DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity
313 Commits 15 Branches 0 Tags
941a4aa9a39ca5a42ecec92a6fa6908ebcc2c9f2
Commit Graph

106 Commits

Author SHA1 Message Date
Michael Rash
941a4aa9a3 Added source port and protocol to digest tracking 
Added the source port and protocol fields to valid SPA packets in the digest
cache.  This can help to discover replay trends.  The format of the digest
file cache is now:

<digest> <proto> <src_ip> <src_port> <dst_ip> <dst_port> <time>
 2011-08-13 21:00:54 -04:00
Michael Rash
6982a72c07 Added dst IP to tracked SPA data 
The digest cache now contains destination IP addresses of valid SPA packets.
The complete format is now:

<digest> <src_ip> <dst_ip> <creation time>
 2011-08-12 22:00:44 -04:00
Michael Rash
4197e51c9d Started on code to parse the digest cache file 
At init time fwknopd will read in the digest cache file into the in-memory
linked list of digests for SPA replay detection. This commit starts on this
code, but the file format does not yet include destination IP addresses
(to be added in an upcoming commit).
 2011-08-12 21:43:07 -04:00
Michael Rash
459cfb4d45 Implemented linked list cache of SPA digests 
When not using gdbm/ndbm support (the default now), fwknopd implements a linked
list of SPA packet digests for replay attack detection along with writing
digest data in ascii text down to disk (in the CONF_DIGEST_FILE file).
 2011-08-12 20:16:00 -04:00
Michael Rash
e443550e5f Merge branch 'master' into optional_dbm_support 2011-08-10 22:41:18 -04:00
Michael Rash
d2c5085843 Added --pcap-filter to the fwknopd command line 
To override the value of the PCAP_FILTER variable in the fwknopd.conf
config file, a new fwknopd command line argument "--pcap-filter" was
added.  This assists in various activities by making it trivial to
change how fwknopd acquires packet data without editing the fwknopd.conf
file.  Here is an example:

fwknopd -i lo -f --pcap-filter "udp port 12345"
 2011-08-10 22:38:01 -04:00
Michael Rash
52c795634b Updated digest file path for gdbm/ndbm support 
If fwknopd is compiled with --disable-file-cache to the ./configure script
then it will assume that the default filename is "digest_db.cache" for the
digest cache.  If the file cache method is used (this is the default), then
"digest.cache" is the default filename.  A new variable DIGEST_DB_FILE in
the fwknopd.conf file controls the digest filename if gdbm/ndbm support is
required.
 2011-08-10 22:07:25 -04:00
Michael Rash
0525cd4a5c Added autoconf support for non-dbm file cache. 
This change starts on support for a simple file-based cache mechanism
for tracking SPA digests.  This removes the libgdbm/libndbm dependency
by default, but it can be re-enabled with the --disable-file-cache
argument to the ./configure script.
 2011-08-10 20:56:42 -04:00
Michael Rash
2dd7c4aac7 Minor rename in support of non-dbm file cache 
Added the optional_dbm_support branch and made a minor renaming change
on this branch for the coming non-dbm file cache support.
 2011-08-08 22:49:28 -04:00
Damien Stuart
69f41eb399 Set FD_CLOEXEC on pid file descriptor. 
Added support for setting the URL for resolving source IP via command-line or the .fwknoprc file.
 2011-07-07 08:12:49 -04:00
Michael Rash
ca5f82c067 Removed legacy $Id$ tags from svn 
$Id$ tags don't really mean anything to git so they have been removed from all
source files.
 2011-06-18 20:53:40 -04:00
Damien Stuart
39e7412bb8 Added a no-digest-cache configure option and capability (though it is not recommended). 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@313 510a4753-2344-4c79-9c09-4d669213fbeb
 2011-03-27 02:38:41 +00:00
Damien Stuart
03361fea74 Fix check and handling of ndbm as an option for the digest cache. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@312 510a4753-2344-4c79-9c09-4d669213fbeb
 2011-03-26 16:33:02 +00:00
Damien Stuart
6c050b481c Added python/fko.py to Makefile.am so it is also included in distributions. Minor tweak to address compile error on Mac os X. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@311 510a4753-2344-4c79-9c09-4d669213fbeb
 2011-02-12 13:18:31 +00:00
Damien Stuart
00bc99a966 Minor comment and documentation tweaks. Add the python directory which contains my first cut at a libfko Python wrapper module. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@302 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-11-26 15:51:00 +00:00
Damien Stuart
0f6ca00ac4 Updated the GPL blurb at the top of the source files. Added some missing copyright statements (Thanks to Franck Joncourt). 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@300 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-11-13 03:04:36 +00:00
Damien Stuart
3c83e899cb Put the usleep back pcap_capture (oops). 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@293 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-10-23 17:34:47 +00:00
Damien Stuart
bbe8c9d7a1 Set pcap non-block mode back on unless it is a freebsd system. Server verbose output no longer shows access key or GPG password. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@290 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-10-21 01:53:04 +00:00
Damien Stuart
4f504848a0 Fixed handling of man page generation in Makefile.am so it works from alternate build directories. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@289 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-10-17 02:52:21 +00:00
Damien Stuart
f1e82bc7ae Minor fwknopd man page tweak. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@288 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-29 02:06:13 +00:00
Damien Stuart
6bcebe565c Made fw_cleanup not remove rules from the expired rule set. Added code to read in any existing expired rules into the rule_map at startup. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@286 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-29 01:32:04 +00:00
Damien Stuart
ff9dad6fd9 Wrapped #ifdef around a linux-specific chunk. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@285 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-27 22:09:36 +00:00
Damien Stuart
c4c158c1ba Missed a config file update on the last check-in. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@284 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-26 22:56:47 +00:00
Damien Stuart
cdff077bb6 Added rule expire and purge for ipfw. Almost there... 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@283 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-24 03:09:35 +00:00
Damien Stuart
51c21b318f Start of addition of access requests via ipfw. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@282 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-23 02:43:43 +00:00
Damien Stuart
838b80fd7d Refactored firewall rule code to separate files by firewall type. Stubbed in ipfw and ipf firewall types. Updated autoconf to set a firewall type and path depending on configure arguments. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@279 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-10 02:29:09 +00:00
Damien Stuart
c1f67b900d Uncommented call to check_firewall_rules (left in while debugging freebsd build). 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@278 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-08 19:01:36 +00:00
Damien Stuart
6126b7b7ca Updates to accomodate building and compiling on FreeBSD systems. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@276 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-08 18:53:35 +00:00
Damien Stuart
9c2cd267bf Fixed issue with spaces in in access.conf comma-separated values. Fixed issue with GPG signature check being forced when GPG_REMOTE_ID is set and GPG_REQUIRE_SIG was "N". Updated dependency in the spec file. Updates to ChangeLog. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@273 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-31 18:04:08 +00:00
Damien Stuart
bf8586922e Added check to make sure a firewall program is set. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@267 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-16 20:47:50 +00:00
Damien Stuart
aa0cc1c699 Per Franck Joncourt - Corrected misspelled word in fwknopd man page and access.conf. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@266 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-16 20:14:35 +00:00
Damien Stuart
b0886a1d49 Updates and clean-up to address the many compiler warnings when compiled with -Wall. Also some autoconf updates 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@265 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-16 14:28:32 +00:00
Damien Stuart
4c995c146b Almost all he conf variables have a default value if they are not there (or set). All the entries in the initial fwknop.conf file are not commented out adn can be override as needed. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@262 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-15 01:38:16 +00:00
Michael Rash
d904f5637f removed additional wait() call from run_extcmd(), updated --fw-list to just use system() to execute the iptables listing commands 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@261 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-14 02:58:51 +00:00
Michael Rash
6f4ff9cb69 added --fw-list arg to the fwknopd daemon to list all current firewall rules for any running fwknopd process 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@260 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-13 04:09:07 +00:00
Michael Rash
ed9170e506 - added is_valid_dir() utility function for checking directory stat()/existence (this 
is used for gpg keyring path validation).



git-svn-id: file:///home/mbr/svn/fwknop/trunk@259 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-12 01:48:49 +00:00
Damien Stuart
f03b2786eb Added the fwknopd_errors.[ch] files which provides the get_errstr() and fwknopd_errstr() functions. The get_errstr() function takes and error_code, tries to determine the type, then calls the appropriate xxx_errstr function to return a description string. Fixed some minor errors in the libfko API docs. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@258 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-11 20:16:32 +00:00
Damien Stuart
390ea80df7 Moved force set of verify flag on remote_id value to before decryption phase. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@257 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-11 14:04:23 +00:00
Damien Stuart
3c5c8f1da7 Reverted last libfko change. Added set verify_sig flag when remote_ids are specified. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@256 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-11 13:55:44 +00:00
Michael Rash
eed35a8f1c minor update to check the gpg keyring path setting in access stanzas only if a decrypt password is specified 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@254 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-11 12:37:31 +00:00
Michael Rash
05fdf6f319 minor macro update to define the default gpg keyring 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@253 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-11 02:49:12 +00:00
Michael Rash
688ae8d4f0 Updated to define a default gpg keyring path of /root/.gnupg, and if the GPG_HOME_DIR variable 
is not defined in the fwknopd.conf file or the access.conf file, then this default will take
over.


git-svn-id: file:///home/mbr/svn/fwknop/trunk@252 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-11 02:45:38 +00:00
Damien Stuart
a0b813ca55 Reworked how man pages are generated. Now, man pages in the client and server directory are "fwknop(d).8.in" and a target was added to Makefile.am to create the man pages while doing variable substitutions based on directives specified via the configure script. Minor tweak to fwknop.spec file. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@251 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-11 01:27:12 +00:00
Damien Stuart
492b1db861 Slightly revamped how signals were setup. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@250 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-10 16:41:52 +00:00
Damien Stuart
4a85c6fd25 Modified top-level Makefile.am so the legacy perl stuff is not packaged into the distribution tar file. More cleanup of the fwknopd man page. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@249 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-10 00:48:41 +00:00
Damien Stuart
9c6377aff6 Manpage updates 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@247 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-09 02:09:22 +00:00
Damien Stuart
9d2a4c2471 Fixed autoconf config so libfko and fwknop client are not linked with libpcap and libgdbm. Fixed some issues in the fwknop.spec file. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@244 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-08 01:59:51 +00:00
Damien Stuart
2a67766589 Added fwknop.spec for rpm builds. Removed the server post install hook as it breaks make distcheck and rpm builds. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@238 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-07 02:32:01 +00:00
Damien Stuart
e9c0f41541 Added installation hook to set the perms on the .conf files to 600 during make install. Minot doc tweak. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@235 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-06 00:59:33 +00:00
Damien Stuart
8129f86ddd More cleanup. Removed the direction field (src, dst, both) from the chain configuration directives. Remove the HOSTNAME parameter as it was not used. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@232 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-04 21:12:51 +00:00