Permalink
Commits on Sep 8, 2011
  1. Update to make _exp_ string a #define

    Replaced all instances of "_exp_" with the #define EXPIRE_COMMENT_PREFIX so
    that the prefix can easily be changed. so
    that the prefix can easily be changed. so
    that the prefix can easily be changed. so
    that the prefix can easily be changed.
    committed Sep 8, 2011
  2. Added the ability to delete PF rules

    This commit adds the ability to fwknopd to delete PF rules after the SPA timer
    expires.  The strategy implemented is similar to iptables and ipfw, except
    that all PF rules are added to an 'anchor', and deleting a specific expired
    rule is done by listing all rules in the anchor and reinstantiating it via
    'pfctl -a <anchor> -f -' with the expired rule deleted.  fwknopd uses the
    "_exp_<expire time>" convention in a PF rule label similarly to how fwknopd
    interfaces with iptables (via the 'comment' match), and ipfw (via the
    "//<comment>" feature).
    committed Sep 8, 2011
Commits on Sep 4, 2011
  1. minor comment typo fixes

    committed Sep 4, 2011
Commits on Sep 3, 2011
  1. PF rules are now added to the fwknop anchor

    This commit implements the ability to add PF firewall rules to the fwknop
    anchor after a valid SPA packet is sniffed off the wire.  A subsequent commit
    will add the ability to delete these rules.
    committed Sep 3, 2011
Commits on Aug 28, 2011
  1. Minor copyright holder update

    Minor copyright holder update
    committed Aug 28, 2011
  2. For PF firewalls implemented a check for an active fwknop anchor

    This commit ensures that for PF firewalls that the fwknop anchor is active and
    linked into the running PF policy.  This is accomplished by looking for the
    string 'anchor "fwknop"' in the output of "pfctl -s rules".  If the anchor
    exists, then fwknopd will be able to influence traffic via rules added and
    removed from the fwknop anchor.
    committed Aug 28, 2011
Commits on Aug 27, 2011
  1. Added --fw-list info to --help

    Added --fw-list output to usage info when --help is specified from the command
    line.
    committed Aug 27, 2011
  2. PF support on OpenBSD in progress, fwknop --fw-list now works

    This is the first commit that has fwknopd interact with the PF firewall on
    OpenBSD (via fwknopd --fw-list to show any active fwknopd rules).
    committed Aug 27, 2011
Commits on Aug 25, 2011
  1. Added autoconf check for pf firewalls

    On OpenBSD systems fwknop now checks for pf firewalls via autoconf.  The next
    step will be to fill in support for pf via the C code.
    committed Aug 25, 2011
  2. Disabled read-only relocations and immediate binding compiler protect…

    …ions
    
    Similarly to FreeBSD systems, gcc throws the following warnings with read-only
    relcations and immediate binding protections - disbabled for now:
    
    gcc: -z: linker input file unused because linking not done
    gcc: relro: linker input file unused because linking not done
    gcc: -z: linker input file unused because linking not done
    gcc: now: linker input file unused because linking not done
    committed Aug 25, 2011
Commits on Aug 23, 2011
Commits on Aug 21, 2011
  1. bumped version to 2.0.0rc4

    committed Aug 21, 2011
  2. Added version specific ChangeLog, ShortLog, and diffstat files.

    Added version specific ChangeLog, ShortLog, and diffstat files (these go all
    the way back to the beginning of the svn import since 2.0.0 will be the
    first official non-"rc" release of the new C code).
    committed Aug 21, 2011
  3. Updated ChangeLog with all changes from 2.0.0-rc3

    Updated ChangeLog with all changes from 2.0.0-rc3
    committed Aug 21, 2011
  4. Bug fix for ipfw firewalls to not always require seeing 'Dynamic' rules

    This commit fixes an issue on ipfw firewalls where fwknopd would always require
    seeing ipfw 'Dynamic' rules associated with newly added connections.  But, such
    connections may never be established for various reasons.  Previous to this
    commit the following warning was frequently generated by fwknopd:
    
    Unexpected error: did not find 'Dynamic rules' string in list output.
    committed Aug 21, 2011
  5. Bug fix for missing set existence check on ipfw firewalls

    This commit fixes an issues on systems running the ipfw firewall where the
    'set' where fwknopd puts new access rules was attempted to be deleted without
    first checking to see whether it exists.  The following errors would be
    generated (now fixed):
    
    ipfw: rule 16777217: setsockopt(IP_FW_DEL): Invalid argument
    Error 17664 from cmd:'/sbin/ipfw delete set 1':
    Fatal: Errors detected during ipfw rules initialization.
    committed Aug 21, 2011
  6. Bug fix to create the digest.cache file at init

    Bug fix to ensure that the digest.cache file gets created at fwknopd init time
    so fwknopd does not throw the following error:
    
    Error opening digest cache file. Incoming digests will not be remembered.
    committed Aug 21, 2011
  7. On FreeBSD, made gpgme header path inclusion optional

    If gpgme is installed on FreeBSD systems it appears that
    -I/usr/local/include/gpgme must be added to the include path, but this change
    only adds the path if gpgme is installed and going to be used.
    committed Aug 21, 2011
Commits on Aug 20, 2011
  1. Fixed a few minor compiler warnings on FreeBSD

    This commit fixes a few warnings about possible uninitialized and unused
    variables.
    committed Aug 20, 2011
  2. On FreeBSD disable read-only relocations and immediate binding protec…

    …tions
    
    gcc on FreeBSD generates the following errors when the -Wl,-z,relro -Wl,-z,now
    flags are used:
    
    gcc: -z: linker input file unused because linking not done
    gcc: relro: linker input file unused because linking not done
    gcc: -z: linker input file unused because linking not done
    gcc: now: linker input file unused because linking not done
    committed Aug 20, 2011
  3. Update to suppress additional compiler warning

    This change fixes the following compiler warning that was seen with many of
    the source files in server/
    
    fwknopd_common.h:223: warning: ‘config_map’ defined but not used
    committed Aug 20, 2011
  4. Minor restructuring to suppress compiler "defined but not used warnings"

    This commit fixes several compiler warnings like the following (now that -Wall
    is the default):
    
    config_init.h:68: warning: ‘cmd_opts’ defined but not used
    committed Aug 20, 2011
  5. Added -Wall for all gcc warnings during compile

    Enable gcc compilation to include -Wall for all warnings (can be disabled
    with --disable-wall to ./configure).
    committed Aug 20, 2011
  6. Bug fix for ./configure args to disable compile time security options

    The ./configure script would generate the following error for the attempted
    use of the --without-stackprotector (and other related options like
    --without-pie):
    
    configure: WARNING: unrecognized options: --without-stackprotect
    committed Aug 20, 2011
Commits on Aug 19, 2011
  1. added the VERSION file

    committed Aug 19, 2011
  2. Bumped version to fwknop-2.0.0-rc3

    Bumped version to fwknop-2.0.0-rc3
    committed Aug 19, 2011
  3. Added ChangeLog derived from git commit messages.

    There will be branch and release specific ChangeLog files as well.
    committed Aug 19, 2011
  4. Renamed ChangeLog -> ChangeLog.old for new ChangeLog handling

    The ChangeLog will be derived from commit messages.
    committed Aug 19, 2011
  5. Update to add any missing iptables jump rules

    Upon the receipt of a valid SPA packet, a check is done to make sure that
    a jump rule from the appropriate built-in iptables chains exists to the
    fwknop chains.  Such rules could have been deleted by other manipulations
    of the iptables policy, so it is important to ensure they exist.  Running
    in foreground (-f) mode, here is an illustration of the jump rule being
    added after it got deleted:
    
    SPA Packet from IP: 127.0.0.1 received.
    Added jump rule from chain: INPUT to chain: FWKNOP_INPUT
    Added Rule to FWKNOP_INPUT for 127.0.0.1, tcp/22 expires at 1313680648
    committed Aug 19, 2011
Commits on Aug 18, 2011
  1. Update to force base64 check for all SPA data

    Previous to this change a check was done for base64 characters in incoming
    SPA data only up to MIN_SPA_DATA_SIZE.  This check may be reinstantiated for
    SPA packets that are delivered over HTTP (and the packet data is embedded
    within a URL that may also contain non-base64 chars), but in the meantime the
    fwknopd daemon should not accept SPA packets over arbitrary ports with any
    non-base64 chars.
    committed Aug 18, 2011
  2. Updated replay warnings to include proto/port info

    Replay warnings now include port and protocol information.  Here is an example:
    
    SPA Packet from IP: 127.0.0.1 received.
    Replay detected from source IP: 127.0.0.1
            Destination proto/port: 17/62201
                Original source IP: 127.0.0.1
           Original dst proto/port: 17/62201
                     Entry created: 08/17/11 21:06:07
                      First replay: 08/17/11 21:06:32
                       Last replay: 08/17/11 21:06:45
                      Replay count: 7
    committed Aug 18, 2011
  3. Added stack protection, PIE, fortify source, etc.

    Added various security options that can be enabled at compile time.  These
    options include everything that the "hardening-check" script written by Kees
    Cook checks for.  After this change, the hardening-check script produces the
    following output against the fwknopd binary:
    
    $ hardening-check server/.libs/fwknopd
    server/.libs/fwknopd:
     Position Independent Executable: yes
     Stack protected: yes
     Fortify Source functions: yes
     Read-only relocations: yes
     Immediate binding: yes
    
    One of the compile outputs (for example) that shows the new options is:
    
    /bin/bash ../libtool --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I..     -g -O2 -fstack-protector-all -fPIE -pie -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wl,-z,now -MT fko_decode.lo -MD -MP -MF .deps/fko_decode.Tpo -c -o fko_decode.lo fko_decode.c
    
    From the hardening-check man page, here is a description of each of these
    options:
    
    NAME
           hardening-check - check binaries for security hardening features
    
    SYNOPSIS
           Examine a given set of ELF binaries and check for several security
           hardening features, failing if they are not all found.
    
    DESCRIPTION
           This utility checks a given list of ELF binaries for several security
           hardening features that can be compiled into an executable.  These
           features are:
    
           Position Independent Executable
                   This indicates that the executable was built in such a way
                   (PIE) that the "text" section of the program can be relocated
                   in memory.  To take full advantage of this feature, the
                   executing kernel must support text Address Space Layout
                   Randomization (ASLR).
    
           Stack Protected
                   This indicates that the executable was compiled with the
                   gcc(1) option -fstack-protector.  The program will be
                   resistant to have its stack overflowed.
    
           Fortify Source functions
                   This indicates that the executable was compiled with
                   -D_FORTIFY_SOURCE=2 and -O2 or higher.  This causes certain
                   unsafe glibc functions with their safer counterparts (e.g.
                   strncpy instead of strcpy).
    
           Read-only relocations
                   This indicates that the executable was build with -Wl,-z,relro
                   to have ELF markings (RELRO) that ask the runtime linker to
                   mark any regions of the relocation table as "read-only" if
                   they were resolved before execution begins.  This reduces the
                   possible areas of memory in a program that can be used by an
                   attacker that performs a successful memory corruption exploit.
    
           Immediate binding
                   This indicates that the executable was built with -Wl,-z,now
                   to have ELF markings (BIND_NOW) that ask the runtime linker to
                   resolve all relocations before starting program execution.
                   When combined with RELRO above, this further reduces the
                   regions of memory available to memory corruption attacks.
    committed Aug 18, 2011
Commits on Aug 15, 2011
  1. Minor variable cleanup to fix compiler warnings

    Minor cleanup to fix compiler warnings about unused variables.
    committed Aug 15, 2011
  2. Added fwknop-2.0.0rc2 openwrt support from Jonathan Bennett

    Applied a patch sent from Jonathan Bennett to add fwknop-2.0.0rc2 support to
    openwrt.  One thing to note about this patch is that the +libgdbm library
    dependency has been removed because fwknop now implements its own digest
    tracking file without needing gdbm/ndbm on the system.
    committed Aug 15, 2011