Changeset 1266

Timestamp:

09/29/08 23:36:50 (2 months ago)

Author:

mbr

Message:

- Bugfix to make sure that neither fwknop nor fwknopd reference any
options file in GnuPG mode, and this is now the default (which overrides
the now unnecessary --gpg-no-options arg). There is a new option
--gpg-use-options to restore the usage of an options file by GnuPG (not
normally needed).

Files:

• fwknop/trunk/ChangeLog (modified) (2 diffs)
• fwknop/trunk/fwknop (modified) (6 diffs)
• fwknop/trunk/fwknop.8 (modified) (1 diff)
• fwknop/trunk/fwknopd (modified) (6 diffs)
• fwknop/trunk/fwknopd.8 (modified) (1 diff)
• fwknop/trunk/test/fwknop_test.pl (modified) (4 diffs)

fwknop/trunk/ChangeLog

@@ -14 +14 @@
-      /usr/bin/gpg), and another SOURCE stanza to apply to another gpg binary
-      (say /usr/bin/gpg2).
+    - Bugfix to make sure that neither fwknop nor fwknopd reference any
+      options file in GnuPG mode, and this is now the default (which overrides
+      the now unnecessary --gpg-no-options arg).  There is a new option
+      --gpg-use-options to restore the usage of an options file by GnuPG (not
+      normally needed).
-    - Added '--gpg-prefix <bytes>' to the fwknop client so that the
-      predictable prefix for GnuPG encrypted data can be changed.  Normally
@@ -52 +57 @@
-
-      http://www.cipherdyne.org/blog/2008/09/visualizing-spa-packet-randomness.html
+
-    - (Test suite) Added tests for GPG_NO_REQUIRE_PREFIX functionality and for
-      the expected GnuPG prefix.

fwknop/trunk/fwknop

@@ -97 +97 @@
-my $client_src_port = 0;
-my $gpg_default_key = 0;
+my $gpg_use_options = 0;
-my $err_wait_timer  = 30;  ### seconds
-my $resolve_ip_url  = 'http://www.whatismyip.org/';
@@ -721 +722 @@
-    my %gnupg_options = (
-        'batch' => 1,
-
+
+
-    );
-
-    delete $gnupg_options{'batch'} if $gpg_verbose;
+    delete $gnupg_options{'no_options'} if $gpg_use_options;
-
-    $gnupg->options->hash_init(%gnupg_options);
-
-    $gnupg->options->no_options() if $gpg_no_options;
-
-    ### if --gpg-default-key is given, then we trust that the user has
-    ### set the default key with the default-key variable in ~/.gnupg/options
-
-
+
+
+
+
+
+
+
-
-    $gnupg->options->push_recipients($gpg_recipient);
@@ -1636 +1642 @@
-        'gpg-agent-info=s'  => \$gpg_agent_info,
-        'gpg-no-options'    => \$gpg_no_options,
+        'gpg-use-options'   => \$gpg_use_options,
-        'gpg-prefix=s'      => \$gpg_prefix,
-        'gpg-path=s'        => \$gpg_path,
@@ -1905 +1912 @@
-        if (($gpg_default_key or $gpg_signing_key) and not $gpg_recipient);
-
-    die "[*] Cannot assume a default key when --gpg-no-options is used."
-        if ($gpg_default_key and $gpg_no_options);
-
-    die "[*] Cannot spoof source address for a real TCP socket."
-        if ($spoof_src and $spa_established_tcp);
@@ -1917 +1921 @@
-        die "[*] $gpg_path does not exist." unless -e $gpg_path;
-        die "[*] $gpg_path not executable." unless -x $gpg_path;
+    }
+
+    if ($gpg_no_options) {
+        print "[-] Options are disabled by default, so --gpg-no-options ",
+            "is not used.\n";
-    }
-    return;
@@ -1959 +1968 @@
-                                 'gpg-agent --daemon'.
-    --gpg-verbose              - Display all output from GnuPG process.
-no-options           - In GnuPG mode, instruct GnuPG to not us
-the 
-
+use-options          - In GnuPG mode, instruct GnuPG to use th
+
+ (this is disabled by default)
-    --gpg-prefix <bytes>       - Change the bytes for the expected GnuPG
-                                 prefix from 'hQ' to the specified string.

fwknop/trunk/fwknop.8

@@ -277 +277 @@
-purposes if it appears that the GnuPG encrypt/decrypt is not performing correctly.
-.TP
-
-
-
-
-
-
+
+
+
+
+
-.TP
-.BR \-\^\-Home-dir\ \<dir>

fwknop/trunk/fwknopd

@@ -105 +105 @@
-my $gpg_agent_info = '';
-my $gpg_no_options = 0;
+my $gpg_use_options = 0;
-my $gpg_default_prefix = 'hQ';  ### base64 encoded 0x8502
-my $build_ipt_config = 0;
@@ -229 +230 @@
-    'GPG_HOME_DIR'   => '',
-    'GPG_NO_OPTIONS' => 0,
+    'GPG_USE_OPTIONS' => 0,
-    'GPG_NO_REQUIRE_PREFIX' => 0,
-    'GPG_PREFIX' => '',
@@ -2341 +2343 @@
-    my %gnupg_options = (
-        'batch'   => 1,
-
+
+
-    );
-
-    delete $gnupg_options{'batch'} if ($debug and $verbose and not $test_mode);
+    delete $gnupg_options{'batch'} if $access_hr->{'GPG_USE_OPTIONS'};
-
-    $gnupg->options->hash_init(%gnupg_options);
-
-    $gnupg->options->no_options()
-        if $gpg_no_options or $access_hr->{'GPG_NO_OPTIONS'};
-
-    if ($access_hr->{'GPG_PATH'}) {
@@ -3551 +3552 @@
-                    } else {
-                        $access_hsh{'GPG_NO_OPTIONS'} = 0;
+                    }
+                } elsif ($line =~ /^\s*GPG_USE_OPTIONS:\s*(\S+);/) {
+                    my $val = $1;
+                    if ($val =~ /y/i) {
+                        $access_hsh{'GPG_USE_OPTIONS'} = 1;
+                    } else {
+                        $access_hsh{'GPG_USE_OPTIONS'} = 0;
-                    }
-                } elsif ($line =~ /^\s*GPG_NO_REQUIRE_PREFIX:\s*(\S+);/) {
@@ -3950 +3958 @@
-            $access_hr->{'GPG_PATH'} = ''
-                unless defined $access_hr->{'GPG_PATH'};
+            $access_hr->{'GPG_NO_OPTIONS'} = 0
+                unless defined $access_hr->{'GPG_NO_OPTIONS'};
+            $access_hr->{'GPG_USE_OPTIONS'} = 0
+                unless defined $access_hr->{'GPG_USE_OPTIONS'};
-            unless ($access_hr->{'GPG_PATH'}) {
-                &check_commands({'gpg' => ''}, {});
@@ -4048 +4060 @@
-        'gpg-agent-info=s' => \$gpg_agent_info,
-        'gpg-no-options'   => \$gpg_no_options,
+        'gpg-use-options'  => \$gpg_use_options,
-        'debug'          => \$debug,
-        'Kill'           => \$kill,

fwknop/trunk/fwknopd.8

@@ -214 +214 @@
-then fwknopd will default to using the /root/.gnupg directory for the server key(s).
-.TP
-
-
-
+
+
+
+
+
+
-.TP
-.B GPG_NO_REQUIRE_PREFIX

fwknop/trunk/test/fwknop_test.pl

@@ -182 +182 @@
-    'loopback-intf=s'   => \$loopback_intf,
-    'test-include=s'    => \$test_include,
+    'include=s'         => \$test_include,  ### synonym
-    'test-exclude=s'    => \$test_exclude,
+    'exclude=s'         => \$test_exclude,  ### synonym
-    'test-system-fwknop' => \$test_system_installed_fwknop,
-    'help'              => \$help
@@ -2367 +2369 @@
-    return &get_access_packet("$default_fwknop_args " .
-        "--gpg-home conf/client-gpg --gpg-recip $gpg_server_key " .
- --gpg-no-options
+
-}
-
@@ -2373 +2375 @@
-    return &get_access_packet("$default_fwknop_args " .
-        "--gpg-home conf/client-gpg --gpg-recip $gpg_server_key " .
-
-
+
-        $NO_QUIET);
-}
@@ -2381 +2382 @@
-    return &get_access_packet("$default_fwknop_args " .
-        "--gpg-home conf/client-gpg --gpg-recip $gpg_server_key " .
-no-options " .
-"--gpg-path $gpg2Cmd", 
+path $gpg2Cmd",
+
-}
-