Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Commits on Jul 13, 2012
Commits on Jul 10, 2012
  1. bumped version to 2.0.1-pre2

Commits on Jul 9, 2012
  1. bumped version to 2.0.1-pre1

Commits on Jan 2, 2012
  1. added FKO_CHECK_COMPILER_ARG_LDFLAGS_ONLY to fix ro-relocations and i…

    …mmediate binding protection compliation warnings on FreeBSD
Commits on Dec 29, 2011
  1. @damienstuart

    Refactored to use a custom macro for compiler flag checks.

    damienstuart authored Damien S. Stuart committed
    Set version to 2.0 (non-release candidate).
    Minor typo fixes.
Commits on Dec 6, 2011
Commits on Sep 9, 2011
  1. Added read-only relocations and immediate bindings

    Commit 4248b26 removed read-only relocations
    and immediate bindings for FreeBSD systems (and the same was done for OpenBSD
    systems too).  This commit adds these security features back in as linker
    options by only changing LDFLAGS as opposed to also adding the corresponding
    flags to CFLAGS.  The end result is that the following errors are fixed:
    gcc: -z: linker input file unused because linking not done
    gcc: relro: linker input file unused because linking not done
Commits on Aug 27, 2011
  1. PF support on OpenBSD in progress, fwknop --fw-list now works

    This is the first commit that has fwknopd interact with the PF firewall on
    OpenBSD (via fwknopd --fw-list to show any active fwknopd rules).
Commits on Aug 25, 2011
  1. Added autoconf check for pf firewalls

    On OpenBSD systems fwknop now checks for pf firewalls via autoconf.  The next
    step will be to fill in support for pf via the C code.
  2. Disabled read-only relocations and immediate binding compiler protect…

    Similarly to FreeBSD systems, gcc throws the following warnings with read-only
    relcations and immediate binding protections - disbabled for now:
    gcc: -z: linker input file unused because linking not done
    gcc: relro: linker input file unused because linking not done
    gcc: -z: linker input file unused because linking not done
    gcc: now: linker input file unused because linking not done
Commits on Aug 21, 2011
  1. bumped version to 2.0.0rc4

  2. On FreeBSD, made gpgme header path inclusion optional

    If gpgme is installed on FreeBSD systems it appears that
    -I/usr/local/include/gpgme must be added to the include path, but this change
    only adds the path if gpgme is installed and going to be used.
Commits on Aug 20, 2011
  1. Fixed a few minor compiler warnings on FreeBSD

    This commit fixes a few warnings about possible uninitialized and unused
  2. On FreeBSD disable read-only relocations and immediate binding protec…

    gcc on FreeBSD generates the following errors when the -Wl,-z,relro -Wl,-z,now
    flags are used:
    gcc: -z: linker input file unused because linking not done
    gcc: relro: linker input file unused because linking not done
    gcc: -z: linker input file unused because linking not done
    gcc: now: linker input file unused because linking not done
  3. Added -Wall for all gcc warnings during compile

    Enable gcc compilation to include -Wall for all warnings (can be disabled
    with --disable-wall to ./configure).
  4. Bug fix for ./configure args to disable compile time security options

    The ./configure script would generate the following error for the attempted
    use of the --without-stackprotector (and other related options like
    configure: WARNING: unrecognized options: --without-stackprotect
Commits on Aug 18, 2011
  1. Added stack protection, PIE, fortify source, etc.

    Added various security options that can be enabled at compile time.  These
    options include everything that the "hardening-check" script written by Kees
    Cook checks for.  After this change, the hardening-check script produces the
    following output against the fwknopd binary:
    $ hardening-check server/.libs/fwknopd
     Position Independent Executable: yes
     Stack protected: yes
     Fortify Source functions: yes
     Read-only relocations: yes
     Immediate binding: yes
    One of the compile outputs (for example) that shows the new options is:
    /bin/bash ../libtool --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I..     -g -O2 -fstack-protector-all -fPIE -pie -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wl,-z,now -MT fko_decode.lo -MD -MP -MF .deps/fko_decode.Tpo -c -o fko_decode.lo fko_decode.c
    From the hardening-check man page, here is a description of each of these
           hardening-check - check binaries for security hardening features
           Examine a given set of ELF binaries and check for several security
           hardening features, failing if they are not all found.
           This utility checks a given list of ELF binaries for several security
           hardening features that can be compiled into an executable.  These
           features are:
           Position Independent Executable
                   This indicates that the executable was built in such a way
                   (PIE) that the "text" section of the program can be relocated
                   in memory.  To take full advantage of this feature, the
                   executing kernel must support text Address Space Layout
                   Randomization (ASLR).
           Stack Protected
                   This indicates that the executable was compiled with the
                   gcc(1) option -fstack-protector.  The program will be
                   resistant to have its stack overflowed.
           Fortify Source functions
                   This indicates that the executable was compiled with
                   -D_FORTIFY_SOURCE=2 and -O2 or higher.  This causes certain
                   unsafe glibc functions with their safer counterparts (e.g.
                   strncpy instead of strcpy).
           Read-only relocations
                   This indicates that the executable was build with -Wl,-z,relro
                   to have ELF markings (RELRO) that ask the runtime linker to
                   mark any regions of the relocation table as "read-only" if
                   they were resolved before execution begins.  This reduces the
                   possible areas of memory in a program that can be used by an
                   attacker that performs a successful memory corruption exploit.
           Immediate binding
                   This indicates that the executable was built with -Wl,-z,now
                   to have ELF markings (BIND_NOW) that ask the runtime linker to
                   resolve all relocations before starting program execution.
                   When combined with RELRO above, this further reduces the
                   regions of memory available to memory corruption attacks.
Commits on Aug 11, 2011
  1. Added autoconf support for non-dbm file cache.

    This change starts on support for a simple file-based cache mechanism
    for tracking SPA digests.  This removes the libgdbm/libndbm dependency
    by default, but it can be re-enabled with the --disable-file-cache
    argument to the ./configure script.
Commits on Mar 27, 2011
  1. Added a no-digest-cache configure option and capability (though it is…

    Damien Stuart authored
    … not recommended).
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@313 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Mar 26, 2011
  1. Fix check and handling of ndbm as an option for the digest cache.

    Damien Stuart authored
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@312 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Oct 31, 2010
  1. Bumped version to rc3 (even though we may go straight to release) and…

    Damien Stuart authored
    … lib rev to 3.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@298 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Oct 21, 2010
  1. Set pcap non-block mode back on unless it is a freebsd system. Server…

    Damien Stuart authored
    … verbose output no longer shows access key or GPG password.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@290 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Aug 29, 2010
  1. Made autoconf print an error message indicating ipf is not supported …

    Damien Stuart authored
    …if it is specified. Changelog updates.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@287 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Aug 10, 2010
  1. Refactored firewall rule code to separate files by firewall type. Stu…

    Damien Stuart authored
    …bbed in ipfw and ipf firewall types. Updated autoconf to set a firewall type and path depending on configure arguments.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@279 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Aug 8, 2010
  1. Updates to accomodate building and compiling on FreeBSD systems.

    Damien Stuart authored
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@276 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Aug 1, 2010
  1. Tweaks to autoconf files.

    Damien Stuart authored
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@275 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Jul 29, 2010
  1. Bug fix for USE_NDBM variable so that client-only builds work. The sp…

    error before the patch along with the command line invocation of the
    "configure" script appear below:
    $ ./configure --prefix=/usr --disable-server
    configure: error: conditional "USE_NDBM" was never defined.
    Usually this means the macro was only invoked conditionally.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@272 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Jul 25, 2010
  1. Added extras directory. Bumped version in autoconf to 1.0.0rc2.

    Damien Stuart authored
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@271 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Jul 19, 2010
  1. Cleaned out some old commented-out sections and fixed an…

    Damien Stuart authored
    … issue where exteranl file checks would fail when running configure in cross-compiler environment. No code changes made.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@269 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Jul 16, 2010
  1. Updates and clean-up to address the many compiler warnings when compi…

    Damien Stuart authored
    …led with -Wall. Also some autoconf updates
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@265 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Jul 15, 2010
  1. Almost all he conf variables have a default value if they are not the…

    Damien Stuart authored
    …re (or set). All the entries in the initial fwknop.conf file are not commented out adn can be override as needed.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@262 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Jul 9, 2010
  1. Added AC_SYS_LARGE_FILE to

    Damien Stuart authored
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@248 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Jul 8, 2010
  1. Fixed autoconf config so libfko and fwknop client are not linked with…

    Damien Stuart authored
    … libpcap and libgdbm. Fixed some issues in the fwknop.spec file.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@244 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Jul 7, 2010
  1. Added fwknop.spec for rpm builds. Removed the server post install hoo…

    Damien Stuart authored
    …k as it breaks make distcheck and rpm builds.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@238 510a4753-2344-4c79-9c09-4d669213fbeb
Commits on Jul 3, 2010
  1. Changed the way running external commands are hanlded to address issu…

    Damien Stuart authored
    …es with it not working on some systems/configurations. Just using system and popen and fw commands are run with stdout and stderr tied to gether.
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@230 510a4753-2344-4c79-9c09-4d669213fbeb
Something went wrong with that request. Please try again.