Michael Rash
0bf4993071
[server] minor update to replace a string compare for command cycle close exclusions
2015-11-17 21:19:59 -08:00
Vlad Glagolev
37cc375ea3
added substitution support for CLIENT_TIMEOUT
2015-11-19 21:39:07 +03:00
Michael Rash
cfa02859eb
[server] don't run firewall handling code for command-only modes
2015-11-17 20:48:37 -08:00
Michael Rash
882624a2a0
[server] allow 'NONE' to short circuit close command execution
2015-11-13 11:18:19 -08:00
Michael Rash
b0f25ae2e8
[server] (Vlad Glagolev) Add client timeouts to command open/close cycle operations
2015-11-13 08:41:39 -08:00
Michael Rash
97faa2dbdf
minor docs update
2015-11-10 21:40:57 -05:00
Michael Rash
2f49be6cb0
[server] For SIGHUP processing, don't send the TCP server SIGTERM unless it is running
2015-11-01 01:58:47 -08:00
Michael Rash
72d6a0c018
[test suite] add multi-cycle open/close command tests
2015-10-26 13:02:51 -07:00
Michael Rash
7910658c85
[server] memory leak bugfix caught by multi-cycle open/close test
2015-10-24 07:05:29 -04:00
Michael Rash
4909b629d5
[server] add command cycle close support to UDP server mode
2015-10-19 20:17:44 -04:00
Michael Rash
6c0b328114
[server] fix command cycle close code to iterate through the entire list until all expiration commands have been executed
2015-10-18 08:47:50 -07:00
Michael Rash
17b4b3d55e
[server] implemented command cycle close execution and expiration
2015-10-17 20:14:33 -07:00
Michael Rash
2b97e8b2e6
[server] command IP,SRC,PKT_SRC,DST,PORT,PROTO substitutions work for open/close cycles now
2015-10-17 06:30:33 -07:00
Michael Rash
32b4c5e53f
[server] minor log_msg() reformatting
2015-10-17 05:27:54 -07:00
Michael Rash
4587a279e1
[server] validate CMD_CYCLE_* vars from the access.conf file
2015-10-13 19:17:06 -07:00
Michael Rash
d67fbde992
[server] start on command open/close cycle support (issue #117 )
2015-10-13 18:00:07 -07:00
Michael Rash
cac6a3f726
[server] minor refactor for access.conf parsing
2015-10-09 04:42:09 -07:00
Michael Rash
a11881433d
[server] minor access.conf variable name bug fix
2015-10-03 06:16:47 -07:00
Damien Stuart
a4309ad768
Added clean up for .gcno and .gcda files (left went c-unit-tests are enabled.
2015-09-05 15:20:22 -04:00
Damien Stuart
2e60687dcf
Merge branch 'master' into dstuart_refactor_autoconf
2015-08-29 12:46:24 -04:00
Michael Rash
ecfa8021e5
doc updates to include sudo information
2015-08-24 17:25:06 -07:00
Michael Rash
d1d59778e9
[server] handle trailing quote for PF firewalls on OpenBSD
2015-08-21 23:06:07 -04:00
Michael Rash
dd1528c829
[test suite] set sudo path on the fwknopd command line
2015-08-21 22:24:45 -04:00
Michael Rash
2f94413b2f
[server] bug fix for ipfw firewall rule removal
2015-08-21 21:35:10 -04:00
Michael Rash
ec9eef3365
[server] fix a dead code condition spotted by Coverity
2015-08-19 23:41:47 -04:00
Michael Rash
c5507d2c2a
[server] fix ptr vs. val check spotted by Coverity
2015-08-19 23:41:17 -04:00
Michael Rash
423899f3c4
[server] minor fix to remove unnecessary var definition
2015-08-18 22:02:00 -04:00
Michael Rash
0fdc263a43
options struct should not be global (CLANG -Wshadow warning)
2015-08-18 21:58:53 -04:00
Michael Rash
5e0a668a7f
[server] minor access.c fix to quiet both Coverity and the CLANG static analyzer
2015-08-16 21:31:48 -04:00
Michael Rash
e5c6f96788
[server] fix compilation issue for non-iptables firewalls
2015-07-25 23:10:06 -04:00
Michael Rash
72555ba9fe
[server] minor comment fix for group ID determination in access.conf parsing
2015-07-25 18:58:39 -07:00
Michael Rash
fbdc542f48
Merge branch 'master' of https://github.com/mrash/fwknop
2015-07-25 13:28:49 -07:00
Michael Rash
c0330e5c8b
[server] additional work on splitting incoming_spa() loop into functions
2015-07-25 13:27:42 -07:00
Michael Rash
3270900a38
[server] continued work on splitting incoming_spa() into functions
2015-07-24 12:38:17 -07:00
Michael Rash
01beb31861
[server] start to split incoming_spa() main loop into functions
2015-07-22 06:57:13 -07:00
Michael Rash
d681485e29
[server] add sudo support, closes #159
2015-07-22 04:08:58 -07:00
micha137
0ac52b9b4d
Fix some typos
2015-07-21 18:39:43 +02:00
Michael Rash
89b2e8f477
[server] interface goes down will cause fwknopd to exit
...
By default, fwknopd will now exit if the interface that it is
sniffing goes down (patch contributed by Github user 'sgh7'). If this
happens, it is expected that the native process monitoring feature in
things like systemd or upstart will restart fwknopd. However, if fwknopd
is not being monitored by systemd, upstart, or anything else, this
behavior can be disabled with the EXIT_AT_INTF_DOWN variable in the
fwknopd.conf file. If disabled, fwknopd will try to recover when a
downed interface comes back up.
2015-07-18 13:11:25 -07:00
Michael Rash
795b1de4dd
[server] Added RULES_CHECK_THRESHOLD to define 'deep' rule expiration check frequency
...
The RULES_CHECK_THRESHOLD variable defines the number of times firewall rule
expiration times must be checked before a "deep" check is run. This allows
fwknopd to remove rules that contain a proper '_exp_<time>' even if a third party
program added them instead of fwknopd. The default value for this variable is 20,
and this typically results in this check being run every two seconds or so. To
disable this type of checking altogether, set this variable to zero.
2015-07-18 10:37:17 -07:00
Michael Rash
295a6a0d14
[server] fix is_digits() logic and add tests
2015-07-17 21:28:02 -07:00
Michael Rash
76d8ce5158
minor change to remove debugging statement
2015-07-17 12:17:48 -07:00
Michael Rash
6e4ad4767f
[server] make sure fw _exp_NNN... strings contain only digits after the _exp_ prefix
2015-07-17 12:15:01 -07:00
Michael Rash
b753812cf6
[server] minor addition of function names to fw command error log messages
2015-07-17 11:48:28 -07:00
Michael Rash
a8ef2922e6
Merge branch 'master' of https://github.com/mrash/fwknop
2015-07-17 10:56:28 -07:00
Michael Rash
c25f951b42
Merge pull request #161 from sgh7/master
...
[server] daemon exits if listened-to interface goes down
2015-07-17 22:37:59 -04:00
Michael Rash
4169c6d477
[server] switch chain_exists() log message to LOG_DEBUG upon error since FWKNOP_INPUT almost never exists at startup
2015-07-17 10:38:34 -07:00
Michael Rash
e7b48af47c
[server] Calculate payload length from IP header
...
Github user Scotte noticed that in his setup a 'VSS-Monitoring ethernet trailer'
was being added to incoming Ethernet frames that contained SPA packets. This
caused base64 decoding to break because the packet data length was calculated
from what libpcap returned for the frame (so these bytes became included in the
SPA payload itself). This issue was reported as #163 on github.
This commit has fwknopd calculate the SPA payload length using the length field
in the IP header so that any trailing bytes in the Ethernet frame are not
included. This solution also applies to the Ethernet Frame Check Sequence issue
(#126 ).
2015-07-16 23:02:50 -07:00
Michael Rash
71d6f01d11
[server] further no_chk_support for issue #162
2015-07-16 11:49:04 -07:00
Michael Rash
3c8e03d062
[server] add stronger 'no -C' support for firewalld systems (issue #162 )
2015-07-16 11:39:14 -07:00
Michael Rash
f1c3806dca
[test suite] added tests for duplicate rule detection (issue #162 )
2015-07-14 21:13:46 -04:00
