diff --git a/ChangeLog b/ChangeLog new file mode 100644 index 00000000..7f30525b --- /dev/null +++ b/ChangeLog @@ -0,0 +1,2877 @@ +commit 409c08ac5c3f6310306ddba9b34c985db491722c +Author: Michael Rash +Date: Thu Aug 18 21:10:09 2011 -0400 + + Renamed ChangeLog -> ChangeLog.old for new ChangeLog handling + + The ChangeLog will be derived from commit messages. + +commit b9122f648e57a9f3cfa84c3462ab2463fe04e275 +Author: Michael Rash +Date: Thu Aug 18 20:37:31 2011 -0400 + + Update to add any missing iptables jump rules + + Upon the receipt of a valid SPA packet, a check is done to make sure that + a jump rule from the appropriate built-in iptables chains exists to the + fwknop chains. Such rules could have been deleted by other manipulations + of the iptables policy, so it is important to ensure they exist. Running + in foreground (-f) mode, here is an illustration of the jump rule being + added after it got deleted: + + SPA Packet from IP: 127.0.0.1 received. + Added jump rule from chain: INPUT to chain: FWKNOP_INPUT + Added Rule to FWKNOP_INPUT for 127.0.0.1, tcp/22 expires at 1313680648 + +commit acdf15f158c32bb12b141ecb8bd37fae5f7bfcb1 +Author: Michael Rash +Date: Wed Aug 17 21:24:03 2011 -0400 + + Update to force base64 check for all SPA data + + Previous to this change a check was done for base64 characters in incoming + SPA data only up to MIN_SPA_DATA_SIZE. This check may be reinstantiated for + SPA packets that are delivered over HTTP (and the packet data is embedded + within a URL that may also contain non-base64 chars), but in the meantime the + fwknopd daemon should not accept SPA packets over arbitrary ports with any + non-base64 chars. + +commit 92b7e2588ee64f253720cf8d819ee64f42333aee +Author: Michael Rash +Date: Wed Aug 17 21:07:35 2011 -0400 + + Updated replay warnings to include proto/port info + + Replay warnings now include port and protocol information. Here is an example: + + SPA Packet from IP: 127.0.0.1 received. + Replay detected from source IP: 127.0.0.1 + Destination proto/port: 17/62201 + Original source IP: 127.0.0.1 + Original dst proto/port: 17/62201 + Entry created: 08/17/11 21:06:07 + First replay: 08/17/11 21:06:32 + Last replay: 08/17/11 21:06:45 + Replay count: 7 + +commit df96e42c51b6847d91575dfd68f8cb23ba3aa318 +Author: Michael Rash +Date: Wed Aug 17 20:36:28 2011 -0400 + + Added stack protection, PIE, fortify source, etc. + + Added various security options that can be enabled at compile time. These + options include everything that the "hardening-check" script written by Kees + Cook checks for. After this change, the hardening-check script produces the + following output against the fwknopd binary: + + $ hardening-check server/.libs/fwknopd + server/.libs/fwknopd: + Position Independent Executable: yes + Stack protected: yes + Fortify Source functions: yes + Read-only relocations: yes + Immediate binding: yes + + One of the compile outputs (for example) that shows the new options is: + + /bin/bash ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -fstack-protector-all -fPIE -pie -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wl,-z,now -MT fko_decode.lo -MD -MP -MF .deps/fko_decode.Tpo -c -o fko_decode.lo fko_decode.c + + From the hardening-check man page, here is a description of each of these + options: + + NAME + hardening-check - check binaries for security hardening features + + SYNOPSIS + Examine a given set of ELF binaries and check for several security + hardening features, failing if they are not all found. + + DESCRIPTION + This utility checks a given list of ELF binaries for several security + hardening features that can be compiled into an executable. These + features are: + + Position Independent Executable + This indicates that the executable was built in such a way + (PIE) that the "text" section of the program can be relocated + in memory. To take full advantage of this feature, the + executing kernel must support text Address Space Layout + Randomization (ASLR). + + Stack Protected + This indicates that the executable was compiled with the + gcc(1) option -fstack-protector. The program will be + resistant to have its stack overflowed. + + Fortify Source functions + This indicates that the executable was compiled with + -D_FORTIFY_SOURCE=2 and -O2 or higher. This causes certain + unsafe glibc functions with their safer counterparts (e.g. + strncpy instead of strcpy). + + Read-only relocations + This indicates that the executable was build with -Wl,-z,relro + to have ELF markings (RELRO) that ask the runtime linker to + mark any regions of the relocation table as "read-only" if + they were resolved before execution begins. This reduces the + possible areas of memory in a program that can be used by an + attacker that performs a successful memory corruption exploit. + + Immediate binding + This indicates that the executable was built with -Wl,-z,now + to have ELF markings (BIND_NOW) that ask the runtime linker to + resolve all relocations before starting program execution. + When combined with RELRO above, this further reduces the + regions of memory available to memory corruption attacks. + +commit 60b6a5a4d8a3075ef5d0bc7025859f704ef90bb0 +Author: Michael Rash +Date: Sun Aug 14 22:46:09 2011 -0400 + + Minor variable cleanup to fix compiler warnings + + Minor cleanup to fix compiler warnings about unused variables. + +commit e7d275ee312c618c3233a504c5aa54b72312f39a +Author: Michael Rash +Date: Sun Aug 14 21:55:29 2011 -0400 + + Added fwknop-2.0.0rc2 openwrt support from Jonathan Bennett + + Applied a patch sent from Jonathan Bennett to add fwknop-2.0.0rc2 support to + openwrt. One thing to note about this patch is that the +libgdbm library + dependency has been removed because fwknop now implements its own digest + tracking file without needing gdbm/ndbm on the system. + +commit 878fae8e8a22ea2c34ca544e84e163347835f361 +Author: Michael Rash +Date: Sun Aug 14 19:42:50 2011 -0400 + + Implemented memory clean up for digest cache list + + Upon fwknopd shutdown, a new function free_replay_list() is now called in order + to free heap allocated memory dedicated to SPA digest tracking. Without this + fix, valgrind reports the following (some output snipped): + + valgrind --leak-check=full ./server/.libs/fwknopd -f -i lo -P "udp port 62201" + + ==30864== 431 (48 direct, 383 indirect) bytes in 1 blocks are definitely lost in loss record 17 of 17 + ==30864== at 0x4C27480: calloc (vg_replace_malloc.c:467) + ==30864== by 0x407CB7: replay_check_file_cache (replay_cache.c:461) + ==30864== by 0x407B69: replay_check (replay_cache.c:413) + ==30864== by 0x405813: incoming_spa (incoming_spa.c:363) + ==30864== by 0x406275: pcap_capture (pcap_capture.c:223) + ==30864== by 0x40317D: main (fwknopd.c:297) + +commit 5ee6715cffe9dd4bbed3c0c3eaa75b5dc618b9a6 +Author: Michael Rash +Date: Sun Aug 14 12:36:25 2011 -0400 + + Consolidated replay warnings in a single function + + For both the simple digest file cache and the gdbm/ndbm tracking methods, all + replay warnings are generated by a single function "replay_warning()". + +commit c13cca4aa18317e462c4900e3779de67fa194e21 +Author: Michael Rash +Date: Sat Aug 13 22:35:52 2011 -0400 + + Added digest file import code + + The digest file is now imported as a linked list of digest cache entries at + init time for SPA replay attack detection. + +commit 941a4aa9a39ca5a42ecec92a6fa6908ebcc2c9f2 +Author: Michael Rash +Date: Sat Aug 13 21:00:54 2011 -0400 + + Added source port and protocol to digest tracking + + Added the source port and protocol fields to valid SPA packets in the digest + cache. This can help to discover replay trends. The format of the digest + file cache is now: + +