From 2da2704d4c09651f1b88bc3b57c6244b23b2a875 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Thu, 3 Apr 2014 19:29:14 -0400 Subject: [PATCH] [test suite] fwknoprc GPG tests, more time offset tests --- Makefile.am | 2 + client/fwknop.c | 5 +- test/conf/fwknoprc_hmac_time_offset_days | 18 ++++ test/conf/fwknoprc_hmac_time_offset_hours | 18 ++++ test/conf/fwknoprc_hmac_time_offset_mins | 18 ++++ .../conf/gpg_no_pw_hmac_clientdir_access.conf | 8 ++ .../conf/gpg_no_pw_hmac_serverdir_access.conf | 8 ++ test/test-fwknop.pl | 25 +++++- test/tests/basic_operations.pl | 88 +++++++++++++++++++ test/tests/gpg_no_pw_hmac.pl | 27 ++++++ 10 files changed, 212 insertions(+), 5 deletions(-) create mode 100644 test/conf/fwknoprc_hmac_time_offset_days create mode 100644 test/conf/fwknoprc_hmac_time_offset_hours create mode 100644 test/conf/fwknoprc_hmac_time_offset_mins create mode 100644 test/conf/gpg_no_pw_hmac_clientdir_access.conf create mode 100644 test/conf/gpg_no_pw_hmac_serverdir_access.conf diff --git a/Makefile.am b/Makefile.am index d7c674e6..d9b57305 100644 --- a/Makefile.am +++ b/Makefile.am @@ -158,6 +158,8 @@ EXTRA_DIST = \ test/conf/gpg_hmac_access.conf \ test/conf/gpg_no_pw_access.conf \ test/conf/gpg_no_pw_hmac_access.conf \ + test/conf/gpg_no_pw_hmac_clientdir_access.conf \ + test/conf/gpg_no_pw_hmac_serverdir_access.conf \ test/conf/fwknoprc_gpg_invalid_exe \ test/conf/fwknoprc_hmac_defaults \ test/conf/fwknoprc_hmac_time_offset_mins \ diff --git a/client/fwknop.c b/client/fwknop.c index a859bb59..4d55df01 100644 --- a/client/fwknop.c +++ b/client/fwknop.c @@ -605,7 +605,10 @@ main(int argc, char **argv) * expected, return 0 instead of an error condition (so calling * programs like the fwknop test suite don't interpret this as * an unrecoverable error), but print the error string for - debugging purposes. */ + * debugging purposes. The test suite does run a series of + * tests that use a single key pair for encryption and + * authentication, so decryption become possible for these + * tests. */ log_msg(LOG_VERBOSITY_ERROR, "GPG ERR: %s\n%s", fko_gpg_errstr(ctx2), "No access to recipient private key?"); } diff --git a/test/conf/fwknoprc_hmac_time_offset_days b/test/conf/fwknoprc_hmac_time_offset_days new file mode 100644 index 00000000..e0917142 --- /dev/null +++ b/test/conf/fwknoprc_hmac_time_offset_days @@ -0,0 +1,18 @@ +[default] +ACCESS tcp/22 +SPA_SERVER 127.0.0.1 +ALLOW_IP 127.0.0.2 +USE_HMAC Y +HMAC_DIGEST_TYPE sha256 +KEY_BASE64 wzNP62oPPgEc+kXDPQLHPOayQBuNbYUTPP+QrErNDmg= +HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg== +DIGEST_TYPE sha256 +SPA_SERVER_PROTO udp +SPA_SERVER_PORT 62201 +SPOOF_USER mbrtest +VERBOSE 2 +TIME_OFFSET -1D +ENCRYPTION_MODE CBC +USE_GPG N +USE_GPG_AGENT N +RESOLVE_IP_HTTP N diff --git a/test/conf/fwknoprc_hmac_time_offset_hours b/test/conf/fwknoprc_hmac_time_offset_hours new file mode 100644 index 00000000..0a6b4fcc --- /dev/null +++ b/test/conf/fwknoprc_hmac_time_offset_hours @@ -0,0 +1,18 @@ +[default] +ACCESS tcp/22 +SPA_SERVER 127.0.0.1 +ALLOW_IP 127.0.0.2 +USE_HMAC Y +HMAC_DIGEST_TYPE sha256 +KEY_BASE64 wzNP62oPPgEc+kXDPQLHPOayQBuNbYUTPP+QrErNDmg= +HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg== +DIGEST_TYPE sha256 +SPA_SERVER_PROTO udp +SPA_SERVER_PORT 62201 +SPOOF_USER mbrtest +VERBOSE Y +TIME_OFFSET +1H +ENCRYPTION_MODE CBC +USE_GPG N +USE_GPG_AGENT N +RESOLVE_IP_HTTP N diff --git a/test/conf/fwknoprc_hmac_time_offset_mins b/test/conf/fwknoprc_hmac_time_offset_mins new file mode 100644 index 00000000..41e4fa5b --- /dev/null +++ b/test/conf/fwknoprc_hmac_time_offset_mins @@ -0,0 +1,18 @@ +[default] +ACCESS tcp/22 +SPA_SERVER 127.0.0.1 +ALLOW_IP 127.0.0.2 +USE_HMAC Y +HMAC_DIGEST_TYPE sha256 +KEY_BASE64 wzNP62oPPgEc+kXDPQLHPOayQBuNbYUTPP+QrErNDmg= +HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg== +DIGEST_TYPE sha256 +SPA_SERVER_PROTO udp +SPA_SERVER_PORT 62201 +SPOOF_USER mbrtest +VERBOSE Y +TIME_OFFSET -1M +ENCRYPTION_MODE CBC +USE_GPG N +USE_GPG_AGENT N +RESOLVE_IP_HTTP N diff --git a/test/conf/gpg_no_pw_hmac_clientdir_access.conf b/test/conf/gpg_no_pw_hmac_clientdir_access.conf new file mode 100644 index 00000000..5d6d9ca5 --- /dev/null +++ b/test/conf/gpg_no_pw_hmac_clientdir_access.conf @@ -0,0 +1,8 @@ +SOURCE ANY +FW_ACCESS_TIMEOUT 3 +HMAC_DIGEST_TYPE sha256 +HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg== +GPG_HOME_DIR conf/client-gpg-no-pw +GPG_DECRYPT_ID 6A3FAD56 +GPG_ALLOW_NO_PW Y +GPG_REMOTE_ID 6A3FAD56 diff --git a/test/conf/gpg_no_pw_hmac_serverdir_access.conf b/test/conf/gpg_no_pw_hmac_serverdir_access.conf new file mode 100644 index 00000000..405baf7d --- /dev/null +++ b/test/conf/gpg_no_pw_hmac_serverdir_access.conf @@ -0,0 +1,8 @@ +SOURCE ANY +FW_ACCESS_TIMEOUT 3 +HMAC_DIGEST_TYPE sha256 +HMAC_KEY_BASE64 Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg== +GPG_HOME_DIR conf/server-gpg-no-pw +GPG_DECRYPT_ID 361BBAD4 +GPG_ALLOW_NO_PW Y +GPG_REMOTE_ID 361BBAD4 diff --git a/test/test-fwknop.pl b/test/test-fwknop.pl index 51a9c792..a6bc5936 100755 --- a/test/test-fwknop.pl +++ b/test/test-fwknop.pl @@ -106,6 +106,8 @@ our %cf = ( 'legacy_iv_long_key2_access' => "$conf_dir/legacy_iv_long_key2_access.conf", 'gpg_no_pw_access' => "$conf_dir/gpg_no_pw_access.conf", 'gpg_no_pw_hmac_access' => "$conf_dir/gpg_no_pw_hmac_access.conf", + 'gpg_no_pw_hmac_clientdir_access' => "$conf_dir/gpg_no_pw_hmac_clientdir_access.conf", + 'gpg_no_pw_hmac_serverdir_access' => "$conf_dir/gpg_no_pw_hmac_serverdir_access.conf", 'gpg_no_pw_hmac_sha512_access' => "$conf_dir/gpg_no_pw_hmac_sha512_access.conf", 'tcp_server' => "$conf_dir/tcp_server_fwknopd.conf", 'tcp_pcap_filter' => "$conf_dir/tcp_pcap_filter_fwknopd.conf", @@ -543,6 +545,14 @@ our $default_client_gpg_args_no_homedir = "$default_client_args " . "--gpg-recipient-key $gpg_server_key " . "--gpg-signer-key $gpg_client_key "; +our $default_client_gpg_args_same_key_signer = "$default_client_args " . + "--gpg-recipient-key $gpg_client_key " . + "--gpg-signer-key $gpg_client_key "; + +our $default_client_gpg_args_same_key_recip = "$default_client_args " . + "--gpg-recipient-key $gpg_server_key " . + "--gpg-signer-key $gpg_server_key "; + our $default_client_gpg_args_no_get_key = "$default_client_args_no_get_key " . "--gpg-recipient-key $gpg_server_key " . "--gpg-signer-key $gpg_client_key " . @@ -1573,8 +1583,12 @@ sub client_rc_file() { $rv = 0 unless &run_cmd($test_hr->{'cmdline'}, $cmd_out_tmp, $curr_test_file); } + if ($rv == 0) { + $rv = 1 if $test_hr->{'exec_err'} eq $YES; + } - unless ($test_hr->{'cmdline'} =~ /key\-gen/ or $test_hr->{'cmdline'} =~ /\-k/) { + unless ($test_hr->{'cmdline'} =~ /key\-gen/ or $test_hr->{'cmdline'} =~ /\-k/ + or $test_hr->{'exec_err'} eq $YES) { $rv = 0 unless &file_find_regex([qr/Final\sSPA\sData/i], $MATCH_ALL, $NO_APPEND_RESULTS, $curr_test_file); } @@ -1813,7 +1827,8 @@ sub client_send_spa_packet() { if ($is_hmac_type and $hmac_key) { my $enc_mode = $ENC_RIJNDAEL; - $enc_mode = $ENC_GPG if $test_hr->{'msg'} =~ /GPG/; + $enc_mode = $ENC_GPG if $test_hr->{'msg'} =~ /gpg/i + or $test_hr->{'msg'} =~ /gnupg/i; unless (&openssl_hmac_verification($encrypted_msg, $encoded_msg, '', $hmac_key, $b64_decode_key, $hmac_digest, $hmac_mode, $enc_mode)) { @@ -1933,7 +1948,8 @@ sub gpg_pinentry_check() { alarm 0; if ($@) { $rv = 0; - push @tests_to_exclude, qr/GPG/; + push @tests_to_exclude, qr/gpg/i; + push @tests_to_exclude, qr/gnupg/i; $pinentry_fail = 1; } } else { @@ -5404,7 +5420,8 @@ sub specs() { ### all three of fwknop/fwknopd/libfko must link against gpgme in order ### to enable gpg tests unless ($have_gpgme == 3) { - push @tests_to_exclude, qr/GPG/; + push @tests_to_exclude, qr/gpg/i; + push @tests_to_exclude, qr/gnupg/i; } return 1; diff --git a/test/tests/basic_operations.pl b/test/tests/basic_operations.pl index dceeb07e..d69c4328 100644 --- a/test/tests/basic_operations.pl +++ b/test/tests/basic_operations.pl @@ -607,6 +607,20 @@ 'positive_output_matches' => [qr/Digest\sType\:\s.*SHA1/], 'rc_positive_output_matches' => [qr/TIME_OFFSET.*60/], }, + { + 'category' => 'basic operations', + 'subcategory' => 'client save rc file', + 'detail' => '--time-offset-plus invalid', + 'function' => \&client_rc_file, + 'cmdline' => "$client_save_rc_args -n default --time-offset-plus invalid", + 'save_rc_stanza' => [{'name' => 'default', + 'vars' => {'KEY' => 'testtest', 'DIGEST_TYPE' => 'SHA1', + 'TIME_OFFSET' => 'invalid'}}], + 'exec_err' => $YES, + 'positive_output_matches' => [qr/Invalid/], + 'rc_positive_output_matches' => [qr/TIME_OFFSET.*invalid/], + }, + { 'category' => 'basic operations', 'subcategory' => 'client save rc file', @@ -867,6 +881,80 @@ 'rc_positive_output_matches' => [qr/VERBOSE.*(Y|\d)/, qr/USE_HMAC.*Y/, qr/KEY_BASE64/, qr/HMAC_KEY_BASE64/], }, + { + 'category' => 'basic operations', + 'subcategory' => 'client save rc file', + 'detail' => 'GPG same signing key', + 'function' => \&client_rc_file, + 'cmdline' => "$default_client_gpg_args_same_key_signer --gpg-encryption " + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw " + . "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test", + 'save_rc_stanza' => [{'name' => 'default', + 'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30', + 'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}], + 'positive_output_matches' => [qr/GPG sig verify/], + 'rc_positive_output_matches' => [qr/GPG_SIGNER/, qr/GPG_RECIPIENT/, + qr/GPG_HOMEDIR/] + }, + { + 'category' => 'basic operations', + 'subcategory' => 'client save rc file', + 'detail' => 'GPG invalid exe', + 'function' => \&client_rc_file, + 'cmdline' => "$default_client_gpg_args_same_key_signer " + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw " + . "--gpg-exe invalidpath " + . "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test", + 'save_rc_stanza' => [{'name' => 'default', + 'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30', + 'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}], + 'exec_err' => $YES, + 'positive_output_matches' => [qr/Unable\sto\sstat/], + }, + { + 'category' => 'basic operations', + 'subcategory' => 'client save rc file', + 'detail' => 'GPG invalid homedir', + 'function' => \&client_rc_file, + 'cmdline' => "$default_client_gpg_args_same_key_signer " + . "--gpg-home-dir invalidpath --gpg-no-signing-pw " + . "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test", + 'save_rc_stanza' => [{'name' => 'default', + 'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30', + 'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}], + 'exec_err' => $YES, + 'positive_output_matches' => [qr/Unable\sto\sstat/], + }, + { + 'category' => 'basic operations', + 'subcategory' => 'client save rc file', + 'detail' => 'GPG invalid recip', + 'function' => \&client_rc_file, + 'cmdline' => "$default_client_args " + . "--gpg-recipient-key invalid --gpg-signer-key $gpg_client_key " + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw " + . "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test", + 'save_rc_stanza' => [{'name' => 'default', + 'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30', + 'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}], + 'exec_err' => $YES, + 'positive_output_matches' => [qr/key\sfor.*not\sfound/], + }, + { + 'category' => 'basic operations', + 'subcategory' => 'client save rc file', + 'detail' => 'GPG invalid signer', + 'function' => \&client_rc_file, + 'cmdline' => "$default_client_args " + . "--gpg-recipient-key $gpg_client_key --gpg-signer-key invalid " + . "--gpg-home-dir $gpg_client_home_dir_no_pw --gpg-no-signing-pw " + . "--rc-file $save_rc_file --save-rc-stanza --force-stanza --test", + 'save_rc_stanza' => [{'name' => 'default', + 'vars' => {'KEY' => 'testtest', 'FW_TIMEOUT' => '30', + 'GPG_HOMEDIR' => 'somepath', 'GPG_SIGNER' => 'invalid'}}], + 'exec_err' => $YES, + 'positive_output_matches' => [qr/key\sfor.*not\sfound/], + }, { 'category' => 'basic operations', diff --git a/test/tests/gpg_no_pw_hmac.pl b/test/tests/gpg_no_pw_hmac.pl index 3b1ebd67..6213e271 100644 --- a/test/tests/gpg_no_pw_hmac.pl +++ b/test/tests/gpg_no_pw_hmac.pl @@ -13,6 +13,33 @@ 'fw_rule_removed' => $NEW_RULE_REMOVED, 'key_file' => $cf{'rc_hmac_b64_key'}, }, + { + 'category' => 'GPG (no pw) HMAC', + 'subcategory' => 'client+server', + 'detail' => 'complete cycle same key signer', + 'function' => \&spa_cycle, + 'cmdline' => "$default_client_gpg_args_same_key_signer " + . "--gpg-home-dir $gpg_client_home_dir_no_pw " + . "--rc-file $cf{'rc_hmac_b64_key'}", + 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir " . + "$valgrind_str $fwknopdCmd -c $cf{'def'} " . + "-a $cf{'gpg_no_pw_hmac_clientdir_access'} $intf_str " . + "-d $default_digest_file -p $default_pid_file", + 'fw_rule_created' => $NEW_RULE_REQUIRED, + 'fw_rule_removed' => $NEW_RULE_REMOVED, + 'key_file' => $cf{'rc_hmac_b64_key'}, + }, + { + 'category' => 'GPG (no pw) HMAC', + 'subcategory' => 'client', + 'detail' => 'same signing key --test', + 'function' => \&generic_exec, + 'cmdline' => "$default_client_gpg_args_same_key_signer " + . "--gpg-home-dir $gpg_client_home_dir_no_pw " + . "--rc-file $cf{'rc_hmac_b64_key'} --test", + 'key_file' => $cf{'rc_hmac_b64_key'}, + }, + { 'category' => 'GPG (no pw) HMAC', 'subcategory' => 'client+server',