Changeset 1251

Timestamp:

09/28/08 16:28:42 (2 months ago)

Author:

mbr

Message:

- Added GPG_NO_REQUIRE_PREFIX to access.conf to control whether the GnuPG
'hQ' prefix is added before base64 decoding and decrypting. Normally
this is not needed, but if there appear to be communications issues
between the fwknop client and the fwknopd server then this option can be
useful to ensure that encrypted SPA data is sent through the GnuPG
decryption routine. The 'hQ' prefix is a heuristic derived from the
file 'magic' database for describing data encrypted with GnuPG, and the
fwknop client normally strips this data from outgoing SPA packets
(unless the --Include-gpg-prefix option is used).
- Added '--gpg-prefix <bytes>' to the fwknop client so that the
predictable prefix for GnuPG encrypted data can be changed. Normally
this prefix is 'hQ' (base64 encoded), or the raw bytes 0x8502.
- Added the ability to control the path used for the gpg binary on the
client side with a new argument '--gpg-path <path>', and on the server
side with gpgCmd in the fwknop.conf file. The GnuPG::Interface module
normally just takes the first instance of gpg that is the current path,
but this new feature allows the path to the binary to be explicitly set.
- (Test suite) Added tests for GPG_NO_REQUIRE_PREFIX functionality and for
the expected GnuPG prefix.

Files:

• fwknop/trunk/ChangeLog (modified) (2 diffs)
• fwknop/trunk/fwknop (modified) (7 diffs)
• fwknop/trunk/fwknop.conf (modified) (1 diff)
• fwknop/trunk/fwknopd (modified) (15 diffs)
• fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/blacklist_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/default_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/filter_62203_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/forward_chain_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/gpg_access_no_prefix.conf (added)
• fwknop/trunk/test/conf/md5_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/no_local_nat_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/no_promisc_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/output_chain_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/pcap_file_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/pk_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/rand_port_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/sha1_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/sha256_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/conf/spa_aging_fwknop.conf (modified) (1 diff)
• fwknop/trunk/test/fwknop_test.pl (modified) (15 diffs)

fwknop/trunk/ChangeLog

@@ -1 +1 @@
-fwknop-1.9.8 (09//2008):
+    - Added GPG_NO_REQUIRE_PREFIX to access.conf to control whether the GnuPG
+      'hQ' prefix is added before base64 decoding and decrypting.  Normally
+      this is not needed, but if there appear to be communications issues
+      between the fwknop client and the fwknopd server then this option can be
+      useful to ensure that encrypted SPA data is sent through the GnuPG
+      decryption routine.  The 'hQ' prefix is a heuristic derived from the
+      file 'magic' database for describing data encrypted with GnuPG, and the
+      fwknop client normally strips this data from outgoing SPA packets
+      (unless the --Include-gpg-prefix option is used).
+    - Added '--gpg-prefix <bytes>' to the fwknop client so that the
+      predictable prefix for GnuPG encrypted data can be changed.  Normally
+      this prefix is 'hQ' (base64 encoded), or the raw bytes 0x8502.
+    - Added the ability to control the path used for the gpg binary on the
+      client side with a new argument '--gpg-path <path>', and on the server
+      side with gpgCmd in the fwknop.conf file.  The GnuPG::Interface module
+      normally just takes the first instance of gpg that is the current path,
+      but this new feature allows the path to the binary to be explicitly set.
-    - Added --Save-packet-append to allow SPA packets to be appended to the
-      --Save-packet-file in --Save-packet mode.  This allows multiple SPA
@@ -14 +31 @@
-    - Bugfix to remove the Net::IPv4Addr dependency in the fwknop client and
-      knoptm daemon (Franck Joncourt).
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-fwknop-1.9.7 (08/24/2008):

fwknop/trunk/fwknop

@@ -122 +122 @@
-my $locale = 'C';  ### default LC_ALL env variable
-my $no_locale = 0;
+my $gpg_prefix = 'hQ';  ### base64 encoded version of 0x8502
+my $gpg_path = '';
-
-### User agent for contacting http://www.whatismyip.org/, (can
@@ -525 +527 @@
-
-    if ($debug) {
-
+some 
-            "    Digest: $total_digest\n";
-    }
@@ -756 +758 @@
-    $gnupg->options->push_recipients($gpg_recipient);
-
+    if ($gpg_path) {
+        ### normally gpg is in the local path, but if not --gpg-path can
+        ### provide a custom path
+        $gnupg->call($gpg_path);
+    }
+
-    my ($input, $output, $error, $pw, $status) =
-        (IO::Handle->new(),
@@ -824 +832 @@
-    }
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    }
-
@@ -1413 +1428 @@
-    Term::ReadKey->import(qw/ReadMode ReadLine/);
-
-
-
-
-
+
+
-
-    return;
@@ -1644 +1657 @@
-        'gpg-agent-info=s'  => \$gpg_agent_info,
-        'gpg-no-options'    => \$gpg_no_options,
+        'gpg-prefix=s'      => \$gpg_prefix,
+        'gpg-path=s'        => \$gpg_path,
-        'quiet'             => \$quiet,
-        'Forward-access=s'  => \$NAT_access_str,
@@ -1935 +1950 @@
-                                 the local ~/.gnupg/options file for config
-                                 parameters.
+    --gpg-prefix <bytes>       - Change the bytes for the expected GnuPG
+                                 prefix from 'hQ' to the specified string.
+    --gpg-path <path>          - Specify the path to the gpg command (not
+                                 usually necessary if gpg is in your path).
-    -a, --allow-IP <IP>        - IP to instruct the remote fwknop server to
-                                 allow through the firewall ruleset.

fwknop/trunk/fwknop.conf

@@ -311 +311 @@
-
-### system binaries
+gpgCmd           /usr/bin/gpg;
-mailCmd          /bin/mail;
-shCmd            /bin/sh;

fwknop/trunk/fwknopd

@@ -105 +105 @@
-my $gpg_agent_info = '';
-my $gpg_no_options = 0;
+my $gpg_default_prefix = 'hQ';  ### base64 encoded 0x8502
-my $build_ipt_config = 0;
-my $skipped_first_loop = 0;
@@ -228 +229 @@
-    'GPG_HOME_DIR'   => '',
-    'GPG_NO_OPTIONS' => 0,
-
-
+
+
+
+
-    'DATA_COLLECT_MODE' => '',
-    'ENCRYPT_SEQUENCE'  => '',
@@ -2263 +2266 @@
-    my $gpg_sign_id   = '';
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
-    }
-
@@ -2296 +2306 @@
-    }
-
-
-
-
-
-
-
-
-
+#
+#
+#
+#
+#
+#
+#
+#
-
-    print STDERR localtime() . " [+] Attempting GnuPG decrypt...\n" if $debug;
@@ -2324 +2334 @@
-    $gnupg->options->no_options()
-        if $gpg_no_options or $access_hr->{'GPG_NO_OPTIONS'};
+
+    $gnupg->call($cmds{'gpg'}) if defined $cmds{'gpg'};
-
-    my $input  = IO::Handle->new() or die $!;
@@ -3461 +3473 @@
-                } elsif ($line =~ /^\s*GPG_REMOTE_ID:\s*(.*)\s*;/) {
-                    unless ($imported_gpg) {
+                        &check_commands({'gpg' => ''}, {});
-                        require GnuPG::Interface;
-                        print STDERR "[+] GnuPG::Interface::VERSION ",
@@ -3472 +3485 @@
-                } elsif ($line =~ /^\s*GPG_DECRYPT_ID:\s*(.*)\s*;/) {
-                    unless ($imported_gpg) {
+                        &check_commands({'gpg' => ''}, {});
-                        require GnuPG::Interface;
-                        print STDERR "[+] GnuPG::Interface::VERSION ",
@@ -3480 +3494 @@
-                } elsif ($line =~ /^\s*GPG_DECRYPT_PW:\s*(.*)\s*;/) {
-                    unless ($imported_gpg) {
+                        &check_commands({'gpg' => ''}, {});
-                        require GnuPG::Interface;
-                        print STDERR "[+] GnuPG::Interface::VERSION ",
@@ -3488 +3503 @@
-                } elsif ($line =~ /^\s*GPG_HOME_DIR:\s*(\S+)\s*;/) {
-                    unless ($imported_gpg) {
+                        &check_commands({'gpg' => ''}, {});
-                        require GnuPG::Interface;
-                        print STDERR "[+] GnuPG::Interface::VERSION ",
@@ -3501 +3517 @@
-                        $access_hsh{'GPG_NO_OPTIONS'} = 0;
-                    }
+                } elsif ($line =~ /^\s*GPG_NO_REQUIRE_PREFIX:\s*(\S+);/) {
+                    my $val = $1;
+                    if ($val =~ /y/i) {
+                        $access_hsh{'GPG_NO_REQUIRE_PREFIX'} = 1;
+                    } else {
+                        $access_hsh{'GPG_NO_REQUIRE_PREFIX'} = 0;
+                    }
+                } elsif ($line =~ /^\s*GPG_PREFIX:\s*(\S+);/) {
+                    $access_hsh{'GPG_PREFIX'} = $1;
-                } elsif ($line =~ /^\s*FILE_PCAP\s*;/) {
-                    ### used in file pcap mode
@@ -3876 +3901 @@
-        }
-        $gpg_mode = 1 if defined $access_hr->{'GPG_REMOTE_ID'};
+        if ($gpg_mode) {
+            $access_hr->{'GPG_PREFIX'} = $gpg_default_prefix
+                unless defined $access_hr->{'GPG_PREFIX'};
+        }
-        if (defined ($access_hr->{'REQUIRE_AUTH_METHOD'})) {
-            unless (lc($access_hr->{'REQUIRE_AUTH_METHOD'}) eq 'crypt') {
@@ -3992 +4021 @@
-### check paths to commands and attempt to correct if any are wrong.
-sub check_commands() {
+    my ($include_hr, $exclude_hr) = @_;
+
+    if ($debug and $verbose) {
+        print STDERR "[+] check_commands() include/exclude hrefs:\n",
+            Dumper($include_hr), Dumper $exclude_hr;
+    }
+
-    my @path = qw(
-        /bin
@@ -4002 +4038 @@
-    for my $cmd (keys %cmds) {
-
+        if ($include_hr) {
+            next unless defined $include_hr->{$cmd};
+        }
+        if ($exclude_hr) {
+            next if defined $exclude_hr->{$cmd};
+        }
+
-        if ($cmd eq 'iptables') {
-            next unless $config{'FIREWALL_TYPE'} eq 'iptables';
-        } elsif ($cmd eq 'ipfw') {
-            next unless $config{'FIREWALL_TYPE'} eq 'ipfw';
+        }
+
+        if ($cmd eq 'mknod') {
+            next unless $config{'AUTH_MODE'} eq 'KNOCK';
-        }
-
@@ -4018 +4065 @@
-            }
-            unless ($found) {
-!!! 
+.
-                    "config section in $config_file to include the path to\n",
-                    "$cmd.";
@@ -4163 +4210 @@
-
-    ### make sure command paths are correct
-
+{}, {'gpg' => ''}
-
-    if ($fw_del_ip) {

fwknop/trunk/test/conf/blacklist_dashA_IP_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/blacklist_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/default_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/filter_62203_fwknop.conf

@@ -98 +98 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/forward_chain_fwknop.conf

@@ -100 +100 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/md5_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/no_local_nat_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/no_promisc_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/output_chain_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/pcap_file_fwknop.conf

@@ -100 +100 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/pk_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/rand_port_fwknop.conf

@@ -98 +98 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/sha1_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/sha256_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/conf/spa_aging_fwknop.conf

@@ -101 +101 @@
-### system binaries
-mailCmd          /bin/mail;
+gpgCmd           /usr/bin/gpg;
-shCmd            /bin/sh;
-mknodCmd         /bin/mknod;

fwknop/trunk/test/fwknop_test.pl

@@ -62 +62 @@
-my $rand_port_fwknop_conf = "$conf_dir/rand_port_fwknop.conf";
-my $gpg_access_conf       = "$conf_dir/gpg_access.conf";
+my $gpg_access_no_prefix_conf = "$conf_dir/gpg_access_no_prefix.conf";
-my $no_promisc_fwknop_conf = "$conf_dir/no_promisc_fwknop.conf";
-my $excluded_net_access_conf = "$conf_dir/excluded_net_access.conf";
@@ -83 +84 @@
-my $localhost = '127.0.0.1';
-my $allow_src = '127.0.0.2';
+
+my $gpg_server_key = '361BBAD4';
+my $gpg_client_key = '6A3FAD56';
-
-my $sniff_alarm = 20;
@@ -477 +481 @@
-    &fw_sleep('(GnuPG)');
-    &test_driver('(GnuPG) Firewall access rules removed', \&fw_rules_removed);
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -907 +930 @@
-            or die "[*] Could not open $current_test_file: $!";
-        while (<SE>) {
-
+FIXME 
-        }
-        close SE;
@@ -922 +945 @@
-            or die "[*] Could not open $current_test_file: $!";
-        while (<SE>) {
-
+FIXME 
-        }
-        close SE;
@@ -1450 +1473 @@
-}
-
+sub gpg_sniff_decrypt_no_prefix_add() {
+
+    if (&run_fwknopd($cache_encrypted_spa_packet,
+            $default_fwknop_conf, $gpg_access_no_prefix_conf)) {
+
+        ### now that fwknopd has exited, see if the SPA packet was valid
+        open SE, "< $current_test_file"
+            or die "[*] Could not open $current_test_file: $!";
+        while (<SE>) {
+            if (/\s+is\s+not\s+prefixed/i) {
+                close SE;
+                return 1;
+            }
+        }
+        close SE;
+        return &print_errors("[-] fwknopd accepted SPA packet without prefix");
+    }
+    return &print_errors("[-] Sniff alarm ($sniff_alarm seconds) expired");
+}
+
-sub gpg_sniff_decrypt() {
-
@@ -1462 +1505 @@
-                ### [-] Key mis-match or broken message checksum for SOURCE \
-                ### ANY (# 1 in access.conf)
+                close SE;
-                return &print_errors("[-] Key mis-match");
-            } elsif (/\[\-\]\s+Decrypted.*not\s+conform/i) {
-                ### [-] Decrypted message does not conform to a valid SPA packet
+                close SE;
-                return &print_errors("[-] Invalid SPA packet");
-            }
@@ -1495 +1540 @@
-                ### [-] Key mis-match or broken message checksum for SOURCE \
-                ### ANY (# 1 in access.conf)
+                close SE;
-                return &print_errors("[-] Key mis-match");
-            } elsif (/\[\-\]\s+Decrypted.*not\s+conform/i) {
-                ### [-] Decrypted message does not conform to a valid SPA packet
+                close SE;
-                return &print_errors("[-] Invalid SPA packet");
-            }
@@ -1519 +1566 @@
-                ### [-] Key mis-match or broken message checksum for SOURCE \
-                ### ANY (# 1 in access.conf)
+                close SE;
-                return &print_errors("[-] Key mis-match");
-            } elsif (/\[\-\]\s+Decrypted.*not\s+conform/i) {
-                ### [-] Decrypted message does not conform to a valid SPA packet
+                close SE;
-                return &print_errors("[-] Invalid SPA packet");
-            } elsif (/Unable\s+to\s+compile\s+packet\s+capture/) {
+                close SE;
-                return &print_errors("[-] Could not compile pcap filter, " .
-                    "upgrade libpcap?");
@@ -1547 +1597 @@
-                ### [-] Key mis-match or broken message checksum for SOURCE \
-                ### ANY (# 1 in access.conf)
+                close SE;
-                return &print_errors("[-] Key mis-match");
-            } elsif (/\[\-\]\s+Decrypted.*not\s+conform/i) {
-                ### [-] Decrypted message does not conform to a valid SPA packet
+                close SE;
-                return &print_errors("[-] Invalid SPA packet");
-            }
@@ -1579 +1631 @@
-                ### [-] Key mis-match or broken message checksum for SOURCE \
-                ### ANY (# 1 in access.conf)
+                close SE;
-                return &print_errors("[-] Key mis-match");
-            } elsif (/\[\-\]\s+Decrypted.*not\s+conform/i) {
-                ### [-] Decrypted message does not conform to a valid SPA packet
+                close SE;
-                return &print_errors("[-] Invalid SPA packet");
-            }
@@ -2248 +2302 @@
-sub SPA_gpg_access_packet() {
-    return &get_access_packet("$default_fwknop_args " .
-
-
+
+
+
+
+
+
+
+
+
+
-}
-
@@ -2497 +2559 @@
-                ### [-] Key mis-match or broken message checksum for SOURCE \
-                ### ANY (# 1 in access.conf)
+                close SE;
-                return &print_errors("[-] Key mis-match");
-            } elsif (/\[\-\]\s+Decrypted.*not\s+conform/i) {
-                ### [-] Decrypted message does not conform to a valid SPA packet
+                close SE;
-                return &print_errors("[-] Invalid SPA packet");
-            }
@@ -2521 +2585 @@
-                ### [-] Key mis-match or broken message checksum for SOURCE \
-                ### ANY (# 1 in access.conf)
+                close SE;
-                return &print_errors("[-] Key mis-match");
-            } elsif (/\[\-\]\s+Decrypted.*not\s+conform/i) {
-                ### [-] Decrypted message does not conform to a valid SPA packet
+                close SE;
-                return &print_errors("[-] Invalid SPA packet");
-            }
@@ -2547 +2613 @@
-                ### ANY (# 1 in access.conf)
-                $found_err = 1;
-
-
+
-            } elsif (/\[\-\]\s+Decrypted.*not\s+conform/i) {
-                ### [-] Decrypted message does not conform to a valid SPA packet
-                return &print_errors("[-] Invalid SPA packet");
-                $found_err = 1;
- 
+
-            }
-        }