diff --git a/ChangeLog-v2.0.0 b/ChangeLog-v2.0.0 deleted file mode 100644 index 0f75ddf9..00000000 --- a/ChangeLog-v2.0.0 +++ /dev/null @@ -1,3020 +0,0 @@ -commit 35456877fa257889c7d894cc24c98fba06106ca6 -Author: Michael Rash -Date: Sun Aug 21 13:50:16 2011 -0400 - - Bug fix for ipfw firewalls to not always require seeing 'Dynamic' rules - - This commit fixes an issue on ipfw firewalls where fwknopd would always require - seeing ipfw 'Dynamic' rules associated with newly added connections. But, such - connections may never be established for various reasons. Previous to this - commit the following warning was frequently generated by fwknopd: - - Unexpected error: did not find 'Dynamic rules' string in list output. - -commit 4b2a96578bcc8ba07371989dcc124ef42813acea -Author: Michael Rash -Date: Sun Aug 21 13:28:16 2011 -0400 - - Bug fix for missing set existence check on ipfw firewalls - - This commit fixes an issues on systems running the ipfw firewall where the - 'set' where fwknopd puts new access rules was attempted to be deleted without - first checking to see whether it exists. The following errors would be - generated (now fixed): - - ipfw: rule 16777217: setsockopt(IP_FW_DEL): Invalid argument - Error 17664 from cmd:'/sbin/ipfw delete set 1': - Fatal: Errors detected during ipfw rules initialization. - -commit 03859387b6667839d8eb6eaf1601e2c14c24d355 -Author: Michael Rash -Date: Sat Aug 20 22:34:24 2011 -0400 - - Bug fix to create the digest.cache file at init - - Bug fix to ensure that the digest.cache file gets created at fwknopd init time - so fwknopd does not throw the following error: - - Error opening digest cache file. Incoming digests will not be remembered. - -commit 04afd2846dd563296c40667557ef4ac0d47aeb0c -Author: Michael Rash -Date: Sat Aug 20 22:02:21 2011 -0400 - - On FreeBSD, made gpgme header path inclusion optional - - If gpgme is installed on FreeBSD systems it appears that - -I/usr/local/include/gpgme must be added to the include path, but this change - only adds the path if gpgme is installed and going to be used. - -commit 6eeb41309401a0c8a47613bcc9f3ce58aa1f6436 -Author: Michael Rash -Date: Sat Aug 20 13:33:00 2011 -0400 - - Fixed a few minor compiler warnings on FreeBSD - - This commit fixes a few warnings about possible uninitialized and unused - variables. - -commit 4248b2687054b38e79e2ab9eecf71e5b299172f4 -Author: Michael Rash -Date: Sat Aug 20 13:19:33 2011 -0400 - - On FreeBSD disable read-only relocations and immediate binding protections - - gcc on FreeBSD generates the following errors when the -Wl,-z,relro -Wl,-z,now - flags are used: - - gcc: -z: linker input file unused because linking not done - gcc: relro: linker input file unused because linking not done - gcc: -z: linker input file unused because linking not done - gcc: now: linker input file unused because linking not done - -commit ff7c4219e8a946fa28aeec941a17d3998ab87ae7 -Author: Michael Rash -Date: Sat Aug 20 12:56:30 2011 -0400 - - Update to suppress additional compiler warning - - This change fixes the following compiler warning that was seen with many of - the source files in server/ - - fwknopd_common.h:223: warning: ‘config_map’ defined but not used - -commit ab7226092dcf687a46916e1841cc05107a5fce8f -Author: Michael Rash -Date: Sat Aug 20 12:34:57 2011 -0400 - - Minor restructuring to suppress compiler "defined but not used warnings" - - This commit fixes several compiler warnings like the following (now that -Wall - is the default): - - config_init.h:68: warning: ‘cmd_opts’ defined but not used - -commit db681fb7916470ec981f0d4e4514402cb49eca3f -Author: Michael Rash -Date: Fri Aug 19 22:00:16 2011 -0400 - - minor commit to fix minor compilations warnings - -commit 637f7a4c936d91a18ef71f364c5fe1c7c5256f5e -Author: Michael Rash -Date: Fri Aug 19 21:14:24 2011 -0400 - - Added -Wall for all gcc warnings during compile - - Enable gcc compilation to include -Wall for all warnings (can be disabled - with --disable-wall to ./configure). - -commit bf59c2688f3dc11913c347c4d1e92c95dfcaa671 -Author: Michael Rash -Date: Fri Aug 19 20:51:50 2011 -0400 - - Bug fix for ./configure args to disable compile time security options - - The ./configure script would generate the following error for the attempted - use of the --without-stackprotector (and other related options like - --without-pie): - - configure: WARNING: unrecognized options: --without-stackprotect - -commit 41fc93407e303a47a412ee91a54f136f80a903f1 -Author: Michael Rash -Date: Thu Aug 18 22:26:52 2011 -0400 - - added the VERSION file - -commit 8b0787c270dc12552275d610bf38115f95cd5972 -Author: Michael Rash -Date: Thu Aug 18 22:25:12 2011 -0400 - - Bumped version to fwknop-2.0.0-rc3 - - Bumped version to fwknop-2.0.0-rc3 - -commit 1e494aba2ec806bec8f670c5378cf6dd5624c012 -Author: Michael Rash -Date: Thu Aug 18 21:13:58 2011 -0400 - - Added ChangeLog derived from git commit messages. - - There will be branch and release specific ChangeLog files as well. - -commit 409c08ac5c3f6310306ddba9b34c985db491722c -Author: Michael Rash -Date: Thu Aug 18 21:10:09 2011 -0400 - - Renamed ChangeLog -> ChangeLog.old for new ChangeLog handling - - The ChangeLog will be derived from commit messages. - -commit b9122f648e57a9f3cfa84c3462ab2463fe04e275 -Author: Michael Rash -Date: Thu Aug 18 20:37:31 2011 -0400 - - Update to add any missing iptables jump rules - - Upon the receipt of a valid SPA packet, a check is done to make sure that - a jump rule from the appropriate built-in iptables chains exists to the - fwknop chains. Such rules could have been deleted by other manipulations - of the iptables policy, so it is important to ensure they exist. Running - in foreground (-f) mode, here is an illustration of the jump rule being - added after it got deleted: - - SPA Packet from IP: 127.0.0.1 received. - Added jump rule from chain: INPUT to chain: FWKNOP_INPUT - Added Rule to FWKNOP_INPUT for 127.0.0.1, tcp/22 expires at 1313680648 - -commit acdf15f158c32bb12b141ecb8bd37fae5f7bfcb1 -Author: Michael Rash -Date: Wed Aug 17 21:24:03 2011 -0400 - - Update to force base64 check for all SPA data - - Previous to this change a check was done for base64 characters in incoming - SPA data only up to MIN_SPA_DATA_SIZE. This check may be reinstantiated for - SPA packets that are delivered over HTTP (and the packet data is embedded - within a URL that may also contain non-base64 chars), but in the meantime the - fwknopd daemon should not accept SPA packets over arbitrary ports with any - non-base64 chars. - -commit 92b7e2588ee64f253720cf8d819ee64f42333aee -Author: Michael Rash -Date: Wed Aug 17 21:07:35 2011 -0400 - - Updated replay warnings to include proto/port info - - Replay warnings now include port and protocol information. Here is an example: - - SPA Packet from IP: 127.0.0.1 received. - Replay detected from source IP: 127.0.0.1 - Destination proto/port: 17/62201 - Original source IP: 127.0.0.1 - Original dst proto/port: 17/62201 - Entry created: 08/17/11 21:06:07 - First replay: 08/17/11 21:06:32 - Last replay: 08/17/11 21:06:45 - Replay count: 7 - -commit df96e42c51b6847d91575dfd68f8cb23ba3aa318 -Author: Michael Rash -Date: Wed Aug 17 20:36:28 2011 -0400 - - Added stack protection, PIE, fortify source, etc. - - Added various security options that can be enabled at compile time. These - options include everything that the "hardening-check" script written by Kees - Cook checks for. After this change, the hardening-check script produces the - following output against the fwknopd binary: - - $ hardening-check server/.libs/fwknopd - server/.libs/fwknopd: - Position Independent Executable: yes - Stack protected: yes - Fortify Source functions: yes - Read-only relocations: yes - Immediate binding: yes - - One of the compile outputs (for example) that shows the new options is: - - /bin/bash ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -fstack-protector-all -fPIE -pie -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wl,-z,now -MT fko_decode.lo -MD -MP -MF .deps/fko_decode.Tpo -c -o fko_decode.lo fko_decode.c - - From the hardening-check man page, here is a description of each of these - options: - - NAME - hardening-check - check binaries for security hardening features - - SYNOPSIS - Examine a given set of ELF binaries and check for several security - hardening features, failing if they are not all found. - - DESCRIPTION - This utility checks a given list of ELF binaries for several security - hardening features that can be compiled into an executable. These - features are: - - Position Independent Executable - This indicates that the executable was built in such a way - (PIE) that the "text" section of the program can be relocated - in memory. To take full advantage of this feature, the - executing kernel must support text Address Space Layout - Randomization (ASLR). - - Stack Protected - This indicates that the executable was compiled with the - gcc(1) option -fstack-protector. The program will be - resistant to have its stack overflowed. - - Fortify Source functions - This indicates that the executable was compiled with - -D_FORTIFY_SOURCE=2 and -O2 or higher. This causes certain - unsafe glibc functions with their safer counterparts (e.g. - strncpy instead of strcpy). - - Read-only relocations - This indicates that the executable was build with -Wl,-z,relro - to have ELF markings (RELRO) that ask the runtime linker to - mark any regions of the relocation table as "read-only" if - they were resolved before execution begins. This reduces the - possible areas of memory in a program that can be used by an - attacker that performs a successful memory corruption exploit. - - Immediate binding - This indicates that the executable was built with -Wl,-z,now - to have ELF markings (BIND_NOW) that ask the runtime linker to - resolve all relocations before starting program execution. - When combined with RELRO above, this further reduces the - regions of memory available to memory corruption attacks. - -commit 60b6a5a4d8a3075ef5d0bc7025859f704ef90bb0 -Author: Michael Rash -Date: Sun Aug 14 22:46:09 2011 -0400 - - Minor variable cleanup to fix compiler warnings - - Minor cleanup to fix compiler warnings about unused variables. - -commit e7d275ee312c618c3233a504c5aa54b72312f39a -Author: Michael Rash -Date: Sun Aug 14 21:55:29 2011 -0400 - - Added fwknop-2.0.0rc2 openwrt support from Jonathan Bennett - - Applied a patch sent from Jonathan Bennett to add fwknop-2.0.0rc2 support to - openwrt. One thing to note about this patch is that the +libgdbm library - dependency has been removed because fwknop now implements its own digest - tracking file without needing gdbm/ndbm on the system. - -commit 878fae8e8a22ea2c34ca544e84e163347835f361 -Author: Michael Rash -Date: Sun Aug 14 19:42:50 2011 -0400 - - Implemented memory clean up for digest cache list - - Upon fwknopd shutdown, a new function free_replay_list() is now called in order - to free heap allocated memory dedicated to SPA digest tracking. Without this - fix, valgrind reports the following (some output snipped): - - valgrind --leak-check=full ./server/.libs/fwknopd -f -i lo -P "udp port 62201" - - ==30864== 431 (48 direct, 383 indirect) bytes in 1 blocks are definitely lost in loss record 17 of 17 - ==30864== at 0x4C27480: calloc (vg_replace_malloc.c:467) - ==30864== by 0x407CB7: replay_check_file_cache (replay_cache.c:461) - ==30864== by 0x407B69: replay_check (replay_cache.c:413) - ==30864== by 0x405813: incoming_spa (incoming_spa.c:363) - ==30864== by 0x406275: pcap_capture (pcap_capture.c:223) - ==30864== by 0x40317D: main (fwknopd.c:297) - -commit 5ee6715cffe9dd4bbed3c0c3eaa75b5dc618b9a6 -Author: Michael Rash -Date: Sun Aug 14 12:36:25 2011 -0400 - - Consolidated replay warnings in a single function - - For both the simple digest file cache and the gdbm/ndbm tracking methods, all - replay warnings are generated by a single function "replay_warning()". - -commit c13cca4aa18317e462c4900e3779de67fa194e21 -Author: Michael Rash -Date: Sat Aug 13 22:35:52 2011 -0400 - - Added digest file import code - - The digest file is now imported as a linked list of digest cache entries at - init time for SPA replay attack detection. - -commit 941a4aa9a39ca5a42ecec92a6fa6908ebcc2c9f2 -Author: Michael Rash -Date: Sat Aug 13 21:00:54 2011 -0400 - - Added source port and protocol to digest tracking - - Added the source port and protocol fields to valid SPA packets in the digest - cache. This can help to discover replay trends. The format of the digest - file cache is now: - -