DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

[test suite] fwknoprc GPG tests, more time offset tests

Browse Source
This commit is contained in:
Michael Rash
2014-04-03 19:30:58 -04:00
parent d4c696d24a
commit 2da2704d4c
10 changed files with 212 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile.am
+2
View File
@@ -158,6 +158,8 @@ EXTRA_DIST = \
test/conf/gpg_hmac_access.conf \
test/conf/gpg_no_pw_access.conf \
test/conf/gpg_no_pw_hmac_access.conf \
test/conf/gpg_no_pw_hmac_clientdir_access.conf \
test/conf/gpg_no_pw_hmac_serverdir_access.conf \
test/conf/fwknoprc_gpg_invalid_exe \
test/conf/fwknoprc_hmac_defaults \
test/conf/fwknoprc_hmac_time_offset_mins \
client/fwknop.c
+4 -1
View File
@@ -605,7 +605,10 @@ main(int argc, char **argv)
* expected, return 0 instead of an error condition (so calling
* programs like the fwknop test suite don't interpret this as
* an unrecoverable error), but print the error string for
debugging purposes. */
* debugging purposes. The test suite does run a series of
* tests that use a single key pair for encryption and
* authentication, so decryption become possible for these
* tests. */
log_msg(LOG_VERBOSITY_ERROR, "GPG ERR: %s\n%s", fko_gpg_errstr(ctx2),
"No access to recipient private key?");
}
test/conf/fwknoprc_hmac_time_offset_days
+18
View File
@@ -0,0 +1,18 @@
[default]
ACCESS tcp/22
SPA_SERVER 127.0.0.1
ALLOW_IP 127.0.0.2
USE_HMAC Y
HMAC_DIGEST_TYPE sha256
KEY_BASE64 wzNP62oPPgEc+kXDPQLHPOayQBuNbYUTPP+QrErNDmg=
HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg==
DIGEST_TYPE sha256
SPA_SERVER_PROTO udp
SPA_SERVER_PORT 62201
SPOOF_USER mbrtest
VERBOSE 2
TIME_OFFSET -1D
ENCRYPTION_MODE CBC
USE_GPG N
USE_GPG_AGENT N
RESOLVE_IP_HTTP N
test/conf/fwknoprc_hmac_time_offset_hours
+18
View File
@@ -0,0 +1,18 @@
[default]
ACCESS tcp/22
SPA_SERVER 127.0.0.1
ALLOW_IP 127.0.0.2
USE_HMAC Y
HMAC_DIGEST_TYPE sha256
KEY_BASE64 wzNP62oPPgEc+kXDPQLHPOayQBuNbYUTPP+QrErNDmg=
HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg==
DIGEST_TYPE sha256
SPA_SERVER_PROTO udp
SPA_SERVER_PORT 62201
SPOOF_USER mbrtest
VERBOSE Y
TIME_OFFSET +1H
ENCRYPTION_MODE CBC
USE_GPG N
USE_GPG_AGENT N
RESOLVE_IP_HTTP N
test/conf/fwknoprc_hmac_time_offset_mins
+18
View File
@@ -0,0 +1,18 @@
[default]
ACCESS tcp/22
SPA_SERVER 127.0.0.1
ALLOW_IP 127.0.0.2
USE_HMAC Y
HMAC_DIGEST_TYPE sha256
KEY_BASE64 wzNP62oPPgEc+kXDPQLHPOayQBuNbYUTPP+QrErNDmg=
HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg==
DIGEST_TYPE sha256
SPA_SERVER_PROTO udp
SPA_SERVER_PORT 62201
SPOOF_USER mbrtest
VERBOSE Y
TIME_OFFSET -1M
ENCRYPTION_MODE CBC
USE_GPG N
USE_GPG_AGENT N
RESOLVE_IP_HTTP N
test/conf/gpg_no_pw_hmac_clientdir_access.conf
+8
View File
@@ -0,0 +1,8 @@
SOURCE ANY
FW_ACCESS_TIMEOUT 3
HMAC_DIGEST_TYPE sha256
HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg==
GPG_HOME_DIR conf/client-gpg-no-pw
GPG_DECRYPT_ID 6A3FAD56
GPG_ALLOW_NO_PW Y
GPG_REMOTE_ID 6A3FAD56
test/conf/gpg_no_pw_hmac_serverdir_access.conf
+8
View File
@@ -0,0 +1,8 @@
SOURCE ANY
FW_ACCESS_TIMEOUT 3
HMAC_DIGEST_TYPE sha256
HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg==
GPG_HOME_DIR conf/server-gpg-no-pw
GPG_DECRYPT_ID 361BBAD4
GPG_ALLOW_NO_PW Y
GPG_REMOTE_ID 361BBAD4
test/test-fwknop.pl
+21 -4
View File
@@ -106,6 +106,8 @@ our %cf = (
'legacy_iv_long_key2_access' => "$conf_dir/legacy_iv_long_key2_access.conf",
'gpg_no_pw_access' => "$conf_dir/gpg_no_pw_access.conf",
'gpg_no_pw_hmac_access' => "$conf_dir/gpg_no_pw_hmac_access.conf",
'gpg_no_pw_hmac_clientdir_access' => "$conf_dir/gpg_no_pw_hmac_clientdir_access.conf",
'gpg_no_pw_hmac_serverdir_access' => "$conf_dir/gpg_no_pw_hmac_serverdir_access.conf",
'gpg_no_pw_hmac_sha512_access' => "$conf_dir/gpg_no_pw_hmac_sha512_access.conf",
'tcp_server' => "$conf_dir/tcp_server_fwknopd.conf",
'tcp_pcap_filter' => "$conf_dir/tcp_pcap_filter_fwknopd.conf",
@@ -543,6 +545,14 @@ our $default_client_gpg_args_no_homedir = "$default_client_args " .
"--gpg-recipient-key $gpg_server_key " .
"--gpg-signer-key $gpg_client_key ";
our $default_client_gpg_args_same_key_signer = "$default_client_args " .
"--gpg-recipient-key $gpg_client_key " .
"--gpg-signer-key $gpg_client_key ";
our $default_client_gpg_args_same_key_recip = "$default_client_args " .
"--gpg-recipient-key $gpg_server_key " .
"--gpg-signer-key $gpg_server_key ";
our $default_client_gpg_args_no_get_key = "$default_client_args_no_get_key " .
"--gpg-recipient-key $gpg_server_key " .
"--gpg-signer-key $gpg_client_key " .
@@ -1573,8 +1583,12 @@ sub client_rc_file() {
$rv = 0 unless &run_cmd($test_hr->{'cmdline'},
$cmd_out_tmp, $curr_test_file);
}
if ($rv == 0) {
$rv = 1 if $test_hr->{'exec_err'} eq $YES;
}
unless ($test_hr->{'cmdline'} =~ /key\-gen/ or $test_hr->{'cmdline'} =~ /\-k/) {
unless ($test_hr->{'cmdline'} =~ /key\-gen/ or $test_hr->{'cmdline'} =~ /\-k/
or $test_hr->{'exec_err'} eq $YES) {
$rv = 0 unless &file_find_regex([qr/Final\sSPA\sData/i],
$MATCH_ALL, $NO_APPEND_RESULTS, $curr_test_file);
}
@@ -1813,7 +1827,8 @@ sub client_send_spa_packet() {
if ($is_hmac_type and $hmac_key) {
my $enc_mode = $ENC_RIJNDAEL;
$enc_mode = $ENC_GPG if $test_hr->{'msg'} =~ /GPG/;
$enc_mode = $ENC_GPG if $test_hr->{'msg'} =~ /gpg/i
or $test_hr->{'msg'} =~ /gnupg/i;
unless (&openssl_hmac_verification($encrypted_msg,
$encoded_msg, '', $hmac_key, $b64_decode_key,
$hmac_digest, $hmac_mode, $enc_mode)) {
@@ -1933,7 +1948,8 @@ sub gpg_pinentry_check() {
alarm 0;
if ($@) {
$rv = 0;
push @tests_to_exclude, qr/GPG/;
push @tests_to_exclude, qr/gpg/i;
push @tests_to_exclude, qr/gnupg/i;
$pinentry_fail = 1;
}
} else {
@@ -5404,7 +5420,8 @@ sub specs() {
### all three of fwknop/fwknopd/libfko must link against gpgme in order
### to enable gpg tests
unless ($have_gpgme == 3) {
push @tests_to_exclude, qr/GPG/;
push @tests_to_exclude, qr/gpg/i;
push @tests_to_exclude, qr/gnupg/i;
}
return 1;
test/tests/basic_operations.pl
+88
View File
@@ -607,6 +607,20 @@
'positive_output_matches' => [qr/Digest\sType\:\s.*SHA1/],
'rc_positive_output_matches' => [qr/TIME_OFFSET.*60/],
},
{
'category' => 'basic operations',
'subcategory' => 'client save rc file',
'detail' => '--time-offset-plus invalid',
'function' => \&client_rc_file,
'cmdline' => "$client_save_rc_args -n default --time-offset-plus invalid",
'save_rc_stanza' => [{'name' => 'default',
'vars' => {'KEY' => 'testtest', 'DIGEST_TYPE' => 'SHA1',
'TIME_OFFSET' => 'invalid'}}],
'exec_err' => $YES,
'positive_output_matches' => [qr/Invalid/],
'rc_positive_output_matches' => [qr/TIME_OFFSET.*invalid/],
},
{
'category' => 'basic operations',
'subcategory' => 'client save rc file',
@@ -867,6 +881,80 @@
'rc_positive_output_matches' => [qr/VERBOSE.*(Y|\d)/,
qr/USE_HMAC.*Y/, qr/KEY_BASE64/, qr/HMAC_KEY_BASE64/],
},
{
'category' => 'basic operations',
'subcategory' => 'client save rc file',
'detail' => 'GPG same signing key',
'function' => \&client_rc_file,
'cmdline' => "$default_client_gpg_args_same_key_signer --gpg-encryption "
. "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw "
. "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test",
'save_rc_stanza' => [{'name' => 'default',
'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30',
'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}],
'positive_output_matches' => [qr/GPG sig verify/],
'rc_positive_output_matches' => [qr/GPG_SIGNER/, qr/GPG_RECIPIENT/,
qr/GPG_HOMEDIR/]
},
{
'category' => 'basic operations',
'subcategory' => 'client save rc file',
'detail' => 'GPG invalid exe',
'function' => \&client_rc_file,
'cmdline' => "$default_client_gpg_args_same_key_signer "
. "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw "
. "--gpg-exe invalidpath "
. "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test",
'save_rc_stanza' => [{'name' => 'default',
'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30',
'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}],
'exec_err' => $YES,
'positive_output_matches' => [qr/Unable\sto\sstat/],
},
{
'category' => 'basic operations',
'subcategory' => 'client save rc file',
'detail' => 'GPG invalid homedir',
'function' => \&client_rc_file,
'cmdline' => "$default_client_gpg_args_same_key_signer "
. "--gpg-home-dir invalidpath --gpg-no-signing-pw "
. "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test",
'save_rc_stanza' => [{'name' => 'default',
'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30',
'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}],
'exec_err' => $YES,
'positive_output_matches' => [qr/Unable\sto\sstat/],
},
{
'category' => 'basic operations',
'subcategory' => 'client save rc file',
'detail' => 'GPG invalid recip',
'function' => \&client_rc_file,
'cmdline' => "$default_client_args "
. "--gpg-recipient-key invalid --gpg-signer-key $gpg_client_key "
. "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw "
. "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test",
'save_rc_stanza' => [{'name' => 'default',
'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30',
'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}],
'exec_err' => $YES,
'positive_output_matches' => [qr/key\sfor.*not\sfound/],
},
{
'category' => 'basic operations',
'subcategory' => 'client save rc file',
'detail' => 'GPG invalid signer',
'function' => \&client_rc_file,
'cmdline' => "$default_client_args "
. "--gpg-recipient-key $gpg_client_key --gpg-signer-key invalid "
. "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw "
. "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test",
'save_rc_stanza' => [{'name' => 'default',
'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30',
'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}],
'exec_err' => $YES,
'positive_output_matches' => [qr/key\sfor.*not\sfound/],
},
{
'category' => 'basic operations',
test/tests/gpg_no_pw_hmac.pl
+27
View File
@@ -13,6 +13,33 @@
'fw_rule_removed' => $NEW_RULE_REMOVED,
'key_file' => $cf{'rc_hmac_b64_key'},
},
{
'category' => 'GPG (no pw) HMAC',
'subcategory' => 'client+server',
'detail' => 'complete cycle same key signer',
'function' => \&spa_cycle,
'cmdline' => "$default_client_gpg_args_same_key_signer "
. "--gpg-home-dir $gpg_client_home_dir_no_pw "
. "--rc-file $cf{'rc_hmac_b64_key'}",
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir " .
"$valgrind_str $fwknopdCmd -c $cf{'def'} " .
"-a $cf{'gpg_no_pw_hmac_clientdir_access'} $intf_str " .
"-d $default_digest_file -p $default_pid_file",
'fw_rule_created' => $NEW_RULE_REQUIRED,
'fw_rule_removed' => $NEW_RULE_REMOVED,
'key_file' => $cf{'rc_hmac_b64_key'},
},
{
'category' => 'GPG (no pw) HMAC',
'subcategory' => 'client',
'detail' => 'same signing key --test',
'function' => \&generic_exec,
'cmdline' => "$default_client_gpg_args_same_key_signer "
. "--gpg-home-dir $gpg_client_home_dir_no_pw "
. "--rc-file $cf{'rc_hmac_b64_key'} --test",
'key_file' => $cf{'rc_hmac_b64_key'},
},
{
'category' => 'GPG (no pw) HMAC',
'subcategory' => 'client+server',