From 27ccfe35d36c7ba1d94734fb21a46c77aaf30719 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Fri, 10 Aug 2012 21:52:09 -0400 Subject: [PATCH] [server] Added GPG_ALLOW_NO_PW variable and associated test suite support For GPG mode, added a new access.conf variable "GPG_ALLOW_NO_PW" to make it possible to leverage a server-side GPG key pair that has no associated password. This comes in handy when a system requires the user to leverage gpg-agent / pinentry which can present a problem in automated environments as required by the fwknopd server. Now, it might seem like a problem to remove the passphrase from a GPG key pair, but it's important to note that simply doing this is little worse than storing the passphrase in the clear on disk anyway in the access.conf file. Further, this link help provides additional detail: http://www.gnupg.org/faq/GnuPG-FAQ.html#how-can-i-use-gnupg-in-an-automated-environment --- ChangeLog | 23 ++++ Makefile.am | 12 +- server/access.c | 13 ++ server/incoming_spa.c | 2 +- test/conf/client-gpg-no-pw/pubring.gpg | Bin 0 -> 2480 bytes test/conf/client-gpg-no-pw/secring.gpg | Bin 0 -> 1274 bytes test/conf/client-gpg-no-pw/trustdb.gpg | Bin 0 -> 1360 bytes test/conf/gpg_no_pw_access.conf | 7 + test/conf/server-gpg-no-pw/pubring.gpg | Bin 0 -> 2480 bytes test/conf/server-gpg-no-pw/secring.gpg | Bin 0 -> 1276 bytes test/conf/server-gpg-no-pw/trustdb.gpg | Bin 0 -> 1360 bytes test/test-fwknop.pl | 176 +++++++++++++++++++++++++ 12 files changed, 229 insertions(+), 4 deletions(-) create mode 100644 test/conf/client-gpg-no-pw/pubring.gpg create mode 100644 test/conf/client-gpg-no-pw/secring.gpg create mode 100644 test/conf/client-gpg-no-pw/trustdb.gpg create mode 100644 test/conf/gpg_no_pw_access.conf create mode 100644 test/conf/server-gpg-no-pw/pubring.gpg create mode 100644 test/conf/server-gpg-no-pw/secring.gpg create mode 100644 test/conf/server-gpg-no-pw/trustdb.gpg diff --git a/ChangeLog b/ChangeLog index 17c531c5..dc0027ea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,4 +1,16 @@ fwknop-2.0.2 (08//2012): + - [server] For GPG mode, added a new access.conf variable + "GPG_ALLOW_NO_PW" to make it possible to leverage a server-side GPG key + pair that has no associated password. This comes in handy when a system + requires the user to leverage gpg-agent / pinentry which can present a + problem in automated environments as required by the fwknopd server. + Now, it might seem like a problem to remove the passphrase from a GPG + key pair, but it's important to note that simply doing this is little + worse than storing the passphrase in the clear on disk anyway in the + access.conf file. Further, this link helps provide additional detail: + + http://www.gnupg.org/faq/GnuPG-FAQ.html#how-can-i-use-gnupg-in-an-automated-environment + - [client] In IP resolution mode (-R) changed HTTP connection type to 'close' since there is no need for connection persistence, and indeed the client expects to just get the IP and the connection to be closed. @@ -7,6 +19,14 @@ fwknop-2.0.2 (08//2012): remote webserver IP resolution mode (-R). Previously IP resolution could fail if HTTP headers were transferred separately from the data (for whatever reason). Jonathan Schulz submitted a patch for this. + - [server] Bug fix to implement FLUSH_IPT_AT_INIT and FLUSH_IPT_AT_EXIT + functionality. These are enabled by default, and now iptables rules + added by fwknopd can be made persistant by setting these variables to + "N" in the fwknopd.conf file (this is not a recommended setting + however). + [server] Added FLUSH_IPFW_AT_INIT and FLUSH_IPFW_AT_EXIT for ipfw + firewalls to emulate the corresponding functionality that is implemented + for iptables firewalls. This was suggested by Jonathan Schulz. - [server] Replay attack bug fix to ensure that an attacker cannot force a replay attack by intercepting an SPA packet and the replaying it with the base64 version of "Salted__" (for Rindael) or the "hQ" prefix (for @@ -36,6 +56,9 @@ fwknop-2.0.2 (08//2012): by 0x10DABF: pcap_capture (pcap_capture.c:226) by 0x10A798: main (fwknopd.c:299) + - [test suite] Added GPG tests for keyrings that have no associated + passphrases. + fwknop-2.0.1 (07/23/2012): - [server] Bug fix where the same encryption key used for two stanzas in the access.conf file would result in access requests that matched the diff --git a/Makefile.am b/Makefile.am index b682fa3d..16dfecb1 100644 --- a/Makefile.am +++ b/Makefile.am @@ -109,6 +109,15 @@ EXTRA_DIST = \ test/conf/client-gpg/pubring.gpg \ test/conf/client-gpg/secring.gpg \ test/conf/client-gpg/trustdb.gpg \ + test/conf/client-gpg-no-pw/pubring.gpg \ + test/conf/client-gpg-no-pw/secring.gpg \ + test/conf/client-gpg-no-pw/trustdb.gpg \ + test/conf/server-gpg/pubring.gpg \ + test/conf/server-gpg/secring.gpg \ + test/conf/server-gpg/trustdb.gpg \ + test/conf/server-gpg-no-pw/pubring.gpg \ + test/conf/server-gpg-no-pw/secring.gpg \ + test/conf/server-gpg-no-pw/trustdb.gpg \ test/conf/default_access.conf \ test/conf/default_fwknopd.conf \ test/conf/dual_key_usage_access.conf \ @@ -133,9 +142,6 @@ EXTRA_DIST = \ test/conf/override_fwknopd.conf \ test/conf/require_src_access.conf \ test/conf/require_user_access.conf \ - test/conf/server-gpg/pubring.gpg \ - test/conf/server-gpg/secring.gpg \ - test/conf/server-gpg/trustdb.gpg \ test/conf/subnet_source_match_access.conf \ test/conf/local_nat_fwknopd.conf \ test/hardening-check \ diff --git a/server/access.c b/server/access.c index 15057d3b..c81fb936 100644 --- a/server/access.c +++ b/server/access.c @@ -46,6 +46,9 @@ static void add_acc_string(char **var, const char *val) { + if(*var != NULL) + free(*var); + if((*var = strdup(val)) == NULL) { log_msg(LOG_ERR, @@ -396,6 +399,9 @@ add_string_list_ent(acc_string_list_t **stlist, const char *str_str) last_stlist->next = new_stlist; } + if(new_stlist->str != NULL) + free(new_stlist->str); + new_stlist->str = strdup(str_str); if(new_stlist->str == NULL) @@ -930,6 +936,13 @@ parse_access_file(fko_srv_options_t *opts) } add_acc_string(&(curr_acc->gpg_decrypt_pw), val); } + else if(CONF_VAR_IS(var, "GPG_ALLOW_NO_PW")) + { + if(curr_acc->gpg_decrypt_pw != NULL && curr_acc->gpg_decrypt_pw[0] != '\0') + free(curr_acc->gpg_decrypt_pw); + + add_acc_string(&(curr_acc->gpg_decrypt_pw), ""); + } else if(CONF_VAR_IS(var, "GPG_REQUIRE_SIG")) { add_acc_bool(&(curr_acc->gpg_require_sig), val); diff --git a/server/incoming_spa.c b/server/incoming_spa.c index 7f272484..2703a77c 100644 --- a/server/incoming_spa.c +++ b/server/incoming_spa.c @@ -436,7 +436,7 @@ incoming_spa(fko_srv_options_t *opts) else { log_msg(LOG_ERR, - "(stanza #%d) No GPG_DECRYPT_PW for GPG encrypted messages", + "(stanza #%d) No GPG_DECRYPT_PW for GPG encrypted messages, set GPG_ALLOW_NO_PW", stanza_num ); acc = acc->next; diff --git a/test/conf/client-gpg-no-pw/pubring.gpg b/test/conf/client-gpg-no-pw/pubring.gpg new file mode 100644 index 0000000000000000000000000000000000000000..615e12f6ebbba9257d6f5502dce8ceae20ef3686 GIT binary patch literal 2480 zcmbuObD2U|DlBS~tTi2-_nhZFf4%>_fBl~4_x%3*eV%Wz02yqP^cgA*2F#jYJ0$Lt zrvr6Dc9uznfM0`M?SwQh&l&id*Q?ZaIezZHo-T=EzIt0)MFJzrFp!Z!rOhdoM9Qgg zotWOW#a{K4t1_MeM+G#T^oP>?cq%N-fWaKJ_h1JixC(WoaC@n3RYs3T+%x&h- z_n<3VH*%vWA73&@LR|f#yi6WM&qdAwuNKmjkD8aP%ewU?&E?FKr)Z7nu{_bJx|%q> zn1K)_hvTMc{tGaE^3s4bWB6P30 zR&Vdm+N!dS+MeZqd_bUgx6g(yR?6sc?}Y1|1|6GapbxFcH2?vi4xsoCQDRb1z_0bi z&1q9k!s>wKRp#hBjm-Y0NqW^VWgoTqi0rX2QI2woG|WC$^8286QE7bMq*_ms@##(0 z7kzutcj4;SfLh6;&Zqefijorh2AzLzE?jFDQgOlRYJCX4%QJosEWQ`3xUXyLirAO) z;#(472d-u**geJ;;OuHtpNL*)9O7z5N-0sZH32DaC$9i8-+GE&A0#}^RNj#!9oC8q{+ zm9{x`G}9Mm(czY7mV!NO)1Lk+Xg87VC4{3kW^b+M-Ar&L$F(@YtrB~n>1`R$d^C@7 zvoGbib}et)qhDMxOS0oBr6pIA8KKFG58e0780l2S zIC{yf`Mr&^wuqo;!c|yu}o)w8HXA!ue~(&dWsKYfGY#aS44EJ z+xZsE6ZP-YWDT)1QJtQ+?`=;??Cqs&Md~k@!t|Q6T&>tyDbWYA=>`fwWev-WB8gxw zZhk@k8~F(XpGPW+I9WuJHfeWhW%|QR?3#45jgEVt*Mk5m^JbBuW3doJ5%;or_xnye z=szCWgZOfrt_idyD>rFs_RZo!$2ys=ok_Y&G_jB);n!gX3g&vnwPt^t=GLB_&bc+t zb7bSewGHcAfwP>uw{=g&IJz9k$-n++?c%^*AkB?G;bz@vA^QcpJaSCq;X#2O7D=li z%$T9P6Sf}Q;9(x5klC-8Bwb*T8<|mR_i2sz>v_OY~n{7D?dz;tie*dM1^*VCPTgd?Nh!8P)Qo!t#p6!Vw9n~ZQ9Z> zugGzsBf>nBHgc8~pv4#0S8tS@c#hZ?SkDRYqw5*vTio_1u=%-hxk=mvub}ZeKWS0z zT{^7ir>`s&D3sCU`k9~Jzurkb-SA+pLS%27d$-tuZEDXisp7b!$*CT1n=jUNB7Re0 z@as%$HD*k>zf^dGcz1z#V#)@qe6i1fMGx|b`GoJa>GGQ;dcMU3OSROZaLA{s+O>}ChkB?*aSkzHbg-=P40y4(;3Bei!P((mP--!Id}=Ji=*3_8)9uxu%Mem) zMO=KV!^sgcIT_~3wKlZQj@yEB&()`k@(GwN{H{}Ph?MRX#y%Nw!T3&Iu_6Nj`T)193JVv8!1%rgV&$J7I}&Q literal 0 HcmV?d00001 diff --git a/test/conf/client-gpg-no-pw/secring.gpg b/test/conf/client-gpg-no-pw/secring.gpg new file mode 100644 index 0000000000000000000000000000000000000000..e84fd95c7496ab361b7515b661dca267121adbde GIT binary patch literal 1274 zcmVNJ-VC_Yy{r~SxW{XWZg4jLa!REyifJT zjDrt9*2#4faQ|xXzdT$dB358Uy6ucD=7f_ znu9>EVma=1F$*hr@o2N_zer<@_EU`4%w?juJf-FZGal{&*0&6 zU&95)>ov`SgZ8)!^e)I|0L{laF>2!^wMB=oKdG?EhTi!KNW#`=WS?)pv!{mawQvm` zO~4Hxcc-~l_|_jsWj`Ic*6ihs|A->i-=@6LN?Q!d-QcB5o+ktVn%E|S+3al&M-tU8 zZJs`L>SgR}F^QoO*s3#|o0i?NWoUCkN8L)H2f_Gm9)`uT)zhWQrYOF%G7~j$3-cL(5g$!? z5C6y}n45c))f~WnI85~H_c2Wi=W!j20waIUQ%wC%7Y`07$Wza=m+QC&8dPg8BkgLP z`#8n|nW1?XD7^NB4EI(I_6~3>hlv(TyK9zhOR5{a3s7`}=j0D$BbN+A4G zrxG}-e0h>*M;3{Q;A%>$V9G6Y^QJc;DQmu*^BUMwHg}FQT9`?1Y|s_h6jvI;zeBJY z5Az1ugMzhOaDfznrr?2Iv>lHJ%$kwsY`0Ep`_8pqKU`(JlFkc2KSp7LY|z~DRO1JS zASDS0c23S1BLD*h2mU-}qG$nc}hH@eMdv7ShI6YCN*fe25v*<@tCJF@$uuwA8&Jfc%DxBQoK1mTT6yJd+Be^@% z+{;fr8voPt`;PztR1N^oJg()yUu0V6761Sl&|8{HX1St3ewbKB3L;B3+3+)T9g$Yp zxDbV!Z literal 0 HcmV?d00001 diff --git a/test/conf/client-gpg-no-pw/trustdb.gpg b/test/conf/client-gpg-no-pw/trustdb.gpg new file mode 100644 index 0000000000000000000000000000000000000000..58ec2d6dbf204edd880308798a9b72d7f7d66d15 GIT binary patch literal 1360 zcmZQfFGy!*W@Ke#U|?{s@3{e_umMIckf=e(T&GFURn0 z;-<>JZ8pco2++#HGD+QZI@8}AG0hI!~K~0^#g9>%hs5Y;m zibkUZ`u9<&=F;jrJ(m|)e+sz7t7w@^*`#I1kb0`-bG)!7dMdch8S}IGd7h=EfEicK zB|Vr*LyEmIJta2eNGe%f3@9mQl$gWk%f!sitNkc_PQhjna{^E25CwHw?3$>aFdd6} zXPRz_0fnr%QI_K~m&It|ZC?Qvz=uDj+5;e)fwlD6vM#pkrs z-NGCa5eVNJENRi>KuY?!OkigExd6MU>f`Q*F^*9i?9d+Ju^zP>OruNGrxDxZ0)&&2 zKnM^$X+yc7nMrw?ODN4E+35GVNo9TVdS&)Nxbci<2pWs?zY0I}=fI-^gHeHS0t!!n zqfucxa3gEDm9-uGf~_&!6Bh{g55!#!@*w!&u<)xWe?MFp28AWym58ojVL>1O#t!`T zbf7edgPRiy0Rh3HKqv?#24n-uu>r+n0bHB{hpXw|3NXXWe({yNTM+7c^ z{W{wGYvDCpK+y>uzWwFXyppQe<`2r164D=GAD3%^08lHC_g7Qa0#HD?X2&?Wee=uv zeG3Db*EK_Hvh|DAGgy_IYkM?riO&nPRR3&5j*BN480w_v3gmCt~89J~mu_+@||Pin8-q z$4qWYhk3u)6~rn8VhOS9w4#M>bsE{nDfAn*%e38Nn&A8q{cNHe{UmqMPd;(E^wEitM6K5V5Iba7xl4{LgpaG{ zvU9HpC=C=!OEie7HXUqhy~959N>=czBJT=N$nxGzNBITKNTge}{mjogXZ z&UYY zMP_IzqiGAH4QGqi)mB+YGom^(jAgpPGT%$83@N^j^zIh6%u#yw_pIiB@Ef2NpG!yh z7pGL5y#_p^>#!J6A)iY!us2Az@~k$l^9Z6NClJBs+)oYvhT>i)nt>(uqT~D>oi$LJ z=kL5u1p$gQL=%G8=jsSQ^hx-LuAQ;ei7k0RvEkMa$a?F-`L3a^kXqHDp28rG;$L~? z{w8Y^x<}Tu!S!RjZW&5Y8$?@yfFF1cY;VCKe|1LP-JnLQy4`xS=SBiQlKTE*ei;$0 zTY!QL^+{|@NJW*O8C44HT3zUpja|A+^ZvsBF0A8TylX1a<%kmCpS%P;_Kf;XUiao? zY)d37Rg4LlU0%38_|YtE{2XMSjn>68MaRkxs8s+;O2;Om2ED&hHK&Z$r=q}W1FH2E zpxq;GEu93-Iv^{ef|N44&C9(=59{ydo2oK;!l)6##7Z&V%rD?wyVzf?Y7E6EY_)K2 zDED~+hI&t``BL{c87J2uAJz6J%`&;pyqxg9T8!&xs7RtU`SZ$JcJjhQDq1gYPryu3 zNZHm2+R}}m#C;QU&V z)${YSX6jJhcmvZJ^Lx}2S2V1R|)O)ldw9e7wUR7R}Ha}%bE~=O%v~E13HZ+ z|CZ{HSa1(NpFM&8FR(VD{}U`K&Pdl6`S@b<7N9sFkKG(x zqgB1;Rd&3pGa67RXhzY`MHjq-4tbXGPZL$6)PkY^#cz{m55I>sxef6XHk`76r4{P% zC%L4a`f+mEK=~n3!*O8^e{P0ktRT!XjQ?k!VorWU#<)ypwD#Ez+IKZe?oR=-*MSN# z!?tI4ti<{G4)xi-X~F3;+>iU`TK>`w_RCz$`2T^nQ58DbM?aIioyI!VZDa3hS^GdgYV+2OImb?<0 zRKSp;*lLEPsXOGD;rvEKDI%AoUUnGPO7b%}rV`?toc!ZNV$0{_TpDF>K?d{geDZs0 zg=P&mxgecT?RST{^^hi468uJ{>2_2|GW-B1B-mr)XM&&O6-++w{0KPeie;AG43j$C5h&Y$il}TH{{uhiSuPjY%?AY>b=$v2{1ah z=<8$_|KcIL#aOBf2ZmIay0w;ZE7HC+ywL`39MuU;Xij|TCa=Lvy^?0%zO-#={`#7J zv~kauV~SI!Ii)NDnjCRnRi)RXO50hJ_2_kgYBVvCVqv66uU9}HFSChRMe>P&cPon1GZq3F z9z=zh4r=*r-rzC(qP^H|l!%yeKA4CRJGfM}<7OW_OR_GCH#uKcF9!gil-xaU(0KsZGn0?b4lXZogOY!S;s8$31BLkpRr56Y((^v!Q z(1{+lQ3K>6zHWm%v%8{MZ>2b2{z`*-%--o4Q!{#>P&kudd0K@%J!-FRzT#sgiIdeF za+Q-%aa4V*GGZ!iTYdBe2*nfB#W9TeL|5atd-&B5bU7IU2Lfx?QP@>BmDsnLbfT8N zQ9;OH8kXm0#z~|T005m5|5J3q3$u&0mJMi~mbQYUXY#KLRkTQEcWZ8MaAY7TW_N3D zZ*XKFb7gXNWpW^NWpi{OYh`&mAVg0fPES-IRZ~SEW^ZyJaB^>Cbz^jCZ*CxDWpHe7 zd2MBGbaN?)Uj!2o0stQc0!M!RJOUd71`7!Y2Ll2G6#@tY0~P`S0v-VZ7k~f?2@oo* z@=rD!y3~Xr0G>Yw_F+Eq2!OwPZ=3InYfA8)gi`>XG&>F?rrZq~FmATwE~*$C<{#$i zumS)8odP`sM}GZJ5C{OKHow)=y!GwdBH_xFi#B+#mqEQ93n${iDIX288TBE@lhxO3 z@W5I^{0PnR6QEnm%g)#?_&~I<-WT&!(>!ope(#Ru76_SG?&^)2I>tOGXs`2UW797; zl|zwcbMpO@dXs+nd|qkMk|ZO(O;ou?-q(cSmKL1M6vgB5=->W``<()Abb#;dp5eqZ?9*vnc=2w- zN4#U)bY13UY7n%nKW#n18~JC%hHk6k*grakbN;?9v=`kx$2TmTu}}oz!26vKkwaKoJaX3G{SJjJ(C}vKF43b}+DhPBuqoY}XO{I+PZ|>_-f@1Y*9f zdg1+2(NUGVYkY{m-$oU1JyQYVQ64njcvZ3V@|qd_{YL5v4`nXb8Z*wh2{xAmA~()R z=%yExRXsnAV~Nz>g^yypkXrlh!*lAXe3UmXYwY3CvrL}vG3)y*lzqUIMI6Kg9QUBB zL)dCt^2E3SmC^E-_m;N$bMyo1X;&)`;@K}O->ad(jmGh)Dz(5dr`S1p-HY{Z9fL3;+rV5Gt(lPc|F6)H-zlpI`bhU0Q7IPt6CO myJYd^Z%hjHWB{K?G(V8^TrttuNP2AL$#`5bRD@XyT=!63RE@mzq literal 0 HcmV?d00001 diff --git a/test/test-fwknop.pl b/test/test-fwknop.pl index e2e580b4..324f8cb7 100755 --- a/test/test-fwknop.pl +++ b/test/test-fwknop.pl @@ -18,6 +18,7 @@ my $configure_path = '../configure'; my $cmd_out_tmp = 'cmd.out'; my $server_cmd_tmp = 'server_cmd.out'; my $gpg_client_home_dir = "$conf_dir/client-gpg"; +my $gpg_client_home_dir_no_pw = "$conf_dir/client-gpg-no-pw"; my %cf = ( 'nat' => "$conf_dir/nat_fwknopd.conf", @@ -31,6 +32,7 @@ my %cf = ( 'local_nat' => "$conf_dir/local_nat_fwknopd.conf", 'dual_key_access' => "$conf_dir/dual_key_usage_access.conf", 'gpg_access' => "$conf_dir/gpg_access.conf", + 'gpg_no_pw_access' => "$conf_dir/gpg_no_pw_access.conf", 'open_ports_access' => "$conf_dir/open_ports_access.conf", 'multi_gpg_access' => "$conf_dir/multi_gpg_access.conf", 'multi_stanza_access' => "$conf_dir/multi_stanzas_access.conf", @@ -160,6 +162,10 @@ my $default_client_gpg_args = "$default_client_args " . "--gpg-signer-key $gpg_client_key " . "--gpg-home-dir $gpg_client_home_dir"; +my $default_client_gpg_args_no_homedir = "$default_client_args " . + "--gpg-recipient-key $gpg_server_key " . + "--gpg-signer-key $gpg_client_key "; + my $default_server_conf_args = "-c $cf{'def'} -a $cf{'def_access'} " . "-d $default_digest_file -p $default_pid_file"; @@ -168,6 +174,11 @@ my $default_server_gpg_args = "LD_LIBRARY_PATH=$lib_dir " . "-a $cf{'gpg_access'} $intf_str " . "-d $default_digest_file -p $default_pid_file"; +my $default_server_gpg_args_no_pw = "LD_LIBRARY_PATH=$lib_dir " . + "$valgrind_str $fwknopdCmd -c $cf{'def'} " . + "-a $cf{'gpg_no_pw_access'} $intf_str " . + "-d $default_digest_file -p $default_pid_file"; + ### point the compiled binaries at the local libary path ### instead of any installed libfko instance $ENV{'LD_LIBRARY_PATH'} = $lib_dir; @@ -1183,6 +1194,171 @@ my @tests = ( 'fatal' => $NO }, + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'complete cycle (tcp/22 ssh)', + 'err_msg' => 'could not complete SPA cycle', + 'function' => \&spa_cycle, + 'cmdline' => "$default_client_gpg_args_no_homedir " + . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'fw_rule_created' => $NEW_RULE_REQUIRED, + 'fw_rule_removed' => $NEW_RULE_REMOVED, + 'fatal' => $NO + }, + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'multi gpg-IDs (tcp/22 ssh)', + 'err_msg' => 'could not complete SPA cycle', + 'function' => \&spa_cycle, + 'cmdline' => "$default_client_gpg_args_no_homedir " + . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir " . + "$valgrind_str $fwknopdCmd -c $cf{'def'} " . + "-a $cf{'multi_gpg_access'} $intf_str " . + "-d $default_digest_file -p $default_pid_file", + 'fw_rule_created' => $NEW_RULE_REQUIRED, + 'fw_rule_removed' => $NEW_RULE_REMOVED, + 'fatal' => $NO + }, + + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'complete cycle (tcp/23 telnet)', + 'err_msg' => 'could not complete SPA cycle', + 'function' => \&spa_cycle, + 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . + "$fwknopCmd -A tcp/23 -a $fake_ip -D $loopback_ip --get-key " . + "$local_key_file --verbose --verbose " . + "--gpg-recipient-key $gpg_server_key " . + "--gpg-signer-key $gpg_client_key " . + "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'fw_rule_created' => $NEW_RULE_REQUIRED, + 'fw_rule_removed' => $NEW_RULE_REMOVED, + 'fatal' => $NO + }, + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'complete cycle (tcp/9418 git)', + 'err_msg' => 'could not complete SPA cycle', + 'function' => \&spa_cycle, + 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . + "$fwknopCmd -A tcp/9418 -a $fake_ip -D $loopback_ip --get-key " . + "$local_key_file --verbose --verbose " . + "--gpg-recipient-key $gpg_server_key " . + "--gpg-signer-key $gpg_client_key " . + "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'fw_rule_created' => $NEW_RULE_REQUIRED, + 'fw_rule_removed' => $NEW_RULE_REMOVED, + 'fatal' => $NO + }, + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'complete cycle (udp/53 dns)', + 'err_msg' => 'could not complete SPA cycle', + 'function' => \&spa_cycle, + 'cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . + "$fwknopCmd -A udp/53 -a $fake_ip -D $loopback_ip --get-key " . + "$local_key_file --verbose --verbose " . + "--gpg-recipient-key $gpg_server_key " . + "--gpg-signer-key $gpg_client_key " . + "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'fw_rule_created' => $NEW_RULE_REQUIRED, + 'fw_rule_removed' => $NEW_RULE_REMOVED, + 'fatal' => $NO + }, + + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'replay attack detection', + 'err_msg' => 'could not detect replay attack', + 'function' => \&replay_detection, + 'cmdline' => "$default_client_gpg_args_no_homedir " + . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'replay_positive_output_matches' => [qr/Replay\sdetected\sfrom\ssource\sIP/], + 'fatal' => $NO + }, + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'replay detection (GnuPG prefix)', + 'err_msg' => 'could not detect replay attack', + 'function' => \&replay_detection, + 'pkt_prefix' => 'hQ', + 'cmdline' => "$default_client_gpg_args_no_homedir " + . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " . + "$fwknopdCmd $default_server_conf_args $intf_str", + 'replay_positive_output_matches' => [qr/Data\sis\snot\sa\svalid\sSPA\smessage\sformat/], + 'fatal' => $NO + }, + + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'non-base64 altered SPA data', + 'err_msg' => 'allowed improper SPA data', + 'function' => \&altered_non_base64_spa_data, + 'cmdline' => "$default_client_gpg_args_no_homedir " + . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'fatal' => $NO + }, + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'base64 altered SPA data', + 'err_msg' => 'allowed improper SPA data', + 'function' => \&altered_base64_spa_data, + 'cmdline' => "$default_client_gpg_args_no_homedir " + . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'fatal' => $NO + }, + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'appended data to SPA pkt', + 'err_msg' => 'allowed improper SPA data', + 'function' => \&appended_spa_data, + 'cmdline' => "$default_client_gpg_args_no_homedir " + . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'fatal' => $NO + }, + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'prepended data to SPA pkt', + 'err_msg' => 'allowed improper SPA data', + 'function' => \&prepended_spa_data, + 'cmdline' => "$default_client_gpg_args_no_homedir " + . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'fatal' => $NO + }, + { + 'category' => 'GPG (no pw) SPA', + 'subcategory' => 'client+server', + 'detail' => 'spoof username (tcp/22 ssh)', + 'err_msg' => 'could not spoof username', + 'function' => \&spoof_username, + 'cmdline' => "SPOOF_USER=$spoof_user $default_client_gpg_args_no_homedir " + . "--gpg-home-dir $gpg_client_home_dir_no_pw", + 'fwknopd_cmdline' => $default_server_gpg_args_no_pw, + 'fatal' => $NO + }, + { 'category' => 'GnuPG (GPG) SPA', 'subcategory' => 'client+server',