From 68acbaadc407b10d973f1157f9638088d620ea98 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Wed, 19 Jun 2013 23:42:58 -0400 Subject: [PATCH] remove newline chars from log_msg() calls --- client/config_init.c | 14 ++++++-- client/fwknop.c | 2 +- client/http_resolve_host.c | 2 +- client/spa_comm.c | 4 +-- client/utils.c | 3 +- server/access.c | 69 +++++++++++++++++++++++++------------- server/config_init.c | 36 ++++++++++---------- server/fw_util_ipf.c | 3 +- server/fw_util_ipfw.c | 26 +++++++------- server/fw_util_iptables.c | 17 +++++----- server/fw_util_pf.c | 5 +-- server/fwknopd.c | 8 ++--- server/incoming_spa.c | 7 ++-- server/log_msg.c | 2 +- server/pcap_capture.c | 10 +++--- server/replay_cache.c | 6 ++-- server/tcp_server.c | 2 +- server/utils.c | 10 +++--- 18 files changed, 132 insertions(+), 94 deletions(-) diff --git a/client/config_init.c b/client/config_init.c index 9e06faac..08219f60 100644 --- a/client/config_init.c +++ b/client/config_init.c @@ -138,7 +138,7 @@ static fko_var_t fko_var_array[FWKNOP_CLI_LAST_ARG] = { "GPG_HOMEDIR", FWKNOP_CLI_ARG_GPG_HOMEDIR }, { "GPG_SIGNING_PW", FWKNOP_CLI_ARG_GPG_SIGNING_PW }, { "GPG_SIGNING_PW_BASE64", FWKNOP_CLI_ARG_GPG_SIGNING_PW_BASE64 }, - { "GPG_NO_SIGNING_PW", FWKNOP_CLI_ARG_GPG_NO_SIGNING_PW }, + { "GPG_NO_SIGNING_PW", FWKNOP_CLI_ARG_GPG_NO_SIGNING_PW }, { "SPOOF_USER", FWKNOP_CLI_ARG_SPOOF_USER }, { "SPOOF_SOURCE_IP", FWKNOP_CLI_ARG_SPOOF_SOURCE_IP }, { "ACCESS", FWKNOP_CLI_ARG_ACCESS }, @@ -720,7 +720,7 @@ create_fwknoprc(const char *rcfile) FILE *rc = NULL; int rcfile_fd = -1; - log_msg(LOG_VERBOSITY_NORMAL,"[*] Creating initial rc file: %s.\n", rcfile); + log_msg(LOG_VERBOSITY_NORMAL, "[*] Creating initial rc file: %s.", rcfile); /* Try to create the initial rcfile with user read/write rights only. * If the rcfile already exists, an error is returned */ @@ -1684,6 +1684,14 @@ validate_options(fko_cli_options_t *options) } } + if(options->encryption_mode == FKO_ENC_MODE_ASYMMETRIC + && ! options->use_gpg) + { + log_msg(LOG_VERBOSITY_ERROR, + "Must specify GPG recipient/signing keys when Asymmetric encryption mode is used."); + exit(EXIT_FAILURE); + } + /* Validate HMAC digest type */ if(options->use_hmac && options->hmac_type == FKO_HMAC_UNKNOWN) @@ -1964,7 +1972,7 @@ config_init(fko_cli_options_t *options, int argc, char **argv) if((options->encryption_mode = enc_mode_strtoint(optarg)) < 0) { log_msg(LOG_VERBOSITY_ERROR, - "* Invalid encryption mode: %s, use {cbc,ecb}", + "* Invalid encryption mode: %s, use {CBC,CTR,legacy,Asymmetric}", optarg); exit(EXIT_FAILURE); } diff --git a/client/fwknop.c b/client/fwknop.c index 8c21a149..6af95ce9 100644 --- a/client/fwknop.c +++ b/client/fwknop.c @@ -574,7 +574,7 @@ main(int argc, char **argv) * programs like the fwknop test suite don't interpret this as * an unrecoverable error), but print the error string for debugging purposes. */ - log_msg(LOG_VERBOSITY_ERROR, "GPG ERR: %s\n%s\n", fko_gpg_errstr(ctx2), + log_msg(LOG_VERBOSITY_ERROR, "GPG ERR: %s\n%s", fko_gpg_errstr(ctx2), "No access to recipient private key?"); fko_destroy(ctx); fko_destroy(ctx2); diff --git a/client/http_resolve_host.c b/client/http_resolve_host.c index dad93f67..b6f9a880 100644 --- a/client/http_resolve_host.c +++ b/client/http_resolve_host.c @@ -97,7 +97,7 @@ try_url(struct url *url, fko_cli_options_t *options) error = getaddrinfo(url->host, url->port, &hints, &result); if (error != 0) { - log_msg(LOG_VERBOSITY_ERROR, "error in getaddrinfo: %s\n", gai_strerror(error)); + log_msg(LOG_VERBOSITY_ERROR, "error in getaddrinfo: %s", gai_strerror(error)); return(-1); } diff --git a/client/spa_comm.c b/client/spa_comm.c index bc01a630..4d89c792 100644 --- a/client/spa_comm.c +++ b/client/spa_comm.c @@ -94,7 +94,7 @@ send_spa_packet_tcp_or_udp(const char *spa_data, const int sd_len, if (options->test) { log_msg(LOG_VERBOSITY_NORMAL, - "test mode enabled, SPA packet not actually sent.\n"); + "test mode enabled, SPA packet not actually sent."); return res; } @@ -374,7 +374,7 @@ send_spa_packet_udp_raw(const char *spa_data, const int sd_len, else if(res != sd_len + hdrlen) /* account for the header ?*/ { log_msg(LOG_VERBOSITY_WARNING, - "[#] Warning: bytes sent (%i) not spa data length (%i).\n", + "[#] Warning: bytes sent (%i) not spa data length (%i).", res, sd_len ); } diff --git a/client/utils.c b/client/utils.c index 1c78da3f..7c2bdd34 100644 --- a/client/utils.c +++ b/client/utils.c @@ -249,7 +249,8 @@ resolve_dest_adr(const char *dns_str, struct addrinfo *hints, char *ip_str, size break; } else - log_msg(LOG_VERBOSITY_ERROR, "resolve_dest_adr() : inet_ntop (%d) - %s", errno, strerror(errno)); + log_msg(LOG_VERBOSITY_ERROR, "resolve_dest_adr() : inet_ntop (%d) - %s", + errno, strerror(errno)); } /* Free our result from getaddrinfo() */ diff --git a/server/access.c b/server/access.c index 66d8ea74..ce2aca04 100644 --- a/server/access.c +++ b/server/access.c @@ -46,6 +46,12 @@ static void add_acc_string(char **var, const char *val) { + if(var == NULL) + { + log_msg(LOG_ERR, "[*] add_acc_string() called with NULL variable"); + exit(EXIT_FAILURE); + } + if(*var != NULL) free(*var); @@ -140,7 +146,7 @@ add_acc_expire_time_epoch(fko_srv_options_t *opts, time_t *access_expire_time, c if (errno == ERANGE || (errno != 0 && expire_time == 0)) { log_msg(LOG_ERR, - "[* ]Fatal: invalid epoch seconds value '%s' for access stanza expiration time", + "[*] Fatal: invalid epoch seconds value '%s' for access stanza expiration time", val ); return 0; @@ -859,13 +865,20 @@ set_acc_defaults(fko_srv_options_t *opts) static int acc_data_is_valid(const acc_stanza_t *acc) { + if(acc == NULL) + { + log_msg(LOG_ERR, + "[*] acc_data_is_valid() called with NULL acc stanza"); + return(0); + } + if(((acc->key == NULL || acc->key_len == 0) && ((acc->gpg_decrypt_pw == NULL || !strlen(acc->gpg_decrypt_pw)) && acc->gpg_allow_no_pw == 0)) || (acc->use_rijndael == 0 && acc->use_gpg == 0 && acc->gpg_allow_no_pw == 0)) { log_msg(LOG_ERR, - "[*] No keys found for access stanza source: '%s'\n", acc->source + "[*] No keys found for access stanza source: '%s'", acc->source ); return(0); } @@ -878,7 +891,7 @@ acc_data_is_valid(const acc_stanza_t *acc) if(memcmp(acc->key, acc->hmac_key, acc->hmac_key_len) == 0) { log_msg(LOG_ERR, - "[*] The encryption passphrase and HMAC key should not be identical for access stanza source: '%s'\n", + "[*] The encryption passphrase and HMAC key should not be identical for access stanza source: '%s'", acc->source ); return(0); @@ -891,7 +904,7 @@ acc_data_is_valid(const acc_stanza_t *acc) if(memcmp(acc->gpg_decrypt_pw, acc->hmac_key, acc->hmac_key_len) == 0) { log_msg(LOG_ERR, - "[*] The encryption passphrase and HMAC key should not be identical for access stanza source: '%s'\n", + "[*] The encryption passphrase and HMAC key should not be identical for access stanza source: '%s'", acc->source ); return(0); @@ -899,6 +912,14 @@ acc_data_is_valid(const acc_stanza_t *acc) } } + if(acc->require_source_address == 0) + { + log_msg(LOG_INFO, + "Warning: REQUIRE_SOURCE_ADDRESS not enabled for access stanza source: '%s'", + acc->source + ); + } + return(1); } @@ -926,7 +947,7 @@ parse_access_file(fko_srv_options_t *opts) */ if(stat(opts->config[CONF_ACCESS_FILE], &st) != 0) { - log_msg(LOG_ERR, "[*] Access file: '%s' was not found.\n", + log_msg(LOG_ERR, "[*] Access file: '%s' was not found.", opts->config[CONF_ACCESS_FILE]); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -950,7 +971,7 @@ parse_access_file(fko_srv_options_t *opts) */ if ((file_ptr = fopen(opts->config[CONF_ACCESS_FILE], "r")) == NULL) { - log_msg(LOG_ERR, "[*] Could not open access file: %s\n", + log_msg(LOG_ERR, "[*] Could not open access file: %s", opts->config[CONF_ACCESS_FILE]); perror(NULL); @@ -1000,7 +1021,7 @@ parse_access_file(fko_srv_options_t *opts) */ if (opts->verbose > 3) log_msg(LOG_DEBUG, - "ACCESS FILE: %s, LINE: %s\tVar: %s, Val: '%s'\n", + "ACCESS FILE: %s, LINE: %s\tVar: %s, Val: '%s'", opts->config[CONF_ACCESS_FILE], access_line_buf, var, val ); @@ -1018,7 +1039,7 @@ parse_access_file(fko_srv_options_t *opts) if(curr_acc != NULL) { if(!acc_data_is_valid(curr_acc)) { - log_msg(LOG_ERR, "[*] Data error in access file: '%s'\n", + log_msg(LOG_ERR, "[*] Data error in access file: '%s'", opts->config[CONF_ACCESS_FILE]); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1052,7 +1073,7 @@ parse_access_file(fko_srv_options_t *opts) if(strcasecmp(val, "__CHANGEME__") == 0) { log_msg(LOG_ERR, - "[*] KEY value is not properly set in stanza source '%s' in access file: '%s'\n", + "[*] KEY value is not properly set in stanza source '%s' in access file: '%s'", curr_acc->source, opts->config[CONF_ACCESS_FILE]); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1066,7 +1087,7 @@ parse_access_file(fko_srv_options_t *opts) if(strcasecmp(val, "__CHANGEME__") == 0) { log_msg(LOG_ERR, - "[*] KEY_BASE64 value is not properly set in stanza source '%s' in access file: '%s'\n", + "[*] KEY_BASE64 value is not properly set in stanza source '%s' in access file: '%s'", curr_acc->source, opts->config[CONF_ACCESS_FILE]); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1074,7 +1095,7 @@ parse_access_file(fko_srv_options_t *opts) if (! is_base64((unsigned char *) val, strlen(val))) { log_msg(LOG_ERR, - "[*] KEY_BASE64 argument '%s' doesn't look like base64-encoded data.\n", + "[*] KEY_BASE64 argument '%s' doesn't look like base64-encoded data.", val); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1091,7 +1112,7 @@ parse_access_file(fko_srv_options_t *opts) if(curr_acc->hmac_type < 0) { log_msg(LOG_ERR, - "[*] HMAC_DIGEST_TYPE argument '%s' must be one of {md5,sha1,sha256,sha384,sha512}\n", + "[*] HMAC_DIGEST_TYPE argument '%s' must be one of {md5,sha1,sha256,sha384,sha512}", val); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1102,7 +1123,7 @@ parse_access_file(fko_srv_options_t *opts) if(strcasecmp(val, "__CHANGEME__") == 0) { log_msg(LOG_ERR, - "[*] HMAC_KEY_BASE64 value is not properly set in stanza source '%s' in access file: '%s'\n", + "[*] HMAC_KEY_BASE64 value is not properly set in stanza source '%s' in access file: '%s'", curr_acc->source, opts->config[CONF_ACCESS_FILE]); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1110,7 +1131,7 @@ parse_access_file(fko_srv_options_t *opts) if (! is_base64((unsigned char *) val, strlen(val))) { log_msg(LOG_ERR, - "[*] HMAC_KEY_BASE64 argument '%s' doesn't look like base64-encoded data.\n", + "[*] HMAC_KEY_BASE64 argument '%s' doesn't look like base64-encoded data.", val); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1124,7 +1145,7 @@ parse_access_file(fko_srv_options_t *opts) if(strcasecmp(val, "__CHANGEME__") == 0) { log_msg(LOG_ERR, - "[*] HMAC_KEY_BASE64 value is not properly set in stanza source '%s' in access file: '%s'\n", + "[*] HMAC_KEY_BASE64 value is not properly set in stanza source '%s' in access file: '%s'", curr_acc->source, opts->config[CONF_ACCESS_FILE]); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1149,7 +1170,7 @@ parse_access_file(fko_srv_options_t *opts) if((curr_acc->encryption_mode = enc_mode_strtoint(val)) < 0) { log_msg(LOG_ERR, - "[*] Unrecognized ENCRYPTION_MODE '%s', use {cbc,ecb}\n", + "[*] Unrecognized ENCRYPTION_MODE '%s', use {CBC,CTR,legacy,Asymmetric}", val); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1168,7 +1189,7 @@ parse_access_file(fko_srv_options_t *opts) if(pw == NULL) { - log_msg(LOG_ERR, "[*] Unable to determine UID for CMD_EXEC_USER: %s.\n", + log_msg(LOG_ERR, "[*] Unable to determine UID for CMD_EXEC_USER: %s.", errno ? strerror(errno) : "Not a user on this system"); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1197,7 +1218,7 @@ parse_access_file(fko_srv_options_t *opts) else { log_msg(LOG_ERR, - "[*] GPG_HOME_DIR directory '%s' stat()/existence problem in stanza source '%s' in access file: '%s'\n", + "[*] GPG_HOME_DIR directory '%s' stat()/existence problem in stanza source '%s' in access file: '%s'", val, curr_acc->source, opts->config[CONF_ACCESS_FILE]); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1212,7 +1233,7 @@ parse_access_file(fko_srv_options_t *opts) if(strcasecmp(val, "__CHANGEME__") == 0) { log_msg(LOG_ERR, - "[*] GPG_DECRYPT_PW value is not properly set in stanza source '%s' in access file: '%s'\n", + "[*] GPG_DECRYPT_PW value is not properly set in stanza source '%s' in access file: '%s'", curr_acc->source, opts->config[CONF_ACCESS_FILE]); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); @@ -1263,14 +1284,14 @@ parse_access_file(fko_srv_options_t *opts) if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1) !=0 ) { log_msg(LOG_ERR, - "[*] FORCE_NAT requires ENABLE_IPT_FORWARDING to be enabled in fwknopd.conf\n"); + "[*] FORCE_NAT requires ENABLE_IPT_FORWARDING to be enabled in fwknopd.conf"); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } add_acc_force_nat(opts, curr_acc, val); #else log_msg(LOG_ERR, - "[*] FORCE_NAT not supported.\n"); + "[*] FORCE_NAT not supported."); fclose(file_ptr); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); #endif @@ -1278,7 +1299,7 @@ parse_access_file(fko_srv_options_t *opts) else { log_msg(LOG_ERR, - "[*] Ignoring unknown access parameter: '%s' in %s\n", + "[*] Ignoring unknown access parameter: '%s' in %s", var, opts->config[CONF_ACCESS_FILE] ); } @@ -1293,7 +1314,7 @@ parse_access_file(fko_srv_options_t *opts) if (got_source == 0) { log_msg(LOG_ERR, - "[*] Could not find valid SOURCE stanza in access file: '%s'\n", + "[*] Could not find valid SOURCE stanza in access file: '%s'", opts->config[CONF_ACCESS_FILE]); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } @@ -1303,7 +1324,7 @@ parse_access_file(fko_srv_options_t *opts) if(!acc_data_is_valid(curr_acc)) { log_msg(LOG_ERR, - "[*] Data error in access file: '%s'\n", + "[*] Data error in access file: '%s'", opts->config[CONF_ACCESS_FILE]); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } diff --git a/server/config_init.c b/server/config_init.c index e6d6cfab..39eb7421 100644 --- a/server/config_init.c +++ b/server/config_init.c @@ -46,7 +46,7 @@ range_check(fko_srv_options_t *opts, char *var, char *val, int low, int high) strtol_wrapper(val, low, high, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] var %s value '%s' not in the range %d-%d\n", + log_msg(LOG_ERR, "[*] var %s value '%s' not in the range %d-%d", var, val, low, high); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } @@ -66,7 +66,7 @@ set_config_entry(fko_srv_options_t *opts, const int var_ndx, const char *value) */ if(var_ndx < 0 || var_ndx >= NUMBER_OF_CONFIG_ENTRIES) { - log_msg(LOG_ERR, "[*] Index value of %i is not valid\n", var_ndx); + log_msg(LOG_ERR, "[*] Index value of %i is not valid", var_ndx); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } @@ -92,7 +92,7 @@ set_config_entry(fko_srv_options_t *opts, const int var_ndx, const char *value) if(opts->config[var_ndx] == NULL) { - log_msg(LOG_ERR, "[*] Fatal memory allocation error!\n"); + log_msg(LOG_ERR, "[*] Fatal memory allocation error!"); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } @@ -132,7 +132,9 @@ free_configs(fko_srv_options_t *opts) static void validate_int_var_ranges(fko_srv_options_t *opts) { +#if FIREWALL_IPFW int is_err = FKO_SUCCESS; +#endif range_check(opts, "PCAP_LOOP_SLEEP", opts->config[CONF_PCAP_LOOP_SLEEP], 1, RCHK_MAX_PCAP_LOOP_SLEEP); @@ -169,7 +171,13 @@ validate_int_var_ranges(fko_srv_options_t *opts) 0, RCHK_MAX_IPFW_SET_NUM, NO_EXIT_UPON_ERR, &is_err)) { log_msg(LOG_ERR, - "[*] Cannot set identical ipfw active and expire sets.\n"); + "[*] Cannot set identical ipfw active and expire sets."); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + + if(is_err != FKO_SUCCESS) + { + log_msg(LOG_ERR, "[*] invalid integer conversion error.\n"); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } @@ -179,12 +187,6 @@ validate_int_var_ranges(fko_srv_options_t *opts) #endif /* FIREWALL type */ - if(is_err != FKO_SUCCESS) - { - log_msg(LOG_ERR, "[*] invalid integer conversion error.\n"); - clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); - } - return; } @@ -210,7 +212,7 @@ parse_config_file(fko_srv_options_t *opts, const char *config_file) */ if(stat(config_file, &st) != 0) { - log_msg(LOG_ERR, "[*] Config file: '%s' was not found.\n", + log_msg(LOG_ERR, "[*] Config file: '%s' was not found.", config_file); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } @@ -222,7 +224,7 @@ parse_config_file(fko_srv_options_t *opts, const char *config_file) */ if ((cfile_ptr = fopen(config_file, "r")) == NULL) { - log_msg(LOG_ERR, "[*] Could not open config file: %s\n", + log_msg(LOG_ERR, "[*] Could not open config file: %s", config_file); perror(NULL); @@ -285,7 +287,7 @@ parse_config_file(fko_srv_options_t *opts, const char *config_file) if(good_ent == 0) log_msg(LOG_ERR, - "[*] Ignoring unknown configuration parameter: '%s' in %s\n", + "[*] Ignoring unknown configuration parameter: '%s' in %s", var, config_file ); } @@ -610,7 +612,7 @@ validate_options(fko_srv_options_t *opts) if((opts->dump_config + opts->kill + opts->restart + opts->status) > 1) { log_msg(LOG_ERR, - "The -D, -K, -R, and -S options are mutually exclusive. Pick only one.\n" + "The -D, -K, -R, and -S options are mutually exclusive. Pick only one." ); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } @@ -618,7 +620,7 @@ validate_options(fko_srv_options_t *opts) if(opts->config[CONF_FIREWALL_EXE] == NULL) { log_msg(LOG_ERR, - "[*] No firewall command executable is set. Please check FIREWALL_EXE in fwknopd.conf.\n" + "[*] No firewall command executable is set. Please check FIREWALL_EXE in fwknopd.conf." ); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } @@ -776,7 +778,7 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) if(is_err != FKO_SUCCESS) { log_msg(LOG_ERR, - "[*] invalid -C packet count limit '%s'\n", + "[*] invalid -C packet count limit '%s'", optarg); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } @@ -812,7 +814,7 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) else { log_msg(LOG_ERR, - "[*] Directory '%s' could not stat()/does not exist?\n", + "[*] Directory '%s' could not stat()/does not exist?", optarg); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } diff --git a/server/fw_util_ipf.c b/server/fw_util_ipf.c index 45ecdcb6..513f19ee 100644 --- a/server/fw_util_ipf.c +++ b/server/fw_util_ipf.c @@ -90,7 +90,8 @@ fw_initialize(const fko_srv_options_t *opts) if(res != 0) { - log_msg(LOG_WARNING, "Warning: Errors detected during fwknop custom chain creation.\n"); + log_msg(LOG_WARNING, + "Warning: Errors detected during fw_initialize()."); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } } diff --git a/server/fw_util_ipfw.c b/server/fw_util_ipfw.c index ef464046..4892d7c1 100644 --- a/server/fw_util_ipfw.c +++ b/server/fw_util_ipfw.c @@ -191,7 +191,7 @@ fw_config_init(fko_srv_options_t * const opts) 0, RCHK_MAX_IPFW_MAX_RULES, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] IPFW_START_RULE_NUM '%s' out of range [%d-%d].\n", + log_msg(LOG_ERR, "[*] IPFW_START_RULE_NUM '%s' out of range [%d-%d].", opts->config[CONF_IPFW_START_RULE_NUM], 0, RCHK_MAX_IPFW_MAX_RULES); exit(EXIT_FAILURE); } @@ -200,7 +200,7 @@ fw_config_init(fko_srv_options_t * const opts) 0, RCHK_MAX_IPFW_MAX_RULES, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] IPFW_MAX_RULES_INT '%s' out of range [%d-%d].\n", + log_msg(LOG_ERR, "[*] IPFW_MAX_RULES_INT '%s' out of range [%d-%d].", opts->config[CONF_IPFW_MAX_RULES], 0, RCHK_MAX_IPFW_MAX_RULES); exit(EXIT_FAILURE); } @@ -209,7 +209,7 @@ fw_config_init(fko_srv_options_t * const opts) 0, RCHK_MAX_IPFW_SET_NUM, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] IPFW_ACTIVE_SET_NUM '%s' out of range [%d-%d].\n", + log_msg(LOG_ERR, "[*] IPFW_ACTIVE_SET_NUM '%s' out of range [%d-%d].", opts->config[CONF_IPFW_ACTIVE_SET_NUM], 0, RCHK_MAX_IPFW_SET_NUM); exit(EXIT_FAILURE); } @@ -218,7 +218,7 @@ fw_config_init(fko_srv_options_t * const opts) 0, RCHK_MAX_IPFW_SET_NUM, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] IPFW_MAX_EXPIRE_SET_NUM '%s' out of range [%d-%d].\n", + log_msg(LOG_ERR, "[*] IPFW_MAX_EXPIRE_SET_NUM '%s' out of range [%d-%d].", opts->config[CONF_IPFW_EXPIRE_SET_NUM], 0, RCHK_MAX_IPFW_SET_NUM); exit(EXIT_FAILURE); } @@ -227,7 +227,7 @@ fw_config_init(fko_srv_options_t * const opts) 0, RCHK_MAX_IPFW_PURGE_INTERVAL, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] IPFW_EXPIRE_PURGE_INTERVAL '%s' out of range [%d-%d].\n", + log_msg(LOG_ERR, "[*] IPFW_EXPIRE_PURGE_INTERVAL '%s' out of range [%d-%d].", opts->config[CONF_IPFW_EXPIRE_PURGE_INTERVAL], 0, RCHK_MAX_IPFW_PURGE_INTERVAL); exit(EXIT_FAILURE); @@ -254,7 +254,7 @@ fw_initialize(const fko_srv_options_t * const opts) if(res != 0) { - log_msg(LOG_ERR, "[*] Fatal: Errors detected during ipfw rules initialization.\n"); + log_msg(LOG_ERR, "[*] Fatal: Errors detected during ipfw rules initialization."); exit(EXIT_FAILURE); } @@ -264,7 +264,7 @@ fw_initialize(const fko_srv_options_t * const opts) if(fwc.rule_map == NULL) { - log_msg(LOG_ERR, "[*] Fatal: Memory allocation error in fw_initialize.\n"); + log_msg(LOG_ERR, "[*] Fatal: Memory allocation error in fw_initialize()."); exit(EXIT_FAILURE); } @@ -378,7 +378,8 @@ fw_initialize(const fko_srv_options_t * const opts) } } else - log_msg(LOG_WARNING, "fw_initialize: No rule number found where expected."); + log_msg(LOG_WARNING, + "fw_initialize: No rule number found where expected."); /* Find the next "# DISABLED" string (if any). */ @@ -418,7 +419,7 @@ fw_cleanup(const fko_srv_options_t * const opts) /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) { - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); got_err++; } } @@ -501,7 +502,8 @@ process_spa_request(const fko_srv_options_t * const opts, */ if(rule_num == 0) { - log_msg(LOG_WARNING, "Access request rejected: Maximum allowed number of rules has been reached."); + log_msg(LOG_WARNING, + "Access request rejected: Maximum allowed number of rules has been reached."); free_acc_port_list(port_list); return(-1); } @@ -547,7 +549,7 @@ process_spa_request(const fko_srv_options_t * const opts, fwc.next_expire = exp_ts; } else - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); ple = ple->next; } @@ -638,7 +640,7 @@ check_firewall_rules(const fko_srv_options_t * const opts) /* we did not find an expected rule. */ log_msg(LOG_ERR, - "Did not find expire comment in rules list %i.\n", i); + "Did not find expire comment in rules list %i.", i); if (fwc.active_rules > 0) fwc.active_rules--; diff --git a/server/fw_util_iptables.c b/server/fw_util_iptables.c index 26866de9..55ff57c3 100644 --- a/server/fw_util_iptables.c +++ b/server/fw_util_iptables.c @@ -250,7 +250,7 @@ fw_dump_rules(const fko_srv_options_t * const opts) /* Expect full success on this */ if(! EXTCMD_IS_SUCCESS(res)) { - log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); + log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); got_err++; } } @@ -434,7 +434,7 @@ set_fw_chain_conf(const int type, const char * const conf_str) if(conf_str == NULL) { - log_msg(LOG_ERR, "[*] NULL conf_str.\n"); + log_msg(LOG_ERR, "[*] NULL conf_str."); exit(EXIT_FAILURE); } @@ -467,7 +467,7 @@ set_fw_chain_conf(const int type, const char * const conf_str) { log_msg(LOG_ERR, "[*] Custom Chain config parse error.\n" "Wrong number of fields for chain type %i\n" - "Line: %s\n", type, conf_str); + "Line: %s", type, conf_str); exit(EXIT_FAILURE); } @@ -485,7 +485,7 @@ set_fw_chain_conf(const int type, const char * const conf_str) 0, RCHK_MAX_IPT_RULE_NUM, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] invalid jump rule position in Line: %s\n", + log_msg(LOG_ERR, "[*] invalid jump rule position in Line: %s", conf_str); exit(EXIT_FAILURE); } @@ -498,7 +498,7 @@ set_fw_chain_conf(const int type, const char * const conf_str) 0, RCHK_MAX_IPT_RULE_NUM, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] invalid to_chain rule position in Line: %s\n", + log_msg(LOG_ERR, "[*] invalid to_chain rule position in Line: %s", conf_str); exit(EXIT_FAILURE); } @@ -576,7 +576,8 @@ fw_initialize(const fko_srv_options_t * const opts) if(res != 0) { - log_msg(LOG_WARNING, "Warning: Errors detected during fwknop custom chain creation.\n"); + log_msg(LOG_WARNING, + "Warning: Errors detected during fwknop custom chain creation."); exit(EXIT_FAILURE); } @@ -585,7 +586,7 @@ fw_initialize(const fko_srv_options_t * const opts) if((strncasecmp(opts->config[CONF_ENABLE_IPT_COMMENT_CHECK], "Y", 1) == 0) && (comment_match_exists(opts) != 1)) { - log_msg(LOG_WARNING, "Warning: Could not use the 'comment' match.\n"); + log_msg(LOG_WARNING, "Warning: Could not use the 'comment' match."); exit(EXIT_FAILURE); } } @@ -1087,7 +1088,7 @@ check_firewall_rules(const fko_srv_options_t * const opts) /* we did not find an expected rule. */ log_msg(LOG_ERR, - "Did not find expire comment in rules list %i.\n", i); + "Did not find expire comment in rules list %i.", i); if (ch[i].active_rules > 0) ch[i].active_rules--; diff --git a/server/fw_util_pf.c b/server/fw_util_pf.c index ec26c535..641dc78e 100644 --- a/server/fw_util_pf.c +++ b/server/fw_util_pf.c @@ -168,7 +168,8 @@ fw_initialize(const fko_srv_options_t * const opts) if (! anchor_active(opts)) { - log_msg(LOG_WARNING, "Warning: the fwknop anchor is not active in the pf policy\n"); + log_msg(LOG_WARNING, + "Warning: the fwknop anchor is not active in the pf policy"); exit(EXIT_FAILURE); } @@ -387,7 +388,7 @@ check_firewall_rules(const fko_srv_options_t * const opts) /* we did not find an expected rule. */ log_msg(LOG_ERR, - "Did not find expire comment in rules list %i.\n", i); + "Did not find expire comment in rules list %i.", i); return; } diff --git a/server/fwknopd.c b/server/fwknopd.c index 2d52d7e8..bf528e2c 100644 --- a/server/fwknopd.c +++ b/server/fwknopd.c @@ -467,7 +467,7 @@ check_dir_path(const char * const filepath, const char * const fp_desc, const un if(! S_ISDIR(st.st_mode)) { log_msg(LOG_ERR, - "Specified %s directory: %s is NOT a directory\n\n", fp_desc, tmp_path + "Specified %s directory: %s is NOT a directory", fp_desc, tmp_path ); exit(EXIT_FAILURE); } @@ -516,7 +516,7 @@ make_dir_path(const char * const run_dir) if(stat(tmp_path, &st) != 0) { log_msg(LOG_ERR, - "Could not create component: %s of %s\n\n", tmp_path, run_dir + "Could not create component: %s of %s", tmp_path, run_dir ); return(ENOTDIR); } @@ -526,7 +526,7 @@ make_dir_path(const char * const run_dir) if(! S_ISDIR(st.st_mode)) { log_msg(LOG_ERR, - "Component: %s of %s is NOT a directory\n\n", tmp_path, run_dir + "Component: %s of %s is NOT a directory", tmp_path, run_dir ); return(ENOTDIR); } @@ -663,7 +663,7 @@ write_pid_file(fko_srv_options_t *opts) my_pid = getpid(); snprintf(buf, PID_BUFLEN, "%i\n", my_pid); - log_msg(LOG_DEBUG, "[+] Writing my PID (%i) to the lock file: %s\n", + log_msg(LOG_DEBUG, "[+] Writing my PID (%i) to the lock file: %s", my_pid, opts->config[CONF_FWKNOP_PID_FILE]); num_bytes = write(op_fd, buf, strlen(buf)); diff --git a/server/incoming_spa.c b/server/incoming_spa.c index 7fb6231d..1835586c 100644 --- a/server/incoming_spa.c +++ b/server/incoming_spa.c @@ -311,7 +311,7 @@ incoming_spa(fko_srv_options_t *opts) 0, RCHK_MAX_SPA_PACKET_AGE, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] [%s] invalid MAX_SPA_PACKET_AGE\n", spadat.pkt_source_ip); + log_msg(LOG_ERR, "[*] [%s] invalid MAX_SPA_PACKET_AGE", spadat.pkt_source_ip); return; } } @@ -377,7 +377,7 @@ incoming_spa(fko_srv_options_t *opts) log_msg(LOG_INFO, "(stanza #%d) SPA Packet from IP: %s received with access source match", stanza_num, spadat.pkt_source_ip); - log_msg(LOG_DEBUG, "SPA Packet: '%s'\n", spa_pkt->packet_data); + log_msg(LOG_DEBUG, "SPA Packet: '%s'", spa_pkt->packet_data); /* Make sure this access stanza has not expired */ @@ -551,7 +551,8 @@ incoming_spa(fko_srv_options_t *opts) res = fko_get_gpg_signature_id(ctx, &gpg_id); if(res != FKO_SUCCESS) { - log_msg(LOG_WARNING, "[%s] (stanza #%d) Error pulling the GPG signature ID from the context: %s", + log_msg(LOG_WARNING, + "[%s] (stanza #%d) Error pulling the GPG signature ID from the context: %s", spadat.pkt_source_ip, stanza_num, fko_gpg_errstr(ctx)); acc = acc->next; continue; diff --git a/server/log_msg.c b/server/log_msg.c index 923c3ec2..85f73d32 100644 --- a/server/log_msg.c +++ b/server/log_msg.c @@ -200,7 +200,7 @@ log_msg(int level, char* msg, ...) /** * Set the verbosity level for the current context of the log module. * - * The verbosity levels used byt the module are defined by the sylsog module. + * The verbosity levels used by the module are defined by the syslog module. * * @param level verbosity level to set (LOG_INFO, LOG_NOTICE ...) */ diff --git a/server/pcap_capture.c b/server/pcap_capture.c index 78388591..311e8d25 100644 --- a/server/pcap_capture.c +++ b/server/pcap_capture.c @@ -73,7 +73,7 @@ pcap_capture(fko_srv_options_t *opts) 0, RCHK_MAX_PCAP_LOOP_SLEEP, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] invalid PCAP_LOOP_SLEEP_value\n"); + log_msg(LOG_ERR, "[*] invalid PCAP_LOOP_SLEEP_value"); clean_exit(opts, FW_CLEANUP, EXIT_FAILURE); } @@ -81,7 +81,7 @@ pcap_capture(fko_srv_options_t *opts) 0, RCHK_MAX_SNIFF_BYTES, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] invalid MAX_SNIFF_BYTES\n"); + log_msg(LOG_ERR, "[*] invalid MAX_SNIFF_BYTES"); clean_exit(opts, FW_CLEANUP, EXIT_FAILURE); } @@ -102,7 +102,7 @@ pcap_capture(fko_srv_options_t *opts) if(pcap == NULL) { - log_msg(LOG_ERR, "[*] pcap_open_offline() error: %s\n", + log_msg(LOG_ERR, "[*] pcap_open_offline() error: %s", errstr); clean_exit(opts, FW_CLEANUP, EXIT_FAILURE); } @@ -118,7 +118,7 @@ pcap_capture(fko_srv_options_t *opts) if(pcap == NULL) { - log_msg(LOG_ERR, "[*] pcap_open_live() error: %s\n", errstr); + log_msg(LOG_ERR, "[*] pcap_open_live() error: %s", errstr); clean_exit(opts, FW_CLEANUP, EXIT_FAILURE); } } @@ -200,7 +200,7 @@ pcap_capture(fko_srv_options_t *opts) 0, RCHK_MAX_PCAP_DISPATCH_COUNT, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] invalid PCAP_DISPATCH_COUNT\n"); + log_msg(LOG_ERR, "[*] invalid PCAP_DISPATCH_COUNT"); clean_exit(opts, FW_CLEANUP, EXIT_FAILURE); } diff --git a/server/replay_cache.c b/server/replay_cache.c index c20c84f1..4211729f 100644 --- a/server/replay_cache.c +++ b/server/replay_cache.c @@ -276,7 +276,7 @@ replay_file_cache_init(fko_srv_options_t *opts) if(write(digest_file_fd, digest_header, strlen(digest_header)) != strlen(digest_header)) { log_msg(LOG_WARNING, - "Did not write expected number of bytes to digest cache: %s\n", + "Did not write expected number of bytes to digest cache: %s", opts->config[CONF_DIGEST_FILE]); } close(digest_file_fd); @@ -314,13 +314,13 @@ replay_file_cache_init(fko_srv_options_t *opts) */ if ((digest_elm = calloc(1, sizeof(struct digest_cache_list))) == NULL) { - log_msg(LOG_ERR, "[*] Could not allocate digest list element\n"); + log_msg(LOG_ERR, "[*] Could not allocate digest list element"); continue; } if ((digest_elm->cache_info.digest = calloc(1, MAX_DIGEST_SIZE+1)) == NULL) { free(digest_elm); - log_msg(LOG_ERR, "[*] Could not allocate digest string\n"); + log_msg(LOG_ERR, "[*] Could not allocate digest string"); continue; } src_ip[0] = '\0'; diff --git a/server/tcp_server.c b/server/tcp_server.c index e29a07f4..c0c510f7 100644 --- a/server/tcp_server.c +++ b/server/tcp_server.c @@ -68,7 +68,7 @@ run_tcp_server(fko_srv_options_t *opts) 0, MAX_PORT, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { - log_msg(LOG_ERR, "[*] Invalid max TCPSERV_PORT value.\n"); + log_msg(LOG_ERR, "[*] Invalid max TCPSERV_PORT value."); exit(EXIT_FAILURE); } log_msg(LOG_INFO, "Kicking off TCP server to listen on port %i.", port); diff --git a/server/utils.c b/server/utils.c index 3e8496f2..3342073d 100644 --- a/server/utils.c +++ b/server/utils.c @@ -200,7 +200,7 @@ is_valid_dir(const char *path) */ if(stat(path, &st) != 0) { - log_msg(LOG_ERR, "[-] unable to stat() directory: %s: %s\n", + log_msg(LOG_ERR, "[-] unable to stat() directory: %s: %s", path, strerror(errno)); exit(EXIT_FAILURE); } @@ -231,7 +231,7 @@ verify_file_perms_ownership(const char *file) { return 0; } else { - log_msg(LOG_ERR, "[-] stat() against file: %s returned: %s\n", + log_msg(LOG_ERR, "[-] stat() against file: %s returned: %s", file, strerror(errno)); exit(EXIT_FAILURE); } @@ -242,7 +242,7 @@ verify_file_perms_ownership(const char *file) if(S_ISREG(st.st_mode) != 1 && S_ISLNK(st.st_mode) != 1) { log_msg(LOG_WARNING, - "[-] file: %s is not a regular file or symbolic link.\n", + "[-] file: %s is not a regular file or symbolic link.", file ); res = 0; @@ -251,7 +251,7 @@ verify_file_perms_ownership(const char *file) if((st.st_mode & (S_IRWXU|S_IRWXG|S_IRWXO)) != (S_IRUSR|S_IWUSR)) { log_msg(LOG_WARNING, - "[-] file: %s permissions should only be user read/write (0600, -rw-------)\n", + "[-] file: %s permissions should only be user read/write (0600, -rw-------)", file ); res = 0; @@ -259,7 +259,7 @@ verify_file_perms_ownership(const char *file) if(st.st_uid != getuid()) { - log_msg(LOG_WARNING, "[-] file: %s not owned by current effective user id\n", + log_msg(LOG_WARNING, "[-] file: %s not owned by current effective user id", file); res = 0; }