DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

Update to print all firewall commands in --verbose mode

Browse Source 
This commit makes it easier to determine exactly which commands fwknopd
runs in --verbose mode when interacting with the underlying firewall.
This commit also adds --verbose --verbose mode to the test suite.
This commit is contained in:
Michael Rash
2011-10-27 21:51:55 -04:00
parent 6388e8ac7f
commit 464dbe95d0
10 changed files with 179 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/access.c
+1
View File
@@ -1074,6 +1074,7 @@ dump_access_list(const fko_srv_options_t *opts)
}
fprintf(stdout, "\n");
fflush(stdout);
}
/***EOF***/
server/config_init.c
+3 -1
View File
@@ -745,6 +745,7 @@ dump_config(const fko_srv_options_t *opts)
);
fprintf(stdout, "\n");
fflush(stdout);
}
/* Print usage message...
@@ -785,7 +786,8 @@ usage(void)
" --fw-list - List all firewall rules that fwknop has created\n"
" and then exit.\n"
" --fw-list-all - List all firewall rules in the complete policy,\n"
" including those that have nothing to with fwknop.\n"
" including those that have nothing to do with\n"
" fwknop.\n"
" --fw-flush - Flush all firewall rules created by fwknop.\n"
"\n"
);
server/fw_util.h
+1 -1
View File
@@ -60,7 +60,7 @@
*/
void fw_config_init(fko_srv_options_t *opts);
void fw_initialize(const fko_srv_options_t *opts);
int fw_cleanup(void);
int fw_cleanup(const fko_srv_options_t *opts);
void check_firewall_rules(const fko_srv_options_t *opts);
int fw_dump_rules(const fko_srv_options_t *opts);
int process_spa_request(const fko_srv_options_t *opts, spa_data_t *spdat);
server/fw_util_ipfw.c
+72 -24
View File
@@ -66,7 +66,8 @@ zero_cmd_buffers(void)
}
static int
ipfw_set_exists(const char *fw_command, const unsigned short set_num)
ipfw_set_exists(const fko_srv_options_t *opts,
const char *fw_command, const unsigned short set_num)
{
int res = 0;
@@ -79,6 +80,10 @@ ipfw_set_exists(const char *fw_command, const unsigned short set_num)
res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "ipfw_set_exists() CMD: '%s' (res: %d)",
cmd_buf, res);
if(!EXTCMD_IS_SUCCESS(res))
return(0);
@@ -111,6 +116,10 @@ fw_dump_rules(const fko_srv_options_t *opts)
res = system(cmd_buf);
if (opts->verbose)
log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
cmd_buf, res);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
{
@@ -132,10 +141,13 @@ fw_dump_rules(const fko_srv_options_t *opts)
opts->fw_config->active_set_num
);
//printf("(%i) CMD: '%s'\n", i, cmd_buf);
printf("\nActive Rules:\n");
res = system(cmd_buf);
if (opts->verbose)
log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
cmd_buf, res);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
{
@@ -150,10 +162,13 @@ fw_dump_rules(const fko_srv_options_t *opts)
opts->fw_config->expire_set_num
);
//printf("(%i) CMD: '%s'\n", i, cmd_buf);
printf("\nExpired Rules:\n");
res = system(cmd_buf);
if (opts->verbose)
log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
cmd_buf, res);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
{
@@ -197,7 +212,7 @@ fw_initialize(const fko_srv_options_t *opts)
/* For now, we just call fw_cleanup to start with clean slate.
*/
res = fw_cleanup();
res = fw_cleanup(opts);
if(res != 0)
{
@@ -229,6 +244,10 @@ fw_initialize(const fko_srv_options_t *opts)
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "fw_initialize() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_INFO, "Added check-state rule %u to set %u",
@@ -253,11 +272,15 @@ fw_initialize(const fko_srv_options_t *opts)
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "fw_initialize() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
log_msg(LOG_INFO, "Set ipfw set %u to disabled.",
fwc.expire_set_num);
else
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
/* Now read the expire set in case there are existing
* rules to track.
@@ -271,14 +294,18 @@ fw_initialize(const fko_srv_options_t *opts)
res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "fw_initialize() CMD: '%s' (res: %d)",
cmd_buf, res);
if(!EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
return;
}
if(opts->verbose > 2)
log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nRULES LIST: %s", res, cmd_buf, cmd_out);
if(opts->verbose > 1)
log_msg(LOG_INFO, "RULES LIST: %s", cmd_out);
/* Find the first "# DISABLED" string (if any).
*/
@@ -320,14 +347,14 @@ fw_initialize(const fko_srv_options_t *opts)
int
fw_cleanup(void)
fw_cleanup(const fko_srv_options_t *opts)
{
int res, got_err = 0;
zero_cmd_buffers();
if(fwc.active_set_num > 0
&& ipfw_set_exists(fwc.fw_command, fwc.active_set_num))
&& ipfw_set_exists(opts, fwc.fw_command, fwc.active_set_num))
{
/* Create the set delete command for active rules
*/
@@ -336,9 +363,12 @@ fw_cleanup(void)
fwc.active_set_num
);
//printf("CMD: '%s'\n", cmd_buf);
res = system(cmd_buf);
if (opts->verbose)
log_msg(LOG_INFO, "fw_cleanup() CMD: '%s' (res: %d)",
cmd_buf, res);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
{
@@ -453,9 +483,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
exp_ts
);
//--DSS tmp
//fprintf(stderr, "ADD CMD: %s\n", cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_INFO, "Added Rule %u for %s, %s expires at %u",
@@ -545,14 +578,18 @@ check_firewall_rules(const fko_srv_options_t *opts)
res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d)",
cmd_buf, res);
if(!EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
return;
}
if(opts->verbose > 2)
log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nRULES LIST: %s", res, cmd_buf, cmd_out);
if(opts->verbose > 1)
log_msg(LOG_INFO, "RULES LIST: %s", cmd_out);
/* Find the first _exp_ string (if any).
*/
@@ -586,7 +623,6 @@ check_firewall_rules(const fko_srv_options_t *opts)
strlcpy(exp_str, ndx, 11);
rule_exp = (time_t)atoll(exp_str);
//fprintf(stderr, "RULE_EXP=%u, NOW=%u\n", rule_exp, now);
if(rule_exp <= now)
{
/* Backtrack and get the rule number and delete it.
@@ -646,8 +682,12 @@ check_firewall_rules(const fko_srv_options_t *opts)
fwc.expire_set_num
);
//fprintf(stderr, "MOVE RULE CMD: %s\n", cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_INFO, "Moved rule %s with expire time of %u to set %u.",
@@ -660,7 +700,7 @@ check_firewall_rules(const fko_srv_options_t *opts)
fwc.rule_map[curr_rule - fwc.start_rule_num] = RULE_EXPIRED;
}
else
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
}
else
{
@@ -710,9 +750,13 @@ ipfw_purge_expired_rules(const fko_srv_options_t *opts)
res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "ipfw_purge_expired_rules() CMD: '%s' (res: %d)",
cmd_buf, res);
if(!EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
return;
}
@@ -723,8 +767,8 @@ ipfw_purge_expired_rules(const fko_srv_options_t *opts)
{
co_end = cmd_out + strlen(cmd_out);
if(opts->verbose > 2)
log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nEXP RULES LIST: %s", res, cmd_buf, cmd_out);
if(opts->verbose > 1)
log_msg(LOG_INFO, "EXP RULES LIST: %s", cmd_out);
/* Find the "## Dynamic rules" string.
*/
@@ -810,13 +854,17 @@ ipfw_purge_expired_rules(const fko_srv_options_t *opts)
res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "ipfw_purge_expired_rules() CMD: '%s' (res: %d)",
cmd_buf, res);
if(!EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
continue;
}
log_msg(LOG_INFO, "Purged rule %u from set %u", curr_rule, fwc.expire_set_num);
log_msg(LOG_INFO, "Purged rule %u from set %u", curr_rule, fwc.expire_set_num);
fwc.rule_map[curr_rule - fwc.start_rule_num] = RULE_FREE;
server/fw_util_iptables.c
+76 -32
View File
@@ -53,7 +53,7 @@ zero_cmd_buffers(void)
}
static int
add_jump_rule(const int chain_num)
add_jump_rule(const fko_srv_options_t *opts, const int chain_num)
{
int res = 0;
@@ -67,9 +67,12 @@ add_jump_rule(const int chain_num)
fwc.chain[chain_num].to_chain
);
//printf("(%i) CMD: '%s'\n", i, cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "add_jump_rule() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
log_msg(LOG_INFO, "Added jump rule from chain: %s to chain: %s",
fwc.chain[chain_num].from_chain,
@@ -158,9 +161,12 @@ fw_dump_rules(const fko_srv_options_t *opts)
ch[i].table
);
//printf("(%i) CMD: '%s'\n", i, cmd_buf);
res = system(cmd_buf);
if (opts->verbose)
log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
cmd_buf, res);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
{
@@ -190,9 +196,12 @@ fw_dump_rules(const fko_srv_options_t *opts)
ch[i].to_chain
);
//printf("(%i) CMD: '%s'\n", i, cmd_buf);
res = system(cmd_buf);
if (opts->verbose)
log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
cmd_buf, res);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
{
@@ -208,7 +217,7 @@ fw_dump_rules(const fko_srv_options_t *opts)
/* Quietly flush and delete all fwknop custom chains.
*/
static void
delete_all_chains(void)
delete_all_chains(const fko_srv_options_t *opts)
{
int i, res;
int jump_rule_num;
@@ -232,11 +241,15 @@ delete_all_chains(void)
jump_rule_num
);
//printf("CMD: '%s'\n", cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "delete_all_chains() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
}
zero_cmd_buffers();
@@ -253,18 +266,22 @@ delete_all_chains(void)
fwc.chain[i].to_chain
);
//printf("CMD: '%s'\n", cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "delete_all_chains() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
}
}
/* Create the fwknop custom chains (at least those that are configured).
*/
static int
create_fw_chains(void)
create_fw_chains(const fko_srv_options_t *opts)
{
int i;
int res, got_err = 0;
@@ -284,19 +301,22 @@ create_fw_chains(void)
fwc.chain[i].to_chain
);
//printf("(%i) CMD: '%s'\n", i, cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "create_fw_chains() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
got_err++;
}
/* Then create the jump rule to that chain.
*/
res = add_jump_rule(i);
res = add_jump_rule(opts, i);
/* Expect full success on this */
if(! EXTCMD_IS_SUCCESS(res))
@@ -434,11 +454,11 @@ fw_initialize(const fko_srv_options_t *opts)
/* Flush the chains (just in case) so we can start fresh.
*/
delete_all_chains();
delete_all_chains(opts);
/* Now create any configured chains.
*/
res = create_fw_chains();
res = create_fw_chains(opts);
if(res != 0)
{
@@ -448,9 +468,9 @@ fw_initialize(const fko_srv_options_t *opts)
}
int
fw_cleanup(void)
fw_cleanup(const fko_srv_options_t *opts)
{
delete_all_chains();
delete_all_chains(opts);
return(0);
}
@@ -513,11 +533,11 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
* required chain
*/
if(jump_rule_exists(IPT_INPUT_ACCESS) == 0)
add_jump_rule(IPT_INPUT_ACCESS);
add_jump_rule(opts, IPT_INPUT_ACCESS);
if(out_chain->to_chain != NULL && strlen(out_chain->to_chain))
if(jump_rule_exists(IPT_OUTPUT_ACCESS) == 0)
add_jump_rule(IPT_OUTPUT_ACCESS);
add_jump_rule(opts, IPT_OUTPUT_ACCESS);
/* Create an access command for each proto/port for the source ip.
*/
@@ -536,9 +556,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
in_chain->target
);
//--DSS tmp
//fprintf(stderr, "ADD CMD: %s\n", cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_INFO, "Added Rule to %s for %s, %s expires at %u",
@@ -575,9 +598,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
out_chain->target
);
//--DSS tmp
//fprintf(stderr, "ADD OUTPUT CMD: %s\n", cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_INFO, "Added OUTPUT Rule to %s for %s, %s expires at %u",
@@ -632,7 +658,7 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
/* Make sure the required jump rule exists
*/
if (jump_rule_exists(IPT_FORWARD_ACCESS) == 0)
add_jump_rule(IPT_FORWARD_ACCESS);
add_jump_rule(opts, IPT_FORWARD_ACCESS);
zero_cmd_buffers();
@@ -648,9 +674,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
fwd_chain->target
);
//--DSS tmp
//fprintf(stderr, "ADD OUTPUT CMD: %s\n", cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_INFO, "Added FORWARD Rule to %s for %s, %s expires at %u",
@@ -676,7 +705,7 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
/* Make sure the required jump rule exists
*/
if (jump_rule_exists(IPT_DNAT_ACCESS) == 0)
add_jump_rule(IPT_DNAT_ACCESS);
add_jump_rule(opts, IPT_DNAT_ACCESS);
zero_cmd_buffers();
@@ -693,9 +722,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
nat_port
);
//--DSS tmp
//fprintf(stderr, "ADD DNAT CMD: %s\n", cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_INFO, "Added DNAT Rule to %s for %s, %s expires at %u",
@@ -753,6 +785,11 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_INFO, "Added Source NAT Rule to %s for %s, %s expires at %u",
@@ -818,13 +855,17 @@ check_firewall_rules(const fko_srv_options_t *opts)
res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(!EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
continue;
}
if(opts->verbose > 2)
if(opts->verbose > 1)
log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nRULES LIST: %s", res, cmd_buf, cmd_out);
ndx = strstr(cmd_out, EXPIRE_COMMENT_PREFIX);
@@ -856,7 +897,6 @@ check_firewall_rules(const fko_srv_options_t *opts)
strlcpy(exp_str, ndx, 11);
rule_exp = (time_t)atoll(exp_str);
//fprintf(stderr, "RULE_EXP=%u, NOW=%u\n", rule_exp, now);
if(rule_exp <= now)
{
/* Backtrack and get the rule number and delete it.
@@ -910,8 +950,12 @@ check_firewall_rules(const fko_srv_options_t *opts)
);
//fprintf(stderr, "DELETE RULE CMD: %s\n", cmd_buf);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
if (opts->verbose)
log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d, err: %s)",
cmd_buf, res, err_buf);
if(EXTCMD_IS_SUCCESS(res))
{
log_msg(LOG_INFO, "Removed rule %s from %s with expire time of %u.",
server/fw_util_pf.c
+3 -3
View File
@@ -135,7 +135,7 @@ anchor_active(const fko_srv_options_t *opts)
}
static void
delete_all_anchor_rules(void)
delete_all_anchor_rules(const fko_srv_options_t *opts)
{
int res = 0;
@@ -193,9 +193,9 @@ fw_initialize(const fko_srv_options_t *opts)
}
int
fw_cleanup(void)
fw_cleanup(const fko_srv_options_t *opts)
{
delete_all_anchor_rules();
delete_all_anchor_rules(opts);
return(0);
}
server/fwknopd.c
+2 -2
View File
@@ -185,7 +185,7 @@ main(int argc, char **argv)
if(opts.fw_flush == 1)
{
fprintf(stdout, "Deleting any existing firewall rules...\n");
fw_cleanup();
fw_cleanup(&opts);
exit(EXIT_SUCCESS);
}
@@ -367,7 +367,7 @@ main(int argc, char **argv)
/* Other cleanup.
*/
fw_cleanup();
fw_cleanup(&opts);
free_logging();
#if USE_FILE_CACHE
server/incoming_spa.c
+2 -2
View File
@@ -326,7 +326,7 @@ incoming_spa(fko_srv_options_t *opts)
/* At this point, we assume the SPA data is valid. Now we need to see
* if it meets our access criteria.
*/
if(opts->verbose > 2)
if(opts->verbose > 1)
log_msg(LOG_INFO, "SPA Decode (res=%i):\n%s", res, dump_ctx(ctx));
/* First, if this is a GPG message, and GPG_REMOTE_ID list is not empty,
@@ -498,7 +498,7 @@ incoming_spa(fko_srv_options_t *opts)
*/
status = WEXITSTATUS(res);
if(opts->verbose > 2)
if(opts->verbose > 1)
log_msg(LOG_WARNING,
"CMD_EXEC: command returned %i", status);
server/log_msg.c
+1 -1
View File
@@ -66,7 +66,7 @@ init_logging(fko_srv_options_t *opts) {
/* In case this is a re-init.
*/
free_logging();
/* Allocate memory for the log_name and set the my_name to point to the
* appropriate name. The name should already be set in the config struct
* but if it is not, fallback to the default as defined by 'MY_NAME'.
test/test-fwknop.pl
+18 -41
View File
@@ -87,7 +87,7 @@ exit 1 unless GetOptions(
&identify_loopback_intf();
my $default_client_args = "LD_LIBRARY_PATH=$lib_dir $fwknopCmd -A tcp/22 -a $fake_ip " .
"-D $loopback_ip --get-key $local_key_file --verbose";
"-D $loopback_ip --get-key $local_key_file --verbose --verbose";
my $default_client_gpg_args = "LD_LIBRARY_PATH=$lib_dir $default_client_args " .
"--gpg-recipient-key $gpg_server_key " .
@@ -98,7 +98,7 @@ my $default_server_conf_args = "-c $default_conf -a $default_access_conf " .
"-d $default_digest_file -p $default_pid_file";
my $default_server_gpg_args = "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd -c $default_conf " .
"-a $gpg_access_conf -i $loopback_intf --foreground --verbose " .
"-a $gpg_access_conf -i $loopback_intf --foreground --verbose --verbose " .
"-d $default_digest_file -p $default_pid_file";
### point the compiled binaries at the local libary path
@@ -437,7 +437,7 @@ my @tests = (
'err_msg' => 'start error',
'function' => \&server_start,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose",
"-i $loopback_intf --foreground --verbose --verbose",
'fatal' => $NO
},
{
@@ -447,7 +447,7 @@ my @tests = (
'err_msg' => 'stop error',
'function' => \&server_stop,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose",
"-i $loopback_intf --foreground --verbose --verbose",
'fatal' => $NO
},
{
@@ -457,7 +457,7 @@ my @tests = (
'err_msg' => 'did not write PID',
'function' => \&write_pid,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose",
"-i $loopback_intf --foreground --verbose --verbose",
'fatal' => $NO
},
@@ -468,7 +468,7 @@ my @tests = (
'err_msg' => 'did not exit after one packet',
'function' => \&server_packet_limit,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --packet-limit 1 --foreground --verbose",
"-i $loopback_intf --packet-limit 1 --foreground --verbose --verbose",
'fatal' => $NO
},
{
@@ -478,7 +478,7 @@ my @tests = (
'err_msg' => 'did not ignore small packets',
'function' => \&server_ignore_small_packets,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --packet-limit 1 --foreground --verbose",
"-i $loopback_intf --packet-limit 1 --foreground --verbose --verbose",
'fatal' => $NO
},
{
@@ -489,7 +489,7 @@ my @tests = (
'function' => \&server_bpf_ignore_packet,
'cmdline' => $default_client_args,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --packet-limit 1 --foreground --verbose " .
"-i $loopback_intf --packet-limit 1 --foreground --verbose --verbose " .
qq|-P "udp port $non_std_spa_port"|,
'fatal' => $NO
},
@@ -502,7 +502,7 @@ my @tests = (
'function' => \&spa_cycle,
'cmdline' => $default_client_args,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose",
"-i $loopback_intf --foreground --verbose --verbose",
'fatal' => $NO
},
{
@@ -513,7 +513,7 @@ my @tests = (
'function' => \&spa_over_non_std_port,
'cmdline' => "$default_client_args --server-port $non_std_spa_port",
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose " .
"-i $loopback_intf --foreground --verbose --verbose " .
qq|-P "udp port $non_std_spa_port"|,
'fatal' => $NO
},
@@ -525,7 +525,7 @@ my @tests = (
'function' => \&replay_detection,
'cmdline' => $default_client_args,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose",
"-i $loopback_intf --foreground --verbose --verbose",
'fatal' => $NO
},
{
@@ -545,7 +545,7 @@ my @tests = (
'function' => \&altered_non_base64_spa_data,
'cmdline' => $default_client_args,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose",
"-i $loopback_intf --foreground --verbose --verbose",
'fatal' => $NO
},
{
@@ -556,7 +556,7 @@ my @tests = (
'function' => \&altered_base64_spa_data,
'cmdline' => $default_client_args,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose",
"-i $loopback_intf --foreground --verbose --verbose",
'fatal' => $NO
},
{
@@ -567,7 +567,7 @@ my @tests = (
'function' => \&appended_spa_data,
'cmdline' => $default_client_args,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose",
"-i $loopback_intf --foreground --verbose --verbose",
'fatal' => $NO
},
{
@@ -578,7 +578,7 @@ my @tests = (
'function' => \&prepended_spa_data,
'cmdline' => $default_client_args,
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
"-i $loopback_intf --foreground --verbose",
"-i $loopback_intf --foreground --verbose --verbose",
'fatal' => $NO
},
@@ -892,7 +892,7 @@ sub spa_cycle() {
my $rv = &client_server_interaction($test_hr, [],
$USE_CLIENT, $REQUIRE_FW_RULE, $NO_FORCE_STOP);
sleep 2;
sleep 3;
### the firewall rule should be timed out (3 second timeout
### as defined in the access.conf file
@@ -920,30 +920,7 @@ sub spa_cycle() {
sub spa_over_non_std_port() {
my $test_hr = shift;
my $rv = &client_server_interaction($test_hr, [],
$USE_CLIENT, $REQUIRE_FW_RULE, $NO_FORCE_STOP);
sleep 2;
### the firewall rule should be timed out (3 second timeout
### as defined in the access.conf file
if (&is_fw_rule_active()) {
&write_test_file("[-] new fw rule not timed out.\n");
$rv = 0;
} else {
&write_test_file("[+] new fw rule timed out.\n");
}
if (&is_fwknopd_running()) {
&stop_fwknopd();
unless (&file_find_regex([qr/Got\sSIGTERM/],
$server_test_file)) {
$rv = 0;
}
} else {
&write_test_file("[-] server is not running.\n");
$rv = 0;
}
my $rv = &spa_cycle($test_hr);
unless (&file_find_regex([qr/PCAP\sfilter.*\s$non_std_spa_port/],
$server_test_file)) {
@@ -1897,7 +1874,7 @@ sub identify_loopback_intf() {
sub is_fw_rule_active() {
return 1 if &run_cmd("LD_LIBRARY_PATH=$lib_dir $fwknopdCmd " .
"$default_server_conf_args " .
"--fw-list | grep $fake_ip |grep _exp_",
qq{--fw-list | grep -v "# DISABLED" |grep $fake_ip |grep _exp_},
$cmd_out_tmp, $current_test_file);
return 0;
}