Changeset 1210

Timestamp:

08/16/08 11:54:51 (4 months ago)

Author:

mbr

Message:

- Added the ability to ignore any local GnuPG 'options' file with a new
command line argument --gpg-no-options (for the fwknop client) and a new
access.conf config variable GPG_NO_OPTIONS (for the fwknopd daemon).
This fixes a problem reported by Mike Holzmann where the 'encrypt-to'
option in the default options file was causing SPA packets to exceed
1500 bytes when encrypted with a 2048-bit GnuPG key.

Files:

• fwknop/trunk/CREDITS (modified) (1 diff)
• fwknop/trunk/ChangeLog (modified) (1 diff)
• fwknop/trunk/fwknop (modified) (8 diffs)
• fwknop/trunk/fwknopd (modified) (7 diffs)

fwknop/trunk/CREDITS

@@ -225 +225 @@
-        Updated fwknopd to use the Net::Pcap API valid in Net::Pcap 0.14 for
-      the datalink() function (used to detect the datalink layer type).
+
+Mike Holzmann
+    - Diagnosed a bug where SPA packets encrypted with 2048-bit keys would
+      exceed 1500 bytes if the 'encrypt-to' option was set in the default
+      ~/.gnupg/options file.  The result was the addition of the
+      --gpg-no-options command line argument on the fwknop command line, and
+      the GPG_NO_OPTIONS variable in the access.conf file for the fwknopd
+      daemon.

fwknop/trunk/ChangeLog

@@ -27 +27 @@
-      and fwknopd in --debug mode.  This is mostly useful for the test suite
-      to see which versions of the modules are being used.
+    - Added the ability to ignore any local GnuPG 'options' file with a new
+      command line argument --gpg-no-options (for the fwknop client) and a new
+      access.conf config variable GPG_NO_OPTIONS (for the fwknopd daemon).
+      This fixes a problem reported by Mike Holzmann where the 'encrypt-to'
+      option in the default options file was causing SPA packets to exceed
+      1500 bytes when encrypted with a 2048-bit GnuPG key.
-
-fwknop-1.9.6 (07/18/2008):

fwknop/trunk/fwknop

@@ -5 +5 @@
-# File: fwknop
-#
-
+/
-#
-# Purpose: fwknop implements an authorization scheme known as Single Packet
@@ -91 +91 @@
-my $max_msg_len   = 1500;
-my $gpg_verbose   = 0;
+my $gpg_no_options = 0;
-my $gpg_agent_info = '';
-my $include_salted = 0;
@@ -251 +252 @@
-    if (($gpg_default_key or $gpg_signing_key) and not $gpg_recipient);
-
+die "[*] Cannot assume a default key when --gpg-no-options is used."
+    if ($gpg_default_key and $gpg_no_options);
+
-die "[*] Cannot spoof source address for a real TCP socket."
-    if ($spoof_src and $spa_established_tcp);
@@ -699 +703 @@
-        Digest::SHA->import(qw(sha1_base64));
-        if ($debug) {
-1::VERSION $Digest::SHA1
+::VERSION $Digest::SHA
-        }
-        $digest = sha1_base64($msg);
@@ -710 +714 @@
-        Digest::SHA->import(qw(sha256_base64));
-        if ($debug) {
-256::VERSION $Digest::SHA256
+::VERSION $Digest::SHA
-        }
-        $digest = sha256_base64($msg);
@@ -730 +734 @@
-    $gpg_home_dir = "$homedir/.gnupg" unless $gpg_home_dir;
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
-
-    ### if --gpg-default-key is given, then we trust that the user has
-    ### set the default key with the default-key variable in ~/.gnupg/options
+    ### and --no-gpg-options is not used on the fwknop command line.
-    $gnupg->options->default_key($gpg_signing_key) unless $gpg_default_key;
-
@@ -1626 +1633 @@
-        'gpg-agent'         => \$use_gpg_agent,
-        'gpg-agent-info=s'  => \$gpg_agent_info,
+        'gpg-no-options'    => \$gpg_no_options,
-        'quiet'             => \$quiet,
-        'Forward-access=s'  => \$NAT_access_str,
@@ -1911 +1919 @@
-                                 running gpg-agent.
-    --gpg-agent-info <info>    - Specify the value for the GPG_AGENT_INFO
- 
- 
+
+
-    --gpg-verbose              - Display all output from GnuPG process.
+    --gpg-no-options           - In GnuPG mode, instruct GnuPG to not use
+                                 the local ~/.gnupg/options file for config
+                                 parameters.
-    -a, --allow-IP <IP>        - IP to instruct the remote fwknop server to
-                                 allow through the firewall ruleset.

fwknop/trunk/fwknopd

@@ -5 +5 @@
-# File: fwknopd (/usr/sbin/fwknopd)
-#
-
+/
-#
-# Purpose: fwknopd implements the server portion of an authorization scheme
@@ -104 +104 @@
-my $err_wait_timer = 30;  ### seconds
-my $gpg_agent_info = '';
+my $gpg_no_options = 0;
-my $build_ipt_config = 0;
-my $skipped_first_loop = 0;
@@ -226 +227 @@
-    'GPG_DECRYPT_PW' => '',
-    'GPG_HOME_DIR'   => '',
+    'GPG_NO_OPTIONS' => 0,
-    'ULOG_PCAP'      => '',
-    'FILE_PCAP'      => '',
@@ -2261 +2263 @@
-    my $gnupg = GnuPG::Interface->new();
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-
-    my $input  = IO::Handle->new() or die $!;
@@ -3410 +3415 @@
-                    $imported_gpg = 1;
-                    $access_hsh{'GPG_HOME_DIR'} = $1;
+                } elsif ($line =~ /^\s*GPG_NO_OPTIONS:\s*(\S+);/) {
+                    my $val = $1;
+                    if ($val =~ /y/i) {
+                        $access_hsh{'GPG_NO_OPTIONS'} = 1;
+                    } else {
+                        $access_hsh{'GPG_NO_OPTIONS'} = 0;
+                    }
-                } elsif ($line =~ /^\s*FILE_PCAP\s*;/) {
-                    ### used in file pcap mode
@@ -3878 +3890 @@
-        'fw-type=s'      => \$fw_type,
-        'gpg-agent-info=s' => \$gpg_agent_info,
+        'gpg-no-options'   => \$gpg_no_options,
-        'debug'          => \$debug,
-        'Kill'           => \$kill,
@@ -5177 +5190 @@
-    -S, --Status               - Displays the status of any
-                                 currently running fwknopd processes.
+    --gpg-agent-info <info>    - Specify the value for the GPG_AGENT_INFO
+                                 environment variable as returned by
+                                 'gpg-agent --daemon'.
+    --gpg-no-options           - In GnuPG mode, instruct GnuPG to not use
+                                 the local ~/.gnupg/options file for config
+                                 parameters.
-    -T, --Test-mode            - Run in testing mode for compatibility
-                                 with the fwknop test suite (sets the