From 13173343ee0a4797abfba868117fe08fe3a10b92 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Tue, 18 Jun 2013 22:51:22 -0400 Subject: [PATCH] [client] add GPG_ALLOW_NO_SIGNING_PW and --gpg-no-signing-pw This change brings similar functionality to the client as the GPG_ALLOW_NO_PW keyword in the server access.conf file. Although this option is less likely to be used than the analogous server functionality, it stands to reason that the client should offer this feature. The test suite has also been updated to not use the --get-key option for the 'no password' GPG tests. --- client/cmd_opts.h | 2 + client/config_init.c | 110 +++++++++++++++++++++++++++------------- client/fwknop.8.in | 13 ++++- client/fwknop.c | 23 +++++---- client/fwknop_common.h | 1 + doc/fwknop.man.asciidoc | 6 +++ test/test-fwknop.pl | 6 +++ test/tests/gpg_no_pw.pl | 61 ++++++++-------------- 8 files changed, 135 insertions(+), 87 deletions(-) diff --git a/client/cmd_opts.h b/client/cmd_opts.h index 0c0a1115..154f602e 100644 --- a/client/cmd_opts.h +++ b/client/cmd_opts.h @@ -66,6 +66,7 @@ enum { GPG_SIGNER_KEY, GPG_HOME_DIR, GPG_AGENT, + GPG_ALLOW_NO_SIGNING_PW, NOOP /* Just to be a marker for the end */ }; @@ -97,6 +98,7 @@ static struct option cmd_opts[] = {"gpg-signer-key", 1, NULL, GPG_SIGNER_KEY }, {"gpg-home-dir", 1, NULL, GPG_HOME_DIR }, {"gpg-agent", 0, NULL, GPG_AGENT }, + {"gpg-no-signing-pw", 0, NULL, GPG_ALLOW_NO_SIGNING_PW }, {"get-key", 1, NULL, 'G'}, {"get-hmac-key", 1, NULL, GET_HMAC_KEY }, {"help", 0, NULL, 'h'}, diff --git a/client/config_init.c b/client/config_init.c index 2a347c64..9e06faac 100644 --- a/client/config_init.c +++ b/client/config_init.c @@ -91,6 +91,7 @@ enum FWKNOP_CLI_ARG_ENCRYPTION_MODE, FWKNOP_CLI_ARG_USE_GPG, FWKNOP_CLI_ARG_USE_GPG_AGENT, + FWKNOP_CLI_ARG_GPG_NO_SIGNING_PW, FWKNOP_CLI_ARG_GPG_RECIPIENT, FWKNOP_CLI_ARG_GPG_SIGNER, FWKNOP_CLI_ARG_GPG_HOMEDIR, @@ -101,6 +102,8 @@ enum FWKNOP_CLI_ARG_RAND_PORT, FWKNOP_CLI_ARG_KEY_RIJNDAEL, FWKNOP_CLI_ARG_KEY_RIJNDAEL_BASE64, + FWKNOP_CLI_ARG_GPG_SIGNING_PW, + FWKNOP_CLI_ARG_GPG_SIGNING_PW_BASE64, FWKNOP_CLI_ARG_HMAC_DIGEST_TYPE, FWKNOP_CLI_ARG_KEY_HMAC_BASE64, FWKNOP_CLI_ARG_KEY_HMAC, @@ -120,40 +123,43 @@ enum static fko_var_t fko_var_array[FWKNOP_CLI_LAST_ARG] = { - { "DIGEST_TYPE", FWKNOP_CLI_ARG_DIGEST_TYPE }, - { "SPA_SERVER_PROTO", FWKNOP_CLI_ARG_SPA_SERVER_PROTO }, - { "SPA_SERVER_PORT", FWKNOP_CLI_ARG_SPA_SERVER_PORT }, - { "SPA_SOURCE_PORT", FWKNOP_CLI_ARG_SPA_SOURCE_PORT }, - { "FW_TIMEOUT", FWKNOP_CLI_ARG_FW_TIMEOUT }, - { "ALLOW_IP", FWKNOP_CLI_ARG_ALLOW_IP }, - { "TIME_OFFSET", FWKNOP_CLI_ARG_TIME_OFFSET }, - { "ENCRYPTION_MODE", FWKNOP_CLI_ARG_ENCRYPTION_MODE }, - { "USE_GPG", FWKNOP_CLI_ARG_USE_GPG }, - { "USE_GPG_AGENT", FWKNOP_CLI_ARG_USE_GPG_AGENT }, - { "GPG_RECIPIENT", FWKNOP_CLI_ARG_GPG_RECIPIENT }, - { "GPG_SIGNER", FWKNOP_CLI_ARG_GPG_SIGNER }, - { "GPG_HOMEDIR", FWKNOP_CLI_ARG_GPG_HOMEDIR }, - { "SPOOF_USER", FWKNOP_CLI_ARG_SPOOF_USER }, - { "SPOOF_SOURCE_IP", FWKNOP_CLI_ARG_SPOOF_SOURCE_IP }, - { "ACCESS", FWKNOP_CLI_ARG_ACCESS }, - { "SPA_SERVER", FWKNOP_CLI_ARG_SPA_SERVER }, - { "RAND_PORT", FWKNOP_CLI_ARG_RAND_PORT }, - { "KEY", FWKNOP_CLI_ARG_KEY_RIJNDAEL }, - { "KEY_BASE64", FWKNOP_CLI_ARG_KEY_RIJNDAEL_BASE64 }, - { "HMAC_DIGEST_TYPE", FWKNOP_CLI_ARG_HMAC_DIGEST_TYPE }, - { "HMAC_KEY_BASE64", FWKNOP_CLI_ARG_KEY_HMAC_BASE64 }, - { "HMAC_KEY", FWKNOP_CLI_ARG_KEY_HMAC }, - { "USE_HMAC", FWKNOP_CLI_ARG_USE_HMAC }, - { "KEY_FILE", FWKNOP_CLI_ARG_KEY_FILE }, - { "HMAC_KEY_FILE", FWKNOP_CLI_ARG_HMAC_KEY_FILE }, - { "NAT_ACCESS", FWKNOP_CLI_ARG_NAT_ACCESS }, - { "HTTP_USER_AGENT", FWKNOP_CLI_ARG_HTTP_USER_AGENT }, - { "RESOLVE_URL", FWKNOP_CLI_ARG_RESOLVE_URL }, - { "NAT_LOCAL", FWKNOP_CLI_ARG_NAT_LOCAL }, - { "NAT_RAND_PORT", FWKNOP_CLI_ARG_NAT_RAND_PORT }, - { "NAT_PORT", FWKNOP_CLI_ARG_NAT_PORT }, - { "VERBOSE", FWKNOP_CLI_ARG_VERBOSE }, - { "RESOLVE_IP_HTTP", FWKNOP_CLI_ARG_RESOLVE_IP_HTTP } + { "DIGEST_TYPE", FWKNOP_CLI_ARG_DIGEST_TYPE }, + { "SPA_SERVER_PROTO", FWKNOP_CLI_ARG_SPA_SERVER_PROTO }, + { "SPA_SERVER_PORT", FWKNOP_CLI_ARG_SPA_SERVER_PORT }, + { "SPA_SOURCE_PORT", FWKNOP_CLI_ARG_SPA_SOURCE_PORT }, + { "FW_TIMEOUT", FWKNOP_CLI_ARG_FW_TIMEOUT }, + { "ALLOW_IP", FWKNOP_CLI_ARG_ALLOW_IP }, + { "TIME_OFFSET", FWKNOP_CLI_ARG_TIME_OFFSET }, + { "ENCRYPTION_MODE", FWKNOP_CLI_ARG_ENCRYPTION_MODE }, + { "USE_GPG", FWKNOP_CLI_ARG_USE_GPG }, + { "USE_GPG_AGENT", FWKNOP_CLI_ARG_USE_GPG_AGENT }, + { "GPG_RECIPIENT", FWKNOP_CLI_ARG_GPG_RECIPIENT }, + { "GPG_SIGNER", FWKNOP_CLI_ARG_GPG_SIGNER }, + { "GPG_HOMEDIR", FWKNOP_CLI_ARG_GPG_HOMEDIR }, + { "GPG_SIGNING_PW", FWKNOP_CLI_ARG_GPG_SIGNING_PW }, + { "GPG_SIGNING_PW_BASE64", FWKNOP_CLI_ARG_GPG_SIGNING_PW_BASE64 }, + { "GPG_NO_SIGNING_PW", FWKNOP_CLI_ARG_GPG_NO_SIGNING_PW }, + { "SPOOF_USER", FWKNOP_CLI_ARG_SPOOF_USER }, + { "SPOOF_SOURCE_IP", FWKNOP_CLI_ARG_SPOOF_SOURCE_IP }, + { "ACCESS", FWKNOP_CLI_ARG_ACCESS }, + { "SPA_SERVER", FWKNOP_CLI_ARG_SPA_SERVER }, + { "RAND_PORT", FWKNOP_CLI_ARG_RAND_PORT }, + { "KEY", FWKNOP_CLI_ARG_KEY_RIJNDAEL }, + { "KEY_BASE64", FWKNOP_CLI_ARG_KEY_RIJNDAEL_BASE64 }, + { "HMAC_DIGEST_TYPE", FWKNOP_CLI_ARG_HMAC_DIGEST_TYPE }, + { "HMAC_KEY_BASE64", FWKNOP_CLI_ARG_KEY_HMAC_BASE64 }, + { "HMAC_KEY", FWKNOP_CLI_ARG_KEY_HMAC }, + { "USE_HMAC", FWKNOP_CLI_ARG_USE_HMAC }, + { "KEY_FILE", FWKNOP_CLI_ARG_KEY_FILE }, + { "HMAC_KEY_FILE", FWKNOP_CLI_ARG_HMAC_KEY_FILE }, + { "NAT_ACCESS", FWKNOP_CLI_ARG_NAT_ACCESS }, + { "HTTP_USER_AGENT", FWKNOP_CLI_ARG_HTTP_USER_AGENT }, + { "RESOLVE_URL", FWKNOP_CLI_ARG_RESOLVE_URL }, + { "NAT_LOCAL", FWKNOP_CLI_ARG_NAT_LOCAL }, + { "NAT_RAND_PORT", FWKNOP_CLI_ARG_NAT_RAND_PORT }, + { "NAT_PORT", FWKNOP_CLI_ARG_NAT_PORT }, + { "VERBOSE", FWKNOP_CLI_ARG_VERBOSE }, + { "RESOLVE_IP_HTTP", FWKNOP_CLI_ARG_RESOLVE_IP_HTTP } }; /* Array to define which conf. variables are critical and should not be @@ -166,7 +172,9 @@ static int critical_var_array[] = FWKNOP_CLI_ARG_KEY_HMAC, FWKNOP_CLI_ARG_KEY_HMAC_BASE64, FWKNOP_CLI_ARG_GPG_RECIPIENT, - FWKNOP_CLI_ARG_GPG_SIGNER + FWKNOP_CLI_ARG_GPG_SIGNER, + FWKNOP_CLI_ARG_GPG_SIGNING_PW, + FWKNOP_CLI_ARG_GPG_SIGNING_PW_BASE64 }; /** @@ -925,6 +933,13 @@ parse_rc_param(fko_cli_options_t *options, const char *var_name, char * val) options->use_gpg_agent = 1; else; } + /* No GPG signing passphrase ? */ + else if (var->pos == FWKNOP_CLI_ARG_GPG_NO_SIGNING_PW) + { + if (is_yes_str(val)) + options->gpg_no_signing_pw = 1; + else; + } /* GPG Recipient */ else if (var->pos == FWKNOP_CLI_ARG_GPG_RECIPIENT) { @@ -986,6 +1001,25 @@ parse_rc_param(fko_cli_options_t *options, const char *var_name, char * val) strlcpy(options->key_base64, val, sizeof(options->key_base64)); options->have_base64_key = 1; } + /* GnuPG signing passphrase */ + else if (var->pos == FWKNOP_CLI_ARG_GPG_SIGNING_PW) + { + strlcpy(options->key, val, sizeof(options->key)); + options->have_key = 1; + } + /* GnuPG signing passphrase (base-64 encoded) */ + else if (var->pos == FWKNOP_CLI_ARG_GPG_SIGNING_PW_BASE64) + { + if (! is_base64((unsigned char *) val, strlen(val))) + { + log_msg(LOG_VERBOSITY_WARNING, + "GPG_SIGNING_KEY_BASE64 argument '%s' doesn't look like base64-encoded data.", + val); + parse_error = -1; + } + strlcpy(options->key_base64, val, sizeof(options->key_base64)); + options->have_base64_key = 1; + } /* HMAC digest type */ else if (var->pos == FWKNOP_CLI_ARG_HMAC_DIGEST_TYPE) { @@ -2044,6 +2078,12 @@ config_init(fko_cli_options_t *options, int argc, char **argv) add_var_to_bitmask(FWKNOP_CLI_ARG_USE_GPG, &var_bitmask); add_var_to_bitmask(FWKNOP_CLI_ARG_USE_GPG_AGENT, &var_bitmask); break; + case GPG_ALLOW_NO_SIGNING_PW: + options->use_gpg = 1; + options->gpg_no_signing_pw = 1; + add_var_to_bitmask(FWKNOP_CLI_ARG_USE_GPG, &var_bitmask); + add_var_to_bitmask(FWKNOP_CLI_ARG_GPG_NO_SIGNING_PW, &var_bitmask); + break; case NAT_LOCAL: options->nat_local = 1; add_var_to_bitmask(FWKNOP_CLI_ARG_NAT_LOCAL, &var_bitmask); diff --git a/client/fwknop.8.in b/client/fwknop.8.in index 07a503d4..716b572f 100644 --- a/client/fwknop.8.in +++ b/client/fwknop.8.in @@ -2,12 +2,12 @@ .\" Title: fwknop .\" Author: [see the "AUTHORS" section] .\" Generator: DocBook XSL Stylesheets v1.76.1 -.\" Date: 06/16/2013 +.\" Date: 06/18/2013 .\" Manual: Fwknop Client .\" Source: Fwknop Client .\" Language: English .\" -.TH "FWKNOP" "8" "06/16/2013" "Fwknop Client" "Fwknop Client" +.TH "FWKNOP" "8" "06/18/2013" "Fwknop Client" "Fwknop Client" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -658,6 +658,15 @@ Specify the GnuPG key ID, e\&.g\&. \(lq+ABCD1234+\(rq (see the output of "gpg \- \fBfwknopd\fR daemon on the remote server to authenticate who created the SPA message\&. .RE +.PP +\fB\-\-gpg\-no\-signing\-pw\fR +.RS 4 +Instruct +\fBfwknop\fR +to not acquire a passphrase for usage of GnuPG signing key\&. This option is provided to make SPA packet construction easier for client\-side operations in automated environments where the passphrase for the signing key has been removed from the GnuPG key ring\&. However, it is usually better to leverage +\fIgpg\-agent\fR +instead of using this option\&. +.RE .SH "FWKNOPRC FILE" .sp The \fI\&.fwknoprc\fR file is used to set various parameters to override default program parameters at runtime\&. It also allows for additional named configuration \fIstanzas\fR for setting program parameters for a particular invocation\&. diff --git a/client/fwknop.c b/client/fwknop.c index 6585e426..8c21a149 100644 --- a/client/fwknop.c +++ b/client/fwknop.c @@ -1085,14 +1085,6 @@ get_keys(fko_ctx_t ctx, fko_cli_options_t *options, memset(key, 0x0, MAX_KEY_LEN+1); memset(hmac_key, 0x0, MAX_KEY_LEN+1); - /* First of all if we are using GPG and GPG_AGENT - * then there is no password to return. - */ - if(options->use_gpg - && (options->use_gpg_agent - || (crypt_op == CRYPT_OP_ENCRYPT && options->gpg_signer_key[0] == '\0'))) - return; - if (options->have_key) { strlcpy(key, options->key, MAX_KEY_LEN+1); @@ -1123,7 +1115,16 @@ get_keys(fko_ctx_t ctx, fko_cli_options_t *options, } else if (options->use_gpg) { - if(crypt_op == CRYPT_OP_DECRYPT) + if(options->use_gpg_agent) + log_msg(LOG_VERBOSITY_NORMAL, + "[+] GPG mode set, signing passphrase acquired via gpg-agent"); + else if(options->gpg_no_signing_pw) + log_msg(LOG_VERBOSITY_NORMAL, + "[+] GPG mode set, signing passphrase not required"); + else if(crypt_op == CRYPT_OP_ENCRYPT) + log_msg(LOG_VERBOSITY_NORMAL, + "[+] GPG mode set, encrypt instead of decrypt operation"); + else if(crypt_op == CRYPT_OP_DECRYPT) { key_tmp = getpasswd("Enter passphrase for secret key: ", options->input_fd); if(key_tmp == NULL) @@ -1149,11 +1150,11 @@ get_keys(fko_ctx_t ctx, fko_cli_options_t *options, else { if(crypt_op == CRYPT_OP_ENCRYPT) - key_tmp = getpasswd("Enter encryption key: ", options->input_fd); + key_tmp = getpasswd("Enter encryption key: ", options->input_fd); else if(crypt_op == CRYPT_OP_DECRYPT) key_tmp = getpasswd("Enter decryption key: ", options->input_fd); else - key_tmp = getpasswd("Enter key: ", options->input_fd); + key_tmp = getpasswd("Enter key: ", options->input_fd); if(key_tmp == NULL) { diff --git a/client/fwknop_common.h b/client/fwknop_common.h index 779acb4d..266243ca 100644 --- a/client/fwknop_common.h +++ b/client/fwknop_common.h @@ -151,6 +151,7 @@ typedef struct fko_cli_options unsigned char test; unsigned char use_gpg; unsigned char use_gpg_agent; + unsigned char gpg_no_signing_pw; int time_offset_plus; int time_offset_minus; int fw_timeout; diff --git a/doc/fwknop.man.asciidoc b/doc/fwknop.man.asciidoc index c28c2fbd..2a0c040a 100644 --- a/doc/fwknop.man.asciidoc +++ b/doc/fwknop.man.asciidoc @@ -543,6 +543,12 @@ More comprehensive information on this can be found here: the *fwknopd* daemon on the remote server to authenticate who created the SPA message. +*--gpg-no-signing-pw*:: + Instruct *fwknop* to not acquire a passphrase for usage of GnuPG signing + key. This option is provided to make SPA packet construction easier for + client-side operations in automated environments where the passphrase for + the signing key has been removed from the GnuPG key ring. However, it is + usually better to leverage 'gpg-agent' instead of using this option. FWKNOPRC FILE ------------- diff --git a/test/test-fwknop.pl b/test/test-fwknop.pl index 5df129e9..e763e839 100755 --- a/test/test-fwknop.pl +++ b/test/test-fwknop.pl @@ -445,6 +445,12 @@ our $default_client_gpg_args_no_get_key = "$default_client_args_no_get_key " . "--gpg-signer-key $gpg_client_key " . "--gpg-home-dir $gpg_client_home_dir"; +our $default_client_gpg_args_no_pw = "$default_client_args_no_get_key " . + "--gpg-no-signing-pw " . + "--gpg-recipient-key $gpg_server_key " . + "--gpg-signer-key $gpg_client_key " . + "--gpg-home-dir $gpg_client_home_dir_no_pw"; + our $default_server_conf_args = "-c $cf{'def'} -a $cf{'def_access'} " . "-d $default_digest_file -p $default_pid_file"; diff --git a/test/tests/gpg_no_pw.pl b/test/tests/gpg_no_pw.pl index 282467e8..3b30f666 100644 --- a/test/tests/gpg_no_pw.pl +++ b/test/tests/gpg_no_pw.pl @@ -5,9 +5,8 @@ 'subcategory' => 'client+server', 'detail' => 'complete cycle (tcp/22 ssh)', 'function' => \&spa_cycle, - 'cmdline' => "$default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", - 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'cmdline' => $default_client_gpg_args_no_pw, + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, 'fw_rule_created' => $NEW_RULE_REQUIRED, 'fw_rule_removed' => $NEW_RULE_REMOVED, 'fatal' => $NO @@ -17,8 +16,7 @@ 'subcategory' => 'client+server', 'detail' => 'multi gpg-IDs (tcp/22 ssh)', 'function' => \&spa_cycle, - 'cmdline' => "$default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'cmdline' => $default_client_gpg_args_no_pw, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir " . "$valgrind_str $fwknopdCmd -c $cf{'def'} " . "-a $cf{'multi_gpg_no_pw_access'} $intf_str " . @@ -33,12 +31,7 @@ 'subcategory' => 'client+server', 'detail' => 'iptables - no flush at init', 'function' => \&iptables_no_flush_init_exit, - 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . - "$fwknopCmd -A tcp/22 -a $fake_ip -D $loopback_ip --get-key " . - "$local_key_file --verbose --verbose " . - "--gpg-recipient-key $gpg_server_key " . - "--gpg-signer-key $gpg_client_key " . - "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'cmdline' => $default_client_gpg_args_no_pw, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir " . "$valgrind_str $fwknopdCmd -c $cf{'no_flush_init'} " . "-a $cf{'multi_gpg_no_pw_access'} $intf_str " . @@ -52,12 +45,7 @@ 'subcategory' => 'client+server', 'detail' => 'iptables - no flush at exit', 'function' => \&iptables_no_flush_init_exit, - 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . - "$fwknopCmd -A tcp/22 -a $fake_ip -D $loopback_ip --get-key " . - "$local_key_file --verbose --verbose " . - "--gpg-recipient-key $gpg_server_key " . - "--gpg-signer-key $gpg_client_key " . - "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'cmdline' => $default_client_gpg_args_no_pw, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir " . "$valgrind_str $fwknopdCmd -c $cf{'no_flush_exit'} " . "-a $cf{'multi_gpg_no_pw_access'} $intf_str " . @@ -71,12 +59,7 @@ 'subcategory' => 'client+server', 'detail' => 'iptables - no flush at init or exit', 'function' => \&iptables_no_flush_init_exit, - 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . - "$fwknopCmd -A tcp/22 -a $fake_ip -D $loopback_ip --get-key " . - "$local_key_file --verbose --verbose " . - "--gpg-recipient-key $gpg_server_key " . - "--gpg-signer-key $gpg_client_key " . - "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'cmdline' => $default_client_gpg_args_no_pw, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir " . "$valgrind_str $fwknopdCmd -c $cf{'no_flush_init_or_exit'} " . "-a $cf{'multi_gpg_no_pw_access'} $intf_str " . @@ -92,8 +75,8 @@ 'detail' => 'complete cycle (tcp/23 telnet)', 'function' => \&spa_cycle, 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . - "$fwknopCmd -A tcp/23 -a $fake_ip -D $loopback_ip --get-key " . - "$local_key_file --verbose --verbose " . + "$fwknopCmd -A tcp/23 -a $fake_ip -D $loopback_ip " . + "--gpg-no-signing-pw --verbose --verbose " . "--gpg-recipient-key $gpg_server_key " . "--gpg-signer-key $gpg_client_key " . "--gpg-home-dir $gpg_client_home_dir_no_pw", @@ -108,8 +91,8 @@ 'detail' => 'complete cycle (tcp/9418 git)', 'function' => \&spa_cycle, 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . - "$fwknopCmd -A tcp/9418 -a $fake_ip -D $loopback_ip --get-key " . - "$local_key_file --verbose --verbose " . + "$fwknopCmd -A tcp/9418 -a $fake_ip -D $loopback_ip " . + "--gpg-no-signing-pw --verbose --verbose " . "--gpg-recipient-key $gpg_server_key " . "--gpg-signer-key $gpg_client_key " . "--gpg-home-dir $gpg_client_home_dir_no_pw", @@ -124,8 +107,8 @@ 'detail' => 'complete cycle (tcp/60001)', 'function' => \&spa_cycle, 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . - "$fwknopCmd -A tcp/60001 -a $fake_ip -D $loopback_ip --get-key " . - "$local_key_file --verbose --verbose " . + "$fwknopCmd -A tcp/60001 -a $fake_ip -D $loopback_ip " . + "--gpg-no-singing-pw --verbose --verbose " . "--gpg-recipient-key $gpg_server_key " . "--gpg-signer-key $gpg_client_key " . "--gpg-home-dir $gpg_client_home_dir_no_pw", @@ -141,8 +124,8 @@ 'detail' => 'complete cycle (udp/53 dns)', 'function' => \&spa_cycle, 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . - "$fwknopCmd -A udp/53 -a $fake_ip -D $loopback_ip --get-key " . - "$local_key_file --verbose --verbose " . + "$fwknopCmd -A udp/53 -a $fake_ip -D $loopback_ip " . + "--gpg-no-signing-pw --verbose --verbose " . "--gpg-recipient-key $gpg_server_key " . "--gpg-signer-key $gpg_client_key " . "--gpg-home-dir $gpg_client_home_dir_no_pw", @@ -158,7 +141,7 @@ 'detail' => 'replay attack detection', 'function' => \&replay_detection, 'cmdline' => "$default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw", 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, 'server_positive_output_matches' => [qr/Replay\sdetected\sfrom\ssource\sIP/], 'fatal' => $NO @@ -170,7 +153,7 @@ 'function' => \&replay_detection, 'pkt_prefix' => 'U2FsdGVkX1', 'cmdline' => "$default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw", 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . "$fwknopdCmd $default_server_conf_args $intf_str", 'server_positive_output_matches' => [qr/Data\sis\snot\sa\svalid\sSPA\smessage\sformat/], @@ -183,7 +166,7 @@ 'function' => \&replay_detection, 'pkt_prefix' => 'hQ', 'cmdline' => "$default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw", 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . "$fwknopdCmd $default_server_conf_args $intf_str", 'server_positive_output_matches' => [qr/Data\sis\snot\sa\svalid\sSPA\smessage\sformat/], @@ -196,7 +179,7 @@ 'detail' => 'non-base64 altered SPA data', 'function' => \&altered_non_base64_spa_data, 'cmdline' => "$default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw", 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, 'fatal' => $NO }, @@ -206,7 +189,7 @@ 'detail' => 'base64 altered SPA data', 'function' => \&altered_base64_spa_data, 'cmdline' => "$default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw", 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, 'fatal' => $NO }, @@ -216,7 +199,7 @@ 'detail' => 'appended data to SPA pkt', 'function' => \&appended_spa_data, 'cmdline' => "$default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw", 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, 'fatal' => $NO }, @@ -226,7 +209,7 @@ 'detail' => 'prepended data to SPA pkt', 'function' => \&prepended_spa_data, 'cmdline' => "$default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw", 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, 'fatal' => $NO }, @@ -236,7 +219,7 @@ 'detail' => 'spoof username (tcp/22 ssh)', 'function' => \&spa_cycle, 'cmdline' => "SPOOF_USER=$spoof_user $default_client_gpg_args_no_homedir " - . "--gpg-home-dir $gpg_client_home_dir_no_pw", + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw", 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, 'positive_output_matches' => [qr/Username:\s*$spoof_user/], 'server_positive_output_matches' => [qr/Username:\s*$spoof_user/],