74 Commits

Author SHA1 Message Date
Michael Rash
1f9e939c95 [server] consolidate iptables rule additions into a single ipt_rule() function 2015-01-06 15:30:12 -05:00
Michael Rash
1ece9d022b [server] consolidate create_chain() and add_jump_rule() into a single function 2014-12-30 10:42:31 -05:00
Michael Rash
9dc56d6bb7 [test suite / server] rule deletion/addition tests mid-cycle 2014-12-15 17:06:07 -08:00
Grant Pannell
624872ef48 Add DESTINATION access.conf directive and ENABLE_DESTINATION_RULE fwknopd.conf directive 2014-11-29 15:05:06 +10:30
Michael Rash
a8879231c3 [server] add run_extcmd_write() call in code coverage mode 2014-11-06 20:24:33 -05:00
Michael Rash
c70e1c72a0 [server] update firewalld code to use run_extcmd() instead of popen() and system() - allows execvpe() to be used 2014-10-12 21:57:04 -04:00
Michael Rash
62ee780d65 [server] make pid_status a static var at the top of each fw_util_*.c file 2014-10-10 14:20:18 -04:00
Michael Rash
1905baa0e8 [server] minor macro usage update 2014-10-07 21:37:29 -04:00
Michael Rash
b7785a9304 [server] extend run_extcmd() to allow the caller to specify whether to collect stderr 2014-10-07 21:01:17 -04:00
Michael Rash
652b8cb80e [server] have run_extcmd() collect process exit status for calling function (in addition to return value) 2014-10-05 20:21:05 -04:00
Michael Rash
841d732c07 [server] removed remaining popen() call for iptables firewalls 2014-10-04 19:56:26 -04:00
Michael Rash
d71f386971 [server] add search_extcmd() to replace all popen() calls with the execvpe() no env strategy 2014-10-04 10:31:15 -04:00
Michael Rash
e271442aa9 [server] first cut at converting iptables commands to use execvpe() 2014-10-03 21:58:51 -04:00
Michael Rash
06ce514111 [test suite] add several fault injection tests 2014-06-12 00:02:18 -04:00
Michael Rash
6dde30bc91 [test suite] significant test coverage update
This commit adds a lot of test coverage support as guided by gcov +
lcov.

Also added the --no-ipt-check-support option to fwknopd (this is only
useful in practice on older Linux distros where 'iptables -C' is not
available, but it helps with test coverage).
2014-04-29 20:54:01 -04:00
Michael Rash
9e990c9be0 fix header non-ascii chars, and introduce test suite support for detecting this in source files 2014-03-14 09:14:35 -04:00
Michael Rash
bfdbb8f260 Updated authorship and copyright information
This commit updates all authorship and copyright information to include a
standard header that references the AUTHORS and CREDITS file. This standard
header was written by the Debian legal team at the request of Franck Joncourt.
2014-03-04 17:53:10 -05:00
Michael Rash
919f25f85d [server] fw_initialize() vs. fw_config_init() bug fix for use_masquerade 2013-12-14 19:41:00 -05:00
Michael Rash
92cdb47ff7 [server] added FORCE_MASQUERADE to fwknopd(8) man page, closes #101
This commit completes the addition of generalized NAT (both DNAT and
SNAT) capabilities to access.conf stanzas.
2013-12-14 15:44:39 -05:00
Michael Rash
46b5f2ecaf [server] added the ability to use FORCE_MASQUERADE to access.conf stanzas 2013-12-05 23:00:19 -05:00
Michael Rash
e0114e60c2 [server] Added FORCE_SNAT to access.conf stanzas.
Added FORCE_SNAT to the access.conf file so that per-access stanza SNAT
criteria can be specified for SPA access.
2013-12-04 21:52:07 -05:00
Michael Rash
d7aa820e33 [server] Bug fix for SPA NAT modes on iptables firewalls for chain re-creation
For SPA NAT modes this commit ensures that custom fwknop chains are re-created
if they get deleted out from under the running fwknopd instance.
2013-12-03 21:42:23 -05:00
Michael Rash
78f696b2f7 [libfko] implemented shared utility function for ipv4 address checking
This commit implements a single shared utility function for checking the
validaty of an IPv4 address, and both libfko and the fwknopd server use it
now.  The client will be updated as well.
2013-11-20 17:13:55 -05:00
Michael Rash
8c73c7801b [server] send IPT_*_ACCESS vars through basic validation at fwknopd.conf parse time 2013-08-05 00:00:45 -04:00
Michael Rash
131c643cad [server] make IPT_INPUT_ACCESS validation more strict on allowed chars 2013-08-04 23:20:53 -04:00
Michael Rash
24101ac33a [server] add NULL check for SNAT translate IP 2013-08-03 20:37:50 -04:00
Michael Rash
dcf9c99fb5 [server] iptables rule duplication bug fix to look for protocol name with -C support isn't available 2013-07-14 14:37:22 -04:00
Michael Rash
a7de80e66e [server] Account for older versions of iptables that don't have -C
This commit updates fwknopd to test for the existance of the iptables '-C'
rule checking functionality since older versions of iptables don't have this.
If it isn't offered by the installed version of iptables, then revert to parsing
fwknop chains to see if iptables rules already exist before adding new rules (to
avoid duplicates).
2013-07-12 23:22:50 -04:00
Michael Rash
6f6f7b8de2 [server] update fw_config_init() to allow access stanza key information to be zeroed out upon error (#93) 2013-07-06 15:05:09 -04:00
Michael Rash
4ff518d54a [server] zero out access stanza key information before exit (in support of #93) 2013-07-06 14:52:46 -04:00
Franck Joncourt
9d7feb52f6 Merge remote-tracking branch 'upstream/master' 2013-06-30 22:22:34 +02:00
Franck Joncourt
c2e1a00154 s/GNU Public/GNU General Public/g 2013-06-30 22:21:22 +02:00
Michael Rash
5a4a8a5baa [server] convert several LOG_INFO messages to LOG_DEBUG 2013-06-27 22:15:39 -04:00
Michael Rash
68acbaadc4 remove newline chars from log_msg() calls 2013-06-19 23:42:58 -04:00
Franck Joncourt
57cf6dc472 s/fprintf(stderr/log_msg(LOG_ERR/ 2013-06-16 22:16:41 +02:00
Franck Joncourt
b48295c69b Interim commit to make the log_msg strategy.
* log_msg : New log_set_verbosity(): It sets the default verbosity for the
    log module according to the verbose option set by the user through the command
    line.
  * Remove useless checks of the verbose option when log_msg() is invoked.
2013-06-16 19:12:06 +02:00
Michael Rash
8155cf3331 [server] ensure 'Rule added' log messages are generated when create_rule() is called 2013-06-13 21:23:59 -04:00
Michael Rash
7a1bdea514 [server] fix 'Use of untrusted string value' bug found by Coverity
This commit changes iptables policy parsing to re-use rule_exists() for fwknop
jump rule detection instead of using sscanf() against iptables policy list
output.  Also, fwknop jump rules are now deleted from iptables policies in a
loop to ensure all are removed even if there are duplicates (even though this
should not happen under normal circumstances anyway).
2013-06-09 14:28:17 -04:00
Michael Rash
f491c41697 [server] minor addition of IPT_CHK_RULE_ARGS macro for iptables -C usage 2013-06-06 21:29:08 -04:00
Michael Rash
866e0a95d5 [server] minor bug fix to switch iptables comment match check to built-in INPUT chain 2013-06-05 21:46:51 -04:00
Michael Rash
382099e85a Updated copyright dates, removed NEWS file in favor of the ChangeLog 2013-06-02 14:07:01 -04:00
Michael Rash
52462e7dba Use {0} initializer for all stack allocated char arrays
Lots of places in the code were already using {0} to initialize stack char
arrays, but memset() was being used as well.  This commit removes all
unnecessary memset() calls against char arrays that are already initialized
via {0} (which sets all members to zero for such arrays).
2013-05-21 22:00:15 -04:00
Michael Rash
7cb23c75cc [server] added check to ensure any existing fwknop jump rule is not duplicated at init 2013-05-17 22:34:26 -04:00
Michael Rash
0c3da4bee4 [server] minor cosmetic (unnecessary NULL checks and one un-triggerable memory leak) found by Coverity 2013-05-13 20:40:29 -04:00
Michael Rash
3c3283992c (Franck Joncourt) patch to address sprintf() warnings for issue #60 2013-05-04 14:16:06 -04:00
Michael Rash
b3f55bf1ab Convert most strlcpy() calls to use destination bound from sizeof()
This commit helps to ensure correctness of strlcpy() calls in support of fixing
issue #2.
2013-04-27 15:08:11 -04:00
Michael Rash
08add2fd48 [server] minor function prototype convention update for create_rule() 2013-04-21 20:48:42 -04:00
Michael Rash
a413c6cf94 Continue atoi() replacement with strtol() wrapper, closes issue #21
This commit completes the conversion to the strtol() wrapper function in order
to remove all atoi() calls.  In addition, variable max values are enforced
using more broadly defined RCHK_* values.
2013-02-19 23:11:01 -05:00
Michael Rash
1afc8db96a Added strtol_wrapper() libfko utility function for atoi() replacement (#21)
This commit replaces most atoi() calls (which don't report errors) with a strtol()
wrapper function for stronger string -> integer conversion validation.
2013-02-18 19:32:53 -05:00
Michael Rash
ce18de4f84 make libfko pointers constant where possible 2013-02-12 22:39:39 -05:00