Permalink
Commits on Aug 18, 2011
  1. Updated replay warnings to include proto/port info

    Replay warnings now include port and protocol information.  Here is an example:
    
    SPA Packet from IP: 127.0.0.1 received.
    Replay detected from source IP: 127.0.0.1
            Destination proto/port: 17/62201
                Original source IP: 127.0.0.1
           Original dst proto/port: 17/62201
                     Entry created: 08/17/11 21:06:07
                      First replay: 08/17/11 21:06:32
                       Last replay: 08/17/11 21:06:45
                      Replay count: 7
    committed Aug 18, 2011
  2. Added stack protection, PIE, fortify source, etc.

    Added various security options that can be enabled at compile time.  These
    options include everything that the "hardening-check" script written by Kees
    Cook checks for.  After this change, the hardening-check script produces the
    following output against the fwknopd binary:
    
    $ hardening-check server/.libs/fwknopd
    server/.libs/fwknopd:
     Position Independent Executable: yes
     Stack protected: yes
     Fortify Source functions: yes
     Read-only relocations: yes
     Immediate binding: yes
    
    One of the compile outputs (for example) that shows the new options is:
    
    /bin/bash ../libtool --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I. -I..     -g -O2 -fstack-protector-all -fPIE -pie -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wl,-z,now -MT fko_decode.lo -MD -MP -MF .deps/fko_decode.Tpo -c -o fko_decode.lo fko_decode.c
    
    From the hardening-check man page, here is a description of each of these
    options:
    
    NAME
           hardening-check - check binaries for security hardening features
    
    SYNOPSIS
           Examine a given set of ELF binaries and check for several security
           hardening features, failing if they are not all found.
    
    DESCRIPTION
           This utility checks a given list of ELF binaries for several security
           hardening features that can be compiled into an executable.  These
           features are:
    
           Position Independent Executable
                   This indicates that the executable was built in such a way
                   (PIE) that the "text" section of the program can be relocated
                   in memory.  To take full advantage of this feature, the
                   executing kernel must support text Address Space Layout
                   Randomization (ASLR).
    
           Stack Protected
                   This indicates that the executable was compiled with the
                   gcc(1) option -fstack-protector.  The program will be
                   resistant to have its stack overflowed.
    
           Fortify Source functions
                   This indicates that the executable was compiled with
                   -D_FORTIFY_SOURCE=2 and -O2 or higher.  This causes certain
                   unsafe glibc functions with their safer counterparts (e.g.
                   strncpy instead of strcpy).
    
           Read-only relocations
                   This indicates that the executable was build with -Wl,-z,relro
                   to have ELF markings (RELRO) that ask the runtime linker to
                   mark any regions of the relocation table as "read-only" if
                   they were resolved before execution begins.  This reduces the
                   possible areas of memory in a program that can be used by an
                   attacker that performs a successful memory corruption exploit.
    
           Immediate binding
                   This indicates that the executable was built with -Wl,-z,now
                   to have ELF markings (BIND_NOW) that ask the runtime linker to
                   resolve all relocations before starting program execution.
                   When combined with RELRO above, this further reduces the
                   regions of memory available to memory corruption attacks.
    committed Aug 18, 2011
Commits on Aug 15, 2011
  1. Minor variable cleanup to fix compiler warnings

    Minor cleanup to fix compiler warnings about unused variables.
    committed Aug 15, 2011
  2. Added fwknop-2.0.0rc2 openwrt support from Jonathan Bennett

    Applied a patch sent from Jonathan Bennett to add fwknop-2.0.0rc2 support to
    openwrt.  One thing to note about this patch is that the +libgdbm library
    dependency has been removed because fwknop now implements its own digest
    tracking file without needing gdbm/ndbm on the system.
    committed Aug 15, 2011
Commits on Aug 14, 2011
  1. Implemented memory clean up for digest cache list

    Upon fwknopd shutdown, a new function free_replay_list() is now called in order
    to free heap allocated memory dedicated to SPA digest tracking.  Without this
    fix, valgrind reports the following (some output snipped):
    
    valgrind --leak-check=full ./server/.libs/fwknopd -f -i lo -P "udp port 62201"
    
    ==30864== 431 (48 direct, 383 indirect) bytes in 1 blocks are definitely lost in loss record 17 of 17
    ==30864==    at 0x4C27480: calloc (vg_replace_malloc.c:467)
    ==30864==    by 0x407CB7: replay_check_file_cache (replay_cache.c:461)
    ==30864==    by 0x407B69: replay_check (replay_cache.c:413)
    ==30864==    by 0x405813: incoming_spa (incoming_spa.c:363)
    ==30864==    by 0x406275: pcap_capture (pcap_capture.c:223)
    ==30864==    by 0x40317D: main (fwknopd.c:297)
    committed Aug 14, 2011
  2. Consolidated replay warnings in a single function

    For both the simple digest file cache and the gdbm/ndbm tracking methods, all
    replay warnings are generated by a single function "replay_warning()".
    committed Aug 14, 2011
  3. Added digest file import code

    The digest file is now imported as a linked list of digest cache entries at
    init time for SPA replay attack detection.
    committed Aug 14, 2011
  4. Added source port and protocol to digest tracking

    Added the source port and protocol fields to valid SPA packets in the digest
    cache.  This can help to discover replay trends.  The format of the digest
    file cache is now:
    
    <digest> <proto> <src_ip> <src_port> <dst_ip> <dst_port> <time>
    committed Aug 14, 2011
Commits on Aug 13, 2011
  1. Added dst IP to tracked SPA data

    The digest cache now contains destination IP addresses of valid SPA packets.
    The complete format is now:
    
    <digest> <src_ip> <dst_ip> <creation time>
    committed Aug 13, 2011
  2. Started on code to parse the digest cache file

    At init time fwknopd will read in the digest cache file into the in-memory
    linked list of digests for SPA replay detection. This commit starts on this
    code, but the file format does not yet include destination IP addresses
    (to be added in an upcoming commit).
    committed Aug 13, 2011
  3. Implemented linked list cache of SPA digests

    When not using gdbm/ndbm support (the default now), fwknopd implements a linked
    list of SPA packet digests for replay attack detection along with writing
    digest data in ascii text down to disk (in the CONF_DIGEST_FILE file).
    committed Aug 13, 2011
Commits on Aug 11, 2011
  1. Added --pcap-filter to the fwknopd command line

    To override the value of the PCAP_FILTER variable in the fwknopd.conf
    config file, a new fwknopd command line argument "--pcap-filter" was
    added.  This assists in various activities by making it trivial to
    change how fwknopd acquires packet data without editing the fwknopd.conf
    file.  Here is an example:
    
    fwknopd -i lo -f --pcap-filter "udp port 12345"
    committed Aug 11, 2011
  2. Updated digest file path for gdbm/ndbm support

    If fwknopd is compiled with --disable-file-cache to the ./configure script
    then it will assume that the default filename is "digest_db.cache" for the
    digest cache.  If the file cache method is used (this is the default), then
    "digest.cache" is the default filename.  A new variable DIGEST_DB_FILE in
    the fwknopd.conf file controls the digest filename if gdbm/ndbm support is
    required.
    committed Aug 11, 2011
  3. Added autoconf support for non-dbm file cache.

    This change starts on support for a simple file-based cache mechanism
    for tracking SPA digests.  This removes the libgdbm/libndbm dependency
    by default, but it can be re-enabled with the --disable-file-cache
    argument to the ./configure script.
    committed Aug 11, 2011
Commits on Aug 9, 2011
  1. Minor rename in support of non-dbm file cache

    Added the optional_dbm_support branch and made a minor renaming change
    on this branch for the coming non-dbm file cache support.
    committed Aug 9, 2011
  2. Bug fix for uninitialized variable found with splint static analyzer

    In the save_args() function the args_str_len variable was being used before
    being initialized as reported via the splint static code analysis tool.  Here
    is the splint output that found this bug:
    
    client/fwknop.c:650:13: Variable args_str_len used before definition
      An rvalue is used that may not be initialized to a value on some execution
      path. (Use -usedef to inhibit warning)
    committed Aug 9, 2011
Commits on Jul 7, 2011
  1. Set FD_CLOEXEC on pid file descriptor.

    Added support for setting the URL for resolving source IP via command-line or the .fwknoprc file.
    damienstuart committed Jul 7, 2011
Commits on Jun 19, 2011
  1. Removed legacy $Id$ tags from svn

    $Id$ tags don't really mean anything to git so they have been removed from all
    source files.
    committed Jun 19, 2011
Commits on Mar 27, 2011
  1. Added a no-digest-cache configure option and capability (though it is…

    … not recommended).
    
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@313 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Mar 27, 2011
Commits on Mar 26, 2011
  1. Fix check and handling of ndbm as an option for the digest cache.

    git-svn-id: file:///home/mbr/svn/fwknop/trunk@312 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Mar 26, 2011
Commits on Feb 12, 2011
  1. Added python/fko.py to Makefile.am so it is also included in distribu…

    …tions. Minor tweak to address compile error on Mac os X.
    
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@311 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Feb 12, 2011
Commits on Jan 2, 2011
  1. Minor update to the android README

    git-svn-id: file:///home/mbr/svn/fwknop/trunk@310 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Jan 2, 2011
  2. Adding Max Kastanas's fwknop client app code for Android

    git-svn-id: file:///home/mbr/svn/fwknop/trunk@309 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Jan 2, 2011
Commits on Jan 1, 2011
  1. Removed unnecessary include.

    git-svn-id: file:///home/mbr/svn/fwknop/trunk@308 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Jan 1, 2011
Commits on Dec 5, 2010
  1. Additional docs and classes added to the fko python module. Minor twe…

    …ak and bumped version in the fwknop.spec file.
    
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@307 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Dec 5, 2010
  2. Fixed bug where libfko would segfault if fko_get_spa_data() was calle…

    …d before fko_spa_data_final() was called (and successful). Added include of time.h in fko.h.
    
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@306 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Dec 5, 2010
Commits on Dec 4, 2010
  1. Do not need parens around expression in if statements in python (stil…

    …l learning).
    
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@305 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Dec 4, 2010
  2. Added pydoc text to the fko python module. Minot tweak to setup.py.

    git-svn-id: file:///home/mbr/svn/fwknop/trunk@304 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Dec 4, 2010
Commits on Nov 27, 2010
  1. Added the Fko class code to wrap the _fko wrapper around libfko.

    git-svn-id: file:///home/mbr/svn/fwknop/trunk@303 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Nov 27, 2010
Commits on Nov 26, 2010
  1. Minor comment and documentation tweaks. Add the python directory whic…

    …h contains my first cut at a libfko Python wrapper module.
    
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@302 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Nov 26, 2010
Commits on Nov 14, 2010
  1. Added code to zero out rcfile path before setting it. Also added a bo…

    …unds check to that as well.
    
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@301 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Nov 14, 2010
Commits on Nov 13, 2010
  1. Updated the GPL blurb at the top of the source files. Added some miss…

    …ing copyright statements (Thanks to Franck Joncourt).
    
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@300 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Nov 13, 2010
Commits on Nov 10, 2010
  1. Updated perl module for additional error messages.

    git-svn-id: file:///home/mbr/svn/fwknop/trunk@299 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Nov 10, 2010
Commits on Oct 31, 2010
  1. Bumped version to rc3 (even though we may go straight to release) and…

    … lib rev to 3.
    
    git-svn-id: file:///home/mbr/svn/fwknop/trunk@298 510a4753-2344-4c79-9c09-4d669213fbeb
    Damien Stuart committed Oct 31, 2010