DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

Merge remote-tracking branch 'upstream/master' into c_unit_testing

Browse Source
This commit is contained in:
Franck Joncourt
2014-09-07 15:24:59 +02:00
parent 688f08c2a0 aae72a9470
commit 32c5afae83
22 changed files with 2269 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+77
View File
@@ -0,0 +1,77 @@
# built application files
*.apk
*.ap_
# files for the dex VM
*.dex
# Java class files
*.class
# generated files
bin/
gen/
# Local configuration file (sdk path, etc)
local.properties
# Eclipse project files
.classpath
.project
# Proguard folder generated by Eclipse
proguard/
# Intellij project files
*.iml
*.ipr
*.iws
.idea/
# CMake files
CMakeCache.txt
CMakeFiles
Makefile
cmake_install.cmake
install_manifest.txt
# C, C++
*.o
*.lo
#project generated files
autom4te.cache/
*.m4
client/.deps/
client/Makefile.in
common/libfko_util.a
common/Makefile.in
config.h
config.h.in
config.log
config.status
config/
configure
doc/libfko.info
doc/Makefile.in
doc/stamp-vti
doc/version.texi
lib/libfko.la
lib/.deps/
lib/.dirstamp
lib/.libs/
lib/Makefile.in
libtool
Makefile.in
server/.deps/
server/.libs/
server/fwknopd
server/fwknopd.8
server/Makefile.in
stamp-h1
android/project/libs
android/project/obj
android/project/jni/fwknop/fko.h
android/project/jni/libfwknop/*.h
android/project/jni/libfwknop/*.c
CREDITS
+3
View File
@@ -175,6 +175,9 @@ Gerry Reno
- Provided guidance on Android client issues along with testing candidate
patches to update various things - this work is being tracked in the
android4.4_support branch.
- Implemented support for firewalld in the fwknopd daemon running on RHEL 7
and CentOS 7 systems. This is a major addition to handle yet another
firewall architecture.
Tim Heckman
- Homebrew fwknop package maintainer for Mac OS X systems.
ChangeLog
+7
View File
@@ -1,4 +1,11 @@
fwknop-2.6.4 (09//2014):
- (Gerry Reno) Added support for firewalld to the fwknopd daemon on RHEL 7
CentOS 7. This is implemented using the current firewalld '--direct
--passthrough' capability which accepts raw iptables commands. More
information on firewalld can be found here:
https://fedoraproject.org/wiki/FirewallD
- (Bill Stubbs) submitted a patch to fix a bug where fwknopd could not
handle Ethernet frames that include the Frame Check Sequence (FCS)
header. This header is four bytes long, and is placed at the end of each
README.md
+10 -3
View File
@@ -9,9 +9,9 @@ default-drop filtering stance. The main application of SPA is to use a firewall
to drop all attempts to connect to services such as SSH in order to make the
exploitation of vulnerabilities (both 0-day and unpatched code) more difficult.
Because there are no open ports, any service that is concealed by SPA naturally
cannot be scanned for with Nmap. The fwknop project supports three different
firewalls: iptables on Linux systems, pf on OpenBSD, and ipfw on FreeBSD and
Mac OS X.
cannot be scanned for with Nmap. The fwknop project supports four different
firewalls: firewalld and iptables on Linux systems, pf on OpenBSD, and ipfw on
FreeBSD and Mac OS X.
SPA is essentially next generation Port Knocking (PK), but solves many of the
limitations exhibited by PK while retaining its core benefits. PK limitations
@@ -103,6 +103,9 @@ the `INSTALL` file for the general basics on using autoconf.
--with-gpgme-prefix=PFX prefix where GPGME is installed (optional)
--with-gpg=/path/to/gpg Specify path to the gpg executable that gpgme will
use [default=check path]
--with-firewalld=/path/to/firewalld
Specify path to the firewalld executable
[default=check path]
--with-iptables=/path/to/iptables
Specify path to the iptables executable
[default=check path]
@@ -115,6 +118,10 @@ the `INSTALL` file for the general basics on using autoconf.
--with-ipf=/path/to/ipf Specify path to the ipf executable [default=check
path]
Examples:
./configure --disable-client --with-firewalld=/bin/firewall-cmd
./configure --disable-client --with-iptables=/sbin/iptables --with-firewalld=no
## Notes
### Migrating from the Perl version of fwknop
android/project/src/com/max2idea/android/fwknop/Fwknop.java
+3
View File
@@ -378,9 +378,12 @@ public class Fwknop extends Activity {
this.mCheck.setChecked(prefs.getBoolean("app_start", false));
this.mPasswd = (EditText) findViewById(R.id.passwd);
this.mPasswd.setText(prefs.getString("passwd_str", ""));
this.mOutput = (TextView) findViewById(R.id.output);
this.mHmac = (EditText) findViewById(R.id.hmac);
this.mHmac.setText(prefs.getString("hmac_str", ""));
mUnlock = (ImageButton) findViewById(R.id.unlock);
mUnlock.setOnClickListener(new OnClickListener() {
client/config_init.c
+5 -4
View File
@@ -2412,7 +2412,7 @@ usage(void)
" '$HOME/.fwknoprc' file to provide some of all\n"
" of the configuration parameters.\n"
" If more arguments are set through the command\n"
" line, the configuration is updated accordingly\n"
" line, the configuration is updated accordingly.\n"
" -A, --access Provide a list of ports/protocols to open\n"
" on the server (e.g. 'tcp/22').\n"
" -a, --allow-ip Specify IP address to allow within the SPA\n"
@@ -2458,6 +2458,7 @@ usage(void)
" -u, --user-agent Set the HTTP User-Agent for resolving the\n"
" external IP via -R, or for sending SPA\n"
" packets over HTTP.\n"
" -w, --wget-cmd Manually set the path to wget in -R mode.\n"
" -H, --http-proxy Specify an HTTP proxy host through which the\n"
" SPA packet will be sent. The port can also be\n"
" specified here by following the host/ip with\n"
@@ -2474,9 +2475,9 @@ usage(void)
" -K, --key-gen-file Write generated Rijndael + HMAC keys to a\n"
" file\n"
" --key-rijndael Specify the Rijndael key. Since the password is\n"
" visible to utilities (like 'ps' under Unix) this\n"
" form should only be used where security is not\n"
" important.\n"
" visible to utilities (like 'ps' under Unix)\n"
" this form should only be used where security is\n"
" not important.\n"
" --key-base64-rijndael Specify the base64 encoded Rijndael key. Since\n"
" the password is visible to utilities (like 'ps'\n"
" under Unix) this form should only be used where\n"
common/common.h
+2
View File
@@ -97,6 +97,8 @@
#define fdopen _fdopen
#define close _close
#define write _write
#define popen _popen
#define pclose _pclose
#define O_WRONLY _O_WRONLY
#define O_RDONLY _O_RDONLY
#define O_RDWR _O_RDWR
configure.ac
+33 -4
View File
@@ -493,6 +493,24 @@ AS_IF([test "$want_server" = yes], [
AM_CONDITIONAL([USE_NDBM], [test x$use_ndbm = xyes])
AM_CONDITIONAL([CONFIG_FILE_CACHE], [test x$want_file_cache = xyes])
dnl Check for firewalld
dnl
AC_ARG_WITH([firewall-cmd],
[AS_HELP_STRING([--with-firewall-cmd=/path/to/firewall-cmd],
[Specify path to the firewall-cmd executable @<:@default=check path@:>@])],
[
AS_IF([ test "x$withval" = xno ], [],
AS_IF([ test "x$withval" = x -o "x$withval" = xyes ],
[AC_MSG_ERROR([--with-firewall-cmd requires an argument specifying a path to firewall-cmd])],
[ FORCE_FIREWALLD_EXE=$withval ]
)
)
],
[
AC_PATH_PROG(FIREWALLD_EXE, [firewall-cmd], [], [$APP_PATH])
]
)
dnl Check for iptables
dnl
AC_ARG_WITH([iptables],
@@ -567,6 +585,9 @@ dnl
dnl If a firewall was forced. set the appropriate _EXE var and clear the others.
dnl
AS_IF([test "x$FORCE_FIREWALLD_EXE" != x], [
FIREWALLD_EXE="$FORCE_FIREWALLD_EXE"
],[
AS_IF([test "x$FORCE_IPTABLES_EXE" != x], [
IPTABLES_EXE="$FORCE_IPTABLES_EXE"
],[
@@ -588,12 +609,19 @@ dnl
]
]
]
))))
]
)))))
dnl Determine which firewall exe we use (if we have one).
dnl If iptables was found or specified, it wins, then we fallback to ipfw,
dnl then pf, and otherwise we try ipf.
dnl If firewalld was found or specified, it wins, then we fallback to iptables,
dnl then ipfw, pf, and otherwise we try ipf.
dnl
AS_IF([test "x$FIREWALLD_EXE" != x], [
FW_DEF="FW_FIREWALLD"
FIREWALL_TYPE="firewalld"
FIREWALL_EXE=$FIREWALLD_EXE
AC_DEFINE_UNQUOTED([FIREWALL_FIREWALLD], [1], [The firewall type: firewalld.])
],[
AS_IF([test "x$IPTABLES_EXE" != x], [
FW_DEF="FW_IPTABLES"
FIREWALL_TYPE="iptables"
@@ -621,7 +649,8 @@ dnl
]
]
]
))))
]
)))))
AC_DEFINE_UNQUOTED([FIREWALL_EXE], ["$FIREWALL_EXE"],
[Path to firewall command executable (it should match the firewall type).])
doc/fwknopd.man.asciidoc
+29 -15
View File
@@ -229,17 +229,6 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
synchronization with the *fwknopd* server system (NTP is good). The
default age is 120 seconds (two minutes).
*ACCESS_EXPIRE* '<MM/DD/YYYY>'::
Defines an expiration date for the access stanza in MM/DD/YYYY format.
All SPA packets that match an expired stanza will be ignored. This
parameter is optional.
*ACCESS_EXPIRE_EPOCH* '<seconds>'::
Defines an expiration date for the access stanza as the epoch time, and is
useful if a more accurate expiration time needs to be given than the day
resolution offered by the ACCESS_EXPIRE variable above. All SPA packets
that match an expired stanza will be ignored. This parameter is optional.
*ENABLE_DIGEST_PERSISTENCE* '<Y/N>'::
Track digest sums associated with previous SPA packets processed by
*fwknopd*. This allows digest sums to remain persistent across
@@ -303,7 +292,7 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
the '$HOME/.gnupg' directory of the user running *fwknopd* (most
likely root).
GPG_EXE* '<path>'::
*GPG_EXE* '<path>'::
Specify the path to GPG, and defaults to '/usr/bin/gpg' if not set.
*LOCALE* '<locale>'::
@@ -443,6 +432,17 @@ directive starts a new stanza.
optional field, and if not specified then *fwknopd* defaults to using
SHA256 if the access stanza requires an HMAC.
*ACCESS_EXPIRE* '<MM/DD/YYYY>'::
Defines an expiration date for the access stanza in MM/DD/YYYY format.
All SPA packets that match an expired stanza will be ignored. This
parameter is optional.
*ACCESS_EXPIRE_EPOCH* '<seconds>'::
Defines an expiration date for the access stanza as the epoch time, and is
useful if a more accurate expiration time needs to be given than the day
resolution offered by the ACCESS_EXPIRE variable above. All SPA packets
that match an expired stanza will be ignored. This parameter is optional.
*ENABLE_CMD_EXEC* '<Y/N>'::
This instructs *fwknopd* to accept complete commands that are contained
within an authorization packet. Any such command will be executed on
@@ -468,6 +468,9 @@ directive starts a new stanza.
client behind a NAT) or the client must know the external IP and set it
via the *-a* argument.
*REQUIRE_SOURCE_ADDRESS* '<Y/N>'::
Synonym for ``REQUIRE_SOURCE_ADDRESS''.
*FORCE_NAT* '<IP> <PORT>'::
For any valid SPA packet, force the requested connection to be NAT'd
through to the specified (usually internal) IP and port value. This is
@@ -522,10 +525,14 @@ directive starts a new stanza.
and/or pinentry to collect a passphrase.
*GPG_REQUIRE_SIG* '<Y/N>'::
With this setting set to 'Y', fwknopd check all GPG-encrypted SPA
With this setting set to 'Y', fwknopd check all GPG-encrypted SPA
messages for a signature (signed by the sender's key). If the incoming
message is not signed, the decryption process will fail. If not set, the
default is 'N'.
default is 'Y'.
*GPG_DISABLE_SIG* '<Y/N>'::
Disable signature verification for incoming SPA messages. This is not a
recommended setting, and the default is 'N'.
*GPG_IGNORE_SIG_VERIFY_ERROR* '<Y/N>'::
Setting this will allow fwknopd to accept incoming GPG-encrypted packets
@@ -538,9 +545,16 @@ directive starts a new stanza.
any incoming SPA message that has been encrypted with the
*fwknopd* server key. This ensures that the verification of the
remote user is accomplished via a strong cryptographic mechanism.
This setting only applies if the ``GPG_REQUIRE_SIG'' is set to 'Y'.
Signature verification is enabled by default, and can only be disabled
if ``GPG_DISABLE_SIG'' is set to 'Y' (not a recommended setting).
Separate multiple entries with a comma.
*GPG_FINGERPRINT_ID* '<keyID,...,keyID>'::
Specify a set of full-length GnuPG key fingerprints instead of the shorter
key identifiers set with the ``GPG_REMOTE_ID'' variable. Here is an
example fingerprint for one of the fwknop test suite keys:
'00CC95F05BC146B6AC4038C9E36F443C6A3FAD56'.
*GPG_HOME_DIR* '<path>'::
Define the path to the GnuPG directory to be used by the *fwknopd*
server. If this keyword is not specified within '@sysconfdir@/fwknop/access.conf'
fwknop.spec
+5 -5
View File
@@ -50,11 +50,11 @@ Requires: libfko => 2.0.3, libpcap, iptables
%description
Fwknop implements an authorization scheme known as Single Packet Authorization
(SPA) for Linux systems running iptables. This mechanism requires only a
single encrypted and non-replayed packet to communicate various pieces of
information including desired access through an iptables policy. The main
application of this program is to use iptables in a default-drop stance to
protect services such as SSH with an additional layer of security in order
(SPA) for Linux systems running firewalld or iptables. This mechanism requires
only a single encrypted and non-replayed packet to communicate various pieces of
information including desired access through a firewalld or iptables policy. The
main application of this program is to use firewalld or iptables in a default-drop
stance to protect services such as SSH with an additional layer of security in order
to make the exploitation of vulnerabilities (both 0-day and unpatched code)
much more difficult.
server/Makefile.am
+1
View File
@@ -8,6 +8,7 @@ fwknopd_SOURCES = fwknopd.c fwknopd.h config_init.c config_init.h \
access.c access.h fwknopd_errors.c fwknopd_errors.h \
tcp_server.c tcp_server.h extcmd.c extcmd.h \
fw_util.c fw_util.h fw_util_ipf.c fw_util_ipf.h \
fw_util_firewalld.c fw_util_firewalld.h \
fw_util_iptables.c fw_util_iptables.h \
fw_util_ipfw.c fw_util_ipfw.h \
fw_util_pf.c fw_util_pf.h cmd_opts.h \
server/access.c
+29 -3
View File
@@ -170,7 +170,7 @@ add_acc_expire_time_epoch(fko_srv_options_t *opts, time_t *access_expire_time, c
return 1;
}
#if FIREWALL_IPTABLES
#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES)
static int
add_acc_force_nat(fko_srv_options_t *opts, acc_stanza_t *curr_acc, const char *val)
{
@@ -1590,7 +1590,20 @@ parse_access_file(fko_srv_options_t *opts)
}
else if(CONF_VAR_IS(var, "FORCE_NAT"))
{
#if FIREWALL_IPTABLES
#if FIREWALL_FIREWALLD
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1) !=0 )
{
log_msg(LOG_ERR,
"[*] FORCE_NAT requires ENABLE_FIREWD_FORWARDING to be enabled in fwknopd.conf");
fclose(file_ptr);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
if(add_acc_force_nat(opts, curr_acc, val) != SUCCESS)
{
fclose(file_ptr);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
#elif FIREWALL_IPTABLES
if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1) !=0 )
{
log_msg(LOG_ERR,
@@ -1612,7 +1625,20 @@ parse_access_file(fko_srv_options_t *opts)
}
else if(CONF_VAR_IS(var, "FORCE_SNAT"))
{
#if FIREWALL_IPTABLES
#if FIREWALL_FIREWALLD
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1) !=0 )
{
log_msg(LOG_ERR,
"[*] FORCE_SNAT requires ENABLE_FIREWD_FORWARDING to be enabled in fwknopd.conf");
fclose(file_ptr);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
if(add_acc_force_snat(opts, curr_acc, val) != SUCCESS)
{
fclose(file_ptr);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
#elif FIREWALL_IPTABLES
if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1) !=0 )
{
log_msg(LOG_ERR,
server/cmd_opts.h
+18 -1
View File
@@ -66,7 +66,22 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = {
//"EXTERNAL_CMD_ALARM",
//"ENABLE_EXT_CMD_PREFIX",
//"EXT_CMD_PREFIX",
#if FIREWALL_IPTABLES
#if FIREWALL_FIREWALLD
"ENABLE_FIREWD_FORWARDING",
"ENABLE_FIREWD_LOCAL_NAT",
"ENABLE_FIREWD_SNAT",
"SNAT_TRANSLATE_IP",
"ENABLE_FIREWD_OUTPUT",
"FLUSH_FIREWD_AT_INIT",
"FLUSH_FIREWD_AT_EXIT",
"FIREWD_INPUT_ACCESS",
"FIREWD_OUTPUT_ACCESS",
"FIREWD_FORWARD_ACCESS",
"FIREWD_DNAT_ACCESS",
"FIREWD_SNAT_ACCESS",
"FIREWD_MASQUERADE_ACCESS",
"ENABLE_FIREWD_COMMENT_CHECK",
#elif FIREWALL_IPTABLES
"ENABLE_IPT_FORWARDING",
"ENABLE_IPT_LOCAL_NAT",
"ENABLE_IPT_SNAT",
@@ -121,6 +136,7 @@ enum {
FW_FLUSH,
GPG_HOME_DIR,
GPG_EXE_PATH,
FIREWD_DISABLE_CHECK_SUPPORT,
IPT_DISABLE_CHECK_SUPPORT,
PCAP_FILE,
ENABLE_PCAP_ANY_DIRECTION,
@@ -158,6 +174,7 @@ static struct option cmd_opts[] =
{"fw-list-all", 0, NULL, FW_LIST_ALL },
{"gpg-home-dir", 1, NULL, GPG_HOME_DIR },
{"gpg-exe", 1, NULL, GPG_EXE_PATH },
{"no-firewd-check-support", 0, NULL, FIREWD_DISABLE_CHECK_SUPPORT },
{"no-ipt-check-support", 0, NULL, IPT_DISABLE_CHECK_SUPPORT },
{"locale", 1, NULL, 'l' },
{"rotate-digest-cache", 0, NULL, ROTATE_DIGEST_CACHE },
server/config_init.c
+152 -2
View File
@@ -36,7 +36,9 @@
#include "utils.h"
#include "log_msg.h"
#if FIREWALL_IPTABLES
#if FIREWALL_FIREWALLD
#include "fw_util_firewalld.h"
#elif FIREWALL_IPTABLES
#include "fw_util_iptables.h"
#endif
@@ -428,7 +430,150 @@ validate_options(fko_srv_options_t *opts)
if(opts->config[CONF_MAX_SNIFF_BYTES] == NULL)
set_config_entry(opts, CONF_MAX_SNIFF_BYTES, DEF_MAX_SNIFF_BYTES);
#if FIREWALL_IPTABLES
#if FIREWALL_FIREWALLD
/* Enable FIREWD forwarding.
*/
if(opts->config[CONF_ENABLE_FIREWD_FORWARDING] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_FORWARDING,
DEF_ENABLE_FIREWD_FORWARDING);
/* Enable FIREWD local NAT.
*/
if(opts->config[CONF_ENABLE_FIREWD_LOCAL_NAT] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_LOCAL_NAT,
DEF_ENABLE_FIREWD_LOCAL_NAT);
/* Enable FIREWD SNAT.
*/
if(opts->config[CONF_ENABLE_FIREWD_SNAT] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_SNAT,
DEF_ENABLE_FIREWD_SNAT);
/* Make sure we have a valid IP if SNAT is enabled
*/
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_SNAT], "Y", 1) == 0)
{
/* Note that fw_config_init() will set use_masquerade if necessary
*/
if(opts->config[CONF_SNAT_TRANSLATE_IP] != NULL)
{
if(! is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP]))
{
log_msg(LOG_ERR,
"Invalid IPv4 addr for SNAT_TRANSLATE_IP"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
}
}
/* Enable FIREWD OUTPUT.
*/
if(opts->config[CONF_ENABLE_FIREWD_OUTPUT] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_OUTPUT,
DEF_ENABLE_FIREWD_OUTPUT);
/* Flush FIREWD at init.
*/
if(opts->config[CONF_FLUSH_FIREWD_AT_INIT] == NULL)
set_config_entry(opts, CONF_FLUSH_FIREWD_AT_INIT, DEF_FLUSH_FIREWD_AT_INIT);
/* Flush FIREWD at exit.
*/
if(opts->config[CONF_FLUSH_FIREWD_AT_EXIT] == NULL)
set_config_entry(opts, CONF_FLUSH_FIREWD_AT_EXIT, DEF_FLUSH_FIREWD_AT_EXIT);
/* FIREWD input access.
*/
if(opts->config[CONF_FIREWD_INPUT_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_INPUT_ACCESS,
DEF_FIREWD_INPUT_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_INPUT_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_INPUT_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD output access.
*/
if(opts->config[CONF_FIREWD_OUTPUT_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_OUTPUT_ACCESS,
DEF_FIREWD_OUTPUT_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_OUTPUT_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_OUTPUT_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD forward access.
*/
if(opts->config[CONF_FIREWD_FORWARD_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_FORWARD_ACCESS,
DEF_FIREWD_FORWARD_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_FORWARD_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_FORWARD_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD dnat access.
*/
if(opts->config[CONF_FIREWD_DNAT_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_DNAT_ACCESS,
DEF_FIREWD_DNAT_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_DNAT_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_DNAT_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD snat access.
*/
if(opts->config[CONF_FIREWD_SNAT_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_SNAT_ACCESS,
DEF_FIREWD_SNAT_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_SNAT_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_SNAT_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD masquerade access.
*/
if(opts->config[CONF_FIREWD_MASQUERADE_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_MASQUERADE_ACCESS,
DEF_FIREWD_MASQUERADE_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_MASQUERADE_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_MASQUERADE_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* Check for the firewalld 'comment' match at init time
*/
if(opts->config[CONF_ENABLE_FIREWD_COMMENT_CHECK] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_COMMENT_CHECK,
DEF_ENABLE_FIREWD_COMMENT_CHECK);
#elif FIREWALL_IPTABLES
/* Enable IPT forwarding.
*/
if(opts->config[CONF_ENABLE_IPT_FORWARDING] == NULL)
@@ -929,6 +1074,9 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
case 'i':
set_config_entry(opts, CONF_PCAP_INTF, optarg);
break;
case FIREWD_DISABLE_CHECK_SUPPORT:
opts->firewd_disable_check_support = 1;
break;
case IPT_DISABLE_CHECK_SUPPORT:
opts->ipt_disable_check_support = 1;
break;
@@ -1069,6 +1217,8 @@ usage(void)
" done in the access.conf file).\n"
" --gpg-exe - Specify the path to GPG (this is normally done in\n"
" the access.conf file).\n"
" --no-firewd-check-support\n"
" - Disable test for 'firewall-cmd ... -C' support.\n"
" --no-ipt-check-support - Disable test for 'iptables -C' support.\n"
"\n"
);
server/fw_util.h
+3 -1
View File
@@ -40,7 +40,9 @@
#define EXPIRE_COMMENT_PREFIX "_exp_"
#define TMP_COMMENT "__TMPCOMMENT__"
#if FIREWALL_IPTABLES
#if FIREWALL_FIREWALLD
#include "fw_util_firewalld.h"
#elif FIREWALL_IPTABLES
#include "fw_util_iptables.h"
#elif FIREWALL_IPFW
#include "fw_util_ipfw.h"
server/fw_util_firewalld.c
+1589
View File
File diff suppressed because it is too large Load Diff
server/fw_util_firewalld.h
+62
View File
@@ -0,0 +1,62 @@
/*
*****************************************************************************
*
* File: fw_util_firewalld.h
*
* Purpose: Header file for fw_util_firewalld.c.
*
* Fwknop is developed primarily by the people listed in the file 'AUTHORS'.
* Copyright (C) 2009-2014 fwknop developers and contributors. For a full
* list of contributors, see the file 'CREDITS'.
*
* License (GNU General Public License):
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
* USA
*
*****************************************************************************
*/
#ifndef FW_UTIL_FIREWALLD_H
#define FW_UTIL_FIREWALLD_H
#define SNAT_TARGET_BUFSIZE 64
/* firewalld command args
*/
#define FIREWD_CHK_RULE_ARGS "-C %s %s" /* 2>&1 is always added in the second %s */
#define FIREWD_RULE_ARGS "-t %s -p %i -s %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s 2>&1"
#define FIREWD_OUT_RULE_ARGS "-t %s -p %i -d %s --sport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s 2>&1"
#define FIREWD_FWD_RULE_ARGS "-t %s -p %i -s %s -d %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s 2>&1"
#define FIREWD_DNAT_RULE_ARGS "-t %s -p %i -s %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s --to-destination %s:%i 2>&1"
#define FIREWD_SNAT_RULE_ARGS "-t %s -p %i -d %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s %s 2>&1"
#define FIREWD_TMP_COMMENT_ARGS "-t %s -I %s %i -s 127.0.0.2 -m comment --comment " TMP_COMMENT " -j %s 2>&1"
#define FIREWD_TMP_CHK_RULE_ARGS "-t %s -I %s %i -s 127.0.0.2 -p udp -j %s 2>&1"
#define FIREWD_TMP_VERIFY_CHK_ARGS "-t %s -C %s -s 127.0.0.2 -p udp -j %s 2>&1"
#define FIREWD_DEL_RULE_ARGS "-t %s -D %s %i 2>&1"
#define FIREWD_NEW_CHAIN_ARGS "-t %s -N %s 2>&1"
#define FIREWD_FLUSH_CHAIN_ARGS "-t %s -F %s 2>&1"
#define FIREWD_CHAIN_EXISTS_ARGS "-t %s -L %s -n 2>&1"
#define FIREWD_DEL_CHAIN_ARGS "-t %s -X %s 2>&1"
#define FIREWD_CHK_JUMP_RULE_ARGS "-t %s -j %s 2>&1"
#define FIREWD_ADD_JUMP_RULE_ARGS "-t %s -I %s %i -j %s 2>&1"
#define FIREWD_DEL_JUMP_RULE_ARGS "-t %s -D %s -j %s 2>&1" /* let firewalld work out the rule number */
#define FIREWD_LIST_RULES_ARGS "-t %s -L %s --line-numbers -n 2>&1"
#define FIREWD_LIST_ALL_RULES_ARGS "-t %s -v -n -L --line-numbers 2>&1"
int validate_firewd_chain_conf(const char * const chain_str);
#endif /* FW_UTIL_FIREWALLD_H */
/***EOF***/
server/fwknopd.8.in
+33 -15
View File
@@ -2,12 +2,12 @@
.\" Title: fwknopd
.\" Author: [see the "AUTHORS" section]
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
.\" Date: 06/05/2014
.\" Date: 08/26/2014
.\" Manual: Fwknop Server
.\" Source: Fwknop Server
.\" Language: English
.\"
.TH "FWKNOPD" "8" "06/05/2014" "Fwknop Server" "Fwknop Server"
.TH "FWKNOPD" "8" "08/26/2014" "Fwknop Server" "Fwknop Server"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
@@ -317,16 +317,6 @@ Defines the maximum age (in seconds) that an SPA packet will be accepted\&. This
server system (NTP is good)\&. The default age is 120 seconds (two minutes)\&.
.RE
.PP
\fBACCESS_EXPIRE\fR \fI<MM/DD/YYYY>\fR
.RS 4
Defines an expiration date for the access stanza in MM/DD/YYYY format\&. All SPA packets that match an expired stanza will be ignored\&. This parameter is optional\&.
.RE
.PP
\fBACCESS_EXPIRE_EPOCH\fR \fI<seconds>\fR
.RS 4
Defines an expiration date for the access stanza as the epoch time, and is useful if a more accurate expiration time needs to be given than the day resolution offered by the ACCESS_EXPIRE variable above\&. All SPA packets that match an expired stanza will be ignored\&. This parameter is optional\&.
.RE
.PP
\fBENABLE_DIGEST_PERSISTENCE\fR \fI<Y/N>\fR
.RS 4
Track digest sums associated with previous SPA packets processed by
@@ -407,7 +397,7 @@ directory of the user running
(most likely root)\&.
.RE
.PP
GPG_EXE* \fI<path>\fR
\fBGPG_EXE\fR \fI<path>\fR
.RS 4
Specify the path to GPG, and defaults to
\fI/usr/bin/gpg\fR
@@ -551,6 +541,16 @@ Specify the digest algorithm for incoming SPA packet authentication\&. Must be o
defaults to using SHA256 if the access stanza requires an HMAC\&.
.RE
.PP
\fBACCESS_EXPIRE\fR \fI<MM/DD/YYYY>\fR
.RS 4
Defines an expiration date for the access stanza in MM/DD/YYYY format\&. All SPA packets that match an expired stanza will be ignored\&. This parameter is optional\&.
.RE
.PP
\fBACCESS_EXPIRE_EPOCH\fR \fI<seconds>\fR
.RS 4
Defines an expiration date for the access stanza as the epoch time, and is useful if a more accurate expiration time needs to be given than the day resolution offered by the ACCESS_EXPIRE variable above\&. All SPA packets that match an expired stanza will be ignored\&. This parameter is optional\&.
.RE
.PP
\fBENABLE_CMD_EXEC\fR \fI<Y/N>\fR
.RS 4
This instructs
@@ -585,6 +585,11 @@ has to be used to automatically resolve the external address (if the client behi
argument\&.
.RE
.PP
\fBREQUIRE_SOURCE_ADDRESS\fR \fI<Y/N>\fR
.RS 4
Synonym for \(lqREQUIRE_SOURCE_ADDRESS\(rq\&.
.RE
.PP
\fBFORCE_NAT\fR \fI<IP> <PORT>\fR
.RS 4
For any valid SPA packet, force the requested connection to be NAT\(cqd through to the specified (usually internal) IP and port value\&. This is useful if there are multiple internal systems running a service such as SSHD, and you want to give transparent access to only one internal system for each stanza in the access\&.conf file\&. This way, multiple external users can each directly access only one internal system per SPA key\&.
@@ -633,6 +638,12 @@ to leverage a GnuPG key pair that does not have an associated password\&. While
.RS 4
With this setting set to
\fIY\fR, fwknopd check all GPG\-encrypted SPA messages for a signature (signed by the sender\(cqs key)\&. If the incoming message is not signed, the decryption process will fail\&. If not set, the default is
\fIY\fR\&.
.RE
.PP
\fBGPG_DISABLE_SIG\fR \fI<Y/N>\fR
.RS 4
Disable signature verification for incoming SPA messages\&. This is not a recommended setting, and the default is
\fIN\fR\&.
.RE
.PP
@@ -646,8 +657,15 @@ Setting this will allow fwknopd to accept incoming GPG\-encrypted packets that a
.RS 4
Define a list of gpg key ID\(cqs that are required to have signed any incoming SPA message that has been encrypted with the
\fBfwknopd\fR
server key\&. This ensures that the verification of the remote user is accomplished via a strong cryptographic mechanism\&. This setting only applies if the \(lqGPG_REQUIRE_SIG\(rq is set to
\fIY\fR\&. Separate multiple entries with a comma\&.
server key\&. This ensures that the verification of the remote user is accomplished via a strong cryptographic mechanism\&. Signature verification is enabled by default, and can only be disabled if \(lqGPG_DISABLE_SIG\(rq is set to
\fIY\fR
(not a recommended setting)\&. Separate multiple entries with a comma\&.
.RE
.PP
\fBGPG_FINGERPRINT_ID\fR \fI<keyID,\&...,keyID>\fR
.RS 4
Specify a set of full\-length GnuPG key fingerprints instead of the shorter key identifiers set with the \(lqGPG_REMOTE_ID\(rq variable\&. Here is an example fingerprint for one of the fwknop test suite keys:
\fI00CC95F05BC146B6AC4038C9E36F443C6A3FAD56\fR\&.
.RE
.PP
\fBGPG_HOME_DIR\fR \fI<path>\fR
server/fwknopd.conf
+110
View File
@@ -196,6 +196,114 @@
#ENABLE_EXT_CMD_PREFIX N;
#EXT_CMD_PREFIX FWKNOP_;
##############################################################################
# Parameters specific to firewalld:
# Flush all existing rules in the fwknop chains at fwknop start time and/or
# exit time. They default to Y and it is a recommended setting for both.
#
#FLUSH_FIREWD_AT_INIT Y;
#FLUSH_FIREWD_AT_EXIT Y;
#
# Allow SPA clients to request access to services through an firewalld
# firewall instead of just to it (i.e. access through the FWKNOP_FORWARD
# chain instead of the INPUT chain).
#
#ENABLE_FIREWD_FORWARDING N;
# Allow SPA clients to request access to a local socket via NAT. This still
# puts an ACCEPT rule into the FWKNOP_INPUT chain, but a different port is
# translated via DNAT rules to the real one. So, the user would do
# "ssh -p <port>" to access the local service (see the --NAT-local and
# --NAT-rand-port on the fwknop client command line).
#
#ENABLE_FIREWD_LOCAL_NAT Y;
# By default, if forwarding access is enabled (see the ENABLE_FIREWD_FORWARDING
# variable above), then fwknop creates DNAT rules for incoming connections,
# but does not also complement these rules with SNAT rules at the same time.
# In some situations, internal systems may not have a route back out for the
# source address of the incoming connection, so it is necessary to also
# apply SNAT rules so that the internal systems see the IP of the internal
# interface where fwknopd is running. This functionality is only enabled
# when ENABLE_FIREWD_SNAT is set to "Y", and by default SNAT rules are built
# with the MASQUERADE target (since then the internal IP does not have to be
# defined here in the fwknop.conf file), but if you want fwknopd to use the
# SNAT target then also defined an IP address with the SNAT_TRANSLATE_IP
# variable.
#
#ENABLE_FIREWD_SNAT N;
#SNAT_TRANSLATE_IP __CHANGEME__;
# Add ACCEPT rules to the FWKNOP_OUTPUT chain. This is usually only useful
# if there are no state tracking rules to allow connection responses out and
# the OUTPUT chain has a default-drop stance.
#
#ENABLE_FIREWD_OUTPUT N;
# fwknopd adds allow rules to a custom firewalld chain "FWKNOP_INPUT".
# This chain is called from the INPUT chain, and by default no other
# firewalld chains are used. However, additional chains can be added
# (say, if access needs to be allowed through the local system via the
# FORWARD chain) by altering the FIREWD_FORWARD_ACCESS variable below.
# For a discussion of the format followed by these keywords, read on:
#
# Specify chain names to which firewalld blocking rules will be
# added with the FIREWD_INPUT_ACCESS and FIREWD_FORWARD_ACCESS keyword.
# The format for these variables is:
#
# <Target>,<Table>,<From_chain>,<Jump_rule_position>,\
# <To_chain>,<Rule_position>.
#
# "Target":
# Can be any legitimate firewalld target, but should usually just be "DROP".
#
# "Table":
# Can be any firewalld table, but the default is "filter".
#
# "From_chain":
# Is the chain from which packets will be jumped.
#
# "Jump_rule_position":
# Defines the position within the From_chain where the jump rule is added.
#
# "To_chain":
# Is the chain to which packets will be jumped. This is the main chain
# where fwknop rules are added.
#
# "Rule_position":
# Defines the position where rule are added within the To_chain.
#
#FIREWD_INPUT_ACCESS ACCEPT, filter, INPUT, 1, FWKNOP_INPUT, 1;
# The FIREWD_OUTPUT_ACCESS variable is only used if ENABLE_FIREWD_OUTPUT is enabled
#
#FIREWD_OUTPUT_ACCESS ACCEPT, filter, OUTPUT, 1, FWKNOP_OUTPUT, 1;
# The FIREWD_FORWARD_ACCESS variable is only used if ENABLE_FIREWD_FORWARDING is
# enabled.
#
#FIREWD_FORWARD_ACCESS ACCEPT, filter, FORWARD, 1, FWKNOP_FORWARD, 1;
#FIREWD_DNAT_ACCESS DNAT, nat, PREROUTING, 1, FWKNOP_PREROUTING, 1;
# The FIREWD_SNAT_ACCESS variable is not used unless both ENABLE_FIREWD_SNAT and
# ENABLE_FIREWD_FORWARDING are enabled. Also, the external static IP must be
# set with the SNAT_TRANSLATE_IP variable. The default is to use the
# FIREWD_MASQUERADE_ACCESS variable.
#
#FIREWD_SNAT_ACCESS SNAT, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1;
#FIREWD_MASQUERADE_ACCESS MASQUERADE, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1;
# The ENABLE_COMMENT_MATCH_CHECK variable instructs fwknopd to check for the
# firewalld 'comment' match at start up. If it's not found, then fwknopd will
# exit and throw an error. This variable is enabled by default, but can be
# disabled if you want fwknopd to run without being sure that the comment match
# if available (not recommended, since the comment match enables new SPA rules
# to be timed out).
#
#ENABLE_FIREWD_COMMENT_CHECK Y;
##############################################################################
# Parameters specific to iptables:
@@ -372,6 +480,7 @@
#
#PF_EXPIRE_INTERVAL 30;
##############################################################################
# Directories - These can override compile-time defaults.
#
@@ -389,6 +498,7 @@
# System binaries
#
#FIREWALL_EXE /bin/firewall-cmd;
#FIREWALL_EXE /sbin/iptables;
###EOF###
server/fwknopd_common.h
+86 -3
View File
@@ -115,9 +115,29 @@
#define RCHK_MAX_PCAP_DISPATCH_COUNT (2 << 22)
#define RCHK_MAX_FW_TIMEOUT (2 << 22)
/* FirewallD-specific defines
*/
#if FIREWALL_FIREWALLD
#define DEF_FLUSH_FIREWD_AT_INIT "Y"
#define DEF_FLUSH_FIREWD_AT_EXIT "Y"
#define DEF_ENABLE_FIREWD_FORWARDING "N"
#define DEF_ENABLE_FIREWD_LOCAL_NAT "Y"
#define DEF_ENABLE_FIREWD_SNAT "N"
#define DEF_ENABLE_FIREWD_OUTPUT "N"
#define DEF_ENABLE_FIREWD_COMMENT_CHECK "Y"
#define DEF_FIREWD_INPUT_ACCESS "ACCEPT, filter, INPUT, 1, FWKNOP_INPUT, 1"
#define DEF_FIREWD_OUTPUT_ACCESS "ACCEPT, filter, OUTPUT, 1, FWKNOP_OUTPUT, 1"
#define DEF_FIREWD_FORWARD_ACCESS "ACCEPT, filter, FORWARD, 1, FWKNOP_FORWARD, 1"
#define DEF_FIREWD_DNAT_ACCESS "DNAT, nat, PREROUTING, 1, FWKNOP_PREROUTING, 1"
#define DEF_FIREWD_SNAT_ACCESS "SNAT, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1"
#define DEF_FIREWD_MASQUERADE_ACCESS "MASQUERADE, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1"
#define RCHK_MAX_FIREWD_RULE_NUM (2 << 15)
/* Iptables-specific defines
*/
#if FIREWALL_IPTABLES
#elif FIREWALL_IPTABLES
#define DEF_FLUSH_IPT_AT_INIT "Y"
#define DEF_FLUSH_IPT_AT_EXIT "Y"
@@ -215,7 +235,22 @@ enum {
//CONF_EXTERNAL_CMD_ALARM,
//CONF_ENABLE_EXT_CMD_PREFIX,
//CONF_EXT_CMD_PREFIX,
#if FIREWALL_IPTABLES
#if FIREWALL_FIREWALLD
CONF_ENABLE_FIREWD_FORWARDING,
CONF_ENABLE_FIREWD_LOCAL_NAT,
CONF_ENABLE_FIREWD_SNAT,
CONF_SNAT_TRANSLATE_IP,
CONF_ENABLE_FIREWD_OUTPUT,
CONF_FLUSH_FIREWD_AT_INIT,
CONF_FLUSH_FIREWD_AT_EXIT,
CONF_FIREWD_INPUT_ACCESS,
CONF_FIREWD_OUTPUT_ACCESS,
CONF_FIREWD_FORWARD_ACCESS,
CONF_FIREWD_DNAT_ACCESS,
CONF_FIREWD_SNAT_ACCESS,
CONF_FIREWD_MASQUERADE_ACCESS,
CONF_ENABLE_FIREWD_COMMENT_CHECK,
#elif FIREWALL_IPTABLES
CONF_ENABLE_IPT_FORWARDING,
CONF_ENABLE_IPT_LOCAL_NAT,
CONF_ENABLE_IPT_SNAT,
@@ -352,7 +387,54 @@ typedef struct acc_stanza
/* Firewall-related data and types. */
#if FIREWALL_IPTABLES
#if FIREWALL_FIREWALLD
/* --DSS XXX: These are arbitrary. We should determine appropriate values.
*/
#define MAX_TABLE_NAME_LEN 64
#define MAX_CHAIN_NAME_LEN 64
#define MAX_TARGET_NAME_LEN 64
/* Fwknop custom chain types
*/
enum {
FIREWD_INPUT_ACCESS,
FIREWD_OUTPUT_ACCESS,
FIREWD_FORWARD_ACCESS,
FIREWD_DNAT_ACCESS,
FIREWD_SNAT_ACCESS,
FIREWD_MASQUERADE_ACCESS,
NUM_FWKNOP_ACCESS_TYPES /* Leave this entry last */
};
/* Structure to define an fwknop firewall chain configuration.
*/
struct fw_chain {
int type;
char target[MAX_TARGET_NAME_LEN];
//int direction;
char table[MAX_TABLE_NAME_LEN];
char from_chain[MAX_CHAIN_NAME_LEN];
int jump_rule_pos;
char to_chain[MAX_CHAIN_NAME_LEN];
int rule_pos;
int active_rules;
time_t next_expire;
};
/* Based on the fw_chain fields (not counting type)
*/
#define FW_NUM_CHAIN_FIELDS 6
struct fw_config {
struct fw_chain chain[NUM_FWKNOP_ACCESS_TYPES];
char fw_command[MAX_PATH_LEN];
/* Flag for firewalld SNAT vs. MASQUERADE usage
*/
unsigned char use_masquerade;
};
#elif FIREWALL_IPTABLES
/* --DSS XXX: These are arbitrary. We should determine appropriate values.
*/
#define MAX_TABLE_NAME_LEN 64
@@ -484,6 +566,7 @@ typedef struct fko_srv_options
unsigned char verbose; /* Verbose mode flag */
unsigned char exit_after_parse_config; /* Parse config and exit */
unsigned char firewd_disable_check_support; /* Don't use firewall-cmd ... -C */
unsigned char ipt_disable_check_support; /* Don't use iptables -C */
/* Flag for permitting SPA packets regardless of directionality test
server/incoming_spa.c
+11 -1
View File
@@ -815,7 +815,17 @@ incoming_spa(fko_srv_options_t *opts)
|| spadat.message_type == FKO_NAT_ACCESS_MSG
|| spadat.message_type == FKO_CLIENT_TIMEOUT_NAT_ACCESS_MSG)
{
#if FIREWALL_IPTABLES
#if FIREWALL_FIREWALLD
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1)!=0)
{
log_msg(LOG_WARNING,
"(stanza #%d) SPA packet from %s requested NAT access, but is not enabled",
stanza_num, spadat.pkt_source_ip
);
acc = acc->next;
continue;
}
#elif FIREWALL_IPTABLES
if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1)!=0)
{
log_msg(LOG_WARNING,
win32/config.h
+1 -1
View File
@@ -178,7 +178,7 @@
#undef TIME_WITH_SYS_TIME
/* Version number of package */
#define VERSION "2.0"
#define VERSION "2.6.3"
/* Define to 1 if your processor stores words with the most significant byte
first (like Motorola and SPARC, unlike Intel and VAX). */