------------------------------------------------------------------------
r1107 | mbr | 2008-06-01 14:51:32 -0400 (Sun, 01 Jun 2008) | 1 line
Changed paths:
   A /fwknop/branches/fwknop-1.9.4 (from /fwknop/trunk:1106)

created 1.9.4 branch
------------------------------------------------------------------------
r1106 | mbr | 2008-06-01 00:08:15 -0400 (Sun, 01 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/packaging/fwknop.spec
   M /fwknop/trunk/test/fwknop_test.pl

1.9.4 release
------------------------------------------------------------------------
r1105 | mbr | 2008-05-31 20:52:02 -0400 (Sat, 31 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknopd

minor addition of a flag to make sure that access should be granted to a specific port
------------------------------------------------------------------------
r1104 | mbr | 2008-05-31 18:21:29 -0400 (Sat, 31 May 2008) | 4 lines
Changed paths:
   M /fwknop/trunk/CREDITS
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/TODO
   M /fwknop/trunk/fwknopd

- Bugfix to not open ports that are not specifically requested in an SPA
packet even if those ports are listed in the OPEN_PORTS variable in the
access.conf file.

------------------------------------------------------------------------
r1103 | mbr | 2008-05-31 17:38:23 -0400 (Sat, 31 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/packaging/fwknop.spec

updated fwknop.spec to include the Digest::SHA module, and for the 1.9.4 release
------------------------------------------------------------------------
r1102 | mbr | 2008-05-31 17:11:38 -0400 (Sat, 31 May 2008) | 1 line
Changed paths:
   A /fwknop/trunk/Digest-SHA/lib
   A /fwknop/trunk/Digest-SHA/lib/Digest
   A /fwknop/trunk/Digest-SHA/lib/Digest/SHA.pm

Added lib directory for Digest::SHA
------------------------------------------------------------------------
r1100 | mbr | 2008-05-31 17:02:48 -0400 (Sat, 31 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

1.9.4-pre4
------------------------------------------------------------------------
r1099 | mbr | 2008-05-31 17:02:18 -0400 (Sat, 31 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknop.8
   M /fwknop/trunk/fwknop.conf
   M /fwknop/trunk/fwknopd.8

documentation updates for NAT, random port, and time offset options
------------------------------------------------------------------------
r1098 | mbr | 2008-05-31 11:58:00 -0400 (Sat, 31 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknop

Added --time-offset-plus and --time-offset-minus options
------------------------------------------------------------------------
r1097 | mbr | 2008-05-31 11:57:41 -0400 (Sat, 31 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

added --time-offset-* tests, added test against PCAP_FILTER and sniffing on a non-standard port
------------------------------------------------------------------------
r1096 | mbr | 2008-05-31 10:58:46 -0400 (Sat, 31 May 2008) | 1 line
Changed paths:
   A /fwknop/trunk/test/conf/filter_62203_fwknop.conf

add the filter_62203_fwknop.conf file to test the PCAP_FILTER variable with a port other than the default
------------------------------------------------------------------------
r1095 | mbr | 2008-05-31 10:42:09 -0400 (Sat, 31 May 2008) | 2 lines
Changed paths:
   M /fwknop/trunk/CREDITS
   M /fwknop/trunk/install.pl

made the init script position as "99" instead of "20" on Ubuntu systems.

------------------------------------------------------------------------
r1094 | mbr | 2008-05-31 10:40:42 -0400 (Sat, 31 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/CREDITS

credited BoneKracker for the port randomization post to the Gentoo forum
------------------------------------------------------------------------
r1092 | mbr | 2008-05-28 22:39:12 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

updated to 1.9.4-pre3
------------------------------------------------------------------------
r1091 | mbr | 2008-05-28 22:27:11 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/conf/blacklist_fwknop.conf
   M /fwknop/trunk/test/conf/excluded_net_access.conf
   M /fwknop/trunk/test/conf/forward_internal_ip_access.conf
   M /fwknop/trunk/test/conf/no_local_nat_fwknop.conf
   M /fwknop/trunk/test/conf/rand_port_fwknop.conf

added Id tag expansion
------------------------------------------------------------------------
r1090 | mbr | 2008-05-28 22:03:22 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

minor spacing fix for --NAT-local random test
------------------------------------------------------------------------
r1089 | mbr | 2008-05-28 21:54:27 -0400 (Wed, 28 May 2008) | 7 lines
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

-Added tests for --NAT-local --NAT-rand-port --rand-port mode.
-Updated to include executed commands in N.test files.
-Updated to include test status and identifying message at the
 end of N.test files.
-Updated print_errors() to automatically begin each error message
 with test number.

------------------------------------------------------------------------
r1088 | mbr | 2008-05-28 21:50:17 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

minor update to let the user know about NAT access ports (so 'ssh -p <port>' can be used); this is mostly needed with the --NAT-rand-port option
------------------------------------------------------------------------
r1087 | mbr | 2008-05-28 08:18:41 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

updated to used a single function to acquire SPA packet data
------------------------------------------------------------------------
r1086 | mbr | 2008-05-28 08:18:03 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   A /fwknop/trunk/test/conf/no_local_nat_fwknop.conf

added conf/no_local_nat_fwknop.conf file
------------------------------------------------------------------------
r1085 | mbr | 2008-05-28 08:17:47 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/conf/gpg_access.conf

removed KEY variable since it is not needed for GPG mode access
------------------------------------------------------------------------
r1084 | mbr | 2008-05-28 08:17:28 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/output/README

updated to latest test file format
------------------------------------------------------------------------
r1083 | mbr | 2008-05-28 08:17:05 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknopd

added log message and packet exclusion if ENABLE_IPT_LOCAL_NAT is not enabled but the client used --NAT-local
------------------------------------------------------------------------
r1082 | mbr | 2008-05-28 08:16:13 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

minor comment enhancement
------------------------------------------------------------------------
r1081 | mbr | 2008-05-28 08:15:48 -0400 (Wed, 28 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

updated to allow --NAT-access to not be specified if --NAT-local is used, minor bugfix for exiting if the symmetric key is not long enough
------------------------------------------------------------------------
r1080 | mbr | 2008-05-27 00:38:57 -0400 (Tue, 27 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

minor newline addition for hex dump output
------------------------------------------------------------------------
r1079 | mbr | 2008-05-27 00:38:42 -0400 (Tue, 27 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

1.9.4 additions
------------------------------------------------------------------------
r1078 | mbr | 2008-05-27 00:38:27 -0400 (Tue, 27 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknopd

updated access alert strings in NAT mode to show translated port
------------------------------------------------------------------------
r1077 | mbr | 2008-05-27 00:37:17 -0400 (Tue, 27 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

added tests for --NAT-local feature
------------------------------------------------------------------------
r1076 | mbr | 2008-05-26 20:16:02 -0400 (Mon, 26 May 2008) | 5 lines
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/IPTables-ChainMgr/Changes
   M /fwknop/trunk/IPTables-ChainMgr/README
   M /fwknop/trunk/IPTables-ChainMgr/VERSION
   M /fwknop/trunk/IPTables-ChainMgr/lib/IPTables/ChainMgr.pm
   M /fwknop/trunk/IPTables-Parse/Changes
   M /fwknop/trunk/IPTables-Parse/VERSION
   M /fwknop/trunk/IPTables-Parse/lib/IPTables/Parse.pm

- Updated to version 0.7 of the IPTables::ChainMgr module (includes
perldoc documentation).
- Updated to version 0.6 of the IPTables::Parse module (includes perldoc
documentation).

------------------------------------------------------------------------
r1075 | mbr | 2008-05-26 20:11:06 -0400 (Mon, 26 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

updated test output file format to <num>.test, and consolidated stdout and stderr into the same output file for each test
------------------------------------------------------------------------
r1074 | mbr | 2008-05-26 11:08:31 -0400 (Mon, 26 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/README

updated to newest test suite output listing (includes 126 tests)
------------------------------------------------------------------------
r1073 | mbr | 2008-05-26 11:07:16 -0400 (Mon, 26 May 2008) | 6 lines
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

- Added a single function to parse fwknop client output to acquire SPA packet
  data.
- Removed iptables ACCEPT rule for udp/62201 traffic since such a rule is not
  required (sniffing the loopback interface works without such a rule even if
  all udp/62201 packets are dropped).

------------------------------------------------------------------------
r1072 | mbr | 2008-05-24 22:41:08 -0400 (Sat, 24 May 2008) | 1 line
Changed paths:
   A /fwknop/trunk/test/conf/rand_port_fwknop.conf

Added rand_port_fwknop.conf file
------------------------------------------------------------------------
r1071 | mbr | 2008-05-24 22:34:52 -0400 (Sat, 24 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

added -V tests against installed fwknop and fwknopd scripts
------------------------------------------------------------------------
r1070 | mbr | 2008-05-24 21:38:50 -0400 (Sat, 24 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

Updated to version 5.47 of the Digest::SHA module
------------------------------------------------------------------------
r1069 | mbr | 2008-05-24 21:37:57 -0400 (Sat, 24 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/Digest-SHA/Changes
   M /fwknop/trunk/Digest-SHA/MANIFEST
   M /fwknop/trunk/Digest-SHA/META.yml
   M /fwknop/trunk/Digest-SHA/Makefile.PL
   M /fwknop/trunk/Digest-SHA/README
   D /fwknop/trunk/Digest-SHA/SHA.pm
   M /fwknop/trunk/Digest-SHA/SHA.xs
   M /fwknop/trunk/Digest-SHA/VERSION
   M /fwknop/trunk/Digest-SHA/examples/dups
   M /fwknop/trunk/Digest-SHA/shasum
   M /fwknop/trunk/Digest-SHA/src/hmac.c
   M /fwknop/trunk/Digest-SHA/src/hmac.h
   M /fwknop/trunk/Digest-SHA/src/sha.c
   M /fwknop/trunk/Digest-SHA/src/sha.h
   M /fwknop/trunk/Digest-SHA/t/allfcns.t
   M /fwknop/trunk/Digest-SHA/t/base64.t
   M /fwknop/trunk/Digest-SHA/t/bitbuf.t
   M /fwknop/trunk/Digest-SHA/t/dumpload.t
   M /fwknop/trunk/Digest-SHA/t/fips198.t
   M /fwknop/trunk/Digest-SHA/t/gg.t
   M /fwknop/trunk/Digest-SHA/t/gglong.t
   M /fwknop/trunk/Digest-SHA/t/hmacsha.t
   M /fwknop/trunk/Digest-SHA/t/ireland.t
   M /fwknop/trunk/Digest-SHA/t/methods.t
   M /fwknop/trunk/Digest-SHA/t/nistbit.t
   M /fwknop/trunk/Digest-SHA/t/nistbyte.t
   M /fwknop/trunk/Digest-SHA/t/podcover.t
   M /fwknop/trunk/Digest-SHA/t/rfc2202.t
   M /fwknop/trunk/Digest-SHA/t/sha1.t
   M /fwknop/trunk/Digest-SHA/t/sha224.t
   M /fwknop/trunk/Digest-SHA/t/sha256.t
   M /fwknop/trunk/Digest-SHA/t/sha384.t
   M /fwknop/trunk/Digest-SHA/t/sha512.t
   M /fwknop/trunk/Digest-SHA/t/woodbury.t

updated to Digest::SHA version 5.47
------------------------------------------------------------------------
r1068 | mbr | 2008-05-24 11:47:58 -0400 (Sat, 24 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop.conf
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/test/conf/blacklist_fwknop.conf
   M /fwknop/trunk/test/conf/default_fwknop.conf
   M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
   M /fwknop/trunk/test/conf/md5_fwknop.conf
   M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
   M /fwknop/trunk/test/conf/output_chain_fwknop.conf
   M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
   M /fwknop/trunk/test/conf/sha1_fwknop.conf
   M /fwknop/trunk/test/conf/sha256_fwknop.conf
   M /fwknop/trunk/test/conf/spa_aging_fwknop.conf

Added ENABLE_IPT_LOCAL_NAT variable to control whether connections to local sockets can be NAT'd
------------------------------------------------------------------------
r1067 | mbr | 2008-05-24 11:47:01 -0400 (Sat, 24 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

added destination port randomness checks for --rand-port, added the ability to cache the /proc ip_forward value and restore it after the FORWARD chain checks are run
------------------------------------------------------------------------
r1065 | mbr | 2008-05-23 00:29:16 -0400 (Fri, 23 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

bumped version to 1.9.4-pre2
------------------------------------------------------------------------
r1064 | mbr | 2008-05-23 00:06:35 -0400 (Fri, 23 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknop.conf
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/test/conf/blacklist_fwknop.conf
   M /fwknop/trunk/test/conf/default_fwknop.conf
   M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
   M /fwknop/trunk/test/conf/md5_fwknop.conf
   M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
   M /fwknop/trunk/test/conf/output_chain_fwknop.conf
   M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
   M /fwknop/trunk/test/conf/sha1_fwknop.conf
   M /fwknop/trunk/test/conf/sha256_fwknop.conf
   M /fwknop/trunk/test/conf/spa_aging_fwknop.conf
   M /fwknop/trunk/test/fwknop_test.pl

added MIN_SPA_PKT_LEN to enforce minimum SPA packet size, updated the test suite for NAT strings
------------------------------------------------------------------------
r1063 | mbr | 2008-05-23 00:02:34 -0400 (Fri, 23 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/TODO

need to add the Digest::SHA module to the RPM
------------------------------------------------------------------------
r1062 | mbr | 2008-05-22 21:52:21 -0400 (Thu, 22 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

added the ability to use a colon for --NAT-access command arg, e.g. '--NAT-access 192.168.10.1:12345'
------------------------------------------------------------------------
r1061 | mbr | 2008-05-22 21:43:20 -0400 (Thu, 22 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/access.conf

moved access.conf descriptions to the README.ACCESS file
------------------------------------------------------------------------
r1060 | mbr | 2008-05-22 21:42:56 -0400 (Thu, 22 May 2008) | 1 line
Changed paths:
   A /fwknop/trunk/README.ACCESS

added README.ACCESS file
------------------------------------------------------------------------
r1059 | mbr | 2008-05-21 01:02:11 -0400 (Wed, 21 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

1.9.4-pre1
------------------------------------------------------------------------
r1058 | mbr | 2008-05-21 01:01:20 -0400 (Wed, 21 May 2008) | 23 lines
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknopd

- Added two new port randomization options.  The first instructs the
  fwknop client to select a random port between 10,000 and 65,535 as the
  destination port over which to send an SPA packet.  This feature is
  enabled with a new command line argument "--rand-port" like so:

  $ fwknop -A tcp/22 --rand-port -R -D 11.1.1.1

  On the fwknopd server side, the default PCAP_FILTER setting of "udp port
  62201" should be changed to "udp dst portrange 10000-65535" so that
  fwknopd can sniff SPA packets that are sent over randomized destination
  ports.  Randomizing the destination port makes it more difficult to
  write IDS signatures to detect fwknop SPA communications.

  The second port randomization technique uses a new SPA message type to
  tell the fwknopd daemon to create a NAT rule for access to a local
  socket via the iptables INPUT chain.  This allows an SSH client to meet
  the local SSHD daemon running on the fwknopd server system by SSH'ing to
  the random port.  This functionality is implemented via a new command
  line argument "--Nat-access" on the fwknop command line.

- Bugfix to add a check for "keep-state" in ipfw policies in addition to
  the existing "check-state" check (noticed by Sebastien Jeanquier).

------------------------------------------------------------------------
r1057 | mbr | 2008-05-21 00:45:38 -0400 (Wed, 21 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/TODO

todo update
------------------------------------------------------------------------
r1056 | mbr | 2008-05-21 00:43:46 -0400 (Wed, 21 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/install.pl

bugfix to determine OS type as early as possible
------------------------------------------------------------------------
r1055 | mbr | 2008-05-20 22:57:17 -0400 (Tue, 20 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/bump_version.pl

added fwknop_serv
------------------------------------------------------------------------
r1054 | mbr | 2008-05-19 22:25:51 -0400 (Mon, 19 May 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop_serv

added GPL header
------------------------------------------------------------------------
r1053 | mbr | 2008-04-07 00:34:20 -0400 (Mon, 07 Apr 2008) | 1 line
Changed paths:
   M /fwknop/trunk/TODO

removed destination IP address restriction blurb; added SPA proxy idea
------------------------------------------------------------------------
