diff --git a/Makefile.am b/Makefile.am index 1d439a06..727aea52 100644 --- a/Makefile.am +++ b/Makefile.am @@ -164,6 +164,7 @@ EXTRA_DIST = \ test/conf/gpg_no_pw_fpr_access.conf \ test/conf/gpg_no_pw_bad_fpr_access.conf \ test/conf/gpg_no_pw_no_fpr_access.conf \ + test/conf/gpg_no_sig_verify_access.conf \ test/conf/fwknoprc_gpg_invalid_exe \ test/conf/fwknoprc_hmac_defaults \ test/conf/fwknoprc_hmac_time_offset_mins \ diff --git a/test/conf/gpg_no_sig_verify_access.conf b/test/conf/gpg_no_sig_verify_access.conf new file mode 100644 index 00000000..b4167dd0 --- /dev/null +++ b/test/conf/gpg_no_sig_verify_access.conf @@ -0,0 +1,8 @@ +SOURCE ANY +FW_ACCESS_TIMEOUT 3 +GPG_HOME_DIR conf/server-gpg-no-pw +GPG_DECRYPT_ID 361BBAD4 +GPG_ALLOW_NO_PW Y +### the following ID won't verify, but we've disabled signature verification +GPG_REMOTE_ID AAAAAAAA +GPG_DISABLE_SIG Y diff --git a/test/test-fwknop.pl b/test/test-fwknop.pl index 0c7dc10f..0b16f267 100755 --- a/test/test-fwknop.pl +++ b/test/test-fwknop.pl @@ -118,6 +118,7 @@ our %cf = ( 'gpg_no_pw_hmac_clientdir_access' => "$conf_dir/gpg_no_pw_hmac_clientdir_access.conf", 'gpg_no_pw_hmac_serverdir_access' => "$conf_dir/gpg_no_pw_hmac_serverdir_access.conf", 'gpg_no_pw_hmac_sha512_access' => "$conf_dir/gpg_no_pw_hmac_sha512_access.conf", + 'gpg_no_sig_verify_access' => "$conf_dir/gpg_no_sig_verify_access.conf", 'tcp_server' => "$conf_dir/tcp_server_fwknopd.conf", 'spa_over_http' => "$conf_dir/spa_over_http_fwknopd.conf", 'tcp_pcap_filter' => "$conf_dir/tcp_pcap_filter_fwknopd.conf", diff --git a/test/tests/gpg_no_pw.pl b/test/tests/gpg_no_pw.pl index da95d6c5..bc11a567 100644 --- a/test/tests/gpg_no_pw.pl +++ b/test/tests/gpg_no_pw.pl @@ -10,6 +10,19 @@ 'fw_rule_created' => $NEW_RULE_REQUIRED, 'fw_rule_removed' => $NEW_RULE_REMOVED, }, + { + 'category' => 'GPG (no pw)', + 'subcategory' => 'client+server', + 'detail' => 'complete cycle no sig verify', + 'function' => \&spa_cycle, + 'cmdline' => $default_client_gpg_args_no_pw, + 'fwknopd_cmdline' => "$fwknopdCmd -c $cf{'def'} " . + "-a $cf{'gpg_no_sig_verify_access'} $intf_str " . + "-d $default_digest_file -p $default_pid_file", + 'fw_rule_created' => $NEW_RULE_REQUIRED, + 'fw_rule_removed' => $NEW_RULE_REMOVED, + }, + { 'category' => 'GPG (no pw)', 'subcategory' => 'client+server',