root/fwknop/tags/fwknop_0_9_4/ChangeLog

fwknop-0.9.4 (09/17/2005):
    - Bugfix for knoptm timing out new entries based on old time values
      (this caused new rules to timed out too quickly).
    - Added support for multiple users in REQUIRE_USERNAME keyword in
      access.conf.
    - Added the ability to display raw encrypted packet data in client
      mode with --verbose.
    - Created fwknop RPM for RPM-based Linux distributions.
    - Bugfix for inappropriate redirects in command mode where the command
      already contained a redirect.

fwknop-0.9.3 (08/27/2005):
    - Added an on-disk cache of md5 sums so that the md5 sum check can
      survive restarts of fwknop.
    - Updated install.pl to be more friendly to Mac OS X (Blair Zajac).
    - Updated to allow access.conf variables to have values instead of just
      being defined.
    - Started on additional server authentication mode code (re-worked MD5
      sum calculation to allow packet format to be extended by taking into
      account the fwknop version number).

fwknop-0.9.2 (08/06/2005):
    - Added FILE_PCAP data collection method when running in server mode.
      This is a more general way of getting packets than the ULOG_PCAP
      mode since then a normal ethernet sniffer can be used to build the
      file.
    - Added the ability to re-open a pcap file if its size shrinks (i.e.
      it gets rotated out or something).
    - Bugfix for multiple rules with the same timestamp not being timed out
      by knoptm.
    - Integrated spoofing capability directly within fwknop (instead of
      using the knopspoof command) through the use of "require Net::RawIP".
    - Better multi-protocol support in server mode.  Tcp and icmp packets
      are properly decoded now.

fwknop-0.9.1 (07/29/2005):
    - Added the ability to specify multiple ports/protocols to access on a
      server with the --Access command line option.
    - Added the ability to spoof SPA packets over icmp and tcp protocols.
    - Added the ability to restrict access at the server to only those
      ports defined in the OPEN_PORTS keyword.  This option is controled by
      a new keyword "PERMIT_CLIENT_PORTS".
    - Bugfix for MD5 sum not being properly calculated over decrypted data.
      This allowed old packets that contained additional garbage data to
      be replayed against an fwknop server.
    - Updated to fall back to getpwuid() if getlogin() fails (Blair Zajac).
    - Added --ipt-list to list all current rules in the FWKNOP Netfilter
      chains.
    - Added --ipt-flush to flush all current rules in the FWKNOP Netfilter
      chains.
    - Bugfix for the installer dying if ~/lib already exists (Blair Zajac).
    - Updated to delay the loading of server perl modules (Net::Pcap, etc.)
      only if we are running in server mode.
    - Bugfix for module directory paths in install.pl.

fwknop-0.9.0 (05/29/2005):
    - Added new authorization mode that uses Net::Pcap to read packets
      out of a file that is written to by the ulogd pcap writer (also
      stubbed in code to sniff packets directly off the wire).  This
      authorization mode only requires single packets, and has many
      characteristics that are better than simple port knocking, including
      being non-replayable, and much more data can be sent.  This mode
      is now the default for both the server and the client.
    - Made the execution of knopmd optional depending on whether AUTH_MODE
      is a pcap mode (e.g. ULOG_PCAP or PCAP).
    - Added --Spoof-src argument so that encrypted packets can be spoofed
      via /usr/sbin/knopspoof.
    - Added /usr/sbin/knoptm so that firewall rules can be timed-out when
      the server is running in PCAP mode even if new packets don't appear
      on the wire.
    - Updated fwknop man page to talk about the new pcap-based
      authorization mode.

fwknop-0.5.0 (03/19/2005):
    - Added ALERTING_METHOD to allow syslog and/or email reporting to be
      disabled (there is a dedicated file /etc/fwknop/alert.conf that
      governs this behavior, and both fwknop and knopwatchd reference this
      file).
    - Bugfix for distinguishing OPT field associated with --log-tcp-options
      vs. --log-ip-options.
    - Added install_perl_module() install.pl from psad to provide a
      consistent installation interface.
    - Applied patch to only install perl modules that are not already
      installed (Blair Zajac).
    - Added --last-cmd option to allow fwknop to be executed with command
      line arguments from the previous execution (they are saved in
      ~/.fwknop.run).
    - Added --Home-dir option to allow the home directory to be manually
      specified.
    - Re-worked get_homedir() to be more friendly to systems that do not
      necessarily have /etc/passwd (e.g. OS X).
    - Added configuration preservation and querying for which syslog
      daemon is running to install.pl.  These features were adapted from the
      psad installer (http://www.cipherdyne.org/psad).
    - Added IPTables::ChainMgr.  Fwknop uses this module to maintain
      dedicated chains to which access rules are added.
    - Added IPTables::Parse, which is used internally by IPTables::ChainMgr.
    - Added __WARN__ and __DIE__ handlers so errors can easily be collected.

fwknop-0.4.2 (09/27/2004):
    - Added init script for Fedora systems.
    - Added --Kill, --Restart, and --Status modes (this fixes the generic
      init script which depends on these arguments).

fwknop-0.4.1 (09/14/2004):
    - Bugfix for legacy posf code in fwknop and variable in fwknop.conf.

fwknop-0.4 (09/10/2004):
    - Added ability to specify multiple IPs/networks in a single SOURCE
      definition.
    - Better examples section in the fwknop manpage.
    - Bugfix to make sure EMAIL_ADDRESSES variable does not contain commas
      (any commas are translated into spaces).
    - Added LICENSE file.

fwknop-0.3 (08/21/2004):
    - Bugfix for tracking knock sequences by source IP address.
    - Bugfix for knock sequence timeouts.
    - Removed old passive OS fingerprinting code in favor of the p0f
      strategy.
    - Added support for taking encryption keys from a file specified on
      the command line.
    - Update to send "sequence decrypt failed" email message only if
      decryption failed for all encrypt sequence SOURCE blocks.

fwknop-0.2 (07/31/2004):
    - Implemented remote username checking in encrypted sequences.
    - Added support for icmp in knock sequences.
    - Added protocol rotation option for encrypted sequences.
    - Added code for multiple SOURCE access blocks with the same source
      net/IP.
    - Added KNOCK_LIMIT access control variable to limit the number of
      times a particular knock sequence is honored.
    - Added email alerts.

fwknop-0.1 (07/08/2004):
    - Initial release.