863838d0ba
Updated the 'make install' step to not overwrite any existing config files in /etc/fwknop/ and instead install new copies from the source tree at /etc/fwknop/fwknopd.conf.inst and /etc/fwknop/access.conf.inst
133 lines
8.2 KiB
Plaintext
133 lines
8.2 KiB
Plaintext
fwknop-2.0.2 (08//2012):
|
||
- [server] For GPG mode, added a new access.conf variable
|
||
"GPG_ALLOW_NO_PW" to make it possible to leverage a server-side GPG key
|
||
pair that has no associated password. This comes in handy when a system
|
||
requires the user to leverage gpg-agent / pinentry which can present a
|
||
problem in automated environments as required by the fwknopd server.
|
||
Now, it might seem like a problem to remove the passphrase from a GPG
|
||
key pair, but it's important to note that simply doing this is little
|
||
worse than storing the passphrase in the clear on disk anyway in the
|
||
access.conf file. Further, this link helps provide additional detail:
|
||
|
||
http://www.gnupg.org/faq/GnuPG-FAQ.html#how-can-i-use-gnupg-in-an-automated-environment
|
||
|
||
- [client] In IP resolution mode (-R) changed HTTP connection type to
|
||
'close' since there is no need for connection persistence, and indeed the
|
||
client expects to just get the IP and the connection to be closed.
|
||
Jonathan Schulz submitted a patch for this.
|
||
- [client] Bug fix to ensure that all data is read via recv() from a
|
||
remote webserver IP resolution mode (-R). Previously IP resolution
|
||
could fail if HTTP headers were transferred separately from the data
|
||
(for whatever reason). Jonathan Schulz submitted a patch for this.
|
||
- [server] Bug fix to implement FLUSH_IPT_AT_INIT and FLUSH_IPT_AT_EXIT
|
||
functionality. These are enabled by default, and now iptables rules
|
||
added by fwknopd can be made persistant by setting these variables to
|
||
"N" in the fwknopd.conf file (this is not a recommended setting
|
||
however).
|
||
[server] Added FLUSH_IPFW_AT_INIT and FLUSH_IPFW_AT_EXIT for ipfw
|
||
firewalls to emulate the corresponding functionality that is implemented
|
||
for iptables firewalls. This was suggested by Jonathan Schulz.
|
||
- [server] Replay attack bug fix to ensure that an attacker cannot force a
|
||
replay attack by intercepting an SPA packet and the replaying it with the
|
||
base64 version of "Salted__" (for Rindael) or the "hQ" prefix (for
|
||
GnuPG). This is an important fix. The following comment was added into
|
||
the fwknopd code:
|
||
|
||
/* Ignore any SPA packets that contain the Rijndael or GnuPG prefixes
|
||
* since an attacker might have tacked them on to a previously seen
|
||
* SPA packet in an attempt to get past the replay check. And, we're
|
||
* no worse off since a legitimate SPA packet that happens to include
|
||
* a prefix after the outer one is stripped off won't decrypt properly
|
||
* anyway because libfko would not add a new one.
|
||
*/
|
||
|
||
- [server] Fixed a memory leak bug in the replay attack detection code.
|
||
The leak was found with the test suite in --enable-valgrind mode, and
|
||
here is the valgrind trace that exposed it:
|
||
|
||
44 bytes in 1 blocks are definitely lost in loss record 2 of 2
|
||
at 0x482BE68: malloc (in
|
||
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
|
||
by 0x490EA50: strdup (strdup.c:43)
|
||
by 0x10CD69: incoming_spa (incoming_spa.c:162)
|
||
by 0x10E000: process_packet (process_packet.c:200)
|
||
by 0x4862E63: ??? (in /usr/lib/i386-linux-gnu/libpcap.so.1.1.1)
|
||
by 0x4865667: pcap_dispatch (in /usr/lib/i386-linux-gnu/libpcap.so.1.1.1)
|
||
by 0x10DABF: pcap_capture (pcap_capture.c:226)
|
||
by 0x10A798: main (fwknopd.c:299)
|
||
|
||
- [test suite] Added GPG tests for keyrings that have no associated
|
||
passphrases.
|
||
- [server] Implemented a new check to ensure that the iptables 'comment'
|
||
match exists to ensure the proper environment for fwknopd operations.
|
||
This check is controlled by the new ENABLE_IPT_COMMENT_CHECK variable,
|
||
and was suggested by Hank Leininger.
|
||
- [server] 'make install' fix to ensure restrictive permissions on the
|
||
/etc/fwknop/ directory and /etc/fwknop/* files. Also updated the 'make
|
||
install' step to not overwrite any existing config files in /etc/fwknop/
|
||
and instead install new copies from the source tree at
|
||
/etc/fwknop/fwknopd.conf.inst and /etc/fwknop/access.conf.inst
|
||
|
||
fwknop-2.0.1 (07/23/2012):
|
||
- [server] Bug fix where the same encryption key used for two stanzas in
|
||
the access.conf file would result in access requests that matched the
|
||
second stanza to always be treated as a replay attack. This has been
|
||
fixed for the fwknop-2.0.1 release, and was reported by Andy Rowland. Now
|
||
the fwknopd server computes the SHA256 digest of raw incoming payload
|
||
data before decryption, and compares this against all previous hashes.
|
||
Previous to this commit, fwknopd would add a new hash to the replay
|
||
digest list right after the first access.conf stanza match, so when SPA
|
||
packet data matched the second access.conf stanza a matching replay
|
||
digest would already be there.
|
||
- [server] Updated PCAP_LOOP_SLEEP default to 1/10th of a second (in
|
||
microseconds). This was supposed to be the default anyway, but C
|
||
Anthony Risinger reported a bug where fwknopd was consuming more
|
||
resources than necessary, and the cause was PCAP_LOOP_SLEEP set by
|
||
default to 1/100th of a second - this has been fixed.
|
||
- [libfko] Added SPA message validation calls to fko decoding routines to
|
||
help ensure that SPA messages conform to expected values.
|
||
- Bug fix for PF firewalls: updated the PF anchor check to not rely on
|
||
listing the PF policy - fwknopd now uses 'pfctl -s Anchor' instead.
|
||
- [test suite] Added parsing of valgrind output to produce a listing of
|
||
functions that have been flagged - this assists in the development
|
||
process to ensure that fwknop is not leaking memory.
|
||
- [test suite] Bug fix on Mac OS X systems to account for libfko.dylib path
|
||
instead of libfko.so. This fixes the existence check for libfko.
|
||
- [test suite] Added tests for --nat-local mode.
|
||
- [client] Fixed several minor memory leaks caught by valgrind.
|
||
- [libfko] Minor gcc warning fix: fko_decode.c:43:17: warning: variable
|
||
‘edata_size’ set but not used [-Wunused-but-set-variable].
|
||
- Updated fwknopd init script for Debian systems (contributed by Franck
|
||
Joncourt).
|
||
|
||
fwknop-2.0 (01/02/2012):
|
||
- This is the first production release that has been completely re-written
|
||
in C. This brings Single Packet Authorization functionality to all sorts
|
||
of machines from embedded devices to large systems. iptables, ipfw, and
|
||
pf firewalls are supported by the fwknopd daemon, and the fwknop client
|
||
is known to work on most major *NIX environments, the iPhone and Android
|
||
operating systems, and Cygwin under Windows.
|
||
- Added FORCE_NAT mode to the access.conf file so that for any valid SPA
|
||
packet, force the requested connection to be NAT'd through to the
|
||
specified (usually internal) IP and port value. This is useful if there
|
||
are multiple internal systems running a service such as SSHD, and you
|
||
want to give transparent access to only one internal system for each
|
||
stanza in the access.conf file. This way, multiple external users can
|
||
each directly access only one internal system per SPA key.
|
||
- Added two new access.conf variables are added "ACCESS_EXPIRE" and
|
||
"ACCESS_EXPIRE_EPOCH" to allow access stanzas to be expired without
|
||
having to modify the access.conf file and restart fwknopd.
|
||
- Added a new feature to allow an access stanza that matches the SPA source
|
||
address to not automatically short circuit other stanzas if there is an
|
||
error (such as when there are multiple encryption keys involved and an
|
||
incoming SPA packet is meant for, say, the second stanza and the first
|
||
therefore doesn't allow proper decryption).
|
||
- Bug fix to exclude SPA packets with timestamps in the future that are too
|
||
great (old packets were properly excluded already).
|
||
- Bug fix to honor the fwknop client --time-offset-plus and
|
||
--time-offset-minus options
|
||
- Added DNAT mode tests, minor memory leak fix in NAT mode, added fwknopd
|
||
check for ENABLE_IPT_FORWARDING variable before attempting NAT access.
|
||
- [test suite] Added --diff mode to compare results from one execution to
|
||
the next.
|