From b937ae234730241a25144b63ed1eadf3291da642 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Sun, 21 Aug 2011 14:02:25 -0400 Subject: [PATCH] Added version specific ChangeLog, ShortLog, and diffstat files. Added version specific ChangeLog, ShortLog, and diffstat files (these go all the way back to the beginning of the svn import since 2.0.0 will be the first official non-"rc" release of the new C code). --- ChangeLog-v2.0.0 | 3020 ++++++++++++++++++++++++++++++++++++++++++++++ ShortLog-v2.0.0 | 654 ++++++++++ diffstat-v2.0.0 | 1310 ++++++++++++++++++++ 3 files changed, 4984 insertions(+) create mode 100644 ChangeLog-v2.0.0 create mode 100644 ShortLog-v2.0.0 create mode 100644 diffstat-v2.0.0 diff --git a/ChangeLog-v2.0.0 b/ChangeLog-v2.0.0 new file mode 100644 index 00000000..0f75ddf9 --- /dev/null +++ b/ChangeLog-v2.0.0 @@ -0,0 +1,3020 @@ +commit 35456877fa257889c7d894cc24c98fba06106ca6 +Author: Michael Rash +Date: Sun Aug 21 13:50:16 2011 -0400 + + Bug fix for ipfw firewalls to not always require seeing 'Dynamic' rules + + This commit fixes an issue on ipfw firewalls where fwknopd would always require + seeing ipfw 'Dynamic' rules associated with newly added connections. But, such + connections may never be established for various reasons. Previous to this + commit the following warning was frequently generated by fwknopd: + + Unexpected error: did not find 'Dynamic rules' string in list output. + +commit 4b2a96578bcc8ba07371989dcc124ef42813acea +Author: Michael Rash +Date: Sun Aug 21 13:28:16 2011 -0400 + + Bug fix for missing set existence check on ipfw firewalls + + This commit fixes an issues on systems running the ipfw firewall where the + 'set' where fwknopd puts new access rules was attempted to be deleted without + first checking to see whether it exists. The following errors would be + generated (now fixed): + + ipfw: rule 16777217: setsockopt(IP_FW_DEL): Invalid argument + Error 17664 from cmd:'/sbin/ipfw delete set 1': + Fatal: Errors detected during ipfw rules initialization. + +commit 03859387b6667839d8eb6eaf1601e2c14c24d355 +Author: Michael Rash +Date: Sat Aug 20 22:34:24 2011 -0400 + + Bug fix to create the digest.cache file at init + + Bug fix to ensure that the digest.cache file gets created at fwknopd init time + so fwknopd does not throw the following error: + + Error opening digest cache file. Incoming digests will not be remembered. + +commit 04afd2846dd563296c40667557ef4ac0d47aeb0c +Author: Michael Rash +Date: Sat Aug 20 22:02:21 2011 -0400 + + On FreeBSD, made gpgme header path inclusion optional + + If gpgme is installed on FreeBSD systems it appears that + -I/usr/local/include/gpgme must be added to the include path, but this change + only adds the path if gpgme is installed and going to be used. + +commit 6eeb41309401a0c8a47613bcc9f3ce58aa1f6436 +Author: Michael Rash +Date: Sat Aug 20 13:33:00 2011 -0400 + + Fixed a few minor compiler warnings on FreeBSD + + This commit fixes a few warnings about possible uninitialized and unused + variables. + +commit 4248b2687054b38e79e2ab9eecf71e5b299172f4 +Author: Michael Rash +Date: Sat Aug 20 13:19:33 2011 -0400 + + On FreeBSD disable read-only relocations and immediate binding protections + + gcc on FreeBSD generates the following errors when the -Wl,-z,relro -Wl,-z,now + flags are used: + + gcc: -z: linker input file unused because linking not done + gcc: relro: linker input file unused because linking not done + gcc: -z: linker input file unused because linking not done + gcc: now: linker input file unused because linking not done + +commit ff7c4219e8a946fa28aeec941a17d3998ab87ae7 +Author: Michael Rash +Date: Sat Aug 20 12:56:30 2011 -0400 + + Update to suppress additional compiler warning + + This change fixes the following compiler warning that was seen with many of + the source files in server/ + + fwknopd_common.h:223: warning: ‘config_map’ defined but not used + +commit ab7226092dcf687a46916e1841cc05107a5fce8f +Author: Michael Rash +Date: Sat Aug 20 12:34:57 2011 -0400 + + Minor restructuring to suppress compiler "defined but not used warnings" + + This commit fixes several compiler warnings like the following (now that -Wall + is the default): + + config_init.h:68: warning: ‘cmd_opts’ defined but not used + +commit db681fb7916470ec981f0d4e4514402cb49eca3f +Author: Michael Rash +Date: Fri Aug 19 22:00:16 2011 -0400 + + minor commit to fix minor compilations warnings + +commit 637f7a4c936d91a18ef71f364c5fe1c7c5256f5e +Author: Michael Rash +Date: Fri Aug 19 21:14:24 2011 -0400 + + Added -Wall for all gcc warnings during compile + + Enable gcc compilation to include -Wall for all warnings (can be disabled + with --disable-wall to ./configure). + +commit bf59c2688f3dc11913c347c4d1e92c95dfcaa671 +Author: Michael Rash +Date: Fri Aug 19 20:51:50 2011 -0400 + + Bug fix for ./configure args to disable compile time security options + + The ./configure script would generate the following error for the attempted + use of the --without-stackprotector (and other related options like + --without-pie): + + configure: WARNING: unrecognized options: --without-stackprotect + +commit 41fc93407e303a47a412ee91a54f136f80a903f1 +Author: Michael Rash +Date: Thu Aug 18 22:26:52 2011 -0400 + + added the VERSION file + +commit 8b0787c270dc12552275d610bf38115f95cd5972 +Author: Michael Rash +Date: Thu Aug 18 22:25:12 2011 -0400 + + Bumped version to fwknop-2.0.0-rc3 + + Bumped version to fwknop-2.0.0-rc3 + +commit 1e494aba2ec806bec8f670c5378cf6dd5624c012 +Author: Michael Rash +Date: Thu Aug 18 21:13:58 2011 -0400 + + Added ChangeLog derived from git commit messages. + + There will be branch and release specific ChangeLog files as well. + +commit 409c08ac5c3f6310306ddba9b34c985db491722c +Author: Michael Rash +Date: Thu Aug 18 21:10:09 2011 -0400 + + Renamed ChangeLog -> ChangeLog.old for new ChangeLog handling + + The ChangeLog will be derived from commit messages. + +commit b9122f648e57a9f3cfa84c3462ab2463fe04e275 +Author: Michael Rash +Date: Thu Aug 18 20:37:31 2011 -0400 + + Update to add any missing iptables jump rules + + Upon the receipt of a valid SPA packet, a check is done to make sure that + a jump rule from the appropriate built-in iptables chains exists to the + fwknop chains. Such rules could have been deleted by other manipulations + of the iptables policy, so it is important to ensure they exist. Running + in foreground (-f) mode, here is an illustration of the jump rule being + added after it got deleted: + + SPA Packet from IP: 127.0.0.1 received. + Added jump rule from chain: INPUT to chain: FWKNOP_INPUT + Added Rule to FWKNOP_INPUT for 127.0.0.1, tcp/22 expires at 1313680648 + +commit acdf15f158c32bb12b141ecb8bd37fae5f7bfcb1 +Author: Michael Rash +Date: Wed Aug 17 21:24:03 2011 -0400 + + Update to force base64 check for all SPA data + + Previous to this change a check was done for base64 characters in incoming + SPA data only up to MIN_SPA_DATA_SIZE. This check may be reinstantiated for + SPA packets that are delivered over HTTP (and the packet data is embedded + within a URL that may also contain non-base64 chars), but in the meantime the + fwknopd daemon should not accept SPA packets over arbitrary ports with any + non-base64 chars. + +commit 92b7e2588ee64f253720cf8d819ee64f42333aee +Author: Michael Rash +Date: Wed Aug 17 21:07:35 2011 -0400 + + Updated replay warnings to include proto/port info + + Replay warnings now include port and protocol information. Here is an example: + + SPA Packet from IP: 127.0.0.1 received. + Replay detected from source IP: 127.0.0.1 + Destination proto/port: 17/62201 + Original source IP: 127.0.0.1 + Original dst proto/port: 17/62201 + Entry created: 08/17/11 21:06:07 + First replay: 08/17/11 21:06:32 + Last replay: 08/17/11 21:06:45 + Replay count: 7 + +commit df96e42c51b6847d91575dfd68f8cb23ba3aa318 +Author: Michael Rash +Date: Wed Aug 17 20:36:28 2011 -0400 + + Added stack protection, PIE, fortify source, etc. + + Added various security options that can be enabled at compile time. These + options include everything that the "hardening-check" script written by Kees + Cook checks for. After this change, the hardening-check script produces the + following output against the fwknopd binary: + + $ hardening-check server/.libs/fwknopd + server/.libs/fwknopd: + Position Independent Executable: yes + Stack protected: yes + Fortify Source functions: yes + Read-only relocations: yes + Immediate binding: yes + + One of the compile outputs (for example) that shows the new options is: + + /bin/bash ../libtool --tag=CC --mode=compile gcc -DHAVE_CONFIG_H -I. -I.. -g -O2 -fstack-protector-all -fPIE -pie -D_FORTIFY_SOURCE=2 -Wl,-z,relro -Wl,-z,now -MT fko_decode.lo -MD -MP -MF .deps/fko_decode.Tpo -c -o fko_decode.lo fko_decode.c + + From the hardening-check man page, here is a description of each of these + options: + + NAME + hardening-check - check binaries for security hardening features + + SYNOPSIS + Examine a given set of ELF binaries and check for several security + hardening features, failing if they are not all found. + + DESCRIPTION + This utility checks a given list of ELF binaries for several security + hardening features that can be compiled into an executable. These + features are: + + Position Independent Executable + This indicates that the executable was built in such a way + (PIE) that the "text" section of the program can be relocated + in memory. To take full advantage of this feature, the + executing kernel must support text Address Space Layout + Randomization (ASLR). + + Stack Protected + This indicates that the executable was compiled with the + gcc(1) option -fstack-protector. The program will be + resistant to have its stack overflowed. + + Fortify Source functions + This indicates that the executable was compiled with + -D_FORTIFY_SOURCE=2 and -O2 or higher. This causes certain + unsafe glibc functions with their safer counterparts (e.g. + strncpy instead of strcpy). + + Read-only relocations + This indicates that the executable was build with -Wl,-z,relro + to have ELF markings (RELRO) that ask the runtime linker to + mark any regions of the relocation table as "read-only" if + they were resolved before execution begins. This reduces the + possible areas of memory in a program that can be used by an + attacker that performs a successful memory corruption exploit. + + Immediate binding + This indicates that the executable was built with -Wl,-z,now + to have ELF markings (BIND_NOW) that ask the runtime linker to + resolve all relocations before starting program execution. + When combined with RELRO above, this further reduces the + regions of memory available to memory corruption attacks. + +commit 60b6a5a4d8a3075ef5d0bc7025859f704ef90bb0 +Author: Michael Rash +Date: Sun Aug 14 22:46:09 2011 -0400 + + Minor variable cleanup to fix compiler warnings + + Minor cleanup to fix compiler warnings about unused variables. + +commit e7d275ee312c618c3233a504c5aa54b72312f39a +Author: Michael Rash +Date: Sun Aug 14 21:55:29 2011 -0400 + + Added fwknop-2.0.0rc2 openwrt support from Jonathan Bennett + + Applied a patch sent from Jonathan Bennett to add fwknop-2.0.0rc2 support to + openwrt. One thing to note about this patch is that the +libgdbm library + dependency has been removed because fwknop now implements its own digest + tracking file without needing gdbm/ndbm on the system. + +commit 878fae8e8a22ea2c34ca544e84e163347835f361 +Author: Michael Rash +Date: Sun Aug 14 19:42:50 2011 -0400 + + Implemented memory clean up for digest cache list + + Upon fwknopd shutdown, a new function free_replay_list() is now called in order + to free heap allocated memory dedicated to SPA digest tracking. Without this + fix, valgrind reports the following (some output snipped): + + valgrind --leak-check=full ./server/.libs/fwknopd -f -i lo -P "udp port 62201" + + ==30864== 431 (48 direct, 383 indirect) bytes in 1 blocks are definitely lost in loss record 17 of 17 + ==30864== at 0x4C27480: calloc (vg_replace_malloc.c:467) + ==30864== by 0x407CB7: replay_check_file_cache (replay_cache.c:461) + ==30864== by 0x407B69: replay_check (replay_cache.c:413) + ==30864== by 0x405813: incoming_spa (incoming_spa.c:363) + ==30864== by 0x406275: pcap_capture (pcap_capture.c:223) + ==30864== by 0x40317D: main (fwknopd.c:297) + +commit 5ee6715cffe9dd4bbed3c0c3eaa75b5dc618b9a6 +Author: Michael Rash +Date: Sun Aug 14 12:36:25 2011 -0400 + + Consolidated replay warnings in a single function + + For both the simple digest file cache and the gdbm/ndbm tracking methods, all + replay warnings are generated by a single function "replay_warning()". + +commit c13cca4aa18317e462c4900e3779de67fa194e21 +Author: Michael Rash +Date: Sat Aug 13 22:35:52 2011 -0400 + + Added digest file import code + + The digest file is now imported as a linked list of digest cache entries at + init time for SPA replay attack detection. + +commit 941a4aa9a39ca5a42ecec92a6fa6908ebcc2c9f2 +Author: Michael Rash +Date: Sat Aug 13 21:00:54 2011 -0400 + + Added source port and protocol to digest tracking + + Added the source port and protocol fields to valid SPA packets in the digest + cache. This can help to discover replay trends. The format of the digest + file cache is now: + +