------------------------------------------------------------------------
r1175 | mbr | 2008-07-18 23:55:00 -0400 (Fri, 18 Jul 2008) | 1 line
Changed paths:
   A /fwknop/branches/fwknop-1.9.6 (from /fwknop/trunk:1174)

created fwknop-1.9.6 branch
------------------------------------------------------------------------
r1174 | mbr | 2008-07-18 23:46:42 -0400 (Fri, 18 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/packaging/fwknop.spec
   M /fwknop/trunk/test/fwknop_test.pl

bumped version to 1.9.6
------------------------------------------------------------------------
r1173 | mbr | 2008-07-18 23:38:39 -0400 (Fri, 18 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknop

implemented UDP source port randomization by default, and added --Source-port in the fwknop client to override this
------------------------------------------------------------------------
r1172 | mbr | 2008-07-06 13:14:16 -0400 (Sun, 06 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/knoptm.8

wording update for knoptm always running
------------------------------------------------------------------------
r1171 | mbr | 2008-07-06 13:11:16 -0400 (Sun, 06 Jul 2008) | 1 line
Changed paths:
   A /fwknop/trunk/fwknop_serv.8
   A /fwknop/trunk/knoptm.8

Added knoptm and fwknop_serv man pages from Franck Joncourt
------------------------------------------------------------------------
r1170 | mbr | 2008-07-05 23:46:15 -0400 (Sat, 05 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/CREDITS

updates for Franck
------------------------------------------------------------------------
r1169 | mbr | 2008-07-05 23:39:26 -0400 (Sat, 05 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop.8
   D /fwknop/trunk/knopspoof

removed knopspoof command (noticed by Franck Joncourt)
------------------------------------------------------------------------
r1167 | mbr | 2008-07-05 14:46:43 -0400 (Sat, 05 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

updated version to 1.9.6-pre3
------------------------------------------------------------------------
r1166 | mbr | 2008-07-05 14:42:22 -0400 (Sat, 05 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

added --Include-gpg-prefix handling to GetOpt
------------------------------------------------------------------------
r1165 | mbr | 2008-07-03 19:06:27 -0400 (Thu, 03 Jul 2008) | 27 lines
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/test/fwknop_test.pl

- SPA packets are base64-encoded by the fwknop client, and this encoding
pads data with '=' chars until the total length of the encoded data is a
multiple of four.  This characteristic can be used within a Snort rule
to assist in the detection of SPA communications.  The 1.9.6 release of
fwknop strips out these padding characters before the client sends an
SPA packet, and the fwknopd server adds them back in (to form a multiple
of four) before base64 decoding the packet data.  This reduces the level
of identifying information in SPA packets and therefore makes it more
difficult to detect the usage of SPA for service access.  For reference,
a Snort rule that would detect SPA packets via the trailing '=' chars
(previous to this release) would be:

    alert udp any any -> any 62201 (msg:"fwknop SPA traffic"; \
    dsize:>150; pcre:"/==$/"; sid:20080001; rev:1;)

- According to the 'file' command (via it's 'magic') database, files that
are encrypted with GnuPG begin with 0x8502, and this is true for SPA
packets generated by fwknop (previous to this release).  In
fwknop-1.9.6, the "hQ" prefix is removed by the fwknop client and added
back in by the fwknopd server if it doesn't exist.  This measure is
another effort to make SPA packets more difficult to detect on the wire,
such as with the following Snort rule:

    alert udp any any -> any 62201 (msg:"fwknop GnuPG encrypted SPA
    traffic"; content:"hQ"; depth:2; dsize:>1000; sid:20080003; rev:1;)


------------------------------------------------------------------------
r1163 | mbr | 2008-07-01 20:18:17 -0400 (Tue, 01 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

bumped version to 1.9.6-pre2
------------------------------------------------------------------------
r1162 | mbr | 2008-07-01 19:46:30 -0400 (Tue, 01 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog
   M /fwknop/trunk/test/fwknop_test.pl

finished off proper support for testing of legacy encrypted port knocking
------------------------------------------------------------------------
r1161 | mbr | 2008-07-01 19:46:03 -0400 (Tue, 01 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/conf/pk_encrypted_sequence_access.conf

Added PORT_OFFSET and updated KEY to standard test suite key
------------------------------------------------------------------------
r1160 | mbr | 2008-07-01 19:45:22 -0400 (Tue, 01 Jul 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

added port offset output in legacy encrypted port knocking mode
------------------------------------------------------------------------
r1158 | mbr | 2008-06-30 20:39:14 -0400 (Mon, 30 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/VERSION
   M /fwknop/trunk/fwknop
   M /fwknop/trunk/fwknop_serv
   M /fwknop/trunk/fwknopd
   M /fwknop/trunk/knoptm
   M /fwknop/trunk/knopwatchd.c
   M /fwknop/trunk/test/fwknop_test.pl

bump version to 1.9.6-pre1
------------------------------------------------------------------------
r1157 | mbr | 2008-06-30 20:38:44 -0400 (Mon, 30 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

ipfw test suite fix
------------------------------------------------------------------------
r1156 | mbr | 2008-06-29 13:17:59 -0400 (Sun, 29 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

bugfix for regex to match 0.0.0.0
------------------------------------------------------------------------
r1155 | mbr | 2008-06-29 11:13:04 -0400 (Sun, 29 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

bugfix to use --fw-type argument on fwknopd command line - fixes tests on FreeBSD systems
------------------------------------------------------------------------
r1154 | mbr | 2008-06-28 11:53:29 -0400 (Sat, 28 Jun 2008) | 6 lines
Changed paths:
   M /fwknop/trunk/fwknopd

- Updated to parse /var/log/messages by default via ENABLE_SYSLOG_FILE in
legacy port knocking mode.
- Added code to re-open the fwdata file if it is rotated.
- Added packet limit (actually "sequence limit") in support of test suite
legacy port knocking tests.

------------------------------------------------------------------------
r1153 | mbr | 2008-06-28 11:51:38 -0400 (Sat, 28 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/ChangeLog

1.9.6 changes
------------------------------------------------------------------------
r1152 | mbr | 2008-06-28 11:50:53 -0400 (Sat, 28 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop.conf

added ENABLE_SYSLOG_FILE and IPT_SYSLOG_FILE to parse /var/log/messages by default in legacy port knocking mode
------------------------------------------------------------------------
r1151 | mbr | 2008-06-28 11:50:16 -0400 (Sat, 28 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/knopwatchd.c

added check for ENABLE_SYSLOG_FILE so that knopmd is not monitored if enabled
------------------------------------------------------------------------
r1150 | mbr | 2008-06-28 11:49:29 -0400 (Sat, 28 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/install.pl

updated to not reconfigure syslog for legacy port knocking mode since fwknopd will parse /var/log/messages by default, but added --install-syslog-fifo to override this
------------------------------------------------------------------------
r1149 | mbr | 2008-06-28 11:47:37 -0400 (Sat, 28 Jun 2008) | 12 lines
Changed paths:
   M /fwknop/trunk/test/fwknop_test.pl

- Added the ability to explicitly run major classes of tests
with two new command line arguments to the fwknop_test.pl script:
--test-include <test>, and --test-exclude <test>.  In each case the
<test> string is used as a sub-string match against the main identifying
string for the name of the test.  For example, to run all tests for
replay attacks, use "--test-include Replay", and for all port
randomization tests use "--test-include random".  To see all possible
classes of tests run the test suite without any command line arguments
and examine the test.log file.
- Implemented tests for legacy port knocking sequences - shared only for
now, but support for encrypted sequences is coming as well.

------------------------------------------------------------------------
r1148 | mbr | 2008-06-28 11:44:08 -0400 (Sat, 28 Jun 2008) | 1 line
Changed paths:
   A /fwknop/trunk/test/conf/pk_encrypted_sequence_access.conf
   A /fwknop/trunk/test/conf/pk_fwknop.conf
   A /fwknop/trunk/test/conf/pk_multi_port_shared_sequence_access.conf
   A /fwknop/trunk/test/conf/pk_multi_protocol_shared_sequence_access.conf
   A /fwknop/trunk/test/conf/pk_single_port_shared_sequence_access.conf

added config and access files in support of legacy port knocking mode tests
------------------------------------------------------------------------
r1147 | mbr | 2008-06-28 11:43:07 -0400 (Sat, 28 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/test/conf/blacklist_fwknop.conf
   M /fwknop/trunk/test/conf/default_fwknop.conf
   M /fwknop/trunk/test/conf/filter_62203_fwknop.conf
   M /fwknop/trunk/test/conf/forward_chain_fwknop.conf
   M /fwknop/trunk/test/conf/md5_fwknop.conf
   M /fwknop/trunk/test/conf/no_local_nat_fwknop.conf
   M /fwknop/trunk/test/conf/no_promisc_fwknop.conf
   M /fwknop/trunk/test/conf/output_chain_fwknop.conf
   M /fwknop/trunk/test/conf/pcap_file_fwknop.conf
   M /fwknop/trunk/test/conf/rand_port_fwknop.conf
   M /fwknop/trunk/test/conf/sha1_fwknop.conf
   M /fwknop/trunk/test/conf/sha256_fwknop.conf
   M /fwknop/trunk/test/conf/spa_aging_fwknop.conf

added ENABLE_SYSLOG_FILE and IPT_SYSLOG_FILE variables in support of the legacy port knocking mode
------------------------------------------------------------------------
r1146 | mbr | 2008-06-28 11:42:27 -0400 (Sat, 28 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop

added --Test-mode exit for port knock sequences so that they are not sent if --Test-mode is used (this assists the test suite)
------------------------------------------------------------------------
r1145 | mbr | 2008-06-28 11:41:17 -0400 (Sat, 28 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/access.conf

minor wording update to include the legacy port knocking mode
------------------------------------------------------------------------
r1144 | mbr | 2008-06-28 11:40:53 -0400 (Sat, 28 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop_funcs.c

Minor bugfix to require a space character after variable names
------------------------------------------------------------------------
r1143 | mbr | 2008-06-20 00:05:36 -0400 (Fri, 20 Jun 2008) | 1 line
Changed paths:
   M /fwknop/trunk/fwknop.8
   M /fwknop/trunk/fwknopd.8
   M /fwknop/trunk/test/output/README

added doc fixes from Franck Joncourt
------------------------------------------------------------------------
