Changeset 1464

Timestamp:

06/17/09 23:55:49 (9 months ago)

Author:

mbr

Message:

major update to fwknopd to support the FKO module

Location:

fwknop/trunk

Files:

• fwknop (modified) (3 diffs)
• fwknopd (modified) (24 diffs)

fwknop/trunk/fwknop

@@ -476 +476 @@
     ### initialize the FKO object if we are using the FKO module
     if ($use_fko_module) {
-        $fko_obj = FKO->new() or die "[*] Could not acquire FKO object: $!";
+        $fko_obj = FKO->new()
+            or die "[*] Could not acquire FKO object: $FKO::error_str";
         if ($debug) {
             print "[+] Using libfko functions via the FKO module.\n";
@@ -520 +521 @@
     $msg .= &SPA_digest($msg);
 
+    my $encrypted_msg = '';
+
     ### encrypt the SPA packet using the FKO module
-    return &fko_encrypt() if $use_fko_module;
+    if ($use_fko_module) {
+        $encrypted_msg = &fko_encrypt();
+        $fko_obj->destroy();
+        return $encrypted_msg;
+    }
 
     if ($debug) {
@@ -528 +535 @@
     }
 
-    my $encrypted_msg = '';
     if ($gpg_signing_key or $gpg_recipient) {
         $encrypted_msg = &pcap_GPG_encrypt_msg($msg);

fwknop/trunk/fwknopd

@@ -108 +108 @@
 my $skip_fko_module = 0;
 my $use_fko_module  = 0;
+my $fko_obj = ();
 my $cmdl_disable_gpg = 0;
 my $cmdline_fwknop_serv = '';
@@ -199 +200 @@
 my $SHA1_DIGEST_LEN   = 27;
 my $MD5_DIGEST_LEN    = 22;
+my $FKO_RECOMPUTE     = 1;
 
 ### logr constants
@@ -699 +701 @@
 
             ### see if we can decrypt and base64-decode
+            &fko_acquire_object() if $use_fko_module;
             my ($decrypt_rv, $decrypted_msg, $gpg_sign_id, $decrypt_algo)
                 = &SPA_decrypt($pkt_data, $enc_msg_len, $access_hr);
-            next SOURCE unless $decrypt_rv;
+
+            unless ($decrypt_rv) {
+                &fko_destroy_object() if $use_fko_module;
+                next SOURCE;
+            }
 
             ### check for replay attacks
             my ($digest_rv, $digest)
                 = &check_replay_attack($decrypted_msg, $src_ip);
-            return if $digest_rv;
+            if ($digest_rv) {
+                &fko_destroy_object() if $use_fko_module;
+                return;
+            }
 
             ### see if we have a syntactically valid message
@@ -715 +725 @@
                     "conform to a valid SPA packet.\n";
             }
-            next SOURCE unless $validate_rv;
+            unless ($validate_rv) {
+                &fko_destroy_object() if $use_fko_module;
+                next SOURCE;
+            }
 
             ### check to see if client side time stamp is too old
             my $time_check_rv = &SPA_check_packet_age($msg_hr->{'remote_time'});
+            unless ($validate_rv) {
+                &fko_destroy_object() if $use_fko_module;
+                next SOURCE;
+            }
             next SOURCE unless $time_check_rv;
 
@@ -726 +743 @@
             ### check username
             next SOURCE unless &SPA_check_user($access_hr, $src_ip, $msg_hr);
+            unless ($validate_rv) {
+                &fko_destroy_object() if $use_fko_module;
+                next SOURCE;
+            }
 
             ### check authentication method
-            next SOURCE unless &SPA_check_auth_method(
-                $access_hr, $src_ip, $msg_hr);
+            unless (&SPA_check_auth_method($access_hr, $src_ip, $msg_hr)) {
+                &fko_destroy_object() if $use_fko_module;
+                next SOURCE;
+            }
 
             if ($msg_hr->{'action_type'} == $SPA_ACCESS_MODE
@@ -740 +763 @@
                 if (&SPA_access($msg_hr, $src_ip, $decrypt_algo,
                         $gpg_sign_id, $digest, $access_hr)) {
+                    &fko_destroy_object() if $use_fko_module;
                     last SOURCE;
                 } else {
+                    &fko_destroy_object() if $use_fko_module;
                     next SOURCE;
                 }
@@ -747 +772 @@
                 if (&SPA_cmd($msg_hr, $src_ip, $decrypt_algo,
                         $gpg_sign_id, $digest, $access_hr)) {
+                    &fko_destroy_object() if $use_fko_module;
                     last SOURCE;
                 } else {
+                    &fko_destroy_object() if $use_fko_module;
                     next SOURCE;
                 }
@@ -795 +822 @@
     my $decrypt_rv    = 0;
 
-    if (not $cmdl_disable_gpg and $enc_msg_len > $config{'MIN_GNUPG_MSG_SIZE'}
+    if (not $cmdl_disable_gpg
+            and $enc_msg_len > $config{'MIN_GNUPG_MSG_SIZE'}
             and defined $access_hr->{'GPG_REMOTE_ID'}) {
         ### attempt GPG decrypt (only if the length of the encrypted
@@ -818 +846 @@
 
     if ($decrypt_rv) {
-        if ($debug) {
+        if ($debug and not $use_fko_module) {
             ### make sure not to print non-printable stuff
             my $dec_tmp_msg = $decrypted_msg;
@@ -1418 +1446 @@
 
     if ($config{'DIGEST_TYPE'} eq 'ALL') {
-        push @digests, sha256_base64($decrypted_data);
-        push @digests, sha1_base64($decrypted_data);
-        push @digests, md5_base64($decrypted_data);
+        if ($use_fko_module) {
+            for my $digest_type (FKO->FKO_DIGEST_SHA256,
+                    FKO->FKO_DIGEST_SHA1,
+                    FKO->FKO_DIGEST_MD5) {
+                my $digest = &fko_compute_digest($digest_type);
+                if ($digest) {
+                    push @digests, $digest;
+                } else {
+                    return 1, '';
+                }
+            }
+        } else {
+            push @digests, sha256_base64($decrypted_data);
+            push @digests, sha1_base64($decrypted_data);
+            push @digests, md5_base64($decrypted_data);
+        }
     } else {
         if ($config{'DIGEST_TYPE'} =~ /SHA256/) {
-            push @digests, sha256_base64($decrypted_data);
+            if ($use_fko_module) {
+                my $digest = &fko_compute_digest(FKO->FKO_DIGEST_SHA256);
+                if ($digest) {
+                    push @digests, $digest;
+                } else {
+                    return 1, '';
+                }
+            } else {
+                push @digests, sha256_base64($decrypted_data);
+            }
         }
         if ($config{'DIGEST_TYPE'} =~ /SHA1/) {
-            push @digests, sha1_base64($decrypted_data);
+            if ($use_fko_module) {
+                my $digest = &fko_compute_digest(FKO->FKO_DIGEST_SHA1);
+                if ($digest) {
+                    push @digests, $digest;
+                } else {
+                    return 1, '';
+                }
+            } else {
+                push @digests, sha1_base64($decrypted_data);
+            }
         }
         if ($config{'DIGEST_TYPE'} =~ /MD5/) {
-            push @digests, md5_base64($decrypted_data);
+            if ($use_fko_module) {
+                my $digest = &fko_compute_digest(FKO->FKO_DIGEST_MD5);
+                if ($digest) {
+                    push @digests, $digest;
+                } else {
+                    return 1, '';
+                }
+            } else {
+                push @digests, md5_base64($decrypted_data);
+            }
         }
     }
@@ -1467 +1535 @@
     }
     return $rv, $disk_write_digest;
+}
+
+sub fko_acquire_object() {
+
+    &fko_destroy_object() if $fko_obj;
+
+    ### initialize the FKO object
+    $fko_obj = FKO->new()
+        or die "[*] Could not acquire FKO object: ", FKO->error_str;
+
+    if ($debug) {
+        print STDERR localtime() . " [+] Using libfko ",
+            "functions via the FKO module.\n";
+    }
+    return;
+}
+
+sub fko_destroy_object() {
+    $fko_obj->destroy();
+    $fko_obj = ();
+    return;
+}
+
+sub fko_compute_digest() {
+    my $digest_type = shift;
+
+    my $fko_err = $fko_obj->digest_type($digest_type);
+    if ($fko_err) {
+        &logr('[-]', "FKO error setting digest type " .
+            "$digest_type: " . $fko_obj->errstr($fko_err),
+            $NO_MAIL);
+    }
+    my $digest = $fko_obj->spa_digest($FKO_RECOMPUTE);
+    unless ($digest) {
+        &logr('[-]', "FKO error computing digest: " .
+            $fko_obj->errstr($fko_err),
+            $NO_MAIL);
+        return 0;
+    }
+    return $digest;
 }
 
@@ -1590 +1698 @@
     );
 
+    my @fields = ();
+    my $fko_err = 0;
+
     ### the last field in the SPA packet is the digest, so see if it
     ### checks out first (this is the internal digest, not the digest that
@@ -1601 +1712 @@
     }
 
-    my @fields = split /:/, $msg;
-
-    unless (@fields) {
-        print STDERR localtime() . " [-] Could not split decrypted ",
-            "message into an array.\n" if $debug;
+    unless ($use_fko_module) {
+        @fields = split /:/, $msg;
+
+        unless (@fields) {
+            print STDERR localtime() . " [-] Could not split decrypted ",
+                "message into an array.\n" if $debug;
+            return 0, {};
+        }
+
+        if ($debug and $verbose) {
+            print STDERR localtime() . " [+] Packet array:\n", Dumper @fields;
+        }
+
+        unless ($#fields+1 >= $SPA_MIN_PACKET_FIELDS
+                and $#fields+1 <= $SPA_MAX_PACKET_FIELDS) {
+            print STDERR localtime() . " [-] Invalid number of fields in ",
+                "SPA packet, expected $SPA_MIN_PACKET_FIELDS-",
+                "$SPA_MAX_PACKET_FIELDS, got " . ($#fields+1) . ".\n" if $debug;
+            return 0, {};
+        }
+    }
+
+    ### random number
+    #
+    if ($use_fko_module) {
+        $msg_hsh{'random_number'} = $fko_obj->rand_value();
+    } else {
+        $msg_hsh{'random_number'} = $fields[0];
+    }
+    unless (&is_digit($msg_hsh{'random_number'})) {
+        &logr('[-]', "non-digit random number in decrypted SPA " .
+            "packet: $msg_hsh{'random_number'}", $SEND_MAIL);
         return 0, {};
     }
 
-    if ($debug and $verbose) {
-        print STDERR localtime() . " [+] Packet array:\n", Dumper @fields;
-    }
-
-    unless ($#fields+1 >= $SPA_MIN_PACKET_FIELDS
-            and $#fields+1 <= $SPA_MAX_PACKET_FIELDS) {
-        print STDERR localtime() . " [-] Invalid number of fields in ",
-            "SPA packet, expected $SPA_MIN_PACKET_FIELDS-",
-            "$SPA_MAX_PACKET_FIELDS, got " . ($#fields+1) . ".\n" if $debug;
-        return 0, {};
-    }
-
-    ### random number
-    if (&is_digit($fields[0])) {
-        $msg_hsh{'random_number'} = $fields[0];
+    ### username
+    #
+    if ($use_fko_module) {
+        $msg_hsh{'username'} = $fko_obj->username();
     } else {
-        &logr('[-]', "non-digit random number in decrypted SPA packet",
-            $SEND_MAIL);
-        return 0, {};
-    }
-
-    ### username
-    $msg_hsh{'username'} = decode_base64($fields[1]);
+        $msg_hsh{'username'} = decode_base64($fields[1]);
+    }
 
     ### timestamp
-    if (&is_digit($fields[2])) {
+    #
+    if ($use_fko_module) {
+        $msg_hsh{'remote_time'} = $fko_obj->timestamp();
+    } else {
         $msg_hsh{'remote_time'} = $fields[2];
-    } else {
+    }
+    unless (&is_digit($msg_hsh{'remote_time'})) {
         &logr('[-]', "non-digit timestamp in decrypted SPA packet",
             $SEND_MAIL);
@@ -1643 +1769 @@
 
     ### remote client version
-    $msg_hsh{'remote_version'} = $fields[3];
+    #
+    if ($use_fko_module) {
+        $msg_hsh{'remote_version'} = $fko_obj->version();
+    } else {
+        $msg_hsh{'remote_version'} = $fields[3];
+    }
+
     unless (&SPA_parse_client_version(\%msg_hsh)) {
         &logr('[-]', "invalid client string in decrypted SPA packet",
@@ -1651 +1783 @@
 
     ### message type
-    if (&is_digit($fields[4])) {
-        return 0, {} unless $fields[4] == $SPA_COMMAND_MODE
-                or $fields[4] == $SPA_ACCESS_MODE
-                or $fields[4] == $SPA_NAT_ACCESS_MODE
-                or $fields[4] == $SPA_CLIENT_TIMEOUT_ACCESS_MODE
-                or $fields[4] == $SPA_CLIENT_TIMEOUT_NAT_ACCESS_MODE
-                or $fields[4] == $SPA_LOCAL_NAT_ACCESS_MODE
-                or $fields[4] == $SPA_CLIENT_TIMEOUT_LOCAL_NAT_ACCESS_MODE;
+    #
+    if ($use_fko_module) {
+        $msg_hsh{'action_type'} = $fko_obj->spa_message_type();
+    } else {
         $msg_hsh{'action_type'} = $fields[4];
+    }
+
+    if (&is_digit($msg_hsh{'action_type'})) {
+        return 0, {} unless $msg_hsh{'action_type'} == $SPA_COMMAND_MODE
+                or $msg_hsh{'action_type'} == $SPA_ACCESS_MODE
+                or $msg_hsh{'action_type'} == $SPA_NAT_ACCESS_MODE
+                or $msg_hsh{'action_type'} == $SPA_CLIENT_TIMEOUT_ACCESS_MODE
+                or $msg_hsh{'action_type'} == $SPA_CLIENT_TIMEOUT_NAT_ACCESS_MODE
+                or $msg_hsh{'action_type'} == $SPA_LOCAL_NAT_ACCESS_MODE
+                or $msg_hsh{'action_type'} == $SPA_CLIENT_TIMEOUT_LOCAL_NAT_ACCESS_MODE;
+        $msg_hsh{'action_type'} = $msg_hsh{'action_type'};
     } else {
         &logr('[-]', "non-digit action type in decrypted SPA packet",
@@ -1665 +1804 @@
         return 0, {};
     }
+    if ($debug) {
+        print STDERR localtime() .
+            "[+] SPA action type: $msg_hsh{'action_type'}\n";
+    }
 
     ### action
-    $msg_hsh{'action'} = decode_base64($fields[5]);
+    #
+    if ($use_fko_module) {
+        $msg_hsh{'action'} = $fko_obj->spa_message();
+    } else {
+        $msg_hsh{'action'} = decode_base64($fields[5]);
+    }
 
     ### server_auth was introduced in 0.9.3
+    #
     if ($msg_hsh{'numeric_version'} >= 93) {
 
@@ -1676 +1825 @@
             my $found = 0;
             if ($msg_hsh{'action_type'} == $SPA_NAT_ACCESS_MODE
-                    or $msg_hsh{'action_type'} == $SPA_LOCAL_NAT_ACCESS_MODE) {
-                if ($#fields == $SPA_MIN_PACKET_FIELDS) {
-                    $msg_hsh{'nat_info'} = decode_base64($fields[6]);
-                    $found = 1;
+                        or $msg_hsh{'action_type'} == $SPA_LOCAL_NAT_ACCESS_MODE) {
+                if ($use_fko_module) {
+                    $msg_hsh{'nat_info'} = $fko_obj->spa_nat_access();
+                } else {
+                    if ($#fields == $SPA_MIN_PACKET_FIELDS) {
+                        $msg_hsh{'nat_info'} = decode_base64($fields[6]);
+                    }
                 }
+                $found = 1;
             } elsif ($msg_hsh{'numeric_version'} >= 192) {
                 ### client timeouts were introduced in 1.9.2
                 if ($msg_hsh{'action_type'} == $SPA_CLIENT_TIMEOUT_ACCESS_MODE) {
-                    $msg_hsh{'client_timeout'} = $fields[6];
+                    if ($use_fko_module) {
+                        $msg_hsh{'client_timeout'} = $fko_obj->spa_client_timeout();
+                    } else {
+                        $msg_hsh{'client_timeout'} = $fields[6];
+                    }
                     $found = 1;
                 } elsif ($msg_hsh{'action_type'}
                             == $SPA_CLIENT_TIMEOUT_NAT_ACCESS_MODE) {
-                    $msg_hsh{'nat_info'} = decode_base64($fields[6]);
-                    $msg_hsh{'client_timeout'} = $fields[7];
+                    if ($use_fko_module) {
+                        $msg_hsh{'nat_info'} = $fko_obj->spa_nat_access();
+                        $msg_hsh{'client_timeout'} = $fko_obj->spa_client_timeout();
+                    } else {
+                        $msg_hsh{'nat_info'} = decode_base64($fields[6]);
+                        $msg_hsh{'client_timeout'} = $fields[7];
+                    }
                     $found = 1;
                 } elsif ($msg_hsh{'action_type'}
                             == $SPA_CLIENT_TIMEOUT_LOCAL_NAT_ACCESS_MODE) {
-                    $msg_hsh{'nat_info'} = decode_base64($fields[6]);
-                    $msg_hsh{'client_timeout'} = $fields[7];
+                    if ($use_fko_module) {
+                        $msg_hsh{'nat_info'} = $fko_obj->spa_nat_access();
+                        $msg_hsh{'client_timeout'} = $fko_obj->spa_client_timeout();
+                    } else {
+                        $msg_hsh{'nat_info'} = decode_base64($fields[6]);
+                        $msg_hsh{'client_timeout'} = $fields[7];
+                    }
                     $found = 1;
                 }
@@ -1706 +1873 @@
             }
             unless ($found) {
+                if (not $use_fko_module and $#fields+1 > $SPA_MIN_PACKET_FIELDS) {
+                    $msg_hsh{'server_auth'} = decode_base64($fields[6]);
+                }
+            }
+        } else {
+            if ($use_fko_module) {
+                &logr('[-]', "remote libfko version less than minimum ",
+                    "required by FKO module", $SEND_MAIL);
+                return 0, {};
+            } else {
                 if ($#fields+1 > $SPA_MIN_PACKET_FIELDS) {
                     $msg_hsh{'server_auth'} = decode_base64($fields[6]);
                 }
             }
-        } else {
-            if ($#fields+1 > $SPA_MIN_PACKET_FIELDS) {
-                $msg_hsh{'server_auth'} = decode_base64($fields[6]);
-            }
         }
     } else {
-        unless ($#fields+1 == $SPA_MIN_PACKET_FIELDS) {
+        unless ($use_fko_module and $#fields+1 == $SPA_MIN_PACKET_FIELDS) {
             print STDERR localtime() . " [-] SPA packet from version: ",
                 "$msg_hsh{'remote_version'} ",
@@ -1790 +1963 @@
 
     my $rv = 0;
+
+    if ($use_fko_module) {
+        $hr->{'digest'} = $fko_obj->spa_digest();
+        my $digest_type = $fko_obj->digest_type();
+        if ($digest_type == FKO->FKO_DIGEST_SHA256) {
+            $hr->{'digest_str'} = 'SHA256';
+            return 1;
+        } elsif ($digest_type == FKO->FKO_DIGEST_SHA1) {
+            $hr->{'digest_str'} = 'SHA1';
+            return 1;
+        } elsif ($digest_type == FKO->FKO_DIGEST_MD5) {
+            $hr->{'digest_str'} = 'MD5';
+            return 1;
+        } else {
+            if ($debug) {
+                print STDERR localtime() .
+                    " [-] invalid digest type: $digest_type\n";
+            }
+            return 0;
+        }
+    }
+
     if ($msg_str =~ /(.*):(\S+)/) {
         my $msg = $1;
@@ -2522 +2717 @@
     my $gpg_sign_id   = '';
 
+    if ($use_fko_module) {
+
+        my $fko_err = $fko_obj->spa_data($msg);
+        if ($fko_err) {
+            if ($debug) {
+                &logr('[-]', "FKO error setting spa_data(): " .
+                    $fko_obj->errstr($fko_err), $NO_MAIL);
+            }
+            return $decrypt_rv, $decrypted_msg, $gpg_sign_id;
+        }
+
+        ### set the decryption type to use gpg
+        $fko_err = $fko_obj->encryption_type(FKO->FKO_ENCRYPTION_GPG);
+        if ($fko_err) {
+            if ($debug) {
+                &logr('[-]', "FKO error setting decryption type to gpg: " .
+                    $fko_obj->errstr($fko_err), $NO_MAIL);
+                return $decrypt_rv, $decrypted_msg, $gpg_sign_id;
+            }
+        }
+
+        $fko_err = $fko_obj->gpg_home_dir($access_hr->{'GPG_HOME_DIR'});
+        if ($fko_err) {
+            if ($debug) {
+                &logr('[-]', "FKO error setting gpg home dir: " .
+                    $fko_obj->errstr($fko_err), $NO_MAIL);
+                return $decrypt_rv, $decrypted_msg, $gpg_sign_id;
+            }
+        }
+
+        $fko_err = $fko_obj->gpg_recipient($access_hr->{'GPG_DECRYPT_ID'});
+        if ($fko_err) {
+            if ($debug) {
+                &logr('[-]', "FKO error setting signing key " .
+                    "gpg_signer(): " . $fko_obj->errstr($fko_err),
+                    $NO_MAIL);
+            }
+            return $decrypt_rv, $decrypted_msg, $gpg_sign_id;
+        }
+
+        $fko_err = $fko_obj->decrypt_spa_data($access_hr->{'GPG_DECRYPT_PW'});
+        if ($fko_err) {
+            if ($debug) {
+                &logr('[-]', "FKO error decrypting data via " .
+                    "decrypt_spa_data(): " . $fko_obj->errstr($fko_err),
+                    $NO_MAIL);
+            }
+            return $decrypt_rv, $decrypted_msg, $gpg_sign_id;
+        }
+
+        return 1, $decrypted_msg, $gpg_sign_id;
+    }
+
     unless ($msg =~ /^$access_hr->{'GPG_PREFIX'}/) {
         if ($access_hr->{'GPG_NO_REQUIRE_PREFIX'}) {
@@ -2566 +2814 @@
         return $decrypt_rv, $decrypted_msg, $gpg_sign_id;
     }
-
-#    ### look for the 0x8502 GnuPG prefix
-#    unless ($base64_decoded_msg =~ /^\x85\x02/) {
-#        if ($debug) {
-#            print STDERR localtime() . " [-] base64-decoded data does not begin ",
-#                "with 0x8502\n";
-#        }
-#        return $decrypt_rv, $decrypted_msg, $gpg_sign_id;
-#    }
 
     print STDERR localtime() . " [+] Attempting GnuPG decrypt...\n" if $debug;
@@ -2710 +2949 @@
     my $base64_decoded_msg = '';
 
+    if ($use_fko_module) {
+
+        my $fko_err = $fko_obj->spa_data($msg);
+        if ($fko_err) {
+            if ($debug) {
+                &logr('[-]', "FKO error setting spa_data(): " .
+                    $fko_obj->errstr($fko_err), $NO_MAIL);
+            }
+            return $decrypt_rv, $decrypted_msg;
+        }
+
+        $fko_err = $fko_obj->decrypt_spa_data($enc_key);
+        if ($fko_err) {
+            if ($debug) {
+                &logr('[-]', "FKO error decrypting data via " .
+                    "decrypt_spa_data(): " . $fko_obj->errstr($fko_err),
+                    $NO_MAIL);
+            }
+            return $decrypt_rv, $decrypted_msg;
+        }
+
+        return 1, $decrypted_msg;
+
+    }
+
     unless ($msg =~ /^U2FsdGVkX1/) {
         if ($debug) {
-            print STDERR localtime() . " [+] Adding encoded 'Salted__' prefix ",
-                "(U2FsdGVkX1) to incoming encoded SPA packet.\n"
+            print STDERR localtime() . " [+] Adding encoded 'Salted__' ",
+                "prefix (U2FsdGVkX1) to incoming encoded SPA packet.\n";
         }
         $msg = 'U2FsdGVkX1' . $msg;
@@ -2753 +3017 @@
     unless ($base64_decoded_msg =~ /^Salted__/) {
         if ($debug) {
-            print STDERR localtime() . " [-] base64-decoded data does not ",
-                "begin with 'Salted__'\n";
+            print STDERR localtime() . " [-] base64-decoded data does ",
+                "not begin with 'Salted__'\n";
         }
         return $decrypt_rv, $decrypted_msg;
     }
 
-    print STDERR localtime() . " [+] Attempting Rijndael decrypt...\n" if $debug;
+    print STDERR localtime() . " [+] Attempting Rijndael decrypt...\n"
+        if $debug;
 
     if ($debug and $verbose) {
@@ -5700 +5965 @@
             }
         }
-    }
-    close F;
+        close F;
+    }
 
     &logr('[+]', "imported previous tracking digests from disk " .