DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

Merge remote-tracking branch 'upstream/master'

Browse Source
This commit is contained in:
Franck Joncourt
2013-06-25 23:03:28 +02:00
parent 5413d1c48c d125146c37
commit 47a7ffe22b
7 changed files with 28 additions and 57 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/config_init.c
+6 -3
View File
@@ -757,13 +757,13 @@ create_fwknoprc(const char *rcfile)
"# It is this identifier (or name) that is used from the fwknop command line\n"
"# via the '-n <name>' argument to reference the corresponding stanza.\n"
"#\n"
"# The parameters within the stanza typicaly match corresponding client \n"
"# The parameters within the stanza typically match corresponding client \n"
"# command-line parameters.\n"
"#\n"
"# The first one should always be `[default]' as it defines the global\n"
"# default settings for the user. These override the program defaults\n"
"# for these parameters. If a named stanza is used, its entries will\n"
"# override any of the default. Command-line options will trump them\n"
"# override any of the default values. Command-line options will trump them\n"
"# all.\n"
"#\n"
"# Subsequent stanzas will have only the overriding and destination\n"
@@ -797,7 +797,7 @@ create_fwknoprc(const char *rcfile)
"\n"
"# User-provided named stanzas:\n"
"\n"
"# Example for a destination server of 192.168.1.20 to open access to \n"
"# Example for a destination server of 192.168.1.20 to open access to\n"
"# SSH for an IP that is resolved externally, and one with a NAT request\n"
"# for a specific source IP that maps port 8088 on the server\n"
"# to port 88 on 192.168.1.55 with timeout.\n"
@@ -1225,6 +1225,9 @@ add_single_var_to_rc(FILE* fhandle, short var_pos, fko_cli_options_t *options)
case FWKNOP_CLI_ARG_GPG_HOMEDIR :
strlcpy(val, options->gpg_home_dir, sizeof(val));
break;
case FWKNOP_CLI_ARG_GPG_NO_SIGNING_PW :
bool_to_yesno(options->gpg_no_signing_pw, val, sizeof(val));
break;
case FWKNOP_CLI_ARG_SPOOF_USER :
strlcpy(val, options->spoof_user, sizeof(val));
break;
client/fwknop.8.in
+3 -3
View File
@@ -2,12 +2,12 @@
.\" Title: fwknop
.\" Author: [see the "AUTHORS" section]
.\" Generator: DocBook XSL Stylesheets v1.76.1 <http://docbook.sf.net/>
.\" Date: 06/19/2013
.\" Date: 06/20/2013
.\" Manual: Fwknop Client
.\" Source: Fwknop Client
.\" Language: English
.\"
.TH "FWKNOP" "8" "06/19/2013" "Fwknop Client" "Fwknop Client"
.TH "FWKNOP" "8" "06/20/2013" "Fwknop Client" "Fwknop Client"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
@@ -1075,7 +1075,7 @@ When \fBfwknopd\fR is running on an iptables firewall with systems deployed behi
.\}
.SH "BACKWARDS COMPATIBILITY"
.sp
With the \fI2\&.5\fR release, \fBfwknop\fR underwent significant changes in its usage of cryptography including the addition of support for HMAC authenticated encryption, ensuring the proper usage of PBKDF1 for key derivation when SPA packets are encrypted with Rijndael, and several bugs were fixed from previous versions of fwknop\&. In general, this implies that SPA packets produced by the \fI2\&.5\fR release are incompatible with previous versions of fwknop\&. However, backwards compatibility is supported through setting the \fIlegacy\fR encryption mode with \fB\-M\fR on the fwknop client command line and/or the \fIENCRYPTION_MODE\fR variable in the \fI@sysconfdir@/fwknop/access\&.conf\fR file\&. This way, a pre\-2\&.5 server can decrypt SPA packets produced by a 2\&.5 and later client (set \fI\-M legacy\fR), and a 2\&.5 and later server can decrypt SPA packets produced by pre\-2\&.5 clients (set \fIENCRYPTION_MODE legacy\fR in the access\&.conf file)\&. Note that HMAC is only supported as of 2\&.5 and is an optional feature, so backwards compatibility is only for configurations that don\(cqt use an HMAC on either side\&. It is strongly recommended to upgrade all fwknop clients and servers to 2\&.5 and use the new HMAC mode for properly authenticated SPA communications\&. The backwards compatibility support is used to make it easier to upgrade clients and servers with a phased approach\&.
With the \fI2\&.5\fR release, \fBfwknop\fR underwent significant changes in its usage of cryptography including the addition of support for HMAC authenticated encryption for both Rijndael and GnuPG modes, ensuring the proper usage of PBKDF1 for key derivation when SPA packets are encrypted with Rijndael, and several bugs were fixed from previous versions of fwknop\&. In general, this implies that when Rijndael is used, SPA packets produced by the \fI2\&.5\fR release are incompatible with previous versions of fwknop\&. The GnuPG encryption mode is unaffected by these updates\&. However, even with Rijndael is used, backwards compatibility is supported through setting the \fIlegacy\fR encryption mode with \fB\-M\fR on the fwknop client command line and/or the \fIENCRYPTION_MODE\fR variable in the \fI@sysconfdir@/fwknop/access\&.conf\fR file\&. This way, a pre\-2\&.5 server can decrypt SPA packets produced by a 2\&.5 and later client (set \fI\-M legacy\fR), and a 2\&.5 and later server can decrypt SPA packets produced by pre\-2\&.5 clients (set \fIENCRYPTION_MODE legacy\fR in the access\&.conf file)\&. Note that HMAC is only supported as of 2\&.5 and is an optional feature, so backwards compatibility is only for configurations that don\(cqt use an HMAC on either side\&. It is strongly recommended to upgrade all fwknop clients and servers to 2\&.5 and use the new HMAC mode for properly authenticated SPA communications\&. The backwards compatibility support is used to make it easier to upgrade clients and servers with a phased approach\&.
.sp
For emphasis, if the \fBfwknopd\fR server is upgraded to 2\&.5 (or later), but older clients cannot be upgraded at the same time, then for each \fISOURCE\fR stanza in the \fI@sysconfdir@/fwknop/access\&.conf\fR file, add the following line:
.sp
client/fwknop.c
+8 -33
View File
@@ -38,8 +38,7 @@
/* prototypes
*/
static void get_keys(fko_ctx_t ctx, fko_cli_options_t *options,
char *key, int *key_len, char *hmac_key,
int *hmac_key_len, const int crypt_op);
char *key, int *key_len, char *hmac_key, int *hmac_key_len);
static void display_ctx(fko_ctx_t ctx);
static void errmsg(const char *msg, const int err);
static void prev_exec(fko_cli_options_t *options, int argc, char **argv);
@@ -433,8 +432,7 @@ main(int argc, char **argv)
/* Acquire the necessary encryption/hmac keys
*/
get_keys(ctx, &options, key, &key_len,
hmac_key, &hmac_key_len, CRYPT_OP_ENCRYPT);
get_keys(ctx, &options, key, &key_len, hmac_key, &hmac_key_len);
/* Finalize the context data (encrypt and encode the SPA data)
*/
@@ -555,9 +553,6 @@ main(int argc, char **argv)
}
}
get_keys(ctx2, &options, key, &key_len,
hmac_key, &hmac_key_len, CRYPT_OP_DECRYPT);
/* Decrypt
*/
res = fko_decrypt_spa_data(ctx2, key, key_len);
@@ -1076,8 +1071,7 @@ set_message_type(fko_ctx_t ctx, fko_cli_options_t *options)
*/
static void
get_keys(fko_ctx_t ctx, fko_cli_options_t *options,
char *key, int *key_len, char *hmac_key,
int *hmac_key_len, const int crypt_op)
char *key, int *key_len, char *hmac_key, int *hmac_key_len)
{
char *key_tmp = NULL, *hmac_key_tmp = NULL;
int use_hmac = 0, res = 0;
@@ -1085,12 +1079,12 @@ get_keys(fko_ctx_t ctx, fko_cli_options_t *options,
memset(key, 0x0, MAX_KEY_LEN+1);
memset(hmac_key, 0x0, MAX_KEY_LEN+1);
if (options->have_key)
if(options->have_key)
{
strlcpy(key, options->key, MAX_KEY_LEN+1);
*key_len = strlen(key);
}
else if (options->have_base64_key)
else if(options->have_base64_key)
{
*key_len = fko_base64_decode(options->key_base64,
(unsigned char *) options->key);
@@ -1109,11 +1103,11 @@ get_keys(fko_ctx_t ctx, fko_cli_options_t *options,
{
/* If --get-key file was specified grab the key/password from it.
*/
if (options->get_key_file[0] != 0x0)
if(options->get_key_file[0] != 0x0)
{
get_key_file(key, key_len, options->get_key_file, ctx, options);
}
else if (options->use_gpg)
else if(options->use_gpg)
{
if(options->use_gpg_agent)
log_msg(LOG_VERBOSITY_NORMAL,
@@ -1121,20 +1115,6 @@ get_keys(fko_ctx_t ctx, fko_cli_options_t *options,
else if(options->gpg_no_signing_pw)
log_msg(LOG_VERBOSITY_NORMAL,
"[+] GPG mode set, signing passphrase not required");
else if(crypt_op == CRYPT_OP_ENCRYPT)
log_msg(LOG_VERBOSITY_NORMAL,
"[+] GPG mode set, encrypt instead of decrypt operation");
else if(crypt_op == CRYPT_OP_DECRYPT)
{
key_tmp = getpasswd("Enter passphrase for secret key: ", options->input_fd);
if(key_tmp == NULL)
{
log_msg(LOG_VERBOSITY_ERROR, "[*] getpasswd() key error.");
clean_exit(ctx, options, EXIT_FAILURE);
}
strlcpy(key, key_tmp, MAX_KEY_LEN+1);
*key_len = strlen(key);
}
else if(strlen(options->gpg_signer_key))
{
key_tmp = getpasswd("Enter passphrase for signing: ", options->input_fd);
@@ -1149,12 +1129,7 @@ get_keys(fko_ctx_t ctx, fko_cli_options_t *options,
}
else
{
if(crypt_op == CRYPT_OP_ENCRYPT)
key_tmp = getpasswd("Enter encryption key: ", options->input_fd);
else if(crypt_op == CRYPT_OP_DECRYPT)
key_tmp = getpasswd("Enter decryption key: ", options->input_fd);
else
key_tmp = getpasswd("Enter key: ", options->input_fd);
key_tmp = getpasswd("Enter encryption key: ", options->input_fd);
if(key_tmp == NULL)
{
client/fwknop.h
-5
View File
@@ -34,9 +34,4 @@
#include "fwknop_common.h"
/* Used by the get_user_pw function below.
*/
#define CRYPT_OP_ENCRYPT 1
#define CRYPT_OP_DECRYPT 2
#endif /* FWKNOP_H */
doc/fwknop.man.asciidoc
+9 -7
View File
@@ -184,7 +184,7 @@ GENERAL OPTIONS
*--key-gen*::
Have *fwknop* generate both Rijndael and HMAC keys that can be used for SPA
packet encryption. These keys are derived from /dev/random and then base64
packet encryption. These keys are derived from /dev/urandom and then base64
encoded before being printed to stdout, and are meant to be included within
the ``$HOME/.fwknoprc'' file (or the file referenced by *--get-key*). Such
keys are generally more secure than passphrases that are typed in from the
@@ -905,12 +905,14 @@ translated via NAT to the '192.168.10.2' system automatically:
BACKWARDS COMPATIBILITY
-----------------------
With the '2.5' release, *fwknop* underwent significant changes in its usage of
cryptography including the addition of support for HMAC authenticated encryption,
ensuring the proper usage of PBKDF1 for key derivation when SPA packets are
encrypted with Rijndael, and several bugs were fixed from previous versions of
fwknop. In general, this implies that SPA packets produced by the '2.5' release
are incompatible with previous versions of fwknop. However, backwards
compatibility is supported through setting the 'legacy' encryption mode with
cryptography including the addition of support for HMAC authenticated encryption
for both Rijndael and GnuPG modes, ensuring the proper usage of PBKDF1 for key
derivation when SPA packets are encrypted with Rijndael, and several bugs were
fixed from previous versions of fwknop. In general, this implies that when
Rijndael is used, SPA packets produced by the '2.5' release are incompatible
with previous versions of fwknop. The GnuPG encryption mode is unaffected by
these updates. However, even with Rijndael is used, backwards compatibility is
supported through setting the 'legacy' encryption mode with
*-M* on the fwknop client command line and/or the 'ENCRYPTION_MODE' variable in
the '@sysconfdir@/fwknop/access.conf' file. This way, a pre-2.5 server can
decrypt SPA packets produced by a 2.5 and later client (set '-M legacy'), and
server/config_init.c
+2 -1
View File
@@ -913,7 +913,8 @@ dump_config(const fko_srv_options_t *opts)
void
usage(void)
{
fprintf(stdout, "\n%s server version %s\n%s\n\n", MY_NAME, MY_VERSION, MY_DESC);
fprintf(stdout, "\n%s server version %s\n%s - http://www.cipherdyne.org/fwknop/\n\n",
MY_NAME, MY_VERSION, MY_DESC);
fprintf(stdout,
"Usage: fwknopd [options]\n\n"
" -h, --help - Print this usage message and exit.\n"
server/fwknopd.h
-5
View File
@@ -57,11 +57,6 @@
#define LOCK_UN 0x08 /* unlock file */
#endif
/* Used by the get_user_pw function.
*/
#define CRYPT_OP_ENCRYPT 1
#define CRYPT_OP_DECRYPT 2
#define PID_BUFLEN 7
#endif /* FWKNOPD_H */