------------------------------------------------------------------------
r545 | mbr | 2006-09-17 22:26:40 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknopd

bumped version to 0.9.8
------------------------------------------------------------------------
r544 | mbr | 2006-09-17 22:25:32 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.8

Added the --gpg-default-key option
------------------------------------------------------------------------
r543 | mbr | 2006-09-17 22:03:09 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknopd

updated to email username mismatch errors
------------------------------------------------------------------------
r542 | mbr | 2006-09-17 21:19:09 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknopd

bugfix to use absolute value of time difference for valid time window checking
------------------------------------------------------------------------
r541 | mbr | 2006-09-17 18:25:01 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop.conf

changed acceptable time window to two minutes by default
------------------------------------------------------------------------
r540 | mbr | 2006-09-17 18:23:42 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

added blurb about acceptable time window feature
------------------------------------------------------------------------
r539 | mbr | 2006-09-17 14:53:36 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop.conf
   M /fwknop/trunk/fwknopd

added ENABLE_SPA_PACKET_AGING and MAX_SPA_PACKET_AGE so that a captured SPA packet cannot (i.e. and never forwarded to the fwknopd desination system) cannot be replayed by a malicious party (MITM)
------------------------------------------------------------------------
r538 | mbr | 2006-09-17 14:51:50 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/TODO

more TODO stuff
------------------------------------------------------------------------
r537 | mbr | 2006-09-17 14:00:58 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

updated to allow any length GnuPG password because GnuPG itself will validate it, bugfix to warn if the symmetric key length is less than 8 chars instead of dying immediately
------------------------------------------------------------------------
r536 | mbr | 2006-09-17 01:11:16 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/knoptm

added --Version output, bumped version to 0.9.8
------------------------------------------------------------------------
r535 | mbr | 2006-09-17 00:38:49 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/CREDITS

Added Mate Wierdl
------------------------------------------------------------------------
r534 | mbr | 2006-09-17 00:38:10 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

more 0.9.8 stuff
------------------------------------------------------------------------
r533 | mbr | 2006-09-17 00:37:57 -0400 (Sun, 17 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop.8

updated man page with various fixes including the addition of the --User-agent, --URL, and --Last-host descriptions
------------------------------------------------------------------------
r532 | mbr | 2006-09-17 00:29:37 -0400 (Sun, 17 Sep 2006) | 4 lines
Changed paths:
   M /fwknop/trunk/packaging/fwknop.spec

-Removed iptables requirement since fwknop may be installed on a system just
to use the fwknop client (fwknopd may never run).
-Adapted Mate Wierdl's patch from psad to get fwknop building on x86_64 systems.

------------------------------------------------------------------------
r531 | mbr | 2006-09-16 23:15:46 -0400 (Sat, 16 Sep 2006) | 5 lines
Changed paths:
   M /fwknop/trunk/fwknop

-Added the ability to specify an external resolution URL in place of the
default http://www.whatismyip.com/.  The new command line arguments are
--Resolve-external-IP (this is analogous to the --whatismyip argument),
and --URL (to manually provide a URL).

------------------------------------------------------------------------
r530 | mbr | 2006-09-12 23:17:55 -0400 (Tue, 12 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

updated to allow symmetric keys that are longer than the Rijndael block size (suggested by Sebastien J.)
------------------------------------------------------------------------
r529 | mbr | 2006-09-12 23:12:37 -0400 (Tue, 12 Sep 2006) | 8 lines
Changed paths:
   M /fwknop/trunk/fwknop

-Updated to allow non-root users to use the --Spoof-user option because 1) anyone
could simply copy the fwknop code to their local directory and modify it to send
any username they like, 2) the real security on the server side is maintained
by encryption keys, and 3) if a remote user is on a system that has a different
username than the one on the fwknopd server, this should not prohibit them from
gaining access.  The real security in this scheme is not usernames, it is proving
possession of the appropriate encryption key.

------------------------------------------------------------------------
r527 | mbr | 2006-09-07 23:36:39 -0400 (Thu, 07 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

more 0.9.8 stuff
------------------------------------------------------------------------
r526 | mbr | 2006-09-07 23:34:28 -0400 (Thu, 07 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/packaging/fwknop.spec

bumped version to 0.9.8
------------------------------------------------------------------------
r525 | mbr | 2006-09-07 23:33:18 -0400 (Thu, 07 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/CREDITS

added Sebastien J.
------------------------------------------------------------------------
r524 | mbr | 2006-09-07 22:51:25 -0400 (Thu, 07 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

bugfix for http request ordering when querying http://www.whatismyip.com/, updated to more rigorous IP regex (Sebastien J.)
------------------------------------------------------------------------
r523 | mbr | 2006-09-07 00:02:04 -0400 (Thu, 07 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/packaging/fwknop.spec

minor comment fix
------------------------------------------------------------------------
r522 | mbr | 2006-09-06 23:52:20 -0400 (Wed, 06 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/packaging/fwknop.spec

minor fwknop URL update
------------------------------------------------------------------------
r521 | mbr | 2006-09-03 13:25:45 -0400 (Sun, 03 Sep 2006) | 14 lines
Changed paths:
   M /fwknop/trunk/fwknopd

-Updated to new data return model in IPTables::ChainMgr.
-More rigorous checks for encrypted message length before trying to decrypt.
In particular, the message length must be less than 1500 bytes for either a
Rijndael or GunPG decrypt.  The message length must also be greater than 400
bytes before attempting a GnuPG decrypt (even a single byte of data encrypted
with a 1048-bit Elgammal key results in an encrypted data length of well over
300 bytes).
-Bugfix to make sure to only allow the username that is tied to a specific
SOURCE block in access.conf access as a result of a successful decrypt.  The
bug mixed usernames from all encryption keys together.
-Added check to make sure that md5_base64() actually returns something before
attempting comparison against previously calculated MD5 sums.
-Added psyslog_errs() to log any errors that are generated by iptables.

------------------------------------------------------------------------
r520 | mbr | 2006-09-03 12:54:29 -0400 (Sun, 03 Sep 2006) | 7 lines
Changed paths:
   M /fwknop/trunk/fwknop.conf

-Updated to specify the jump rule position in the IPT_AUTO_CHAIN{n} vars to
take advantage of the new IPTables::ChainMgr code.
-Removed IPTABLES_AUTO_RULENUM since the new IPTables::ChainMgr model makes
it unnecessary.
-Added IPT_OUTPUT_FILE and IPT_ERROR_FILE to collect iptables command output
and errors.

------------------------------------------------------------------------
r519 | mbr | 2006-09-03 08:04:05 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/IPTables-Parse/lib/IPTables/Parse.pm

Added chain_policy(), added support for the ULOG target, added convenience hash keys
------------------------------------------------------------------------
r518 | mbr | 2006-09-03 07:58:22 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop.h
   M /fwknop/trunk/knopmd.c

updated copyright date
------------------------------------------------------------------------
r517 | mbr | 2006-09-03 07:57:23 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/knopwatchd.c

updated copyright date
------------------------------------------------------------------------
r516 | mbr | 2006-09-03 07:56:09 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   A /fwknop/trunk/Crypt-CBC/README.compatibility

added README.compatibility file
------------------------------------------------------------------------
r515 | mbr | 2006-09-03 07:55:35 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/Crypt-CBC/CBC.pm
   M /fwknop/trunk/Crypt-CBC/Changes
   A /fwknop/trunk/Crypt-CBC/Crypt-CBC-2.16-vulnerability.txt (from /fwknop/trunk/Crypt-CBC/Crypt::CBC-2.16-vulnerability.txt:503)
   D /fwknop/trunk/Crypt-CBC/Crypt::CBC-2.16-vulnerability.txt
   M /fwknop/trunk/Crypt-CBC/MANIFEST
   M /fwknop/trunk/Crypt-CBC/META.yml
   M /fwknop/trunk/Crypt-CBC/VERSION

updated to 2.19
------------------------------------------------------------------------
r514 | mbr | 2006-09-03 07:55:03 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/install.pl

minor update for --force-mod-regex -> --Force-mod-regex
------------------------------------------------------------------------
r513 | mbr | 2006-09-03 07:53:57 -0400 (Sun, 03 Sep 2006) | 8 lines
Changed paths:
   M /fwknop/trunk/install.pl

- Added the ability to update the *Cmd paths in the fwknop.conf and
knopwatchd.conf files if the expected path does not exist.  This only
happens if the user does not want to merge an existing set of fwknop
of configurations (see the new --path-update option to override this).
- Added the ability to force the installation of specific perl modules
with the new --force-mod-regex command line argument.
- Added the --Skip-mod-install argument to not install any perl modules.

------------------------------------------------------------------------
r512 | mbr | 2006-09-03 07:34:28 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/Makefile

updated copyright date
------------------------------------------------------------------------
r511 | mbr | 2006-09-03 07:33:44 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/knoptm

Added psyslog_errs() to communicate iptables errors to syslog, updated to new IPTables::ChainMgr return value model
------------------------------------------------------------------------
r510 | mbr | 2006-09-03 07:29:36 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/CREDITS

more stuff for Blair
------------------------------------------------------------------------
r509 | mbr | 2006-09-03 07:28:54 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

added 0.9.8 stuff
------------------------------------------------------------------------
r508 | mbr | 2006-09-03 07:28:32 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/chainmgr_test.pl

updated to new ChainMgr function return model
------------------------------------------------------------------------
r507 | mbr | 2006-09-03 07:27:15 -0400 (Sun, 03 Sep 2006) | 12 lines
Changed paths:
   M /fwknop/trunk/IPTables-ChainMgr/lib/IPTables/ChainMgr.pm

- Completely re-worked IPTables::ChainMgr to support the return of iptables
error messages that are collected via stderr. This is critical to acquire
information from iptables if an error condition is created (not doing so
is a bug since no information is returned to the user).
- Added the ability to specify the position for both the jump rule into the
fwknop chains as well as the position for new rules within the fwknop chains
via the -I argument to iptables. This fixes a bug where the user was
given the impression that the IPTABLES_AUTO_RULENUM would accomplish this.
- Populated the _debug option in the IPTables::ChainMgr module, and also
added the _verbose option so that the specific iptables commands can
actually be seen.

------------------------------------------------------------------------
r506 | mbr | 2006-09-03 00:34:20 -0400 (Sun, 03 Sep 2006) | 1 line
Changed paths:
   M /fwknop/trunk/IPTables-ChainMgr/VERSION

0.4
------------------------------------------------------------------------
r505 | mbr | 2006-08-12 12:18:23 -0400 (Sat, 12 Aug 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

minor status comment fixes for GPG to GnuPG
------------------------------------------------------------------------
r504 | mbr | 2006-08-12 12:17:51 -0400 (Sat, 12 Aug 2006) | 1 line
Changed paths:
   M /fwknop/trunk/fwknopd

minor status comment fixes for GPG to GnuPG
------------------------------------------------------------------------
r502 | mbr | 2006-08-04 23:07:46 -0400 (Fri, 04 Aug 2006) | 1 line
Changed paths:
   M /fwknop/trunk/packaging/fwknop.spec

added 0.9.7 stuff
------------------------------------------------------------------------
