-
Notifications
You must be signed in to change notification settings - Fork 59
/
ChangeLog
1697 lines (1190 loc) · 65.4 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2024-09-15 Roy Hills <Roy.Hills@hotmail.com>
* check-error: Change invalid option test string from
"ike-scan: unrecognized option", to "^Usage: ike-scan".
This fixes a test failure on cygwin because it's newlib based C
library outputs "ike-scan: unknown option" instead of
"ike-scan: unrecognized option" that is used by glibc and BSD libc.
https://github.com/royhills/ike-scan/pull/45
2022-10-02 Roy Hills <Roy.Hills@hotmail.com>
* acinclude.m4: Replaced obsolete autoconf macros AC_TRY_COMPILE with
AC_COMPILE_IFELSE. This macro was obsoleted in autoconf 2.70.
* configure.ac: Remove obsolescent autoconf macros: AC_HEADER_STDC,
AC_C_CONST, AC_HEADER_TIME - all modern systems have an ANSI C
compiler with working const and time headers. Incremented version
number to reflect recent changes.
* ike-scan.h: Include ASNI C headers unconditionally. Include
<sys/time.h> if HAVE_SYS_TIME_H is defined.
2022-10-01 Sam James <sam@gentoo.org>
* configure.ac: Fix recognising -Wformat-security with Clang
* acinclude.m4: fix typo in 'x' if check (was using lowercase 'x'
on one side of comparison and uppercase 'X' on the other side).
Declare main() as int to fix -Wimplicit-int errors.
2022-09-18 Roy Hills <Roy.Hills@nta-monitor.com>
* check-decode, check-error, check-packet, check-psk-crack-1,
check-psk-crack-2, check-psk-crack-3, check-psk-crack-4,
check-run1, check-run2, check-run3, check-vendor-ids: Changed
"$srcdir/ike-scan" to "./ike-scan" in test scripts so
"make distcheck" succeeds.
* .github/workflows/c-cpp.yml: Enable "make distcheck" step.
2022-09-14 Roy Hills <Roy.Hills@nta-monitor.com>
* README.md, .github/workflows/*: Migrated from travis-ci to github
actions for CI/CD build check and code coverage report.
* .travis.yml: removed as no longer needed.
2020-07-05 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Remove unused variables "idfile" and "idstrings", and
the associated options -F and --idfile. These were never used, and
were causing warnings with GCC 10.2
* ike-scan.c: Add "break" statement after call to usage() in options
switch statement. This isn't required as usage() never returns,
but it's harmless and prevents a "this statement may fall through"
compiler warning with GCC 8.3.0.
* utils.c: Use labs() rather than abs() when computing time
difference as time_t is normally "long" and using abs() generates
a compiler warning with GCC 10.2
2020-07-05 Roy Hills <Roy.Hills@nta-monitor.com>
* README.md, ike-backoff-patterns, ike-scan.1, ike-vendor-ids: Update
wiki references to use new URL http://www.royhills.co.uk/wiki/
2014-05-23 Richard Moore <rich@...>
* ika-scan.c, ike-scan.c: Added option to bind to a specific interface.
2014-03-21 Roy Hills <Roy.Hills@nta-monitor.com>
* isakmp.c: Added fclose call to fix the potential file pointer
resource leak in print_psk_crack_values().
2013-12-01 Roy Hills <Roy.Hills@nta-monitor.com>
* configure.ac, .gitignore: Added configure option --enable-gcov to
enable gcov code coverage.
2013-11-12 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Disallow the use of both --aggressive and --ikev2 options.
This fixes debian bug #512962.
2013-11-10 Roy Hills <Roy.Hills@nta-monitor.com>
* isakmp.c: Updated attribute maps with new values and updated
RFC references.
* TODO: Removed items that have been addressed or are no longer
required.
2013-10-27 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, ike-scan.h, isakmp.c: Use payload type 43 instead of
13 for vendor ID payloads with ikev2. This implementation requires
that the --ikev2 or -2 option be specified before the --vendor or -e
option to work correctly.
* isakmp.c: Updated maps from RFC 5996 (new IKEv2 RFC which replaces
4306), RFC 5282, RFC 5114, and RFC 6467.
* ike-vendor-ids, check-deocde: Minor change to Firewall-1 NGX vendor
id name.
2013-10-26 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Add support for sending key exchange payload for ECP
Diffie-Hellman groups 19, 20 and 21 with --dhgroup=n. The Key
Exchange payload length for these groups is as detailed in RFC 4753.
DH groups 19 and 20 tested in aggressive mode with Checkpoint VPN-1
R77.
2013-09-04 Roy Hills <Roy.Hills@nta-monitor.com>
* Added references to the github repository in README, *.c and *.h
in place of the ike-scan email address and the pattern submission
URL.
* configure.ac: Change the bug-report string in AC_INIT from the
ike-scan email address to the github URL.
2013-08-17 Roy Hills <Roy.Hills@nta-monitor.com>
* check-vendor-ids, Makefile.am: New check script to validate the
vendor ID patterns as part of "make check" from Jonathan Claudius.
2013-08-16 Roy Hills <Roy.Hills@nta-monitor.com>
* .travis.yaml: New file to enable autobuild on Travis CI.
* .gitignore: New file listing patterns to exclude from the repository.
* COPYING: New file.
* check-decode: Modified so "make check" works with new
HeartBeat_Notify VID name.
* configure.ac: Incremented version to 1.9.4 to distinguish new
version under git revision control.
* ike-vendor-ids: Merged in vendor ID additions from Jonathan Claudius.
* Removed $Id$ keywords from all files, and associated rcsid variable
from C sources.
2013-08-15 Roy Hills <Roy.Hills@nta-monitor.com>
* Final SVN revision before migration to git.
2012-12-14 Jesper Kückelhahn <(email withheld)>
* ike-vendor-ids: Added new vendor IDs from research while developing
script for nmap.
2011-09-22 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Removed most occurances of set but unused variables as
reported by -Wunused-but-set-variable in gcc 4.6. There is one
occuurance of this error remaining, because the --idstrings
option has not been fully implemented.
2011-04-04 Roy Hills <Roy.Hills@nta-monitor.com>
* configure.ac: incremented version number to 1.9.3
* configure.ac: Remove version number from AM_INIT_AUTOMAKE macro,
as this usage is obsolete now.
* ike-scan.c, ike-scan.h: Modify add_host_pattern() and add_host() so
we always use the more efficient inet_aton() rather than
get_host_address() for IPnet/bits, IPnet:mask and IPstart-IPend
patterns.
* ike-scan.c: Add support for IPnet:netmask format in
add_host_pattern().
* ike-scan.c: Change all uses of sprintf() to snprintf().
2011-03-30 Roy Hills <Roy.Hills@nta-monitor.com>
* acinclude.m4: Removed #include <features.h> from GCC_FORTIFY_SOURCE
macro, as this header is not portable.
* configure.ac: Added GCC_WEXTRA macro if we are compiling with GCC
to enable extra warnings, and define ATTRIBUTE_UNUSED to the
appropriate pragma depending on whether we are using GCC or not.
* utils.c: Added ATTRIBUTE_UNUSED to sig_alarm parameter to avoid
unused parameter warning.
* ike-scan.c: Add some casts to unsigned to avoid "comparison between
signed and unsigned" warnings.
2010-12-07 Roy Hills <Roy.Hills@nta-monitor.com>
* acinclude.m4: Added GCC_WEXTRA macro to determine if the C compiler
supports the -Wextra switch to enable extra warnings.
* ike-scan.c, isakmp.c, utils.c, psk-crack.c: Addressed some of the
unsigned/signed comparisons flagged up with -Wextra.
2009-08-15 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, utils.c: Improve handling of --bandwidth and
--interval options: Allow either upper or lowercase
multiplier letters and give an error if an unknown multiplier
character is used. Previously an unknown multiplier character
or one with the wrong case was silently ignored and treated as
no multiplier at all.
* wrappers.c: Change Strtoul so it gives an error if the
underlying strtoul function finishes at an unconvertable
character other than NULL or whitespace.
* configure.ac: Added extra warnings "-Wshadow -Wwrite-strings"
for gcc.
2009-08-14 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, ike-scan.h, psk-crack.h, configure.ac, error.c: Removed
syslog functionality as this is not used and has been #ifdef'ed out
for some time.
2009-05-06 Roy Hills <Roy.Hills@nta-monitor.com>
* configure.ac: Upgraded for autoconf 2.61
2009-03-06 Roy Hills <Roy.Hills@nta-monitor.com>
* acinclude.m4: Added macros to detect compiler support for
-fstack-protect, -D_FORTIFY_SOURCE and -Wformat-security.
* configure.ac: Conditionally enable compiler flags for
-fstack-protect, -D_FORTIFY_SOURCE and -Wformat-security using
the new acinclude.m4 autoconf macros.
* configure.ac: Incremented version to 1.9.2
2008-09-01 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Improved the description of the --trans option in
the help output.
* wrappers.c: Modified Strtoul so it only permits fully convertable
strings. This avoids the problem mentioned by ML with 1=7/128
in an advanced transform specification.
* ike-scan.c: Corrected those calls to Strtoul that assumed the old
behaviour, where a string could be terminated by any non convertable
character.
* check-packet, pkt-custom-proposal.dat: Corrected the advanced
transform specification, and added an additional transform using
variable length attributes.
2008-03-07 Roy Hills <Roy.Hills@nta-monitor.com>
* isakmp.c: Added additional XAUTH authentication methods to auth_map.
* ike-backoff-patterns: Added Cisco PIX 7.0
* ike-vendor-ids: Added Windows 2008 server
2007-06-09 Roy Hills <Roy.Hills@nta-monitor.com>
* check-error: new checking script to test response to error
conditions.
2007-04-22 Roy Hills <Roy.Hills@nta-monitor.com>
* utils.c: New function "dupstr", which is a local implementation
of the common but non-standard library function "strdup".
* ike-scan.c: Replace calls to malloc/strcpy with calls to the
new dupstr function. This makes the code tidier and also reduces
the number of calls to the potentially dangerous strcpy function.
2007-04-17 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.h: Undefined SYSLOG, as we don't use this any more, and I
doubt that anyone else needs it. The syslog functionality may be
removed in a future release.
2007-04-13 Roy Hills <Roy.Hills@nta-monitor.com>
* configure.ac: Added checks for strlcat and strlcpy, with
replacement functions using the OpenBSD implementations if they are
not present.
* strlcat.c, strlcpy.c: New source files from the OpenBSD source at
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/string
2007-03-06 Roy Hills <Roy.Hills@nta-monitor.com>
* configure.ac: Incremented version number to 1.9.1.
* ike-vendor-ids, ike-backoff-patterns: various minor changes and
additions.
2007-01-26 Roy Hills <Roy.Hills@nta-monitor.com>
* Released v1.9 Tarball size: 1412689, Zip size: 2260655.
tarball md5sum: bed63c7d2f54c482525a735be7b5e720
Zip md5sum: 5a224a60235189ba1b8882c98e09489c
2007-01-14 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Refactored display_packet() to ensure that payload
is correctly aligned.
2007-01-13 Roy Hills <Roy.Hills@nta-monitor.com>
* check-decode: New tests for pkt-main-natt-response,
pkt-aggr-cert-response, pkt-v2-notify-response and
pkt-checkpoint-notify.
* check-packet: New test for pkt-single-trans.
* ike-scan.c: Added conditional code to write received IKE packet to
a file. This is used to create data files for use with check-decode,
and is not intended for production use.
* psk-crack.h: Include <sys/time.h> and <time.h>.
* ike-scan.c: Added O_TRUNC option to writepkttofile open() call.
2007-01-02 Roy Hills <Roy.Hills@nta-monitor.com>
* check-psk-crack-4: New checking script to improve coverage of
psk-crack.c and hash_functions.h. Test coverage for these
source files is now:
96.88% of 64 lines executed in file hash_functions.h
95.28% of 318 lines executed in file psk-crack.c
* check-packet, check-decode: Added new tests to improve coverage of
ike-scan.c and isakmp.c. Test coverage for these files is
now:
71.18% of 1957 lines executed in file ike-scan.c
69.61% of 964 lines executed in file isakmp.c
* ike-scan.c, ike-scan.h: Added new --readpktfromfile option.
This option reads the packet from the specified file rather
than from the network. It is intended for debugging and
testing purposes, to allow the IKE packet decoding to be
easily checked. This option is not documented, because it is
designed purely for testing.
2006-12-30 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: Added support for IKEv2 with new --ikev2
option.
* configure.ac: Incremented version to 1.8.7.
2006-12-27 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: New option --rcookie to set the responder
cookie to the specified value. Modified make_isakmp_header() to
support specification of the responder cookie.
2006-12-23 Roy Hills <Roy.Hills@nta-monitor.com>
* psk-crack.c, psk-crack.h: Moved nortel_user into psk_entry struct
to permit cracking a mixture of Nortel and standard PSKs, although
the command line options do not currently permit this.
* psk-crack.c: Changed cracking loop order, so that the candidate
password selection (either the next work from the dictionary, or
the next brute-force string) is the outher loop, and the PSK entry
selection the inner one. This avoids having to rewind the
dictionary file, which permits the use of stdin for the
dictionary.
This also cured an as-yet unfound bug, which caused false positive
matches against the last candidate password when cracking multiple
PSK entries.
* psk-crack.c: Added support for using stdin for the dictionary file
with "--dictionary=-". This allows us to use other programs to
generate the candidate passwords, e.g:
john --incremental --stdout | psk-crack --dictionary=- psk-file
* hash_functions.h: New header file containing "inline static"
functions for MD5, SHA1, hmac_md5 and hmac_sha1.
* configure.ac: Incremented version to 1.8.6.
2006-12-21 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Added --nat-t option to enable RFC 3947 NAT Traversal.
This option adds the Non-ESP marker to outbound packets and
strips the marker from responses. It also changes the default
source and destination UDP ports to 4500.
2006-12-18 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Added experimental support for RFC 3947 NAT-Traversal.
2006-12-17 Roy Hills <Roy.Hills@nta-monitor.com>
* isakmp.c: Added CRACK (128) to auth map. This is defined in
draft-harkins-ipsra-crack-00 "IKE Challenge/Response for
Authenticated Cryptographic Keys", but I've not seen it used in
practice.
2006-11-30 Roy Hills <Roy.Hills@nta-monitor.com>
* isakmp.c: Moved all the ID/Name maps into isakmp.c as global
consts. Other source files that need to reference them do so
by declaring them as extern.
* utils.c: New functions name_or_number() and str_ccmp() which
allow a string containing either a number or a name from the
specified map to be used.
2006-11-25 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Changed --ranssrc option to --sourceip, and allow it
to take an IP address or the string "random". When --sourceip is
specified, we no longer attempt to read from the socket as reading
UDP from a raw socket doesn't work on all OSes and we are unlikely
to receive any return data if we've spoofed the source address
anyway.
* ike-vendor-ids: Update strongSwan vendor IDs based on stronSwan
4.0.5
2006-11-23 Roy Hills <Roy.Hills@nta-monitor.com>
* psk-crack.c: New function load_psk_params() to read the data from
the psk parameters file into a list of structures. This moves the
psk file reading loop out of main(), and also allows more flexible
selection of the psk cracking order as all the psks are in memory.
* psk-crack.c: New function compute_hash(), which does the real work
of computing the hash given the PSK parameters and a candidate
password. This function is defined as "static inline" because it
is called from a tight loop, and inlining significantly improves
performance.
* psk-crack.c: New function open_dict_file(), which opens the
dictionary file. This function reduces the size of main() to make
it more readable.
* configure.ac: Added AC_C_INLINE to check for compiler support for
function inlining and define "inline" accordingly in config.h.
2006-11-21 Roy Hills <Roy.Hills@nta-monitor.com>
* psk-crack.h: New header file for psk-crack.
This separates the psk-crack headers, defines, structures and
prototypes from ike-scan.
* ike-scan.h: Removed psk-crack specific stuff. Modified psk_crack
structure to improve storage efficiency.
2006-10-18 Roy Hills <Roy.Hills@nta-monitor.com>
* isakmp.c: Modified creation of proposal and SA payloads, so that
these payloads contain the transform and proposal payloads
respectively (previously, they only returned the header, and it
was down to the caller to add the rest). Also added add_prop()
function which allows for multiple proposals within an SA
payload (although ike-scan does not have any way to use this yet).
* ike-scan.c: Modified initialise_ike_packet() function to use
modified SA and proposal functions.
2006-10-10 Roy Hills <Roy.Hills@nta-monitor.com>
* check-psk-crack-3: New script to check Nortel Contivity PSK
cracking. Uses test data obtained from a Contivity 1600 running
software release 6.00.
* psk-crack.1: Added --username option description to psk-crack
manpage.
2006-10-01 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Show backoff patterns even if there was only a
single response. Some implementations, e.g. linksys, don't
retry at all, and this change allows these to be matched as
well. The lack of a pattern is sufficiently unusual to be a
pattern itself.
2006-09-23 Anonymous <l...e@gmail.com>
* psk-crack.c: Added code to allow cracking Nortel Contivity
pre-shared keys, which use a variation of Mamro's method. Thanks
to an anonymous benefactor.
2006-08-30 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-backoff-patterns: Added new PIX backoff pattern, with details
of the PIX versions for both patterns.
2006-08-22 Roy Hills <Roy.Hills@nta-monitor.com>
* udp.h: Removed unneeded BSD-flavour declarations and unneeded macros.
Changed types from u_int{8,16,32}_t to uint{8,16,32}_t. Added
definition of struct pseudo_hdr (moved from ike-scan.c).
Changed names of pseudo_hdr struct members to avoid problem due
to s_addr being defined as a macro on some systems (e.g. Solaris).
* ip.h: Changed types from u_int{8,16,32}_t to uint{8,16,32}_t.
Removed unneeded macros.
* utils.c: Change random_ip() so that it generates the same sequence
on both little-endian and big-endian systems.
* ike-scan.c: --randsrc option now works on Solaris 9 and FreeBSD 5.3
as well as Linux.
2006-08-14 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: Changed random number implementation to use
the mersenne twister functions from mt19937ar.c rather than the
standard rand() from the C library.
This improves the quality of the random numbers, as some C library
rand() functions are quite bad. More importantly, it makes the
random number generation process repeatable across different
platforms.
However, this change also means that packets created with the new
PRNG will not be the same as packets created with the old one, even
if the same random seed value is used.
* mt19937ar.c: New file - Mersenne Twister random number generator.
* utils.c: New functions random_byte() and random_ip(), which use
the mersenne twister random number functions.
* pkt-aggressive.dat: New file - sample aggressive mode packet.
* check-packet: Added aggressive mode packet check. This is possible
now that the random number generator is repeatable across platforms.
* configure.ac: Incremented version number to 1.8.4.
2006-08-04 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, ike-scan.h: Added new --randsrc option for source IP
spoofing.
* ike-scan.c, ike-scan.h: Added new --shownum option to display the
return packet number. This is useful when looking for DoS
conditions.
2006-08-02 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Added experimental support for source IP spoofing.
Currently, this only works on Linux.
* ip.h, udp.h: New header files to support IP spoofing. Copied
from the GNU C Library.
* configure.ac: incremented version number to 1.8.2
2006-07-01 Roy Hills <Roy.Hills@nta-monitor.com>
* configure.ac, ike-scan.c: Removed initial lookup and configure
option --enable-lookup to control it. This is legacy code
that has never been required.
* ike-scan.h, ike-scan.c: Removed low-pass filter in timing
error correction code, and associated ALPHA macro. This had
never been used, and tests indicate that it performed worse
than the standard timing error correction code.
* psk-crack.c: Free malloc'ed data when we are finished with
each PSK to prevent a memory leak when cracking many PSKs.
Thanks to Antoine Brodin for finding and reporting this bug.
2006-06-24 Roy Hills <Roy.Hills@nta-monitor.com>
* utils.c: Changed printable() and hexstring() to make the first
arg "const unsigned char *" instead of "unsigned char *". This
change was integrated from the arp-scan source.
2006-06-06 Roy Hills <Roy.Hills@nta-monitor.com>
* Changed web URLs to correspond with the new layout of the NTA
website.
2006-05-14 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Add --timestamp option.
* isakmp.c: Improve decoding of notification payload. Tony has found
an IKE implementation which returnes a notification payload after
the SA payload, and this uncovered shortcomings in the notification
processing code.
2006-05-12 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Allow --interval to be expressed in seconds by
appending "s" to the value. This is useful if you want to send
packets very slowly, as it avoids having to add lots of trailing
zeros.
* ike-scan.c: Add experimental option to display packet received
time in %H:%M:%S.%u format before the packet details.
* Moved ike-scan source code from CVS to SVN revision control.
This changes the revision numbers from 1.x, where x is a relatively
small number, to y, where y is a larger number (currently four
digits).
2006-05-05 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Delay opening the file specified by --writepkttofile
until after we've dropped SUID to avoid security issues.
2006-03-22 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Added --randomseed option, which allows the PRNG seed
to be specified. This enables packets with payloads containing
random data, such as Key Exchange and Nonce, to be compared with
known good examples for testing. It also allows the packet data to
be exactly repeatable, which can be useful in some situations.
2006-03-19 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Use unsigned 64-bit integer arithmetic for interval
calculation instead of double-precision floating point. This
avoids the small rounding errors that can occur with floating point.
2006-03-14 Roy Hills <Roy.Hills@nta-monitor.com>
* Moved ike-scan source code from RCS to CVS revision control.
2005-12-07 Roy Hills <Roy.Hills@nta-monitor.com>
* Released v1.8 Tarball size: 1376995, Zip size: 2090803.
tarball md5sum: 961310e6f3c07d26c90447e392dfb97e
Zip md5sum: 884e1c3eb03ea1519ab7537e095d2c0b
* configure.ac: Incremented version number to 1.8.1 in preparation
for post 1.8 changes.
2005-12-06 Roy Hills <Roy.Hills@nta-monitor.com>
* configure.ac: Incremented version number to 1.8 in preparation
for release.
2005-12-04 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-backoff-patterns: Added backoff patterns for Netgear ProSafe
and Netgear ADSL Firewall Router. Submitted by Paul Askew.
2005-11-30 Roy Hills <Roy.Hills@nta-monitor.com>
* Removed automake boilerplace files, and ran automake --add-missing
--copy to obtain the latest versions as of automake 1.9. The updated
files were: missing, install-sh, depcomp and INSTALL. mkinstalldirs
is no longer installed by automake and is probably no longer needed.
However, I have kept the old version just in case.
2005-11-29 Roy Hills <Roy.Hills@nta-monitor.com>
* isakmp.h: Changed u_int8_t, u_int16_t and u_int32_t to uint8_t,
uint16_t and uint32_t in definition of delete payload.
* configure.ac: Improved OpenSSL detection by adding support for
libcrypto.so and libcrypto.dylib as well as libcrypto.a.
2005-11-25 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, ike-scan.h, configure.ac: Added new --writepkttofile
option. This option writes the output packet to the specified file
rather than sending it to the remote host. It is intended for
debugging and testing purposes, to allow the IKE packet to be
easily checked. This option is not documented, because it is
designed purely for testing.
* check-packet: New test to check IKE scan packet data. Currently
tests two sample packets: one default proposal, and one custom
proposal.
* configure.ac: Added conditional #include <stdlib.h> to the
AC_LINK_IFELSE that checks if the OpenSSL headers and libraries
work. This is needed because the OpenSSL md5.h and sha1.h in
recent versions use size_t but don't include any header to
define it.
2005-11-24 Roy Hills <Roy.Hills@nta-monitor.com>
* configure.ac: Support the OpenSSL libcrypto.a library in either
$ssldir/lib or in $ssldir.
* configure.ac: Added --disable-lookup option which allows the
initial DNS lookup to be disabled. This is in response to
Debian bug ID 327220. Thanks to Florian Weimer for reporting this,
and to Benoit Mortier for forwarding the bug to me.
2005-10-22 Roy Hills <Roy.Hills@nta-monitor.com>
* wrappers.c: Added new wrapper function, Strtoul(), which
calls strtoul() and checks for errors.
* ike-scan.c: Change most calls to strtoul() to use the new
wrapper function Strtoul() instead, because this checks for
errors. Previously, a non-numeric value would be converted to
zero without any error, meaning something like "--sport=xxx"
would be silently accepted. Now, such invalid inputs result in
an error.
* ike-scan.c: Modify decode_trans_simple() to detect invalid values
which could previously result in an infinate loop. Now, invalid
values cause an error.
2005-09-08 Roy Hills <Roy.Hills@nta-monitor.com>
* Upgraded automake from 1.8 to 1.9. No code changes required.
2005-09-08 Roy Hills <Roy.Hills@nta-monitor.com>
* check-hash.c, check-sizes.c, error.c, ike-scan.c, isakmp.c,
psk-crack.c, utils.c, wrappers.c, ike-scan.h, isakmp.h: Added
OpenSSL exception to the copyright notice at the beginning of
these files. This allows linking of the program against OpenSSL
and distributing linked versions. This exception is intended to
allow the use of OpenSSL in this GPL v2 application. The added
text reads:
"In addition, as a special exception, the copyright holders give
permission to link the code of portions of this program with the
OpenSSL library, and distribute linked combinations including the two.
You must obey the GNU General Public License in all respects
for all of the code used other than OpenSSL. If you modify
file(s) with this exception, you may extend this exception to your
version of the file(s), but you are not obligated to do so. If you
do not wish to do so, delete this exception statement from your
version."
This text was taken from
http://www.gnome.org/~markmc/openssl-and-the-gpl.html
2005-08-02 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: Added support for advanced transform
creation using new functions add_transform() and make_transform().
These new functions take a pre-built attribute list, which has
previously been created with add_attr(), and can therefore create
transforms with arbitrary attributes.
The old add_trans() and make_trans() functions have been renamed
to add_trans_simple() and make_trans_simple() to reflect the fact
that they are simplified versions. These simple versions are now
wrappers that use the advanced functions.
Added support for advanced transform creation, which uses these new
functions. This involves an alternative syntax for the --trans
option: --trans=(attr=value, ...).
2005-08-01 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: Added Notification payload processing. We now
display details of an ISAKMP Notification payload if one is returned,
rather than just displaying generic payload information.
2005-07-21 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c, utils.c: Added support for variable length
lifetime and lifesize transform attributes. Now, the --lifetime
and --lifesize options can take three options:
a) "none" - Do not add any lifetime or lifesize attribute
b) decimal integer, e.g. 86400 - Add a 4-byte value
c) hex number, e.g. 0xff - Add a variable length value
This allows arbitrary length lifetime and lifesize attributes to
be added using the hex notation.
2005-07-06 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Added --exchange option to allow the exchange field
in the ISAKMP header to be set to arbitrary values.
* ike-scan.c: Changed default packet rate calculation from interval
to bandwidth. The default bandwidth is 56000 bits per second. It's
still possible to set the interval instead for backwards
compatibility, and for those applications where it's important to
be able to specify the exact packet rate.
2005-06-21 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: Added --hdrflags and --hdrmsgid options to
allow Flags and MsgID fields in the ISAKMP header to be specified.
* ike-scan.c: Added --cookie option to allow the initiator cookie in
the ISAKMP header to be set to a static value.
* isakmp.c: Added support for Checkpoint notify code 9110. This was
observed when sending a large volume of requests to a VPN-1 system,
and is believed to be related to the Client Puzzles VPN DoS avoidance
mechanism.
* isakmp.c: Display the Version, flags, or msgid from the ISAKMP
header if they don't contain the expected value.
2005-06-21 Roy Hills <Roy.Hills@nta-monitor.com>
* make-win32-zipfile.sh: New file to create the Windows binary
zipfile. Used under Cygwin. Previously, I had manually created
the zip files using "winzip", which was error-prone.
2005-06-20 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Add 64-bit cast to calculation of microsecond-resolution
time differences to ensure that the calculation is performed with
64-bit quantities. Previously, the calculation was performed
with 32-bit quantities before being assigned to a 64-bit value.
2005-06-18 Roy Hills <Roy.Hills@nta-monitor.com>
* utils.c: Modify timeval_diff() to prevent it changing its input
arguments. Previously, it was sometimes changing its second
argument, b, because of the carry calculation; now it uses a
temporary value to perform the carry on.
2005-06-17 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: Added Delete payload processing. We now
display details of an ISAKMP Delete payload if one is returned,
rather than just displaying generic payload information.
2005-06-16 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: Add --spisize option to allow a random SPI
of the specified size to be added to the proposal payload.
2005-06-15 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: Display responder cookie value as a hex string
when displaying SA and Notify payloads, unless quiet is in effect.
* ike-scan.c: Added support for SIGUSR1 handling. Not fully
implemented. NOTE: This was removed later in June 2005, because the
bug we were looking for was found and fixed.
* isakmp.c: Print the SA Proposal SPI as hex if the SPI size in the
proposal header is non-zero. During Phase-1, the SPI size is
normally zero. However it has been observed to be non-zero on rare
occasions, and RFC 2408 allows this: "[during phase-1, the SPI is]
redundant and MAY be set to 0 or it MAY contain the transmitting
entity's cookie".
2005-05-31 Roy Hills <Roy.Hills@nta-monitor.com>
* psk-crack.c: Fixed error which caused psk-crack to incorrectly report
PSKs after finding a valid one, when processing multiple PSK records.
Solution was to ensure that "found" is cleared on every loop
iteration. Thanks to Daniel Lucq for finding this bug and suggesting
the solution.
2005-05-20 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Check return value from sendto() against size of
packet, and warn if they are different (meaning that not all of
the packet was sent). I've seen this occur when using TCP
encapsulation to send huge packets (which fragment into many TCP
segments), and the VPN server sends a RST back.
2005-05-12 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Use POSIX regex to split both the backoff pattern and
vendor id pattern entries into name and pattern in functions
add_pattern() and add_vid_pattern(). Previously, we manually
stepped through the strings using pointers. POSIX regex is more
complex, but it allows for more flexible and precise matching.
* ike-scan.c: Add SO_REUSEADDR option to TCP socket when performing
TCP scanning (--tcp option).
* ike-vendor-ids: Added 16 new Vendor IDs, and revised some comments
on existing entries.
2005-04-20 Roy Hills <Roy.Hills@nta-monitor.com>
* isakmp.c: Don't try to decode the SA in the returned packet if
it contains more than one transform. This cannot happen during
normal scanning, because the VPN server will only return one
transform, but can occur if you scan your own host, and ike-scan
sees its own packets which contain multiple transforms.
2005-04-09 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Modified usage() so that it can output either brief or
detailed help output depending on a new "detailed" argument. Now,
detailed output, including information on the available options, is
only displayed when ike-scan is run with the --help option. For
error conditions such as incorrect options, it only produces brief
output.
2005-03-19 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Changed initialise_ike_packet() function to use the
struct ike_packet_params rather than taking the various parameters
as separate arguments, as the argument count for this function was
up to 15 and growing (c89 std only guarantees up to 31 I believe).
Also removed some unnecessary global variables and placed these in
the new struct, which currently contains 18 members.
* ike-scan.c: Added --doi (-D) and --situation (-S) options to allow
the DOI and Situation in the SA of the outbound packets to be changed
from the default of DOI_IPSEC and SIT_IDENTITY_ONLY.
* ike-scan.c: Added --protocol (-j) and --transid (-k) options to
allow the proposal protocol and transform id of the outbound packets
to be changed from the defaults.
2005-03-10 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c, isakmp.c: Improved decoding of Certificate and
CertificateRequest payloads. These used to be decoded as
generic payloads, but now include the certificate type in the
decode output.
* ike-scan.c: Added --certreq (-C) option to add a
CertificateRequest payload to the outgoing packet.
2005-03-09 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Added --headerlen (-L) option to allow the ISAKMP header
length to be manually specified. Normally, ike-scan will
automatically calculate the correct length; however, you can use this
option if you want to use an incorrect length value instead.
* ike-scan.c, isakmp.c: Added --mbz (-Z) option to allow the value for
the reserved (MBZ) fields to be set to non-zero values. Doing so
will make the outgoing packet non-RFC compliant.
* ike-scan.c, isakmp.c: Added --headerver (-E) option to allow the
version field in the ISAKMP header to be altered from the default of
0x10 (v1.0).
2005-02-21 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Drop root privileges after binding the local port if we
are running SUID. We don't need enhanced privileges after this
point, and having effective UID root can cause problems on NFS
filesystems where the root user is squashed to nobody and we need
to write a PSK parameters file.
2005-02-18 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Make errors from gethostbyname or inet_aton when adding
hosts non-fatal. Now these errors elicit a warning and cause the
offending target to be ignored, but processing continues.
Thanks to Tony Lloyd for finding this bug.
* ike-scan.h, ike-scan.c, isakmp.c: Change structure definitions to
typedefs. i.e. change "struct foo {defs};" to
typedef struct {defs} foo;".
* ike-scan.h: Added extra data structure to the host entry structure.
This is designed to allow arbitrary extra data, such as an id string
or a transform specification, to be attached to a host entry.
2005-02-15 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Added --bandwidth (-B) option to allow the outgoing
bandwidth to be specified directly instead of using --interval.
The --bandwidth option calculates the appropriate interval setting,
taking into account the size of the packet.
* ike-scan.c: Added --noncelen (-c) option to allow the length of the
nonce data to be changed. This is only applicable to aggressive
mode.
2005-02-14 Roy Hills <Roy.Hills@nta-monitor.com>
* psk-crack.1: Updated psk-crack manpage to reflect current usage. The
manpage had fallen behind, and had become inaccurate.
2005-02-09 Roy Hills <Roy.Hills@nta-monitor.com>
* ike-scan.c: Match ip range and slash notation using regular
expressions rather than single character matches in
add_host_pattern(). This fixes the bug which caused hostnames with
hyphens to fail because they were wrongly interpreted as IP ranges.
Thanks to Volker Stolz for reporting this bug.
2005-01-27 Roy Hills <Roy.Hills@nta-monitor.com>
* configure.ac: Make lack of Posix regular expression support a fatal
error. Previously, it was optional, and we used conditional
compilation based on HAVE_REGEX_H. However, this never worked, and
I've not found a system which lacks Posix regex support.
* ike-scan.h, ike-scan.c, isakmp.c: Remove HAVE_REGEX_H conditional
compilation. Note that we still use it to conditionally include