Browse Source
Merge pull request #2172 from oneru/fwknop-2.6.8
Update fwknop to 2.6.8lilik-openwrt-22.03
Hannu Nyman
9 years ago
3 changed files with 4 additions and 431 deletions
Split View
Diff Options
-
+3 -3net/fwknop/Makefile
-
+1 -1net/fwknop/files/fwknopd.init
-
+0 -427net/fwknop/patches/001-add-keygen.patch
+ 3
- 3
net/fwknop/Makefile
View File
+ 1
- 1
net/fwknop/files/fwknopd.init
View File
+ 0
- 427
net/fwknop/patches/001-add-keygen.patch
View File
| @ -1,427 +0,0 @@ | |||
| diff --git a/CREDITS b/CREDITS | |||
| index de17d9e..38e2108 100644 | |||
| --- a/CREDITS | |||
| +++ b/CREDITS | |||
| @@ -1,5 +1,6 @@ | |||
| Jonathan Bennett | |||
| - Contributed OpenWRT support - see the extras/openwrt/ directory. | |||
| + - Suggested the addition of the --key-gen option to fwknopd. | |||
| Sebastien Jeanquier | |||
| - Assisted with getting fwknop included in BackTrack Linux - the choice | |||
| diff --git a/ChangeLog b/ChangeLog | |||
| index 21a5093..4daf008 100644 | |||
| --- a/ChangeLog | |||
| +++ b/ChangeLog | |||
| @@ -1,3 +1,8 @@ | |||
| +fwknop-2.6.7 (05//2015): | |||
| + - Added --key-gen to fwknopd. This feature was suggested by Jonathan | |||
| + Bennett, and will help with ease of use efforts. The first platform to | |||
| + take advantage of this will likely be OpenWRT thanks to Jonathan. | |||
| + | |||
| fwknop-2.6.6 (04/23/2015): | |||
| - [server] Add the ability for fwknopd to function as an generic SPA | |||
| gateway. This allows scenarios such as the fwknopd system providing DHCP | |||
| diff --git a/client/config_init.c b/client/config_init.c | |||
| index cdb233d..f0ae135 100644 | |||
| --- a/client/config_init.c | |||
| +++ b/client/config_init.c | |||
| @@ -199,7 +199,7 @@ static int critical_var_array[] = | |||
| }; | |||
| /** | |||
| - * @brief Generate Rijndael + HMAC keys from /dev/random (base64 encoded) and exit. | |||
| + * @brief Generate Rijndael + HMAC keys from /dev/urandom (base64 encoded). | |||
| * | |||
| * @param options FKO command line option structure | |||
| */ | |||
| diff --git a/client/fwknop_common.h b/client/fwknop_common.h | |||
| index aef20c4..c57db02 100644 | |||
| --- a/client/fwknop_common.h | |||
| +++ b/client/fwknop_common.h | |||
| @@ -69,8 +69,6 @@ | |||
| #define MAX_HOSTNAME_LEN 70 | |||
| #define MAX_URL_HOST_LEN 256 | |||
| #define MAX_URL_PATH_LEN 1024 | |||
| -#define MAX_KEY_LEN 128 | |||
| -#define MAX_B64_KEY_LEN 180 | |||
| /* fwknop client configuration parameters and values | |||
| */ | |||
| @@ -156,10 +154,10 @@ typedef struct fko_cli_options | |||
| unsigned char use_gpg; | |||
| unsigned char use_gpg_agent; | |||
| unsigned char gpg_no_signing_pw; | |||
| + unsigned char key_gen; | |||
| int time_offset_plus; | |||
| int time_offset_minus; | |||
| int fw_timeout; | |||
| - int key_gen; | |||
| char use_rc_stanza[MAX_LINE_LEN]; | |||
| unsigned char got_named_stanza; | |||
| diff --git a/common/common.h b/common/common.h | |||
| index b63e7c2..c7b2e57 100644 | |||
| --- a/common/common.h | |||
| +++ b/common/common.h | |||
| @@ -157,6 +157,9 @@ enum { | |||
| #define MAX_GPG_KEY_ID 128 | |||
| #define MAX_USERNAME_LEN 30 | |||
| +#define MAX_KEY_LEN 128 | |||
| +#define MAX_B64_KEY_LEN 180 | |||
| + | |||
| /* Command line argument / argv handling | |||
| */ | |||
| #define MAX_CMDLINE_ARGS 30 /*!< should be way more than enough */ | |||
| diff --git a/doc/fwknop.man.asciidoc b/doc/fwknop.man.asciidoc | |||
| index 070ac77..efa99a7 100644 | |||
| --- a/doc/fwknop.man.asciidoc | |||
| +++ b/doc/fwknop.man.asciidoc | |||
| @@ -196,6 +196,11 @@ GENERAL OPTIONS | |||
| keys are generally more secure than passphrases that are typed in from the | |||
| command line. | |||
| +*--key-gen-file*='<file>':: | |||
| + Write generated keys to the specified file. Note that the file is | |||
| + overwritten if it already exists. If this option is not given, then | |||
| + *--key-gen* writes the keys to stdout. | |||
| + | |||
| *--key-len*='<length>':: | |||
| Specify the number of bytes for a generated Rijndael key. The maximum size | |||
| is currently 128 bytes. | |||
| diff --git a/server/cmd_opts.h b/server/cmd_opts.h | |||
| index bc1eee1..d7a645c 100644 | |||
| --- a/server/cmd_opts.h | |||
| +++ b/server/cmd_opts.h | |||
| @@ -141,6 +141,10 @@ enum { | |||
| FW_LIST = 0x200, | |||
| FW_LIST_ALL, | |||
| FW_FLUSH, | |||
| + KEY_GEN_FILE, | |||
| + KEY_LEN, | |||
| + HMAC_KEY_LEN, | |||
| + HMAC_DIGEST_TYPE, | |||
| AFL_PKT_FILE, | |||
| GPG_HOME_DIR, | |||
| GPG_EXE_PATH, | |||
| @@ -178,7 +182,12 @@ static struct option cmd_opts[] = | |||
| {"fault-injection-tag", 1, NULL, FAULT_INJECTION_TAG}, | |||
| {"help", 0, NULL, 'h'}, | |||
| {"interface", 1, NULL, 'i'}, | |||
| - {"kill", 0, NULL, 'K'}, | |||
| + {"key-gen", 0, NULL, 'k'}, | |||
| + {"key-gen-file", 1, NULL, KEY_GEN_FILE }, | |||
| + {"key-len", 1, NULL, KEY_LEN }, | |||
| + {"hmac-key-len", 1, NULL, HMAC_KEY_LEN }, | |||
| + {"hmac-digest-type", 1, NULL, HMAC_DIGEST_TYPE }, | |||
| + {"kill", 0, NULL, 'K' }, | |||
| {"fw-flush", 0, NULL, FW_FLUSH }, | |||
| {"fw-list", 0, NULL, FW_LIST }, | |||
| {"fw-list-all", 0, NULL, FW_LIST_ALL }, | |||
| diff --git a/server/config_init.c b/server/config_init.c | |||
| index 0ddceee..2f1d293 100644 | |||
| --- a/server/config_init.c | |||
| +++ b/server/config_init.c | |||
| @@ -201,6 +201,69 @@ validate_int_var_ranges(fko_srv_options_t *opts) | |||
| return; | |||
| } | |||
| +/** | |||
| + * @brief Generate Rijndael + HMAC keys from /dev/urandom (base64 encoded). | |||
| + * | |||
| + * @param options FKO command line option structure | |||
| + */ | |||
| +static void | |||
| +generate_keys(fko_srv_options_t *options) | |||
| +{ | |||
| + char key_base64[MAX_B64_KEY_LEN+1]; | |||
| + char hmac_key_base64[MAX_B64_KEY_LEN+1]; | |||
| + | |||
| + FILE *key_gen_file_ptr = NULL; | |||
| + int res; | |||
| + | |||
| + /* Set defaults and validate for --key-gen mode | |||
| + */ | |||
| + if(options->key_len == 0) | |||
| + options->key_len = FKO_DEFAULT_KEY_LEN; | |||
| + | |||
| + if(options->hmac_key_len == 0) | |||
| + options->hmac_key_len = FKO_DEFAULT_HMAC_KEY_LEN; | |||
| + | |||
| + if(options->hmac_type == 0) | |||
| + options->hmac_type = FKO_DEFAULT_HMAC_MODE; | |||
| + | |||
| + /* Zero out the key buffers */ | |||
| + memset(key_base64, 0x00, sizeof(key_base64)); | |||
| + memset(hmac_key_base64, 0x00, sizeof(hmac_key_base64)); | |||
| + | |||
| + /* Generate the key through libfko */ | |||
| + res = fko_key_gen(key_base64, options->key_len, | |||
| + hmac_key_base64, options->hmac_key_len, | |||
| + options->hmac_type); | |||
| + | |||
| + if(res != FKO_SUCCESS) | |||
| + { | |||
| + log_msg(LOG_ERR, "%s: fko_key_gen: Error %i - %s", | |||
| + MY_NAME, res, fko_errstr(res)); | |||
| + clean_exit(options, NO_FW_CLEANUP, EXIT_FAILURE); | |||
| + } | |||
| + | |||
| + if(options->key_gen_file[0] != '\0') | |||
| + { | |||
| + if ((key_gen_file_ptr = fopen(options->key_gen_file, "w")) == NULL) | |||
| + { | |||
| + log_msg(LOG_ERR, "Unable to create key gen file: %s: %s", | |||
| + options->key_gen_file, strerror(errno)); | |||
| + clean_exit(options, NO_FW_CLEANUP, EXIT_FAILURE); | |||
| + } | |||
| + fprintf(key_gen_file_ptr, "KEY_BASE64: %s\nHMAC_KEY_BASE64: %s\n", | |||
| + key_base64, hmac_key_base64); | |||
| + fclose(key_gen_file_ptr); | |||
| + fprintf(stdout, "[+] Wrote Rijndael and HMAC keys to: %s", | |||
| + options->key_gen_file); | |||
| + } | |||
| + else | |||
| + { | |||
| + fprintf(stdout, "KEY_BASE64: %s\nHMAC_KEY_BASE64: %s\n", | |||
| + key_base64, hmac_key_base64); | |||
| + } | |||
| + clean_exit(options, NO_FW_CLEANUP, EXIT_SUCCESS); | |||
| +} | |||
| + | |||
| /* Parse the config file... | |||
| */ | |||
| static void | |||
| @@ -427,7 +490,7 @@ validate_options(fko_srv_options_t *opts) | |||
| if(opts->config[CONF_ENABLE_DIGEST_PERSISTENCE] == NULL) | |||
| set_config_entry(opts, CONF_ENABLE_DIGEST_PERSISTENCE, | |||
| DEF_ENABLE_DIGEST_PERSISTENCE); | |||
| - | |||
| + | |||
| /* Enable destination rule. | |||
| */ | |||
| if(opts->config[CONF_ENABLE_DESTINATION_RULE] == NULL) | |||
| @@ -928,8 +991,9 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) | |||
| /* First, scan the command-line args for -h/--help or an alternate | |||
| * configuration file. If we find an alternate config file, use it, | |||
| - * otherwise use the default. We also grab any override config files | |||
| - * as well. | |||
| + * otherwise use the default. We also grab any override config files | |||
| + * as well. In addition, we handle key generation here since this is | |||
| + * independent of configuration parsing. | |||
| */ | |||
| while ((cmd_arg = getopt_long(argc, argv, | |||
| GETOPTS_OPTION_STRING, cmd_opts, &index)) != -1) { | |||
| @@ -952,6 +1016,45 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) | |||
| if(got_override_config > 0) | |||
| break; | |||
| + case 'k': | |||
| + opts->key_gen = 1; | |||
| + break; | |||
| + case KEY_GEN_FILE: | |||
| + opts->key_gen = 1; | |||
| + strlcpy(opts->key_gen_file, optarg, sizeof(opts->key_gen_file)); | |||
| + break; | |||
| + case KEY_LEN: /* used in --key-gen mode only */ | |||
| + opts->key_len = strtol_wrapper(optarg, 1, | |||
| + MAX_KEY_LEN, NO_EXIT_UPON_ERR, &is_err); | |||
| + if(is_err != FKO_SUCCESS) | |||
| + { | |||
| + log_msg(LOG_ERR, | |||
| + "Invalid key length '%s', must be in [%d-%d]", | |||
| + optarg, 1, MAX_KEY_LEN); | |||
| + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); | |||
| + } | |||
| + break; | |||
| + case HMAC_DIGEST_TYPE: /* used in --key-gen mode only */ | |||
| + if((opts->hmac_type = hmac_digest_strtoint(optarg)) < 0) | |||
| + { | |||
| + log_msg(LOG_ERR, | |||
| + "* Invalid hmac digest type: %s, use {md5,sha1,sha256,sha384,sha512}", | |||
| + optarg); | |||
| + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); | |||
| + } | |||
| + break; | |||
| + case HMAC_KEY_LEN: /* used in --key-gen mode only */ | |||
| + opts->hmac_key_len = strtol_wrapper(optarg, 1, | |||
| + MAX_KEY_LEN, NO_EXIT_UPON_ERR, &is_err); | |||
| + if(is_err != FKO_SUCCESS) | |||
| + { | |||
| + log_msg(LOG_ERR, | |||
| + "Invalid hmac key length '%s', must be in [%d-%d]", | |||
| + optarg, 1, MAX_KEY_LEN); | |||
| + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); | |||
| + } | |||
| + break; | |||
| + | |||
| /* Look for override configuration file arg. | |||
| */ | |||
| case 'O': | |||
| @@ -965,6 +1068,9 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) | |||
| } | |||
| } | |||
| + if(opts->key_gen) | |||
| + generate_keys(opts); | |||
| + | |||
| /* If no alternate configuration file was specified, we use the | |||
| * default. | |||
| */ | |||
| diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h | |||
| index ecf2a81..8c33eaa 100644 | |||
| --- a/server/fwknopd_common.h | |||
| +++ b/server/fwknopd_common.h | |||
| @@ -585,10 +585,14 @@ typedef struct fko_srv_options | |||
| unsigned char fw_list; /* List current firewall rules */ | |||
| unsigned char fw_list_all; /* List all current firewall rules */ | |||
| unsigned char fw_flush; /* Flush current firewall rules */ | |||
| + unsigned char key_gen; /* Generate keys and exit */ | |||
| + unsigned char exit_after_parse_config; /* Parse config and exit */ | |||
| + | |||
| + /* Operational flags | |||
| + */ | |||
| unsigned char test; /* Test mode flag */ | |||
| unsigned char afl_fuzzing; /* SPA pkts from stdin for AFL fuzzing */ | |||
| unsigned char verbose; /* Verbose mode flag */ | |||
| - unsigned char exit_after_parse_config; /* Parse config and exit */ | |||
| unsigned char enable_udp_server; /* Enable UDP server mode */ | |||
| unsigned char firewd_disable_check_support; /* Don't use firewall-cmd ... -C */ | |||
| @@ -605,6 +609,13 @@ typedef struct fko_srv_options | |||
| int tcp_server_pid; | |||
| int lock_fd; | |||
| + /* Values used in --key-gen mode only | |||
| + */ | |||
| + char key_gen_file[MAX_PATH_LEN]; | |||
| + int key_len; | |||
| + int hmac_key_len; | |||
| + int hmac_type; | |||
| + | |||
| #if USE_FILE_CACHE | |||
| struct digest_cache_list *digest_cache; /* In-memory digest cache list */ | |||
| #endif | |||
| diff --git a/test/tests/basic_operations.pl b/test/tests/basic_operations.pl | |||
| index f4dde2e..76a509d 100644 | |||
| --- a/test/tests/basic_operations.pl | |||
| +++ b/test/tests/basic_operations.pl | |||
| @@ -390,6 +390,14 @@ | |||
| 'exec_err' => $YES, | |||
| 'cmdline' => "$default_client_args --key-gen -K " . 'A'x1030 | |||
| }, | |||
| + { | |||
| + 'category' => 'basic operations', | |||
| + 'subcategory' => 'server', | |||
| + 'detail' => '--key-gen file path (-K) too long', | |||
| + 'function' => \&generic_exec, | |||
| + 'exec_err' => $YES, | |||
| + 'cmdline' => "$fwknopdCmd --key-gen --key-gen-file " . 'A'x1030 | |||
| + }, | |||
| { | |||
| 'category' => 'basic operations', | |||
| diff --git a/test/tests/rijndael.pl b/test/tests/rijndael.pl | |||
| index 26aab6a..34af65e 100644 | |||
| --- a/test/tests/rijndael.pl | |||
| +++ b/test/tests/rijndael.pl | |||
| @@ -421,33 +421,6 @@ | |||
| 'key_file' => $cf{'rc_named_key'}, | |||
| }, | |||
| - ### --key-gen tests | |||
| - { | |||
| - 'category' => 'Rijndael', | |||
| - 'subcategory' => 'client', | |||
| - 'detail' => '--key-gen', | |||
| - 'function' => \&generic_exec, | |||
| - 'cmdline' => "$fwknopCmd --key-gen", | |||
| - 'positive_output_matches' => [qr/^KEY_BASE64\:?\s\S{10}/, | |||
| - qw/HMAC_KEY_BASE64\:?\s\S{10}/], | |||
| - }, | |||
| - { | |||
| - 'category' => 'Rijndael', | |||
| - 'subcategory' => 'client', | |||
| - 'detail' => "--key-gen $uniq_keys key uniqueness", | |||
| - 'function' => \&key_gen_uniqueness, | |||
| - 'cmdline' => "$fwknopCmd --key-gen", ### no valgrind string (too slow for 100 client exec's) | |||
| - 'disable_valgrind' => $YES, | |||
| - }, | |||
| - { | |||
| - 'category' => 'Rijndael', | |||
| - 'subcategory' => 'client', | |||
| - 'detail' => '--key-gen to file', | |||
| - 'function' => \&generic_exec, | |||
| - 'cmdline' => "$fwknopCmd --key-gen --key-gen-file $key_gen_file", | |||
| - 'positive_output_matches' => [qr/Wrote.*\skeys/], | |||
| - }, | |||
| - | |||
| ### rc file tests | |||
| { | |||
| 'category' => 'Rijndael', | |||
| diff --git a/test/tests/rijndael_hmac.pl b/test/tests/rijndael_hmac.pl | |||
| index fc1a8af..fd80f04 100644 | |||
| --- a/test/tests/rijndael_hmac.pl | |||
| +++ b/test/tests/rijndael_hmac.pl | |||
| @@ -58,6 +58,59 @@ | |||
| 'exec_err' => $YES, | |||
| }, | |||
| + ### --key-gen tests | |||
| + { | |||
| + 'category' => 'Rijndael+HMAC', | |||
| + 'subcategory' => 'client', | |||
| + 'detail' => '--key-gen', | |||
| + 'function' => \&generic_exec, | |||
| + 'cmdline' => "$fwknopCmd --key-gen", | |||
| + 'positive_output_matches' => [qr/^KEY_BASE64\:?\s\S{10}/, | |||
| + qw/HMAC_KEY_BASE64\:?\s\S{10}/], | |||
| + }, | |||
| + { | |||
| + 'category' => 'Rijndael+HMAC', | |||
| + 'subcategory' => 'server', | |||
| + 'detail' => '--key-gen', | |||
| + 'function' => \&generic_exec, | |||
| + 'cmdline' => "$fwknopdCmd --key-gen", | |||
| + 'positive_output_matches' => [qr/^KEY_BASE64\:?\s\S{10}/, | |||
| + qw/HMAC_KEY_BASE64\:?\s\S{10}/], | |||
| + }, | |||
| + { | |||
| + 'category' => 'Rijndael+HMAC', | |||
| + 'subcategory' => 'client', | |||
| + 'detail' => "--key-gen $uniq_keys key uniqueness", | |||
| + 'function' => \&key_gen_uniqueness, | |||
| + 'cmdline' => "$fwknopCmd --key-gen", ### no valgrind string (too slow for 100 exec's) | |||
| + 'disable_valgrind' => $YES, | |||
| + }, | |||
| + { | |||
| + 'category' => 'Rijndael+HMAC', | |||
| + 'subcategory' => 'server', | |||
| + 'detail' => "--key-gen $uniq_keys key uniqueness", | |||
| + 'function' => \&key_gen_uniqueness, | |||
| + 'cmdline' => "$fwknopdCmd --key-gen", ### no valgrind string (too slow for 100 exec's) | |||
| + 'disable_valgrind' => $YES, | |||
| + }, | |||
| + { | |||
| + 'category' => 'Rijndael+HMAC', | |||
| + 'subcategory' => 'client', | |||
| + 'detail' => '--key-gen to file', | |||
| + 'function' => \&generic_exec, | |||
| + 'cmdline' => "$fwknopCmd --key-gen --key-gen-file $key_gen_file", | |||
| + 'positive_output_matches' => [qr/Wrote.*\skeys/], | |||
| + }, | |||
| + { | |||
| + 'category' => 'Rijndael+HMAC', | |||
| + 'subcategory' => 'server', | |||
| + 'detail' => '--key-gen to file', | |||
| + 'function' => \&generic_exec, | |||
| + 'cmdline' => "$fwknopdCmd --key-gen --key-gen-file $key_gen_file", | |||
| + 'positive_output_matches' => [qr/Wrote.*\skeys/], | |||
| + }, | |||
| + | |||
| + ### complete cycle tests | |||
| { | |||
| 'category' => 'Rijndael+HMAC', | |||
| 'subcategory' => 'client+server', | |||