DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

[test suite / server] rule deletion/addition tests mid-cycle

Browse Source
This commit is contained in:
Michael Rash
2014-12-15 17:06:07 -08:00
parent fd582487db
commit 9dc56d6bb7
5 changed files with 106 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/fw_util_firewalld.c
+11 -26
View File
@@ -73,7 +73,7 @@ rule_exists_no_chk_support(const fko_srv_options_t * const opts,
const char * const srcip, const char * const dstip,
const unsigned int port, const unsigned int exp_ts)
{
int rule_exists=0, rule_num=0, rtmp=0;
int rule_exists=0;
char cmd_buf[CMD_BUFSIZE] = {0};
char target_search[CMD_BUFSIZE] = {0};
char proto_search[CMD_BUFSIZE] = {0};
@@ -106,32 +106,17 @@ rule_exists_no_chk_support(const fko_srv_options_t * const opts,
}
snprintf(exp_ts_search, CMD_BUFSIZE-1, "%u ", exp_ts);
/* search for each of the substrings, and require the returned
* rule number to be the same across all searches to return true
/* search for each of the substrings - yes, matches from different
* rules may get triggered here, but the expiration time is the
* primary search method
*/
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, exp_ts_search, &pid_status, opts);
if(rtmp > 0)
{
rule_num = rtmp;
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, proto_search, &pid_status, opts);
if(rtmp == rule_num)
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, srcip_search, &pid_status, opts);
if(rtmp == rule_num)
rtmp = (dstip == NULL) ? rtmp : search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, dstip_search, &pid_status, opts);
if(rtmp == rule_num)
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, target_search, &pid_status, opts);
if(rtmp == rule_num)
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, port_search, &pid_status, opts);
if(rtmp == rule_num)
rule_exists = 1;
}
if(search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, exp_ts_search, &pid_status, opts)
&& search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, proto_search, &pid_status, opts)
&& search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, srcip_search, &pid_status, opts)
&& (dstip == NULL) ? 1 : search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, dstip_search, &pid_status, opts)
&& search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, target_search, &pid_status, opts)
&& search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, port_search, &pid_status, opts))
rule_exists = 1;
if(rule_exists)
log_msg(LOG_DEBUG,
server/fw_util_iptables.c
+12 -27
View File
@@ -73,7 +73,7 @@ rule_exists_no_chk_support(const fko_srv_options_t * const opts,
const char * const srcip, const char * const dstip,
const unsigned int port, const unsigned int exp_ts)
{
int rule_exists=0, rule_num=0, rtmp=0;
int rule_exists=0;
char cmd_buf[CMD_BUFSIZE] = {0};
char target_search[CMD_BUFSIZE] = {0};
char proto_search[CMD_BUFSIZE] = {0};
@@ -117,36 +117,21 @@ rule_exists_no_chk_support(const fko_srv_options_t * const opts,
}
snprintf(exp_ts_search, CMD_BUFSIZE-1, "%u ", exp_ts);
/* search for each of the substrings, and require the returned
* rule number to be the same across all searches to return true
/* search for each of the substrings - yes, matches from different
* rules may get triggered here, but the expiration time is the
* primary search method
*/
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, exp_ts_search, &pid_status, opts);
if(rtmp > 0)
{
rule_num = rtmp;
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, proto_search, &pid_status, opts);
if(rtmp == rule_num)
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, srcip_search, &pid_status, opts);
if(rtmp == rule_num)
rtmp = (dstip == NULL) ? rtmp : search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, dstip_search, &pid_status, opts);
if(rtmp == rule_num)
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, target_search, &pid_status, opts);
if(rtmp == rule_num)
rtmp = search_extcmd(cmd_buf, WANT_STDERR,
NO_TIMEOUT, port_search, &pid_status, opts);
if(rtmp == rule_num)
rule_exists = 1;
}
if(search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, exp_ts_search, &pid_status, opts)
&& search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, proto_search, &pid_status, opts)
&& search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, srcip_search, &pid_status, opts)
&& (dstip == NULL) ? 1 : search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, dstip_search, &pid_status, opts)
&& search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, target_search, &pid_status, opts)
&& search_extcmd(cmd_buf, WANT_STDERR, NO_TIMEOUT, port_search, &pid_status, opts))
rule_exists = 1;
if(rule_exists)
log_msg(LOG_DEBUG,
"rule_exists_no_chk_support() %s %u -> %s expires: %u rule (already exists",
"rule_exists_no_chk_support() %s %u -> %s expires: %u rule already exists",
proto_search, port, srcip, exp_ts);
else
log_msg(LOG_DEBUG,
test/test-fwknop.pl
+29 -5
View File
@@ -21,7 +21,8 @@ our $local_hmac_key_file = 'local_hmac_spa.key';
my $output_dir = 'output';
our $conf_dir = 'conf';
my $run_dir = 'run';
our $run_tmp_dir = 'runtmp';
our $run_tmp_dir_top = 'runtmp';
our $run_tmp_dir = "$run_tmp_dir_top/subdir1/subdir2";
my $cmd_out_tmp = 'cmd.out';
my $server_cmd_tmp = 'server_cmd.out';
my $openssl_cmd_tmp = 'openssl_cmd.out';
@@ -831,12 +832,14 @@ my %test_keys = (
'server_conf_file' => $OPTIONAL,
'digest_cache_file' => $OPTIONAL,
'cmd_exec_file_owner' => $OPTIONAL,
'rm_rule_mid_cycle' => $OPTIONAL,
'server_receive_re' => $OPTIONAL,
'positive_output_matches' => $OPTIONAL,
'negative_output_matches' => $OPTIONAL,
'client_and_server_mode' => $OPTIONAL_NUMERIC,
'insert_rule_before_exec' => $OPTIONAL,
'insert_rule_while_running' => $OPTIONAL,
'insert_duplicate_rule_while_running' => $OPTIONAL,
'weak_server_receive_check' => $OPTIONAL,
'search_for_rule_after_exit' => $OPTIONAL,
'rc_positive_output_matches' => $OPTIONAL,
@@ -5293,6 +5296,18 @@ sub client_server_interaction() {
$cmd_out_tmp, $curr_test_file);
}
if ($test_hr->{'insert_duplicate_rule_while_running'}) {
### insert duplicate rules - guess that this is for SSH
for (my $i=0; $i < 4; $i++) {
my $time_prefix = '_exp_' . (time() + 2+$i); ### default timeout
&write_test_file("[+] Inserting duplicate rule with expire comment: $time_prefix\n",
$curr_test_file);
&run_cmd("iptables -A FWKNOP_INPUT -p 6 -s $fake_ip -d 0.0.0.0/0 " .
"--dport 22 -m comment --comment $time_prefix -j ACCEPT",
$cmd_out_tmp, $curr_test_file);
}
}
&iptables_rm_chains($test_hr)
if $test_hr->{'iptables_rm_chains_after_server_start'};
@@ -5344,11 +5359,20 @@ sub client_server_interaction() {
}
if ($fw_rule_created) {
if ($test_hr->{'rm_rule_mid_cycle'}) {
&write_test_file("[+] Flushing firewall rules out from under fwknopd...\n",
$curr_test_file);
&run_cmd("$lib_view_str $valgrind_str $fwknopdCmd " .
"$default_server_conf_args --fw-flush $verbose_str",
$cmd_out_tmp, $curr_test_file);
}
sleep 3; ### allow time for rule time out.
if (&is_fw_rule_active($test_hr)) {
&write_test_file("[-] new fw rule not timed out, setting rv=0.\n",
$curr_test_file);
$rv = 0;
if ($test_hr->{'fw_rule_removed'} ne $REQUIRE_NO_NEW_REMOVED) {
&write_test_file("[-] new fw rule not timed out, setting rv=0.\n",
$curr_test_file);
$rv = 0;
}
} else {
&write_test_file("[+] new fw rule timed out.\n", $curr_test_file);
$fw_rule_removed = 1;
@@ -6818,7 +6842,7 @@ sub preserve_previous_test_run_results() {
mkdir $output_dir or die "[*] Could not mkdir $output_dir: $!";
}
for my $dir ($run_dir, $run_tmp_dir) {
for my $dir ($run_dir, $run_tmp_dir_top) {
if (-d $dir) {
rmtree $dir or die $!;
}
test/tests/rijndael_hmac.pl
+41
View File
@@ -178,6 +178,47 @@
'key_file' => $cf{'rc_hmac_b64_key'},
'client_cycles_per_server_instance' => 3,
},
{
'category' => 'Rijndael+HMAC',
'subcategory' => 'client+server',
'detail' => '--ipt-no-check dupe rule',
'function' => \&spa_cycle,
'cmdline' => $default_client_hmac_args,
'fwknopd_cmdline' => "$fwknopdCmd -c $cf{'def'} -a $cf{'hmac_access'} " .
"-d $default_digest_file -p $default_pid_file " .
"$intf_str --no-ipt-check-support --no-firewd-check-support",
'fw_rule_created' => $NEW_RULE_REQUIRED,
'fw_rule_removed' => $REQUIRE_NO_NEW_REMOVED,
'key_file' => $cf{'rc_hmac_b64_key'},
'insert_duplicate_rule_while_running' => $YES,
},
{
'category' => 'Rijndael+HMAC',
'subcategory' => 'client+server',
'detail' => 'rm rule mid-cycle',
'function' => \&spa_cycle,
'cmdline' => $default_client_hmac_args,
'fwknopd_cmdline' => "$fwknopdCmd -c $cf{'def'} -a $cf{'hmac_access'} " .
"-d $default_digest_file -p $default_pid_file $intf_str",
'fw_rule_created' => $NEW_RULE_REQUIRED,
'fw_rule_removed' => $NEW_RULE_REMOVED,
'rm_rule_mid_cycle' => $YES,
'key_file' => $cf{'rc_hmac_b64_key'},
},
{
'category' => 'Rijndael+HMAC',
'subcategory' => 'client+server',
'detail' => 'dupe rule mid-cycle',
'function' => \&spa_cycle,
'cmdline' => $default_client_hmac_args,
'fwknopd_cmdline' => "$fwknopdCmd -c $cf{'def'} -a $cf{'hmac_access'} " .
"-d $default_digest_file -p $default_pid_file $intf_str",
'fw_rule_created' => $NEW_RULE_REQUIRED,
'fw_rule_removed' => $REQUIRE_NO_NEW_REMOVED,
'key_file' => $cf{'rc_hmac_b64_key'},
'insert_duplicate_rule_while_running' => $YES,
},
{
'category' => 'Rijndael+HMAC',
test/tests/rijndael_hmac_cmd_exec.pl
+13
View File
@@ -15,6 +15,19 @@
"-d $default_digest_file -p $default_pid_file $intf_str",
'fw_rule_created' => $REQUIRE_NO_NEW_RULE,
},
{
'category' => 'Rijndael+HMAC',
'subcategory' => 'client+server',
'detail' => 'command execution not allowed',
'function' => \&spa_cycle,
'cmdline' => qq|$fwknopCmd --server-cmd "touch $cmd_exec_test_file" | .
"-a $fake_ip -D $loopback_ip --rc-file $cf{'rc_hmac_b64_key'} ".
"$verbose_str",
'fwknopd_cmdline' => "$fwknopdCmd -c $cf{'def'} -a $cf{'hmac_access'} " .
"-d $default_digest_file -p $default_pid_file $intf_str",
'fw_rule_created' => $REQUIRE_NO_NEW_RULE,
'server_positive_output_matches' => [qr/Command messages are not allowed/]
},
{
'category' => 'Rijndael+HMAC',
'subcategory' => 'client+server',