diff --git a/server/access.c b/server/access.c index f9be30cf..7b5204f4 100644 --- a/server/access.c +++ b/server/access.c @@ -1074,6 +1074,7 @@ dump_access_list(const fko_srv_options_t *opts) } fprintf(stdout, "\n"); + fflush(stdout); } /***EOF***/ diff --git a/server/config_init.c b/server/config_init.c index 5e382823..75c49de7 100644 --- a/server/config_init.c +++ b/server/config_init.c @@ -745,6 +745,7 @@ dump_config(const fko_srv_options_t *opts) ); fprintf(stdout, "\n"); + fflush(stdout); } /* Print usage message... @@ -785,7 +786,8 @@ usage(void) " --fw-list - List all firewall rules that fwknop has created\n" " and then exit.\n" " --fw-list-all - List all firewall rules in the complete policy,\n" - " including those that have nothing to with fwknop.\n" + " including those that have nothing to do with\n" + " fwknop.\n" " --fw-flush - Flush all firewall rules created by fwknop.\n" "\n" ); diff --git a/server/fw_util.h b/server/fw_util.h index 7045719a..b5afc1bd 100644 --- a/server/fw_util.h +++ b/server/fw_util.h @@ -60,7 +60,7 @@ */ void fw_config_init(fko_srv_options_t *opts); void fw_initialize(const fko_srv_options_t *opts); -int fw_cleanup(void); +int fw_cleanup(const fko_srv_options_t *opts); void check_firewall_rules(const fko_srv_options_t *opts); int fw_dump_rules(const fko_srv_options_t *opts); int process_spa_request(const fko_srv_options_t *opts, spa_data_t *spdat); diff --git a/server/fw_util_ipfw.c b/server/fw_util_ipfw.c index 2811e324..30522a81 100644 --- a/server/fw_util_ipfw.c +++ b/server/fw_util_ipfw.c @@ -66,7 +66,8 @@ zero_cmd_buffers(void) } static int -ipfw_set_exists(const char *fw_command, const unsigned short set_num) +ipfw_set_exists(const fko_srv_options_t *opts, + const char *fw_command, const unsigned short set_num) { int res = 0; @@ -79,6 +80,10 @@ ipfw_set_exists(const char *fw_command, const unsigned short set_num) res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "ipfw_set_exists() CMD: '%s' (res: %d)", + cmd_buf, res); + if(!EXTCMD_IS_SUCCESS(res)) return(0); @@ -111,6 +116,10 @@ fw_dump_rules(const fko_srv_options_t *opts) res = system(cmd_buf); + if (opts->verbose) + log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)", + cmd_buf, res); + /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) { @@ -132,10 +141,13 @@ fw_dump_rules(const fko_srv_options_t *opts) opts->fw_config->active_set_num ); - //printf("(%i) CMD: '%s'\n", i, cmd_buf); printf("\nActive Rules:\n"); res = system(cmd_buf); + if (opts->verbose) + log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)", + cmd_buf, res); + /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) { @@ -150,10 +162,13 @@ fw_dump_rules(const fko_srv_options_t *opts) opts->fw_config->expire_set_num ); - //printf("(%i) CMD: '%s'\n", i, cmd_buf); printf("\nExpired Rules:\n"); res = system(cmd_buf); + if (opts->verbose) + log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)", + cmd_buf, res); + /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) { @@ -197,7 +212,7 @@ fw_initialize(const fko_srv_options_t *opts) /* For now, we just call fw_cleanup to start with clean slate. */ - res = fw_cleanup(); + res = fw_cleanup(opts); if(res != 0) { @@ -229,6 +244,10 @@ fw_initialize(const fko_srv_options_t *opts) res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "fw_initialize() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_INFO, "Added check-state rule %u to set %u", @@ -253,11 +272,15 @@ fw_initialize(const fko_srv_options_t *opts) res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "fw_initialize() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) log_msg(LOG_INFO, "Set ipfw set %u to disabled.", fwc.expire_set_num); else - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); /* Now read the expire set in case there are existing * rules to track. @@ -271,14 +294,18 @@ fw_initialize(const fko_srv_options_t *opts) res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "fw_initialize() CMD: '%s' (res: %d)", + cmd_buf, res); + if(!EXTCMD_IS_SUCCESS(res)) { - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); return; } - if(opts->verbose > 2) - log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nRULES LIST: %s", res, cmd_buf, cmd_out); + if(opts->verbose > 1) + log_msg(LOG_INFO, "RULES LIST: %s", cmd_out); /* Find the first "# DISABLED" string (if any). */ @@ -320,14 +347,14 @@ fw_initialize(const fko_srv_options_t *opts) int -fw_cleanup(void) +fw_cleanup(const fko_srv_options_t *opts) { int res, got_err = 0; zero_cmd_buffers(); if(fwc.active_set_num > 0 - && ipfw_set_exists(fwc.fw_command, fwc.active_set_num)) + && ipfw_set_exists(opts, fwc.fw_command, fwc.active_set_num)) { /* Create the set delete command for active rules */ @@ -336,9 +363,12 @@ fw_cleanup(void) fwc.active_set_num ); - //printf("CMD: '%s'\n", cmd_buf); res = system(cmd_buf); + if (opts->verbose) + log_msg(LOG_INFO, "fw_cleanup() CMD: '%s' (res: %d)", + cmd_buf, res); + /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) { @@ -453,9 +483,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat) exp_ts ); -//--DSS tmp -//fprintf(stderr, "ADD CMD: %s\n", cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_INFO, "Added Rule %u for %s, %s expires at %u", @@ -545,14 +578,18 @@ check_firewall_rules(const fko_srv_options_t *opts) res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d)", + cmd_buf, res); + if(!EXTCMD_IS_SUCCESS(res)) { - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); return; } - if(opts->verbose > 2) - log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nRULES LIST: %s", res, cmd_buf, cmd_out); + if(opts->verbose > 1) + log_msg(LOG_INFO, "RULES LIST: %s", cmd_out); /* Find the first _exp_ string (if any). */ @@ -586,7 +623,6 @@ check_firewall_rules(const fko_srv_options_t *opts) strlcpy(exp_str, ndx, 11); rule_exp = (time_t)atoll(exp_str); -//fprintf(stderr, "RULE_EXP=%u, NOW=%u\n", rule_exp, now); if(rule_exp <= now) { /* Backtrack and get the rule number and delete it. @@ -646,8 +682,12 @@ check_firewall_rules(const fko_srv_options_t *opts) fwc.expire_set_num ); -//fprintf(stderr, "MOVE RULE CMD: %s\n", cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_INFO, "Moved rule %s with expire time of %u to set %u.", @@ -660,7 +700,7 @@ check_firewall_rules(const fko_srv_options_t *opts) fwc.rule_map[curr_rule - fwc.start_rule_num] = RULE_EXPIRED; } else - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); } else { @@ -710,9 +750,13 @@ ipfw_purge_expired_rules(const fko_srv_options_t *opts) res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "ipfw_purge_expired_rules() CMD: '%s' (res: %d)", + cmd_buf, res); + if(!EXTCMD_IS_SUCCESS(res)) { - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); return; } @@ -723,8 +767,8 @@ ipfw_purge_expired_rules(const fko_srv_options_t *opts) { co_end = cmd_out + strlen(cmd_out); - if(opts->verbose > 2) - log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nEXP RULES LIST: %s", res, cmd_buf, cmd_out); + if(opts->verbose > 1) + log_msg(LOG_INFO, "EXP RULES LIST: %s", cmd_out); /* Find the "## Dynamic rules" string. */ @@ -810,13 +854,17 @@ ipfw_purge_expired_rules(const fko_srv_options_t *opts) res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "ipfw_purge_expired_rules() CMD: '%s' (res: %d)", + cmd_buf, res); + if(!EXTCMD_IS_SUCCESS(res)) { - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); continue; } - log_msg(LOG_INFO, "Purged rule %u from set %u", curr_rule, fwc.expire_set_num); + log_msg(LOG_INFO, "Purged rule %u from set %u", curr_rule, fwc.expire_set_num); fwc.rule_map[curr_rule - fwc.start_rule_num] = RULE_FREE; diff --git a/server/fw_util_iptables.c b/server/fw_util_iptables.c index d4e0799d..bf38b4f3 100644 --- a/server/fw_util_iptables.c +++ b/server/fw_util_iptables.c @@ -53,7 +53,7 @@ zero_cmd_buffers(void) } static int -add_jump_rule(const int chain_num) +add_jump_rule(const fko_srv_options_t *opts, const int chain_num) { int res = 0; @@ -67,9 +67,12 @@ add_jump_rule(const int chain_num) fwc.chain[chain_num].to_chain ); - //printf("(%i) CMD: '%s'\n", i, cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "add_jump_rule() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) log_msg(LOG_INFO, "Added jump rule from chain: %s to chain: %s", fwc.chain[chain_num].from_chain, @@ -158,9 +161,12 @@ fw_dump_rules(const fko_srv_options_t *opts) ch[i].table ); - //printf("(%i) CMD: '%s'\n", i, cmd_buf); res = system(cmd_buf); + if (opts->verbose) + log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)", + cmd_buf, res); + /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) { @@ -190,9 +196,12 @@ fw_dump_rules(const fko_srv_options_t *opts) ch[i].to_chain ); - //printf("(%i) CMD: '%s'\n", i, cmd_buf); res = system(cmd_buf); + if (opts->verbose) + log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)", + cmd_buf, res); + /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) { @@ -208,7 +217,7 @@ fw_dump_rules(const fko_srv_options_t *opts) /* Quietly flush and delete all fwknop custom chains. */ static void -delete_all_chains(void) +delete_all_chains(const fko_srv_options_t *opts) { int i, res; int jump_rule_num; @@ -232,11 +241,15 @@ delete_all_chains(void) jump_rule_num ); - //printf("CMD: '%s'\n", cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "delete_all_chains() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); } zero_cmd_buffers(); @@ -253,18 +266,22 @@ delete_all_chains(void) fwc.chain[i].to_chain ); - //printf("CMD: '%s'\n", cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "delete_all_chains() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); } } /* Create the fwknop custom chains (at least those that are configured). */ static int -create_fw_chains(void) +create_fw_chains(const fko_srv_options_t *opts) { int i; int res, got_err = 0; @@ -284,19 +301,22 @@ create_fw_chains(void) fwc.chain[i].to_chain ); - //printf("(%i) CMD: '%s'\n", i, cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "create_fw_chains() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) { - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); got_err++; } /* Then create the jump rule to that chain. */ - res = add_jump_rule(i); + res = add_jump_rule(opts, i); /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) @@ -434,11 +454,11 @@ fw_initialize(const fko_srv_options_t *opts) /* Flush the chains (just in case) so we can start fresh. */ - delete_all_chains(); + delete_all_chains(opts); /* Now create any configured chains. */ - res = create_fw_chains(); + res = create_fw_chains(opts); if(res != 0) { @@ -448,9 +468,9 @@ fw_initialize(const fko_srv_options_t *opts) } int -fw_cleanup(void) +fw_cleanup(const fko_srv_options_t *opts) { - delete_all_chains(); + delete_all_chains(opts); return(0); } @@ -513,11 +533,11 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat) * required chain */ if(jump_rule_exists(IPT_INPUT_ACCESS) == 0) - add_jump_rule(IPT_INPUT_ACCESS); + add_jump_rule(opts, IPT_INPUT_ACCESS); if(out_chain->to_chain != NULL && strlen(out_chain->to_chain)) if(jump_rule_exists(IPT_OUTPUT_ACCESS) == 0) - add_jump_rule(IPT_OUTPUT_ACCESS); + add_jump_rule(opts, IPT_OUTPUT_ACCESS); /* Create an access command for each proto/port for the source ip. */ @@ -536,9 +556,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat) in_chain->target ); -//--DSS tmp -//fprintf(stderr, "ADD CMD: %s\n", cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_INFO, "Added Rule to %s for %s, %s expires at %u", @@ -575,9 +598,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat) out_chain->target ); -//--DSS tmp -//fprintf(stderr, "ADD OUTPUT CMD: %s\n", cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_INFO, "Added OUTPUT Rule to %s for %s, %s expires at %u", @@ -632,7 +658,7 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat) /* Make sure the required jump rule exists */ if (jump_rule_exists(IPT_FORWARD_ACCESS) == 0) - add_jump_rule(IPT_FORWARD_ACCESS); + add_jump_rule(opts, IPT_FORWARD_ACCESS); zero_cmd_buffers(); @@ -648,9 +674,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat) fwd_chain->target ); -//--DSS tmp -//fprintf(stderr, "ADD OUTPUT CMD: %s\n", cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_INFO, "Added FORWARD Rule to %s for %s, %s expires at %u", @@ -676,7 +705,7 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat) /* Make sure the required jump rule exists */ if (jump_rule_exists(IPT_DNAT_ACCESS) == 0) - add_jump_rule(IPT_DNAT_ACCESS); + add_jump_rule(opts, IPT_DNAT_ACCESS); zero_cmd_buffers(); @@ -693,9 +722,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat) nat_port ); -//--DSS tmp -//fprintf(stderr, "ADD DNAT CMD: %s\n", cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_INFO, "Added DNAT Rule to %s for %s, %s expires at %u", @@ -753,6 +785,11 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat) ); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_INFO, "Added Source NAT Rule to %s for %s, %s expires at %u", @@ -818,13 +855,17 @@ check_firewall_rules(const fko_srv_options_t *opts) res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0); + if (opts->verbose) + log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(!EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); continue; } - if(opts->verbose > 2) + if(opts->verbose > 1) log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nRULES LIST: %s", res, cmd_buf, cmd_out); ndx = strstr(cmd_out, EXPIRE_COMMENT_PREFIX); @@ -856,7 +897,6 @@ check_firewall_rules(const fko_srv_options_t *opts) strlcpy(exp_str, ndx, 11); rule_exp = (time_t)atoll(exp_str); -//fprintf(stderr, "RULE_EXP=%u, NOW=%u\n", rule_exp, now); if(rule_exp <= now) { /* Backtrack and get the rule number and delete it. @@ -910,8 +950,12 @@ check_firewall_rules(const fko_srv_options_t *opts) ); -//fprintf(stderr, "DELETE RULE CMD: %s\n", cmd_buf); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); + + if (opts->verbose) + log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d, err: %s)", + cmd_buf, res, err_buf); + if(EXTCMD_IS_SUCCESS(res)) { log_msg(LOG_INFO, "Removed rule %s from %s with expire time of %u.", diff --git a/server/fw_util_pf.c b/server/fw_util_pf.c index ac26c00c..0fe2ce69 100644 --- a/server/fw_util_pf.c +++ b/server/fw_util_pf.c @@ -135,7 +135,7 @@ anchor_active(const fko_srv_options_t *opts) } static void -delete_all_anchor_rules(void) +delete_all_anchor_rules(const fko_srv_options_t *opts) { int res = 0; @@ -193,9 +193,9 @@ fw_initialize(const fko_srv_options_t *opts) } int -fw_cleanup(void) +fw_cleanup(const fko_srv_options_t *opts) { - delete_all_anchor_rules(); + delete_all_anchor_rules(opts); return(0); } diff --git a/server/fwknopd.c b/server/fwknopd.c index bae14318..efe857b5 100644 --- a/server/fwknopd.c +++ b/server/fwknopd.c @@ -185,7 +185,7 @@ main(int argc, char **argv) if(opts.fw_flush == 1) { fprintf(stdout, "Deleting any existing firewall rules...\n"); - fw_cleanup(); + fw_cleanup(&opts); exit(EXIT_SUCCESS); } @@ -367,7 +367,7 @@ main(int argc, char **argv) /* Other cleanup. */ - fw_cleanup(); + fw_cleanup(&opts); free_logging(); #if USE_FILE_CACHE diff --git a/server/incoming_spa.c b/server/incoming_spa.c index 37f6ad1d..915a6711 100644 --- a/server/incoming_spa.c +++ b/server/incoming_spa.c @@ -326,7 +326,7 @@ incoming_spa(fko_srv_options_t *opts) /* At this point, we assume the SPA data is valid. Now we need to see * if it meets our access criteria. */ - if(opts->verbose > 2) + if(opts->verbose > 1) log_msg(LOG_INFO, "SPA Decode (res=%i):\n%s", res, dump_ctx(ctx)); /* First, if this is a GPG message, and GPG_REMOTE_ID list is not empty, @@ -498,7 +498,7 @@ incoming_spa(fko_srv_options_t *opts) */ status = WEXITSTATUS(res); - if(opts->verbose > 2) + if(opts->verbose > 1) log_msg(LOG_WARNING, "CMD_EXEC: command returned %i", status); diff --git a/server/log_msg.c b/server/log_msg.c index d0e4ef7e..f680c2a6 100644 --- a/server/log_msg.c +++ b/server/log_msg.c @@ -66,7 +66,7 @@ init_logging(fko_srv_options_t *opts) { /* In case this is a re-init. */ free_logging(); - + /* Allocate memory for the log_name and set the my_name to point to the * appropriate name. The name should already be set in the config struct * but if it is not, fallback to the default as defined by 'MY_NAME'. diff --git a/test/test-fwknop.pl b/test/test-fwknop.pl index 18a1fab8..b4faaba9 100755 --- a/test/test-fwknop.pl +++ b/test/test-fwknop.pl @@ -87,7 +87,7 @@ exit 1 unless GetOptions( &identify_loopback_intf(); my $default_client_args = "LD_LIBRARY_PATH=$lib_dir $fwknopCmd -A tcp/22 -a $fake_ip " . - "-D $loopback_ip --get-key $local_key_file --verbose"; + "-D $loopback_ip --get-key $local_key_file --verbose --verbose"; my $default_client_gpg_args = "LD_LIBRARY_PATH=$lib_dir $default_client_args " . "--gpg-recipient-key $gpg_server_key " . @@ -98,7 +98,7 @@ my $default_server_conf_args = "-c $default_conf -a $default_access_conf " . "-d $default_digest_file -p $default_pid_file"; my $default_server_gpg_args = "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd -c $default_conf " . - "-a $gpg_access_conf -i $loopback_intf --foreground --verbose " . + "-a $gpg_access_conf -i $loopback_intf --foreground --verbose --verbose " . "-d $default_digest_file -p $default_pid_file"; ### point the compiled binaries at the local libary path @@ -437,7 +437,7 @@ my @tests = ( 'err_msg' => 'start error', 'function' => \&server_start, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose", + "-i $loopback_intf --foreground --verbose --verbose", 'fatal' => $NO }, { @@ -447,7 +447,7 @@ my @tests = ( 'err_msg' => 'stop error', 'function' => \&server_stop, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose", + "-i $loopback_intf --foreground --verbose --verbose", 'fatal' => $NO }, { @@ -457,7 +457,7 @@ my @tests = ( 'err_msg' => 'did not write PID', 'function' => \&write_pid, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose", + "-i $loopback_intf --foreground --verbose --verbose", 'fatal' => $NO }, @@ -468,7 +468,7 @@ my @tests = ( 'err_msg' => 'did not exit after one packet', 'function' => \&server_packet_limit, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --packet-limit 1 --foreground --verbose", + "-i $loopback_intf --packet-limit 1 --foreground --verbose --verbose", 'fatal' => $NO }, { @@ -478,7 +478,7 @@ my @tests = ( 'err_msg' => 'did not ignore small packets', 'function' => \&server_ignore_small_packets, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --packet-limit 1 --foreground --verbose", + "-i $loopback_intf --packet-limit 1 --foreground --verbose --verbose", 'fatal' => $NO }, { @@ -489,7 +489,7 @@ my @tests = ( 'function' => \&server_bpf_ignore_packet, 'cmdline' => $default_client_args, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --packet-limit 1 --foreground --verbose " . + "-i $loopback_intf --packet-limit 1 --foreground --verbose --verbose " . qq|-P "udp port $non_std_spa_port"|, 'fatal' => $NO }, @@ -502,7 +502,7 @@ my @tests = ( 'function' => \&spa_cycle, 'cmdline' => $default_client_args, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose", + "-i $loopback_intf --foreground --verbose --verbose", 'fatal' => $NO }, { @@ -513,7 +513,7 @@ my @tests = ( 'function' => \&spa_over_non_std_port, 'cmdline' => "$default_client_args --server-port $non_std_spa_port", 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose " . + "-i $loopback_intf --foreground --verbose --verbose " . qq|-P "udp port $non_std_spa_port"|, 'fatal' => $NO }, @@ -525,7 +525,7 @@ my @tests = ( 'function' => \&replay_detection, 'cmdline' => $default_client_args, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose", + "-i $loopback_intf --foreground --verbose --verbose", 'fatal' => $NO }, { @@ -545,7 +545,7 @@ my @tests = ( 'function' => \&altered_non_base64_spa_data, 'cmdline' => $default_client_args, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose", + "-i $loopback_intf --foreground --verbose --verbose", 'fatal' => $NO }, { @@ -556,7 +556,7 @@ my @tests = ( 'function' => \&altered_base64_spa_data, 'cmdline' => $default_client_args, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose", + "-i $loopback_intf --foreground --verbose --verbose", 'fatal' => $NO }, { @@ -567,7 +567,7 @@ my @tests = ( 'function' => \&appended_spa_data, 'cmdline' => $default_client_args, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose", + "-i $loopback_intf --foreground --verbose --verbose", 'fatal' => $NO }, { @@ -578,7 +578,7 @@ my @tests = ( 'function' => \&prepended_spa_data, 'cmdline' => $default_client_args, 'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " . - "-i $loopback_intf --foreground --verbose", + "-i $loopback_intf --foreground --verbose --verbose", 'fatal' => $NO }, @@ -892,7 +892,7 @@ sub spa_cycle() { my $rv = &client_server_interaction($test_hr, [], $USE_CLIENT, $REQUIRE_FW_RULE, $NO_FORCE_STOP); - sleep 2; + sleep 3; ### the firewall rule should be timed out (3 second timeout ### as defined in the access.conf file @@ -920,30 +920,7 @@ sub spa_cycle() { sub spa_over_non_std_port() { my $test_hr = shift; - my $rv = &client_server_interaction($test_hr, [], - $USE_CLIENT, $REQUIRE_FW_RULE, $NO_FORCE_STOP); - - sleep 2; - - ### the firewall rule should be timed out (3 second timeout - ### as defined in the access.conf file - if (&is_fw_rule_active()) { - &write_test_file("[-] new fw rule not timed out.\n"); - $rv = 0; - } else { - &write_test_file("[+] new fw rule timed out.\n"); - } - - if (&is_fwknopd_running()) { - &stop_fwknopd(); - unless (&file_find_regex([qr/Got\sSIGTERM/], - $server_test_file)) { - $rv = 0; - } - } else { - &write_test_file("[-] server is not running.\n"); - $rv = 0; - } + my $rv = &spa_cycle($test_hr); unless (&file_find_regex([qr/PCAP\sfilter.*\s$non_std_spa_port/], $server_test_file)) { @@ -1897,7 +1874,7 @@ sub identify_loopback_intf() { sub is_fw_rule_active() { return 1 if &run_cmd("LD_LIBRARY_PATH=$lib_dir $fwknopdCmd " . "$default_server_conf_args " . - "--fw-list | grep $fake_ip |grep _exp_", + qq{--fw-list | grep -v "# DISABLED" |grep $fake_ip |grep _exp_}, $cmd_out_tmp, $current_test_file); return 0; }