Changeset 1264

Timestamp:

09/29/08 19:46:59 (2 months ago)

Author:

mbr

Message:

- Updated fwknopd to enforce the DIGEST_TYPE variable more strictly by not
accepting SPA packets that do not include digest of the specified type.
The DIGEST_TYPE default is 'ALL', so normally fwknopd accepts any
supported digest.
- (Test suite) Added test for mis-matched DIGEST_TYPE vs. digest algorithm
used in SPA packets.

Files:

• fwknop/trunk/ChangeLog (modified) (1 diff)
• fwknop/trunk/fwknopd (modified) (8 diffs)
• fwknop/trunk/test/fwknop_test.pl (modified) (3 diffs)

fwknop/trunk/ChangeLog

@@ -27 +27 @@
-      sure randomness is high or to test encryption properties over large
-      sets of SPA packets).
+    - Updated fwknopd to enforce the DIGEST_TYPE variable more strictly by not
+      accepting SPA packets that do not include digest of the specified type.
+      The DIGEST_TYPE default is 'ALL', so normally fwknopd accepts any
+      supported digest.
-    - Bugfix to make sure to apply BLACKLIST checks to IP addresses specified
-      with -a (or derived via -R) in addition to the source IP in the IP

fwknop/trunk/fwknopd

@@ -1586 +1586 @@
-        my $sum = $2;
-        if (length($sum) == $SHA256_DIGEST_LEN) {
-
-
-
-
+
+
+
+
+
+
+
+
+
-            }
-        } elsif (length($sum) == $SHA1_DIGEST_LEN) {
-
-
-
-
+
+
+
+
+
+
+
+
+
-            }
-        } elsif (length($sum) == $MD5_DIGEST_LEN) {
-
-
-
-
+
+
+
+
+
+
+
+
+
-            }
-        }
@@ -2342 +2357 @@
-    }
-
-
-
-
-
-
+_fh
+_fh
+_fh
+_fh
+_fh
-
-    my $handles = GnuPG::Handles->new(
-
-
-
-
-
+_fh
+_fh
+_fh
+_fh
+_fh
-    );
-
@@ -2379 +2394 @@
-    }
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    waitpid $pid, 0;
+
+    if ($debug) {
+        print STDERR localtime() . " [+] GnuPG status messages:\n";
+        print STDERR for @status;
+    }
-
-    ### we require the message to be signed; make sure
@@ -2399 +2422 @@
-        $key_id = $1 if $key_id =~ /^0x(\w+)/;
-        my $found_candidate_sig = 0;
+        if ($debug) {
+            print STDERR localtime() . " [+] gpg key ID: $key_id\n"
+                    localtime() . "     GnuPG error messages:\n";
+        }
-        LINE: for my $err (@errors) {
- and $verbose
+
-            if ($key_id eq 'ANY') {
-                if ($err =~ /Good\s+signature/i) {
@@ -2812 +2839 @@
-                        $grant_dst, $auto_rule_position, $table, $to_chain,
-                        $target, \%extended_info);
+
+                    if ($debug) {
+                        print STDERR localtime() . " [+] Dumping $to_chain to ",
+                            "see newly added rule:\n";
+                        $ipt->run_ipt_cmd("$cmds{'iptables'} -t " .
+                            "$table -v -n -L $to_chain");
+                    }
-
-                    if ($rv) {
@@ -4485 +4519 @@
-        &build_ipt_config();
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        }
-    }
@@ -5126 +5168 @@
-
-    my $found_digest = 0;
+    my $use_md5    = 0;
+    my $use_sha1   = 0;
+    my $use_sha256 = 0;
-    if ($config{'DIGEST_TYPE'} eq 'ALL') {
-        $found_digest = 1;
+        $use_md5      = 1;
+        $use_sha1     = 1;
+        $use_sha256   = 1;
-    } else {
-        if ($config{'DIGEST_TYPE'} =~ /SHA256/) {
-            $found_digest = 1;
+            $use_sha256 = 1;
-        }
-        if ($config{'DIGEST_TYPE'} =~ /SHA1/) {
-            $found_digest = 1;
+            $use_sha1 = 1;
-        }
-        if ($config{'DIGEST_TYPE'} =~ /MD5/) {
-            $found_digest = 1;
+            $use_md5 = 1;
-        }
-    }
@@ -5145 +5196 @@
-    ### an old fwknop client can send an SPA packet with an
-    ### MD5 sum
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    if ($debug) {

fwknop/trunk/test/fwknop_test.pl

@@ -277 +277 @@
-    \&SPA_access_packet_md5);
-&test_driver('(Internal digest alg mis-match) Sniffing SPA packet',
-
-
-
-
-
-
-
+
+
-    \&fw_rules_removed);
-
-
+
-
-&test_driver('(pcap filter) SPA packet with --Server-port 62203',
@@ -542 +536 @@
-&test_driver('(Command execution) Making sure firewall rules do not exist',
-    \&fw_rules_removed);
+&stop_fwknopd_quiet('(Command execution)');
-
-if ($config{'FIREWALL_TYPE'} eq 'iptables') {
@@ -1571 +1566 @@
-}
-
+sub SPA_sniff_decrypt_sha256() {
+
+    if (&run_fwknopd($cache_encrypted_spa_packet,
+            $sha256_fwknop_conf, $default_access_conf)) {
+
+        ### now that fwknopd has exited, see if the SPA packet was valid
+        my $found_err = 0;
+        open SE, "< $current_test_file"
+            or die "[*] Could not open $current_test_file: $!";
+        while (<SE>) {
+            if (/Digest\s+alg\s+mis\-match/) {
+                $found_err = 1;
+                last;
+            }
+        }
+        close SE;
+        if ($found_err) {
+            return 1;
+        } else {
+            return &print_errors("[*] fwknopd accepted excluded digest algorithm type");
+        }
+    }
+    return &print_errors("[-] Sniff alarm ($sniff_alarm seconds) expired");
+}
+
-sub sniff_decrypt() {
-    my $fwknop_conf = shift;