Changeset 1243

Timestamp:

09/13/08 23:02:42 (3 months ago)

Author:

mbr

Message:

- Bugfix to make sure to apply BLACKLIST checks to IP addresses specified
with -a (or derived via -R) in addition to the source IP in the IP
header (which can be modified via --Spoof-src). (Franck Joncourt
submitted a patch for this.)

Files:

• fwknop/trunk/CREDITS (modified) (1 diff)
• fwknop/trunk/ChangeLog (modified) (1 diff)
• fwknop/trunk/fwknopd (modified) (2 diffs)
• fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf (added)
• fwknop/trunk/test/fwknop_test.pl (modified) (3 diffs)

fwknop/trunk/CREDITS

@@ -167 +167 @@
-      and in the knoptm daemon since functions from this module were never
-      actually used.
+    - Bugfix to make sure to apply BLACKLIST checks to IP addresses specified
+      with -a (or derived via -R) in addition to the source IP in the IP
+      header (which can be modified via --Spoof-src).
-
-Jose Luis Bellido

fwknop/trunk/ChangeLog

@@ -5 +5 @@
-      sure randomness is high or to test encryption properties over large
-      sets of SPA packets).
+    - Bugfix to make sure to apply BLACKLIST checks to IP addresses specified
+      with -a (or derived via -R) in addition to the source IP in the IP
+      header (which can be modified via --Spoof-src).  (Franck Joncourt
+      submitted a patch for this.)
-    - Bugfix to ensure that the permissions for the
-      /var/run/fwknop/knopwatchd.pid file are set to 0600 (noticed by Franck

fwknop/trunk/fwknopd

@@ -938 +938 @@
-    }
-
+    if (&is_ip_included($allow_src, $blacklist_ar, $blacklist_exclude_ar)) {
+        print STDERR localtime() . " [+] SPA_access() ",
+        "$allow_src in BLACKLIST" if $debug;
+        &logr('[-]', "allow IP: $allow_src SPA packet from $src_ip is " .
+            "blacklisted (SOURCE line num: " .
+            "$access_hr->{'src_line_num'})", $SEND_MAIL);
+        return 0;
+    }
+
-    ### initialize to the OPEN_PORTS directives (if defined; we know that
-    ### either OPEN_PORTS or PERMIT_CLIENT_PORTS was specified in the
@@ -1159 +1168 @@
-            return 0;
-        }
+    }
+
+    if (&is_ip_included($cmd_ip, $blacklist_ar, $blacklist_exclude_ar)) {
+        print STDERR localtime() . " [+] SPA_cmd() ",
+        "$cmd_ip in BLACKLIST" if $debug;
+        &logr('[-]', "cmd IP: $cmd_ip SPA packet from $src_ip is " .
+            "blacklisted (SOURCE line num: " .
+            "$access_hr->{'src_line_num'})", $SEND_MAIL);
+        return 0;
-    }
-

fwknop/trunk/test/fwknop_test.pl

@@ -69 +69 @@
-my $restricted_forward_access_conf = "$conf_dir/forward_internal_ip_access.conf";
-my $no_loopback_ip_match_access_conf = "$conf_dir/no_loopback_ip_match_access.conf";
+my $blacklist_dashA_IP_fwknop_conf = "$conf_dir/blacklist_dashA_IP_fwknop.conf";
-my $pk_fwknop_conf = "$conf_dir/pk_fwknop.conf";
-my $pk_encrypted_sequence_conf = "$conf_dir/pk_encrypted_sequence_access.conf";
@@ -442 +443 @@
-&stop_fwknopd_quiet('(Blacklist src)');
-
+### blacklisted -a 127.0.0.2 address
+&test_driver('(Blacklist src) Generating blacklisted -a SPA packet',
+    \&non_matching_source_generation);
+&test_driver('(Blacklist src) Sniffing SPA packet',
+    \&blacklist_dashA_net_source_block);
+&test_driver('(Blacklist src) Making sure firewall rules do not exist',
+    \&fw_rules_removed);
+&stop_fwknopd_quiet('(Blacklist src)');
+
-### test multi-SOURCE access.conf configuration
-&test_driver('(Multi-SOURCE) Generating SPA access packet',
@@ -1224 +1234 @@
-}
-
+sub blacklist_dashA_net_source_block() {
+
+    if (&run_fwknopd($cache_encrypted_spa_packet,
+            $blacklist_dashA_IP_fwknop_conf, $default_access_conf)) {
+
+        ### now that fwknopd has exited, see if the SPA packet was valid
+        my $found_blacklist_match = 0;
+        open SE, "< $current_test_file"
+            or die "[*] Could not open $current_test_file: $!";
+        while (<SE>) {
+            if (/in\s+BLACKLIST/) {
+                $found_blacklist_match = 1;
+                last;
+            }
+        }
+        close SE;
+        unless ($found_blacklist_match) {
+            return &print_errors("[-] fwknopd " .
+                "accepted blacklisted SPA packet");
+        }
+        return 1;
+    }
+    return &print_errors("[-] Sniff alarm ($sniff_alarm seconds) expired");
+}
+
-sub non_matching_source_block() {
-