------------------------------------------------------------------------
r1434 | mbr | 2009-05-11 22:40:10 -0400 (Mon, 11 May 2009) | 1 line
Changed paths:
   A /fwknop/branches/fwknop-1.9.11 (from /fwknop/trunk:1433)

created fwknop-1.9.11 branch
------------------------------------------------------------------------
r1433 | mbr | 2009-05-11 21:58:26 -0400 (Mon, 11 May 2009) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.h
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/packaging/fwknop-nodeps.spec
   M /fwknop/trunk/packaging/fwknop.spec
   M /fwknop/trunk/test/fwknop_test.pl

tagged fwknop-1.9.11
------------------------------------------------------------------------
r1432 | mbr | 2009-05-10 23:25:33 -0400 (Sun, 10 May 2009) | 1 line
Changed paths:
   M /fwknop/trunk/knoptm

minor formatting change
------------------------------------------------------------------------
r1431 | mbr | 2009-05-10 23:11:37 -0400 (Sun, 10 May 2009) | 1 line
Changed paths:
   M /fwknop/trunk/fwknopd

added 'before' and 'after' ipfw policy displays in --debug mode
------------------------------------------------------------------------
r1430 | mbr | 2009-05-10 23:10:51 -0400 (Sun, 10 May 2009) | 1 line
Changed paths:
   M /fwknop/trunk/knoptm

minor update to consolidate the ipfw -dS list command and print error message (if any) at command execution
------------------------------------------------------------------------
r1429 | mbr | 2009-05-10 23:09:59 -0400 (Sun, 10 May 2009) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

minor update to exclude ipfw DISABLED rules from fw_rules() existence check
------------------------------------------------------------------------
r1427 | mbr | 2009-05-02 09:29:15 -0400 (Sat, 02 May 2009) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.h
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

updated version to 1.9.11-pre7
------------------------------------------------------------------------
r1426 | mbr | 2009-05-02 09:27:55 -0400 (Sat, 02 May 2009) | 17 lines
Changed paths:
   M /fwknop/trunk/CREDITS
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknop.conf
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/test/conf/any_interface_fwknop.conf
   M /fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf
   M /fwknop/trunk/test/conf/blacklist_fwknop.conf
   M /fwknop/trunk/test/conf/default_fwknop.conf
   M /fwknop/trunk/test/conf/filter_62203_fwknop.conf
   M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
   M /fwknop/trunk/test/conf/gpg2_fwknop.conf
   M /fwknop/trunk/test/conf/gpg2_http_fwknop.conf
   M /fwknop/trunk/test/conf/http_fwknop.conf
   M /fwknop/trunk/test/conf/icmp_fwknop.conf
   M /fwknop/trunk/test/conf/ipt_sleep_fwknop.conf
   M /fwknop/trunk/test/conf/md5_fwknop.conf
   M /fwknop/trunk/test/conf/no_local_nat_fwknop.conf
   M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
   M /fwknop/trunk/test/conf/output_chain_fwknop.conf
   M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
   M /fwknop/trunk/test/conf/pk_fwknop.conf
   M /fwknop/trunk/test/conf/popen_fwknop.conf
   M /fwknop/trunk/test/conf/rand_port_fwknop.conf
   M /fwknop/trunk/test/conf/sha1_fwknop.conf
   M /fwknop/trunk/test/conf/sha256_fwknop.conf
   M /fwknop/trunk/test/conf/spa_aging_fwknop.conf
   M /fwknop/trunk/test/conf/system_fwknop.conf
   M /fwknop/trunk/test/conf/tcp_serv_fwknop.conf

- (Julien Picalaus) Contributed patches to implement a proper interface to
use ipfw 'sets' on systems running ipfw firewalls.  This involved
changes to fwknopd, knoptm, and the fwknop.conf file like so:
Added a test to see if the local ipfw firewall policy is using dynamic
rules. Added ipfw_move_rule() so that rules can be moved from one set to
another. Added ipfw_disable() set subroutine and it is called at init for
IPFW_SET_NUM (except when ipfw isn't using dynamic rules).  Made sure
that rule finding includes disabled rules (ipfw list -S and changes to
regexp) and returning the set in addition to the rule number.  When
granting access, if a corresponding disabled rule already exists, enable                                                                                              it instead of adding a new one (except when ipfw isn't using dynamic
rules). When adding rules, only use keep-state if there are already
dynamic rules.  Added IPFW_SET_NUM so that the set number for new ipfw
can be specified, and add IPFW_DYNAMIC_INTERVAL so that the interval
over which rules that have no associated dynamic rules are removed (the
default is 60 seconds).


------------------------------------------------------------------------
r1424 | mbr | 2009-04-20 21:24:00 -0400 (Mon, 20 Apr 2009) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.h
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

bumped version to 1.9.11-pre6
------------------------------------------------------------------------
r1423 | mbr | 2009-04-20 00:11:38 -0400 (Mon, 20 Apr 2009) | 7 lines
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/test/fwknop_test.pl

- (Test suite): Added support for multiple include/exclude test
identifying strings (separated by commas).  For example, to run the
'Setup', 'Basic', and 'Replay' tests, just do:

./fwknop_test.pl --include Setup,Basic,Replay


------------------------------------------------------------------------
r1422 | mbr | 2009-04-20 00:06:52 -0400 (Mon, 20 Apr 2009) | 3 lines
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/knoptm

Bug fix to ensure that UDP rules in ipfw firewalls are timed out 
correctly by knoptm (the problem was that 'keep-state' was required).

------------------------------------------------------------------------
r1421 | mbr | 2009-04-19 23:50:41 -0400 (Sun, 19 Apr 2009) | 1 line
Changed paths:
   M /fwknop/trunk/fwknopd

minor logging message prefix change to use '[+]' instead of '[-]'
------------------------------------------------------------------------
r1420 | mbr | 2009-04-19 21:14:40 -0400 (Sun, 19 Apr 2009) | 1 line
Changed paths:
   M /fwknop/trunk/fwknopd

minor fix to state that --fw-flush is not yet supported for ipfw firewalls (this will be corrected with the new sets interface)
------------------------------------------------------------------------
r1419 | mbr | 2009-04-19 17:02:03 -0400 (Sun, 19 Apr 2009) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

added fwknop-c support in the test suite for --save-packet args
------------------------------------------------------------------------
r1417 | mbr | 2009-03-09 23:07:57 -0400 (Mon, 09 Mar 2009) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.h
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

bumped version to 1.9.11-pre5
------------------------------------------------------------------------
r1416 | mbr | 2009-03-09 22:56:37 -0400 (Mon, 09 Mar 2009) | 4 lines
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/test/fwknop_test.pl

- (Test suite): Added tests for multi-port access requests.  So, to gain
access to tcp/22,udp/1194 with one SPA packet, the test suite verifies
that the code support this.

------------------------------------------------------------------------
r1415 | mbr | 2009-03-09 22:54:31 -0400 (Mon, 09 Mar 2009) | 1 line
Changed paths:
   M /fwknop/trunk/test/conf/any_interface_fwknop.conf
   M /fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf

Added Id tag expansion
------------------------------------------------------------------------
r1414 | mbr | 2009-03-09 22:53:52 -0400 (Mon, 09 Mar 2009) | 1 line
Changed paths:
   A /fwknop/trunk/test/conf/multi_port_access.conf

added the multi_port_access.conf file to test multi-port access requests
------------------------------------------------------------------------
r1413 | mbr | 2009-03-09 22:41:08 -0400 (Mon, 09 Mar 2009) | 1 line
Changed paths:
   M /fwknop/trunk/deps/IPTables-ChainMgr/lib/IPTables/ChainMgr.pm

minor spacing fix when printing IPTables::Parse::VERSION
------------------------------------------------------------------------
r1411 | mbr | 2009-02-23 01:12:07 -0500 (Mon, 23 Feb 2009) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.h
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

bumped version to 1.9.11-pre4
------------------------------------------------------------------------
r1410 | mbr | 2009-02-23 01:09:01 -0500 (Mon, 23 Feb 2009) | 50 lines
Changed paths:
   M /fwknop/trunk/CREDITS
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknopd

- (Martin Ferrari) Bug fix to provide a work around for fwknopd segfaults on
Debian systems when the version of Net::Pcap that is installed comes from doing
'apt-get install fwknop-server'.  See the thread at
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508432 for more info.

Here is the message from Martin describing this patch:

Meanwhile this is solved, see the attached patch that's useful as a
workaround for fwknopd

> Hi, after working on this bug for a while, I was able to distill a
> minimum code that triggers the segfault. The callback routine invoked
> from pcap_loop needs to set a signal handler that it's used during the
> callback.
>
> In the fwknopd code, this happens when calling iptables, which triggers
> a SIGCHLD on exit, but can happen with any signal.
>
> The following backtrace makes me doubt if this is a Net::Pcap or a perl
> problem. Maybe somebody in the list can shed some light? (Hello Niko :))
>
> #0  0xb7e726c9 in free () from /lib/libc.so.6
> #1  0x080c5b70 in Perl_sv_clear ()
> #2  0x080c5d2a in Perl_sv_free2 ()
> #3  0x080e0a10 in Perl_leave_scope ()
> #4  0x080e137c in Perl_pop_scope ()
> #5  0x080b463d in Perl_pp_leavesub ()
> #6  0x080b1879 in Perl_runops_standard ()
> #7  0x080aba15 in Perl_call_sv ()
> #8  0xb7daf538 in callback_wrapper ()
> from /usr/lib/perl5/auto/Net/Pcap/Pcap.so
> #9  0xb7d75d45 in ?? () from /usr/lib/libpcap.so.0.8
> #10 0x08ae4558 in ?? ()
> #11 0xbf8a9e28 in ?? ()
> #12 0x08afb54a in ?? ()
> #13 0x00000020 in ?? ()
> #14 0xbf8a9e14 in ?? ()
> #15 0xbf8a9e38 in ?? ()
> #16 0xbf8a9e48 in ?? ()
> #17 0x080c4067 in Perl_sv_setsv_flags ()
> #18 0xb7d76bab in pcap_loop () from /usr/lib/libpcap.so.0.8
> #19 0xb7da9cf3 in XS_Net__Pcap_loop ()
>   from /usr/lib/perl5/auto/Net/Pcap/Pcap.so
> #20 0x080b32d2 in Perl_pp_entersub ()
> #21 0x080b1879 in Perl_runops_standard ()
> #22 0x080ac6a0 in perl_run ()
> #23 0x08063ddd in main ()



------------------------------------------------------------------------
r1409 | mbr | 2009-02-23 00:38:33 -0500 (Mon, 23 Feb 2009) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/install.pl
   M /fwknop/trunk/test/fwknop_test.pl

Bug fix to not require that gpg is installed in order to install fwknop.
------------------------------------------------------------------------
r1408 | mbr | 2009-02-22 17:46:04 -0500 (Sun, 22 Feb 2009) | 5 lines
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknopd

- Updated all unpack() calls for packet decoding in fwknopd to use the
"mN" format instead of "m[N]" format for proper operation on older
versions of perl.  On FreeBSD 7.0 with perl-5.6.2 the following error
is generated without this fix: "Invalid type in unpack: '['".

------------------------------------------------------------------------
r1406 | mbr | 2009-02-14 00:49:44 -0500 (Sat, 14 Feb 2009) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.h
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

version 1.9.11-pre3
------------------------------------------------------------------------
r1405 | mbr | 2009-02-14 00:49:23 -0500 (Sat, 14 Feb 2009) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

test suite libfko update
------------------------------------------------------------------------
r1404 | mbr | 2009-02-14 00:47:30 -0500 (Sat, 14 Feb 2009) | 3 lines
Changed paths:
   M /fwknop/trunk/CREDITS
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/knopwatchd.8

- (Franck Joncourt) Documentation updates for the knopwatchd.8 man page
to include the latest command line options.

------------------------------------------------------------------------
r1403 | mbr | 2009-02-13 23:44:07 -0500 (Fri, 13 Feb 2009) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

started on support for testing libfko.  The 'Basic' tests now pass
------------------------------------------------------------------------
r1402 | mbr | 2009-02-13 00:50:51 -0500 (Fri, 13 Feb 2009) | 1 line
Changed paths:
   A /fwknop/trunk/test/conf/icmp_fwknop.conf

added icmp_fwknop.conf file for ICMP tests
------------------------------------------------------------------------
r1401 | mbr | 2009-02-12 23:15:24 -0500 (Thu, 12 Feb 2009) | 36 lines
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.8
   M /fwknop/trunk/test/fwknop_test.pl

- Added --icmp-type and --icmp-code command line arguments for the fwknop
client in order to manually set the ICMP type/code values when using
"--Spoof-proto icmp" or "--Server-proto icmp".  Also restructured how
SPA packets are sent over the various protocols.  Here is an example of
sending an SPA packet over an ICMP packet with type "123" and code
"123" (not normal ICMP type/code values) with the pcap trace shown:

# fwknop -A tcp/22 -s --Server-proto icmp --icmp-type 123 --icmp-code
123 -D 127.0.0.1

# tcpdump -i lo -l -nn icmp or udp -s 0 -X
tcpdump: verbose output suppressed, use -v or -vv for full protocol
decode listening on lo, link-type EN10MB (Ethernet), capture size 65535
bytes

07:24:32.527221 IP 127.0.0.1 > 127.0.0.1: ICMP type-#123, length 169
  0x0000:  4510 00bd 0000 4000 4001 3c2e 7f00 0001  E.....@.@.<.....
  0x0010:  7f00 0001 7b7b e66f 0000 0000 2b63 6a6f  ....{{.o....+cjo
  0x0020:  5049 6138 7345 7a35 4864 7955 5176 624b  PIa8sEz5HdyUQvbK
  0x0030:  6637 6f51 5934 4e36 4c6c 3454 6931 4453  f7oQY4N6Ll4Ti1DS
  0x0040:  2b4f 3756 6636 4775 6234 756f 6738 4432  +O7Vf6Gub4uog8D2
  0x0050:  3155 4377 5259 6b52 2b30 354b 7043 6b33  1UCwRYkR+05KpCk3
  0x0060:  4f66 452f 4f32 6737 6d37 5064 4846 4842  OfE/O2g7m7PdHFHB
  0x0070:  7a32 4745 3766 7a31 4a4c 7652 764e 626c  z2GE7fz1JLvRvNbl
  0x0080:  7a4a 7250 5355 3665 5051 5375 7a54 394b  zJrPSU6ePQSuzT9K
  0x0090:  702b 4446 4a79 7a6b 3847 6c51 6a70 3564  p+DFJyzk8GlQjp5d
  0x00a0:  3957 3673 4f52 7945 3771 6f57 6b56 634e  9W6sORyE7qoWkVcN
  0x00b0:  4e41 6167 6231 5a79 6a63 4834 49         NAagb1ZyjcH4I

- (Test suite): Added the ability to test sending SPA packets over ICMP.
- (Test suite): Added import_perl_modules() routine from fwknop itself to
enforce the usage of the same perl modules as those that fwknop
references.  The main application of this is for the Net::RawIP module
which is used by the test suite for the SPA over ICMP tests.


------------------------------------------------------------------------
r1399 | mbr | 2009-02-02 07:54:00 -0500 (Mon, 02 Feb 2009) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.h
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

bumped version to 1.9.11-pre2
------------------------------------------------------------------------
r1398 | mbr | 2009-02-02 07:53:34 -0500 (Mon, 02 Feb 2009) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

minor version line bug fix
------------------------------------------------------------------------
r1397 | mbr | 2009-02-02 07:53:06 -0500 (Mon, 02 Feb 2009) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/bump_version.pl
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.h
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

bumped version to 1.9.11-pre1
------------------------------------------------------------------------
r1396 | mbr | 2009-02-02 07:45:50 -0500 (Mon, 02 Feb 2009) | 4 lines
Changed paths:
   M /fwknop/trunk/CREDITS
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknopd

- (Franck Joncourt) Bug fix to add -O command line arg to knopwatchd to
specify an override config file if one is given on the fwknopd command
line.

------------------------------------------------------------------------
