diff --git a/.gitignore b/.gitignore index 44778bc3..45f5711d 100644 --- a/.gitignore +++ b/.gitignore @@ -39,7 +39,7 @@ install_manifest.txt *.o *.lo -#project generated files +# project generated files autom4te.cache/ *.m4 client/.deps/ @@ -70,6 +70,9 @@ server/fwknopd.8 server/Makefile.in stamp-h1 +# For anyone running on a Mac +.DS_Store + android/project/libs android/project/obj android/project/jni/fwknop/fko.h diff --git a/CREDITS b/CREDITS index e3e59e24..b9ebecd6 100644 --- a/CREDITS +++ b/CREDITS @@ -1,5 +1,10 @@ Jonathan Bennett - Contributed OpenWRT support - see the extras/openwrt/ directory. + - Suggested the addition of the --key-gen option to fwknopd. + - Contributed the console-qr.sh script (in extras/console-qr/) to create + QR codes from fwknopd access.conf keys. + - Wrote a new fwknop client for Android called "Fwknop2" - see: + https://f-droid.org/repository/browse/?fdid=org.cipherdyne.fwknop2 Sebastien Jeanquier - Assisted with getting fwknop included in BackTrack Linux - the choice @@ -55,6 +60,7 @@ Franck Joncourt - Added log module support for the client. - Added the ability to read a passphrase from STDIN and also from a file descriptor via --fd (closes #74). + - Added libfko unit tests via the CUnit framework. Jonathan Schulz - Submitted patches to change HTTP connection type to 'close' for -R mode @@ -213,3 +219,14 @@ Grant Pannell Alexander Kozhevnikov - Reported a bug when fwknop is compiled with --enable-udp-server where the server was including pcap.h + +Dan Brooks + - Contributed a patch for the Android client app to add the definition of + custom server udp port. This is similiar to the --server-port argument + offered by the main fwknop client. + +Github user 'sgh7': + - Contributed a patch to have fwknopd exit if the interface it is sniffing + on goes down. If this happens, it is expected that the native process + monitoring feature in things like systemd or upstart will restart + fwknopd. diff --git a/ChangeLog b/ChangeLog index b886b301..aba3b79f 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,7 +1,69 @@ -fwknop-2.6.6 (02//2015): +fwknop-2.6.7 (08/24/2015): + - [server] When command execution is enabled with ENABLE_CMD_EXEC for an + access.conf stanza, added support for running commands via sudo. This was + suggested by Github user 'freegigi' (issue #159) as a means to provide + command filtering using the powerful sudoers syntax. This feature is + implemented by prefixing any incoming command from a valid SPA packet + with the sudo command along with optional user and group requirements + as defined by the following new access.conf variables: + ENABLE_CMD_SUDO_EXEC, CMD_SUDO_EXEC_USER, and CMD_SUDO_EXEC_GROUP. + - [server] Kevin Layer reported a bug to the fwknop mailing list that + simultaneous NAT access for two different access.conf stanza was not + functioning properly. After some diagnosis, this was a result of + rule_exists() not properly detecting and differentiating existing DNAT + rules from new ones with different port numbers when 'iptables -C' + support is not available. This was against iptables-1.4.7, and has been + fixed in this release of fwknop (tracked as issue #162). + - [server] Added --key-gen to fwknopd. This feature was suggested by + Jonathan Bennett, and will help with ease of use efforts. The first + platform to take advantage of this will likely be OpenWRT thanks to + Jonathan. + - [server] By default, fwknopd will now exit if the interface that it is + sniffing goes down (patch contributed by Github user 'sgh7'). If this + happens, it is expected that the native process monitoring feature in + things like systemd or upstart will restart fwknopd. However, if fwknopd + is not being monitored by systemd, upstart, or anything else, this + behavior can be disabled with the EXIT_AT_INTF_DOWN variable in the + fwknopd.conf file. If disabled, fwknopd will try to recover when a + downed interface comes back up. + - [extras] Added a script from Jonathan Bennett at + extras/console-qr/console-qr.sh to generate QR codes from fwknopd + access.conf keys. + - [build] Added --with-firewalld to the autoconf configure script. This is + a synonym for --with-firewall-cmd to avoid confusion. Some package + maintainers use --with-firewalld to build fwknop. + +fwknop-2.6.6 (04/23/2015): + - [server] Add the ability for fwknopd to function as an generic SPA + gateway. This allows scenarios such as the fwknopd system providing DHCP + addresses to client systems, but those systems would be blocking by + default from accessing the broader Internet until a valid SPA packet is + sent to the gateway. Two new access.conf variables support this feature: + DISABLE_DNAT (do not build any DNAT rules for forwarded connections) and + FORWARD_ALL (allow all traffic to be forwarded instead of specfic + services requested within an SPA packet). So far, this feature is only + supported on systems running iptables or firewalld. The idea was + contributed by "spartan1833" to the fwknop mailing list, and this became + issue 131 on github. - [server] Bug fix when compiled with --enable-udp-server to not include pcap.h, which is likely not installed whenever libpcap is also not installed. This bug was reported by Alexander Kozhevnikov. + - [android] (Dan Brooks) Contributed a patch for the Android client app to + add the definition of custom server udp port. This is similiar to the + --server-port argument offered by the main fwknop client. + - [test suite] Handle versions of lcov that don't have the --rc argument + which is normally used to force the creation of branch coverage stats + when code coverage reports are created. + - [build] Add --enable-asan-support to autoconf configure script to enable + Google's Address Sanitizer (ASan) support. This feature is used during + the testing phase for new fwknop releases. Running fwknop under the + complete test suite (and also under AFL) with ASan support compiled in + did not turn up any new bugs. + - [test suite] (Franck Joncourt) Added libfko unit tests with the CUnit + framework. + - [test suite] Set AFL_HARDEN=1 to AFL fuzzing wrapper scripts. This + enables simple memory bug detection in AFL at the cost of a small + performance hit. fwknop-2.6.5 (12/16/2014): - [server] (Grant Pannell) Added a new access.conf variable "DESTINATION" diff --git a/ChangeLog.git b/ChangeLog.git index 9732ddbd..9866963e 100644 --- a/ChangeLog.git +++ b/ChangeLog.git @@ -1,861 +1,1750 @@ -commit 27af305cf7213c57d9559f129f708fa51fe657aa (HEAD, refs/heads/master) +commit 88c82af1955fb56ade5c6d6e98e80ed28df21ea2 (HEAD, refs/heads/master) Author: Michael Rash -Date: Tue Dec 16 21:31:36 2014 -0500 +Date: Mon Aug 24 17:33:44 2015 -0700 - minor date change for 2.6.5 release + rpm 2.6.7 release note - ChangeLog | 2 +- + fwknop.spec | 3 +++ + 1 file changed, 3 insertions(+) + +commit ecfa8021e58447db656043915e131d6798ee8651 (refs/remotes/origin/master, refs/remotes/origin/HEAD) +Author: Michael Rash +Date: Mon Aug 24 17:25:06 2015 -0700 + + doc updates to include sudo information + + client/fwknop.8.in | 4 ++-- + doc/fwknopd.man.asciidoc | 38 ++++++++++++++++++++++++------------- + server/fwknopd.8.in | 49 +++++++++++++++++++++++++++++++++++++++++++++--- + 3 files changed, 73 insertions(+), 18 deletions(-) + +commit 71ded8caf1770b067d3425f5a5f87ed7984c99c5 +Author: Michael Rash +Date: Mon Aug 24 17:23:40 2015 -0700 + + ChangeLog update for 2.6.7 + + ChangeLog | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +commit c04feff5ef6c9e69e6f22bee9b2cfb75e5fb04e5 +Author: Michael Rash +Date: Sun Aug 23 20:50:24 2015 -0700 + + [test suite] initialize coverage files in non --include mode + + test/test-fwknop.pl | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +commit b060495bb4a21fafa7544739a42eefd488e887f3 +Author: Michael Rash +Date: Sun Aug 23 20:32:59 2015 -0700 + + [test suite] rm previous coverage files in coverage mode when --include criteria is not used + + Makefile.am | 1 + + test/init-lcov.sh | 3 +++ + test/rm-coverage-files.sh | 12 ++++++++++++ + test/test-fwknop.pl | 8 ++++++++ + 4 files changed, 24 insertions(+) + +commit 9531099a1fba4b30ff3a6b5b7db98ab0cf6a69c5 +Author: Michael Rash +Date: Sun Aug 23 20:08:17 2015 -0700 + + [test suite] use pkill when available + + test/test-fwknop.pl | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +commit b88d1854ed311f8a60e325f57d22ea3056fbafb8 +Author: Michael Rash +Date: Sat Aug 22 23:20:59 2015 -0400 + + minor link comment fix + + README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -commit ff3eaf84484c3f4e53392ebea8d6658840873586 +commit fab2f8e591f4617b14b8c514f5513d7b292de40c Author: Michael Rash -Date: Tue Dec 16 21:15:29 2014 -0500 +Date: Sat Aug 22 23:18:12 2015 -0400 - [test suite] minor update to exclude a couple of iptables tests on ipfw/PF firewalls + minor README update - test/test-fwknop.pl | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) + README.md | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) -commit 7f1da8e62596d8c120e1484bab98e95d6f08ca04 +commit d1d59778e95b2ff7737a731698e7b98fc96e6d1d Author: Michael Rash -Date: Mon Dec 15 22:34:22 2014 -0500 +Date: Fri Aug 21 23:06:07 2015 -0400 - bumped version to 2.6.5 + [server] handle trailing quote for PF firewalls on OpenBSD - ChangeLog | 2 +- - VERSION | 2 +- - configure.ac | 2 +- - fwknop.spec | 5 ++++- - win32/config.h | 2 +- - 5 files changed, 8 insertions(+), 5 deletions(-) + server/fw_util_pf.c | 3 +++ + server/utils.c | 11 +++++++++-- + server/utils.h | 1 + + 3 files changed, 13 insertions(+), 2 deletions(-) -commit db8b5e4e485796908f385dcd1c2f7ebb8c742578 +commit fe9e42f2121aac76d1d939b38aef3b5cc6773c70 Author: Michael Rash -Date: Mon Dec 15 20:57:46 2014 -0500 +Date: Fri Aug 21 22:29:35 2015 -0400 - [test suite] added AFL plot results: plot-2.6.5.67f969f/ + [test suite] minor sudo error code searching update - test/afl/results/plot-2.6.5.67f969f/exec_speed.png | Bin 0 -> 20466 bytes - test/afl/results/plot-2.6.5.67f969f/high_freq.png | Bin 0 -> 22305 bytes - test/afl/results/plot-2.6.5.67f969f/index.html | 10 + - .../afl/results/plot-2.6.5.67f969f/index.html.orig | 10 + - test/afl/results/plot-2.6.5.67f969f/low_freq.png | Bin 0 -> 11027 bytes - test/afl/results/plot-2.6.5.67f969f/plot_data | 7337 ++++++++++++++++++++ - 6 files changed, 7357 insertions(+) + test/tests/rijndael_hmac_cmd_exec.pl | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) -commit a4eb640f9ca26dd6cf35e64a74c53fab6f774e97 +commit dd1528c829ea97faa04157e030270b27ae8d8246 Author: Michael Rash -Date: Mon Dec 15 20:55:49 2014 -0500 +Date: Fri Aug 21 22:24:45 2015 -0400 - [test suite] add AFL results file: server-access-2.6.5.67f969f + [test suite] set sudo path on the fwknopd command line - test/afl/results/server-access-2.6.5.67f969f | 25 +++++++++++++++++++++++++ - 1 file changed, 25 insertions(+) + server/config_init.c | 6 ++++-- + test/test-fwknop.pl | 5 +++++ + test/tests/basic_operations.pl | 16 ++++++++++++++++ + 3 files changed, 25 insertions(+), 2 deletions(-) -commit 9dc56d6bb7b28142e0173521db5a91bd25d41a00 +commit e999f61f82930254ef81f3b06de141e08a6f562a Author: Michael Rash -Date: Mon Dec 15 17:06:07 2014 -0800 +Date: Fri Aug 21 22:04:58 2015 -0400 - [test suite / server] rule deletion/addition tests mid-cycle + [test suite] allow /usr/local/etc/sudoers path - server/fw_util_firewalld.c | 37 ++++++++++---------------------- - server/fw_util_iptables.c | 39 +++++++++++----------------------- - test/test-fwknop.pl | 34 +++++++++++++++++++++++++----- - test/tests/rijndael_hmac.pl | 41 ++++++++++++++++++++++++++++++++++++ - test/tests/rijndael_hmac_cmd_exec.pl | 13 ++++++++++++ - 5 files changed, 106 insertions(+), 58 deletions(-) + test/test-fwknop.pl | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) -commit fd582487dba5e5655584f5c341a2754a5aae8d4d +commit f37fd2281607c68463311e06433db52f906c35e6 Author: Michael Rash -Date: Mon Dec 15 17:03:08 2014 -0800 +Date: Fri Aug 21 21:49:07 2015 -0400 - [server] minor typo fix + [extras] use default configure args before running cov-build + + extras/coverity/coverity_scan.sh | 1 + + 1 file changed, 1 insertion(+) + +commit 2f94413b2fa4132f50dfca055e9fb15a5e633b85 +Author: Michael Rash +Date: Fri Aug 21 21:35:10 2015 -0400 + + [server] bug fix for ipfw firewall rule removal + + server/fw_util_ipfw.c | 1 + + 1 file changed, 1 insertion(+) + +commit ec9eef33654b596a3e863176e2b61a4ee32c51d8 +Author: Michael Rash +Date: Wed Aug 19 23:41:47 2015 -0400 + + [server] fix a dead code condition spotted by Coverity + + server/fw_util_firewalld.c | 23 ++++++++++++----------- + server/fw_util_iptables.c | 23 ++++++++++++----------- + 2 files changed, 24 insertions(+), 22 deletions(-) + +commit c5507d2c2a49aaac30582d51701e8a74b398a6fc +Author: Michael Rash +Date: Wed Aug 19 23:41:17 2015 -0400 + + [server] fix ptr vs. val check spotted by Coverity server/incoming_spa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -commit 67f969f2c7ea5f8ce5f498ba99588467436351f2 +commit 82464574a6d07108dce57d2ca5873b8863861381 Author: Michael Rash -Date: Wed Dec 10 17:06:45 2014 -0800 +Date: Tue Aug 18 22:12:23 2015 -0400 - [server] compilation bug fix for firewalld platforms in DESTINATION processing code + [client] minor update to make chksum() static - server/fw_util_firewalld.c | 2 +- + client/spa_comm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -commit 122ecf10d787cd9ae295dc7b029bfa37440fa9b8 +commit 423899f3c47122a1246a335d7abf978f1773abad Author: Michael Rash -Date: Sun Dec 7 17:00:10 2014 -0500 +Date: Tue Aug 18 22:02:00 2015 -0400 - minor ChangeLog update + [server] minor fix to remove unnecessary var definition - ChangeLog | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) + server/fw_util_firewalld.c | 1 - + server/fw_util_iptables.c | 1 - + 2 files changed, 2 deletions(-) -commit c7e3be6bbd5486bd31257d23c074b5e23b428f4a -Merge: 74f1146 a99bff9 +commit 0fdc263a435a7ffe9e805b0ec2f1a9669406c7b5 Author: Michael Rash -Date: Sun Dec 7 16:32:53 2014 -0500 +Date: Tue Aug 18 21:58:53 2015 -0400 + + options struct should not be global (CLANG -Wshadow warning) + + client/fwknop_common.h | 2 -- + server/fwknopd_common.h | 5 ++--- + 2 files changed, 2 insertions(+), 5 deletions(-) + +commit a9c3e204dcf3714e1a891193a420f299438817f5 +Author: Michael Rash +Date: Tue Aug 18 20:40:14 2015 -0400 + + [test suite] pgrep usage bug fix + + test/test-fwknop.pl | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +commit 47ff151dea9ba469a39753943e0aa472c668f5b0 +Author: Michael Rash +Date: Tue Aug 18 20:37:56 2015 -0400 + + [build] add convenience script for ASan builds + + Sometimes when ASan support is wanted for fwknop, the following compile + error can be generated. This script provides a means to solve this. + + fwknop-spa_comm.o: In function `send_spa_packet_http': + /home/mbr/git/fwknop.git/client/spa_comm.c:516: undefined reference to `rpl_malloc' + ../lib/.libs/libfko.so: undefined reference to `rpl_realloc' + + Makefile.am | 1 + + extras/sanitizer/asan-build.sh | 21 +++++++++++++++++++++ + 2 files changed, 22 insertions(+) + +commit 5e0a668a7f61e04eddd4b7dd4ec8273c543b1e0a +Author: Michael Rash +Date: Sun Aug 16 21:31:48 2015 -0400 + + [server] minor access.c fix to quiet both Coverity and the CLANG static analyzer + + server/access.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 8edad8b5839acaf82f51631d40031f3c39bc619a +Author: Michael Rash +Date: Sun Aug 16 21:27:14 2015 -0400 + + [extras] update Coverity version to 7.7.0 for interface script + + extras/coverity/coverity_scan.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit f3b25bdc241e6410ef5f99bcb2257911622ec4bd +Author: Michael Rash +Date: Sun Aug 16 21:06:26 2015 -0400 + + [test suite] require custom config paths for sudo tests + + test/test-fwknop.pl | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit 743d861c6713e6456e71267f107681c8485a2db5 +Author: Damien Stuart +Date: Fri Aug 14 16:49:07 2015 -0400 + + Updated version in the spec file. + + fwknop.spec | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit e5c6f96788a57695e3d6c293cd0ebaa69563e167 +Author: Michael Rash +Date: Sat Jul 25 23:10:06 2015 -0400 + + [server] fix compilation issue for non-iptables firewalls + + server/fw_util_ipf.c | 3 ++- + server/fw_util_ipfw.c | 3 ++- + server/fw_util_pf.c | 3 ++- + 3 files changed, 6 insertions(+), 3 deletions(-) + +commit 47851dffddb25e3eb9a22ec54394adbc79bfe56f +Author: Michael Rash +Date: Sat Jul 25 19:17:10 2015 -0700 + + [test suite] use pgrep for fwknopd check at init time + + test/test-fwknop.pl | 28 ++++++++++++++++++++++++---- + 1 file changed, 24 insertions(+), 4 deletions(-) + +commit 8e7dd29280f0078a64acc6030a20e0ac0d3a23eb +Merge: 72555ba db3a8c3 +Author: Michael Rash +Date: Sat Jul 25 19:00:48 2015 -0700 + + Merge branch 'master' of ssh://192.168.10.1/home/mbr/git/fwknop + +commit 72555ba9fec3af9d734a383ce98050a84bb7b5bd +Author: Michael Rash +Date: Sat Jul 25 18:58:39 2015 -0700 + + [server] minor comment fix for group ID determination in access.conf parsing + + server/access.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit fbdc542f48c45d8b7e466e31f1b3c099b75fec1c +Merge: c0330e5 dff7b82 +Author: Michael Rash +Date: Sat Jul 25 13:28:49 2015 -0700 Merge branch 'master' of https://github.com/mrash/fwknop -commit 74f114603ba149f67fbc51ad2995c78bae9bdadf +commit db3a8c39e4f7930ea59a1acf733d0cad62745f63 +Merge: c0330e5 dff7b82 Author: Michael Rash -Date: Sun Dec 7 16:29:30 2014 -0500 +Date: Sat Jul 25 16:28:23 2015 -0400 - check fiu_init() and fiu_enable() return values + Merge branch 'master' of https://github.com/mrash/fwknop - client/fwknop.c | 31 ++++++++++++++++++++++++------- - server/fwknopd.c | 12 ++++++++++-- - 2 files changed, 34 insertions(+), 9 deletions(-) - -commit a99bff9b639334208ce65920d9b995a52e0da2ac +commit c0330e5c8b604fb50330dfbe60fdf305393250c4 Author: Michael Rash -Date: Sat Dec 6 19:58:33 2014 -0500 +Date: Sat Jul 25 13:27:42 2015 -0700 - [test suite] minor Makefile update for fko-wrapper + [server] additional work on splitting incoming_spa() loop into functions - test/fko-wrapper/Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) + server/incoming_spa.c | 606 +++++++++++++++++++++++++++++--------------------- + 1 file changed, 354 insertions(+), 252 deletions(-) -commit 54625819c959afc30ed0f2b1ca2fdd75e3c6bc41 +commit 591d400216f40f16b3aa116e938130130fb7929e Author: Michael Rash -Date: Fri Dec 5 21:23:23 2014 -0500 +Date: Sat Jul 25 13:26:50 2015 -0700 - [test suite] get resolve tests passing (--test mode stopped resolutions) + [test suite] fix sudo user tests - test/test-fwknop.pl | 4 ++++ - test/tests/basic_operations.pl | 26 +++++++++++++------------- - 2 files changed, 17 insertions(+), 13 deletions(-) + test/test-fwknop.pl | 4 ++-- + test/tests/rijndael_hmac_cmd_exec.pl | 8 +------- + 2 files changed, 3 insertions(+), 9 deletions(-) -commit 01438a9c1621e013daed765c90033707569965d7 +commit 3270900a3813a521be6a83a8274baa2101fa6588 Author: Michael Rash -Date: Fri Dec 5 20:57:38 2014 -0500 +Date: Sun Jul 19 21:54:20 2015 -0700 - [test suite] make filehandles a bit more unique + [server] continued work on splitting incoming_spa() into functions - test/test-fwknop.pl | 160 ++++++++++++++++++++++++++-------------------------- - 1 file changed, 81 insertions(+), 79 deletions(-) + server/incoming_spa.c | 351 ++++++++++++++++++++++++++------------------------ + 1 file changed, 186 insertions(+), 165 deletions(-) -commit a4d6c17512acb62296e6b64a86b9a418da7a1276 +commit 6116419e212a7f65ca658473e0617f073d303495 Author: Michael Rash -Date: Fri Dec 5 20:56:47 2014 -0500 +Date: Sun Jul 19 20:38:23 2015 -0700 - [test suite] add DESTINATION formatting tests + [test suite] ensure HMAC key string is equal to SHA512_BLOCK_LEN in length (fixes ASAN warning) - test/tests/basic_operations.pl | 155 +++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 155 insertions(+) + test/fko-wrapper/fko_wrapper.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) -commit 28c7cfc8e5064a7756f0636da4d641845b10be5c +commit dff7b82dafbab8276add503c5011ef6d2ed6dbb0 +Merge: 89b2e8f 0ac52b9 +Author: Michael Rash +Date: Wed Jul 22 11:06:08 2015 -0400 + + Merge pull request #166 from micha137/patch-1 + +commit 01beb31861a8fdfb4555cce73e4d02139fc946a1 Author: Michael Rash -Date: Fri Dec 5 20:52:17 2014 -0500 +Date: Sun Jul 19 20:35:54 2015 -0700 - added missed config file spotted by the test suite + [server] start to split incoming_spa() main loop into functions + + server/incoming_spa.c | 388 +++++++++++++++++++++++++++++--------------------- + 1 file changed, 223 insertions(+), 165 deletions(-) + +commit d681485e2921020fddd4678a2f2bf93dfc15e92d +Author: Michael Rash +Date: Sun Jul 19 20:23:04 2015 -0700 + + [server] add sudo support, closes #159 + + ChangeLog | 11 ++- + doc/fwknopd.man.asciidoc | 2 +- + server/access.c | 125 +++++++++++++++++++++------ + server/config_init.c | 13 +++ + server/extcmd.c | 4 +- + server/fwknopd_common.h | 4 + + server/incoming_spa.c | 51 ++++++++--- + test/test-fwknop.pl | 124 ++++++++++++++++++++++++--- + test/tests/rijndael_hmac_cmd_exec.pl | 162 ++++++++++++++++++++++++++++++++++- + 9 files changed, 442 insertions(+), 54 deletions(-) + +commit 0ac52b9b4d8a332671c8d1c75e74bd0527442f97 +Author: micha137 +Date: Tue Jul 21 18:39:43 2015 +0200 + + Fix some typos + + server/fwknopd.conf | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +commit 89b2e8f477245bf6fdf1d2746c829f9ba26faf15 +Author: Michael Rash +Date: Sat Jul 18 13:11:25 2015 -0700 + + [server] interface goes down will cause fwknopd to exit + + By default, fwknopd will now exit if the interface that it is + sniffing goes down (patch contributed by Github user 'sgh7'). If this + happens, it is expected that the native process monitoring feature in + things like systemd or upstart will restart fwknopd. However, if fwknopd + is not being monitored by systemd, upstart, or anything else, this + behavior can be disabled with the EXIT_AT_INTF_DOWN variable in the + fwknopd.conf file. If disabled, fwknopd will try to recover when a + downed interface comes back up. + + CREDITS | 6 +++++ + ChangeLog | 8 ++++++ + Makefile.am | 1 + + doc/fwknopd.man.asciidoc | 9 +++++++ + server/cmd_opts.h | 1 + + server/config_init.c | 7 +++++ + server/fwknopd_common.h | 2 ++ + server/pcap_capture.c | 3 ++- + test/conf/no_exit_down_intf_fwknopd.conf | 1 + + test/test-fwknop.pl | 46 +++++++++++++++++++++++++++----- + test/tests/basic_operations.pl | 20 ++++++++++++++ + 11 files changed, 96 insertions(+), 8 deletions(-) + +commit 15c00692b7070eb0807b4f86d43d02b44de40296 +Merge: 795b1de 8647854 +Author: Michael Rash +Date: Sat Jul 18 23:43:00 2015 -0400 + + Merge pull request #164 from Coacher/master + +commit 8647854efe986d7b8bcab5a3dbe6e7541c46713f +Author: Ilya Tumaykin +Date: Sun Jul 19 06:18:54 2015 +0300 + + extras: add systemd unit file and tmpfiles.d configuration for fwknopd + + extras/systemd/fwknopd.service | 12 ++++++++++++ + extras/systemd/fwknopd.tmpfiles.conf | 1 + + 2 files changed, 13 insertions(+) + +commit 795b1de4ddeeed3c2331ec69f60f66253e04a055 +Author: Michael Rash +Date: Sat Jul 18 10:37:17 2015 -0700 + + [server] Added RULES_CHECK_THRESHOLD to define 'deep' rule expiration check frequency + + The RULES_CHECK_THRESHOLD variable defines the number of times firewall rule + expiration times must be checked before a "deep" check is run. This allows + fwknopd to remove rules that contain a proper '_exp_