Hi all,
fwknop-2.6.9 has been released: https://www.cipherdyne.org/fwknop/download/
github release tag: https://github.com/mrash/fwknop/releases/tag/2.6.9
ChangeLog:
- (Jonathan Bennett) Added support for the SHA3 "Keccak" algorithm
(specifically SHA3_256 and SHA3_512) for SPA HMAC and digest checking.
Enabling SHA3 from the fwknop client command line is done with the
'-m'
option for the embedded SPA digest, or with the --hmac-digest-type
argument for the HMAC. On the server side, SHA3_256 or SHA3_512 can be
required for incoming SPA packet HMAC'c via the HMAC_DIGEST_TYPE
configuration variable in access.conf stanzas. The SHA3 implementation
is from, Keyak and Ketje Teams, namely, Guido Bertoni, Joan Daemen,
Michael Peeters, Gilles Van Assche and Ronny Van Keer - see:
http://keyak.noekeon.org/
- (Damien Stuart) Added support for libnetfilter_queue so that fwknopd
can
acquire SPA packets via the NFQ target. This feature is enabled with a
new command line switch '--enable-nfq-capture' for the configure
script,
and libpcap is not required in this mode. In support of capturing SPA
packets via the NFQ target, new configuration variables have been
added
to the fwknopd.conf file: ENABLE_NFQ_CAPTURE, NFQ_INTERFACE, NFQ_PORT,
NFQ_TABLE, NFQ_CHAIN, NFQ_QUEUE_NUMBER, and NFQ_LOOP_SLEEP.
- (Vlad Glagolev) Added support for deriving the source IP from the
X-Forwarded-For HTTP header when SPA packets are sent over HTTP
connections.
- Bug fix in command open/close cycle feature to ensure that the first
successful match on a valid incoming SPA packet finishes all
access.conf
stanza processing. That is, no other stanzas should be looked at after
the first match, and this is consistent with other SPA modes (such as
basic access requests). This bug was reported by Jonathan Bennett.
- (Jonathan Bennett) Various fixes and enhancements to the test suite to
extend code coverage to new code, ensure valgrind bytes lost detection
works for amount of memory less than 10 bytes, better timing strategy
for fwknop client/server interactions, and more.
------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
_______________________________________________
Fwknop-discuss mailing list
Fwknop-discuss@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fwknop-discuss
