Changeset 1489

Timestamp:

06/30/09 08:26:51 (8 months ago)

Author:

mbr

Message:

added --spa-dump-packets mode to fwknopd and used this as the method for acquiring SPA packet digests for the test suite - this ensures the digests always conform to how the fwknopd daemon sees them

Location:

fwknop/trunk

Files:

• fwknopd (modified) (7 diffs)
• test/fwknop_test.pl (modified) (35 diffs)

fwknop/trunk/fwknopd

@@ -128 +128 @@
 my $fw_data_file = '';  ### legacy port knocking mode
 my $dump_config = 0;
+my $spa_dump_packets = '';
 
 my $cmdline_locale = '';
@@ -691 +692 @@
     my ($src_ip, $enc_msg_len, $pkt_data) = @_;
 
+    if ($spa_dump_packets) {
+        if (&is_base64($pkt_data)) {
+            print "\nLen: $enc_msg_len, pkt: $pkt_data\n";
+        } else {
+            print "\nLine contains non base64 chars, skipping.\n";
+            return;
+        }
+    }
+
     ### first check to see if we have any matching access directives
     ### (in access.conf) for $src_ip, and if not we will do _nothing_
@@ -740 +750 @@
                 &fko_destroy_object() if $use_fko_module;
                 next SOURCE;
+            }
+
+            if ($spa_dump_packets) {
+                print "    Disk write digest: $digest\n";
+                for my $key (keys %$msg_hr) {
+                    printf "    %20s -> %s\n", $key, $msg_hr->{$key};
+                }
+                return;
             }
 
@@ -4881 +4899 @@
         'fwknop_servCmd=s' => \$cmdline_fwknop_serv,
         'knoptm-debug-file=s' => \$knoptm_debug_file,
+        'spa-dump-packets=s' => \$spa_dump_packets,
         'LC_ALL=s'       => \$cmdline_locale,
         'locale=s'       => \$cmdline_locale,
@@ -4988 +5007 @@
     }
     return;
+}
+
+sub spa_dump_packets() {
+    my $rv = 0;
+
+    &import_access();
+
+    print "[+] Reading in encoded/encrypted SPA packets ",
+        "from file: $spa_dump_packets\n";
+    open F, "< $spa_dump_packets" or
+        die "[*] Could not open $spa_dump_packets: $!";
+    while (<F>) {
+        next unless /\S/;
+        chomp;
+        &SPA_check_grant_access('127.0.0.1', length($_), $_);
+    }
+    close F;
+    return $rv;
 }
 
@@ -5185 +5222 @@
     ### --Status
     exit &status() if $status;
+
+    ### --spa-dump-packets (dumps decrypted SPA packets out on stdout)
+    exit &spa_dump_packets() if $spa_dump_packets;
 
     ### make sure there is not another fwknopd process already running.
@@ -6037 +6077 @@
         }
         close F;
+    }
+
+    if ($debug) {
+        print STDERR localtime() . " [+] digest_store hash: \n",
+            Dumper(\%digest_store);
     }
 

fwknop/trunk/test/fwknop_test.pl

@@ -53 +53 @@
 
 my $knoptm_debug_file = "$output_dir/knoptm.debug";
+my $dump_packets_file  = "$output_dir/dump_packets";  # for digest calculation
 
 my $default_access_conf   = "$conf_dir/default_access.conf";
@@ -1555 +1556 @@
 sub replay_attack() {
 
-    &get_access_packet($default_fwknop_args, $NO_QUIET);
+    &get_access_packet($default_fwknop_args, $default_fwknop_conf, $NO_QUIET);
 
     ### write out the digest to the digest.cache so that we
@@ -1592 +1593 @@
 
     ### SHA256 is the default anyway
-    &get_access_packet("$default_fwknop_args --digest-alg sha256", $NO_QUIET);
+    &get_access_packet("$default_fwknop_args --digest-alg sha256",
+        $sha256_fwknop_conf, $NO_QUIET);
 
     ### write out the SHA256 digest to the digest.cache file so that we
@@ -1626 +1628 @@
 sub replay_attack_sha1() {
 
-    &get_access_packet("$default_fwknop_args --digest-alg sha1", $NO_QUIET);
+    &get_access_packet("$default_fwknop_args --digest-alg sha1",
+        $sha1_fwknop_conf, $NO_QUIET);
 
     ### write out the SHA1 digest to the digest.cache so that we
@@ -1660 +1663 @@
 sub replay_attack_md5() {
 
-    &get_access_packet("$default_fwknop_args --digest-alg md5", $NO_QUIET);
+    &get_access_packet("$default_fwknop_args --digest-alg md5",
+        $md5_fwknop_conf, $NO_QUIET);
 
     ### write out the MD5 digest to the digest.cache so that we
@@ -1693 +1697 @@
 
 sub non_matching_source_generation() {
-    return &get_access_packet($default_fwknop_args, $NO_QUIET);
+    return &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3382 +3387 @@
     return &get_access_packet("$default_fwknop_args " .
         "--gpg-home conf/client-gpg --gpg-recip $gpg_server_key " .
-        "--gpg-sign $gpg_client_key", $NO_QUIET);
+        "--gpg-sign $gpg_client_key", $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3389 +3394 @@
         "--gpg-home conf/client-gpg --gpg-recip $gpg_server_key " .
         "--gpg-sign $gpg_client_key --Include-gpg-prefix",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3396 +3401 @@
         "--gpg-home conf/client-gpg --gpg-recip $gpg_server_key " .
         "--gpg-sign $gpg_client_key --gpg-path $gpg2Cmd",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3403 +3408 @@
         "--gpg-home conf/client-gpg --gpg-recip $gpg_server_key " .
         "--gpg-sign $gpg_client_key --gpg-path $gpg2Cmd $http_opt",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_client_timeout_access_packet() {
     return &get_access_packet("$default_fwknop_args --fw-timeout 5",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_access_packet_62203() {
     return &get_access_packet("$default_fwknop_args $server_port_opt 62203",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_access_packet_plus60min() {
     return &get_access_packet("$default_fwknop_args --time-offset-plus 60min",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_access_packet_minus60min() {
     return &get_access_packet("$default_fwknop_args --time-offset-minus 60min",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_access_packet_icmp() {
     return &get_access_packet("$default_fwknop_args $spoof_proto_opt icmp",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_access_packet_http() {
     return &get_access_packet("$default_fwknop_args $http_opt",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3439 +3444 @@
     return &get_access_packet("$default_fwknop_args " .
         "--gpg-home conf/client-gpg --gpg-recip $gpg_server_key " .
-        "--gpg-sign $gpg_client_key $http_opt", $NO_QUIET);
+        "--gpg-sign $gpg_client_key $http_opt", $default_fwknop_conf,
+        $NO_QUIET);
 }
 
@@ -3445 +3451 @@
     if ($client_language eq 'C') {
         return &get_access_packet("$default_fwknop_args --server-proto tcp",
-            $NO_QUIET);
+            $default_fwknop_conf, $NO_QUIET);
     } else {
         return &get_access_packet("$default_fwknop_args --TCP-sock",
-            $NO_QUIET);
+            $default_fwknop_conf, $NO_QUIET);
     }
 }
 
 sub SPA_access_packet() {
-    return &get_access_packet($default_fwknop_args, $NO_QUIET);
+    return &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3460 +3467 @@
         "--get-key $local_key_file -D $localhost -a $allow_src " .
         "$test_mode_opt -v --debug $spoof_user_opt $require_user",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_access_packet_salted() {
     return &get_access_packet("$default_fwknop_args --Include-salted",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_access_packet_rand_dest_port() {
     return &get_access_packet("$default_fwknop_args --rand-port",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_access_packet_no_dash_A() {
-    return &get_access_packet($fwknop_args_no_dash_A, $NO_QUIET);
+    return &get_access_packet($fwknop_args_no_dash_A,
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_access_packet_md5() {
     return &get_access_packet("$default_fwknop_args --digest-alg md5",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3486 +3494 @@
         "$local_key_file -D $localhost -a $allow_src --Test -v " .
         qq|--debug $spoof_user_opt $require_user --Server-cmd "$test_cmd"|,
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_forward_access_packet_client_timeout() {
     return &get_access_packet("$default_fwknop_args " .
-        "--NAT-access 192.168.10.3:55000 --fw-timeout 5", $NO_QUIET);
+        "--NAT-access 192.168.10.3:55000 --fw-timeout 5",
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_forward_access_packet() {
     return &get_access_packet("$default_fwknop_args " .
-        "--NAT-access 192.168.10.3:55000", $NO_QUIET);
+        "--NAT-access 192.168.10.3:55000",
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_forward_access_packet_restricted_IP() {
     return &get_access_packet("$default_fwknop_args " .
-        "--NAT-access 192.168.10.5:55000", $NO_QUIET);
+        "--NAT-access 192.168.10.5:55000",
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_output_access_packet() {
-    return &get_access_packet($default_fwknop_args, $NO_QUIET);
+    return &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $NO_QUIET);
 }
 
 sub SPA_local_nat_access_packet() {
     return &get_access_packet("$default_fwknop_args " .
-        "--NAT-local --NAT-access $localhost:55000", $NO_QUIET);
+        "--NAT-local --NAT-access $localhost:55000",
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3516 +3529 @@
     return &get_access_packet("$default_fwknop_args " .
         "--NAT-local --NAT-access $localhost --NAT-rand-port ",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3522 +3535 @@
     return &get_access_packet("$default_fwknop_args " .
         "--NAT-local --NAT-access $localhost --NAT-rand-port " .
-        "--rand-port",
-        $NO_QUIET);
+        "--rand-port", $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3529 +3541 @@
     return &get_access_packet("$default_fwknop_args " .
         "--NAT-local --NAT-access $localhost:55000 --fw-timeout 5",
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3536 +3548 @@
         "$local_key_file -D $localhost -a $allow_src --Test -v " .
         qq|--debug $spoof_user_opt $require_user --Server-cmd "$test_cmd"|,
-        $NO_QUIET);
+        $default_fwknop_conf, $NO_QUIET);
 }
 
@@ -3542 +3554 @@
     my $key_copy = $cache_key;
     $cache_key = 'short';
-    my $rv = &get_access_packet($default_fwknop_args, $QUIET);
+    my $rv = &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $QUIET);
     $cache_key = $key_copy;
     if ($client_language eq 'perl') {
@@ -3554 +3567 @@
 sub unauthorized_port_request() {
     $default_fwknop_args =~ s|\s$open_ports\s| tcp/1 |;
-    my $rv = &get_access_packet($default_fwknop_args, $NO_QUIET);
+    my $rv = &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $NO_QUIET);
     $default_fwknop_args =~ s|\stcp/1\s| $open_ports |;
     return $rv;
@@ -3586 +3600 @@
 sub unauthorized_user() {
     $default_fwknop_args =~ s/\s$require_user/ mbr$require_user/;
-    my $rv = &get_access_packet($default_fwknop_args, $NO_QUIET);
+    my $rv = &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $NO_QUIET);
     $default_fwknop_args =~ s/\smbr$require_user/ $require_user/;
     return $rv;
@@ -3618 +3633 @@
 
 sub truncated_SPA_packet() {
-    my $rv = &get_access_packet($default_fwknop_args, $NO_QUIET);
+    my $rv = &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $NO_QUIET);
     ### chop off the last 11 chars
     $cache_encrypted_spa_packet =~ s|.{11}$||;
@@ -3625 +3641 @@
 
 sub non_base64_SPA_packet() {
-    my $rv = &get_access_packet($default_fwknop_args, $NO_QUIET);
+    my $rv = &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $NO_QUIET);
     ### introduce one non-base64 encoded character "@" at the 11th position
     $cache_encrypted_spa_packet =~ s|(.{10}).|$1@|;
@@ -3632 +3649 @@
 
 sub append_SPA_packet() {
-    my $rv = &get_access_packet($default_fwknop_args, $NO_QUIET);
+    my $rv = &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $NO_QUIET);
     ### append 10 garbage chars
     $cache_encrypted_spa_packet .= '1234567890';
@@ -3739 +3757 @@
 sub source_addr() {
     $default_fwknop_args =~ s/\-a\s+$allow_src\s/-a 0.0.0.0 /;
-    my $rv = &get_access_packet($default_fwknop_args, $NO_QUIET);
+    my $rv = &get_access_packet($default_fwknop_args,
+        $default_fwknop_conf, $NO_QUIET);
     $default_fwknop_args =~ s/\-a\s+0(?:\.0){3}\s/-a $allow_src /;
     return $rv;
@@ -3779 +3798 @@
     for (my $i=0; $i < $NUM_RAND; $i++) {
 
-        &get_access_packet($default_fwknop_args, $NO_QUIET);
+        &get_access_packet($default_fwknop_args,
+            $default_fwknop_conf, $NO_QUIET);
 
         if (defined $packet_cache{$cache_encrypted_spa_packet}) {
@@ -3905 +3925 @@
     }
 
-    &get_packet_data_from_fwknop_output();
+    &get_packet_data_from_fwknop_output($default_fwknop_conf);
 
     unless ($cache_encrypted_spa_packet) {
@@ -3914 +3934 @@
 
 sub get_access_packet() {
-    my ($fwknop_cmdline, $output) = @_;
+    my ($fwknop_cmdline, $fwknop_conf, $output) = @_;
 
     &write_key();
@@ -3936 +3956 @@
     }
 
-    &get_packet_data_from_fwknop_output();
+    &get_packet_data_from_fwknop_output($fwknop_conf);
 
     unless ($cache_encrypted_spa_packet) {
@@ -3962 +3982 @@
 
 sub get_packet_data_from_fwknop_output() {
+    my $fwknop_conf = shift;
 
     $spa_port = 0;
     $cache_encrypted_spa_packet = '';
+    $spa_packet_digest = '';
 
     my $found_packet_data = 0;
@@ -3972 +3994 @@
     while (<F>) {
         if ($client_language eq 'perl') {
-            if (/\sDigest:\s+(\S+)/i) {
-                $spa_packet_digest = $1;
-                next;
-            }
             if (/^\s*\[\+\]\s+Packet\s+data:/) {
                 $found_packet_data = 1;
@@ -3991 +4009 @@
             }
         } else {
-            if (/^\s*SPA.*\sDigest:\s+(\S+)/) {
-                $spa_packet_digest = $1;
-                next;
-            }
             if (/^\s*Final\s+Packed.*\sData:/) {
                 $found_packet_data = 1;
@@ -4007 +4021 @@
     }
     close F;
+
+    ### now that we have the packet data, feed this data to fwknopd
+    ### to get the digest that it would calculate
+    die "[*] Could not acquire encrypted SPA packet from the fwknop client."
+        unless $cache_encrypted_spa_packet;
+
+    &get_spa_digests_from_fwknopd($fwknop_conf);
+
     return;
 }
@@ -4543 +4565 @@
 
 sub fwknopd_test_fko_exists() {
-    my $cmd = "$fwknopdCmd --test-FKO-exists";
+    my $cmd = "$fwknopdCmd -c $default_fwknop_conf --test-FKO-exists";
     open C, "$cmd 2>&1 |" or die "[*] Could not execute $cmd: $!";
     while (<C>) {
@@ -4552 +4574 @@
     }
     close C;
+    return;
+}
+
+sub get_spa_digests_from_fwknopd() {
+    my $fwknop_conf = shift;
+
+    ### write the current packet out to the dump packets file
+    open F, "> $dump_packets_file" or
+        die "[*] Could not open $dump_packets_file: $!";
+    print F $cache_encrypted_spa_packet, "\n";
+    close F;
+
+    my $cmd = "$fwknopdCmd -c $fwknop_conf " .
+        "-a $default_access_conf --spa-dump-packets $dump_packets_file";
+    open C, "$cmd 2>&1 |" or die "[*] Could not execute $cmd: $!";
+    while (<C>) {
+        if (/Disk\s+write\s+digest:\s+(\S+)/) {
+            $spa_packet_digest = $1;
+            last;
+        }
+    }
+    close C;
+
     return;
 }