DeforaNetworks/fwknop
DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity
423 Commits 15 Branches 0 Tags
Commit Graph

60 Commits

Author SHA1 Message Date
Michael Rash
b280f5cde0 Added access stanza expiration feature, multiple access stanza bug fix 
This commit does two major things:

1) Two new access.conf variables are added "ACCESS_EXPIRE" and
"ACCESS_EXPIRE_EPOCH" to allow access stanzas to be expired without having
to modify the access.conf file and restart fwknopd.

2) Allow an access stanza that matches the SPA source address to not
automatically short circuit other stanzas if there is an error (such as when
there are multiple encryption keys involved and an incoming SPA packet is
meant for, say, the second stanza and the first therefore doesn't allow
proper decryption).
 2011-11-28 22:03:21 -05:00
Michael Rash
f41a26b389 Fixed fwknopd memory leak, several other fixes and updates 
This commit does several things.  First, a memory leak in fwknopd has been
fixed by ensuring to free access.conf stanzas.  This bug was found with the
new test suite running in --enable-valgrind mode.  Here is what some of the
valgrind output looked like to find the leak:

==19217== 11 bytes in 1 blocks are indirectly lost in loss record 3 of 5
==19217==    at 0x4C2815C: malloc (vg_replace_malloc.c:236)
==19217==    by 0x52F6B81: strdup (strdup.c:43)
==19217==    by 0x10FC8B: add_acc_string (access.c:49)
==19217==    by 0x1105C8: parse_access_file (access.c:756)
==19217==    by 0x10B79B: main (fwknopd.c:194)
==19217==
==19217== 16 bytes in 1 blocks are indirectly lost in loss record 4 of 5
==19217==    at 0x4C27480: calloc (vg_replace_malloc.c:467)
==19217==    by 0x10FEC0: add_source_mask (access.c:88)
==19217==    by 0x110100: expand_acc_source (access.c:191)
==19217==    by 0x1104B0: parse_access_file (access.c:500)
==19217==    by 0x10B79B: main (fwknopd.c:194)
==19217==
==19217== 183 (152 direct, 31 indirect) bytes in 1 blocks are definitely lost in loss record 5 of 5
==19217==    at 0x4C27480: calloc (vg_replace_malloc.c:467)
==19217==    by 0x1103E4: parse_access_file (access.c:551)
==19217==    by 0x10B79B: main (fwknopd.c:194)
==19217==
==19217== LEAK SUMMARY:
==19217==    definitely lost: 152 bytes in 1 blocks
==19217==    indirectly lost: 31 bytes in 3 blocks
==19217==      possibly lost: 0 bytes in 0 blocks
==19217==    still reachable: 8 bytes in 1 blocks
==19217==         suppressed: 0 bytes in 0 blocks

Second, this commit changes how fwknopd acquires packet data with
pcap_dispatch() - packets are now processed within the callback function
process_packet() that is provided to pcap_dispatch(), the global packet
counter is incremented by the return value from pcap_dispatch() (since this is
the number of packets processed per pcap loop), and there are two new
fwknopd.conf variables PCAP_DISPATCH_COUNT and PCAP_LOOP_SLEEP to control the
number of packets that pcap_dispatch() should process per loop and the number
of microseconds that fwknopd should sleep per loop respectively.  Without this
change, it was fairly easy to cause fwknopd to miss packets by creating bursts
of packets that would all be processed one at time with the usleep() delay
between each.  For fwknopd deployed on a busy network and with a permissive
pcap filter (i.e. something other than the default that causes fwknopd to look
at, say, TCP ACK's), this change should help.

Third, the criteria that a packet must reach before data copying into the
buffer designed for SPA processing has been tightened.  A packet less than
/greater than the minimum/maximum expected sizes is ignored before data is
copied, and the base64 check is done as well.
 2011-11-03 22:15:19 -04:00
Michael Rash
44598fd7dd Added --digest-file and --pid-file args 
Added --digest-file and --pid-file args so that the user can easily alter
these paths from the command line.
 2011-10-20 23:31:59 -04:00
Michael Rash
0e7a0e9a37 Added --fw-list-all and --fw-flush 
Added new command line options --fw-list-all and --fw-flush to allow all
firewall rules to be displayed including those not created by fwknopd, and
allow all firewall rules created by fwknopd to be deleted.

Also switched -D config dump output to stdout.
 2011-10-17 23:03:28 -04:00
Michael Rash
9962dc0808 minor wording update netfilter -> iptables 2011-10-13 20:59:30 -04:00
Michael Rash
6f0d2c5091 minor typo fix 2011-10-13 20:29:37 -04:00
Michael Rash
35abc349ab minor typo fix: fwkop -> fwknop 2011-09-12 23:04:41 -04:00
Michael Rash
d2c5085843 Added --pcap-filter to the fwknopd command line 
To override the value of the PCAP_FILTER variable in the fwknopd.conf
config file, a new fwknopd command line argument "--pcap-filter" was
added.  This assists in various activities by making it trivial to
change how fwknopd acquires packet data without editing the fwknopd.conf
file.  Here is an example:

fwknopd -i lo -f --pcap-filter "udp port 12345"
 2011-08-10 22:38:01 -04:00
Damien Stuart
69f41eb399 Set FD_CLOEXEC on pid file descriptor. 
Added support for setting the URL for resolving source IP via command-line or the .fwknoprc file.
 2011-07-07 08:12:49 -04:00
Damien Stuart
00bc99a966 Minor comment and documentation tweaks. Add the python directory which contains my first cut at a libfko Python wrapper module. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@302 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-11-26 15:51:00 +00:00
Damien Stuart
f1e82bc7ae Minor fwknopd man page tweak. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@288 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-08-29 02:06:13 +00:00
Damien Stuart
aa0cc1c699 Per Franck Joncourt - Corrected misspelled word in fwknopd man page and access.conf. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@266 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-16 20:14:35 +00:00
Michael Rash
6f4ff9cb69 added --fw-list arg to the fwknopd daemon to list all current firewall rules for any running fwknopd process 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@260 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-13 04:09:07 +00:00
Damien Stuart
f03b2786eb Added the fwknopd_errors.[ch] files which provides the get_errstr() and fwknopd_errstr() functions. The get_errstr() function takes and error_code, tries to determine the type, then calls the appropriate xxx_errstr function to return a description string. Fixed some minor errors in the libfko API docs. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@258 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-11 20:16:32 +00:00
Damien Stuart
a0b813ca55 Reworked how man pages are generated. Now, man pages in the client and server directory are "fwknop(d).8.in" and a target was added to Makefile.am to create the man pages while doing variable substitutions based on directives specified via the configure script. Minor tweak to fwknop.spec file. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@251 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-11 01:27:12 +00:00
Damien Stuart
492b1db861 Slightly revamped how signals were setup. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@250 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-10 16:41:52 +00:00
Damien Stuart
4a85c6fd25 Modified top-level Makefile.am so the legacy perl stuff is not packaged into the distribution tar file. More cleanup of the fwknopd man page. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@249 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-10 00:48:41 +00:00
Damien Stuart
9c6377aff6 Manpage updates 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@247 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-09 02:09:22 +00:00
Damien Stuart
e9c0f41541 Added installation hook to set the perms on the .conf files to 600 during make install. Minot doc tweak. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@235 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-06 00:59:33 +00:00
Damien Stuart
5035cf0fed Added .fwknoprc file creation and processing. This allows for saved default and named configuration profiles. Updated fwknop manpage to reflect the new capability. Also cleaned up messages (errors, info) from the program. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@234 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-05 22:49:03 +00:00
Damien Stuart
8129f86ddd More cleanup. Removed the direction field (src, dst, both) from the chain configuration directives. Remove the HOSTNAME parameter as it was not used. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@232 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-07-04 21:12:51 +00:00
Damien Stuart
b217c6a1fa Added the GPG signature checking code. Added GPG_REQUIRE_SIG and GPG_IGNORE_SIG_VERIFY_ERROR parameters to access.conf. Implement the checking of GPG signature IDs against the GPG_REOMOTE_ID list. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@227 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-06-29 02:40:59 +00:00
Damien Stuart
b95d222d3c More tweaks, clean-up and documentation tweaks for the first release. Made client http-proxy option allow case insensitive match and to take an option :port as part of the argument. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@225 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-06-27 21:07:56 +00:00
Damien Stuart
fe09438921 Start of cleanup for beta release candidate. Removed locale-related code (for now) as it was breaking some things like logging. removed some unimplemented and/or unused parameters and config directives (as well as thier respective documentation references. Added a --rotate-digest-cache command-line arg to force a rename of the digest cache file and start a new one. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@224 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-06-24 02:31:36 +00:00
Damien Stuart
63b4da38dc Mostly documentation file updates. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@218 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-06-19 01:15:19 +00:00
Damien Stuart
f3c33c273b Added an initial fwknopd.8 man page (and source asciidoc). Added the --locale and --no-locale command-line option support. The set_config_entry function now allows setting a config entry to NULL to clear and free it. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@209 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-02-09 20:23:42 +00:00
Damien Stuart
d0373a5b33 Fixed libfko so gpgme engine is gpg by default. Added functions to libfko to set/get path to gpgme engine. Fixed some memory leaks. Reworkd the get_user_pw routine. Added code in fwknopd to put back the "hQ" string on the front of incoming GPG-encypted message data. Removed the previously add pretty-print routine to configure. Updated configure to check for path to gpg executable. Updated docs accordingly. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@205 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-02-06 03:43:54 +00:00
Damien Stuart
e3bd3b703e Added additional sanity checks and clean-up of access.conf processing and functionality. Fixes require source and added check for required username. Added fallback to use GPG_DECRYPT_PW if it was set and the normal KEY failed with a decyption error. Fixed packet count checks to allow a limit of 0 to mean unlimited number of packets. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@203 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-01-30 20:22:53 +00:00
Michael Rash
33cb0d4826 added --server-cmd arg to fwknop client man page and help output 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@197 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-01-16 22:09:14 +00:00
Michael Rash
cee622aab5 added --last-cmd argument to fwknop(8) man page via the fwknop.man.asciidoc file 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@196 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-01-16 21:11:27 +00:00
Damien Stuart
be37cecda1 Updated changelog. Made the fwknop.man.asciidoc match the changes made to the fwknopd.8 manpage. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@188 510a4753-2344-4c79-9c09-4d669213fbeb
 2010-01-05 00:06:56 +00:00
Damien Stuart
814d7d3565 Fixed bug in signal handling when libpcap version 1.0 is used. Minor doc update. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@170 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-12-07 03:48:53 +00:00
Damien Stuart
61c243f827 Added some more (stubbed-in) server code and functions. Minor doc tweak. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@148 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-09-14 00:38:31 +00:00
Damien Stuart
911361deff Minor manpage tweak 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@140 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-09-05 23:41:15 +00:00
Damien Stuart
f0fa45cec2 Added fwknop.man.asciidoc to docs and fwknop.8 man page to client (derived from fwknop.man.asciidoc). 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@136 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-09-03 03:25:35 +00:00
Damien Stuart
10c0aabe38 Fixed another minor typo in the doc 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@135 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-08-12 02:11:14 +00:00
Damien Stuart
078661e355 Fixed typo (actually a cut-and-paste remnant) in the doc. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@126 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-08-02 21:27:46 +00:00
Damien Stuart
7f45031cef Added SHA384 and SHA512 digests. Tweaks for getting rid of windows warnings. Use recv instead of read on socket. Bumped version to 0.63 (libfko) and 0.23 (FKO perl module). 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@123 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-08-02 18:28:34 +00:00
Damien Stuart
488ca566e1 Minor updates to non-code-related files. Changed some copyrights to 2009. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@100 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-06-07 20:33:53 +00:00
Damien Stuart
d711843e84 Changed fko version to 1.9.12. Made signing GPG-encrypted messages optional. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@86 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-05-17 15:44:07 +00:00
Damien Stuart
a32100f964 Updated documentation to reflect API changes and GPG signature functions. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@84 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-05-03 18:10:23 +00:00
Damien Stuart
d19e2777f7 Fixed segfault issue when spa_data_final was called before spa_message was set. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@77 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-03-30 00:56:05 +00:00
Damien Stuart
675e24be4c Fixed typo in doc 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@76 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-03-25 02:08:13 +00:00
Damien Stuart
6e90c5efc6 Added gpg-home-dir support to libfko and the fwknop program. Added the fko_set_spa_data() function. Documentation updates and other tweaks to support these changes. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@75 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-03-17 02:05:25 +00:00
Damien Stuart
c3f483a091 Better error checking/message for decription. Fixed typo in docs. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@69 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-02-22 22:18:38 +00:00
Damien Stuart
3342349b48 Fixed minor typo 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@61 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-02-11 02:47:09 +00:00
Damien Stuart
4ef8a25596 Update libfko docs for the gpgme-related error codes and function. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@60 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-02-11 01:00:08 +00:00
Damien Stuart
2d34c27f5a Fixed flag on gpgme_keylist_next that was forcing only private keys for recipient. Fixed typo in docs. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@49 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-01-28 03:38:42 +00:00
Damien Stuart
8e7cf3b5a9 Documentation updates and minor tweaks. Made it version 1.10.0 consistent in caonfigure.ac and fko.h. 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@47 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-01-27 02:47:49 +00:00
Damien Stuart
e846cdd44d First cut at GPG encrytion support (decryption and doc update are pending). 
git-svn-id: file:///home/mbr/svn/fwknop/trunk@39 510a4753-2344-4c79-9c09-4d669213fbeb
 2009-01-25 03:58:50 +00:00