From b7b4e857be15c2f34ada9d63c988fc3d4debcc6f Mon Sep 17 00:00:00 2001 From: Damien Stuart Date: Sun, 13 Jan 2013 22:16:30 -0500 Subject: [PATCH 1/4] Change to how strlcpy and strlcat are handled Put strlcpy and strlcat object files back in the source group in lib. Moved libfko_util.a to the common directory (though sources remain in lib). Client and server code looks to common dir for libfko-util. This fixes issue with strlcpy showing as undefined symbol when perl FKO module is loaded. --- client/Makefile.am | 2 +- common/Makefile.am | 6 ++++++ lib/Makefile.am | 11 +---------- server/Makefile.am | 2 +- 4 files changed, 9 insertions(+), 12 deletions(-) diff --git a/client/Makefile.am b/client/Makefile.am index 6c48198a..61525a12 100644 --- a/client/Makefile.am +++ b/client/Makefile.am @@ -6,7 +6,7 @@ fwknop_SOURCES = fwknop.c fwknop.h config_init.c config_init.h \ fwknop_CPPFLAGS = -I $(top_srcdir)/lib -I $(top_srcdir)/common -fwknop_LDADD = $(top_builddir)/lib/libfko.la $(top_builddir)/lib/libfko_util.a +fwknop_LDADD = $(top_builddir)/lib/libfko.la $(top_builddir)/common/libfko_util.a dist_man_MANS = fwknop.8 diff --git a/common/Makefile.am b/common/Makefile.am index 6eb7b45d..be50de28 100644 --- a/common/Makefile.am +++ b/common/Makefile.am @@ -1 +1,7 @@ +libfko_util_source_files = ../lib/strlcpy.c ../lib/strlcat.c ../lib/fko_util.h +libfko_util_a_SOURCES = $(libfko_util_source_files) +libfko_util_a_LIBADD = + +noinst_LIBRARIES = libfko_util.a + EXTRA_DIST = common.h netinet_common.h diff --git a/lib/Makefile.am b/lib/Makefile.am index fd86623c..84916317 100644 --- a/lib/Makefile.am +++ b/lib/Makefile.am @@ -8,20 +8,11 @@ libfko_source_files = \ fko.h fko_limits.h fko_timestamp.c fko_user.c fko_user.h \ md5.c md5.h rijndael.c rijndael.h sha1.c sha1.h sha2.c sha2.h \ fko_context.h fko_state.h fko_context.h gpgme_funcs.c \ - gpgme_funcs.h + gpgme_funcs.h strlcpy.c strlcat.c fko_util.h libfko_la_SOURCES = $(libfko_source_files) -libfko_la_LIBADD = -libfko_la_DEPENDENCIES = strlcpy.lo strlcat.lo libfko_la_LDFLAGS = -version-info 1:0:0 $(GPGME_LIBS) -export-symbols-regex '^fko_' -libfko_util_source_files = strlcpy.c strlcat.c fko_util.h -libfko_util_a_SOURCES = $(libfko_util_source_files) -libfko_util_a_LIBADD = -libfko_util_a_DEPENDENCIES = strlcpy.lo strlcat.lo - -noinst_LIBRARIES = libfko_util.a - AM_CPPFLAGS = $(GPGME_CFLAGS) -I $(top_srcdir)/common include_HEADERS = fko.h diff --git a/server/Makefile.am b/server/Makefile.am index 5de71553..fc321ba4 100644 --- a/server/Makefile.am +++ b/server/Makefile.am @@ -12,7 +12,7 @@ fwknopd_SOURCES = fwknopd.c fwknopd.h config_init.c config_init.h \ fw_util_ipfw.c fw_util_ipfw.h \ fw_util_pf.c fw_util_pf.h cmd_opts.h -fwknopd_LDADD = $(top_builddir)/lib/libfko.la $(top_builddir)/lib/libfko_util.a -lpcap +fwknopd_LDADD = $(top_builddir)/lib/libfko.la $(top_builddir)/common/libfko_util.a -lpcap if ! CONFIG_FILE_CACHE if USE_NDBM From ecc9a62a23faa3688c5b63849e4f12109beffef5 Mon Sep 17 00:00:00 2001 From: Damien Stuart Date: Sun, 13 Jan 2013 22:28:34 -0500 Subject: [PATCH 2/4] Add AM_CPPFLAGS to common/Makefile.am --- common/Makefile.am | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/common/Makefile.am b/common/Makefile.am index be50de28..4924f53d 100644 --- a/common/Makefile.am +++ b/common/Makefile.am @@ -1,7 +1,9 @@ -libfko_util_source_files = ../lib/strlcpy.c ../lib/strlcat.c ../lib/fko_util.h -libfko_util_a_SOURCES = $(libfko_util_source_files) -libfko_util_a_LIBADD = - noinst_LIBRARIES = libfko_util.a +libfko_util_source_files = ../lib/strlcpy.c ../lib/strlcat.c ../lib/fko_util.h + +libfko_util_a_SOURCES = $(libfko_util_source_files) + +AM_CPPFLAGS = $(GPGME_CFLAGS) -I $(top_srcdir)/common + EXTRA_DIST = common.h netinet_common.h From bf990821ffcb44aba4c82a476e0309b49837ebb7 Mon Sep 17 00:00:00 2001 From: Damien Stuart Date: Sun, 24 Feb 2013 18:09:13 -0500 Subject: [PATCH 3/4] Fixed broken configure options for forcing a particular firewall type and path. --- configure.ac | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/configure.ac b/configure.ac index 137d17c8..fe6c276f 100644 --- a/configure.ac +++ b/configure.ac @@ -417,7 +417,7 @@ dnl AS_IF([ test "x$withval" = xno ], [], AS_IF([ test "x$withval" = x -o "x$withval" = xyes ], [AC_MSG_ERROR([--with-iptables requires an argument specifying a path to iptables])], - [ IPTABLES_EXE=$withval ] + [ FORCE_IPTABLES_EXE=$withval ] ) ) ], @@ -435,7 +435,7 @@ dnl AS_IF([ test "x$withval" = xno ], [], AS_IF([ test "x$withval" = x -o "x$withval" = xyes ], [AC_MSG_ERROR([--with-ipfw requires an argument specifying a path to ipfw])], - [ IPFW_EXE=$withval ] + [ FORCE_IPFW_EXE=$withval ] ) ) ], @@ -453,7 +453,7 @@ dnl AS_IF([ test "x$withval" = xno ], [], AS_IF([ test "x$withval" = x -o "x$withval" = xyes ], [AC_MSG_ERROR([--with-pf requires an argument specifying a path to pf])], - [ PF_EXE=$withval ] + [ FORCE_PF_EXE=$withval ] ) ) ], @@ -471,7 +471,7 @@ dnl AS_IF([ test "x$withval" = xno ], [], AS_IF([ test "x$withval" = x -o "x$withval" = xyes ], [AC_MSG_ERROR([--with-ipf requires an argument specifying a path to ipf])], - [ IPF_EXE=$withval ] + [ FORCE_IPF_EXE=$withval ] ) ) ], @@ -480,6 +480,31 @@ dnl ] ) +dnl If a firewall was forced. set the appropriate _EXE var and clear the others. +dnl + AS_IF([test "x$FORCE_IPTABLES_EXE" != x], [ + IPTABLES_EXE="$FORCE_IPTABLES_EXE" + ],[ + AS_IF([test "x$FORCE_IPFW_EXE" != x], [ + IPFW_EXE="$FORCE_IPFW_EXE" + IPTABLES_EXE="" + ],[ + AS_IF([test "x$FORCE_PF_EXE" != x], [ + PF_EXE="$FORCE_PF_EXE" + IPFW_EXE="" + IPTABLES_EXE="" + ],[ + AS_IF([test "x$FORCE_IPF_EXE" != x], [ + IPF_EXE="$FORCE_IPF_EXE" + PF_EXE="" + IPFW_EXE="" + IPTABLES_EXE="" + ] + ] + ] + ] + )))) + dnl Determine which firewall exe we use (if we have one). dnl If iptables was found or specified, it wins, then we fallback to ipfw, dnl then pf, and otherwise we try ipf. From 839cc416039ca10d42f36071587d4b1ad3bd1fbe Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Fri, 1 Mar 2013 22:11:22 -0500 Subject: [PATCH 4/4] remove unused vars for pf/ipfw/ipf firewalls until NAT is supported for them --- server/fw_util_ipf.c | 9 --------- server/fw_util_ipfw.c | 9 --------- server/fw_util_pf.c | 9 --------- 3 files changed, 27 deletions(-) diff --git a/server/fw_util_ipf.c b/server/fw_util_ipf.c index 37937aad..307d30ca 100644 --- a/server/fw_util_ipf.c +++ b/server/fw_util_ipf.c @@ -121,9 +121,6 @@ process_spa_request(const fko_srv_options_t *opts, const acc_stanza_t *acc, spa_ acc_port_list_t *port_list = NULL; acc_port_list_t *ple; - unsigned int fst_proto; - unsigned int fst_port; - int res = 0; time_t now; unsigned int exp_ts; @@ -136,12 +133,6 @@ process_spa_request(const fko_srv_options_t *opts, const acc_stanza_t *acc, spa_ */ ple = port_list; - /* Remember the first proto/port combo in case we need them - * for NAT access requests. - */ - fst_proto = ple->proto; - fst_port = ple->port; - /* Set our expire time value. */ time(&now); diff --git a/server/fw_util_ipfw.c b/server/fw_util_ipfw.c index a9c84c11..12fd0781 100644 --- a/server/fw_util_ipfw.c +++ b/server/fw_util_ipfw.c @@ -478,9 +478,6 @@ process_spa_request(const fko_srv_options_t * const opts, acc_port_list_t *port_list = NULL; acc_port_list_t *ple; - unsigned int fst_proto; - unsigned int fst_port; - int res = 0; time_t now; unsigned int exp_ts; @@ -493,12 +490,6 @@ process_spa_request(const fko_srv_options_t * const opts, */ ple = port_list; - /* Remember the first proto/port combo in case we need them - * for NAT access requests. - */ - fst_proto = ple->proto; - fst_port = ple->port; - /* Set our expire time value. */ time(&now); diff --git a/server/fw_util_pf.c b/server/fw_util_pf.c index 864375ac..a010e0c0 100644 --- a/server/fw_util_pf.c +++ b/server/fw_util_pf.c @@ -202,9 +202,6 @@ process_spa_request(const fko_srv_options_t * const opts, acc_port_list_t *port_list = NULL; acc_port_list_t *ple; - unsigned int fst_proto; - unsigned int fst_port; - int res = 0; time_t now; unsigned int exp_ts; @@ -217,12 +214,6 @@ process_spa_request(const fko_srv_options_t * const opts, */ ple = port_list; - /* Remember the first proto/port combo in case we need them - * for NAT access requests. - */ - fst_proto = ple->proto; - fst_port = ple->port; - /* Set our expire time value. */ time(&now);