1
1
------------------------------------------------------------------------
2
r1281 | mbr | 2008-10-01 07:55:41 -0400 (Wed, 01 Oct 2008) | 4 lines
4
M /fwknop/tags/fwknop-1.9.8/ChangeLog
6
- Made the updated UI from Sean Greven available on cipherdyne.org. This
7
update fixes the timezone problem so that SPA packets generated by the
8
UI will be properly handled by an fwknopd server.
10
------------------------------------------------------------------------
11
r1280 | mbr | 2008-10-01 07:48:05 -0400 (Wed, 01 Oct 2008) | 1 line
13
A /fwknop/tags/fwknop-1.9.8 (from /fwknop/branches/fwknop-1.9.8:1279)
15
tagged fwknop-1.9.8 release
16
------------------------------------------------------------------------
17
r1279 | mbr | 2008-10-01 07:46:40 -0400 (Wed, 01 Oct 2008) | 1 line
19
A /fwknop/branches/fwknop-1.9.8/ChangeLog.svn
21
added ChangeLog.svn file to track -r 1278:1238 for 1.9.8 release
22
------------------------------------------------------------------------
23
r1278 | mbr | 2008-10-01 07:41:20 -0400 (Wed, 01 Oct 2008) | 1 line
25
A /fwknop/branches/fwknop-1.9.8 (from /fwknop/trunk:1277)
27
created fwknop-1.9.8 branch
28
------------------------------------------------------------------------
29
r1277 | mbr | 2008-09-30 22:37:05 -0400 (Tue, 30 Sep 2008) | 1 line
2
r1354 | mbr | 2008-11-13 23:01:02 -0500 (Thu, 13 Nov 2008) | 1 line
4
A /fwknop/branches/fwknop-1.9.9 (from /fwknop/trunk:1353)
6
created fwknop-1.9.9 branch
7
------------------------------------------------------------------------
8
r1353 | mbr | 2008-11-13 22:56:46 -0500 (Thu, 13 Nov 2008) | 1 line
10
M /fwknop/trunk/ChangeLog
31
11
M /fwknop/trunk/VERSION
32
12
M /fwknop/trunk/fwknop
33
13
M /fwknop/trunk/fwknop_serv
34
14
M /fwknop/trunk/fwknopd
35
15
M /fwknop/trunk/knoptm
36
16
M /fwknop/trunk/knopwatchd.c
37
M /fwknop/trunk/test/fwknop_test.pl
40
------------------------------------------------------------------------
41
r1276 | mbr | 2008-09-30 22:23:52 -0400 (Tue, 30 Sep 2008) | 1 line
43
M /fwknop/trunk/ChangeLog
46
------------------------------------------------------------------------
47
r1275 | mbr | 2008-09-30 22:23:41 -0400 (Tue, 30 Sep 2008) | 1 line
49
M /fwknop/trunk/CREDITS
52
------------------------------------------------------------------------
53
r1274 | mbr | 2008-09-30 22:23:21 -0400 (Tue, 30 Sep 2008) | 1 line
55
17
M /fwknop/trunk/packaging/fwknop-nodeps.spec
56
18
M /fwknop/trunk/packaging/fwknop.spec
58
bumped version to 1.9.8
59
------------------------------------------------------------------------
60
r1273 | mbr | 2008-09-30 08:04:52 -0400 (Tue, 30 Sep 2008) | 1 line
62
M /fwknop/trunk/CREDITS
64
added Francois Marier, made additions for Franck
65
------------------------------------------------------------------------
66
r1271 | mbr | 2008-09-30 07:57:05 -0400 (Tue, 30 Sep 2008) | 1 line
68
M /fwknop/trunk/VERSION
69
M /fwknop/trunk/fwknop
70
M /fwknop/trunk/fwknop_serv
71
M /fwknop/trunk/fwknopd
72
M /fwknop/trunk/knoptm
73
M /fwknop/trunk/knopwatchd.c
74
M /fwknop/trunk/test/fwknop_test.pl
76
bumped version to 1.9.8-pre5
77
------------------------------------------------------------------------
78
r1270 | mbr | 2008-09-30 07:56:34 -0400 (Tue, 30 Sep 2008) | 3 lines
80
M /fwknop/trunk/fwknopd
82
Fixed check_commands() include/exclude search criteria by using the keys
83
operator against incoming hash refs (bug noticed by Franck Joncourt).
85
------------------------------------------------------------------------
86
r1269 | mbr | 2008-09-30 07:55:19 -0400 (Tue, 30 Sep 2008) | 11 lines
88
M /fwknop/trunk/fwknopd.8
90
|From: Franck Joncourt <franck.mail@dthconnex.com>
91
|Subject: [PATCH] fixes/fwknopd_manpage
93
|Hyphen used as minus sign found in fwknopd.8
96
| This fixes the following lintian warning about fwknopd manpage:
97
| http://lintian.debian.org/tags/hyphen-used-as-minus-sign.html
99
|Signed-off-by: Franck Joncourt <franck.mail@dthconnex.com>
101
------------------------------------------------------------------------
102
r1267 | mbr | 2008-09-29 23:37:27 -0400 (Mon, 29 Sep 2008) | 1 line
104
M /fwknop/trunk/VERSION
105
M /fwknop/trunk/fwknop
106
M /fwknop/trunk/fwknop_serv
107
M /fwknop/trunk/fwknopd
108
M /fwknop/trunk/knoptm
109
M /fwknop/trunk/knopwatchd.c
110
M /fwknop/trunk/test/fwknop_test.pl
112
bumped version to 1.9.8-pre4
113
------------------------------------------------------------------------
114
r1266 | mbr | 2008-09-29 23:36:50 -0400 (Mon, 29 Sep 2008) | 6 lines
116
M /fwknop/trunk/ChangeLog
117
M /fwknop/trunk/fwknop
118
M /fwknop/trunk/fwknop.8
119
M /fwknop/trunk/fwknopd
120
M /fwknop/trunk/fwknopd.8
121
M /fwknop/trunk/test/fwknop_test.pl
123
- Bugfix to make sure that neither fwknop nor fwknopd reference any
124
options file in GnuPG mode, and this is now the default (which overrides
125
the now unnecessary --gpg-no-options arg). There is a new option
126
--gpg-use-options to restore the usage of an options file by GnuPG (not
129
------------------------------------------------------------------------
130
r1265 | mbr | 2008-09-29 19:49:47 -0400 (Mon, 29 Sep 2008) | 1 line
132
M /fwknop/trunk/fwknopd
135
------------------------------------------------------------------------
136
r1264 | mbr | 2008-09-29 19:46:59 -0400 (Mon, 29 Sep 2008) | 7 lines
138
M /fwknop/trunk/ChangeLog
139
M /fwknop/trunk/fwknopd
140
M /fwknop/trunk/test/fwknop_test.pl
142
- Updated fwknopd to enforce the DIGEST_TYPE variable more strictly by not
143
accepting SPA packets that do not include digest of the specified type.
144
The DIGEST_TYPE default is 'ALL', so normally fwknopd accepts any
146
- (Test suite) Added test for mis-matched DIGEST_TYPE vs. digest algorithm
149
------------------------------------------------------------------------
150
r1262 | mbr | 2008-09-28 22:50:44 -0400 (Sun, 28 Sep 2008) | 1 line
152
M /fwknop/trunk/VERSION
153
M /fwknop/trunk/fwknop
154
M /fwknop/trunk/fwknop_serv
155
M /fwknop/trunk/fwknopd
156
M /fwknop/trunk/knoptm
157
M /fwknop/trunk/knopwatchd.c
158
M /fwknop/trunk/test/fwknop_test.pl
160
bumped version to 1.9.8-pre3
161
------------------------------------------------------------------------
162
r1261 | mbr | 2008-09-28 22:48:40 -0400 (Sun, 28 Sep 2008) | 1 line
164
M /fwknop/trunk/knoptm
166
added exclusion for gpg command in check_commands()
167
------------------------------------------------------------------------
168
r1260 | mbr | 2008-09-28 22:02:10 -0400 (Sun, 28 Sep 2008) | 3 lines
170
M /fwknop/trunk/ChangeLog
171
M /fwknop/trunk/fwknopd
172
A /fwknop/trunk/test/conf/gpg2_access.conf
173
A /fwknop/trunk/test/conf/gpg2_fwknop.conf
174
M /fwknop/trunk/test/fwknop_test.pl
176
(Test suite) Added tests for GnuPG version 2 (a check is made to see if
177
it is installed before these tests are run).
179
------------------------------------------------------------------------
180
r1259 | mbr | 2008-09-28 21:34:55 -0400 (Sun, 28 Sep 2008) | 1 line
182
M /fwknop/trunk/fwknopd
184
minor addition to be sure to print all access keys in --debug mode (mostly useful for the test suite in order to see all access.conf directives)
185
------------------------------------------------------------------------
186
r1257 | mbr | 2008-09-28 20:22:00 -0400 (Sun, 28 Sep 2008) | 1 line
188
M /fwknop/trunk/VERSION
189
M /fwknop/trunk/fwknop
190
M /fwknop/trunk/fwknop_serv
191
M /fwknop/trunk/fwknopd
192
M /fwknop/trunk/knoptm
193
M /fwknop/trunk/knopwatchd.c
194
M /fwknop/trunk/test/fwknop_test.pl
196
bumped version to 1.9.8-pre2
197
------------------------------------------------------------------------
198
r1256 | mbr | 2008-09-28 20:21:23 -0400 (Sun, 28 Sep 2008) | 1 line
200
M /fwknop/trunk/ChangeLog
203
------------------------------------------------------------------------
204
r1255 | mbr | 2008-09-28 20:17:46 -0400 (Sun, 28 Sep 2008) | 1 line
206
M /fwknop/trunk/fwknopd.8
208
added GPG_NO_OPTIONS, GPG_NO_REQUIRE_PREFIX, and GPG_PATH access.conf vars
209
------------------------------------------------------------------------
210
r1254 | mbr | 2008-09-28 20:17:20 -0400 (Sun, 28 Sep 2008) | 1 line
212
M /fwknop/trunk/fwknopd
214
Added GPG_PATH variable to access.conf import routine to allow different paths for gpg to be specified on a per-SOURCE basis
215
------------------------------------------------------------------------
216
r1253 | mbr | 2008-09-28 18:02:20 -0400 (Sun, 28 Sep 2008) | 1 line
218
M /fwknop/trunk/fwknop
220
minor update to validate command line args in a separate function, and added checks for --gpg-path
221
------------------------------------------------------------------------
222
r1252 | mbr | 2008-09-28 17:51:36 -0400 (Sun, 28 Sep 2008) | 1 line
224
M /fwknop/trunk/fwknopd
226
minor update to include debuging code in check_command()
227
------------------------------------------------------------------------
228
r1251 | mbr | 2008-09-28 16:28:42 -0400 (Sun, 28 Sep 2008) | 20 lines
230
M /fwknop/trunk/ChangeLog
231
M /fwknop/trunk/fwknop
232
M /fwknop/trunk/fwknop.conf
233
M /fwknop/trunk/fwknopd
234
M /fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf
235
M /fwknop/trunk/test/conf/blacklist_fwknop.conf
236
M /fwknop/trunk/test/conf/default_fwknop.conf
237
M /fwknop/trunk/test/conf/filter_62203_fwknop.conf
238
M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
239
A /fwknop/trunk/test/conf/gpg_access_no_prefix.conf
240
M /fwknop/trunk/test/conf/md5_fwknop.conf
241
M /fwknop/trunk/test/conf/no_local_nat_fwknop.conf
242
M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
243
M /fwknop/trunk/test/conf/output_chain_fwknop.conf
244
M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
245
M /fwknop/trunk/test/conf/pk_fwknop.conf
246
M /fwknop/trunk/test/conf/rand_port_fwknop.conf
247
M /fwknop/trunk/test/conf/sha1_fwknop.conf
248
M /fwknop/trunk/test/conf/sha256_fwknop.conf
249
M /fwknop/trunk/test/conf/spa_aging_fwknop.conf
250
M /fwknop/trunk/test/fwknop_test.pl
252
- Added GPG_NO_REQUIRE_PREFIX to access.conf to control whether the GnuPG
253
'hQ' prefix is added before base64 decoding and decrypting. Normally
254
this is not needed, but if there appear to be communications issues
255
between the fwknop client and the fwknopd server then this option can be
256
useful to ensure that encrypted SPA data is sent through the GnuPG
257
decryption routine. The 'hQ' prefix is a heuristic derived from the
258
file 'magic' database for describing data encrypted with GnuPG, and the
259
fwknop client normally strips this data from outgoing SPA packets
260
(unless the --Include-gpg-prefix option is used).
261
- Added '--gpg-prefix <bytes>' to the fwknop client so that the
262
predictable prefix for GnuPG encrypted data can be changed. Normally
263
this prefix is 'hQ' (base64 encoded), or the raw bytes 0x8502.
264
- Added the ability to control the path used for the gpg binary on the
265
client side with a new argument '--gpg-path <path>', and on the server
266
side with gpgCmd in the fwknop.conf file. The GnuPG::Interface module
267
normally just takes the first instance of gpg that is the current path,
268
but this new feature allows the path to the binary to be explicitly set.
269
- (Test suite) Added tests for GPG_NO_REQUIRE_PREFIX functionality and for
270
the expected GnuPG prefix.
272
------------------------------------------------------------------------
273
r1250 | mbr | 2008-09-27 10:23:52 -0400 (Sat, 27 Sep 2008) | 1 line
275
M /fwknop/trunk/fwknop.8
277
applied patch from Franck Joncourt to add the --Home-dir, --Max-packet-size, and --Show-last-cmd command line args
278
------------------------------------------------------------------------
279
r1249 | mbr | 2008-09-21 17:10:09 -0400 (Sun, 21 Sep 2008) | 1 line
283
added - Payload offset to look for valid SPA data.
284
------------------------------------------------------------------------
285
r1248 | mbr | 2008-09-14 12:12:23 -0400 (Sun, 14 Sep 2008) | 1 line
287
M /fwknop/trunk/ChangeLog
289
blurb for the new base64_byte_frequency.pl script
290
------------------------------------------------------------------------
291
r1247 | mbr | 2008-09-14 12:12:01 -0400 (Sun, 14 Sep 2008) | 1 line
293
M /fwknop/trunk/test/base64_byte_frequency.pl
295
added Id tag expansion
296
------------------------------------------------------------------------
297
r1246 | mbr | 2008-09-14 12:08:00 -0400 (Sun, 14 Sep 2008) | 1 line
299
A /fwknop/trunk/test/base64_byte_frequency.pl
301
added base64_byte_frequency.pl file to make it easy to visualize base64 encoded SPA packets
302
------------------------------------------------------------------------
303
r1244 | mbr | 2008-09-14 07:46:21 -0400 (Sun, 14 Sep 2008) | 1 line
305
M /fwknop/trunk/VERSION
306
M /fwknop/trunk/fwknop
307
M /fwknop/trunk/fwknop_serv
308
M /fwknop/trunk/fwknopd
309
M /fwknop/trunk/knoptm
310
M /fwknop/trunk/knopwatchd.c
311
M /fwknop/trunk/test/fwknop_test.pl
313
bumped version to 1.9.8-pre1
314
------------------------------------------------------------------------
315
r1243 | mbr | 2008-09-13 23:02:42 -0400 (Sat, 13 Sep 2008) | 5 lines
317
M /fwknop/trunk/CREDITS
318
M /fwknop/trunk/ChangeLog
319
M /fwknop/trunk/fwknopd
320
A /fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf
321
M /fwknop/trunk/test/fwknop_test.pl
323
- Bugfix to make sure to apply BLACKLIST checks to IP addresses specified
324
with -a (or derived via -R) in addition to the source IP in the IP
325
header (which can be modified via --Spoof-src). (Franck Joncourt
326
submitted a patch for this.)
328
------------------------------------------------------------------------
329
r1242 | mbr | 2008-09-13 09:18:44 -0400 (Sat, 13 Sep 2008) | 1 line
331
M /fwknop/trunk/CREDITS
332
M /fwknop/trunk/ChangeLog
333
M /fwknop/trunk/fwknop
334
M /fwknop/trunk/knoptm
336
removed Net::IPv4Addr dependency for the fwknop client and knoptm daemon, and updated the ChangeLog for 1.9.8
337
------------------------------------------------------------------------
338
r1241 | mbr | 2008-09-13 09:06:08 -0400 (Sat, 13 Sep 2008) | 1 line
340
M /fwknop/trunk/fwknop
341
M /fwknop/trunk/fwknop.8
343
Added --Save-packet-append to allow large sets of SPA packets to be collected by calling fwknop in a loop from a shell
344
------------------------------------------------------------------------
345
r1240 | mbr | 2008-09-04 00:26:06 -0400 (Thu, 04 Sep 2008) | 1 line
347
M /fwknop/trunk/CREDITS
348
M /fwknop/trunk/fwknop_funcs.c
350
added chmod() to ensure that .pid files have 0600 permissions
351
------------------------------------------------------------------------
352
r1239 | mbr | 2008-08-31 09:31:33 -0400 (Sun, 31 Aug 2008) | 5 lines
354
M /fwknop/trunk/fwknop.8
356
-Bugfix for missing "\" chars before dashes (noticed by Franck Joncourt):
358
http://lintian.debian.org/tags/hyphen-used-as-minus-sign.htm
19
M /fwknop/trunk/test/fwknop_test.pl
21
bumped version to 1.9.9
22
------------------------------------------------------------------------
23
r1352 | mbr | 2008-11-13 22:49:45 -0500 (Thu, 13 Nov 2008) | 1 line
25
M /fwknop/trunk/fwknop
27
minor wording update to make it clear when an SPA packet is sent over an established TCP connection (suggested by Alexander Perlis)
28
------------------------------------------------------------------------
29
r1351 | mbr | 2008-11-13 22:24:32 -0500 (Thu, 13 Nov 2008) | 1 line
31
M /fwknop/trunk/fwknop.8
33
wording update to make it clear that fwknop creates a TCP connection when --TCP-sock is used
34
------------------------------------------------------------------------
35
r1349 | mbr | 2008-11-11 23:05:23 -0500 (Tue, 11 Nov 2008) | 1 line
37
M /fwknop/trunk/VERSION
38
M /fwknop/trunk/fwknop
39
M /fwknop/trunk/fwknop_serv
40
M /fwknop/trunk/fwknopd
41
M /fwknop/trunk/knoptm
42
M /fwknop/trunk/knopwatchd.c
43
M /fwknop/trunk/test/fwknop_test.pl
45
updated to version 1.9.9-pre9
46
------------------------------------------------------------------------
47
r1348 | mbr | 2008-11-11 23:04:35 -0500 (Tue, 11 Nov 2008) | 1 line
49
M /fwknop/trunk/CREDITS
51
knoptm update for Franck
52
------------------------------------------------------------------------
53
r1347 | mbr | 2008-11-11 23:04:28 -0500 (Tue, 11 Nov 2008) | 1 line
55
M /fwknop/trunk/knoptm.8
58
------------------------------------------------------------------------
59
r1346 | mbr | 2008-11-11 23:03:03 -0500 (Tue, 11 Nov 2008) | 4 lines
61
M /fwknop/trunk/CREDITS
62
M /fwknop/trunk/ChangeLog
63
M /fwknop/trunk/fwknop.conf
64
M /fwknop/trunk/fwknopd
65
M /fwknop/trunk/knoptm
66
M /fwknop/trunk/test/conf/any_interface_fwknop.conf
67
M /fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf
68
M /fwknop/trunk/test/conf/blacklist_fwknop.conf
69
M /fwknop/trunk/test/conf/default_fwknop.conf
70
M /fwknop/trunk/test/conf/filter_62203_fwknop.conf
71
M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
72
M /fwknop/trunk/test/conf/gpg2_fwknop.conf
73
M /fwknop/trunk/test/conf/ipt_sleep_fwknop.conf
74
M /fwknop/trunk/test/conf/md5_fwknop.conf
75
M /fwknop/trunk/test/conf/no_local_nat_fwknop.conf
76
M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
77
M /fwknop/trunk/test/conf/output_chain_fwknop.conf
78
M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
79
M /fwknop/trunk/test/conf/pk_fwknop.conf
80
M /fwknop/trunk/test/conf/popen_fwknop.conf
81
M /fwknop/trunk/test/conf/rand_port_fwknop.conf
82
M /fwknop/trunk/test/conf/sha1_fwknop.conf
83
M /fwknop/trunk/test/conf/sha256_fwknop.conf
84
M /fwknop/trunk/test/conf/spa_aging_fwknop.conf
85
M /fwknop/trunk/test/conf/system_fwknop.conf
87
- Added code to prefer the usage of the /usr/sbin/sendmail binary to send
88
email alerts before falling back to the mail binary (suggested by
91
------------------------------------------------------------------------
92
r1345 | mbr | 2008-11-11 21:49:08 -0500 (Tue, 11 Nov 2008) | 1 line
94
M /fwknop/trunk/knoptm.8
96
applied knoptm(8) man page update from Franck Joncourt to add discussion of knoptm command line options
97
------------------------------------------------------------------------
98
r1343 | mbr | 2008-11-09 14:47:16 -0500 (Sun, 09 Nov 2008) | 1 line
100
M /fwknop/trunk/VERSION
101
M /fwknop/trunk/fwknop
102
M /fwknop/trunk/fwknop_serv
103
M /fwknop/trunk/fwknopd
104
M /fwknop/trunk/knoptm
105
M /fwknop/trunk/knopwatchd.c
106
M /fwknop/trunk/test/fwknop_test.pl
108
bumped version to 1.9.9-pre8
109
------------------------------------------------------------------------
110
r1342 | mbr | 2008-11-09 14:46:15 -0500 (Sun, 09 Nov 2008) | 1 line
112
A /fwknop/trunk/test/conf/external_cmd_no_dash_A_access.conf
114
added conf/external_cmd_no_dash_A_access.conf
115
------------------------------------------------------------------------
116
r1341 | mbr | 2008-11-09 14:44:46 -0500 (Sun, 09 Nov 2008) | 5 lines
118
M /fwknop/trunk/ChangeLog
119
M /fwknop/trunk/fwknopd
120
M /fwknop/trunk/knoptm
121
M /fwknop/trunk/test/fwknop_test.pl
123
(Test suite): Added the ability to collect output from knoptm to see
124
when requests are received from fwknopd and when rules are added and
126
(Test suite): Better startup/shutdown with fwknop processes stopped at both.
128
------------------------------------------------------------------------
129
r1340 | mbr | 2008-11-09 01:17:12 -0500 (Sun, 09 Nov 2008) | 1 line
131
M /fwknop/trunk/fwknopd
132
M /fwknop/trunk/knoptm
133
M /fwknop/trunk/test/conf/external_cmd_access.conf
134
A /fwknop/trunk/test/conf/external_cmd_no_open_ports_access.conf
135
M /fwknop/trunk/test/fwknop_test.pl
137
added the ability in fwknopd to collect debug output from knoptm via a file, added tests for no OPEN_PORTS variable in the test suite
138
------------------------------------------------------------------------
139
r1339 | mbr | 2008-11-08 21:23:05 -0500 (Sat, 08 Nov 2008) | 1 line
141
M /fwknop/trunk/test/fwknop_test.pl
143
code clean to consolidate fw sleep() functions
144
------------------------------------------------------------------------
145
r1338 | mbr | 2008-11-08 21:17:27 -0500 (Sat, 08 Nov 2008) | 1 line
147
M /fwknop/trunk/fwknopd
149
updated to not require OPEN_PORTS for a SOURCE stanza if we're running in external_cmd mode
150
------------------------------------------------------------------------
151
r1337 | mbr | 2008-11-06 01:07:35 -0500 (Thu, 06 Nov 2008) | 1 line
153
M /fwknop/trunk/CREDITS
154
M /fwknop/trunk/fwknopd
156
bug fix to not start the fwknopd daemons under --fw-list when FIREWALL_TYPE is set to 'external_cmd'
157
------------------------------------------------------------------------
158
r1336 | mbr | 2008-11-06 00:57:15 -0500 (Thu, 06 Nov 2008) | 1 line
160
M /fwknop/trunk/CREDITS
161
M /fwknop/trunk/fwknopd
163
bug fix to allow SPA packets that do not specify a list of ports still results in external commands being executed in EXTERNAL_* mode
164
------------------------------------------------------------------------
165
r1335 | mbr | 2008-11-06 00:39:57 -0500 (Thu, 06 Nov 2008) | 5 lines
167
M /fwknop/trunk/CREDITS
168
M /fwknop/trunk/ChangeLog
169
M /fwknop/trunk/fwknop
170
M /fwknop/trunk/test/fwknop_test.pl
172
- Bug fix for the fwknop client in symmetric key mode where the terminal
173
would not be taken out of 'noecho' mode if a password less than 8
174
characters long is provided. Previous to this fix, it was necessary to
175
blindly type 'reset'. (Reported by Alexander Perlis.)
177
------------------------------------------------------------------------
178
r1333 | mbr | 2008-11-04 23:45:00 -0500 (Tue, 04 Nov 2008) | 1 line
180
M /fwknop/trunk/VERSION
181
M /fwknop/trunk/fwknop
182
M /fwknop/trunk/fwknop_serv
183
M /fwknop/trunk/fwknopd
184
M /fwknop/trunk/knoptm
185
M /fwknop/trunk/knopwatchd.c
186
M /fwknop/trunk/test/fwknop_test.pl
188
bumped version to 1.9.9-pre7
189
------------------------------------------------------------------------
190
r1332 | mbr | 2008-11-04 23:44:44 -0500 (Tue, 04 Nov 2008) | 1 line
192
M /fwknop/trunk/knoptm
194
bug fix for applying variable expansion to EXTERNAL_* vars
195
------------------------------------------------------------------------
196
r1330 | mbr | 2008-11-04 23:28:39 -0500 (Tue, 04 Nov 2008) | 1 line
198
M /fwknop/trunk/VERSION
199
M /fwknop/trunk/fwknop
200
M /fwknop/trunk/fwknop_serv
201
M /fwknop/trunk/fwknopd
202
M /fwknop/trunk/knoptm
203
M /fwknop/trunk/knopwatchd.c
204
M /fwknop/trunk/test/fwknop_test.pl
206
bumped version to 1.9.9-pre6
207
------------------------------------------------------------------------
208
r1329 | mbr | 2008-11-04 21:54:53 -0500 (Tue, 04 Nov 2008) | 1 line
210
M /fwknop/trunk/fwknopd
211
M /fwknop/trunk/test/fwknop_test.pl
213
bug fix for EXTERNAL_* vars and variable expansion (reported by Alexander Perlis), updated fwknopd to accept access.conf vars without trailing colon chars
214
------------------------------------------------------------------------
215
r1327 | mbr | 2008-11-02 23:26:07 -0500 (Sun, 02 Nov 2008) | 1 line
217
M /fwknop/trunk/VERSION
218
M /fwknop/trunk/fwknop
219
M /fwknop/trunk/fwknop_serv
220
M /fwknop/trunk/fwknopd
221
M /fwknop/trunk/knoptm
222
M /fwknop/trunk/knopwatchd.c
223
M /fwknop/trunk/test/fwknop_test.pl
225
bumped version to 1.9.9-pre5
226
------------------------------------------------------------------------
227
r1326 | mbr | 2008-11-02 22:54:20 -0500 (Sun, 02 Nov 2008) | 1 line
229
M /fwknop/trunk/fwknop.conf
230
M /fwknop/trunk/fwknopd
231
M /fwknop/trunk/knoptm
232
M /fwknop/trunk/test/conf/any_interface_fwknop.conf
233
M /fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf
234
M /fwknop/trunk/test/conf/blacklist_fwknop.conf
235
M /fwknop/trunk/test/conf/default_fwknop.conf
236
A /fwknop/trunk/test/conf/external_cmd_access.conf
237
M /fwknop/trunk/test/conf/filter_62203_fwknop.conf
238
M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
239
M /fwknop/trunk/test/conf/gpg2_fwknop.conf
240
M /fwknop/trunk/test/conf/ipt_sleep_fwknop.conf
241
M /fwknop/trunk/test/conf/md5_fwknop.conf
242
M /fwknop/trunk/test/conf/no_local_nat_fwknop.conf
243
M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
244
M /fwknop/trunk/test/conf/output_chain_fwknop.conf
245
M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
246
M /fwknop/trunk/test/conf/pk_fwknop.conf
247
M /fwknop/trunk/test/conf/popen_fwknop.conf
248
M /fwknop/trunk/test/conf/rand_port_fwknop.conf
249
M /fwknop/trunk/test/conf/sha1_fwknop.conf
250
M /fwknop/trunk/test/conf/sha256_fwknop.conf
251
M /fwknop/trunk/test/conf/spa_aging_fwknop.conf
252
M /fwknop/trunk/test/conf/system_fwknop.conf
253
M /fwknop/trunk/test/fwknop_test.pl
255
bug fix in external command mode to send the command to knoptm base64 encoded, added ENABLE_EXT_CMD_PREFIX and EXT_CMD_PREFIX to control naming of substitution vars, added the ability to test the external command mode (test suite).
256
------------------------------------------------------------------------
257
r1325 | mbr | 2008-11-02 12:47:47 -0500 (Sun, 02 Nov 2008) | 25 lines
259
M /fwknop/trunk/CREDITS
260
M /fwknop/trunk/ChangeLog
261
M /fwknop/trunk/fwknop.conf
262
M /fwknop/trunk/fwknopd
263
M /fwknop/trunk/knoptm
264
M /fwknop/trunk/test/conf/any_interface_fwknop.conf
265
M /fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf
266
M /fwknop/trunk/test/conf/blacklist_fwknop.conf
267
M /fwknop/trunk/test/conf/default_fwknop.conf
268
M /fwknop/trunk/test/conf/filter_62203_fwknop.conf
269
M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
270
M /fwknop/trunk/test/conf/gpg2_fwknop.conf
271
M /fwknop/trunk/test/conf/ipt_sleep_fwknop.conf
272
M /fwknop/trunk/test/conf/md5_fwknop.conf
273
M /fwknop/trunk/test/conf/no_local_nat_fwknop.conf
274
M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
275
M /fwknop/trunk/test/conf/output_chain_fwknop.conf
276
M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
277
M /fwknop/trunk/test/conf/pk_fwknop.conf
278
M /fwknop/trunk/test/conf/popen_fwknop.conf
279
M /fwknop/trunk/test/conf/rand_port_fwknop.conf
280
M /fwknop/trunk/test/conf/sha1_fwknop.conf
281
M /fwknop/trunk/test/conf/sha256_fwknop.conf
282
M /fwknop/trunk/test/conf/spa_aging_fwknop.conf
283
M /fwknop/trunk/test/conf/system_fwknop.conf
285
- Added support for interfacing fwknop with third party software through
286
the addition of three new variables in the access.conf file (or set
287
globally in the fwknop.conf file): EXTERNAL_CMD_OPEN,
288
EXTERNAL_CMD_CLOSE, and EXTERNAL_CMD_ALARM.
289
The "open" and "close" commands might be manually supplied firewall
290
commands, and both support variable substitution of any of the variables
291
in the access.conf file with "$VAR". Also, three special variables are
292
supported: $SRC, $PORT, and $PROTO, which are derived from actual values
293
from within valid SPA packets (as opposed to $SOURCE from access.conf
294
which may contain a list of networks instead of a single IP address).
295
Here are some examples:
296
- Execute a specific iptables command on behalf of the source IP
297
in a valid SPA packet to add a new ACCEPT rule, and execute another
298
command (to delete the same rule after a timeout):
299
EXTERNAL_CMD_OPEN iptables -A INPUT -s $SRC -j ACCEPT
300
EXTERNAL_CMD_CLOSE iptables -D INPUT -s $SRC -j ACCEPT
301
- Execute a custom binary with the SOURCE and OPEN_PORTS variables from
302
the access.conf file as input on the command line, and after a
303
timeout execute a different program but use the real SPA source IP:
304
EXTERNAL_CMD_OPEN /path/someprog $SOURCE $OPEN_PORTS
305
EXTERNAL_CMD_OPEN /path/otherprog $SRC
307
This change was suggested by Alexander Perlis on the fwknop mailing list.
310
------------------------------------------------------------------------
311
r1324 | mbr | 2008-11-02 08:29:13 -0500 (Sun, 02 Nov 2008) | 1 line
313
M /fwknop/trunk/knoptm
316
------------------------------------------------------------------------
317
r1323 | mbr | 2008-11-02 08:28:49 -0500 (Sun, 02 Nov 2008) | 1 line
319
M /fwknop/trunk/knoptm
321
bug fix to include signal handler for iptables object, bug fix to only create an iptables object on systems running iptables
322
------------------------------------------------------------------------
323
r1322 | mbr | 2008-10-30 08:12:59 -0400 (Thu, 30 Oct 2008) | 8 lines
325
M /fwknop/trunk/CREDITS
326
M /fwknop/trunk/knoptm
328
Knoptm parses fwknop.conf twice.
330
Set $config_file according to the file specified as an argument of the
331
import_config function rather than using its default value.
333
Signed-off-by: Franck Joncourt <franck.mail@dthconnex.com>
336
------------------------------------------------------------------------
337
r1321 | mbr | 2008-10-28 22:50:05 -0400 (Tue, 28 Oct 2008) | 3 lines
339
M /fwknop/trunk/ChangeLog
340
A /fwknop/trunk/test/conf/any_interface_fwknop.conf
341
M /fwknop/trunk/test/fwknop_test.pl
343
- (Test suite): Added tests for Linux 'any' interface capture of SPA
344
packets on all interfaces.
346
------------------------------------------------------------------------
347
r1319 | mbr | 2008-10-24 08:10:38 -0400 (Fri, 24 Oct 2008) | 1 line
349
M /fwknop/trunk/VERSION
350
M /fwknop/trunk/fwknop
351
M /fwknop/trunk/fwknop_serv
352
M /fwknop/trunk/fwknopd
353
M /fwknop/trunk/knoptm
354
M /fwknop/trunk/knopwatchd.c
355
M /fwknop/trunk/test/fwknop_test.pl
357
bumped version to 1.9.9-pre4
358
------------------------------------------------------------------------
359
r1318 | mbr | 2008-10-24 08:10:21 -0400 (Fri, 24 Oct 2008) | 1 line
361
M /fwknop/trunk/ChangeLog
363
added support for the Linux 'any' interface, which requires support to be enabled for the Linux 'cooked' interface type
364
------------------------------------------------------------------------
365
r1317 | mbr | 2008-10-24 08:09:33 -0400 (Fri, 24 Oct 2008) | 1 line
367
M /fwknop/trunk/fwknopd
369
added support for the Linux 'any' interface, which requires support to be enabled for the Linux 'cooked' interface type
370
------------------------------------------------------------------------
371
r1316 | mbr | 2008-10-18 10:37:44 -0400 (Sat, 18 Oct 2008) | 1 line
373
M /fwknop/trunk/ChangeLog
376
------------------------------------------------------------------------
377
r1314 | mbr | 2008-10-18 00:27:41 -0400 (Sat, 18 Oct 2008) | 1 line
379
M /fwknop/trunk/VERSION
380
M /fwknop/trunk/fwknop
381
M /fwknop/trunk/fwknop_serv
382
M /fwknop/trunk/fwknopd
383
M /fwknop/trunk/knoptm
384
M /fwknop/trunk/knopwatchd.c
385
M /fwknop/trunk/test/fwknop_test.pl
388
------------------------------------------------------------------------
389
r1313 | mbr | 2008-10-18 00:27:19 -0400 (Sat, 18 Oct 2008) | 1 line
391
M /fwknop/trunk/ChangeLog
394
------------------------------------------------------------------------
395
r1312 | mbr | 2008-10-18 00:10:15 -0400 (Sat, 18 Oct 2008) | 1 line
397
A /fwknop/trunk/test/conf/ipt_sleep_fwknop.conf
398
M /fwknop/trunk/test/fwknop_test.pl
400
added tests for IPT_EXEC_SLEEP
401
------------------------------------------------------------------------
402
r1311 | mbr | 2008-10-18 00:09:39 -0400 (Sat, 18 Oct 2008) | 1 line
404
M /fwknop/trunk/fwknopd
406
updated to use POSIX sys_wait_h for SIGCHLD handling, updated to pass in IPT_EXEC_SLEEP (when greater than zero) when firewall rules are being added
407
------------------------------------------------------------------------
408
r1310 | mbr | 2008-10-18 00:08:02 -0400 (Sat, 18 Oct 2008) | 1 line
410
M /fwknop/trunk/knoptm
412
updated to use a global IPTables::ChainMgr object so that usage of IPT_EXEC_SLEEP greater than zero does not slow things down too much
413
------------------------------------------------------------------------
414
r1309 | mbr | 2008-10-18 00:06:37 -0400 (Sat, 18 Oct 2008) | 1 line
416
M /fwknop/trunk/deps/IPTables-Parse/Changes
417
M /fwknop/trunk/deps/IPTables-Parse/VERSION
418
M /fwknop/trunk/deps/IPTables-Parse/lib/IPTables/Parse.pm
420
updated to IPTables::Parse 0.7
421
------------------------------------------------------------------------
422
r1308 | mbr | 2008-10-18 00:05:58 -0400 (Sat, 18 Oct 2008) | 1 line
424
M /fwknop/trunk/deps/IPTables-ChainMgr/Changes
425
M /fwknop/trunk/deps/IPTables-ChainMgr/VERSION
426
M /fwknop/trunk/deps/IPTables-ChainMgr/lib/IPTables/ChainMgr.pm
428
updated to version 0.8
429
------------------------------------------------------------------------
430
r1307 | mbr | 2008-10-16 01:29:12 -0400 (Thu, 16 Oct 2008) | 1 line
432
M /fwknop/trunk/ChangeLog
433
M /fwknop/trunk/fwknop.conf
434
M /fwknop/trunk/fwknopd
435
M /fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf
436
M /fwknop/trunk/test/conf/blacklist_fwknop.conf
437
M /fwknop/trunk/test/conf/default_fwknop.conf
438
M /fwknop/trunk/test/conf/filter_62203_fwknop.conf
439
M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
440
M /fwknop/trunk/test/conf/gpg2_fwknop.conf
441
M /fwknop/trunk/test/conf/md5_fwknop.conf
442
M /fwknop/trunk/test/conf/no_local_nat_fwknop.conf
443
M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
444
M /fwknop/trunk/test/conf/output_chain_fwknop.conf
445
M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
446
M /fwknop/trunk/test/conf/pk_fwknop.conf
447
M /fwknop/trunk/test/conf/popen_fwknop.conf
448
M /fwknop/trunk/test/conf/rand_port_fwknop.conf
449
M /fwknop/trunk/test/conf/sha1_fwknop.conf
450
M /fwknop/trunk/test/conf/sha256_fwknop.conf
451
M /fwknop/trunk/test/conf/spa_aging_fwknop.conf
452
M /fwknop/trunk/test/conf/system_fwknop.conf
454
Added IPT_EXEC_TRIES to allow iptables commands to be re-tried if there are any errors
455
------------------------------------------------------------------------
456
r1306 | mbr | 2008-10-16 01:28:41 -0400 (Thu, 16 Oct 2008) | 1 line
458
M /fwknop/trunk/knoptm
460
added IPT_CMD_ALARM, IPT_EXEC_STYLE, IPT_EXEC_SLEEP, and IPT_EXEC_TRIES handling
461
------------------------------------------------------------------------
462
r1305 | mbr | 2008-10-15 23:38:04 -0400 (Wed, 15 Oct 2008) | 1 line
464
M /fwknop/trunk/test/fwknop_test.pl
466
fixed --Dump-config tests by referencing local files but allowing /etc/fwknop/fwknop.conf to take precedence
467
------------------------------------------------------------------------
468
r1304 | mbr | 2008-10-15 23:37:30 -0400 (Wed, 15 Oct 2008) | 1 line
470
M /fwknop/trunk/test/conf/override_sleep_fwknop.conf
472
added IPT_CMD_ALARM, IPT_EXEC_STYLE, and IPT_EXEC_SLEEP vars
473
------------------------------------------------------------------------
474
r1303 | mbr | 2008-10-15 23:20:06 -0400 (Wed, 15 Oct 2008) | 1 line
476
M /fwknop/trunk/test/fwknop_test.pl
478
minor bugfix for IPTables::ChainMgr system() testing
479
------------------------------------------------------------------------
480
r1302 | mbr | 2008-10-15 23:17:26 -0400 (Wed, 15 Oct 2008) | 1 line
482
M /fwknop/trunk/test/fwknop_test.pl
484
Added the ability to set the version of the IPTables::ChainMgr module from the command line with --IPT
485
------------------------------------------------------------------------
486
r1301 | mbr | 2008-10-14 07:20:16 -0400 (Tue, 14 Oct 2008) | 1 line
488
A /fwknop/trunk/test/conf/popen_fwknop.conf
489
A /fwknop/trunk/test/conf/system_fwknop.conf
490
M /fwknop/trunk/test/fwknop_test.pl
492
added the ability to dump process ID's if the test suite alarm expires against fwknopd, added tests for popen() and system() execution models for IPTables::ChainMgr
493
------------------------------------------------------------------------
494
r1300 | mbr | 2008-10-13 22:14:25 -0400 (Mon, 13 Oct 2008) | 1 line
496
M /fwknop/trunk/fwknopd
499
------------------------------------------------------------------------
500
r1299 | mbr | 2008-10-09 22:04:07 -0400 (Thu, 09 Oct 2008) | 1 line
502
M /fwknop/trunk/fwknopd
505
------------------------------------------------------------------------
506
r1298 | mbr | 2008-10-09 22:03:17 -0400 (Thu, 09 Oct 2008) | 12 lines
508
M /fwknop/trunk/ChangeLog
509
M /fwknop/trunk/fwknop.conf
510
M /fwknop/trunk/fwknopd
511
M /fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf
512
M /fwknop/trunk/test/conf/blacklist_fwknop.conf
513
M /fwknop/trunk/test/conf/default_fwknop.conf
514
M /fwknop/trunk/test/conf/filter_62203_fwknop.conf
515
M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
516
M /fwknop/trunk/test/conf/gpg2_fwknop.conf
517
M /fwknop/trunk/test/conf/md5_fwknop.conf
518
M /fwknop/trunk/test/conf/no_local_nat_fwknop.conf
519
M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
520
M /fwknop/trunk/test/conf/output_chain_fwknop.conf
521
M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
522
M /fwknop/trunk/test/conf/pk_fwknop.conf
523
M /fwknop/trunk/test/conf/rand_port_fwknop.conf
524
M /fwknop/trunk/test/conf/sha1_fwknop.conf
525
M /fwknop/trunk/test/conf/sha256_fwknop.conf
526
M /fwknop/trunk/test/conf/spa_aging_fwknop.conf
528
- Added IPT_CMD_ALARM to control the number of seconds that the
529
IPTables::ChainMgr module uses to wrap alarm() calls around iptables
530
commands (for IPTables::ChainMgr 0.8 and later, although this does not
531
interfere with earlier versions of the module).
532
- Added IPT_EXEC_STYLE to control the execution method used for iptables
533
commands in the IPTables::ChainMgr module. The default is "waitpid",
534
but "system", and "popen" are also supported.
535
- Added IPT_EXEC_SLEEP to control the number of seconds that the
536
IPTables::ChainMgr module uses to delay between each iptables command.
537
The default is zero (no delay), but this can be increased to ensure that
538
iptables commands are issued at a slower pace.
540
------------------------------------------------------------------------
541
r1297 | mbr | 2008-10-09 21:49:07 -0400 (Thu, 09 Oct 2008) | 1 line
543
M /fwknop/trunk/fwknop_serv
545
minor tab -> expanded whitespace fix
546
------------------------------------------------------------------------
547
r1296 | mbr | 2008-10-09 21:46:48 -0400 (Thu, 09 Oct 2008) | 1 line
549
M /fwknop/trunk/knoptm
551
bugfix to include --Override-config parsing
552
------------------------------------------------------------------------
553
r1295 | mbr | 2008-10-09 00:38:14 -0400 (Thu, 09 Oct 2008) | 1 line
555
M /fwknop/trunk/test/fwknop_test.pl
558
------------------------------------------------------------------------
559
r1294 | mbr | 2008-10-07 23:13:34 -0400 (Tue, 07 Oct 2008) | 1 line
561
M /fwknop/trunk/test/fwknop_test.pl
563
added checks for running fwknop processes besides just fwknopd
564
------------------------------------------------------------------------
565
r1292 | mbr | 2008-10-05 23:50:40 -0400 (Sun, 05 Oct 2008) | 1 line
567
M /fwknop/trunk/VERSION
568
M /fwknop/trunk/fwknop
569
M /fwknop/trunk/fwknop_serv
570
M /fwknop/trunk/fwknopd
571
M /fwknop/trunk/knoptm
572
M /fwknop/trunk/knopwatchd.c
573
M /fwknop/trunk/test/fwknop_test.pl
575
version to 1.9.9-pre2
576
------------------------------------------------------------------------
577
r1291 | mbr | 2008-10-05 23:50:21 -0400 (Sun, 05 Oct 2008) | 1 line
579
M /fwknop/trunk/test/fwknop_test.pl
581
bugfix to make sure to write out the local SPA key before trying to acquire the first SPA packet
582
------------------------------------------------------------------------
583
r1289 | mbr | 2008-10-05 23:33:07 -0400 (Sun, 05 Oct 2008) | 1 line
585
M /fwknop/trunk/VERSION
586
M /fwknop/trunk/fwknop
587
M /fwknop/trunk/fwknop_serv
588
M /fwknop/trunk/fwknopd
589
M /fwknop/trunk/knoptm
590
M /fwknop/trunk/knopwatchd.c
591
M /fwknop/trunk/test/fwknop_test.pl
593
version to 1.9.9-pre1
594
------------------------------------------------------------------------
595
r1288 | mbr | 2008-10-05 23:32:10 -0400 (Sun, 05 Oct 2008) | 1 line
597
M /fwknop/trunk/CREDITS
598
M /fwknop/trunk/ChangeLog
599
M /fwknop/trunk/fwknopd
601
added --Override-config
602
------------------------------------------------------------------------
603
r1287 | mbr | 2008-10-05 23:31:51 -0400 (Sun, 05 Oct 2008) | 1 line
605
M /fwknop/trunk/fwknopd.8
607
Added --Dump-config and --Override-config
608
------------------------------------------------------------------------
609
r1286 | mbr | 2008-10-05 23:27:59 -0400 (Sun, 05 Oct 2008) | 1 line
611
A /fwknop/trunk/test/conf/override_sleep_fwknop.conf
612
M /fwknop/trunk/test/fwknop_test.pl
614
Added tests for fwknopd --Override configs, filesystem SPA packet caching (with --Save-packet and --Save-packet-append), added uptime to system specifics
615
------------------------------------------------------------------------
616
r1285 | mbr | 2008-10-05 14:30:06 -0400 (Sun, 05 Oct 2008) | 1 line
618
M /fwknop/trunk/fwknopd
620
more verbose debugging output for iptables commands
621
------------------------------------------------------------------------
622
r1284 | mbr | 2008-10-05 14:27:48 -0400 (Sun, 05 Oct 2008) | 1 line
624
M /fwknop/trunk/ChangeLog
626
started on 1.9.9 additions
627
------------------------------------------------------------------------
628
r1283 | mbr | 2008-10-05 13:51:58 -0400 (Sun, 05 Oct 2008) | 6 lines
630
M /fwknop/trunk/fwknopd
631
M /fwknop/trunk/test/fwknop_test.pl
633
- Added --Dump-conf to fwknopd (suggested by Franck Joncourt).
634
- Added execution of --Dump-conf to the test suite to collect the installed
635
version of the fwknop.conf and access.conf files.
636
- Added time stamps to MSG and TEST lines for each test (useful to see the
637
relative time if an alarm expires).
361
639
------------------------------------------------------------------------