DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

Adding support for reading encryption/key password from a file descriptor.

Browse Source 
* Added tests to the test suite.
 * Updated the usage message.
 * Fixed the password functions.

reference : mrash/fwknop#74
This commit is contained in:
Franck Joncourt
2013-06-02 21:36:17 +02:00
parent f3af0d48c5
commit 9fce10abd8
6 changed files with 73 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/config_init.c
+14 -10
View File
@@ -1384,18 +1384,19 @@ validate_options(fko_cli_options_t *options)
static void
set_defaults(fko_cli_options_t *options)
{
options->spa_proto = FKO_DEFAULT_PROTO;
options->spa_dst_port = FKO_DEFAULT_PORT;
options->fw_timeout = -1;
options->spa_proto = FKO_DEFAULT_PROTO;
options->spa_dst_port = FKO_DEFAULT_PORT;
options->fw_timeout = -1;
options->key_len = FKO_DEFAULT_KEY_LEN;
options->hmac_key_len = FKO_DEFAULT_HMAC_KEY_LEN;
options->hmac_type = FKO_HMAC_UNKNOWN; /* updated when HMAC key is used */
options->key_len = FKO_DEFAULT_KEY_LEN;
options->hmac_key_len = FKO_DEFAULT_HMAC_KEY_LEN;
options->hmac_type = FKO_HMAC_UNKNOWN; /* updated when HMAC key is used */
options->spa_icmp_type = ICMP_ECHOREPLY; /* only used in '-P icmp' mode */
options->spa_icmp_code = 0; /* only used in '-P icmp' mode */
options->spa_icmp_type = ICMP_ECHOREPLY; /* only used in '-P icmp' mode */
options->spa_icmp_code = 0; /* only used in '-P icmp' mode */
options->input_fd = FD_INVALID;
options->input_fd = -1;
return;
}
@@ -1790,7 +1791,7 @@ config_init(fko_cli_options_t *options, int argc, char **argv)
break;
case FD_SET:
options->input_fd = strtol_wrapper(optarg, 0,
65535, EXIT_UPON_ERR, &is_err);;
-1, EXIT_UPON_ERR, &is_err);
break;
default:
usage();
@@ -1831,6 +1832,8 @@ usage(void)
" -C, --server-cmd Specify a command that the fwknop server will\n"
" execute on behalf of the fwknop client..\n"
" -D, --destination Specify the IP address of the fwknop server.\n"
" --fd Specify the file descriptor to read the\n"
" encryption key/password from.\n"
" -n, --named-config Specify an named configuration stanza in the\n"
" '$HOME/.fwknoprc' file to provide some of all\n"
" of the configuration parameters.\n"
@@ -1921,6 +1924,7 @@ usage(void)
" --save-rc-stanza Save command line arguments to the\n"
" $HOME/.fwknoprc stanza specified with the\n"
" -n option.\n"
" --stdin Read the encryption key/password from stdin\n"
" --force-stanza Used with --save-rc-stanza to overwrite all of\n"
" the variables for the specified stanza\n"
" --nat-local Access a local service via a forwarded port\n"
client/getpasswd.c
+19 -13
View File
@@ -39,6 +39,7 @@
#include "fwknop_common.h"
#include "getpasswd.h"
#include "utils.h"
#define PW_BUFSIZE 128 /*!< Maximum number of chars an encryption key or a password can contain */
@@ -84,7 +85,7 @@ read_passwd_from_stream(FILE *stream)
else if (c == PW_CLEAR_CHAR)
ptr = ARRAY_FIRST_ELT_ADR(password);
/* Fill in the password buffer until it reach the last -1 char.
/* Fill in the password buffer until it reaches the last -1 char.
* The last char is used to NULL terminate the string. */
else if (ptr < ARRAY_LAST_ELT_ADR(password))
{
@@ -110,11 +111,15 @@ read_passwd_from_stream(FILE *stream)
/**
* @brief Function for accepting password input from users
*
* The functions reads chars from the terminal and store them in a buffer of chars.
* The functions reads chars from a buffered stream and store them in a buffer of
* chars. If a file descriptor is supplied then, the password is read from
* the associated stream, otherwise a new buffered stream is created and a
* prompt is displayed to the user.
*
* @param prompt String displayed on the terminal to prompt the user for a password
* or an encryption key
* @param fd File descriptor
* @param prompt String displayed on the terminal to prompt the user for a
* password or an encryption key
* @param fd File descriptor to use to read the pasword from. If fd is set
* to FD_INVALID, then a new stream is opened.
*
* @return NULL if a problem occured or the user killed the terminal (Ctrl-C)\n
* otherwise the password - empty password is accepted.
@@ -128,22 +133,22 @@ getpasswd(const char *prompt, int fd)
sigset_t sig, old_sig;
struct termios ts, old_ts;
FILE *fp;
int use_ext_fd = 0;
if (fd >= 0)
/* If a valid file descriptor is supplied, we try to open a stream from it */
if (FD_IS_VALID(fd))
{
fp = fdopen(fd, "r");
if (fp == NULL)
{
log_msg(LOG_VERBOSITY_ERROR, "getpasswd() - "
"Unable to create a stream from file descriptor : %s",
"Unable to create a stream from the file descriptor : %s",
strerror(errno));
exit(EXIT_FAILURE);
}
use_ext_fd = 1;
}
if (use_ext_fd == 0)
/* Otherwise we are going to open a new stream */
else
{
if((fp = fopen(ctermid(NULL), "r+")) == NULL)
return(NULL);
@@ -180,7 +185,8 @@ getpasswd(const char *prompt, int fd)
#ifndef WIN32
if (use_ext_fd == 0)
/* If we used a new buffered stream */
if (FD_IS_VALID(fd) == 0)
{
/* we can go ahead and echo out a newline.
*/
@@ -190,9 +196,9 @@ getpasswd(const char *prompt, int fd)
*/
tcsetattr(fileno(fp), TCSAFLUSH, &old_ts);
sigprocmask(SIG_BLOCK, &old_sig, NULL);
fclose(fp);
}
fclose(fp);
#else
/* In Windows, it would be a CR-LF
*/
client/utils.h
+3
View File
@@ -48,6 +48,9 @@
#define PROTOCOL_BUFSIZE 16 /*!< Maximum number of chars for a protocol string (TCP for example) */
#define FD_INVALID -1
#define FD_IS_VALID(x) ((x)>=0)
/* Prototypes
*/
void hex_dump(const unsigned char *data, const int size);
test/test-fwknop.pl
+1
View File
@@ -16,6 +16,7 @@ use strict;
#==================== config =====================
my $logfile = 'test.log';
our $local_key_file = 'local_spa.key';
our $local_spa_key = 'fwknoptest';
our $local_hmac_key_file = 'local_hmac_spa.key';
my $output_dir = 'output';
our $conf_dir = 'conf';
test/tests/basic_operations.pl
+10 -2
View File
@@ -21,7 +21,6 @@
"-O $conf_dir/override_fwknopd.conf --dump-config",
'fatal' => $NO
},
{
'category' => 'basic operations',
'subcategory' => 'client',
@@ -700,5 +699,14 @@
'cmdline' => $default_client_args . " --test --encryption-mode badmode",
'positive_output_matches' => [qr/Invalid\sencryption\smode:\sbadmode/],
'fatal' => $NO
},
},
{
'category' => 'basic operations',
'subcategory' => 'client',
'detail' => 'bad file descriptor',
'function' => \&generic_exec,
'cmdline' => $default_client_args . " --test --fd -1",
'positive_output_matches' => [qr/Value\s.*out\sof\srange/],
'fatal' => $NO
},
);
test/tests/rijndael.pl
+26
View File
@@ -11,6 +11,32 @@
'fw_rule_removed' => $NEW_RULE_REMOVED,
'fatal' => $NO
},
{
'category' => 'Rijndael',
'subcategory' => 'client+server',
'detail' => 'use of encryption key with fd 0',
'function' => \&spa_cycle,
'cmdline' => "echo $local_spa_key | $default_client_args_no_get_key " .
"--fd 0",
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
"$fwknopdCmd $default_server_conf_args $intf_str",
'fw_rule_created' => $NEW_RULE_REQUIRED,
'fw_rule_removed' => $NEW_RULE_REMOVED,
'fatal' => $NO
},
{
'category' => 'Rijndael',
'subcategory' => 'client+server',
'detail' => 'use of encryption key with stdin',
'function' => \&spa_cycle,
'cmdline' => "echo $local_spa_key | $default_client_args_no_get_key " .
"--stdin",
'fwknopd_cmdline' => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
"$fwknopdCmd $default_server_conf_args $intf_str",
'fw_rule_created' => $NEW_RULE_REQUIRED,
'fw_rule_removed' => $NEW_RULE_REMOVED,
'fatal' => $NO
},
{
'category' => 'Rijndael',
'subcategory' => 'client+server',