diff --git a/ChangeLog.git b/ChangeLog.git index 849cec84..55f29bb8 100644 --- a/ChangeLog.git +++ b/ChangeLog.git @@ -1,1716 +1,1306 @@ -commit 5befed6bae9228ab649e41217df21b5b32740fe0 (HEAD, refs/heads/master) +commit d2880021ca6a42d7d0e040e6f0de840b55fb51a1 (HEAD, refs/heads/master) Author: Michael Rash -Date: Mon Jul 28 22:40:13 2014 -0400 +Date: Sat Nov 15 10:45:59 2014 -0500 - removed gdbm/gdbm-devel dependencies for the RPM, bumped libfko to 2.0.3 for the RPM + [server] document --udp-server option - fwknop.spec | 17 +++++++++++------ - 1 file changed, 11 insertions(+), 6 deletions(-) + doc/fwknopd.man.asciidoc | 7 ++++++- + server/cmd_opts.h | 2 +- + server/config_init.c | 13 ++++++++----- + 3 files changed, 15 insertions(+), 7 deletions(-) -commit 96e16cf6f4b690fda1cb90b1bba6aba95bc8919d +commit 85f559a9fdad7af9df4c242c7bbf074b4f3b346c Author: Michael Rash -Date: Mon Jul 28 22:28:46 2014 -0400 +Date: Sat Nov 15 10:27:19 2014 -0500 - extended ChangeLog.git to include libfko version bump + 2.6.4 release date - ChangeLog.git | 20 +++++++++++++++++++- - 1 file changed, 19 insertions(+), 1 deletion(-) + ChangeLog | 2 +- + fwknop.spec | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) -commit 71b97b6cad00223b2061309c2e87e2ede5a2da2f +commit 5df437660212f7a7c99bae142421e34a557e3836 Author: Michael Rash -Date: Mon Jul 28 21:46:32 2014 -0400 +Date: Sat Nov 15 00:36:33 2014 -0500 - bumped libfko version to 2.0.3 + add new test suite files to Makefile.am - lib/Makefile.am | 2 +- + Makefile.am | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +commit 49b09c490358cea202000bd5b098b272ba491152 +Author: Michael Rash +Date: Sat Nov 15 00:22:14 2014 -0500 + + [test suite] update to use helper scripts for code coverage report generation + + test/afl/afl-compile-code-coverage.sh | 9 ++++++ + test/afl/afl-compile.sh | 2 +- + test/afl/afl-gen-code-coverage.sh | 13 ++++++++ + test/gen-coverage-report.sh | 29 +++++++++++++++++ + test/rm-coverage-files.sh | 12 +++++++ + test/test-fwknop.pl | 61 +++++++++++++++-------------------- + 6 files changed, 90 insertions(+), 36 deletions(-) + +commit b9d5919cdd1bca0371fa06ac6e3fa0fc7cfbee25 +Author: Michael Rash +Date: Sat Nov 15 00:16:38 2014 -0500 + + [test suite] AFL README update + + test/afl/README | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +commit 2e1d0761603515d32b8867def285e283790b43ce +Author: Michael Rash +Date: Sat Nov 15 00:16:17 2014 -0500 + + [server] minor status wording update + + server/fwknopd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -commit 67ca2f69ea8c59495e9b6a341d258eb2851e5828 +commit 665b65ef3efdb1d47ff71a4495195e8da03a1001 Author: Michael Rash -Date: Sun Jul 27 23:20:55 2014 -0400 +Date: Sat Nov 15 00:15:55 2014 -0500 - changes since 2.6.2 to ChangeLog.git + doc updates to include material about AFL support - ChangeLog.git | 1676 +++++++++++++++++++++++++++++++++++++++++++++++++++++++-- - 1 file changed, 1627 insertions(+), 49 deletions(-) + ChangeLog | 7 +++++++ + doc/fwknop.man.asciidoc | 5 +++-- + doc/fwknopd.man.asciidoc | 19 ++++++++++++++----- + 3 files changed, 24 insertions(+), 7 deletions(-) -commit 03000dde5dda307ea421d19181cf7638240d8fbc +commit aaa44656bcfcb705d80768a7b9aa0d45a0e55e21 (refs/remotes/origin/master, refs/remotes/origin/HEAD) Author: Michael Rash -Date: Sun Jul 27 23:03:11 2014 -0400 +Date: Thu Nov 13 20:55:04 2014 -0500 - bumped version to 2.6.3 in preparation for release + [server] add support for American Fuzzy Lop (ALF) fuzzing - ChangeLog | 2 +- - VERSION | 2 +- - configure.ac | 2 +- - fwknop.spec | 5 ++++- - 4 files changed, 7 insertions(+), 4 deletions(-) + Makefile.am | 1 + + configure.ac | 15 +++++++ + lib/base64.c | 17 +++++++- + lib/fko_decode.c | 10 +++++ + server/cmd_opts.h | 3 +- + server/config_init.c | 8 ++++ + server/fwknopd.c | 81 +++++++++++++++++++++++++++++++++++++- + server/fwknopd_common.h | 1 + + test/afl/README | 50 +++++++++++++++++++++++ + test/afl/afl-compile.sh | 8 ++++ + test/afl/afl-fuzzing.in/spa.start | 1 + + test/afl/afl-fuzzing.in/spa2.start | 1 + + test/afl/afl-fuzzing.in/spa3.start | 1 + + test/afl/afl-run.sh | 16 ++++++++ + test/afl/fwknopd-stdin-test.sh | 6 +++ + test/test-fwknop.pl | 3 ++ + test/tests/afl_fuzzing.pl | 13 ++++++ + 17 files changed, 231 insertions(+), 4 deletions(-) -commit fa154259d5c425ad5f6e436a7353918225c797d9 +commit fe288120b32e945b33b10b7b26675aa84744b3ae (refs/heads/execvpe) Author: Michael Rash -Date: Sun Jul 27 22:56:15 2014 -0400 +Date: Sun Nov 9 21:41:10 2014 -0500 - [test suite] added FreeBSD-10.0 and OpenBSD-5.5 compatibility tests + minor ChangeLog wording update - test/tests/os_compatibility.pl | 52 ++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 52 insertions(+) + ChangeLog | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) -commit 24ccf03a90b5338cc82d6fae2bef6f78145dcf06 +commit 1a76d5586fc37e36d555ac5181b2e4f886036eed Author: Michael Rash -Date: Sun Jul 27 22:40:04 2014 -0400 +Date: Sun Nov 9 21:36:36 2014 -0500 - added configure_max_coverage.sh helper script + [test suite] extend server receive criteria + + test/test-fwknop.pl | 22 ++++++++++++++++++---- + test/tests/rijndael.pl | 10 ++++++++-- + test/tests/rijndael_hmac.pl | 1 + + 3 files changed, 27 insertions(+), 6 deletions(-) + +commit ba337108af9524d533ebd17c37b180a0e4daf8ed +Author: Michael Rash +Date: Sat Nov 8 21:44:49 2014 -0500 + + [test suite] implement multi-cycle test sequences + + test/test-fwknop.pl | 281 +++++++++++++++++++++++++++++-------------- + test/tests/configure_args.pl | 28 +++++ + test/tests/rijndael.pl | 11 ++ + test/tests/rijndael_hmac.pl | 42 +++++++ + 4 files changed, 269 insertions(+), 93 deletions(-) + +commit 7022d79ca796219c0d4fa62984d4b967056618bd +Author: Michael Rash +Date: Thu Nov 6 20:24:50 2014 -0500 + + [server] minor code cleanup + + server/fw_util_pf.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +commit a8879231c30c144293eed8bcfa80030734873f02 +Author: Michael Rash +Date: Thu Nov 6 20:24:33 2014 -0500 + + [server] add run_extcmd_write() call in code coverage mode + + server/extcmd.c | 9 +++++++-- + server/fw_util_iptables.c | 11 +++++++++++ + 2 files changed, 18 insertions(+), 2 deletions(-) + +commit 0c59f6e50017db2ccd2d3103b35e6dfc1179242f +Author: Michael Rash +Date: Thu Nov 6 20:23:40 2014 -0500 + + add CODE_COVERAGE macro for ./configure --enable-profile-coverage + + configure.ac | 1 + + server/tcp_server.c | 10 +++++----- + 2 files changed, 6 insertions(+), 5 deletions(-) + +commit 46fd32a6f12264be58af09be0e4b3739e6361ca4 +Author: Michael Rash +Date: Thu Nov 6 20:22:05 2014 -0500 + + [test suite] minor bug fix to add --no-firewd-check-support option for one test + + test/tests/rijndael_hmac.pl | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +commit 4ca718f8da49face1131f4869ebea13e01ca28cc +Author: Michael Rash +Date: Thu Nov 6 20:21:05 2014 -0500 + + [test suite] allow valgrind/crash search/profile coverage tests to run after --test-limit + + test/test-fwknop.pl | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +commit 04f8b9669a6dca2c828a275c9c991beccd910092 (refs/remotes/origin/execvpe) +Author: Michael Rash +Date: Wed Nov 5 23:19:51 2014 -0500 + + [server] check number of cmd args even when execvpe() is not available + + server/extcmd.c | 56 ++++++++++++++++++++++++++++++++++++++------------------ + 1 file changed, 38 insertions(+), 18 deletions(-) + +commit e7942f48e0d95c98426990b11f6870af0b5e0e4a +Author: Michael Rash +Date: Tue Nov 4 22:44:59 2014 -0500 + + [server] allow loop restart after select() sets EINTR (since we handle signals) - fixes cmd execution through UDP on FreeBSD + + server/udp_server.c | 31 ++++++++++++++++++++++++------- + 1 file changed, 24 insertions(+), 7 deletions(-) + +commit c5f038928143421906d2f54587ecefe94dfde8ff +Author: Michael Rash +Date: Tue Nov 4 22:43:04 2014 -0500 + + [server] minor code restructure, use FD_ISSET() test on file descriptors + + server/tcp_server.c | 28 ++++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +commit 705c50741497e933521af2a9303751dab3e1b555 +Author: Michael Rash +Date: Mon Nov 3 19:57:50 2014 -0500 + + [test suite] check for TCP/UDP server string in do_fwknopd_cmd() + + test/test-fwknop.pl | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +commit fdc6e0db20cc940a09c02def3aebd5c2af0dcd54 +Author: Michael Rash +Date: Sun Nov 2 15:30:56 2014 -0500 + + [test suite] bug fix to specify LD_LIBRARY_PATH for configure --enable-udp-server recompile test + + test/test-fwknop.pl | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +commit 7a98eed75921b57bd1d9271d49bc18a22319acfe +Author: Michael Rash +Date: Sat Nov 1 20:44:35 2014 -0400 + + [test suite] add spa_fuzzing.py and a few minor helper files for FreeBSD/OpenBSD + + Makefile.am | 4 ++++ + test/misc/freebsd_rc.conf | 12 ++++++++++++ + test/misc/pf.rules | 6 ++++++ + test/misc/pf.sh | 3 +++ + 4 files changed, 25 insertions(+) + +commit 3826bb5631743ab8cbea0fbd06bc90b4ea01d4b4 +Author: Michael Rash +Date: Sat Nov 1 12:04:11 2014 -0400 + + ChangeLog updates, bump version to 2.6.4 + + ChangeLog | 28 +++++++++++++++++++++------- + VERSION | 2 +- + configure.ac | 2 +- + fwknop.spec | 5 ++++- + win32/config.h | 2 +- + 5 files changed, 28 insertions(+), 11 deletions(-) + +commit 50009115b3dba3f35bd93757c26d6239757b3a1d +Author: Michael Rash +Date: Sat Nov 1 12:03:49 2014 -0400 + + [server] bug fix to close write filehandle in _run_extcmd_write() + + server/extcmd.c | 1 + + 1 file changed, 1 insertion(+) + +commit 4880243902f22ce436053040922b4079f86dc77e +Author: Michael Rash +Date: Tue Oct 28 21:56:19 2014 -0400 + + [test suite] added invalid_firewd_input_chain_* files + + test/conf/invalid_firewd_input_chain_2_fwknopd.conf | 1 + + test/conf/invalid_firewd_input_chain_3_fwknopd.conf | 1 + + test/conf/invalid_firewd_input_chain_4_fwknopd.conf | 1 + + test/conf/invalid_firewd_input_chain_5_fwknopd.conf | 1 + + test/conf/invalid_firewd_input_chain_6_fwknopd.conf | 1 + + test/conf/invalid_firewd_input_chain_fwknopd.conf | 1 + + 6 files changed, 6 insertions(+) + +commit 387c1acdf777bff5397b36d2e368fad99bc04af6 +Author: Michael Rash +Date: Tue Oct 28 21:29:34 2014 -0400 + + add fcs_spa.pcap to Makefile.am Makefile.am | 1 + 1 file changed, 1 insertion(+) -commit 655abf6f0bbf865addb07df6020b072203e30bb3 +commit 34e38fe39eb930ae9a69d0a46b7312d95a4ec95e Author: Michael Rash -Date: Sun Jul 27 22:31:49 2014 -0400 +Date: Tue Oct 28 21:28:21 2014 -0400 - [test suite] WGET_CMD and RESOLVE_HTTP_ONLY fwknoprc test coverage + [server] first pass at eliminating popen() write calls with run_extcmd_write() (used for PF firewalls) - Makefile.am | 1 + - test/conf/fwknoprc_hmac_http_only_resolve | 22 ++++++++++++++++++++++ - test/conf/fwknoprc_hmac_https_resolve | 1 + - test/test-fwknop.pl | 4 ++++ - test/tests/rijndael_hmac.pl | 12 ++++++++++++ - 5 files changed, 40 insertions(+) + server/extcmd.c | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++-- + server/extcmd.h | 4 ++- + server/fw_util_pf.c | 34 ++++++------------ + server/fw_util_pf.h | 4 +-- + 4 files changed, 113 insertions(+), 29 deletions(-) -commit 7f830e02391d6505063372c9eb2abd42b0802d1f +commit b5fe62bfc74288b885188f7b5012cff0aa71c4c1 Author: Michael Rash -Date: Sun Jul 27 22:10:01 2014 -0400 +Date: Sun Oct 26 16:58:13 2014 -0400 - revert gpg trustdb.gpg update from test suite + [test suite] command exec too many args tests - test/conf/client-gpg-no-pw/trustdb.gpg | Bin 1360 -> 1360 bytes - 1 file changed, 0 insertions(+), 0 deletions(-) + common/common.h | 2 +- + test/tests/rijndael_hmac_cmd_exec.pl | 28 ++++++++++++++++++++++++++++ + 2 files changed, 29 insertions(+), 1 deletion(-) -commit b06447384e8d5f5c68efaf959c0d390daf984d94 +commit d2abbd87202719734b5258d58c2635e5883a94fa Author: Michael Rash -Date: Sun Jul 27 22:03:58 2014 -0400 +Date: Sat Oct 25 22:29:49 2014 -0400 - [client] have autoconf resolve the absolute path to wget for SSL IP resolution + [test suite] more code coverage tests - client/cmd_opts.h | 3 +- - client/config_init.c | 48 ++++++++++++++++++++++++++++-- - client/fwknop.8.in | 52 +++++++++++++++++++++++++++++++-- - client/fwknop.c | 2 ++ - client/fwknop_common.h | 3 +- - client/http_resolve_host.c | 31 +++++++++++++++----- - configure.ac | 22 ++++++++++++++ - doc/fwknop.man.asciidoc | 23 ++++++++++++++- - test/conf/client-gpg-no-pw/trustdb.gpg | Bin 1360 -> 1360 bytes - test/tests/basic_operations.pl | 39 +++++++++++++++++++++++++ - 10 files changed, 207 insertions(+), 16 deletions(-) + server/config_init.c | 2 +- + test/tests/basic_operations.pl | 40 ++++++++++++++++++++++++++++++++++++++++ + test/tests/rijndael_hmac.pl | 3 ++- + 3 files changed, 43 insertions(+), 2 deletions(-) -commit 4fcd5b317a649645316e63eedf7f7dbf8ff0c565 +commit 17608dd01df6eee5446c0b0cfbde69a132d0d7a2 Author: Michael Rash -Date: Sat Jul 26 23:43:48 2014 -0400 +Date: Sat Oct 25 08:42:30 2014 -0400 - [server] fix shift operation bug in SOURCE subnet processing spotted by Coverity + [test suite] additional code coverage - server/access.c | 4 +++- - test/tests/basic_operations.pl | 32 ++++++++++++++++++++++++++++++++ - 2 files changed, 35 insertions(+), 1 deletion(-) + server/fwknopd.c | 16 ++++++++-------- + server/utils.c | 11 +++-------- + test/tests/basic_operations.pl | 26 ++++++++++++++++++++++++++ + 3 files changed, 37 insertions(+), 16 deletions(-) -commit 134f4c6cfb936d2a5d7932128ba7d0f51980057c -Merge: 2f9b920 59718f1 +commit 837f7780fe23d0486c4bfe32c1eacaf9a73fa43a Author: Michael Rash -Date: Fri Jul 25 17:44:27 2014 -0400 +Date: Sat Oct 25 08:42:14 2014 -0400 - Merge branch 'libfiu_fault_injection' - - Conflicts: - test/tests/rijndael_hmac_fuzzing.pl + [libfko] validate MAX_PORT integer value for SPA messages -commit 59718f1a3668683acf9c64b3e86ad66fadebdc84 (refs/heads/libfiu_fault_injection) + common/common.h | 1 - + lib/fko_limits.h | 5 +++-- + lib/fko_message.c | 13 +++++++++++-- + 3 files changed, 14 insertions(+), 5 deletions(-) + +commit 58d47cb3853c563677de00aca816a4a019ca81ea Author: Michael Rash -Date: Fri Jul 25 17:42:06 2014 -0400 +Date: Fri Oct 24 20:39:40 2014 -0400 - [client] Updated IP resolution mode -R to use SSL - - External IP resolution via '-R' (or '--resolve-ip-http') is now done via SSL by - default. The IP resolution URL is now 'https://www.cipherdyne.org/cgi-gin/myip', - and a warning is generated in '-R' mode whenever a non-HTTPS URL is specified - (it is safer just to use the default). The fwknop client leverages 'wget' for - this operation since that is cleaner than having fwknop link against an SSL - library. - - ChangeLog | 6 ++ - Makefile.am | 1 + - client/cmd_opts.h | 3 + - client/config_init.c | 57 ++++++++++++----- - client/fwknop.8.in | 50 ++++++++++----- - client/fwknop.c | 21 +++++-- - client/fwknop_common.h | 15 +++-- - client/http_resolve_host.c | 112 +++++++++++++++++++++++++++++++--- - doc/fwknop.man.asciidoc | 49 +++++++++------ - test/conf/fwknoprc_hmac_https_resolve | 20 ++++++ - test/test-fwknop.pl | 6 +- - test/tests/basic_operations.pl | 32 ++++++++-- - test/tests/rijndael.pl | 31 +++++++++- - test/tests/rijndael_hmac.pl | 45 +++++++++++++- - 14 files changed, 368 insertions(+), 80 deletions(-) - -commit e1608b90fec440bf1b13b76b474a153d6091c2fe -Author: Michael Rash -Date: Tue Jul 22 22:35:43 2014 -0400 - - [client] call freeaddrinfo() early after iterating through getaddrinfo() results - - client/http_resolve_host.c | 20 ++++++++++++-------- - client/spa_comm.c | 19 +++++++++++-------- - 2 files changed, 23 insertions(+), 16 deletions(-) - -commit 5fadf56af42a6b320a5752cfb048df4697fb190e -Author: Michael Rash -Date: Tue Jul 22 22:05:29 2014 -0400 - - added extras/coverity/ directory for Coverity script - - extras/coverity/coverity_scan.sh | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -commit 666d150affdedc7604a729941422a42dbf9b73db -Author: Michael Rash -Date: Tue Jul 22 22:04:44 2014 -0400 - - [client] make close() on socket handle more intuitive (resolves 'double close' bugs flagged by Coverity) - - client/http_resolve_host.c | 15 ++++++++------- - client/spa_comm.c | 13 +++++-------- - 2 files changed, 13 insertions(+), 15 deletions(-) - -commit 73490209f7d4a6d6c990da119cab2138387928b0 -Author: Michael Rash -Date: Tue Jul 22 18:56:12 2014 -0400 - - [test suite] add access.conf file path to a few basic tests - - test/tests/basic_operations.pl | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -commit 3df08e3c0ebe48b06b6066ebfd549841f54a72f3 -Author: Michael Rash -Date: Tue Jul 22 18:48:54 2014 -0400 - - [test suite] handle PF on FreeBSD - - test/test-fwknop.pl | 21 +++++++++++++++++++++ - 1 file changed, 21 insertions(+) - -commit eed3418996cc5de92b92bca20d980f3d700846a6 -Author: Michael Rash -Date: Tue Jul 22 18:40:29 2014 -0400 - - [test suite] update wrapper Makefile gcc -> cc - - test/fko-wrapper/Makefile | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -commit 9470b3ce21b409c1258ed64561499b2a389bcd8b -Author: Michael Rash -Date: Mon Jul 21 23:59:44 2014 -0400 - - [test suite] README update to include --enable-complete mode - - test/README | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -commit 7df1186c66796f0d3b41ebfa95c3a2303e0ceaf1 -Author: Michael Rash -Date: Mon Jul 21 23:55:08 2014 -0400 - - fixed several socket handle leaks under error conditions spotted by Coverity - - client/http_resolve_host.c | 6 ++++-- - client/spa_comm.c | 5 +++++ - server/tcp_server.c | 14 +++++++++++++- - 3 files changed, 22 insertions(+), 3 deletions(-) - -commit 7d5b75886c94f1647276eebeb139ac36e299668b -Author: Michael Rash -Date: Sat Jul 19 17:26:15 2014 -0400 - - added lcov coverage link - - ChangeLog | 4 ++++ - 1 file changed, 4 insertions(+) - -commit b2117e6fe7a3832ab9e4e7164a5b5f66397a8ef1 -Author: Michael Rash -Date: Sat Jul 19 17:18:59 2014 -0400 - - ChangeLog updates - - ChangeLog | 47 +++++++++++++++++++++++++++++++++++------------ - 1 file changed, 35 insertions(+), 12 deletions(-) - -commit 641866deffcd767b4f4a4cb439575e5e4479a49d -Author: Michael Rash -Date: Sat Jul 19 16:40:59 2014 -0400 - - [server] minor update print -> fprintf for PF firewall interface - - server/fw_util_pf.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -commit 764d9ca26da2b6359534b3faea537e288922ce5b -Author: Michael Rash -Date: Sat Jul 19 16:30:53 2014 -0400 - - fix gcc -Wstrlcpy-strlcat-size warnings - - client/config_init.c | 7 ++++--- - client/fwknop.c | 7 ++++--- - server/access.c | 2 +- - 3 files changed, 9 insertions(+), 7 deletions(-) - -commit ec54b4fd11c707fb11efd61a09c2e7a240286065 -Author: Michael Rash -Date: Sat Jul 19 16:30:00 2014 -0400 - - fixed README paths - - Makefile.am | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit 2012d2d7d1a15863323b9849a3c6a528dd13b810 -Author: Michael Rash -Date: Sat Jul 19 16:22:42 2014 -0400 - - fixed README paths - - README | 1 + - 1 file changed, 1 insertion(+) - -commit 74428adae63f93c8e5679ce8ba0793e8e786f2ec -Author: Michael Rash -Date: Fri Jul 18 20:54:11 2014 -0400 - - [server] Bug fix for PF firewalls without ALTQ support on FreeBSD. - - With this commit PF rules are added correctly regardless of whether ALTQ support - is available or not. Thanks to Barry Allard for discovering and reporting this - issue. Closes issue #121 on github. - - CREDITS | 4 ++++ - ChangeLog | 4 ++++ - server/fw_util_pf.h | 2 +- - 3 files changed, 9 insertions(+), 1 deletion(-) - -commit 51506db24c0683e45b7a7ad80c25d8b905c022ad -Author: Michael Rash -Date: Fri Jul 11 22:41:32 2014 -0500 - - minor README.md summary update - - README.md | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -commit 6fe1107bbf1d85072f71c934cd540b8367ebc932 -Author: Michael Rash -Date: Fri Jul 11 22:29:13 2014 -0500 - - minor README.md formating updates - - Makefile.am | 2 +- - README.md | 76 +++++++++++++++++++++++++++++++++++++++++-------------------- - 2 files changed, 52 insertions(+), 26 deletions(-) - -commit f7004cec62f1814493060a351e7b78af0e76deeb (refs/remotes/origin/libfiu_fault_injection) -Merge: 3bd1d07 3d504cf -Author: Michael Rash -Date: Fri Jul 11 09:43:50 2014 -0500 - - Merge pull request #122 from steakknife/convert_readme - - readme -> md - -commit 3d504cfc17f82dc3e081106774cc4be355d81b18 -Author: Barry Allard -Date: Tue Jul 8 19:09:29 2014 -0700 - - readme -> md - - Signed-off-by: Barry Allard - - README | 150 -------------------------------------------------------------- - README.md | 123 +++++++++++++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 123 insertions(+), 150 deletions(-) - -commit 3bd1d0742e8f68d6a5f6b9e479a391ba605a2385 -Author: Michael Rash -Date: Mon Jul 7 22:55:34 2014 -0500 - - [test suite] add --gpg-home-dir arg to GPG test - - test/tests/gpg_no_pw.pl | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit 7e1346c49ad2dfd8118deae3c9dbb09a300a0bbb -Author: Michael Rash -Date: Mon Jul 7 22:50:24 2014 -0500 - - [test suite] add variable expansion and fwknopd override tests - - Makefile.am | 3 +++ - test/conf/override2_fwknopd.conf | 2 ++ - test/conf/override_fwknopd.conf | 1 + - test/conf/var_expansion_fwknopd.conf | 2 ++ - test/conf/var_expansion_invalid_fwknopd.conf | 2 ++ - test/tests/basic_operations.pl | 30 ++++++++++++++++++++++++++++ - 6 files changed, 40 insertions(+) - -commit 824ebe94f8b8c5c86034cad212309adbfeb35d4b -Author: Michael Rash -Date: Mon Jul 7 22:41:17 2014 -0500 - - [test suite] run interrupt signal test against foreground fwknopd process - - test/test-fwknop.pl | 35 +++++++++++++++++++++++++++++------ - 1 file changed, 29 insertions(+), 6 deletions(-) - -commit 1dccab0fc84f15ca5dd105538e033f883a0d91f7 -Author: Michael Rash -Date: Mon Jul 7 22:37:08 2014 -0500 - - [server] handle signal vars in dedicated function - - server/fwknopd.c | 99 ++++++++++++++++++++++++++++++-------------------------- - 1 file changed, 53 insertions(+), 46 deletions(-) - -commit 3c0694841488381013de7e2f5947fb74aec1b41b -Author: Michael Rash -Date: Mon Jul 7 22:30:49 2014 -0500 - - [server] alert the user when config file variable expansion references invalid var - - server/config_init.c | 18 +++++++++--------- - 1 file changed, 9 insertions(+), 9 deletions(-) - -commit 0e5c4644fca4e8d9d9c39eb07a1a95fcc0b67c32 -Author: Michael Rash -Date: Mon Jul 7 22:16:47 2014 -0500 - - [test suite] add GPG test for a manually altered SPA packet - - test/tests/gpg_no_pw.pl | 31 +++++++++++++++++++++++++++++++ - 1 file changed, 31 insertions(+) - -commit 1b47173906ff76d9a520eb2b756fa9e89e4b4b27 -Author: Michael Rash -Date: Mon Jul 7 21:35:27 2014 -0500 - - [test suite] add SYSLOG_FACILITY tests - - server/log_msg.c | 18 ++--- - test/tests/basic_operations.pl | 164 +++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 172 insertions(+), 10 deletions(-) - -commit 5c54ef00ad271b71383d95c3ecb6d8a5d74dffdf -Author: Michael Rash -Date: Mon Jul 7 21:34:45 2014 -0500 - - [server] refactor main() into a more natural breakdown of functions - - server/fwknopd.c | 413 ++++++++++++++++++++++++++++++------------------------- - 1 file changed, 228 insertions(+), 185 deletions(-) - -commit 9f2e01eb0114ee0cb0bc101dda036779c456915d -Author: Michael Rash -Date: Mon Jul 7 21:27:53 2014 -0500 - - [server] Fix uninitialized value usage after proper SPA authentication/decryption - - Bug fix discovered with the libfiu fault injection tag - "fko_get_username_init" combined with valgrind analysis. This bug - is only triggered after a valid authenticated and decrypted SPA - packet is sniffed by fwknopd: - - ==11181== Conditional jump or move depends on uninitialised value(s) - ==11181== at 0x113B6D: incoming_spa (incoming_spa.c:707) - ==11181== by 0x11559F: process_packet (process_packet.c:211) - ==11181== by 0x5270857: ??? (in /usr/lib/x86_64-linux-gnu/libpcap.so.1.4.0) - ==11181== by 0x114BCC: pcap_capture (pcap_capture.c:270) - ==11181== by 0x10F32C: main (fwknopd.c:195) - ==11181== Uninitialised value was created by a stack allocation - ==11181== at 0x113476: incoming_spa (incoming_spa.c:294) - - ChangeLog | 13 +++++++++++++ - server/incoming_spa.c | 18 +++++++++--------- - 2 files changed, 22 insertions(+), 9 deletions(-) - -commit 5474ced90b2f272e4a1e97ddd863765839eafae6 -Author: Michael Rash -Date: Sat Jul 5 23:10:26 2014 -0500 - - [test suite] extend invalid sniff interface test to include promisc mode - - test/tests/basic_operations.pl | 13 +++++++++++-- - 1 file changed, 11 insertions(+), 2 deletions(-) - -commit 77eb1a763fb7a41a02b2a7ab3ee9844a76d54724 -Author: Michael Rash -Date: Sat Jul 5 22:44:40 2014 -0500 - - [test suite] add invalid sniff interface test - - test/tests/basic_operations.pl | 9 +++++++++ - 1 file changed, 9 insertions(+) - -commit f0285ae2b54940156a35ef0cd276cbd0a8c0954c -Author: Michael Rash -Date: Fri Jul 4 20:05:54 2014 -0400 - - [test suite] add invalid gpg sig ID list - - Makefile.am | 1 + - test/conf/gpg_invalid_sig_id_access.conf | 7 +++++++ - test/test-fwknop.pl | 1 + - test/tests/gpg_no_pw.pl | 11 +++++++++++ - 4 files changed, 20 insertions(+) - -commit ffa77a9e54653fdd3a411f672b586c0fd6a8b685 -Author: Michael Rash -Date: Fri Jul 4 19:54:56 2014 -0400 - - [test suite] add GPG_DISABLE_SIG test + [test suite] additional code coverage for a few areas Makefile.am | 1 + - test/conf/gpg_no_sig_verify_access.conf | 8 ++++++++ + server/access.c | 13 ++----------- + test/conf/gpg_no_sig_no_fpr_access.conf | 8 ++++++++ test/test-fwknop.pl | 1 + - test/tests/gpg_no_pw.pl | 13 +++++++++++++ - 4 files changed, 23 insertions(+) + test/tests/basic_operations.pl | 29 ++++++++++++++++++++++++++++- + 5 files changed, 40 insertions(+), 12 deletions(-) -commit a2ff2a396c99fb3f2ab41e2325a3e5bdf7971328 +commit 7b70ed08d261dc9db9e026b215a72da2cbd58089 Author: Michael Rash -Date: Thu Jul 3 10:31:30 2014 -0400 +Date: Thu Oct 23 23:05:21 2014 -0400 - [server] call clean_exit() upon check_dir_path() error + [server] ensure to break out of while loop and close() UDP socket before returning - Makefile.am | 1 + - server/fwknopd.c | 18 ++++++++++-------- - test/conf/invalid_run_dir_path_fwknopd.conf | 2 ++ - test/test-fwknop.pl | 1 + - test/tests/basic_operations.pl | 10 ++++++++++ - 5 files changed, 24 insertions(+), 8 deletions(-) + server/udp_server.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) -commit 5ced103207865877eceaee2f29d36a0f8f3f7e47 +commit 30402516950446eb0ebd14723bb00c9611d8a5c1 Author: Michael Rash -Date: Thu Jul 3 10:17:52 2014 -0400 +Date: Thu Oct 23 20:03:34 2014 -0400 - [test suite] minor test coverage addition for invalid locale setting + [test suite] default to recompiling fwknop in code coverage profiling mode - test/tests/basic_operations.pl | 11 +++++++++++ - 1 file changed, 11 insertions(+) + test/test-fwknop.pl | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) -commit fed2da3bb00a6a98a4d5a8d0753218f49417d846 +commit cbb3b0d4137316455a03336340c4168a7dcf3f76 Author: Michael Rash -Date: Thu Jul 3 08:52:48 2014 -0400 +Date: Thu Oct 23 19:55:30 2014 -0400 - [test suite] additional valgrind suppression for pcap-file processing + [test suite] add branch coverage stats in code coverage mode - test/valgrind_suppressions | 9 +++++++++ - 1 file changed, 9 insertions(+) + test/test-fwknop.pl | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) -commit 43b770320ad5b38e9d1c97ebc1200a28ecdbe1b0 +commit a2ce50e9e5999e890da7ce6ed57806e271f770dd Author: Michael Rash -Date: Sun Jun 29 18:46:19 2014 -0400 +Date: Thu Oct 23 08:45:21 2014 -0400 - [server] Require sig ID's or fingerprints when sigs are validated - - When validating access.conf stanzas make sure that one of - GPG_REMOTE_ID or GPG_FINGERPRINT_ID is specified whenever GnuPG - signatures are to be verified for incoming SPA packets. Signature - verification is the default, and can only be disabled with - GPG_DISABLE_SIG but this is NOT recommended. + [python module] default to HMAC SHA256 when an HMAC key is used but no HMAC mode was specified - ChangeLog | 6 ++++++ - Makefile.am | 1 + - server/access.c | 14 ++++++++++++++ - test/conf/gpg_no_pw_no_fpr_access.conf | 5 +++++ - test/test-fwknop.pl | 1 + - test/tests/basic_operations.pl | 10 ++++++++++ - 6 files changed, 37 insertions(+) + ChangeLog | 19 +++++++++++-------- + python/fko.py | 23 ++++++++++++++--------- + python/fkomodule.c | 9 ++++----- + test/fko-python.py | 4 ++++ + 4 files changed, 33 insertions(+), 22 deletions(-) -commit 77384a904e44e92db7c5240d1a31449543692b7c +commit d7be3f43ac27d52da6af59ca758c2deb1805bee0 Author: Michael Rash -Date: Sun Jun 29 17:07:55 2014 -0400 +Date: Thu Oct 23 08:40:21 2014 -0400 - [server] add access.conf variable GPG_FINGERPRINT_ID - - Add a new GPG_FINGERPRINT_ID variable to the access.conf file - so that full GnuPG fingerprints can be required for incoming SPA packets - in addition to the appreviated GnuPG signatures listed in GPG_REMOTE_ID. - From the test suite, an example fingerprint is - - GPG_FINGERPRINT_ID 00CC95F05BC146B6AC4038C9E36F443C6A3FAD56 - - ChangeLog | 6 ++++ - Makefile.am | 2 ++ - server/access.c | 33 +++++++++++++++++++-- - server/fwknopd_common.h | 2 ++ - server/incoming_spa.c | 52 +++++++++++++++++++++++++++++---- - test/conf/gpg_no_pw_bad_fpr_access.conf | 6 ++++ - test/conf/gpg_no_pw_fpr_access.conf | 6 ++++ - test/test-fwknop.pl | 9 ++++-- - test/tests/gpg_no_pw.pl | 25 ++++++++++++++++ - 9 files changed, 132 insertions(+), 9 deletions(-) - -commit 11b9732c1641cb6c972fbc5f32613b1d27fbe308 -Author: Michael Rash -Date: Sun Jun 29 17:23:20 2014 -0400 - - [server] Call clean_exit() from daemon parent process - - When becoming a daemon, make sure the fwknopd parent process calls - clean_exit() to release memory before calling exit(). - - server/fwknopd.c | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - -commit e41e0f5aafba244e8d94965dd9e690c68a48fa4b -Author: Michael Rash -Date: Tue Jun 24 22:54:27 2014 -0400 - - [test suite] added iptables OUTPUT chain test - - Makefile.am | 1 + - test/conf/invalid_ipt_input_chain_2_fwknopd.conf | 1 - - test/conf/invalid_ipt_input_chain_3_fwknopd.conf | 1 - - test/conf/invalid_ipt_input_chain_4_fwknopd.conf | 1 - - test/conf/invalid_ipt_input_chain_5_fwknopd.conf | 1 - - test/conf/invalid_ipt_input_chain_6_fwknopd.conf | 1 - - test/conf/invalid_ipt_input_chain_fwknopd.conf | 1 - - test/conf/ipt_output_chain_fwknopd.conf | 2 ++ - test/test-fwknop.pl | 1 + - test/tests/rijndael_hmac.pl | 12 ++++++++++++ - 10 files changed, 16 insertions(+), 6 deletions(-) - -commit a4615a76b5e4975ca2f1c34f4c3d26bc086e7e58 -Author: Michael Rash -Date: Mon Jun 23 18:27:22 2014 -0400 - - [test suite] add Rjindael HMAC --no-ipt-check-support test for udp/53 - - test/tests/rijndael_hmac.pl | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -commit 125f99aa3bd1fe509f3cd6c9c5d990e26cedd120 -Author: Michael Rash -Date: Mon Jun 23 18:21:29 2014 -0400 - - [test suite] updated --gdb mode to run the first found fwknop command from an output/*.test file - - test/test-fwknop.pl | 3 +++ - 1 file changed, 3 insertions(+) - -commit e0001e4a5d5bf68c004edf007cf589a3e4591b31 -Author: Michael Rash -Date: Mon Jun 23 18:10:01 2014 -0400 - - [server] call clean_exit() on expand_acc_string_list() error - - server/access.c | 33 ++++++++++++++++++++------------- - 1 file changed, 20 insertions(+), 13 deletions(-) - -commit 189d0ea0bca75cbc6d7e670102b10831ccb6a19b -Author: Michael Rash -Date: Mon Jun 23 18:02:57 2014 -0400 - - [server] call clean_exit() on add_acc_string() error - - server/access.c | 120 +++++++++++++++++++++++++++++++++++++++++++------------- - 1 file changed, 92 insertions(+), 28 deletions(-) - -commit ff65274e28738e3bf14a54b2708112a8403c4352 -Author: Michael Rash -Date: Fri Jun 20 19:35:02 2014 -0400 - - [server] make sure clean_exit() is called on any add_acc_b64_string() errs - - server/access.c | 31 ++++++++++++++++++++++--------- - 1 file changed, 22 insertions(+), 9 deletions(-) - -commit fd0805c57ab0972d9a52c4b8f6abc7981fabd873 -Author: Michael Rash -Date: Fri Jun 20 19:22:35 2014 -0400 - - [server] minor memory leak fix for invalid FORCE_NAT var in access.conf - - This commit fixes the following leak found by valgrind: - - ==6241== 568 bytes in 1 blocks are still reachable in loss record 1 of 1 - ==6241== at 0x4C2A2DB: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) - ==6241== by 0x551537A: __fopen_internal (iofopen.c:73) - ==6241== by 0x118C8E: parse_access_file (access.c:1143) - ==6241== by 0x10F134: main (fwknopd.c:250) - - server/access.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -commit 74440be6535b66d8585aac63c0efc1e170f70e96 -Author: Michael Rash -Date: Mon Jun 16 23:08:50 2014 -0400 - - [server] minor pointer typo fix - - server/fwknopd.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit 3557158620f3a576cf4a958a80f3534ea3e85edc -Author: Michael Rash -Date: Sun Jun 15 23:10:02 2014 -0400 - - [test suite] add valgrind suppressions for libfiu - - test/valgrind_suppressions | 38 ++++++++++++++++++++++++++++++-------- - 1 file changed, 30 insertions(+), 8 deletions(-) - -commit 389e55ddfcd5a8a2d7c75fdca905768a8318ed2a -Author: Michael Rash -Date: Sun Jun 15 10:55:19 2014 -0400 - - [test suite] consolidate valgrind success/failure criteria into a single function - - test/test-fwknop.pl | 33 +++++++++++++++++++++------------ - 1 file changed, 21 insertions(+), 12 deletions(-) - -commit 55a03f33927dd95719dbe0683a3b29b6d3501344 -Author: Michael Rash -Date: Sun Jun 15 10:34:52 2014 -0400 - - [test suite] added suppressions to fko-wrapper/run_valgrind.sh - - test/fko-wrapper/run_valgrind.sh | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -commit 487860725451f5f290b55b8cbe729af58f7d5413 -Author: Michael Rash -Date: Sun Jun 15 10:21:21 2014 -0400 - - [libfko] removed fko_new_strdup() fault injection tag since fko_destroy() isn't called - - lib/fko_funcs.c | 4 ---- - test/fko-wrapper/fko_fault_injection.c | 3 +-- - test/tests/fault_injection.pl | 9 --------- - 3 files changed, 1 insertion(+), 15 deletions(-) - -commit 054793fd9e79b5aa70c5be7759fec1e9e23a9108 -Author: Michael Rash -Date: Sun Jun 15 09:48:37 2014 -0400 - - [server] check fiu_enable() return value in --fault-injection mode - - server/fwknopd.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -commit 34f7ebd0829b3dd5545e120fe3e9af9cca7a7119 -Author: Michael Rash -Date: Sun Jun 15 09:41:43 2014 -0400 - - [test suite] added strtol_wrapper() fault injection tags - - lib/fko_util.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -commit 42a20616b499003d59b21abba2ee6ce9431622e1 -Author: Michael Rash -Date: Sat Jun 14 21:27:18 2014 -0400 - - [libfko] additional fault injection additions with test suite support - - lib/fko_funcs.c | 19 ++++---- - lib/fko_hmac.c | 10 ++++ - test/tests/fault_injection.pl | 103 ++++++++++++++++++++++++++++++++++++++++++ - 3 files changed, 123 insertions(+), 9 deletions(-) - -commit c00a3e7b2670566c9a403e07a5a34df0fcda1811 -Author: Michael Rash -Date: Thu Jun 12 20:29:54 2014 -0400 - - [test suite] additional fault injection tests - - lib/fko_util.c | 11 ++++++++ - test/tests/fault_injection.pl | 58 +++++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 69 insertions(+) - -commit 13ca6261b362382dd42b56cafadd903dcd851412 -Author: Michael Rash -Date: Thu Jun 12 20:29:24 2014 -0400 - - [test suite] minor update to not parse crash messages out of crash test output file + [test suite] firewall prefix typo bug fix test/test-fwknop.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -commit 06ce514111ad9838eee1cf82955140099c78ffe5 +commit 22161af075f9d3cda1c6ec8b79273951b30c5cc5 Author: Michael Rash -Date: Thu Jun 12 00:02:18 2014 -0400 +Date: Thu Oct 23 08:39:42 2014 -0400 - [test suite] add several fault injection tests + [test suite] add ipt_local_nat_fwknopd.conf - lib/fko_client_timeout.c | 2 +- - lib/fko_digest.c | 46 ++++++++ - server/fw_util_iptables.c | 4 + - test/fko-wrapper/fko_wrapper.c | 8 +- - test/tests/fault_injection.pl | 243 ++++++++++++++++++++++++++++++++++++++++- - 5 files changed, 294 insertions(+), 9 deletions(-) - -commit d8b2ae370afcd211338bc91d880b61fbb83c0c77 -Author: Michael Rash -Date: Thu Jun 12 00:01:58 2014 -0400 - - [test suite] always run crash check at the end of test run - - test/test-fwknop.pl | 28 ++++++++++++++-------------- - 1 file changed, 14 insertions(+), 14 deletions(-) - -commit e02750e6662204ad1020c4128e2e34c505e26ad6 -Author: Michael Rash -Date: Thu Jun 12 00:01:12 2014 -0400 - - [server] skip firewall rules check in --test mode - - server/pcap_capture.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -commit 410624a85828a23290bbac25c8ac3a8627660e22 -Author: Michael Rash -Date: Thu Jun 12 00:00:40 2014 -0400 - - [libfko] free() temp buffer right after strdup() call, add libfiu fault injection tags - - lib/fko_encode.c | 46 ++++++++++++++++++++++++++++------------------ - 1 file changed, 28 insertions(+), 18 deletions(-) - -commit 816962982f631cd8e6d15dc40171a3755c263a18 -Author: Michael Rash -Date: Wed Jun 11 23:59:08 2014 -0400 - - [server] clean up fko_destroy() calls in main access stanza loop - - server/incoming_spa.c | 57 ++++++--------------------------------------------- - 1 file changed, 6 insertions(+), 51 deletions(-) - -commit b8ad48eaa97646b48a4debc4e4e7f49cc279c05d -Author: Michael Rash -Date: Mon Jun 9 21:50:55 2014 -0400 - - [test suite] added fiu-run fault injection tests against the fwknopd server - - test/tests/fault_injection.pl | 56 +++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 56 insertions(+) - -commit 8d31de729571be2e2bfc28e0889d904305c881ee -Author: Michael Rash -Date: Mon Jun 9 20:48:23 2014 -0400 - - [server] skip replay storage in --test mode (since we're not granting access anyway) - - server/incoming_spa.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit 70f70091b12f929f4dd56d2b783d7ea77a4b06f3 -Author: Michael Rash -Date: Mon Jun 9 20:45:01 2014 -0400 - - [server] skip fw initialization and cleanup in --test mode - - server/fwknopd.c | 17 ++++------------- - 1 file changed, 4 insertions(+), 13 deletions(-) - -commit 4ab677cfe0ac2bd99f2b7c84b1f17a6e84f2b440 -Author: Michael Rash -Date: Mon Jun 9 20:40:44 2014 -0400 - - [server] minor fwknopd --help output update - - server/config_init.c | 19 ++++++++++++++++++- - 1 file changed, 18 insertions(+), 1 deletion(-) - -commit ffde9c3f1ae38d1a5c0f72ed3d721bc0bfaeaa16 -Author: Michael Rash -Date: Sun Jun 8 23:09:55 2014 -0400 - - [libfko] bug fix to check strdup() return value - - Using the 'fiu-run' fault injection binary, a couple of cases were - turned up with libfko does not properly check the strdup() return value. - This commit fixes these issues, and here is an illustration of the stack - trace for one such issue: - - Core was generated by `../client/.libs/fwknop -A tcp/22 -a 127.0.0.2 -D - 127.0.0.1 --get-key local_spa.'. - Program terminated with signal 11, Segmentation fault. - #0 __strnlen_sse2 () at ../sysdeps/x86_64/multiarch/../strnlen.S:34 - 34 ../sysdeps/x86_64/multiarch/../strnlen.S: No such file or directory. - (gdb) where - #0 __strnlen_sse2 () at ../sysdeps/x86_64/multiarch/../strnlen.S:34 - #1 0x00007effa38189bc in _rijndael_encrypt (enc_key_len=, enc_key=, ctx=0x7effa5945750) at fko_encryption.c:141 - #2 fko_encrypt_spa_data (ctx=0x7effa5945750, enc_key=, enc_key_len=) at fko_encryption.c:605 - #3 0x00007effa381a2d6 in fko_spa_data_final (ctx=0x7effa5945750, enc_key=enc_key@entry=0x7fff3ff4aa10 "fwknoptest", enc_key_len=, hmac_key=hmac_key@entry=0x7fff3ff4aaa0 "", hmac_key_len=0) at fko_funcs.c:489 - #4 0x00007effa405f2fb in main (argc=, argv=) at fwknop.c:449 - - lib/fko_encryption.c | 10 ++++++---- - lib/fko_hmac.c | 8 ++++++-- - 2 files changed, 12 insertions(+), 6 deletions(-) - -commit 989d48b7e97ebd8186f4b9ec364bc2389edcb623 -Author: Michael Rash -Date: Sun Jun 8 20:22:19 2014 -0400 - - [test suite] make valgrind suppressions slightly more perscriptive - - test/valgrind_suppressions | 46 ++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 46 insertions(+) - -commit 7fb2f292bcd74c39772816d617912ad7febc351b -Author: Michael Rash -Date: Sun Jun 8 20:20:19 2014 -0400 - - [test suite] in valgrind mode, make tests fail whenever there are 'definitely' or 'indirectly' lost bytes in memory - - test/test-fwknop.pl | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -commit 53a1e1bc0047b116807f715c326edad93c164c7e -Author: Michael Rash -Date: Sun Jun 8 20:19:03 2014 -0400 - - [client] minor bug fix for condition under which fiu_* functions are called for fault injection - - client/fwknop.c | 6 ++---- - 1 file changed, 2 insertions(+), 4 deletions(-) - -commit 82b05b95302744d1c1dba55b4e1792868114bf8d -Author: Michael Rash -Date: Fri Jun 6 21:28:28 2014 -0400 - - [libfko] fko_new() bug fix to not leak memory under fko_set_... error conditions - - This commit changes how fko_new() deals with FKO context initialization - to not set ctx->initval back to zero (uninitialized) imediately after - calling each fko_set_... function and before checking the fko_set_... return - value. The reason for this change is that fko_destroy() checks for - context initialization via ctx->initval before calling free() against - any heap allocated context member. So, if fko_set_... returns an error, - fko_destroy() (previous to this commit) would have no opportunity to - free such members. - - This bug was found with fault injection testing provided by libfiu - together with valgrind. Specifically the following test suite command - exposes the problem (from the test/ directory): - - ./test-fwknop.pl --enable-complete --include "fault injection.*libfko" - - In the resulting output/2.test file valgrind reports the following: - - ==27941== LEAK SUMMARY: - ==27941== definitely lost: 264 bytes in 1 blocks - ==27941== indirectly lost: 28 bytes in 3 blocks - ==27941== possibly lost: 0 bytes in 0 blocks - ==27941== still reachable: 1,099 bytes in 12 blocks - ==27941== suppressed: 0 bytes in 0 blocks - - After this commit is applied, this changes to: - - ==7137== LEAK SUMMARY: - ==7137== definitely lost: 0 bytes in 0 blocks - ==7137== indirectly lost: 0 bytes in 0 blocks - ==7137== possibly lost: 0 bytes in 0 blocks - ==7137== still reachable: 1,099 bytes in 12 blocks - ==7137== suppressed: 0 bytes in 0 blocks - - Note that 'definitely lost' in valgrind output means there is a real - memory leak that needs to be fixed whereas 'still reachable' is most - likely not a real problem according to: - - http://valgrind.org/docs/manual/faq.html#faq.deflost - - lib/fko_funcs.c | 37 ++++++++----------------------------- - 1 file changed, 8 insertions(+), 29 deletions(-) - -commit dfeecf5c293af02bca9c830052bc85ea7e0279e4 -Author: Michael Rash -Date: Thu Jun 5 23:13:01 2014 -0400 - - [test suite] additional fix for duplicate fault injection tags - - test/fko-wrapper/fko_fault_injection.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -commit 1b4d7f5b1935d4882db1c85d95676f51e446fd3b -Author: Michael Rash -Date: Thu Jun 5 23:10:41 2014 -0400 - - [test suite] minor fix for duplicate fault injection tags - - test/fko-wrapper/fko_fault_injection.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -commit 6d1d66fe032c33894252d3b88253255f68019a4c -Author: Michael Rash -Date: Thu Jun 5 23:05:49 2014 -0400 - - add --fault-injection-tag support to the client/server/libfko - - This is a significant commit to add the ability to leverage libfko fault - injections from both the fwknop client and server command lines via a - new option '--fault-injection-tag '. This option is used by - the test suite with the tests/fault_injection.pl tests. - - client/cmd_opts.h | 3 + - client/config_init.c | 9 + - client/fwknop.8.in | 12 +- - client/fwknop.c | 29 +++ - client/fwknop_common.h | 3 + - common/common.h | 4 + - doc/fwknop.man.asciidoc | 7 + - doc/fwknopd.man.asciidoc | 9 + - lib/fko_client_timeout.c | 11 ++ - lib/fko_funcs.c | 22 +++ - lib/fko_message.c | 19 ++ - lib/fko_nat_access.c | 21 +++ - lib/fko_server_auth.c | 12 ++ - lib/fko_timestamp.c | 9 + - lib/fko_user.c | 9 + - server/cmd_opts.h | 5 +- - server/config_init.c | 8 + - server/fwknopd.8.in | 12 +- - server/fwknopd.c | 30 +++ - server/fwknopd_common.h | 1 + - test/test-fwknop.pl | 63 ++++++- - test/tests/fault_injection.pl | 427 ++++++++++++++++++++++++++++++++++++++++++ - 22 files changed, 717 insertions(+), 8 deletions(-) - -commit 6a0af8ed8ef1b585a346475005c81c062e81ab4b -Author: Michael Rash -Date: Sun Jun 1 22:30:54 2014 -0400 - - [test suite] added coverage_diff.py - - This commit adds support for diff'ing before and after gcov/lcov results - to see when new function/line coverage is added by the test suite. Here - is an example of its output: - - Sun Jun 1 22:28:00 2014 CMD: ./coverage_diff.py - [+] Coverage: /home/mbr/git/fwknop.git/server/config_init.c - [+] new 'fcns' coverage: usage() - [+] new 'lines' coverage: 1015 - [+] new 'lines' coverage: 1017 - [+] new 'lines' coverage: 1019 - [+] new 'lines' coverage: 1059 - [+] new 'lines' coverage: 979 - [+] Coverage: /home/mbr/git/fwknop.git/server/fw_util_iptables.c - [+] new 'lines' coverage: 560 - [+] new 'lines' coverage: 561 - - test/coverage_diff.py | 77 +++++++++++++++++++++++++++++++++++++++++++++++++++ - test/test-fwknop.pl | 5 ++++ - 2 files changed, 82 insertions(+) - -commit 040b7b10a002d2f9b98a5b73c7b846ca61edbe5c -Author: Michael Rash -Date: Mon May 26 23:15:09 2014 -0400 - - [test suite] add shell escape for /usr/include/* wildcard on lcov command line - - test/test-fwknop.pl | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit 2e150d47a7d905f4cbf7e3c0188343b45d87b471 -Author: Michael Rash -Date: Mon May 26 23:06:14 2014 -0400 - - restore trustdb.gpg files - - test/conf/client-gpg-no-pw/trustdb.gpg | Bin 1360 -> 1360 bytes - test/conf/server-gpg-no-pw/trustdb.gpg | Bin 1360 -> 1360 bytes - 2 files changed, 0 insertions(+), 0 deletions(-) - -commit 2697bd260ce821c7be632cfd87e381805a7db1a0 -Author: Michael Rash -Date: Mon May 26 22:53:44 2014 -0400 - - [test suite] fix LD_LIBRARY_PATH for fiu-run execution against fko-wrapper binaries - - test/conf/client-gpg-no-pw/trustdb.gpg | Bin 1360 -> 1360 bytes - test/conf/server-gpg-no-pw/trustdb.gpg | Bin 1360 -> 1360 bytes - test/test-fwknop.pl | 4 +++- - 3 files changed, 3 insertions(+), 1 deletion(-) - -commit ed58dcb635b7d3b0f89b3f3191aa903fa18d0d76 -Author: Michael Rash -Date: Mon May 26 21:28:19 2014 -0400 - - Revert "add gcc '-pg' flag in --enable-profile-coverage mode" - - This reverts commit bbe5626566d617317f2d25f5650f2299c95f2c9f because -pg - is needed for gprof, not gcov, and valgrind is incompatible with -pg. - - configure.ac | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -commit ddaf0134d6d6b42284047ee6b543a6258c61e34d -Author: Michael Rash -Date: Mon May 26 15:54:12 2014 -0400 - - use fiu.h instead of fiu-local.h - - common/common.h | 2 +- - lib/fko_common.h | 2 +- - test/fko-wrapper/fko_basic.c | 6 ++++++ - test/fko-wrapper/fko_fault_injection.c | 2 +- - test/tests/fault_injection.pl | 4 ++-- - 5 files changed, 11 insertions(+), 5 deletions(-) - -commit e893ecad21d2152edd3e9e661eedb3f0d0bd9ac2 -Author: Michael Rash -Date: Mon May 26 15:09:02 2014 -0400 - - [test suite] added first test to run fwknop client underneath fiu-run for libc fault injection - - test/tests/fault_injection.pl | 12 +++++++++++- - 1 file changed, 11 insertions(+), 1 deletion(-) - -commit a1f1e4b32891f710f52cd6b486bf026fde77d50d -Author: Michael Rash -Date: Mon May 26 14:18:27 2014 -0400 - - [test suite] in --enable-fuzzing-interfaces mode create fko-wrapper/send_spa_payloads file if it does exist - - test/test-fwknop.pl | 14 ++++++++++++++ - 1 file changed, 14 insertions(+) - -commit 237602114fc20d55187d797e3f1d553bf12684ae -Author: Michael Rash -Date: Mon May 26 08:40:26 2014 -0400 - - [test suite] minor fko_wrapper comment update - - test/fko-wrapper/fko_wrapper.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -commit 15aff82980c7b093f231c8218ff5d84553e79dc0 -Author: Michael Rash -Date: Mon May 26 08:39:44 2014 -0400 - - client/server added libfiu header files in --enable-libfiu-support mode - - common/common.h | 5 +++++ - 1 file changed, 5 insertions(+) - -commit 55ae7d509576c1279ba9b7b90f33eb7a6a88bbbc -Author: Michael Rash -Date: Sun May 25 22:10:43 2014 -0400 - - [test suite] auto-generate fko-wrapper/fuzz_spa_payload file with spa_fuzzing.py if necessary in --enable-complete/--enable-fuzzing-interfaces mode - - test/test-fwknop.pl | 26 +++++++++++++++++++++++--- - test/tests/rijndael_hmac_fuzzing.pl | 2 +- - 2 files changed, 24 insertions(+), 4 deletions(-) - -commit 23e8dcfddd16c687563b45dae8f7bcd608b1c27b -Author: Michael Rash -Date: Sun May 25 16:23:40 2014 -0400 - - [test suite] added configure_max_coverage.sh for --enable-complete mode - - test/configure_max_coverage.sh | 13 +++++++++++++ - 1 file changed, 13 insertions(+) - -commit fa53cc62e14e9c235bffe64e22d383b95d59ce35 -Author: Michael Rash -Date: Sun May 25 15:50:09 2014 -0400 - - [test suite] SPA packet fuzzer minor comment additions to clearly define SPA packet types - - test/spa_fuzzing.py | 36 +++++++++++++++++++++++++++++++++--- - 1 file changed, 33 insertions(+), 3 deletions(-) - -commit d625a24a87e541295f3457867e8933bcd3eb54e5 -Author: Michael Rash -Date: Sun May 25 15:08:31 2014 -0400 - - [test suite] added fko_new_with_data() call with SPA data that is too short - - test/fko-wrapper/fko_wrapper.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -commit 00ea2ce0efffb0a5fadab8ada3b873a07cb1068f -Author: Michael Rash -Date: Sun May 25 12:37:35 2014 -0400 - - [test suite] added --enable-complete option for fuzzing, fault injection, and code coverage - - test/test-fwknop.pl | 21 +++++++++++++++------ - 1 file changed, 15 insertions(+), 6 deletions(-) - -commit de03ed702ea30748e876bf2cdbe22aa75f25c69b -Author: Michael Rash -Date: Sat May 24 17:55:57 2014 -0400 - - [test suite] added the ability to run fiu-run fault injection binary against fwknop - - test/test-fwknop.pl | 36 +++++++++++++++++++++++++++++++++++- - 1 file changed, 35 insertions(+), 1 deletion(-) - -commit 597a3d395363af43c3a46617649c6f786aa69dbb -Author: Michael Rash -Date: Sat May 24 15:12:07 2014 -0400 - - [libfko] added fault injections for remaining ...set...() functions called by fko_new() - - lib/fko_digest.c | 7 +++++++ - lib/fko_encryption.c | 16 ++++++++++++++++ - lib/fko_message.c | 8 ++++++++ - lib/fko_timestamp.c | 8 ++++++++ - test/fko-wrapper/fko_fault_injection.c | 28 ++++++++++++++++++++++++++-- - 5 files changed, 65 insertions(+), 2 deletions(-) - -commit 5f227cfa488e28bba60376e7f10c387cc0c3f9c5 -Author: Michael Rash -Date: Sat May 24 14:47:10 2014 -0400 - - [libfko] added fault injections for fko_set_username() - - lib/fko_user.c | 14 ++++++++++++++ - test/fko-wrapper/fko_fault_injection.c | 13 ++++++++++--- - 2 files changed, 24 insertions(+), 3 deletions(-) - -commit 17f325ecebd69d7421f590c0fcf00058a8cc6990 -Author: Michael Rash -Date: Sat May 24 14:01:49 2014 -0400 - - [libfko] added fault injections for fko_set_rand_value() - - lib/fko_rand_value.c | 20 ++++++++++++++++++++ - test/fko-wrapper/fko_fault_injection.c | 16 ++++++++++++++-- - 2 files changed, 34 insertions(+), 2 deletions(-) - -commit 35ad8323928ebdf07fad38bed22e65f099dfae02 -Author: Michael Rash -Date: Sat May 24 10:14:28 2014 -0400 - - [libfko] started on libfiu fault injection code - - lib/fko_common.h | 4 ++++ - lib/fko_funcs.c | 9 +++++++ - test/fko-wrapper/fko_fault_injection.c | 43 +++++++++++++++++++--------------- - 3 files changed, 37 insertions(+), 19 deletions(-) - -commit 2f9b92068d7239e9a617e21b4cb8febbaf06f436 (refs/remotes/origin/master, refs/remotes/origin/HEAD) -Author: Michael Rash -Date: Fri May 23 18:55:06 2014 -0400 - - [test suite] added tests/rijndael_hmac_fuzzing.pl file - - test/tests/rijndael_hmac_fuzzing.pl | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -commit 23997b62aac680a97d3040806786cd5f6e738d61 -Author: Michael Rash -Date: Fri May 23 18:50:47 2014 -0400 - - [test suite] add hmac_fuzzing_access.conf file - - test/conf/hmac_fuzzing_access.conf | 5 +++++ - 1 file changed, 5 insertions(+) - -commit 8d61a8cf7fab4cf0caeed0e1bffe4de4e9c86fa3 -Author: Michael Rash -Date: Fri May 23 18:55:06 2014 -0400 - - [test suite] added tests/rijndael_hmac_fuzzing.pl file - - test/tests/rijndael_hmac_fuzzing.pl | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -commit 0a82c68451b3ea6543fc1a97409212b1b8402841 -Author: Michael Rash -Date: Fri May 23 18:50:47 2014 -0400 - - [test suite] add hmac_fuzzing_access.conf file - - test/conf/hmac_fuzzing_access.conf | 5 +++++ - 1 file changed, 5 insertions(+) - -commit cf3f41821b43d4a87367ffd899b81e5bd5862568 -Author: Michael Rash -Date: Thu May 22 08:36:11 2014 -0500 - - [test suite] add fault injection tests - - Makefile.am | 1 + - test/test-fwknop.pl | 43 ++++++++++++++++++++++++++++++++----------- - test/tests/fault_injection.pl | 37 +++++++++++++++++++++++++++++++++++-- - 3 files changed, 68 insertions(+), 13 deletions(-) - -commit a65fff7e7b9689bdae06a7791c573097a7a83b2d -Author: Michael Rash -Date: Thu May 22 08:30:36 2014 -0500 - - [test suite] make fko_wrapper binary path absolute - - test/tests/basic_operations.pl | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -commit c5e8eee74325ed7ce01c025cc820fea3e6c2e04a -Author: Michael Rash -Date: Thu May 22 08:29:06 2014 -0500 - - [test suite] make fko_wrapper binary path absolute - - test/tests/rijndael_fuzzing.pl | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -commit a2f2777e9f9e89a5af484d0df68437dfc23f2a62 -Author: Michael Rash -Date: Thu May 22 08:24:16 2014 -0500 - - [test suite] add fko_basic.c file to the FKO wrapper - - Makefile.am | 3 ++- - test/fko-wrapper/fko_basic.c | 19 +++++++++++++++++++ - 2 files changed, 21 insertions(+), 1 deletion(-) - -commit bbe5626566d617317f2d25f5650f2299c95f2c9f -Author: Michael Rash -Date: Thu May 22 08:19:45 2014 -0500 - - add gcc '-pg' flag in --enable-profile-coverage mode - - configure.ac | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -commit 8666788a16bd206a5a14562e2cccb873015b89d4 -Author: Michael Rash -Date: Wed May 21 09:12:20 2014 -0400 - - [test suite] minor line counter addition for file_find_regex() - - test/test-fwknop.pl | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -commit 02389932bc23db025b13a07665858ed50fe48b6a -Author: Michael Rash -Date: Wed May 21 08:27:31 2014 -0400 - - added --enable-libfiu-support to build fwknop with fault injection support - - configure.ac | 19 ++++++++++++++++++- - 1 file changed, 18 insertions(+), 1 deletion(-) - -commit 84821438bdfedabaac16185308ec65149fdf31b9 -Author: Michael Rash -Date: Tue May 20 21:20:10 2014 -0400 - - [test suite] started on support for libfiu fault injection tests - - test/fko-wrapper/Makefile | 6 +- - test/fko-wrapper/fko_fault_injection.c | 34 +++++++++++ - test/fko-wrapper/run.sh | 7 +++ - test/fko-wrapper/run_valgrind.sh | 6 +- - test/test-fwknop.pl | 105 ++++++++++++++++++--------------- - test/tests/basic_operations.pl | 18 ++++++ - test/tests/fault_injection.pl | 21 +++++++ - test/tests/rijndael_fuzzing.pl | 10 +++- - 8 files changed, 154 insertions(+), 53 deletions(-) - -commit 55582c31f8bd661408dc3b11f46ad7808d5ea784 -Author: Michael Rash -Date: Sat May 10 23:16:32 2014 -0400 - - [test suite] expand libfko username coverage testing by adding undef LOGNAME env variable test - - test/tests/basic_operations.pl | 9 +++++++++ - 1 file changed, 9 insertions(+) - -commit d5e5961ca1cad0f62e280a51d8b38b9c76bc8e6e -Author: Michael Rash -Date: Fri May 9 21:13:48 2014 -0400 - - [test suite] stronger valgrind test requirements - - This commit adds a couple of suppressions for known issues that valgrind - finds in libcap, and then makes a significant change to how the test - suite deals with any valgrind errors (in --enable-valgrind mode) that - are outside of these suppressions. That is, any new valgrind errors - that are discovered will cause the test that triggers them to fail. - Previous to this commit, the final valgrind "flagged functions" test - attmpted to do this by comparing valgrind output across test runs. This - worked well enough for a while, but this latest commit enforces a - stricter stance for valgrind validation of the fwknop code base. - - test/test-fwknop.pl | 188 ++++++++++++++++++++++++++------------------- - test/valgrind_suppressions | 28 ++++++- - 2 files changed, 134 insertions(+), 82 deletions(-) - -commit 7cb8ad95280f09fceaaee1488b54fc15e75f3ff5 -Author: Michael Rash -Date: Fri May 9 20:53:32 2014 -0400 - - [fko-wrapper] add missing fko_destroy() call - - test/fko-wrapper/fko_wrapper.c | 2 ++ + test/conf/ipt_local_nat_fwknopd.conf | 2 ++ 1 file changed, 2 insertions(+) -commit 22ad9044cdd2d5da86e23534c5d8acf1ee4cb397 +commit b8f1cf6c6c1c935df4260e30ab555458ce686b62 (refs/remotes/ubuntu13/execvpe) Author: Michael Rash -Date: Fri May 9 20:51:29 2014 -0400 +Date: Tue Oct 21 22:49:03 2014 -0400 - [test suite] python fuzzer pkt_id counter minor bug fix + make sure test suite conf files are included in Makefile.am - test/spa_fuzzing.py | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) + Makefile.am | 16 +++++++++++++--- + test/conf/local_nat_fwknopd.conf | 2 -- + test/test-fwknop.pl | 2 +- + 3 files changed, 14 insertions(+), 6 deletions(-) -commit 3e0c983bbd0d13ec7354e86678951f3d3a832c22 +commit 56a6b7dee5476eedb481bac2aefc765ba54ed3a0 Author: Michael Rash -Date: Fri May 9 07:57:46 2014 -0400 +Date: Tue Oct 21 22:43:21 2014 -0400 - [test suite] add lib path and valgrind string to server start/stop cycle tests + give firewalld its own namespace (can track firewalld changes independently of iptables) - test/test-fwknop.pl | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) + Makefile.am | 18 +- + test/conf/custom_input_chain_fwknopd.conf | 2 - + test/conf/custom_nat_chain_fwknopd.conf | 5 - + test/conf/firewd_custom_input_chain_fwknopd.conf | 2 + + test/conf/firewd_custom_nat_chain_fwknopd.conf | 5 + + test/conf/firewd_local_nat_fwknopd.conf | 2 + + test/conf/firewd_nat_fwknopd.conf | 1 + + test/conf/firewd_no_flush_exit_fwknopd.conf | 1 + + test/conf/firewd_no_flush_init_fwknopd.conf | 1 + + .../conf/firewd_no_flush_init_or_exit_fwknopd.conf | 2 + + test/conf/firewd_output_chain_fwknopd.conf | 2 + + test/conf/firewd_snat_fwknopd.conf | 3 + + test/conf/firewd_snat_no_translate_ip_fwknopd.conf | 2 + + test/conf/ipt_custom_input_chain_fwknopd.conf | 2 + + test/conf/ipt_custom_nat_chain_fwknopd.conf | 5 + + test/conf/ipt_nat_fwknopd.conf | 1 + + test/conf/ipt_no_flush_exit_fwknopd.conf | 1 + + test/conf/ipt_no_flush_init_fwknopd.conf | 1 + + test/conf/ipt_no_flush_init_or_exit_fwknopd.conf | 2 + + test/conf/ipt_snat_fwknopd.conf | 3 + + test/conf/ipt_snat_no_translate_ip_fwknopd.conf | 2 + + test/conf/nat_fwknopd.conf | 1 - + test/conf/no_flush_exit_fwknopd.conf | 1 - + test/conf/no_flush_init_fwknopd.conf | 1 - + test/conf/no_flush_init_or_exit_fwknopd.conf | 2 - + test/conf/snat_fwknopd.conf | 3 - + test/conf/snat_no_translate_ip_fwknopd.conf | 2 - + test/test-fwknop.pl | 400 +++++++++++---------- + test/tests/basic_operations.pl | 18 +- + test/tests/gpg.pl | 12 +- + test/tests/gpg_no_pw.pl | 12 +- + test/tests/rijndael.pl | 62 ++-- + test/tests/rijndael_hmac.pl | 108 +++--- + 33 files changed, 360 insertions(+), 325 deletions(-) -commit 2b5029a4eed188986e0e6d810d5161d6542727b8 +commit 6945e23bc93d9580ccbcda1e770d6f818d2c7b0d Author: Michael Rash -Date: Fri May 9 07:49:57 2014 -0400 +Date: Mon Oct 20 22:23:46 2014 -0400 - [test suite] add SIGINT, SIGUSR1, and SIGUSR2 signals to restart cycle test for code coverage + [test suite] UDP server command execution tests, run configure arg recompile tests after gcov profiling stuff - test/test-fwknop.pl | 24 +++++++++++++++++++++--- - test/tests/basic_operations.pl | 1 - - 2 files changed, 21 insertions(+), 4 deletions(-) + Makefile.am | 1 + + test/test-fwknop.pl | 216 +++++++++++++++++++++-------------- + test/tests/configure_args.pl | 71 +++++++++++- + test/tests/rijndael_cmd_exec.pl | 12 ++ + test/tests/rijndael_hmac.pl | 3 +- + test/tests/rijndael_hmac_cmd_exec.pl | 12 ++ + 6 files changed, 225 insertions(+), 90 deletions(-) -commit 33234183dfe8cca858d83f0ce81df14b8eb2ba1e +commit 15f73c7f9e1dd99d3a54a5e6428909b4873ad1b4 Author: Michael Rash -Date: Mon May 5 01:15:20 2014 -0400 +Date: Sun Oct 19 22:58:35 2014 -0400 - [test stuie] fko-wrapper PKT_ID generation + send fuzzing packets back through fko_new_with_data() cycle + [test suite] added configure args test with UDP server test for fwknopd not linking against libpcap - test/fko-wrapper/fko_wrapper.c | 50 ++++++++++++++++++++++++++++++++++++++++-- - 1 file changed, 48 insertions(+), 2 deletions(-) + Makefile.am | 1 + + test/test-fwknop.pl | 56 ++++++++++++++++++++++++++++++++++++++++++++ + test/tests/configure_args.pl | 9 +++++++ + 3 files changed, 66 insertions(+) -commit 0c544f2690640719da243ffbdd7b0d8560673945 +commit 0af8faa0b37b08533fa1aa678f0e9e2f15cc6b11 +Merge: 00b229b 2b04639 Author: Michael Rash -Date: Mon May 5 23:51:21 2014 -0400 +Date: Mon Oct 13 20:25:14 2014 -0400 - [server] add --test mode to enable broader fuzzing coverage + Merge branch 'udp_listener' into execvpe - ChangeLog | 5 +++++ - doc/fwknopd.man.asciidoc | 6 ++++++ - server/cmd_opts.h | 3 ++- - server/config_init.c | 3 +++ - server/fwknopd.8.in | 13 +++++++++++-- - server/incoming_spa.c | 24 +++++++++++++++++++++++- - 6 files changed, 50 insertions(+), 4 deletions(-) - -commit 64a4642c479e9d0bd2434b86dcf1f0ca3b0883fb +commit 00b229b8341b860324a46acd0b8bc603f59990fe Author: Michael Rash -Date: Mon May 5 23:11:32 2014 -0400 +Date: Mon Oct 13 19:54:30 2014 -0400 - [server] minor fix to remove unnecessary opts.status check + [test suite] detect firewalld vs. iptables for server rewrite conf tests - server/fwknopd.c | 2 +- + test/test-fwknop.pl | 11 +++++- + test/tests/basic_operations.pl | 86 +++++++++++++++++++++--------------------- + 2 files changed, 53 insertions(+), 44 deletions(-) + +commit c70e1c72a060eb846654d20bcdc1ddd30ba7f8fd +Author: Michael Rash +Date: Sun Oct 12 21:57:04 2014 -0400 + + [server] update firewalld code to use run_extcmd() instead of popen() and system() - allows execvpe() to be used + + server/fw_util_firewalld.c | 165 +++++++++++++++++++++++---------------------- + server/fw_util_firewalld.h | 44 ++++++------ + server/fw_util_iptables.c | 6 +- + 3 files changed, 112 insertions(+), 103 deletions(-) + +commit d9fb29318e3ee64e207bbd0771393c3de78b9d02 +Author: Michael Rash +Date: Sun Oct 12 21:29:44 2014 -0400 + + [test suite] add --exit-parse-config to fwknopd basic tests where possible + + test/tests/basic_operations.pl | 27 +++++++++++++-------------- + 1 file changed, 13 insertions(+), 14 deletions(-) + +commit c481f7f6b3ed3723904c3838ac63e9fced62618d +Author: Michael Rash +Date: Sun Oct 12 13:16:30 2014 -0400 + + add --disable-execvpe arg to configure script (looks for execvpe() support by default) + + configure.ac | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +commit 62ee780d65d12de41bafa1f7226b1808d7cb04af +Author: Michael Rash +Date: Fri Oct 10 08:20:01 2014 -0400 + + [server] make pid_status a static var at the top of each fw_util_*.c file + + server/fw_util_ipfw.c | 16 +++++++++------- + server/fw_util_iptables.c | 28 +++++++++++++++------------- + server/fw_util_iptables.h | 2 +- + 3 files changed, 25 insertions(+), 21 deletions(-) + +commit e54b15ceaff86d2da4ccac69691da1562a4e2640 +Author: Michael Rash +Date: Fri Oct 10 08:16:31 2014 -0400 + + [test suite] fix up Rijndael cmd exec test + + test/tests/rijndael_cmd_exec.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -commit 7d1ad9a4fa2b12d9a6754432e880f88519f8d2ee +commit a6007918a8b4a71707c58ed9f468613a409ae740 Author: Michael Rash -Date: Mon May 5 23:05:02 2014 -0400 +Date: Fri Oct 10 08:15:44 2014 -0400 - add new test suite conf files + added setuid/setgid cmd exec test files Makefile.am | 2 ++ 1 file changed, 2 insertions(+) -commit 16b391109183c8f4d76359ed9fd3aa8bbc4ea706 +commit 2b5088eb76f5a7af06d68e94c66885e73e81974d Author: Michael Rash -Date: Mon May 5 23:01:44 2014 -0400 +Date: Wed Oct 8 23:10:09 2014 -0400 - [test suite] Rijndael HMAC fuzzing support and a few minor test additions + [test suite] added use terminal test, fix up Rijndael CMD tests - test/spa_fuzzing.py | 188 +++++++++++++++++++++++++++++------------ - test/test-fwknop.pl | 107 +++++++++++++++++++++++ - test/tests/basic_operations.pl | 23 ++++- - 3 files changed, 264 insertions(+), 54 deletions(-) + test/conf/cmd_giduid_access.conf | 6 ++++++ + test/conf/cmd_setuid_access.conf | 5 +++++ + test/test-fwknop.pl | 14 ++++++++++++++ + test/tests/rijndael.pl | 3 +-- + test/tests/rijndael_cmd_exec.pl | 27 +++++++++++++++++++++++++++ + 5 files changed, 53 insertions(+), 2 deletions(-) -commit 02ed5f5ad4aab6b9734f30ca58633dc1431f46cd +commit 6dd599f3de138dfcd3fea39b32241b6df06a245d Author: Michael Rash -Date: Sun May 4 09:17:27 2014 -0400 +Date: Tue Oct 7 23:23:05 2014 -0400 - [server] add --exit-parse-config option, man page updates (minor formatting change) + [server] update ipfw and pf firewall interace code to latest run_extcmd() API - client/fwknop.8.in | 10 +- - doc/fwknop.man.asciidoc | 300 +++++++++++++++++++++++------------------------ - doc/fwknopd.man.asciidoc | 208 ++++++++++++++++---------------- - server/cmd_opts.h | 2 + - server/config_init.c | 4 + - server/fwknopd.8.in | 17 ++- - server/fwknopd.c | 6 + - server/fwknopd_common.h | 1 + - server/fwknopd_errors.h | 1 + - 9 files changed, 296 insertions(+), 253 deletions(-) + server/fw_util_ipfw.c | 34 +++++++++++++++++++++------------- + server/fw_util_pf.c | 40 ++++++++++++++++++---------------------- + server/fw_util_pf.h | 18 ++++++++++++++---- + 3 files changed, 53 insertions(+), 39 deletions(-) -commit d7e9ae578b0e41555f6260d848d6f2566bce315c +commit 06f3db1de8bebf4a3fb2e5982b7beb0e57a788b5 Author: Michael Rash -Date: Sun May 4 09:16:39 2014 -0400 +Date: Tue Oct 7 21:42:36 2014 -0400 - [test suite] add digest cache rewrite feature for test coverage, add config line and pcap filter validation tests + [server] restore shell stderr redirect when execvpe() is not available - test/test-fwknop.pl | 7 +++- - test/tests/basic_operations.pl | 78 ++++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 84 insertions(+), 1 deletion(-) + server/fw_util_iptables.h | 42 ++++++++++++++++++++++++------------------ + 1 file changed, 24 insertions(+), 18 deletions(-) -commit 24f9c582bb1fa9b6074a0f97698c9139ed298590 +commit 1905baa0e8d7ac16f6dd77aa548c72ba30d2a8de Author: Michael Rash -Date: Sun May 4 09:15:44 2014 -0400 +Date: Tue Oct 7 21:37:29 2014 -0400 - [test suite] add multi-port access request to python fuzzer + [server] minor macro usage update - test/spa_fuzzing.py | 1 + - 1 file changed, 1 insertion(+) + server/fw_util_iptables.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) -commit 5f24fc8c5ff9900199838dda47d9b7b21c70da25 +commit b7785a930460014bb0c3b9b2ee4e160040cbe67a Author: Michael Rash -Date: Tue Apr 29 23:50:54 2014 -0400 +Date: Tue Oct 7 21:01:17 2014 -0400 - [server] add --dump-serv-err-codes for test coverage + [server] extend run_extcmd() to allow the caller to specify whether to collect stderr - server/cmd_opts.h | 4 +++- - server/config_init.c | 4 ++++ - server/fwknopd_errors.c | 20 ++++++++++++++++++++ - test/tests/basic_operations.pl | 10 ++++++++++ - 4 files changed, 37 insertions(+), 1 deletion(-) + server/extcmd.c | 49 ++++++++++++++-------------------- + server/extcmd.h | 13 ++++++--- + server/fw_util_iptables.c | 68 ++++++++++++++++++++++++++++++----------------- + server/fw_util_pf.c | 4 +-- + server/incoming_spa.c | 6 +++-- + 5 files changed, 79 insertions(+), 61 deletions(-) -commit 11f3e9b8d3ed919e13b9c22d6c94745919028ddf +commit ed9e1ac236c3c48507916754c1c3dff89d2e05b8 Author: Michael Rash -Date: Tue Apr 29 23:41:01 2014 -0400 +Date: Mon Oct 6 22:10:40 2014 -0400 - [server] add test coverage for tcp server when FUZZING_INTERFACES is defined + added setgid() call for command execution along with CMD_EXEC_GROUP access.conf var - server/fwknopd.c | 14 +++----------- - server/incoming_spa.c | 3 +++ - server/tcp_server.c | 38 +++++++++++++++++++++++++------------- - 3 files changed, 31 insertions(+), 24 deletions(-) + Makefile.am | 1 + + server/access.c | 45 ++++++++++++++++++++++++---- + server/extcmd.c | 56 ++++++++++++++++++++++++----------- + server/extcmd.h | 8 +++-- + server/fwknopd_common.h | 2 ++ + server/incoming_spa.c | 13 ++++---- + test/conf/hmac_cmd_giduid_access.conf | 7 +++++ + test/test-fwknop.pl | 7 +++-- + test/tests/basic_operations.pl | 17 +++++++++++ + test/tests/rijndael_hmac_cmd_exec.pl | 13 ++++++++ + 10 files changed, 136 insertions(+), 33 deletions(-) -commit fb21e3a575954b7898eececa0c1c2a39ea88283a +commit e6d162215f30b0ba18fb620a616459fc1966e4cc Author: Michael Rash -Date: Tue Apr 29 23:25:31 2014 -0400 +Date: Mon Oct 6 22:04:20 2014 -0400 - [server] bug fix to handle SPA packets via http + [test suite] added command execution setuid() 'nobody' test - ChangeLog | 5 ++++ - Makefile.am | 2 ++ - server/incoming_spa.c | 5 +++- - test/conf/spa_over_http.pcap | Bin 0 -> 1846 bytes - test/conf/spa_over_http_fwknopd.conf | 1 + - test/test-fwknop.pl | 2 ++ - test/tests/basic_operations.pl | 52 +++++++++++++++++++++++++++++++++++ - test/tests/rijndael_hmac.pl | 14 ++++++++++ - 8 files changed, 80 insertions(+), 1 deletion(-) + Makefile.am | 1 + + test/conf/hmac_cmd_setuid_access.conf | 6 ++++++ + test/test-fwknop.pl | 16 ++++++++++++++++ + test/tests/rijndael_hmac_cmd_exec.pl | 16 +++++++++++++++- + 4 files changed, 38 insertions(+), 1 deletion(-) -commit 6dde30bc91e20d57891e27ecda3aa0116f33d02b +commit fedc691e21e5ad5c55336995d5509eb08533cb34 Author: Michael Rash -Date: Tue Apr 29 20:54:01 2014 -0400 +Date: Mon Oct 6 21:10:02 2014 -0400 - [test suite] significant test coverage update - - This commit adds a lot of test coverage support as guided by gcov + - lcov. - - Also added the --no-ipt-check-support option to fwknopd (this is only - useful in practice on older Linux distros where 'iptables -C' is not - available, but it helps with test coverage). + [test suite] added generate_core.sh script and --enable-cores-pattern arg for the test suite - doc/fwknopd.man.asciidoc | 5 + - server/access.c | 2 +- - server/cmd_opts.h | 54 ++-- - server/config_init.c | 3 + - server/fw_util_iptables.c | 5 +- - server/fwknopd.8.in | 64 +++-- - server/fwknopd_common.h | 2 + - test/conf/gpg_hmac_access.conf | 2 +- - test/conf/gpg_no_pw_hmac_access.conf | 2 +- - test/test-fwknop.pl | 11 +- - test/tests/basic_operations.pl | 500 ++++++++++++++++++++++++++++++++++- - test/tests/rijndael_hmac.pl | 13 + - 12 files changed, 609 insertions(+), 54 deletions(-) + Makefile.am | 1 + + test/generate_cores.sh | 13 +++++++++++++ + test/test-fwknop.pl | 6 ++++++ + 3 files changed, 20 insertions(+) -commit 40e14fc4002d00d63f55591ef58fc1ca323f9222 -Merge: 964f28e 9901d8a +commit 248c4b301e329919c1c02e9b59f71346378e3de3 Author: Michael Rash -Date: Mon Apr 28 23:00:16 2014 -0400 +Date: Mon Oct 6 20:04:00 2014 -0400 - Merge branch 'spa_encoding_fuzzing' + added configure detection of execvpe() - doesn't exist on Mac OS X yet -commit 9901d8a76a75e8d2bb5088fe92cc370f084e85cb (refs/remotes/origin/spa_encoding_fuzzing, refs/heads/spa_encoding_fuzzing) + client/http_resolve_host.c | 26 +++++++++++++- + client/utils.c | 1 - + configure.ac | 2 +- + server/extcmd.c | 90 ++++++++++++++++++++++++++++++++++++++++++++-- + server/fw_util_ipfw.c | 45 ++++++++++++----------- + 5 files changed, 139 insertions(+), 25 deletions(-) + +commit 652b8cb80eda66c30b89b5111b700f72e8e17e7b Author: Michael Rash -Date: Sat Apr 26 23:04:44 2014 -0400 +Date: Sun Oct 5 20:21:05 2014 -0400 - [libfko/test suite] add the FUZZING_INTERFACES macro - - Add a new fko_set_encoded_data() function gated by #define - FUZZING_INTERFACES to allow encryption and authentication to be bypassed - for fuzzing purposes (and only fuzzing purposes). The fko-wrapper code - has been extended to process data in the - test/fko-wrapper/fuzz_spa_payloads file, which is created by the new - python fuzzer. Typical workflow is: - - $ cd test/fko-wrapper - $ ../spa_fuzzer.py > fuzz_spa_payloads - $ make fuzzing - - (as root): - - ./test-fwknop.pl --enable-profile-coverage --enable-fuzzing-interfaces --enable-all --include wrapper - - [+] Starting the fwknop test suite... - - args: --enable-profile-coverage --enable-fuzzing-interfaces --enable-all --include wrapper - - Saved results from previous run to: output.last/ - - Valgrind mode enabled, will import previous coverage from: - output.last/valgrind-coverage/ - - [+] Total test buckets to execute: 2 - - [Rijndael] [fko-wrapper] multiple libfko calls (with valgrind)......pass (1) - [Rijndael] [fko-wrapper] multiple libfko calls......................pass (2) - [profile coverage] gcov profile coverage............................pass (3) - [valgrind output] [flagged functions] ..............................pass (4) - - Run time: 5.85 minutes - - [+] 0/0/0 OpenSSL tests passed/failed/executed - [+] 0/0/0 OpenSSL HMAC tests passed/failed/executed - [+] 4/0/4 test buckets passed/failed/executed + [server] have run_extcmd() collect process exit status for calling function (in addition to return value) - configure.ac | 14 +++++ - lib/fko.h | 2 + - lib/fko_encode.c | 4 +- - test/conf/client-gpg-no-pw/trustdb.gpg | Bin 1360 -> 1360 bytes - test/fko-wrapper/Makefile | 3 ++ - test/fko-wrapper/fko_wrapper.c | 90 +++++++++++++++++++++++++++++++++ - 6 files changed, 112 insertions(+), 1 deletion(-) + server/extcmd.c | 39 +++++++++++++++--------- + server/extcmd.h | 7 +++-- + server/fw_util_iptables.c | 75 ++++++++++++++++++++++++----------------------- + server/incoming_spa.c | 28 +++++++++--------- + 4 files changed, 81 insertions(+), 68 deletions(-) -commit e1dde1733a3b7f5512fdb2c104f56e0c45d52589 +commit a47ddfcb1ec97f1c5263d3568e32535bddae2523 Author: Michael Rash -Date: Sat Apr 26 23:01:47 2014 -0400 +Date: Sat Oct 4 21:14:49 2014 -0400 - [test suite] python fuzzer - more field length variations to hit MAX_SPA_MESSAGE_SIZE + [server] added WIFEXITED(status) check for external commands run via execvpe() - test/spa_fuzzing.py | 3 ++- + server/extcmd.c | 20 +++++++++++++++----- + server/extcmd.h | 2 ++ + 2 files changed, 17 insertions(+), 5 deletions(-) + +commit 841d732c0750aabbdea8fd7234bd7123b83bf858 +Author: Michael Rash +Date: Sat Oct 4 19:56:26 2014 -0400 + + [server] removed remaining popen() call for iptables firewalls + + server/fw_util_iptables.c | 66 +++++++++++++++++++---------------------------- + 1 file changed, 27 insertions(+), 39 deletions(-) + +commit 50952b4a6ec3b1cd6e8aeeebce8e95896f0d111a +Merge: 87f3bbd 4623212 +Author: Michael Rash +Date: Sat Oct 4 19:36:04 2014 -0400 + + Merge branch 'master' of https://github.com/mrash/fwknop into execvpe + +commit 87f3bbdd23ebb3af30a39df3011a5d01af352676 +Author: Michael Rash +Date: Sat Oct 4 16:40:44 2014 -0400 + + [server] hex_dump() '%' bug fix, minor verbose criteria update + + server/extcmd.c | 11 +++++++---- + server/utils.c | 15 ++++++++------- + 2 files changed, 15 insertions(+), 11 deletions(-) + +commit 46232122c35ed981fdf95f0f6289f08d8e794581 +Merge: 836370d e9655db +Author: Michael Rash +Date: Sat Oct 4 10:38:08 2014 -0400 + + Merge branch 'master' of https://github.com/mrash/fwknop + +commit 836370d034a308ee2de8c34754528e5c1d9d95f2 +Author: Michael Rash +Date: Sat Oct 4 10:32:52 2014 -0400 + + [client] minor tab->spaces fix + + client/config_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit d71f38697199d932e4d1c156642b9f99a047c62b +Author: Michael Rash +Date: Sat Oct 4 10:31:15 2014 -0400 + + [server] add search_extcmd() to replace all popen() calls with the execvpe() no env strategy + + server/extcmd.c | 152 +++++++++++++++++++++------------------------- + server/extcmd.h | 2 + + server/fw_util_iptables.c | 52 +++++++--------- + 3 files changed, 92 insertions(+), 114 deletions(-) + +commit e271442aa995188a21815e2b3573325c1bcb263a +Author: Michael Rash +Date: Fri Oct 3 21:58:51 2014 -0400 + + [server] first cut at converting iptables commands to use execvpe() + + client/fwknop.c | 1 - + client/fwknop_common.h | 4 -- + client/http_resolve_host.c | 6 +-- + client/utils.c | 65 +++++++++++++-------------- + client/utils.h | 1 - + common/common.h | 4 ++ + server/extcmd.c | 107 ++++++++++++++++++++++++++++++++++++++------- + server/extcmd.h | 6 ++- + server/fw_util_iptables.c | 39 +++++++++-------- + server/fw_util_iptables.h | 38 ++++++++-------- + server/incoming_spa.c | 6 +-- + server/utils.c | 93 +++++++++++++++++++++++++++++++++++++++ + server/utils.h | 9 ++-- + 13 files changed, 275 insertions(+), 104 deletions(-) + +commit 7aa34a92f1ad1b98998770bb422a9d7a16797a9f +Author: Michael Rash +Date: Tue Sep 30 22:33:44 2014 -0400 + + [client] add strtoargv() to easily get an argv array for passing to execvpe() + + client/fwknop.c | 27 ++++++-------------------- + client/http_resolve_host.c | 48 +++++++++------------------------------------- + client/utils.c | 43 +++++++++++++++++++++++++++++++++++++++++ + client/utils.h | 1 + + 4 files changed, 59 insertions(+), 60 deletions(-) + +commit bf3319e0bac513168aeaef084bbeae944d59bd30 +Author: Michael Rash +Date: Tue Sep 30 22:19:17 2014 -0400 + + [test suite] minor addition of spaces for --last tests + + test/test-fwknop.pl | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -commit 91a60b8d91afd7bc11902151a0ea8995ead31a70 +commit 0d6917fa4e123e37a3630536538d4dd29068a33f Author: Michael Rash -Date: Sat Apr 26 22:35:57 2014 -0400 +Date: Tue Sep 30 22:09:10 2014 -0400 - [test suite] libfko wrapper is already called in Rijndael tests + minor hex_dump() update to use a consistent macro definition for ascii str length - test/test-fwknop.pl | 7 ------- - 1 file changed, 7 deletions(-) + server/utils.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) -commit 367424ece5aaf0b0f4c9926e32b36b6d53e36d3a +commit 2247dfeab848db3a0b3b8d18457eae6300b51e8d Author: Michael Rash -Date: Sat Apr 26 22:03:32 2014 -0400 +Date: Tue Sep 30 21:59:01 2014 -0400 - [test suite] python fuzzer - account for base64 strings that have stripped '=' chars + use execvpe() with NULL env for wget calls - test/spa_fuzzing.py | 86 +++++++++++++++++++++++++++++------------------------ - 1 file changed, 47 insertions(+), 39 deletions(-) + client/fwknop.c | 40 ++++----------- + client/fwknop_common.h | 5 +- + client/http_resolve_host.c | 121 +++++++++++++++++++++++++++++++++++---------- + client/utils.c | 50 +++++++++++++++++++ + client/utils.h | 2 + + 5 files changed, 160 insertions(+), 58 deletions(-) -commit e00add778ed7f04791d8f9380da766deaa8e5874 +commit b1358d564deb39c0adc59e17dab3c2443ea52c9c Author: Michael Rash -Date: Sat Apr 26 17:03:47 2014 -0400 +Date: Tue Sep 30 21:34:58 2014 -0400 - [test suite] python fuzzer - add fuzzing fields to original fields (interim commit) + minor client --help update - test/spa_fuzzing.py | 51 ++++++++++++++++++++++++++++++++++++++++++--------- - 1 file changed, 42 insertions(+), 9 deletions(-) + client/config_init.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) -commit 1deccfd0053f5e4649dce697de7cd662a4cb47ec -Author: Michael Rash -Date: Thu Apr 24 22:11:04 2014 -0400 +commit e9655db0b42633bb27ba766a1ae1dd4535fdb91b +Merge: 9bdcd67 899729b +Author: Michael Rash +Date: Fri Oct 3 00:08:45 2014 -0400 - [test suite] python fuzzer - break out fuzzing sections into dedicated functions - - test/spa_fuzzing.py | 198 +++++++++++++++++++++++++++++++++++----------------- - 1 file changed, 134 insertions(+), 64 deletions(-) - -commit 4b11232249a89e4b917779546f6beee2d9e17a91 -Author: Michael Rash -Date: Wed Apr 23 23:31:37 2014 -0400 - - [test suite] add command mode SPA payload and splicing tests to python fuzzer - - test/spa_fuzzing.py | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -commit b9e2a42c5c55286017020d5048e76f375aac060f -Author: Michael Rash -Date: Tue Apr 22 23:48:13 2014 -0400 - - [test suite] support multiple initial SPA payloads in the python fuzzer - - test/spa_fuzzing.py | 121 +++++++++++++++++++++++++++++----------------------- - 1 file changed, 68 insertions(+), 53 deletions(-) - -commit cd8a2493a7d0679bc2c7e02d49ed46c3831972bf -Author: Michael Rash -Date: Tue Apr 22 23:20:06 2014 -0400 - - [test suite] python fuzzer additional tests - - test/spa_fuzzing.py | 65 ++++++++++++++++++++++++++++++++++++++++++++++++----- - 1 file changed, 60 insertions(+), 5 deletions(-) - -commit b28b8b5de124828f6987f26fc824a0a989c4f5b7 -Author: Michael Rash -Date: Tue Apr 22 21:58:09 2014 -0400 - - [libfko] fix double free bug in SPA parser + Merge pull request #135 from tombriden/multi_ports - This commit fixes a double free condition discovered through the new - python SPA payload fuzzer. This bug could be triggered in fwknopd with - a malicious SPA payload but only when GnuPG is used. When Rijndael is - used for SPA packet encryption, this bug cannot be triggered due to an - length/format check towards the end of _rijndael_decrypt(). It should - be noted that only a person in possession of the correct encryption and - authentication GnuPG keys could trigger this bug. + android: allow definition of multiple tcp/udp ports - lib/fko_decode.c | 7 +------ - 1 file changed, 1 insertion(+), 6 deletions(-) +commit 9bdcd6746a1c2ac33f324bb23cd1235a4d81e014 +Merge: 50434c5 dc30f16 +Author: Michael Rash +Date: Fri Oct 3 00:03:06 2014 -0400 -commit beb8df46432d46afe1b60bed132b03285fd86f0e + Merge pull request #137 from schuellerf/master + + Support for "--no-save-args" in .fwknoprc + +commit dc30f162c7d6e438f1eb82f757adb58dbfc7a8cd +Author: Florian Schüller +Date: Wed Oct 1 14:12:57 2014 +0200 + + Add "NO_SAVE_ARGS" to initial config file + + client/config_init.c | 1 + + 1 file changed, 1 insertion(+) + +commit 981d1f7077137a13de256b12d738e18860def88e +Author: Florian Schüller +Date: Wed Oct 1 14:12:10 2014 +0200 + + Support for "--no-save-args" in .fwknoprc + + client/config_init.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +commit 85ff6b25e145a938e618c4cf40739e89fa3082e0 Author: Michael Rash -Date: Tue Apr 22 21:00:16 2014 -0400 +Date: Tue Sep 30 21:12:43 2014 -0400 - [test suite] add python SPA packet payload fuzzer + updated --last-cmd tests to write the previous args first - test/spa_fuzzing.py | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 61 insertions(+) + test/test-fwknop.pl | 11 +++++++++++ + test/tests/rijndael.pl | 2 +- + test/tests/rijndael_hmac.pl | 2 +- + 3 files changed, 13 insertions(+), 2 deletions(-) -commit 63a59bf48b2cbea3755bb774b2007ffd8d881c54 +commit 2b046392b7e05ac20387bbcf539530a6559da50b (refs/remotes/origin/udp_listener) Author: Michael Rash -Date: Tue Apr 22 20:58:03 2014 -0400 +Date: Sun Sep 28 22:44:12 2014 -0400 - [test suite] add --enable-fuzzing-interfaces, fix profile coverage file handling + minor unused var removal - test/test-fwknop.pl | 135 +++++++++++++++++++++++----------------------------- - 1 file changed, 59 insertions(+), 76 deletions(-) + configure.ac | 2 -- + 1 file changed, 2 deletions(-) -commit f4a8c0fda84ec5ebafb68506ff0059f3dbeae396 +commit ddbba5bc90f105269a18d353e1e1b14bdff69299 Author: Michael Rash -Date: Fri Apr 18 21:39:54 2014 -0400 +Date: Sun Sep 28 22:40:50 2014 -0400 - [libfko] for fuzzing purposes, added fko_set_encoded_data() to bypass encryption and authentication for SPA payloads + autoconf update to ensure libpcap is not linked against in --enable-udp-server mode - lib/fko.h | 2 ++ - lib/fko_encode.c | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ - 2 files changed, 72 insertions(+) + configure.ac | 27 +++++++++++---------------- + server/Makefile.am | 2 +- + server/config_init.c | 8 ++++++++ + server/fwknopd.c | 5 ++++- + server/fwknopd_common.h | 8 ++++++-- + server/pcap_capture.c | 5 +++-- + server/process_packet.h | 2 +- + 7 files changed, 34 insertions(+), 23 deletions(-) + +commit 52d34a70a21d4e6d019d3a94bb84448051f87c29 +Author: Michael Rash +Date: Sun Sep 28 22:32:20 2014 -0400 + + fwknopd man page updates, added UDPSERV_SELECT_TIMEOUT config option + + configure.ac | 4 ++-- + doc/fwknopd.man.asciidoc | 29 +++++++++++++++++++++-------- + server/cmd_opts.h | 1 + + server/config_init.c | 8 ++++++++ + server/fwknopd_common.h | 3 +++ + server/udp_server.c | 12 ++++++++++-- + 6 files changed, 45 insertions(+), 12 deletions(-) + +commit 52c9d51d7d02e1caa0e02ea992fffcc435ae5845 +Author: Michael Rash +Date: Sun Sep 28 22:06:34 2014 -0400 + + consolidate signal handling a bit, UDP server msg size updates + + server/pcap_capture.c | 20 +++----------------- + server/sig_handler.c | 24 ++++++++++++++++++++++++ + server/sig_handler.h | 1 + + server/udp_server.c | 49 +++++++++++++++++-------------------------------- + 4 files changed, 45 insertions(+), 49 deletions(-) + +commit e2c2ad141e87b6b799525c3f91b80a294bc117f2 +Author: Michael Rash +Date: Sun Sep 28 22:06:06 2014 -0400 + + TCP/UDP server port validation tests + + test/tests/basic_operations.pl | 32 ++++++++++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +commit ad3b23091720be83c9f8ccb742cf10ea07fe7cf6 +Author: Michael Rash +Date: Sun Sep 28 21:21:25 2014 -0400 + + minor client cmd line bug fix for UDP server HMAC test + + test/tests/rijndael_hmac.pl | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +commit 360905ec5624edb927f708561acfb9f76e6c9423 +Author: Michael Rash +Date: Sun Sep 28 21:19:19 2014 -0400 + + implement --packet-limit for UDP server mode + + server/udp_server.c | 43 ++++++++++++++++++++++++++++++------------ + test/tests/basic_operations.pl | 8 ++++++++ + 2 files changed, 39 insertions(+), 12 deletions(-) + +commit a5dd273189a89071f25cae9954ae11a840e2e488 +Author: Michael Rash +Date: Sun Sep 28 20:48:57 2014 -0400 + + replay attack detection test for UDP server mode + + test/tests/rijndael_replay_attacks.pl | 9 +++++++++ + 1 file changed, 9 insertions(+) + +commit 5db3a12763b1322cc466379e14a362f67ff4d15c +Author: Michael Rash +Date: Sun Sep 28 20:30:09 2014 -0400 + + add signal handling code to UDP server mode + + server/fwknopd.c | 17 +++++++++++------ + server/pcap_capture.c | 1 - + server/udp_server.c | 31 ++++++++++++++++++++++++++++++- + 3 files changed, 41 insertions(+), 8 deletions(-) + +commit aa2492bba237529e6a2b7dc3a4530e2995750a69 +Author: Michael Rash +Date: Sun Sep 28 16:51:38 2014 -0400 + + Added UDP server HMAC cycle tests + + test/tests/rijndael_hmac.pl | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +commit 0af7f72500c6bb404af3fefa5b572403ec2593e5 +Author: Michael Rash +Date: Sun Sep 28 16:49:12 2014 -0400 + + enforce MAX_SPA_PACKET_LEN restriction for incoming datagrams for UDP listener mode + + server/udp_server.c | 32 +++++++------------------------- + 1 file changed, 7 insertions(+), 25 deletions(-) + +commit dc9e8da702c61c36f04072f2dd6cb5d8f99f8f5d +Author: Michael Rash +Date: Sun Sep 28 14:54:40 2014 -0400 + + started on UDP server tests for Rijndael mode + + test/conf/udp_server_fwknopd.conf | 2 ++ + test/test-fwknop.pl | 1 + + test/tests/rijndael.pl | 21 +++++++++++++++++++++ + 3 files changed, 24 insertions(+) + +commit f2a3562f712d511825967b5d3633cbf92abd9fad +Author: Michael Rash +Date: Sun Sep 28 11:49:24 2014 -0400 + + removed + + server/udp_server.c.orig | 117 ----------------------------------------------- + 1 file changed, 117 deletions(-) + +commit 1fd0e7e96012d9bdce0a2a3912bff3498fff3637 +Author: Michael Rash +Date: Sun Sep 28 11:49:04 2014 -0400 + + first cut at UDP server mode + + configure.ac | 24 ++++++ + server/Makefile.am | 13 ++- + server/cmd_opts.h | 3 + + server/config_init.c | 15 ++++ + server/fwknopd.c | 22 ++++- + server/fwknopd_common.h | 6 ++ + server/pcap_capture.c | 5 ++ + server/process_packet.h | 2 + + server/udp_server.c | 211 +++++++++++++++++++++++++++++++++++++++++++++++ + server/udp_server.c.orig | 117 ++++++++++++++++++++++++++ + server/udp_server.h | 40 +++++++++ + 11 files changed, 451 insertions(+), 7 deletions(-) + +commit c07afac8833e0c46048a1ae34a8a96f19fa6a59e +Author: Michael Rash +Date: Sun Sep 28 09:29:30 2014 -0400 + + calculate sizeof caddr for each client connection + + server/tcp_server.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +commit 50434c5c4c9fe274430c560f83200061e545add2 +Author: Michael Rash +Date: Sat Sep 27 23:23:12 2014 -0400 + + Use the fwknop User-Agent for wget SSL external IP resolutions + + Bug fix to ensure that a User-Agent string can be specified when the + fwknop client uses wget via SSL to resolve the external IP address. This + closes issue #134 on github reported by Barry Allard. The fwknop now + uses the wget '-U' option to specify the User-Agent string with a + default of "Fwknop/". In addition, a new command line argument + "--use-wget-user-agent" to allow the default wget User-Agent string to + apply instead. + + CREDITS | 2 ++ + ChangeLog | 9 ++++++++- + client/cmd_opts.h | 2 ++ + client/config_init.c | 15 +++++++++++++++ + client/fwknop.8.in | 29 +++++++++++++++++++++++++++-- + client/fwknop_common.h | 3 ++- + client/http_resolve_host.c | 13 +++++++++++++ + doc/fwknop.man.asciidoc | 11 +++++++++++ + test/conf/fwknoprc_hmac_https_resolve | 1 + + test/tests/basic_operations.pl | 13 +++++++++++++ + test/tests/rijndael_hmac.pl | 14 +++++++++++++- + 11 files changed, 107 insertions(+), 5 deletions(-) + +commit 899729b498de672dccf14c461bc60fee588d0c09 +Author: Tom Briden +Date: Sat Sep 27 11:14:10 2014 +0100 + + android: allow definition of multiple tcp/udp ports + + android/project/res/layout/main.xml | 19 +++--- + .../src/com/max2idea/android/fwknop/Fwknop.java | 76 ++++++++++++---------- + 2 files changed, 52 insertions(+), 43 deletions(-) + +commit aae72a947026d96a43fe854079e92b9a31ad8b36 +Author: Michael Rash +Date: Wed Sep 3 23:28:51 2014 -0400 + + firewalld support from Gerry Reno + + CREDITS | 3 +++ + ChangeLog | 7 +++++++ + 2 files changed, 10 insertions(+) + +commit f7f97d3f3004ed553d418c95f9cefa6675bea338 +Author: Michael Rash +Date: Wed Sep 3 23:15:34 2014 -0400 + + [server] firewalld reports 'success' as a string upon command success in contrast to iptables + + server/fw_util_firewalld.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +commit 4fe549c4512ddd21d86bdcea52041baa48aa1dda +Author: Gerry Reno +Date: Sun Aug 31 21:13:42 2014 -0400 + + added feature: firewalld + + README.md | 4 ++++ + 1 file changed, 4 insertions(+) + +commit 2da57da0cb3ec3fac6ec0f5de628d7c3eb2ea0cf +Author: Gerry Reno +Date: Sun Aug 31 16:13:46 2014 -0400 + + more changes for firewalld + + server/fw_util_firewalld.c | 8 +++++++- + server/fw_util_firewalld.h | 38 +++++++++++++++++++------------------- + 2 files changed, 26 insertions(+), 20 deletions(-) + +commit ac82b1ced2b976d8010d73cc2786503b14a73641 +Author: Gerry Reno +Date: Sun Aug 31 13:51:08 2014 -0400 + + more changes for firewalld + + .gitignore | 25 ++++--- + server/Makefile.am | 1 + + server/access.c | 30 ++++++++- + server/cmd_opts.h | 19 +++++- + server/config_init.c | 150 ++++++++++++++++++++++++++++++++++++++++- + server/fw_util_firewalld.c | 162 ++++++++++++++++++++++----------------------- + server/fw_util_firewalld.h | 2 +- + server/fwknopd.conf | 110 ++++++++++++++++++++++++++++++ + server/fwknopd_common.h | 91 +++++++++++++++++++++++-- + server/incoming_spa.c | 12 +++- + 10 files changed, 501 insertions(+), 101 deletions(-) + +commit d47ebb602a8f42b42031ecfadfaf29f37a6c6829 +Author: Gerry Reno +Date: Sun Aug 31 02:23:39 2014 -0400 + + more changes for firewalld + + .gitignore | 29 +++++++++++++++++++++++++++++ + server/access.c | 6 +++--- + server/cmd_opts.h | 2 +- + server/config_init.c | 6 ++++-- + server/fw_util.h | 4 +++- + server/fw_util_firewalld.h | 2 +- + server/fwknopd_common.h | 8 ++++---- + server/incoming_spa.c | 2 +- + 8 files changed, 46 insertions(+), 13 deletions(-) + +commit 25d252c11aea89a5ba5f46868847c72851a62a95 +Author: Gerry Reno +Date: Sun Aug 31 00:29:17 2014 -0400 + + more changes for firewalld + + README.md | 9 ++++++--- + configure.ac | 39 ++++++++++++++++++++++++++++++++++----- + fwknop.spec | 10 +++++----- + server/fw_util_firewalld.h | 38 +++++++++++++++++++------------------- + 4 files changed, 64 insertions(+), 32 deletions(-) + +commit e54383b518fad5e0a31ae0f752d3c3c7ec70f16c +Author: Gerry Reno +Date: Sun Aug 31 00:06:37 2014 -0400 + + first cut at firewalld + + server/fw_util_firewalld.c | 1583 ++++++++++++++++++++++++++++++++++++++++++++ + server/fw_util_firewalld.h | 62 ++ + 2 files changed, 1645 insertions(+) + +commit ea64f15ae7b73a3986807dd76bf9076756b691e8 +Author: Gerry Reno +Date: Sat Aug 30 19:09:02 2014 -0400 + + added .gitignore + + .gitignore | 43 +++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 43 insertions(+) + +commit 73186e511ae226f4e5e1dae5638567ecea788fbc +Author: Damien Stuart +Date: Sat Aug 30 16:18:46 2014 -0400 + + Added WIN32 definitions for popen (_popen) and pclose (_pclose) to accommodate the call to wget on Windows-based systems. + + common/common.h | 2 ++ + win32/config.h | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +commit 8cec7eaeee14f2674a2acf095eff38735091147b +Merge: eb0e8eb 4aacf32 +Author: Michael Rash +Date: Tue Aug 26 23:23:31 2014 -0400 + + Merge branch 'master' of ssh://github.com/mrash/fwknop + +commit 4aacf32f3b015e43316d76c40fe12bbcb0a9c838 +Merge: 00a057a 813e4e0 +Author: Michael Rash +Date: Tue Aug 26 23:22:15 2014 -0400 + + Merge pull request #127 from g-reno/android-keypreserve + + restore keys from prefs when app is launched + +commit eb0e8eb6a1946c2e89ff66399e186d54535bf013 +Author: Michael Rash +Date: Tue Aug 26 23:21:14 2014 -0400 + + fwknopd man page updates for access.conf vars + + client/config_init.c | 9 +++++---- + doc/fwknopd.man.asciidoc | 44 +++++++++++++++++++++++++++++--------------- + server/fwknopd.8.in | 48 +++++++++++++++++++++++++++++++++--------------- + 3 files changed, 67 insertions(+), 34 deletions(-) + +commit 00a057a09da1a7dded8aa6de6479adcc51787202 +Author: Michael Rash +Date: Thu Aug 21 21:15:09 2014 -0400 + + ChangeLog update for FCS bug fix + + CREDITS | 10 ++++++++++ + ChangeLog | 11 +++++++++++ + 2 files changed, 21 insertions(+) + +commit dfcfb2e47b37183c14bd8ab37ec0e8c2a718c186 +Author: Michael Rash +Date: Thu Aug 21 21:08:27 2014 -0400 + + minor code restructure for Ethernet FCS header processing + + server/process_packet.c | 14 +++----------- + server/process_packet.h | 1 + + 2 files changed, 4 insertions(+), 11 deletions(-) + +commit e04f3fef21c997f2359034d32c1bd9c23d363ebe +Author: Michael Rash +Date: Thu Aug 21 21:07:52 2014 -0400 + + added Ethernet FCS header test with pcap contributed by Bill Stubs + + test/test-fwknop.pl | 1 + + test/tests/rijndael_hmac.pl | 13 +++++++++++++ + 2 files changed, 14 insertions(+) + +commit ba9078d990258ad47b564579be4891bd2ace7413 +Merge: e4eb984 2c0606f +Author: Michael Rash +Date: Thu Aug 21 20:44:48 2014 -0400 + + Merge branch 'beaglebone_libpcap_workaround' of https://github.com/stubbsw/fwknop into stubbsw-beaglebone_libpcap_workaround + +commit 813e4e05756ff6fea3ea4b4baeb1af93aeb33e34 +Author: Gerry Reno +Date: Thu Aug 21 18:16:00 2014 -0400 + + restore keys from prefs when app is launched + + android/project/src/com/max2idea/android/fwknop/Fwknop.java | 3 +++ + 1 file changed, 3 insertions(+) + +commit 2c0606f2b84c28ea7b53c2f3d7bcec46705fbcf5 +Author: stubbsw +Date: Thu Aug 21 07:04:55 2014 -0400 + + pcap of spa with Ethernet FCS + + Captured with: + tcpdump -i eth0 -l -nn -s 0 -w fcs_spa.pcap udp port 62201 + + Generated remotely with: + LD_LIBRARY_PATH=./lib/.libs ./client/.libs/fwknop -A tcp/22 -a 127.0.0.2 + -D 192.168.18.11 --no-save-args --verbose --verbose --rc-file + ./test/conf/fwknoprc_default_hmac_base64_key + + test/conf/fcs_spa.pcap | Bin 0 -> 311 bytes + 1 file changed, 0 insertions(+), 0 deletions(-) + +commit e4eb984869f41f04bd2fd9f50a4e2803a1a29fb0 +Merge: 36489b5 19f31c3 +Author: Michael Rash +Date: Wed Aug 20 23:20:40 2014 -0400 + + Merge pull request #125 from stubbsw/beaglebone_libpcap_workaround + + workaround libpcap 4 extra bytes + +commit 19f31c3e2300226f8414b2d050315190168cf6d9 +Author: stubbsw +Date: Tue Aug 19 06:54:18 2014 -0400 + + update to indicate Ethernet FCS support vs. bug + + server/process_packet.c | 26 +++++++++++--------------- + 1 file changed, 11 insertions(+), 15 deletions(-) + +commit b98579ab8f23b436b54fa0a0a3371ec71362f827 +Author: stubbsw +Date: Sun Aug 17 11:50:56 2014 -0400 + + workaround libpcap 4 extra bytes + + Workaround for libpcap returning a length that is 4 bytes longer than + the + packet on the wire. Observed on: + + Linux beaglebone 3.8.13-bone50 #1 SMP Tue May 13 13:24:52 UTC 2014 + armv7l GNU/Linux + ldd fwknopd + libfko.so.2 => /usr/local/lib/libfko.so.2 (0xb6f62000) + libpcap.so.0.8 => /usr/lib/arm-linux-gnueabihf/libpcap.so.0.8 + (0xb6f20000) + libc.so.6 => /lib/arm-linux-gnueabihf/libc.so.6 (0xb6e3b000) + /lib/ld-linux-armhf.so.3 (0xb6f94000) + libgcc_s.so.1 => /lib/arm-linux-gnueabihf/libgcc_s.so.1 (0xb6e17000) + + Calculate the new pkt_end from the length in the ip header. + + server/process_packet.c | 27 +++++++++++++++++++++++++++ + 1 file changed, 27 insertions(+)