From b06447384e8d5f5c68efaf959c0d390daf984d94 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Sun, 27 Jul 2014 22:03:58 -0400 Subject: [PATCH] [client] have autoconf resolve the absolute path to wget for SSL IP resolution --- client/cmd_opts.h | 3 +- client/config_init.c | 48 ++++++++++++++++++++++- client/fwknop.8.in | 52 +++++++++++++++++++++++-- client/fwknop.c | 2 + client/fwknop_common.h | 3 +- client/http_resolve_host.c | 31 +++++++++++---- configure.ac | 22 +++++++++++ doc/fwknop.man.asciidoc | 23 ++++++++++- test/conf/client-gpg-no-pw/trustdb.gpg | Bin 1360 -> 1360 bytes test/tests/basic_operations.pl | 39 +++++++++++++++++++ 10 files changed, 207 insertions(+), 16 deletions(-) diff --git a/client/cmd_opts.h b/client/cmd_opts.h index d39f976c..2ff0ee89 100644 --- a/client/cmd_opts.h +++ b/client/cmd_opts.h @@ -78,7 +78,7 @@ enum { /* Our getopt_long options string. */ -#define GETOPTS_OPTION_STRING "a:A:bB:C:D:E:f:gG:hH:kK:lm:M:n:N:p:P:Q:rRsS:Tu:U:vV" +#define GETOPTS_OPTION_STRING "a:A:bB:C:D:E:f:gG:hH:kK:lm:M:n:N:p:P:Q:rRsS:Tu:U:vVw:" /* Our program command-line options... */ @@ -150,6 +150,7 @@ static struct option cmd_opts[] = {"spoof-user", 1, NULL, 'U'}, {"verbose", 0, NULL, 'v'}, {"version", 0, NULL, 'V'}, + {"wget-cmd", 1, NULL, 'w'}, {0, 0, 0, 0} }; diff --git a/client/config_init.c b/client/config_init.c index 3c229293..fb01d965 100644 --- a/client/config_init.c +++ b/client/config_init.c @@ -125,6 +125,7 @@ enum FWKNOP_CLI_ARG_RESOLVE_IP_HTTP, FWKNOP_CLI_ARG_RESOLVE_IP_HTTPS, FWKNOP_CLI_ARG_RESOLVE_HTTP_ONLY, + FWKNOP_CLI_ARG_WGET_CMD, FWKNOP_CLI_LAST_ARG } fwknop_cli_arg_t; @@ -169,7 +170,8 @@ static fko_var_t fko_var_array[FWKNOP_CLI_LAST_ARG] = { "VERBOSE", FWKNOP_CLI_ARG_VERBOSE }, { "RESOLVE_IP_HTTP", FWKNOP_CLI_ARG_RESOLVE_IP_HTTP }, { "RESOLVE_IP_HTTPS", FWKNOP_CLI_ARG_RESOLVE_IP_HTTPS }, - { "RESOLVE_HTTP_ONLY", FWKNOP_CLI_ARG_RESOLVE_HTTP_ONLY } + { "RESOLVE_HTTP_ONLY", FWKNOP_CLI_ARG_RESOLVE_HTTP_ONLY }, + { "WGET_CMD", FWKNOP_CLI_ARG_WGET_CMD } }; /* Array to define which conf. variables are critical and should not be @@ -1177,6 +1179,20 @@ parse_rc_param(fko_cli_options_t *options, const char *var_name, char * val) } strlcpy(options->resolve_url, val, tmpint); } + /* wget command */ + else if (var->pos == FWKNOP_CLI_ARG_WGET_CMD) + { + if(options->wget_bin != NULL) + free(options->wget_bin); + tmpint = strlen(val)+1; + options->wget_bin = calloc(1, tmpint); + if(options->wget_bin == NULL) + { + log_msg(LOG_VERBOSITY_ERROR,"Memory allocation error for wget command path."); + exit(EXIT_FAILURE); + } + strlcpy(options->wget_bin, val, tmpint); + } /* NAT Local ? */ else if (var->pos == FWKNOP_CLI_ARG_NAT_LOCAL) { @@ -1233,6 +1249,14 @@ parse_rc_param(fko_cli_options_t *options, const char *var_name, char * val) options->resolve_ip_http_https = 1; else; } + /* RESOLVE_HTTP_ONLY ? Force HTTP instead of HTTPS IP resolution. + */ + else if (var->pos == FWKNOP_CLI_ARG_RESOLVE_HTTP_ONLY) + { + if (is_yes_str(val)) + options->resolve_http_only = 1; + else; + } /* The variable is not a configuration variable */ else { @@ -1388,6 +1412,13 @@ add_single_var_to_rc(FILE* fhandle, short var_pos, fko_cli_options_t *options) case FWKNOP_CLI_ARG_RESOLVE_IP_HTTP: bool_to_yesno(options->resolve_ip_http_https, val, sizeof(val)); break; + case FWKNOP_CLI_ARG_RESOLVE_HTTP_ONLY: + bool_to_yesno(options->resolve_http_only, val, sizeof(val)); + break; + case FWKNOP_CLI_ARG_WGET_CMD : + if (options->wget_bin != NULL) + strlcpy(val, options->wget_bin, sizeof(val)); + break; default: log_msg(LOG_VERBOSITY_WARNING, "Warning from add_single_var_to_rc() : Bad variable position %u", var->pos); return; @@ -2181,8 +2212,8 @@ config_init(fko_cli_options_t *options, int argc, char **argv) case RESOLVE_HTTP_ONLY: options->resolve_http_only = 1; options->resolve_ip_http_https = 1; - add_var_to_bitmask(FWKNOP_CLI_ARG_RESOLVE_IP_HTTP, &var_bitmask); add_var_to_bitmask(FWKNOP_CLI_ARG_RESOLVE_HTTP_ONLY, &var_bitmask); + add_var_to_bitmask(FWKNOP_CLI_ARG_RESOLVE_IP_HTTPS, &var_bitmask); break; case RESOLVE_URL: if(options->resolve_url != NULL) @@ -2197,6 +2228,19 @@ config_init(fko_cli_options_t *options, int argc, char **argv) strlcpy(options->resolve_url, optarg, rlen); add_var_to_bitmask(FWKNOP_CLI_ARG_RESOLVE_URL, &var_bitmask); break; + case 'w': + if(options->wget_bin != NULL) + free(options->wget_bin); + rlen = strlen(optarg) + 1; + options->wget_bin = calloc(1, rlen); + if(options->wget_bin == NULL) + { + log_msg(LOG_VERBOSITY_ERROR, "Memory allocation error for resolve URL."); + exit(EXIT_FAILURE); + } + strlcpy(options->wget_bin, optarg, rlen); + add_var_to_bitmask(FWKNOP_CLI_ARG_WGET_CMD, &var_bitmask); + break; case SHOW_LAST_ARGS: options->show_last_command = 1; break; diff --git a/client/fwknop.8.in b/client/fwknop.8.in index 90179681..07c0bc52 100644 --- a/client/fwknop.8.in +++ b/client/fwknop.8.in @@ -2,12 +2,12 @@ .\" Title: fwknop .\" Author: [see the "AUTHORS" section] .\" Generator: DocBook XSL Stylesheets v1.78.1 -.\" Date: 07/25/2014 +.\" Date: 07/27/2014 .\" Manual: Fwknop Client .\" Source: Fwknop Client .\" Language: English .\" -.TH "FWKNOP" "8" "07/25/2014" "Fwknop Client" "Fwknop Client" +.TH "FWKNOP" "8" "07/27/2014" "Fwknop Client" "Fwknop Client" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -528,6 +528,17 @@ is not available (or hasn\(cqt been compiled with SSL support), but generally th and omit this option\&. .RE .PP +\fB\-w, \-\-wget\-cmd\fR=\fI\fR +.RS 4 +Manually set the full path to the +\fIwget\fR +command\&. Normally the +\fIconfigure\fR +script finds the +\fIwget\fR +command, but this option can be used to specify the path if it is located in a non\-standard place\&. +.RE +.PP \fB\-s, \-\-source\-ip\fR .RS 4 Instruct the @@ -811,9 +822,44 @@ Set the source port to use for sending the SPA packet (\fI\-S, \-\-source\-port\ Set the firewall rule timeout value (\fI\-f, \-\-fw\-timeout\fR)\&. .RE .PP +\fBRESOLVE_IP_HTTPS\fR \fI\fR +.RS 4 +Set to +\fIY\fR +to automatically resolve the externally routable IP associated with the +\fBfwknop\fR +client\&. This is done over SSL via +\fIwget\fR +in +\fI\-\-secure\-protocol\fR +mode against the IP resolution service available at +\fIhttps://www\&.cipherdyne\&.org/cgi\-bin/myip\fR\&. +.RE +.PP +\fBRESOLVE_HTTP_ONLY\fR \fI\fR +.RS 4 +When the +\fBfwknop\fR +client is instructed to resolve the external client IP, this option can be used to force an +\fIHTTP\fR +connection instead of an +\fIHTTPS\fR +connection when set to +\fIY\fR\&. This option is useful when +\fIwget\fR +is not installed on the local OS, or when it is not compiled against an SSL library\&. +.RE +.PP \fBRESOLVE_URL\fR \fI\fR .RS 4 -Set to a URL that will be used for resolving the source IP address (\-\-resolve\-url)\&. +Set to a URL that will be used for resolving the source IP address (\fI\-\-resolve\-url\fR)\&. +.RE +.PP +\fBWGET_CMD\fR \fI\fR +.RS 4 +Set the full path to the +\fIwget\fR +command (used for client IP resolution)\&. .RE .PP \fBTIME_OFFSET\fR \fI