15 Commits

Author SHA1 Message Date
Damien Stuart
9c2cd267bf Fixed issue with spaces in in access.conf comma-separated values. Fixed issue with GPG signature check being forced when GPG_REMOTE_ID is set and GPG_REQUIRE_SIG was "N". Updated dependency in the spec file. Updates to ChangeLog.
git-svn-id: file:///home/mbr/svn/fwknop/trunk@273 510a4753-2344-4c79-9c09-4d669213fbeb
2010-07-31 18:04:08 +00:00
Damien Stuart
b0886a1d49 Updates and clean-up to address the many compiler warnings when compiled with -Wall. Also some autoconf updates
git-svn-id: file:///home/mbr/svn/fwknop/trunk@265 510a4753-2344-4c79-9c09-4d669213fbeb
2010-07-16 14:28:32 +00:00
Michael Rash
ed9170e506 - added is_valid_dir() utility function for checking directory stat()/existence (this
is used for gpg keyring path validation).



git-svn-id: file:///home/mbr/svn/fwknop/trunk@259 510a4753-2344-4c79-9c09-4d669213fbeb
2010-07-12 01:48:49 +00:00
Michael Rash
eed35a8f1c minor update to check the gpg keyring path setting in access stanzas only if a decrypt password is specified
git-svn-id: file:///home/mbr/svn/fwknop/trunk@254 510a4753-2344-4c79-9c09-4d669213fbeb
2010-07-11 12:37:31 +00:00
Michael Rash
688ae8d4f0 Updated to define a default gpg keyring path of /root/.gnupg, and if the GPG_HOME_DIR variable
is not defined in the fwknopd.conf file or the access.conf file, then this default will take
over.


git-svn-id: file:///home/mbr/svn/fwknop/trunk@252 510a4753-2344-4c79-9c09-4d669213fbeb
2010-07-11 02:45:38 +00:00
Damien Stuart
b217c6a1fa Added the GPG signature checking code. Added GPG_REQUIRE_SIG and GPG_IGNORE_SIG_VERIFY_ERROR parameters to access.conf. Implement the checking of GPG signature IDs against the GPG_REOMOTE_ID list.
git-svn-id: file:///home/mbr/svn/fwknop/trunk@227 510a4753-2344-4c79-9c09-4d669213fbeb
2010-06-29 02:40:59 +00:00
Damien Stuart
b7ede1625d Added support for COMMAND_MSG requests. Also added CMD_EXEC_USER to access.conf to allow for fwknopd to setuid to the specified user before running the command. Other minor tweaks.
git-svn-id: file:///home/mbr/svn/fwknop/trunk@226 510a4753-2344-4c79-9c09-4d669213fbeb
2010-06-29 01:00:11 +00:00
Damien Stuart
fe09438921 Start of cleanup for beta release candidate. Removed locale-related code (for now) as it was breaking some things like logging. removed some unimplemented and/or unused parameters and config directives (as well as thier respective documentation references. Added a --rotate-digest-cache command-line arg to force a rename of the digest cache file and start a new one.
git-svn-id: file:///home/mbr/svn/fwknop/trunk@224 510a4753-2344-4c79-9c09-4d669213fbeb
2010-06-24 02:31:36 +00:00
Damien Stuart
aad2daadbf First cut at creating access rules and removing them when they expire (not sure I like this implementation but it is a start).
git-svn-id: file:///home/mbr/svn/fwknop/trunk@214 510a4753-2344-4c79-9c09-4d669213fbeb
2010-05-17 01:27:26 +00:00
Damien Stuart
e3bd3b703e Added additional sanity checks and clean-up of access.conf processing and functionality. Fixes require source and added check for required username. Added fallback to use GPG_DECRYPT_PW if it was set and the normal KEY failed with a decyption error. Fixed packet count checks to allow a limit of 0 to mean unlimited number of packets.
git-svn-id: file:///home/mbr/svn/fwknop/trunk@203 510a4753-2344-4c79-9c09-4d669213fbeb
2010-01-30 20:22:53 +00:00
Michael Rash
e8b875789b Update to call parse_proto_and_port() before allocating a new port list. This
fixes the following stack trace when generating an SPA packet that contains
"none/0" for the port list:

Program received signal SIGABRT, Aborted.
0x00007ffff74574b5 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
        in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) where
#0  0x00007ffff74574b5 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff745af50 in *__GI_abort () at abort.c:92
#2  0x00007ffff748fc97 in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3  0x00007ffff7499dd6 in malloc_printerr (action=3, str=0x7ffff755b748 "double free or corruption (fasttop)", ptr=<value optimized out>) at malloc.c:6217
#4  0x00007ffff749e74c in *__GI___libc_free (mem=<value optimized out>) at malloc.c:3716
#5  0x000000000040570c in free_acc_port_list (acc=0x60a1c0, port_str=0x7fffffffdc20 "none/0") at access.c:390
#6  acc_check_port_access (acc=0x60a1c0, port_str=0x7fffffffdc20 "none/0") at access.c:892
#7  0x0000000000403f4a in incoming_spa (opts=<value optimized out>) at incoming_spa.c:229
#8  0x00000000004041eb in pcap_capture (opts=0x7fffffffde40) at pcap_capture.c:155
#9  0x0000000000402ba7 in main (argc=9, argv=0x7fffffffe6e8) at fwknopd.c:241



git-svn-id: file:///home/mbr/svn/fwknop/trunk@201 510a4753-2344-4c79-9c09-4d669213fbeb
2010-01-20 01:20:36 +00:00
Michael Rash
daca01a2c6 Added minor validation code to access.conf parsing to ensure that a SOURCE stanza
begins with the SOURCE variable and that there is at least one usage of the
OPEN_PORTS and KEY variables.  The OPEN_PORTS requirement might be relaxed when
PERMIT_CLIENT_PORTS handling is added.


git-svn-id: file:///home/mbr/svn/fwknop/trunk@199 510a4753-2344-4c79-9c09-4d669213fbeb
2010-01-19 02:51:37 +00:00
Damien Stuart
4e12808345 Added support for multiple GPG_REMOTE_ID values from access.conf (still need to implement the use of those however). Also, went back to support colons (:) as an optional part of the access.conf parameter name (better to keep backward compatibility).
git-svn-id: file:///home/mbr/svn/fwknop/trunk@192 510a4753-2344-4c79-9c09-4d669213fbeb
2010-01-11 01:33:38 +00:00
Michael Rash
11cedcf3eb Added --access-file command line arg to fwknopd so that the path to the
access.conf file can be specified from the command line.


git-svn-id: file:///home/mbr/svn/fwknop/trunk@187 510a4753-2344-4c79-9c09-4d669213fbeb
2010-01-04 04:08:58 +00:00
Damien Stuart
055aa365cb Added access.conf handling and processing. Added a new acces.conf parameter: RESTRICT_PORTS for specifying 1 or more proto/ports that are explicitly not allowed.
git-svn-id: file:///home/mbr/svn/fwknop/trunk@183 510a4753-2344-4c79-9c09-4d669213fbeb
2010-01-04 00:20:19 +00:00