merged replay prefix and IP resolve tests

diff --cc lib/fko.h
index 56b4c3a,3acf267..49c4225
--- 1/lib/fko.h
--- 2/lib/fko.h
+++ b/lib/fko.h
@@@ -192,16 -161,15 +192,24 @@@ typedef enum 
  #define FKO_DEFAULT_MSG_TYPE    FKO_ACCESS_MSG
  #define FKO_DEFAULT_DIGEST      FKO_DIGEST_SHA256
  #define FKO_DEFAULT_ENCRYPTION  FKO_ENCRYPTION_RIJNDAEL
 +#define FKO_DEFAULT_ENC_MODE    MODE_CBC
 +
 +/* Define the consistent prefixes or salt on some encryption schemes.
 +*/
 +#define B64_RIJNDAEL_SALT "U2FsdGVkX1"
 +#define B64_RIJNDAEL_SALT_STR_LEN 10
 +
 +#define B64_GPG_PREFIX "hQ"
 +#define B64_GPG_PREFIX_STR_LEN 2
  
+ /* Define the consistent prefixes or salt on some encryption schemes.
+ */
+ #define B64_RIJNDAEL_SALT "U2FsdGVkX1"
+ #define B64_RIJNDAEL_SALT_STR_LEN 10
+ 
+ #define B64_GPG_PREFIX "hQ"
+ #define B64_GPG_PREFIX_STR_LEN 2
+ 
  /* The context holds the global state and config options, as
   * well as some intermediate results during processing. This
   * is an opaque pointer.

diff --cc server/incoming_spa.c
Simple merge

diff --cc test/conf/hmac_access.conf
index 0000000,0000000..68c148a
new file mode 100644 (file)
--- /dev/null
--- /dev/null
+++ b/test/conf/hmac_access.conf
@@@ -1,0 -1,0 +1,4 @@@
++SOURCE: ANY;
++KEY_BASE64:          wzNP62oPPgEc+kXDPQLHPOayQBuNbYUTPP+QrErNDmg=
++HMAC_KEY_BASE64:     Yh+xizBnl6FotC5ec7FanVGClRMlsOAPh2u6eovnerfBVKwaVKzjGoblFMHMc593TNyi0dWn4opLoTIV9q/ttg==
++FW_ACCESS_TIMEOUT:  3;

diff --cc test/test-fwknop.pl
index 7939f0d,e2e580b..4ecfb67
--- 1/test/test-fwknop.pl
--- 2/test/test-fwknop.pl
+++ b/test/test-fwknop.pl
@@@ -144,9 -123,8 +145,10 @@@ exit 1 unless GetOptions
      'test-exclude=s'    => \$test_exclude,
      'exclude=s'         => \$test_exclude,  ### synonym
      'enable-recompile-check' => \$enable_recompilation_warnings_check,
 +    'enable-profile-coverage-check' => \$enable_profile_coverage_check,
+     'enable-ip-resolve' => \$enable_client_ip_resolve_test,
      'List-mode'         => \$list_mode,
 +    'test-limit=i'      => \$test_limit,
      'enable-valgrind'   => \$use_valgrind,
      'valgrind-path=s'   => \$valgrindCmd,
      'output-dir=s'      => \$output_dir,
@@@ -171,12 -149,12 +173,16 @@@ my $intf_str = "-i $loopback_intf --for
  
  my $default_client_args = "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
      "$fwknopCmd -A tcp/22 -a $fake_ip -D $loopback_ip --get-key " .
 -    "$local_key_file --verbose --verbose";
 +    "$local_key_file --no-save-args --verbose --verbose";
 +
 +my $default_client_args_no_get_key = "LD_LIBRARY_PATH=$lib_dir " .
 +    "$valgrind_str $fwknopCmd -A tcp/22 -a $fake_ip -D $loopback_ip " .
 +    "--no-save-args --verbose --verbose";
  
+ my $client_ip_resolve_args = "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
+     "$fwknopCmd -A tcp/22 -R -D $loopback_ip --get-key " .
+     "$local_key_file --verbose --verbose";
+ 
  my $default_client_gpg_args = "$default_client_args " .
      "--gpg-recipient-key $gpg_server_key " .
      "--gpg-signer-key $gpg_client_key " .
@@@ -652,82 -613,21 +658,99 @@@ my @tests = 
      {
          'category' => 'Rijndael SPA',
          'subcategory' => 'client+server',
+         'detail'   => 'client IP resolve (tcp/22 ssh)',
+         'err_msg'  => 'could not complete SPA cycle',
+         'function' => \&spa_cycle,
+         'cmdline'  => $client_ip_resolve_args,
+         'no_ip_check' => 1,
+         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
+             "$fwknopdCmd $default_server_conf_args $intf_str",
+         'fw_rule_created' => $NEW_RULE_REQUIRED,
+         'fw_rule_removed' => $NEW_RULE_REMOVED,
+         'fatal'    => $NO
+     },
+ 
+     {
+         'category' => 'Rijndael SPA',
+         'subcategory' => 'client+server',
 +        'detail'   => 'complete cycle MD5 (tcp/22 ssh)',
 +        'err_msg'  => 'could not complete SPA cycle',
 +        'function' => \&spa_cycle,
 +        'cmdline'  => "$default_client_args -m md5",
 +        'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
 +            "$fwknopdCmd $default_server_conf_args $intf_str",
 +        'fw_rule_created' => $NEW_RULE_REQUIRED,
 +        'fw_rule_removed' => $NEW_RULE_REMOVED,
 +        'fatal'    => $NO
 +    },
++
 +    {
 +        'category' => 'Rijndael SPA',
 +        'subcategory' => 'client+server',
 +        'detail'   => 'complete cycle SHA1 (tcp/22 ssh)',
 +        'err_msg'  => 'could not complete SPA cycle',
 +        'function' => \&spa_cycle,
 +        'cmdline'  => "$default_client_args -m sha1",
 +        'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
 +            "$fwknopdCmd $default_server_conf_args $intf_str",
 +        'fw_rule_created' => $NEW_RULE_REQUIRED,
 +        'fw_rule_removed' => $NEW_RULE_REMOVED,
 +        'fatal'    => $NO
 +    },
 +    {
 +        'category' => 'Rijndael SPA',
 +        'subcategory' => 'client+server',
 +        'detail'   => 'complete cycle SHA256 (tcp/22 ssh)',
 +        'err_msg'  => 'could not complete SPA cycle',
 +        'function' => \&spa_cycle,
 +        'cmdline'  => "$default_client_args -m sha256",
 +        'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
 +            "$fwknopdCmd $default_server_conf_args $intf_str",
 +        'fw_rule_created' => $NEW_RULE_REQUIRED,
 +        'fw_rule_removed' => $NEW_RULE_REMOVED,
 +        'fatal'    => $NO
 +    },
 +    {
 +        'category' => 'Rijndael SPA',
 +        'subcategory' => 'client+server',
 +        'detail'   => 'complete cycle SHA384 (tcp/22 ssh)',
 +        'err_msg'  => 'could not complete SPA cycle',
 +        'function' => \&spa_cycle,
 +        'cmdline'  => "$default_client_args -m sha384",
 +        'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
 +            "$fwknopdCmd $default_server_conf_args $intf_str",
 +        'fw_rule_created' => $NEW_RULE_REQUIRED,
 +        'fw_rule_removed' => $NEW_RULE_REMOVED,
 +        'fatal'    => $NO
 +    },
 +    {
 +        'category' => 'Rijndael SPA',
 +        'subcategory' => 'client+server',
 +        'detail'   => 'complete cycle SHA512 (tcp/22 ssh)',
 +        'err_msg'  => 'could not complete SPA cycle',
 +        'function' => \&spa_cycle,
 +        'cmdline'  => "$default_client_args -m sha512",
 +        'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
 +            "$fwknopdCmd $default_server_conf_args $intf_str",
 +        'fw_rule_created' => $NEW_RULE_REQUIRED,
 +        'fw_rule_removed' => $NEW_RULE_REMOVED,
 +        'fatal'    => $NO
 +    },
 +    {
 +        'category' => 'Rijndael SPA',
 +        'subcategory' => 'client',
 +        'detail'   => 'validate digest type arg',
 +        'err_msg'  => 'could not complete SPA cycle',
 +        'function' => \&generic_exec,
 +        'cmdline'  => "$default_client_args -m invaliddigest",
 +        'positive_output_matches' => [qr/Invalid\sdigest\stype/i],
 +        'fw_rule_created' => $REQUIRE_NO_NEW_RULE,
 +        'fatal'    => $NO
 +    },
++
 +    {
 +        'category' => 'Rijndael SPA',
 +        'subcategory' => 'client+server',
          'detail'   => 'dual usage access key (tcp/80 http)',
          'err_msg'  => 'could not complete SPA cycle',
          'function' => \&spa_cycle,
@@@ -1632,21 -1271,22 +1669,35 @@@
          'function' => \&replay_detection,
          'cmdline'  => $default_client_gpg_args,
          'fwknopd_cmdline'  => $default_server_gpg_args,
+         'replay_positive_output_matches' => [qr/Replay\sdetected\sfrom\ssource\sIP/],
+         'fatal'    => $NO
+     },
+     {
+         'category' => 'GnuPG (GPG) SPA',
+         'subcategory' => 'client+server',
+         'detail'   => 'replay detection (GnuPG prefix)',
+         'err_msg'  => 'could not detect replay attack',
+         'function' => \&replay_detection,
+         'pkt_prefix' => 'hQ',
+         'cmdline'  => $default_client_gpg_args,
+         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
+             "$fwknopdCmd $default_server_conf_args $intf_str",
+         'replay_positive_output_matches' => [qr/Data\sis\snot\sa\svalid\sSPA\smessage\sformat/],
          'fatal'    => $NO
      },
 +    {
 +        'category' => 'GnuPG (GPG) SPA',
 +        'subcategory' => 'client+server',
 +        'detail'   => 'replay detection (GnuPG prefix)',
 +        'err_msg'  => 'could not detect replay attack',
 +        'function' => \&replay_detection,
 +        'pkt_prefix' => 'hQ',
 +        'cmdline'  => $default_client_args,
 +        'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $valgrind_str " .
 +            "$fwknopdCmd $default_server_conf_args $intf_str",
 +        'fatal'    => $NO
 +    },
 +
  
      {
          'category' => 'GnuPG (GPG) SPA',
@@@ -3095,10 -2634,10 +3156,14 @@@ sub init() 
          push @tests_to_exclude, 'recompilation';
      }
  
 +    unless ($enable_profile_coverage_check) {
 +        push @tests_to_exclude, 'profile coverage';
 +    }
 +
+     unless ($enable_client_ip_resolve_test) {
+         push @tests_to_exclude, 'IP resolve';
+     }
+ 
      $sudo_path = &find_command('sudo');
  
      unless ((&find_command('cc') or &find_command('gcc')) and &find_command('make')) {
@@@ -3275,9 -2763,16 +3340,16 @@@ sub is_fw_rule_active() 
              "-d $default_digest_file -p $default_pid_file";
      }
  
-     return 1 if &run_cmd("LD_LIBRARY_PATH=$lib_dir $fwknopdCmd " .
-             qq{$conf_args --fw-list | grep -v "# DISABLED" |grep $fake_ip |grep _exp_},
-             $cmd_out_tmp, $curr_test_file);
+     if ($test_hr->{'no_ip_check'}) {
+         return 1 if &run_cmd("LD_LIBRARY_PATH=$lib_dir $fwknopdCmd " .
+                 qq{$conf_args --fw-list | grep -v "# DISABLED" |grep _exp_},
 -                $cmd_out_tmp, $current_test_file);
++                $cmd_out_tmp, $curr_test_file);
+     } else {
+         return 1 if &run_cmd("LD_LIBRARY_PATH=$lib_dir $fwknopdCmd " .
+                 qq{$conf_args --fw-list | grep -v "# DISABLED" |grep $fake_ip |grep _exp_},
 -                $cmd_out_tmp, $current_test_file);
++                $cmd_out_tmp, $curr_test_file);
+     }
+ 
      return 0;
  }