 files changed, 121 insertions(+), 65 deletions(-)
commit c6f3fde5371c1be48d8e1bc7e17dde89e19d02fc
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 10 21:43:49 2012 -0400
bug fix to implement FLUSH_IPT_AT_INIT and FLUSH_IPT_AT_EXIT functionality
server/fw_util_iptables.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
commit fbdae500641b4ab46bc54dbf2e509eae2625dc44
Author: Michael Rash <mbr@cipherdyne.org>
Date: Wed Aug 8 21:27:33 2012 -0400
added Geoff Carstairs for the FORCE_NAT idea
CREDITS | 7 +++++++
1 file changed, 7 insertions(+)
commit fd3044012843dfcaa9ab4f9030c70732f29a3b90
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Aug 5 14:07:42 2012 -0400
added Aldan Beaubien for reporting the Morpheus NULL IP problem
CREDITS | 5 +++++
1 file changed, 5 insertions(+)
commit e70739d2117a229e842d3a1bc43f1cf2a6fab46e
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Aug 5 13:05:55 2012 -0400
minor whitespace update
server/fw_util_ipfw.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
commit f6ac4484c95f443dfce9c6b7dafbff8126ade9ad
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Aug 5 13:05:30 2012 -0400
minor memset value update 0 -> 0x0 to conform to other memset() calls
client/http_resolve_host.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
commit 4cde31584fb9afed499b5951b7ae88b7765808c3 (tag: refs/tags/fwknop-2.0.2-pre1)
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 3 22:16:22 2012 -0400
bumped version to 2.0.2-pre1
VERSION | 2 +-
android/project/jni/config.h | 6 +++---
configure.ac | 2 +-
fwknop.spec | 2 +-
iphone/Classes/config.h | 6 +++---
lib/fko.h | 2 +-
6 files changed, 10 insertions(+), 10 deletions(-)
commit 79a947603a7c2bc4636d33834ca0b9fdd033a894
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 3 22:08:14 2012 -0400
added changes for the 2.0.2 release (so far)
ChangeLog | 38 ++++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
commit 29512bd8ec16f47db568694ec172075412ca115d
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 3 21:49:03 2012 -0400
[client] -R http recv() read until close (Jonathan Schulz)
Applied patch from Jonathan Schulz to ensure that the fwknop client reads all
data from a remote webserver when resolving the client IP address in -R mode.
Jonathan indicated that some webservers would transfer HTTP headers and data
separately, and a single recv() would therefore fail to get the necessary IP
information.
client/http_resolve_host.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
commit 7c1db891061dba5cdc29fb8cfe0c88e0a4a408dd
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 3 21:30:24 2012 -0400
minor white space fix tabs->spaces
client/http_resolve_host.c | 82 ++++++++++++++++++++++----------------------
1 file changed, 41 insertions(+), 41 deletions(-)
commit 7061b7bd3ecb1de6ae151b6b85af9251d46e32c6
Author: Michael Rash <mbr@cipherdyne.org>
Date: Wed Aug 1 23:40:34 2012 -0400
added Jonathan Schulz
CREDITS | 4 ++++
1 file changed, 4 insertions(+)
commit 84e036f95b6b239c95c696b884c3989fc30af338
Author: Michael Rash <mbr@cipherdyne.org>
Date: Wed Aug 1 23:27:34 2012 -0400
Change HTTP connection type to 'close' in -R mode
Applied patch from Jonathan Schulz to change the HTTP connection type to
'close' for the client in -R mode.
client/http_resolve_host.c | 2 +-
client/spa_comm.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
commit 5fd3343ca9ae8cce9e39d8a4ccb0efb41ae78128
Author: Michael Rash <mbr@cipherdyne.org>
Date: Wed Aug 1 22:30:02 2012 -0400
added client IP resolution test with complete SPA->SSH cycle
test/test-fwknop.pl | 39 ++++++++++++++++++++++++++++++++++++---
1 file changed, 36 insertions(+), 3 deletions(-)
commit 016098a2543126f2fa01b3f4057646f0ad2842c5
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Jul 29 23:31:15 2012 -0400
Replay attack bug fix (encryption prefixes)
Ensure that an attacker cannot force a replay attack by intercepting an
SPA packet and the replaying it with the base64 version of "Salted__"
(for Rindael) or the "hQ" prefix (for GnuPG). This is an important fix.
The following comment was added into the fwknopd code:
/* Ignore any SPA packets that contain the Rijndael or GnuPG prefixes
* since an attacker might have tacked them on to a previously seen
* SPA packet in an attempt to get past the replay check. And, we're
* no worse off since a legitimate SPA packet that happens to include
* a prefix after the outer one is stripped off won't decrypt properly
* anyway because libfko would not add a new one.
*/
Conflicts:
lib/cipher_funcs.h
lib/cipher_funcs.h | 6 ------
lib/fko.h | 8 ++++++++
server/incoming_spa.c | 14 ++++++++++++++
test/test-fwknop.pl | 48 +++++++++++++++++++++++++++++++++++++++++++++---
4 files changed, 67 insertions(+), 9 deletions(-)
commit c0e53482fa766f1c89d18931e35ebca6297f8018
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Jul 29 21:31:44 2012 -0400
[libfko] minor memory leak fix for user detection (corner case)
lib/fko_user.c | 4 ++++
1 file changed, 4 insertions(+)
commit 060fbb607f25ea2cd511d4cd548dc419d8eb3884
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sat Jul 28 00:08:30 2012 -0400
[server] replay attack detection memory leak bug fix
This commit fixes the following memory leak found with valgrind:
44 bytes in 1 blocks are definitely lost in loss record 2 of 2
at 0x482BE68: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
by 0x490EA50: strdup (strdup.c:43)
by 0x10CD69: incoming_spa (incoming_spa.c:162)
by 0x10E000: process_packet (process_packet.c:200)
by 0x4862E63: ??? (in /usr/lib/i386-linux-gnu/libpcap.so.1.1.1)
by 0x4865667: pcap_dispatch (in /usr/lib/i386-linux-gnu/libpcap.so.1.1.1)
by 0x10DABF: pcap_capture (pcap_capture.c:226)
by 0x10A798: main (fwknopd.c:299)
server/incoming_spa.c | 4 ++++
1 file changed, 4 insertions(+)
Jump to Line
Something went wrong with that request. Please try again.