Skip to content
This repository
Fetching contributors…

Cannot retrieve contributors at this time

file 329 lines (244 sloc) 12.113 kb
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329
commit c560dc503a27d88e700ebb57be45da14c6b92fc6 (HEAD, refs/heads/master)
Author: Michael Rash <mbr@cipherdyne.org>
Date: Tue Sep 4 21:47:30 2012 -0400

    minor spelling typo fixes

 ChangeLog | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

commit 25edd17aca0450844f89971ef1bcd3bb7aa231bc
Author: Michael Rash <mbr@cipherdyne.org>
Date: Tue Sep 4 21:14:49 2012 -0400

    diff update for fwknop-2.0.3 release

 ChangeLog.git | 607 ++++++++++++++++++++-------------------------------------
 1 file changed, 216 insertions(+), 391 deletions(-)

commit 40ac28df21fab384f1389607eed78f6d35159206
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Sep 3 22:23:48 2012 -0400

    bump version to 2.0.3

 ChangeLog | 6 +++---
 VERSION | 2 +-
 android/project/jni/config.h | 6 +++---
 configure.ac | 2 +-
 fwknop.spec | 2 +-
 iphone/Classes/config.h | 6 +++---
 lib/fko.h | 2 +-
 todo.org | 3 +++
 8 files changed, 16 insertions(+), 13 deletions(-)

commit 8d26cc90ee76ba95d58ee18d90431a9883a2a89a
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Sep 3 22:18:59 2012 -0400

    include file compilation fix for OpenBSD relative to inet_aton() IP verification

 lib/fko_message.c | 2 +-
 lib/fko_message.h | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

commit b05d229bb15cb77a17a28a146b8b0dc61afa4aa9
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Sep 3 09:09:35 2012 -0400

    sprintf() -> snprintf() calls

 lib/fko_encryption.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

commit e2c0ac4821773eb335e36ad6cd35830b8d97c75a (refs/remotes/origin/master)
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Sep 3 00:21:46 2012 -0400

    [server] Strong access.conf validation
    
    Fernando Arnaboldi from IOActive found several conditions in
    which the server did not properly throw out maliciously constructed
    variables in the access.conf file. This has been fixed along with new
    fuzzing tests in the test suite.

 CREDITS | 6 ++
 ChangeLog | 4 ++
 Makefile.am | 3 +
 server/access.c | 114 +++++++++++++++++++++++++-------------
 test/conf/open_ports_access.conf | 4 +-
 test/test-fwknop.pl | 42 ++++++++++++++
 6 files changed, 133 insertions(+), 40 deletions(-)

commit 263fa01f2af1d336961df320f1c7a9ea84ddac9a
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Sep 3 00:21:32 2012 -0400

    added inet_aton() call for IP strong IP validation (credit: Fernando Arnaboldi)

 lib/fko_message.c | 29 +++++++++++++++++++++-----
 lib/fko_message.h | 5 +++++
 test/conf/fuzzing_open_ports_access.conf | 4 ++++
 test/conf/fuzzing_restrict_ports_access.conf | 5 +++++
 test/conf/fuzzing_source_access.conf | 4 ++++
 5 files changed, 42 insertions(+), 5 deletions(-)

commit ffe4d3b162bbfea143704461aab4244cc4acdfcf
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Sep 2 15:53:54 2012 -0400

    minor spacing update to make merges into hmac_master easier

 test/test-fwknop.pl | 56 +++++++++++++++++++++++++--------------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

commit 86b403dadb90c30deb51b3530e8ebbb791531615
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sat Sep 1 23:37:03 2012 -0400

    fixed potential buffer overflow discovered by Fernando Arnaboldi of IOActive

 server/access.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

commit e3a78a175c664ee51de1fb8086deb96a1d017ac3
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sat Sep 1 21:55:52 2012 -0400

    verify_file_perms_ownership() to just return if the file doesn't exist

 client/config_init.c | 2 +-
 client/fwknop.c | 4 ++--
 client/utils.c | 23 ++++++++++++++++-------
 server/fwknopd.c | 3 ++-
 server/utils.c | 25 +++++++++++++++++--------
 5 files changed, 38 insertions(+), 19 deletions(-)

commit 1548cbafc886af802b639913bb10e6a746222478
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 31 23:05:05 2012 -0400

    get MAX_PORT_STR_LEN constant from fko_message.h

 client/spa_comm.c | 4 ++--
 client/utils.c | 1 +
 common/common.h | 2 --
 lib/fko.h | 1 +
 4 files changed, 4 insertions(+), 4 deletions(-)

commit dafcfbc488f1e713ef6cfa9e86571a2b14e649d8
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 31 23:00:45 2012 -0400

    bug fix to make sure to verify file permissions/ownership on files that actually exist

 client/fwknop.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

commit b567514a6c722886fef5044a44abfc1514eff032
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 31 22:59:44 2012 -0400

    Added fko_context.h file to lib/Makefile.am

 lib/Makefile.am | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

commit d7393318189ace0a154823b359eb746aa0b36d94
Author: Michael Rash <mbr@cipherdyne.org>
Date: Thu Aug 30 23:38:54 2012 -0400

    implemented a couple of minor stronger bounds checks

 client/config_init.c | 5 +++++
 client/http_resolve_host.c | 6 +++---
 client/spa_comm.c | 2 +-
 3 files changed, 9 insertions(+), 4 deletions(-)

commit 2584521c67952855ba20c7c61b701a34ba57615c
Author: Michael Rash <mbr@cipherdyne.org>
Date: Thu Aug 30 21:43:53 2012 -0400

    Run verify_file_perms_ownership() on fwknop.pid only if it exists
    
    Two bugs are fixed with this commit: verify permissions/ownership on the
    fwknop.pid file only if it exists, and ensure to ru-run stat() on any directory
    component if we're creating a directory.

 server/fwknopd.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

commit 406e33ccc0836796a53c88f7fe118d292adf0a25
Author: Michael Rash <mbr@cipherdyne.org>
Date: Thu Aug 30 21:43:07 2012 -0400

    minor comment update

 server/utils.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

commit 4832312e6de8401ac6fdbe63014ef7f186cf33cb
Author: Michael Rash <mbr@cipherdyne.org>
Date: Wed Aug 29 23:12:56 2012 -0400

    added filesystem permissions test

 test/test-fwknop.pl | 41 +++++++++++++++++++++++++++++++++++++++--
 1 file changed, 39 insertions(+), 2 deletions(-)

commit a60f05ad44e824f6230b22f8976399340cb535dc
Author: Michael Rash <mbr@cipherdyne.org>
Date: Wed Aug 29 22:21:43 2012 -0400

    file permissions and client buffer overflow fix
    
    - [client+server] Fernando Arnaboldi from IOActive found that strict
    filesystem permissions for various fwknop files are not verified. Added
    warnings whenever permissions are not strict enough, and ensured that
    files created by the fwknop client and server are only set to user
    read/write.
    - [client] Fernando Arnaboldi from IOActive found a local buffer overflow
    in --last processing with a maliciously constructed ~/.fwknop.run file.
    This has been fixed with proper validation of .fwknop.run arguments.

 ChangeLog | 8 ++++++
 client/config_init.c | 15 ++++++++---
 client/fwknop.c | 19 ++++++++++---
 client/utils.c | 66 +++++++++++++++++++++++++++++++++++++++++++--
 client/utils.h | 13 +++++++++
 configure.ac | 2 +-
 server/access.c | 2 ++
 server/config_init.c | 2 ++
 server/fwknopd.c | 2 ++
 server/replay_cache.c | 6 ++++-
 server/utils.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++--
 server/utils.h | 2 ++
 test/test-fwknop.pl | 21 ++++++++++++++-
 13 files changed, 217 insertions(+), 13 deletions(-)

commit 186a424353a2e795e69f399f079a901e7dc8f24b
Author: Michael Rash <mbr@cipherdyne.org>
Date: Tue Aug 28 21:28:57 2012 -0400

    Added Ctrl-C and --disable-gpg notes

 todo.org | 7 +++++++
 1 file changed, 7 insertions(+)

commit 098ae417fe91aefe501e9268aacd228374d0906d
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Aug 27 22:30:27 2012 -0400

    migrated TODO tasks to the todo.org file

 TODO | 41 -----------------------------------------
 todo.org | 10 ++++++++++
 2 files changed, 10 insertions(+), 41 deletions(-)

commit 89dfa2c1fb06776646f99f722f21d47620f66695
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Aug 27 21:20:02 2012 -0400

    minor ChangeLog update for the RPM build change

 ChangeLog | 2 ++
 1 file changed, 2 insertions(+)

commit c5b229c5c87657197b0c814ff22127d870b55753
Author: Michael Rash <mbr@cipherdyne.org>
Date: Mon Aug 27 21:16:59 2012 -0400

    Added $DESTDIR prefix in uninstall-local and install-exec-hook to fix RPM builds

 Makefile.am | 43 +++++++++++++++++++++----------------------
 1 file changed, 21 insertions(+), 22 deletions(-)

commit e8386dbe6c959365da5c08396e09c27901faed56
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Aug 26 15:47:24 2012 -0400

    added encryption mode flags for each access stanza

 server/access.c | 17 ++++++++++++-----
 server/fwknopd_common.h | 3 +++
 server/incoming_spa.c | 18 +++++-------------
 3 files changed, 20 insertions(+), 18 deletions(-)

commit 557cd6615b9cab21a9208390f5af070c66fd257d
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sun Aug 26 15:46:54 2012 -0400

    consolidatd fuzzing functions within a single 'fuzzer' function

 test/test-fwknop.pl | 449 +++++++++++++++++++--------------------------------
 1 file changed, 164 insertions(+), 285 deletions(-)

commit f4c16bc47fc24a96b63105556b62d61c1ba7d799
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sat Aug 25 23:08:55 2012 -0400

    [server] Stronger IP validation based on a bug found by Fernando Arnaboldi from IOActive
    
    This commit fixes a condition in which the server did not properly validate
    allow IP addresses from malicious authenticated clients. This has been fixed
    with stronger allow IP validation.

 CREDITS | 2 ++
 ChangeLog | 4 +++
 lib/fko_message.c | 16 +++++++++---
 test/test-fwknop.pl | 67 +++++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 85 insertions(+), 4 deletions(-)

commit d46ba1c027a11e45821ba897a4928819bccc8f22
Author: Michael Rash <mbr@cipherdyne.org>
Date: Fri Aug 24 22:12:19 2012 -0400

    (Fernando Arnaboldi, IOActive) Found and fixed several DoS/code execution vulns for authenticated clients
    
    - [server] Fernando Arnaboldi from IOActive found several DoS/code
    execution vulnerabilities for malicious fwknop clients that manage to
    get past the authentication stage (so a such a client must be in
    possession of a valid access.conf encryption key). These vulnerbilities
    manifested themselves in the handling of malformed access requests, and
    both the fwknopd server code along with libfko now perform stronger input
    validation of access request data. These vulnerabilities affect
    pre-2.0.3 fwknop releases.
    - [test suite] Added a new fuzzing capability to ensure proper server-side
    input validation. Fuzzing data is constructed with modified fwknop
    client code that is designed to emulate malicious behavior.

 CREDITS | 5 +
 ChangeLog | 13 ++
 Makefile.am | 1 +
 lib/fko_message.c | 23 +-
 lib/fko_message.h | 3 +
 server/access.c | 89 ++++++--
 server/access.h | 4 +-
 server/fw_util_iptables.c | 3 +-
 test/conf/disable_aging_fwknopd.conf | 5 +
 test/test-fwknop.pl | 413 +++++++++++++++++++++++++++++++++-
 10 files changed, 531 insertions(+), 28 deletions(-)

commit b0bf7f369918989bae364730c8952258aac693c6
Author: Michael Rash <mbr@cipherdyne.org>
Date: Sat Aug 18 16:30:34 2012 -0400

    minor paren's syntax bug fix

 server/incoming_spa.c | 2 ++
 1 file changed, 2 insertions(+)
Something went wrong with that request. Please try again.