net/fwknop/patches/001-add-keygen.patch

   1 diff --git a/CREDITS b/CREDITS
   2 index de17d9e..38e2108 100644
   3 --- a/CREDITS
   4 +++ b/CREDITS
   5 @@ -1,5 +1,6 @@
   6  Jonathan Bennett
   7      - Contributed OpenWRT support - see the extras/openwrt/ directory.
   8 +    - Suggested the addition of the --key-gen option to fwknopd.
   9
  10  Sebastien Jeanquier
  11      - Assisted with getting fwknop included in BackTrack Linux - the choice
  12 diff --git a/ChangeLog b/ChangeLog
  13 index 21a5093..4daf008 100644
  14 --- a/ChangeLog
  15 +++ b/ChangeLog
  16 @@ -1,3 +1,8 @@
  17 +fwknop-2.6.7 (05//2015):
  18 +    - Added --key-gen to fwknopd. This feature was suggested by Jonathan
  19 +      Bennett, and will help with ease of use efforts. The first platform to
  20 +      take advantage of this will likely be OpenWRT thanks to Jonathan.
  21 +
  22  fwknop-2.6.6 (04/23/2015):
  23      - [server] Add the ability for fwknopd to function as an generic SPA
  24        gateway. This allows scenarios such as the fwknopd system providing DHCP
  25 diff --git a/client/config_init.c b/client/config_init.c
  26 index cdb233d..f0ae135 100644
  27 --- a/client/config_init.c
  28 +++ b/client/config_init.c
  29 @@ -199,7 +199,7 @@ static int critical_var_array[] =
  30  };
  31
  32  /**
  33 - * @brief Generate Rijndael + HMAC keys from /dev/random (base64 encoded) and exit.
  34 + * @brief Generate Rijndael + HMAC keys from /dev/urandom (base64 encoded).
  35   *
  36   * @param options FKO command line option structure
  37   */
  38 diff --git a/client/fwknop_common.h b/client/fwknop_common.h
  39 index aef20c4..c57db02 100644
  40 --- a/client/fwknop_common.h
  41 +++ b/client/fwknop_common.h
  42 @@ -69,8 +69,6 @@
  43  #define MAX_HOSTNAME_LEN            70
  44  #define MAX_URL_HOST_LEN            256
  45  #define MAX_URL_PATH_LEN            1024
  46 -#define MAX_KEY_LEN                 128
  47 -#define MAX_B64_KEY_LEN             180
  48
  49  /* fwknop client configuration parameters and values
  50  */
  51 @@ -156,10 +154,10 @@ typedef struct fko_cli_options
  52      unsigned char   use_gpg;
  53      unsigned char   use_gpg_agent;
  54      unsigned char   gpg_no_signing_pw;
  55 +    unsigned char   key_gen;
  56      int             time_offset_plus;
  57      int             time_offset_minus;
  58      int             fw_timeout;
  59 -    int             key_gen;
  60
  61      char            use_rc_stanza[MAX_LINE_LEN];
  62      unsigned char   got_named_stanza;
  63 diff --git a/common/common.h b/common/common.h
  64 index b63e7c2..c7b2e57 100644
  65 --- a/common/common.h
  66 +++ b/common/common.h
  67 @@ -157,6 +157,9 @@ enum {
  68  #define MAX_GPG_KEY_ID      128
  69  #define MAX_USERNAME_LEN    30
  70
  71 +#define MAX_KEY_LEN                 128
  72 +#define MAX_B64_KEY_LEN             180
  73 +
  74  /* Command line argument / argv handling
  75  */
  76  #define MAX_CMDLINE_ARGS            30                  /*!< should be way more than enough */
  77 diff --git a/doc/fwknop.man.asciidoc b/doc/fwknop.man.asciidoc
  78 index 070ac77..efa99a7 100644
  79 --- a/doc/fwknop.man.asciidoc
  80 +++ b/doc/fwknop.man.asciidoc
  81 @@ -196,6 +196,11 @@ GENERAL OPTIONS
  82      keys are generally more secure than passphrases that are typed in from the
  83      command line.
  84
  85 +*--key-gen-file*='<file>'::
  86 +    Write generated keys to the specified file. Note that the file is
  87 +    overwritten if it already exists. If this option is not given, then
  88 +    *--key-gen* writes the keys to stdout.
  89 +
  90  *--key-len*='<length>'::
  91      Specify the number of bytes for a generated Rijndael key. The maximum size
  92      is currently 128 bytes.
  93 diff --git a/server/cmd_opts.h b/server/cmd_opts.h
  94 index bc1eee1..d7a645c 100644
  95 --- a/server/cmd_opts.h
  96 +++ b/server/cmd_opts.h
  97 @@ -141,6 +141,10 @@ enum {
  98      FW_LIST         = 0x200,
  99      FW_LIST_ALL,
 100      FW_FLUSH,
 101 +    KEY_GEN_FILE,
 102 +    KEY_LEN,
 103 +    HMAC_KEY_LEN,
 104 +    HMAC_DIGEST_TYPE,
 105      AFL_PKT_FILE,
 106      GPG_HOME_DIR,
 107      GPG_EXE_PATH,
 108 @@ -178,7 +182,12 @@ static struct option cmd_opts[] =
 109      {"fault-injection-tag",  1, NULL, FAULT_INJECTION_TAG},
 110      {"help",                 0, NULL, 'h'},
 111      {"interface",            1, NULL, 'i'},
 112 -    {"kill",                 0, NULL, 'K'},
 113 +    {"key-gen",              0, NULL, 'k'},
 114 +    {"key-gen-file",         1, NULL, KEY_GEN_FILE },
 115 +    {"key-len",              1, NULL, KEY_LEN },
 116 +    {"hmac-key-len",         1, NULL, HMAC_KEY_LEN },
 117 +    {"hmac-digest-type",     1, NULL, HMAC_DIGEST_TYPE },
 118 +    {"kill",                 0, NULL, 'K' },
 119      {"fw-flush",             0, NULL, FW_FLUSH },
 120      {"fw-list",              0, NULL, FW_LIST },
 121      {"fw-list-all",          0, NULL, FW_LIST_ALL },
 122 diff --git a/server/config_init.c b/server/config_init.c
 123 index 0ddceee..2f1d293 100644
 124 --- a/server/config_init.c
 125 +++ b/server/config_init.c
 126 @@ -201,6 +201,69 @@ validate_int_var_ranges(fko_srv_options_t *opts)
 127      return;
 128  }
 129
 130 +/**
 131 + * @brief Generate Rijndael + HMAC keys from /dev/urandom (base64 encoded).
 132 + *
 133 + * @param options FKO command line option structure
 134 + */
 135 +static void
 136 +generate_keys(fko_srv_options_t *options)
 137 +{
 138 +    char key_base64[MAX_B64_KEY_LEN+1];
 139 +    char hmac_key_base64[MAX_B64_KEY_LEN+1];
 140 +
 141 +    FILE  *key_gen_file_ptr = NULL;
 142 +    int res;
 143 +
 144 +    /* Set defaults and validate for --key-gen mode
 145 +    */
 146 +    if(options->key_len == 0)
 147 +        options->key_len = FKO_DEFAULT_KEY_LEN;
 148 +
 149 +    if(options->hmac_key_len == 0)
 150 +        options->hmac_key_len = FKO_DEFAULT_HMAC_KEY_LEN;
 151 +
 152 +    if(options->hmac_type == 0)
 153 +        options->hmac_type = FKO_DEFAULT_HMAC_MODE;
 154 +
 155 +    /* Zero out the key buffers */
 156 +    memset(key_base64, 0x00, sizeof(key_base64));
 157 +    memset(hmac_key_base64, 0x00, sizeof(hmac_key_base64));
 158 +
 159 +    /* Generate the key through libfko */
 160 +    res = fko_key_gen(key_base64, options->key_len,
 161 +            hmac_key_base64, options->hmac_key_len,
 162 +            options->hmac_type);
 163 +
 164 +    if(res != FKO_SUCCESS)
 165 +    {
 166 +        log_msg(LOG_ERR, "%s: fko_key_gen: Error %i - %s",
 167 +            MY_NAME, res, fko_errstr(res));
 168 +        clean_exit(options, NO_FW_CLEANUP, EXIT_FAILURE);
 169 +    }
 170 +
 171 +    if(options->key_gen_file[0] != '\0')
 172 +    {
 173 +        if ((key_gen_file_ptr = fopen(options->key_gen_file, "w")) == NULL)
 174 +        {
 175 +            log_msg(LOG_ERR, "Unable to create key gen file: %s: %s",
 176 +                options->key_gen_file, strerror(errno));
 177 +            clean_exit(options, NO_FW_CLEANUP, EXIT_FAILURE);
 178 +        }
 179 +        fprintf(key_gen_file_ptr, "KEY_BASE64: %s\nHMAC_KEY_BASE64: %s\n",
 180 +            key_base64, hmac_key_base64);
 181 +        fclose(key_gen_file_ptr);
 182 +        fprintf(stdout, "[+] Wrote Rijndael and HMAC keys to: %s",
 183 +            options->key_gen_file);
 184 +    }
 185 +    else
 186 +    {
 187 +        fprintf(stdout, "KEY_BASE64: %s\nHMAC_KEY_BASE64: %s\n",
 188 +                key_base64, hmac_key_base64);
 189 +    }
 190 +    clean_exit(options, NO_FW_CLEANUP, EXIT_SUCCESS);
 191 +}
 192 +
 193  /* Parse the config file...
 194  */
 195  static void
 196 @@ -427,7 +490,7 @@ validate_options(fko_srv_options_t *opts)
 197      if(opts->config[CONF_ENABLE_DIGEST_PERSISTENCE] == NULL)
 198          set_config_entry(opts, CONF_ENABLE_DIGEST_PERSISTENCE,
 199              DEF_ENABLE_DIGEST_PERSISTENCE);
 200 -
 201 +
 202      /* Enable destination rule.
 203      */
 204      if(opts->config[CONF_ENABLE_DESTINATION_RULE] == NULL)
 205 @@ -928,8 +991,9 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
 206
 207      /* First, scan the command-line args for -h/--help or an alternate
 208       * configuration file. If we find an alternate config file, use it,
 209 -     * otherwise use the default.  We also grab any override config files
 210 -     * as well.
 211 +     * otherwise use the default. We also grab any override config files
 212 +     * as well. In addition, we handle key generation here since this is
 213 +     * independent of configuration parsing.
 214      */
 215      while ((cmd_arg = getopt_long(argc, argv,
 216              GETOPTS_OPTION_STRING, cmd_opts, &index)) != -1) {
 217 @@ -952,6 +1016,45 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
 218                  if(got_override_config > 0)
 219                      break;
 220
 221 +            case 'k':
 222 +                opts->key_gen = 1;
 223 +                break;
 224 +            case KEY_GEN_FILE:
 225 +                opts->key_gen = 1;
 226 +                strlcpy(opts->key_gen_file, optarg, sizeof(opts->key_gen_file));
 227 +                break;
 228 +            case KEY_LEN:  /* used in --key-gen mode only */
 229 +                opts->key_len = strtol_wrapper(optarg, 1,
 230 +                        MAX_KEY_LEN, NO_EXIT_UPON_ERR, &is_err);
 231 +                if(is_err != FKO_SUCCESS)
 232 +                {
 233 +                    log_msg(LOG_ERR,
 234 +                            "Invalid key length '%s', must be in [%d-%d]",
 235 +                            optarg, 1, MAX_KEY_LEN);
 236 +                    clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
 237 +                }
 238 +                break;
 239 +            case HMAC_DIGEST_TYPE:  /* used in --key-gen mode only */
 240 +                if((opts->hmac_type = hmac_digest_strtoint(optarg)) < 0)
 241 +                {
 242 +                    log_msg(LOG_ERR,
 243 +                        "* Invalid hmac digest type: %s, use {md5,sha1,sha256,sha384,sha512}",
 244 +                        optarg);
 245 +                    clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
 246 +                }
 247 +                break;
 248 +            case HMAC_KEY_LEN:  /* used in --key-gen mode only */
 249 +                opts->hmac_key_len = strtol_wrapper(optarg, 1,
 250 +                        MAX_KEY_LEN, NO_EXIT_UPON_ERR, &is_err);
 251 +                if(is_err != FKO_SUCCESS)
 252 +                {
 253 +                    log_msg(LOG_ERR,
 254 +                            "Invalid hmac key length '%s', must be in [%d-%d]",
 255 +                            optarg, 1, MAX_KEY_LEN);
 256 +                    clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
 257 +                }
 258 +                break;
 259 +
 260              /* Look for override configuration file arg.
 261              */
 262              case 'O':
 263 @@ -965,6 +1068,9 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
 264          }
 265      }
 266
 267 +    if(opts->key_gen)
 268 +        generate_keys(opts);
 269 +
 270      /* If no alternate configuration file was specified, we use the
 271       * default.
 272      */
 273 diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h
 274 index ecf2a81..8c33eaa 100644
 275 --- a/server/fwknopd_common.h
 276 +++ b/server/fwknopd_common.h
 277 @@ -585,10 +585,14 @@ typedef struct fko_srv_options
 278      unsigned char   fw_list;            /* List current firewall rules */
 279      unsigned char   fw_list_all;        /* List all current firewall rules */
 280      unsigned char   fw_flush;           /* Flush current firewall rules */
 281 +    unsigned char   key_gen;            /* Generate keys and exit */
 282 +    unsigned char   exit_after_parse_config; /* Parse config and exit */
 283 +
 284 +    /* Operational flags
 285 +    */
 286      unsigned char   test;               /* Test mode flag */
 287      unsigned char   afl_fuzzing;        /* SPA pkts from stdin for AFL fuzzing */
 288      unsigned char   verbose;            /* Verbose mode flag */
 289 -    unsigned char   exit_after_parse_config; /* Parse config and exit */
 290      unsigned char   enable_udp_server;  /* Enable UDP server mode */
 291
 292      unsigned char   firewd_disable_check_support; /* Don't use firewall-cmd ... -C */
 293 @@ -605,6 +609,13 @@ typedef struct fko_srv_options
 294      int             tcp_server_pid;
 295      int             lock_fd;
 296
 297 +    /* Values used in --key-gen mode only
 298 +    */
 299 +    char key_gen_file[MAX_PATH_LEN];
 300 +    int  key_len;
 301 +    int  hmac_key_len;
 302 +    int  hmac_type;
 303 +
 304  #if USE_FILE_CACHE
 305      struct digest_cache_list *digest_cache;   /* In-memory digest cache list */
 306  #endif
 307 diff --git a/test/tests/basic_operations.pl b/test/tests/basic_operations.pl
 308 index f4dde2e..76a509d 100644
 309 --- a/test/tests/basic_operations.pl
 310 +++ b/test/tests/basic_operations.pl
 311 @@ -390,6 +390,14 @@
 312          'exec_err' => $YES,
 313          'cmdline'  => "$default_client_args --key-gen -K " . 'A'x1030
 314      },
 315 +    {
 316 +        'category' => 'basic operations',
 317 +        'subcategory' => 'server',
 318 +        'detail'   => '--key-gen file path (-K) too long',
 319 +        'function' => \&generic_exec,
 320 +        'exec_err' => $YES,
 321 +        'cmdline'  => "$fwknopdCmd --key-gen --key-gen-file " . 'A'x1030
 322 +    },
 323
 324      {
 325          'category' => 'basic operations',
 326 diff --git a/test/tests/rijndael.pl b/test/tests/rijndael.pl
 327 index 26aab6a..34af65e 100644
 328 --- a/test/tests/rijndael.pl
 329 +++ b/test/tests/rijndael.pl
 330 @@ -421,33 +421,6 @@
 331          'key_file' => $cf{'rc_named_key'},
 332      },
 333
 334 -    ### --key-gen tests
 335 -    {
 336 -        'category' => 'Rijndael',
 337 -        'subcategory' => 'client',
 338 -        'detail'   => '--key-gen',
 339 -        'function' => \&generic_exec,
 340 -        'cmdline'  => "$fwknopCmd --key-gen",
 341 -        'positive_output_matches' => [qr/^KEY_BASE64\:?\s\S{10}/,
 342 -            qw/HMAC_KEY_BASE64\:?\s\S{10}/],
 343 -    },
 344 -    {
 345 -        'category' => 'Rijndael',
 346 -        'subcategory' => 'client',
 347 -        'detail'   => "--key-gen $uniq_keys key uniqueness",
 348 -        'function' => \&key_gen_uniqueness,
 349 -        'cmdline'  => "$fwknopCmd --key-gen",   ### no valgrind string (too slow for 100 client exec's)
 350 -        'disable_valgrind' => $YES,
 351 -    },
 352 -    {
 353 -        'category' => 'Rijndael',
 354 -        'subcategory' => 'client',
 355 -        'detail'   => '--key-gen to file',
 356 -        'function' => \&generic_exec,
 357 -        'cmdline'  => "$fwknopCmd --key-gen --key-gen-file $key_gen_file",
 358 -        'positive_output_matches' => [qr/Wrote.*\skeys/],
 359 -    },
 360 -
 361      ### rc file tests
 362      {
 363          'category' => 'Rijndael',
 364 diff --git a/test/tests/rijndael_hmac.pl b/test/tests/rijndael_hmac.pl
 365 index fc1a8af..fd80f04 100644
 366 --- a/test/tests/rijndael_hmac.pl
 367 +++ b/test/tests/rijndael_hmac.pl
 368 @@ -58,6 +58,59 @@
 369          'exec_err' => $YES,
 370      },
 371
 372 +    ### --key-gen tests
 373 +    {
 374 +        'category' => 'Rijndael+HMAC',
 375 +        'subcategory' => 'client',
 376 +        'detail'   => '--key-gen',
 377 +        'function' => \&generic_exec,
 378 +        'cmdline'  => "$fwknopCmd --key-gen",
 379 +        'positive_output_matches' => [qr/^KEY_BASE64\:?\s\S{10}/,
 380 +            qw/HMAC_KEY_BASE64\:?\s\S{10}/],
 381 +    },
 382 +    {
 383 +        'category' => 'Rijndael+HMAC',
 384 +        'subcategory' => 'server',
 385 +        'detail'   => '--key-gen',
 386 +        'function' => \&generic_exec,
 387 +        'cmdline'  => "$fwknopdCmd --key-gen",
 388 +        'positive_output_matches' => [qr/^KEY_BASE64\:?\s\S{10}/,
 389 +            qw/HMAC_KEY_BASE64\:?\s\S{10}/],
 390 +    },
 391 +    {
 392 +        'category' => 'Rijndael+HMAC',
 393 +        'subcategory' => 'client',
 394 +        'detail'   => "--key-gen $uniq_keys key uniqueness",
 395 +        'function' => \&key_gen_uniqueness,
 396 +        'cmdline'  => "$fwknopCmd --key-gen",   ### no valgrind string (too slow for 100 exec's)
 397 +        'disable_valgrind' => $YES,
 398 +    },
 399 +    {
 400 +        'category' => 'Rijndael+HMAC',
 401 +        'subcategory' => 'server',
 402 +        'detail'   => "--key-gen $uniq_keys key uniqueness",
 403 +        'function' => \&key_gen_uniqueness,
 404 +        'cmdline'  => "$fwknopdCmd --key-gen",   ### no valgrind string (too slow for 100 exec's)
 405 +        'disable_valgrind' => $YES,
 406 +    },
 407 +    {
 408 +        'category' => 'Rijndael+HMAC',
 409 +        'subcategory' => 'client',
 410 +        'detail'   => '--key-gen to file',
 411 +        'function' => \&generic_exec,
 412 +        'cmdline'  => "$fwknopCmd --key-gen --key-gen-file $key_gen_file",
 413 +        'positive_output_matches' => [qr/Wrote.*\skeys/],
 414 +    },
 415 +    {
 416 +        'category' => 'Rijndael+HMAC',
 417 +        'subcategory' => 'server',
 418 +        'detail'   => '--key-gen to file',
 419 +        'function' => \&generic_exec,
 420 +        'cmdline'  => "$fwknopdCmd --key-gen --key-gen-file $key_gen_file",
 421 +        'positive_output_matches' => [qr/Wrote.*\skeys/],
 422 +    },
 423 +
 424 +    ### complete cycle tests
 425      {
 426          'category' => 'Rijndael+HMAC',
 427          'subcategory' => 'client+server',