Changeset 1104

Timestamp:

05/31/08 18:21:29 (6 months ago)

Author:

mbr

Message:

- Bugfix to not open ports that are not specifically requested in an SPA
packet even if those ports are listed in the OPEN_PORTS variable in the
access.conf file.

Files:

• fwknop/trunk/CREDITS (modified) (1 diff)
• fwknop/trunk/ChangeLog (modified) (1 diff)
• fwknop/trunk/TODO (modified) (2 diffs)
• fwknop/trunk/fwknopd (modified) (5 diffs)

fwknop/trunk/CREDITS

@@ -79 +79 @@
-    - Helped with the testing process for fwknop-1.8.2 and OS X support.
-    - Suggested the integration of SHA256 for replay attack detection.
+    - Suggested the OPEN_PORTS fix to not open ports that are not
+      specifically requested in an SPA packet.
+    - Noticed the bug where the "keep-state" option was not noticed when
+      checking for state tracking rules in ipfw policies.
-
-Mate Wierdl

fwknop/trunk/ChangeLog

@@ -65 +65 @@
-      as possible within the boot sequence so that the system is ready to run
-      fwknop.
+    - Bugfix to not open ports that are not specifically requested in an SPA
+      packet even if those ports are listed in the OPEN_PORTS variable in the
+      access.conf file.
-    - Updated to version 5.47 of the Digest::SHA module.
-    - Updated to version 0.7 of the IPTables::ChainMgr module (includes

fwknop/trunk/TODO

@@ -84 +84 @@
-
-
- - Bugfix for opening all ports instead of just the requested ones.
- - Doc links in email messages linking back to help docs on cipherdyne.org
- - Integrate with clients programs besides SSH.
@@ -123 +122 @@
- - Firefox SPA extension.
- - Finish fwknop tutorial.
- - Bugfix for installing Digest::SHA via the RPM.

fwknop/trunk/fwknopd

@@ -776 +776 @@
-        $digest, $access_hr) = @_;
-
-
-
-
+
+
+
+
-
-    if ($access_hr->{'DISABLE_FW_ACCESS'}) {
@@ -838 +839 @@
-
-        if ($access_hr->{'PERMIT_CLIENT_PORTS'}) {
-open
+grant
-        } else {
-unless
+if
-                    defined $open_ports{$allow_proto}{$allow_port}) {
+                $grant_ports{$allow_proto}{$allow_port} = '';
+            } else {
-                &logr('[-]', "IP $allow_src not permitted to open " .
-                    "$allow_proto/$allow_port (SOURCE line num: " .
@@ -868 +871 @@
-
-                if ($access_hr->{'PERMIT_CLIENT_PORTS'}) {
-open
+grant
-                } else {
-unless
+if
-                            defined $open_ports{$proto}{$port}) {
+                        $grant_ports{$proto}{$port} = '';
+                    } else {
-                        &logr('[-]', "IP $allow_src not permitted to open " .
-                            "$proto/$port (SOURCE line num: " .
@@ -932 +937 @@
-        }
-        my $port_ctr = 0;
-open
-open
+grant
+grant
-                $port_ctr++;
-            }
@@ -984 +989 @@
-    ### grant access through the firewall
-    &grant_access($allow_src, $msg_hr, \%nat_info,
-open
+grant
-
-    return 1;