- [client+server] Fernando Arnaboldi from IOActive found that strict filesystem permissions for various fwknop files are not verified. Added warnings whenever permissions are not strict enough, and ensured that files created by the fwknop client and server are only set to user read/write. - [client] Fernando Arnaboldi from IOActive found a local buffer overflow in --last processing with a maliciously constructed ~/.fwknop.run file. This has been fixed with proper validation of .fwknop.run arguments.
Added --enable-profile-coverage to the configure script to have the fwknop binaries compiled with gcc profiling support in order to see which functions get executed by the test suite via gcov. The last test executed by the test suite under --enable-profile-coverage contains all fwknop functions that were not executed under the test run (function execution totals are cumlative).
…mmediate binding protection compliation warnings on FreeBSD
Set version to 2.0 (non-release candidate). Minor typo fixes.
Commit 4248b26 removed read-only relocations and immediate bindings for FreeBSD systems (and the same was done for OpenBSD systems too). This commit adds these security features back in as linker options by only changing LDFLAGS as opposed to also adding the corresponding flags to CFLAGS. The end result is that the following errors are fixed: gcc: -z: linker input file unused because linking not done gcc: relro: linker input file unused because linking not done
This is the first commit that has fwknopd interact with the PF firewall on OpenBSD (via fwknopd --fw-list to show any active fwknopd rules).
…ions Similarly to FreeBSD systems, gcc throws the following warnings with read-only relcations and immediate binding protections - disbabled for now: gcc: -z: linker input file unused because linking not done gcc: relro: linker input file unused because linking not done gcc: -z: linker input file unused because linking not done gcc: now: linker input file unused because linking not done
If gpgme is installed on FreeBSD systems it appears that -I/usr/local/include/gpgme must be added to the include path, but this change only adds the path if gpgme is installed and going to be used.
…tions gcc on FreeBSD generates the following errors when the -Wl,-z,relro -Wl,-z,now flags are used: gcc: -z: linker input file unused because linking not done gcc: relro: linker input file unused because linking not done gcc: -z: linker input file unused because linking not done gcc: now: linker input file unused because linking not done
The ./configure script would generate the following error for the attempted use of the --without-stackprotector (and other related options like --without-pie): configure: WARNING: unrecognized options: --without-stackprotect
Added various security options that can be enabled at compile time. These options include everything that the "hardening-check" script written by Kees Cook checks for. After this change, the hardening-check script produces the following output against the fwknopd binary: $ hardening-check server/.libs/fwknopd server/.libs/fwknopd: Position Independent Executable: yes Stack protected: yes Fortify Source functions: yes Read-only relocations: yes Immediate binding: yes One of the compile outputs (for example) that shows the new options is: /bin/bash ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -fstack-protector-all -fPIE -pie -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wl,-z,now -MT fko_decode.lo -MD -MP -MF .deps/fko_decode.Tpo -c -o fko_decode.lo fko_decode.c From the hardening-check man page, here is a description of each of these options: NAME hardening-check - check binaries for security hardening features SYNOPSIS Examine a given set of ELF binaries and check for several security hardening features, failing if they are not all found. DESCRIPTION This utility checks a given list of ELF binaries for several security hardening features that can be compiled into an executable. These features are: Position Independent Executable This indicates that the executable was built in such a way (PIE) that the "text" section of the program can be relocated in memory. To take full advantage of this feature, the executing kernel must support text Address Space Layout Randomization (ASLR). Stack Protected This indicates that the executable was compiled with the gcc(1) option -fstack-protector. The program will be resistant to have its stack overflowed. Fortify Source functions This indicates that the executable was compiled with -D_FORTIFY_SOURCE=2 and -O2 or higher. This causes certain unsafe glibc functions with their safer counterparts (e.g. strncpy instead of strcpy). Read-only relocations This indicates that the executable was build with -Wl,-z,relro to have ELF markings (RELRO) that ask the runtime linker to mark any regions of the relocation table as "read-only" if they were resolved before execution begins. This reduces the possible areas of memory in a program that can be used by an attacker that performs a successful memory corruption exploit. Immediate binding This indicates that the executable was built with -Wl,-z,now to have ELF markings (BIND_NOW) that ask the runtime linker to resolve all relocations before starting program execution. When combined with RELRO above, this further reduces the regions of memory available to memory corruption attacks.