diff --git a/ChangeLog b/ChangeLog index bd138e7b..f71f8423 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,15 +1,36 @@ fwknop-2.6.8 (12/23/2015): - - [server] open/close functionality... + - [server] Added a major new feature that allows fwknopd to easily + integrate with third-party devices and software. This done through the + addition of a generic "command open" and "command close" capability, and + a set of variable substitutions are supported such as '$SRC', '$PORT', + and '$PROTO'. This feature is designed to allow the user to switch out + the default firewall - iptables, firewalld, ipfw, or PF - for something + complete different. For example, here is a write-up on using this feature + to integrate SPA operations with ipset: + + https://cipherdyne.org/blog/2015/12/single-packet-authorization-and-third-party-devices.html + + - [server] (Jonathan Bennett) Added new access.conf directives + '%include ' and '%include_folder '. This allows more + access stanzas to be defined in other locations in the filesystem, and + this can be adventageous in some scenarios by letting non-privledged + users define their own encryption and authentication keys for SPA + operations. This way, users do not need write access to the main + /etc/fwknop/access.conf file to change keys around or define new ones. - [server] Bug fix to not send the TCP server a TERM signal even when it is not running when fwknopd receives a HUP signal. - - [libfko] Bug fix for a crash that could be triggered in fko_set_username() - when a username that is 64 chars or longer is specified. This crash - cannot be triggered in fwknopd even if an SPA packet contains such a - username however due to additional protections in the SPA decoding - routines. Further, this bug does not apply to the main fwknop client - either because the maximal username size is truncated down below 64 - bytes. Hence, this bug only applies to client-side software that is - directly using libfko calling the fko_set_username() function. + - [libfko] Bug fix for a crash that could be triggered in + fko_set_username() when a username that is 64 chars or longer is + specified. This crash cannot be triggered in fwknopd even if an SPA + packet contains such a username however due to additional protections in + the SPA decoding routines. Further, this bug does not apply to the main + fwknop client either because the maximal username size is truncated down + below 64 bytes. Hence, this bug only applies to client-side software that + is directly using libfko calling the fko_set_username() function. + - [test suite] Code coverage is now at 90.7% counted by lines. The complete + coverage report for the 2.6.8 release is available here: + + https://www.cipherdyne.org/fwknop/lcov-results/ fwknop-2.6.7 (08/24/2015): - [server] When command execution is enabled with ENABLE_CMD_EXEC for an diff --git a/ChangeLog.git b/ChangeLog.git index 9866963e..a53bb942 100644 --- a/ChangeLog.git +++ b/ChangeLog.git @@ -1,1750 +1,1318 @@ -commit 88c82af1955fb56ade5c6d6e98e80ed28df21ea2 (HEAD, refs/heads/master) +commit 9c54d774f6bc5cdda5ea44ff2328b6004eda3526 (HEAD -> refs/heads/master, refs/remotes/moria/master) Author: Michael Rash -Date: Mon Aug 24 17:33:44 2015 -0700 +Date: Wed Dec 23 11:47:17 2015 -0500 - rpm 2.6.7 release note + [docs] man page updates - fwknop.spec | 3 +++ - 1 file changed, 3 insertions(+) + client/fwknop.8.in | 8 +++---- + doc/fwknop.man.asciidoc | 11 +++++---- + doc/fwknopd.man.asciidoc | 57 ++++++++++++++++++++++++++++++----------------- + server/fwknopd.8.in | 58 ++++++++++++++++++++++++++++++++++++++++-------- + 4 files changed, 97 insertions(+), 37 deletions(-) -commit ecfa8021e58447db656043915e131d6798ee8651 (refs/remotes/origin/master, refs/remotes/origin/HEAD) +commit fcb0102d69e23128c85749f22547d98de3b9efad Author: Michael Rash -Date: Mon Aug 24 17:25:06 2015 -0700 +Date: Wed Dec 23 10:56:41 2015 -0500 - doc updates to include sudo information - - client/fwknop.8.in | 4 ++-- - doc/fwknopd.man.asciidoc | 38 ++++++++++++++++++++++++------------- - server/fwknopd.8.in | 49 +++++++++++++++++++++++++++++++++++++++++++++--- - 3 files changed, 73 insertions(+), 18 deletions(-) - -commit 71ded8caf1770b067d3425f5a5f87ed7984c99c5 -Author: Michael Rash -Date: Mon Aug 24 17:23:40 2015 -0700 - - ChangeLog update for 2.6.7 - - ChangeLog | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -commit c04feff5ef6c9e69e6f22bee9b2cfb75e5fb04e5 -Author: Michael Rash -Date: Sun Aug 23 20:50:24 2015 -0700 - - [test suite] initialize coverage files in non --include mode - - test/test-fwknop.pl | 14 ++++++-------- - 1 file changed, 6 insertions(+), 8 deletions(-) - -commit b060495bb4a21fafa7544739a42eefd488e887f3 -Author: Michael Rash -Date: Sun Aug 23 20:32:59 2015 -0700 - - [test suite] rm previous coverage files in coverage mode when --include criteria is not used - - Makefile.am | 1 + - test/init-lcov.sh | 3 +++ - test/rm-coverage-files.sh | 12 ++++++++++++ - test/test-fwknop.pl | 8 ++++++++ - 4 files changed, 24 insertions(+) - -commit 9531099a1fba4b30ff3a6b5b7db98ab0cf6a69c5 -Author: Michael Rash -Date: Sun Aug 23 20:08:17 2015 -0700 - - [test suite] use pkill when available - - test/test-fwknop.pl | 16 +++++++++++----- - 1 file changed, 11 insertions(+), 5 deletions(-) - -commit b88d1854ed311f8a60e325f57d22ea3056fbafb8 -Author: Michael Rash -Date: Sat Aug 22 23:20:59 2015 -0400 - - minor link comment fix - - README.md | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit fab2f8e591f4617b14b8c514f5513d7b292de40c -Author: Michael Rash -Date: Sat Aug 22 23:18:12 2015 -0400 - - minor README update - - README.md | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - -commit d1d59778e95b2ff7737a731698e7b98fc96e6d1d -Author: Michael Rash -Date: Fri Aug 21 23:06:07 2015 -0400 - - [server] handle trailing quote for PF firewalls on OpenBSD - - server/fw_util_pf.c | 3 +++ - server/utils.c | 11 +++++++++-- - server/utils.h | 1 + - 3 files changed, 13 insertions(+), 2 deletions(-) - -commit fe9e42f2121aac76d1d939b38aef3b5cc6773c70 -Author: Michael Rash -Date: Fri Aug 21 22:29:35 2015 -0400 - - [test suite] minor sudo error code searching update - - test/tests/rijndael_hmac_cmd_exec.pl | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -commit dd1528c829ea97faa04157e030270b27ae8d8246 -Author: Michael Rash -Date: Fri Aug 21 22:24:45 2015 -0400 - - [test suite] set sudo path on the fwknopd command line - - server/config_init.c | 6 ++++-- - test/test-fwknop.pl | 5 +++++ - test/tests/basic_operations.pl | 16 ++++++++++++++++ - 3 files changed, 25 insertions(+), 2 deletions(-) - -commit e999f61f82930254ef81f3b06de141e08a6f562a -Author: Michael Rash -Date: Fri Aug 21 22:04:58 2015 -0400 - - [test suite] allow /usr/local/etc/sudoers path - - test/test-fwknop.pl | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -commit f37fd2281607c68463311e06433db52f906c35e6 -Author: Michael Rash -Date: Fri Aug 21 21:49:07 2015 -0400 - - [extras] use default configure args before running cov-build - - extras/coverity/coverity_scan.sh | 1 + - 1 file changed, 1 insertion(+) - -commit 2f94413b2fa4132f50dfca055e9fb15a5e633b85 -Author: Michael Rash -Date: Fri Aug 21 21:35:10 2015 -0400 - - [server] bug fix for ipfw firewall rule removal - - server/fw_util_ipfw.c | 1 + - 1 file changed, 1 insertion(+) - -commit ec9eef33654b596a3e863176e2b61a4ee32c51d8 -Author: Michael Rash -Date: Wed Aug 19 23:41:47 2015 -0400 - - [server] fix a dead code condition spotted by Coverity - - server/fw_util_firewalld.c | 23 ++++++++++++----------- - server/fw_util_iptables.c | 23 ++++++++++++----------- - 2 files changed, 24 insertions(+), 22 deletions(-) - -commit c5507d2c2a49aaac30582d51701e8a74b398a6fc -Author: Michael Rash -Date: Wed Aug 19 23:41:17 2015 -0400 - - [server] fix ptr vs. val check spotted by Coverity - - server/incoming_spa.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit 82464574a6d07108dce57d2ca5873b8863861381 -Author: Michael Rash -Date: Tue Aug 18 22:12:23 2015 -0400 - - [client] minor update to make chksum() static - - client/spa_comm.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit 423899f3c47122a1246a335d7abf978f1773abad -Author: Michael Rash -Date: Tue Aug 18 22:02:00 2015 -0400 - - [server] minor fix to remove unnecessary var definition - - server/fw_util_firewalld.c | 1 - - server/fw_util_iptables.c | 1 - - 2 files changed, 2 deletions(-) - -commit 0fdc263a435a7ffe9e805b0ec2f1a9669406c7b5 -Author: Michael Rash -Date: Tue Aug 18 21:58:53 2015 -0400 - - options struct should not be global (CLANG -Wshadow warning) - - client/fwknop_common.h | 2 -- - server/fwknopd_common.h | 5 ++--- - 2 files changed, 2 insertions(+), 5 deletions(-) - -commit a9c3e204dcf3714e1a891193a420f299438817f5 -Author: Michael Rash -Date: Tue Aug 18 20:40:14 2015 -0400 - - [test suite] pgrep usage bug fix - - test/test-fwknop.pl | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -commit 47ff151dea9ba469a39753943e0aa472c668f5b0 -Author: Michael Rash -Date: Tue Aug 18 20:37:56 2015 -0400 - - [build] add convenience script for ASan builds - - Sometimes when ASan support is wanted for fwknop, the following compile - error can be generated. This script provides a means to solve this. - - fwknop-spa_comm.o: In function `send_spa_packet_http': - /home/mbr/git/fwknop.git/client/spa_comm.c:516: undefined reference to `rpl_malloc' - ../lib/.libs/libfko.so: undefined reference to `rpl_realloc' - - Makefile.am | 1 + - extras/sanitizer/asan-build.sh | 21 +++++++++++++++++++++ - 2 files changed, 22 insertions(+) - -commit 5e0a668a7f61e04eddd4b7dd4ec8273c543b1e0a -Author: Michael Rash -Date: Sun Aug 16 21:31:48 2015 -0400 - - [server] minor access.c fix to quiet both Coverity and the CLANG static analyzer - - server/access.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit 8edad8b5839acaf82f51631d40031f3c39bc619a -Author: Michael Rash -Date: Sun Aug 16 21:27:14 2015 -0400 - - [extras] update Coverity version to 7.7.0 for interface script - - extras/coverity/coverity_scan.sh | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit f3b25bdc241e6410ef5f99bcb2257911622ec4bd -Author: Michael Rash -Date: Sun Aug 16 21:06:26 2015 -0400 - - [test suite] require custom config paths for sudo tests - - test/test-fwknop.pl | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -commit 743d861c6713e6456e71267f107681c8485a2db5 -Author: Damien Stuart -Date: Fri Aug 14 16:49:07 2015 -0400 - - Updated version in the spec file. - - fwknop.spec | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit e5c6f96788a57695e3d6c293cd0ebaa69563e167 -Author: Michael Rash -Date: Sat Jul 25 23:10:06 2015 -0400 - - [server] fix compilation issue for non-iptables firewalls - - server/fw_util_ipf.c | 3 ++- - server/fw_util_ipfw.c | 3 ++- - server/fw_util_pf.c | 3 ++- - 3 files changed, 6 insertions(+), 3 deletions(-) - -commit 47851dffddb25e3eb9a22ec54394adbc79bfe56f -Author: Michael Rash -Date: Sat Jul 25 19:17:10 2015 -0700 - - [test suite] use pgrep for fwknopd check at init time - - test/test-fwknop.pl | 28 ++++++++++++++++++++++++---- - 1 file changed, 24 insertions(+), 4 deletions(-) - -commit 8e7dd29280f0078a64acc6030a20e0ac0d3a23eb -Merge: 72555ba db3a8c3 -Author: Michael Rash -Date: Sat Jul 25 19:00:48 2015 -0700 - - Merge branch 'master' of ssh://192.168.10.1/home/mbr/git/fwknop - -commit 72555ba9fec3af9d734a383ce98050a84bb7b5bd -Author: Michael Rash -Date: Sat Jul 25 18:58:39 2015 -0700 - - [server] minor comment fix for group ID determination in access.conf parsing - - server/access.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -commit fbdc542f48c45d8b7e466e31f1b3c099b75fec1c -Merge: c0330e5 dff7b82 -Author: Michael Rash -Date: Sat Jul 25 13:28:49 2015 -0700 - - Merge branch 'master' of https://github.com/mrash/fwknop - -commit db3a8c39e4f7930ea59a1acf733d0cad62745f63 -Merge: c0330e5 dff7b82 -Author: Michael Rash -Date: Sat Jul 25 16:28:23 2015 -0400 - - Merge branch 'master' of https://github.com/mrash/fwknop - -commit c0330e5c8b604fb50330dfbe60fdf305393250c4 -Author: Michael Rash -Date: Sat Jul 25 13:27:42 2015 -0700 - - [server] additional work on splitting incoming_spa() loop into functions - - server/incoming_spa.c | 606 +++++++++++++++++++++++++++++--------------------- - 1 file changed, 354 insertions(+), 252 deletions(-) - -commit 591d400216f40f16b3aa116e938130130fb7929e -Author: Michael Rash -Date: Sat Jul 25 13:26:50 2015 -0700 - - [test suite] fix sudo user tests - - test/test-fwknop.pl | 4 ++-- - test/tests/rijndael_hmac_cmd_exec.pl | 8 +------- - 2 files changed, 3 insertions(+), 9 deletions(-) - -commit 3270900a3813a521be6a83a8274baa2101fa6588 -Author: Michael Rash -Date: Sun Jul 19 21:54:20 2015 -0700 - - [server] continued work on splitting incoming_spa() into functions - - server/incoming_spa.c | 351 ++++++++++++++++++++++++++------------------------ - 1 file changed, 186 insertions(+), 165 deletions(-) - -commit 6116419e212a7f65ca658473e0617f073d303495 -Author: Michael Rash -Date: Sun Jul 19 20:38:23 2015 -0700 - - [test suite] ensure HMAC key string is equal to SHA512_BLOCK_LEN in length (fixes ASAN warning) - - test/fko-wrapper/fko_wrapper.c | 12 ++++++++++-- - 1 file changed, 10 insertions(+), 2 deletions(-) - -commit dff7b82dafbab8276add503c5011ef6d2ed6dbb0 -Merge: 89b2e8f 0ac52b9 -Author: Michael Rash -Date: Wed Jul 22 11:06:08 2015 -0400 - - Merge pull request #166 from micha137/patch-1 - -commit 01beb31861a8fdfb4555cce73e4d02139fc946a1 -Author: Michael Rash -Date: Sun Jul 19 20:35:54 2015 -0700 - - [server] start to split incoming_spa() main loop into functions - - server/incoming_spa.c | 388 +++++++++++++++++++++++++++++--------------------- - 1 file changed, 223 insertions(+), 165 deletions(-) - -commit d681485e2921020fddd4678a2f2bf93dfc15e92d -Author: Michael Rash -Date: Sun Jul 19 20:23:04 2015 -0700 - - [server] add sudo support, closes #159 - - ChangeLog | 11 ++- - doc/fwknopd.man.asciidoc | 2 +- - server/access.c | 125 +++++++++++++++++++++------ - server/config_init.c | 13 +++ - server/extcmd.c | 4 +- - server/fwknopd_common.h | 4 + - server/incoming_spa.c | 51 ++++++++--- - test/test-fwknop.pl | 124 ++++++++++++++++++++++++--- - test/tests/rijndael_hmac_cmd_exec.pl | 162 ++++++++++++++++++++++++++++++++++- - 9 files changed, 442 insertions(+), 54 deletions(-) - -commit 0ac52b9b4d8a332671c8d1c75e74bd0527442f97 -Author: micha137 -Date: Tue Jul 21 18:39:43 2015 +0200 - - Fix some typos - - server/fwknopd.conf | 30 +++++++++++++++--------------- - 1 file changed, 15 insertions(+), 15 deletions(-) - -commit 89b2e8f477245bf6fdf1d2746c829f9ba26faf15 -Author: Michael Rash -Date: Sat Jul 18 13:11:25 2015 -0700 - - [server] interface goes down will cause fwknopd to exit - - By default, fwknopd will now exit if the interface that it is - sniffing goes down (patch contributed by Github user 'sgh7'). If this - happens, it is expected that the native process monitoring feature in - things like systemd or upstart will restart fwknopd. However, if fwknopd - is not being monitored by systemd, upstart, or anything else, this - behavior can be disabled with the EXIT_AT_INTF_DOWN variable in the - fwknopd.conf file. If disabled, fwknopd will try to recover when a - downed interface comes back up. - - CREDITS | 6 +++++ - ChangeLog | 8 ++++++ - Makefile.am | 1 + - doc/fwknopd.man.asciidoc | 9 +++++++ - server/cmd_opts.h | 1 + - server/config_init.c | 7 +++++ - server/fwknopd_common.h | 2 ++ - server/pcap_capture.c | 3 ++- - test/conf/no_exit_down_intf_fwknopd.conf | 1 + - test/test-fwknop.pl | 46 +++++++++++++++++++++++++++----- - test/tests/basic_operations.pl | 20 ++++++++++++++ - 11 files changed, 96 insertions(+), 8 deletions(-) - -commit 15c00692b7070eb0807b4f86d43d02b44de40296 -Merge: 795b1de 8647854 -Author: Michael Rash -Date: Sat Jul 18 23:43:00 2015 -0400 - - Merge pull request #164 from Coacher/master - -commit 8647854efe986d7b8bcab5a3dbe6e7541c46713f -Author: Ilya Tumaykin -Date: Sun Jul 19 06:18:54 2015 +0300 - - extras: add systemd unit file and tmpfiles.d configuration for fwknopd - - extras/systemd/fwknopd.service | 12 ++++++++++++ - extras/systemd/fwknopd.tmpfiles.conf | 1 + - 2 files changed, 13 insertions(+) - -commit 795b1de4ddeeed3c2331ec69f60f66253e04a055 -Author: Michael Rash -Date: Sat Jul 18 10:37:17 2015 -0700 - - [server] Added RULES_CHECK_THRESHOLD to define 'deep' rule expiration check frequency - - The RULES_CHECK_THRESHOLD variable defines the number of times firewall rule - expiration times must be checked before a "deep" check is run. This allows - fwknopd to remove rules that contain a proper '_exp_