root/fwknop/trunk/fwknop

#!/usr/bin/perl -w
#
#############################################################################
#
# File: fwknop
#
# URL: http://www.cipherdyne.org/fwknop/
#
# Purpose: fwknop implements an authorization scheme known as Single Packet
#          Authorization (SPA) that requires only a single encrypted packet to
#          communicate various pieces of information including desired access
#          through an iptables/ipfw policy and/or specific commands to execute
#          on the target system.  The main application of this program is to
#          protect services such as SSH with an additional layer of security
#          in order to make the exploitation of vulnerabilities (both 0-day
#          and unpatched code) much more difficult.  fwknop also supports
#          encrypted port knocking, but this is a legacy authentication mode
#          when compared to SPA.
#
#          More information can be found in the fwknop(8) and fwknopd(8) man
#          pages, and also online here:
#
#          http://www.cipherdyne.org/fwknop/docs/
#
# Author: Michael Rash (mbr@cipherdyne.org)
#
# Version: 1.9.9
#
# Copyright (C) 2004-2008 Michael Rash (mbr@cipherdyne.org)
#
# License - GNU Public License version 2 (GPLv2):
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program; if not, write to the Free Software
#    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307
#    USA
#
#############################################################################
#
# $Id$
#

use IO::Socket;
use IO::Handle;
use MIME::Base64;
use Data::Dumper;
use POSIX;
use Getopt::Long;
use strict;

my $version = '1.9.9';
my $revision_svn = '$Revision$';
my $rev_num = '1';
($rev_num) = $revision_svn =~ m|\$Rev.*:\s+(\S+)|;

my $lib_dir = '/usr/lib/fwknop';
my $print_version = 0;
my $print_help    = 0;
my $run_last_args = 0;
my $debug         = 0;
my $quiet         = 0;
my $verbose       = 0;
my $test_mode     = 0;
my $cmdl_homedir  = '';
my $knock_sleep   = 1;  ### default to 1 second difference between port knocks
my $knock_dst     = '';
my $homedir       = '';
my $min_port      = 10000;
my $max_port      = 65535;
my $spoof_src     = '';
my $server_mode   = 'pcap';
my $user_rc_file  = '';
my $server_proto  = '';
my $run_last_host = '';
my $total_digest  = '';
my $show_last_host_cmd = '';
my $show_last_cmd = 0;
my $time_offset_plus = '';
my $time_offset_minus = '';
my $use_md5       = 0;
my $use_sha1      = 0;
my $use_sha256    = 0;
my $gpg_home_dir  = '';
my $gpg_recipient = '';
my $use_gpg_agent = 0;
my $max_msg_len   = 1500;
my $max_resolve_http_recv = 1500;
my $gpg_verbose   = 0;
my $gpg_no_options = 0;
my $gpg_agent_info = '';
my $include_salted = 0;
my $client_src_port = 0;
my $gpg_default_key = 0;
my $gpg_use_options = 0;
my $err_wait_timer  = 30;  ### seconds
my $resolve_ip_url  = 'http://www.whatismyip.org/';
my $gpg_signing_key = '';
my $save_packet_mode = 0;
my $save_packet_file = '';
my $save_packet_append = 0;
my $cmdline_pcap_cmd   = '';
my $no_save_last_args  = 0;
my $save_destination   = 0;
my $server_auth_method = '';
my $spa_established_tcp  = 0;
my $resolve_external_ip  = 0;
my $server_auth_crypt_pw = '';
my $pcap_sleep_interval  = 1;  ### seconds
my $knock_dst_pre_resolve = '';
my $selected_random_nat_port = 0;
my $include_base64_trailing_equals = 0;
my $include_base64_gnupg_prefix = 0;
my $rand_port     = 0;  ### for SPA packet destination port
my $NAT_rand_port = 0;  ### for randomized access based on
                        ### NAT rules (e.g. ssh -p <randport>).
my $NAT_local = 0; ### Flag for forwarding a port to local socket.

my $locale = 'C';  ### default LC_ALL env variable
my $no_locale = 0;
my $gpg_prefix = 'hQ';  ### base64 encoded version of 0x8502
my $gpg_path = '';

### User agent for contacting http://www.whatismyip.org/, (can
### override with --User-agent)
my $ext_resolve_user_agent = "Fwknop/$version";
$ext_resolve_user_agent =~ s|-pre\d+||;

### ACCESS message:
###     random data : user : client_timestamp : client_version : \
###     type (1) : access_request : message digest
my $SPA_ACCESS_MODE  = 1;  ### default

### COMMAND message:
###     random data : user : client_timestamp : client_version : \
###     type (0) : command : message digest
my $SPA_COMMAND_MODE = 0;

### NAT ACCESS message:
###     random data : user : client_timestamp : client_version : \
###     type (2) : access_request : NAT_info : message digest
my $SPA_NAT_ACCESS_MODE = 2;

### ACCESS message with client-defined firewall timeout:
###     random data : user : client_timestamp : client_version : \
###     type (3) : access_request : timeout : message digest
my $SPA_CLIENT_TIMEOUT_ACCESS_MODE = 3;

### NAT ACCESS message with client-defined firewall timeout:
###     random data : user : client_timestamp : client_version : \
###     type (4) : access_request : NAT_info : timeout : message digest
my $SPA_CLIENT_TIMEOUT_NAT_ACCESS_MODE = 4;

### local NAT ACCESS message:
###     random data : user : client_timestamp : client_version : \
###     type (5) : access_request : NAT_info : message digest
my $SPA_LOCAL_NAT_ACCESS_MODE = 5;

### local NAT ACCESS message with client-defined firewall timeout:
###     random data : user : client_timestamp : client_version : \
###     type (6) : access_request : NAT_info : timeout : message digest
my $SPA_CLIENT_TIMEOUT_LOCAL_NAT_ACCESS_MODE = 6;

### default time values
my $knock_interval  = 60;
my $cmdl_fw_timeout = 0;

### Digest types and command argument flags
my $MD5_DIGEST    = 1;
my $SHA1_DIGEST   = 2;
my $SHA256_DIGEST = 3;
my $digest_type = $SHA256_DIGEST; ### default
my $cmdl_digest_alg = '';

### default destination port; you can change with --Server-port,
### --rand-port, or by appending the ":<port>" syntax to the
## destination host
my $DEFAULT_PORT = 62201;

### default to root (client must run as root in this mode)
my $spoof_username = '';
my $spoof_proto    = 'udp';  ### default to udp

### encrypted port knock vars (these are only used in the legacy
### port knocking mode).
my $cmdline_offset  = 0;
my $enc_port_offset = 61000;  ### default offset
my $enc_key         = '';
my $enc_alg         = 'Rijndael';
my $enc_blocksize   = 32;

### there is a constant "RIJNDAEL_KEYSIZE" in the Crypt::Rijndael sources, but
### it is not used; a 16 byte key size is fine.
my $enc_keysize = 16;

my $enc_shared_secret = '';
my $enc_allow_ip      = '';
my $enc_source_ip     = '';
my $enc_rotate_proto  = 0;
my $get_key_file      = '';  ### get key from file
my $enc_pcap_port     = $DEFAULT_PORT;
my $access_str        = '';
my $NAT_access_str = '';  ### for access through the iptables FORWARD chain

### packet counters
my $tcp_ctr  = 0;
my $udp_ctr  = 0;
my $icmp_ctr = 0;

### tcp option types
my $tcp_nop_type       = 1;
my $tcp_mss_type       = 2;
my $tcp_win_scale_type = 3;
my $tcp_sack_type      = 4;
my $tcp_timestamp_type = 8;

my %tcp_p0f_opt_types = (
    'N' => $tcp_nop_type,
    'M' => $tcp_mss_type,
    'W' => $tcp_win_scale_type,
    'S' => $tcp_sack_type,
    'T' => $tcp_timestamp_type
);

my $ip_re = qr|(?:[0-2]?\d{1,2}\.){3}[0-2]?\d{1,2}|;

my @args_cp = @ARGV;

### run GetOpt() to get comand line args
&handle_command_line();

&usage(0) if $print_help;

if ($print_version) {
    print "[+] fwknop v$version (file revision: $rev_num)\n",
        "      by Michael Rash <mbr\@cipherdyne.org>\n";
    exit 0;
}

### set LC_ALL env variable
$ENV{'LC_ALL'} = $locale unless $no_locale;

&set_digest_type() if $cmdl_digest_alg;
$digest_type = $MD5_DIGEST    if $use_md5;
$digest_type = $SHA1_DIGEST   if $use_sha1;
$digest_type = $SHA256_DIGEST if $use_sha256;

### import fwknop perl modules
&import_perl_modules();

### this is only necessary for older versions of perl (newer versions
### call srand() automatically at the first usage of rand() if srand()
### was not already called).
srand();

&get_homedir();

### save a copy
$knock_dst_pre_resolve = $knock_dst;

if ($rand_port and $enc_pcap_port != $DEFAULT_PORT) {
    die "[*] Cannot use --Server-port and --rand-port at the same time";
}

### allow for ":<port>" extension to -D arg
if ($knock_dst =~ /(.*):(\d+)/) {
    $knock_dst     = $1;
    $enc_pcap_port = $2;

    die "[*] Cannot use --rand-port with a manually specified -D <host>:<port>"
        if $rand_port;
}

if ($rand_port) {
    ### send the SPA packet over a random port between 10,000 and 65535
    $enc_pcap_port = &rand_port();
}

if ($run_last_args or $show_last_cmd) {

    ### run fwknop with same command line args as the previous
    ### execution
    &run_last_cmdline();

} elsif ($run_last_host or $show_last_host_cmd) {

    $run_last_host = $show_last_host_cmd if $show_last_host_cmd;

    ### run fwknop with the last args for this particular knock destination
    &run_last_host_cmdline();
}

die "[*] Must specify a destination server with -D <IP|Host>"
    unless $knock_dst;

if ($cmdl_fw_timeout ne '0') {
    die "[*] Must specify a firewall timeout > 0"
        unless $cmdl_fw_timeout > 0;
}

my $print_mode = '';
if (lc($server_mode) eq 'pcap') {
    $print_mode = 'SPA';
} elsif (lc($server_mode) eq 'knock') {
    $print_mode = 'encrypted port knocking';
} elsif (lc($server_mode) eq 'shared') {
    $print_mode = 'shared sequence port knocking';
} else {
    die "[*] Unknown server mode: $server_mode ",
        qq|(must be "pcap", "knock", or "shared").|;
}

if ($debug) {
    print "\n[+] ***DEBUG*** Starting fwknop client ($print_mode mode)...\n";
} else {
    print "\n[+] Starting fwknop client ($print_mode mode)...\n"
        unless $quiet;
}

if ($verbose) {
    print "[+] fwknop Command line: @args_cp\n";
}

unless ($knock_dst =~ /$ip_re/) {
    print "[+] Resolving hostname: $knock_dst\n" unless $quiet;
    ### resolve to an IP
    my $iaddr = inet_aton($knock_dst)
        or die "[*] Could not resolve $knock_dst to an IP.";
    my $addr = inet_ntoa($iaddr)
        or die "[*] Could not resolve $knock_dst to an IP.";
    $knock_dst = $addr;
}

if ($NAT_local and not $NAT_access_str) {
    if ($NAT_rand_port) {
        my $rand_port = &rand_port();
        $NAT_access_str = "$knock_dst,$rand_port";
        print "[+] Requesting NAT access for randomized port: $rand_port\n";
        $selected_random_nat_port = 1;
    } else {
        $NAT_access_str = "$knock_dst,55000";
        print
"[+] Requesting NAT support for port 55,000; use --NAT-rand-port for a\n",
"    random port.\n";
    }
}

&validate_access_str() if $access_str;
&validate_NAT_access_str() if $NAT_access_str;

if (lc($server_mode) eq 'pcap' or lc($server_mode) eq 'knock') {
    die "[*] Must also specify: -D <destination>\n"
        unless $knock_dst;

    unless ($enc_allow_ip
            or $enc_source_ip
            or $resolve_external_ip) {
        die "[*] Must either specify: --allow-IP <IP>, ",
            "--source-IP, or --Resolve-external-IP\n";
    }

    ### make fwknop server see "0.0.0.0" in the encrypted sequence.
    ### This will instruct the server to open the port for whatever
    ### source IP the sequence comes from.  This is useful for
    ### clients that are behind a NAT device.
    $enc_allow_ip = '0.0.0.0' if $enc_source_ip;

    ### resolve the extenal IP via http://www.whatismyip.org
    $enc_allow_ip = &resolve_external_ip() if $resolve_external_ip;

    if ($spoof_src) {
        $< == 0 && $> == 0 or
            die '[*] You must be root (or equivalent ',
                "UID 0 account) to spoof the source address.\n";
    }
    unless ($enc_allow_ip =~ /$ip_re/) {
        ### resolve to an IP
        my $iaddr = inet_aton($enc_allow_ip)
            or die "[*] Could not resolve $enc_allow_ip to IP.";
        my $addr = inet_ntoa($iaddr)
            or die "[*] Could not resolve $enc_allow_ip to IP.";
        $enc_allow_ip = $addr;
    }
    if ($cmdline_offset) {
        if (lc($server_mode) eq 'pcap') {
            die "[*] Port offset is meaningless in pcap mode ",
                "(only a single packet is sent).";
        }
        unless ($cmdline_offset < 65280 and $cmdline_offset > 0) {
            die "[*] Port offset must be 0 < port < 65280";
        }
        $enc_port_offset = $cmdline_offset;
    }
    if (lc($server_mode) eq 'pcap') {
        unless ($enc_pcap_port < 65535 and $enc_pcap_port > 0) {
            die "[*] Port offset must be 0 < port < 65535";
        }
    }
} else {
    if ($enc_rotate_proto) {
        die '[*] Can only specify --rotate-proto with ',
            'encrypted sequences.';
    }
}

if ($save_packet_mode) {
    ### save of copy of the packet
    unless ($save_packet_file) {
        $save_packet_file = "$homedir/fwknop_save_packet.$$";
    }
    unless ($save_packet_append) {
        unlink $save_packet_file if -e $save_packet_file;
    }
}

### save our command line args (so -l can be used next time)
unless ($run_last_args or $run_last_host or $no_save_last_args
        or $show_last_cmd or $show_last_host_cmd) {
    &save_args();
}

if (lc($server_mode) eq 'pcap' or lc($server_mode) eq 'knock') {

    ### get the encryption key from the --get-key file
    ### or from STDIN if it's not in the file.
    &get_key();

    &handle_server_auth_method() if $server_auth_method;

    if (lc($server_mode) eq 'pcap') {

        ### construct and send the encrypted message to the server
        ### (sends a single packet).
        &pcap_send_encrypted_msg(&pcap_build_enc_msg());

    } else {
        ### we are running in port knocking mode, so get the
        ### encrypted port sequence (16 ports)
        &knock_ports(&encrypt_sequence());
    }
} else {
    ### we are running in non-encrypted port knocking mode, so get
    ### the port sequence
    &knock_ports(&import_shared_sequence());
}
exit 0;
#============================ end main ==============================

sub pcap_build_enc_msg() {

    ### message format (all fields are separated by ":" characters
    #
    #  random number (16 bytes)
    #  username
    #  timestamp
    #  software version
    #  message type and content:
    #    0 => command mode / command to execute
    #    1 => access mode / IP,proto,port
    #    2 => nat access mode / IP,proto,port / internalIP,externalNATPort
    #  (optional) server_auth (post 0.9.2 release)
    #  message digest (SHA256 / SHA1 / MD5 )

    my $msg = '';

    unless ($quiet) {
        print "\n[+] Building encrypted Single Packet Authorization (SPA) ",
            "message...\n";
        print "[+] Packet fields:\n\n";
    }

    ### start the SPA message with 16 bytes of random data
    $msg = &SPA_random_number();

    ### append the username
    $msg .= &SPA_user();

    ### append the timestamp
    $msg .= &SPA_timestamp();

    ### append the fwknop client version
    $msg .= &SPA_version();

    ### append the message type (integer)
    $msg .= &SPA_message_type();

    ### append the SPA message (this is usually just a request for
    ### access to a port/protocol combination)
    $msg .= &SPA_message();

    ### append NAT access requirement (optional)
    $msg .= &SPA_nat_access();

    ### append server authentication method (optional)
    $msg .= &SPA_server_auth();

    ### append any client defined fw timeout (optional)
    $msg .= &SPA_client_timeout();

    ### append Message Digest
    $msg =~ s/\n//g;
    $msg .= &SPA_digest($msg);

    if ($debug) {
        print "\n[+] Clear text message (some fields base64 encoded): $msg\n",
            "    Digest: $total_digest\n";
    }

    my $encrypted_msg = '';
    if ($gpg_signing_key or $gpg_default_key) {
        $encrypted_msg = &pcap_GPG_encrypt_msg($msg);
    } else {
        $encrypted_msg = &pcap_Rijndael_encrypt_msg($msg);
    }

    unless ($include_base64_trailing_equals) {
        print "[+] Stripping trailing equals chars from base64 encoding.\n"
            if $debug;
        $encrypted_msg =~ s/=*$//;
    }

    return $encrypted_msg;
}

sub SPA_random_number() {
    my $random_num = int(rand(100000000000000));
    $random_num .= int(rand(10)) while (length($random_num) < 16);

    print "        Random data:    $random_num\n" unless $quiet;

    return $random_num;
}

sub SPA_user() {
    my $user = 'root';
    if ($spoof_src) {
        if ($spoof_username) {
            $user = $spoof_username;
        }
    } else {
        ### getlogin() is better than using ENV{'USER'}, which is
        ### easily manipulated, so only use as a last resort.
        if ($spoof_username) {
            $user = $spoof_username;
        } else {
            $user = getlogin() || getpwuid($<) ||
                die "[*] Could not determine user; try using the ",
                    "--Spoof-user option";
        }
    }
    print  "        Username:       $user\n" unless $quiet;
    return ':' . encode_base64($user, '');
}

sub SPA_timestamp() {
    my $timestamp = time();


    if ($time_offset_plus) {
        my $offset = &time_offset($time_offset_plus);
        $timestamp += $offset;
    }

    if ($time_offset_minus) {
        my $offset = &time_offset($time_offset_minus);
        $timestamp -= $offset;
    }

    print "        Timestamp:      $timestamp\n" unless $quiet;
    return ':' . $timestamp;
}

sub SPA_version() {
    print "        Version:        $version\n" unless $quiet;
    return ':' . $version;
}

sub SPA_message_type() {
    if ($cmdline_pcap_cmd) {
        print "        Type:           $SPA_COMMAND_MODE (command mode)\n"
            unless $quiet;
        return ':' . $SPA_COMMAND_MODE;
    } elsif ($NAT_access_str) {
        if ($NAT_local) {
            if ($cmdl_fw_timeout > 0) {
                print "        Type:           " .
                    "$SPA_CLIENT_TIMEOUT_LOCAL_NAT_ACCESS_MODE ",
                    "(Local NAT client-timeout access mode)\n" unless $quiet;
                return ':' . $SPA_CLIENT_TIMEOUT_LOCAL_NAT_ACCESS_MODE;
            } else {
                print "        Type:           $SPA_LOCAL_NAT_ACCESS_MODE ",
                    "(Local NAT access mode)\n" unless $quiet;
                return ':' . $SPA_LOCAL_NAT_ACCESS_MODE;
            }
        } else {
            if ($cmdl_fw_timeout > 0) {
                print "        Type:           " .
                    "$SPA_CLIENT_TIMEOUT_NAT_ACCESS_MODE ",
                    "(NAT client-timeout access mode)\n" unless $quiet;
                return ':' . $SPA_CLIENT_TIMEOUT_NAT_ACCESS_MODE;
            } else {
                print "        Type:           $SPA_NAT_ACCESS_MODE ",
                    "(NAT access mode)\n" unless $quiet;
                return ':' . $SPA_NAT_ACCESS_MODE;
            }
        }
    }
    if ($cmdl_fw_timeout > 0) {
        print "        Type:           " .
            "$SPA_CLIENT_TIMEOUT_ACCESS_MODE (access ",
            "client-timeout mode)\n" unless $quiet;
        return ':' . $SPA_CLIENT_TIMEOUT_ACCESS_MODE;
    } else {
        print "        Type:           $SPA_ACCESS_MODE (access mode)\n"
            unless $quiet;
        return ':' . $SPA_ACCESS_MODE;
    }
}

sub SPA_message() {
    ### a specific command will be executed on the server.  Note we
    ### prepend the command string with the $enc_allow_ip so that the
    ### fwknopd server can apply the REQUIRE_SOURCE_ADDRESS criteria.
    if ($cmdline_pcap_cmd) {
        print "        Cmd:            $cmdline_pcap_cmd\n" unless $quiet;
        return ':' . encode_base64("$enc_allow_ip,$cmdline_pcap_cmd", '');

    }
    unless ($access_str) {
        $access_str = 'none,0';
    }
    ### access to port(s)/protocol(s) will be granted on the
    ### server
    print "        Access:         $enc_allow_ip,$access_str\n"
        unless $quiet;
    return ':' . encode_base64("$enc_allow_ip,$access_str", '');
}

sub SPA_client_timeout() {
    return '' unless $cmdl_fw_timeout;
    return ':' . $cmdl_fw_timeout;
}

sub SPA_server_auth() {
    if (lc($server_auth_method) eq 'crypt') {
        unless ($quiet) {
            print "        Server auth:   $server_auth_method,";
            for (my $i=0; $i<length($server_auth_crypt_pw); $i++) {
                print '*';
            }
            print "\n";
        }
        return ':' . encode_base64("crypt,$server_auth_crypt_pw", '');
    }
    return '';
}

sub SPA_nat_access() {
    if ($NAT_access_str) {
        print "        NAT access:     $NAT_access_str\n"
            unless $quiet;
        return ':' . encode_base64($NAT_access_str, '');
    }
    return '';
}

sub SPA_digest() {
    my $msg = shift;

    my $digest = '';

    if ($digest_type == $MD5_DIGEST) {
        require Digest::MD5;
        Digest::MD5->import(qw(md5_base64));
        if ($debug) {
            print "[+] Digest::MD5 $Digest::MD5::VERSION\n";
        }
        $digest = md5_base64($msg);
        print "        MD5 digest:     $digest\n" unless $quiet;
        if ($debug) {
            $total_digest = md5_base64("$msg:$digest");
        }
    } elsif ($digest_type == $SHA1_DIGEST) {
        require Digest::SHA;
        Digest::SHA->import(qw(sha1_base64));
        if ($debug) {
            print "[+] Digest::SHA::VERSION $Digest::SHA::VERSION\n";
        }
        $digest = sha1_base64($msg);
        print "        SHA1 digest:    $digest\n" unless $quiet;
        if ($debug) {
            $total_digest = sha1_base64("$msg:$digest");
        }
    } elsif ($digest_type == $SHA256_DIGEST) {
        require Digest::SHA;
        Digest::SHA->import(qw(sha256_base64));
        if ($debug) {
            print "[+] Digest::SHA::VERSION $Digest::SHA::VERSION\n";
        }
        $digest = sha256_base64($msg);
        print "        SHA256 digest:  $digest\n" unless $quiet;
        if ($debug) {
            $total_digest = sha256_base64("$msg:$digest");
        }
    } else {
        die "[*] Improper digest algorithm, use --help";
    }
    return ':' . $digest;
}

sub pcap_GPG_encrypt_msg() {
    my $msg = shift;

    my $gnupg = GnuPG::Interface->new();

    $gpg_home_dir = "$homedir/.gnupg" unless $gpg_home_dir;

    my %gnupg_options = (
        'batch' => 1,
        'homedir' => $gpg_home_dir,
        'no_options' => 1
    );

    delete $gnupg_options{'batch'} if $gpg_verbose;
    delete $gnupg_options{'no_options'} if $gpg_use_options;

    $gnupg->options->hash_init(%gnupg_options);

    ### if --gpg-default-key is given, then we trust that the user has
    ### set the default key with the default-key variable in ~/.gnupg/options
    ### and we need to enable options
    if ($gpg_default_key) {
        delete $gnupg_options{'no_options'}
            if defined delete $gnupg_options{'no_options'};
    } else {
        $gnupg->options->default_key($gpg_signing_key);
    }

    $gnupg->options->push_recipients($gpg_recipient);

    if ($gpg_path) {
        ### normally gpg is in the local path, but if not --gpg-path can
        ### provide a custom path
        $gnupg->call($gpg_path);
    }

    my ($input, $output, $error, $pw, $status) =
        (IO::Handle->new(),
        IO::Handle->new(),
        IO::Handle->new(),
        IO::Handle->new(),
        IO::Handle->new());

    my $handles = GnuPG::Handles->new(
        stdin  => $input,
        stdout => $output,
        stderr => $error,
        passphrase => $pw,
        status => $status
    );

    my $pid;

    if ($use_gpg_agent or $gpg_agent_info) {
        if ($gpg_agent_info) {
            $ENV{'GPG_AGENT_INFO'} = $gpg_agent_info;
        }
        $pid = $gnupg->sign_and_encrypt('handles' => $handles,
            'command_args' => [ qw( --use-agent ) ]);
    } else {
        $pid = $gnupg->sign_and_encrypt('handles' => $handles);
    }

    print $pw $enc_key;
    close $pw;

    print $input $msg;
    close $input;

    my @ciphertext = <$output>;
    close $output;

    my @errors = <$error>;
    close $error;

    waitpid $pid, 0;

    my $ctext = '';
    if (@ciphertext) {
        $ctext = join '', @ciphertext;
    }

    unless ($ctext) {
        print "[*] GnuPG encrypt failed.\n";
        unless ($gpg_verbose) {
            print "    GnuPG errors:\n";
            print for @errors;
        }
        exit 1;
    }

    if ($verbose) {
        print "[+] Encrypted msg hex dump (" .
            length($ctext) . " bytes):\n";
        &hex_dump($ctext);
    }

    my $encoded_msg = encode_base64($ctext, '');

    if ($verbose and $debug) {
        print "[+] base64-encoded message before stripping identifying chars:\n",
            $encoded_msg, "\n";
    }

    if ($encoded_msg =~ /^$gpg_prefix/) {
        unless ($include_base64_gnupg_prefix) {
            print qq|[+] Stripping encoded "$gpg_prefix" prefix from |,
                "outgoing encoded SPA packet.\n" if $debug;
            ### perl -MMIME::Base64 -e 'print encode_base64("\x85\x02\n")'
            ### The 'magic' database (via the 'file') command identifies GnuPG
            ### encrypted files as starting with 0x8502
            $encoded_msg =~ s/^$gpg_prefix//;
        }
    } else {
        print
"[-] Warning: GnuPG encrypted SPA packet does not begin with: $gpg_prefix\n",
"    It is recommend to set GPG_NO_PREFIX_ADD in access.conf on the fwknopd\n",
"  &nbs