Update to print all firewall commands in --verbose mode

This commit makes it easier to determine exactly which commands fwknopd
runs in --verbose mode when interacting with the underlying firewall.
This commit also adds --verbose --verbose mode to the test suite.

diff --git a/server/access.c b/server/access.c
index f9be30c..7b5204f 100644 (file)
--- a/server/access.c
+++ b/server/access.c
@@ -1074,6 +1074,7 @@ dump_access_list(const fko_srv_options_t *opts)
     }
 
     fprintf(stdout, "\n");
+    fflush(stdout);
 }
 
 /***EOF***/

diff --git a/server/config_init.c b/server/config_init.c
index 5e38282..75c49de 100644 (file)
--- a/server/config_init.c
+++ b/server/config_init.c
@@ -745,6 +745,7 @@ dump_config(const fko_srv_options_t *opts)
         );
 
     fprintf(stdout, "\n");
+    fflush(stdout);
 }
 
 /* Print usage message...
@@ -785,7 +786,8 @@ usage(void)
       "     --fw-list           - List all firewall rules that fwknop has created\n"
       "                           and then exit.\n"
       "     --fw-list-all       - List all firewall rules in the complete policy,\n"
-      "                           including those that have nothing to with fwknop.\n"
+      "                           including those that have nothing to do with\n"
+      "                           fwknop.\n"
       "     --fw-flush          - Flush all firewall rules created by fwknop.\n"
       "\n"
     );

diff --git a/server/fw_util.h b/server/fw_util.h
index 7045719..b5afc1b 100644 (file)
--- a/server/fw_util.h
+++ b/server/fw_util.h
@@ -60,7 +60,7 @@
 */
 void fw_config_init(fko_srv_options_t *opts);
 void fw_initialize(const fko_srv_options_t *opts);
-int fw_cleanup(void);
+int fw_cleanup(const fko_srv_options_t *opts);
 void check_firewall_rules(const fko_srv_options_t *opts);
 int fw_dump_rules(const fko_srv_options_t *opts);
 int process_spa_request(const fko_srv_options_t *opts, spa_data_t *spdat);

diff --git a/server/fw_util_ipfw.c b/server/fw_util_ipfw.c
index 2811e32..30522a8 100644 (file)
--- a/server/fw_util_ipfw.c
+++ b/server/fw_util_ipfw.c
@@ -66,7 +66,8 @@ zero_cmd_buffers(void)
 }
 
 static int
-ipfw_set_exists(const char *fw_command, const unsigned short set_num)
+ipfw_set_exists(const fko_srv_options_t *opts,
+    const char *fw_command, const unsigned short set_num)
 {
     int res = 0;
 
@@ -79,6 +80,10 @@ ipfw_set_exists(const char *fw_command, const unsigned short set_num)
 
     res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
 
+    if (opts->verbose)
+        log_msg(LOG_INFO, "ipfw_set_exists() CMD: '%s' (res: %d)",
+            cmd_buf, res);
+
     if(!EXTCMD_IS_SUCCESS(res))
         return(0);
 
@@ -111,6 +116,10 @@ fw_dump_rules(const fko_srv_options_t *opts)
 
         res = system(cmd_buf);
 
+        if (opts->verbose)
+            log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
+                cmd_buf, res);
+
         /* Expect full success on this */
         if(! EXTCMD_IS_SUCCESS(res))
         {
@@ -132,10 +141,13 @@ fw_dump_rules(const fko_srv_options_t *opts)
             opts->fw_config->active_set_num
         );
 
-        //printf("(%i) CMD: '%s'\n", i, cmd_buf);
         printf("\nActive Rules:\n");
         res = system(cmd_buf);
 
+        if (opts->verbose)
+            log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
+                cmd_buf, res);
+
         /* Expect full success on this */
         if(! EXTCMD_IS_SUCCESS(res))
         {
@@ -150,10 +162,13 @@ fw_dump_rules(const fko_srv_options_t *opts)
             opts->fw_config->expire_set_num
         );
 
-        //printf("(%i) CMD: '%s'\n", i, cmd_buf);
         printf("\nExpired Rules:\n");
         res = system(cmd_buf);
 
+        if (opts->verbose)
+            log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
+                cmd_buf, res);
+
         /* Expect full success on this */
         if(! EXTCMD_IS_SUCCESS(res))
         {
@@ -197,7 +212,7 @@ fw_initialize(const fko_srv_options_t *opts)
 
     /* For now, we just call fw_cleanup to start with clean slate.
     */
-    res = fw_cleanup();
+    res = fw_cleanup(opts);
 
     if(res != 0)
     {
@@ -229,6 +244,10 @@ fw_initialize(const fko_srv_options_t *opts)
 
         res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
 
+        if (opts->verbose)
+            log_msg(LOG_INFO, "fw_initialize() CMD: '%s' (res: %d, err: %s)",
+                cmd_buf, res, err_buf);
+
         if(EXTCMD_IS_SUCCESS(res))
         {
             log_msg(LOG_INFO, "Added check-state rule %u to set %u",
@@ -253,11 +272,15 @@ fw_initialize(const fko_srv_options_t *opts)
 
     res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
 
+    if (opts->verbose)
+        log_msg(LOG_INFO, "fw_initialize() CMD: '%s' (res: %d, err: %s)",
+            cmd_buf, res, err_buf);
+
     if(EXTCMD_IS_SUCCESS(res))
         log_msg(LOG_INFO, "Set ipfw set %u to disabled.",
             fwc.expire_set_num);
     else
-        log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); 
+        log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
 
     /* Now read the expire set in case there are existing
      * rules to track.
@@ -271,14 +294,18 @@ fw_initialize(const fko_srv_options_t *opts)
 
     res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
 
+    if (opts->verbose)
+        log_msg(LOG_INFO, "fw_initialize() CMD: '%s' (res: %d)",
+            cmd_buf, res);
+
     if(!EXTCMD_IS_SUCCESS(res))
     {
-        log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); 
+        log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
         return;
     }
 
-    if(opts->verbose > 2)
-        log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nRULES LIST: %s", res, cmd_buf, cmd_out);
+    if(opts->verbose > 1)
+        log_msg(LOG_INFO, "RULES LIST: %s", cmd_out);
 
     /* Find the first "# DISABLED" string (if any).
     */
@@ -320,14 +347,14 @@ fw_initialize(const fko_srv_options_t *opts)
 
 
 int
-fw_cleanup(void)
+fw_cleanup(const fko_srv_options_t *opts)
 {
     int     res, got_err = 0;
 
     zero_cmd_buffers();
 
     if(fwc.active_set_num > 0
-        && ipfw_set_exists(fwc.fw_command, fwc.active_set_num))
+        && ipfw_set_exists(opts, fwc.fw_command, fwc.active_set_num))
     {
         /* Create the set delete command for active rules
         */
@@ -336,9 +363,12 @@ fw_cleanup(void)
             fwc.active_set_num
         );
 
-        //printf("CMD: '%s'\n", cmd_buf);
         res = system(cmd_buf);
 
+        if (opts->verbose)
+            log_msg(LOG_INFO, "fw_cleanup() CMD: '%s' (res: %d)",
+                cmd_buf, res);
+
         /* Expect full success on this */
         if(! EXTCMD_IS_SUCCESS(res))
         {
@@ -453,9 +483,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
                 exp_ts
             );
 
-//--DSS tmp
-//fprintf(stderr, "ADD CMD: %s\n", cmd_buf);
             res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+            if (opts->verbose)
+                log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
+                    cmd_buf, res, err_buf);
+
             if(EXTCMD_IS_SUCCESS(res))
             {
                 log_msg(LOG_INFO, "Added Rule %u for %s, %s expires at %u",
@@ -545,14 +578,18 @@ check_firewall_rules(const fko_srv_options_t *opts)
 
     res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
 
+    if (opts->verbose)
+        log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d)",
+            cmd_buf, res);
+
     if(!EXTCMD_IS_SUCCESS(res))
     {
-        log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); 
+        log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
         return;
     }
 
-    if(opts->verbose > 2)
-        log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nRULES LIST: %s", res, cmd_buf, cmd_out);
+    if(opts->verbose > 1)
+        log_msg(LOG_INFO, "RULES LIST: %s", cmd_out);
 
     /* Find the first _exp_ string (if any).
     */
@@ -586,7 +623,6 @@ check_firewall_rules(const fko_srv_options_t *opts)
         strlcpy(exp_str, ndx, 11);
         rule_exp = (time_t)atoll(exp_str);
 
-//fprintf(stderr, "RULE_EXP=%u, NOW=%u\n", rule_exp, now);
         if(rule_exp <= now)
         {
             /* Backtrack and get the rule number and delete it.
@@ -646,8 +682,12 @@ check_firewall_rules(const fko_srv_options_t *opts)
                 fwc.expire_set_num
             );
 
-//fprintf(stderr, "MOVE RULE CMD: %s\n", cmd_buf);
             res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+            if (opts->verbose)
+                log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d, err: %s)",
+                    cmd_buf, res, err_buf);
+
             if(EXTCMD_IS_SUCCESS(res))
             {
                 log_msg(LOG_INFO, "Moved rule %s with expire time of %u to set %u.",
@@ -660,7 +700,7 @@ check_firewall_rules(const fko_srv_options_t *opts)
                 fwc.rule_map[curr_rule - fwc.start_rule_num] = RULE_EXPIRED;
             }
             else
-                log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); 
+                log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
         }
         else
         {
@@ -710,9 +750,13 @@ ipfw_purge_expired_rules(const fko_srv_options_t *opts)
 
     res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
 
+    if (opts->verbose)
+        log_msg(LOG_INFO, "ipfw_purge_expired_rules() CMD: '%s' (res: %d)",
+            cmd_buf, res);
+
     if(!EXTCMD_IS_SUCCESS(res))
     {
-        log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); 
+        log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
         return;
     }
 
@@ -723,8 +767,8 @@ ipfw_purge_expired_rules(const fko_srv_options_t *opts)
     {
         co_end = cmd_out + strlen(cmd_out);
 
-        if(opts->verbose > 2)
-            log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nEXP RULES LIST: %s", res, cmd_buf, cmd_out);
+        if(opts->verbose > 1)
+            log_msg(LOG_INFO, "EXP RULES LIST: %s", cmd_out);
 
         /* Find the "## Dynamic rules" string.
         */
@@ -810,13 +854,17 @@ ipfw_purge_expired_rules(const fko_srv_options_t *opts)
 
         res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
 
+        if (opts->verbose)
+            log_msg(LOG_INFO, "ipfw_purge_expired_rules() CMD: '%s' (res: %d)",
+                cmd_buf, res);
+
         if(!EXTCMD_IS_SUCCESS(res))
         {
-            log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out); 
+            log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
             continue;
         }
 
-        log_msg(LOG_INFO, "Purged rule %u from set %u", curr_rule, fwc.expire_set_num); 
+        log_msg(LOG_INFO, "Purged rule %u from set %u", curr_rule, fwc.expire_set_num);
 
         fwc.rule_map[curr_rule - fwc.start_rule_num] = RULE_FREE;
 

diff --git a/server/fw_util_iptables.c b/server/fw_util_iptables.c
index d4e0799..bf38b4f 100644 (file)
--- a/server/fw_util_iptables.c
+++ b/server/fw_util_iptables.c
@@ -53,7 +53,7 @@ zero_cmd_buffers(void)
 }
 
 static int
-add_jump_rule(const int chain_num)
+add_jump_rule(const fko_srv_options_t *opts, const int chain_num)
 {
     int res = 0;
 
@@ -67,9 +67,12 @@ add_jump_rule(const int chain_num)
         fwc.chain[chain_num].to_chain
     );
 
-    //printf("(%i) CMD: '%s'\n", i, cmd_buf);
     res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
 
+    if (opts->verbose)
+        log_msg(LOG_INFO, "add_jump_rule() CMD: '%s' (res: %d, err: %s)",
+            cmd_buf, res, err_buf);
+
     if(EXTCMD_IS_SUCCESS(res))
         log_msg(LOG_INFO, "Added jump rule from chain: %s to chain: %s",
             fwc.chain[chain_num].from_chain,
@@ -158,9 +161,12 @@ fw_dump_rules(const fko_srv_options_t *opts)
                 ch[i].table
             );
 
-            //printf("(%i) CMD: '%s'\n", i, cmd_buf);
             res = system(cmd_buf);
 
+            if (opts->verbose)
+                log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
+                    cmd_buf, res);
+
             /* Expect full success on this */
             if(! EXTCMD_IS_SUCCESS(res))
             {
@@ -190,9 +196,12 @@ fw_dump_rules(const fko_srv_options_t *opts)
                 ch[i].to_chain
             );
 
-            //printf("(%i) CMD: '%s'\n", i, cmd_buf);
             res = system(cmd_buf);
 
+            if (opts->verbose)
+                log_msg(LOG_INFO, "fw_dump_rules() CMD: '%s' (res: %d)",
+                    cmd_buf, res);
+
             /* Expect full success on this */
             if(! EXTCMD_IS_SUCCESS(res))
             {
@@ -208,7 +217,7 @@ fw_dump_rules(const fko_srv_options_t *opts)
 /* Quietly flush and delete all fwknop custom chains.
 */
 static void
-delete_all_chains(void)
+delete_all_chains(const fko_srv_options_t *opts)
 {
     int     i, res;
     int     jump_rule_num;
@@ -232,11 +241,15 @@ delete_all_chains(void)
                 jump_rule_num
             );
 
-            //printf("CMD: '%s'\n", cmd_buf);
             res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+            if (opts->verbose)
+                log_msg(LOG_INFO, "delete_all_chains() CMD: '%s' (res: %d, err: %s)",
+                    cmd_buf, res, err_buf);
+
             /* Expect full success on this */
             if(! EXTCMD_IS_SUCCESS(res))
-                log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); 
+                log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
         }
 
         zero_cmd_buffers();
@@ -253,18 +266,22 @@ delete_all_chains(void)
             fwc.chain[i].to_chain
         );
 
-        //printf("CMD: '%s'\n", cmd_buf);
         res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+        if (opts->verbose)
+            log_msg(LOG_INFO, "delete_all_chains() CMD: '%s' (res: %d, err: %s)",
+                cmd_buf, res, err_buf);
+
         /* Expect full success on this */
         if(! EXTCMD_IS_SUCCESS(res))
-            log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); 
+            log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
     }
 }
 
 /* Create the fwknop custom chains (at least those that are configured).
 */
 static int
-create_fw_chains(void)
+create_fw_chains(const fko_srv_options_t *opts)
 {
     int     i;
     int     res, got_err = 0;
@@ -284,19 +301,22 @@ create_fw_chains(void)
             fwc.chain[i].to_chain
         );
 
-        //printf("(%i) CMD: '%s'\n", i, cmd_buf);
         res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
 
+        if (opts->verbose)
+            log_msg(LOG_INFO, "create_fw_chains() CMD: '%s' (res: %d, err: %s)",
+                cmd_buf, res, err_buf);
+
         /* Expect full success on this */
         if(! EXTCMD_IS_SUCCESS(res))
         {
-            log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf); 
+            log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, err_buf);
             got_err++;
         }
 
         /* Then create the jump rule to that chain.
         */
-        res = add_jump_rule(i);
+        res = add_jump_rule(opts, i);
 
         /* Expect full success on this */
         if(! EXTCMD_IS_SUCCESS(res))
@@ -434,11 +454,11 @@ fw_initialize(const fko_srv_options_t *opts)
 
     /* Flush the chains (just in case) so we can start fresh.
     */
-    delete_all_chains();
+    delete_all_chains(opts);
 
     /* Now create any configured chains.
     */
-    res = create_fw_chains();
+    res = create_fw_chains(opts);
 
     if(res != 0)
     {
@@ -448,9 +468,9 @@ fw_initialize(const fko_srv_options_t *opts)
 }
 
 int
-fw_cleanup(void)
+fw_cleanup(const fko_srv_options_t *opts)
 {
-    delete_all_chains();
+    delete_all_chains(opts);
     return(0);
 }
 
@@ -513,11 +533,11 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
          * required chain
         */
         if(jump_rule_exists(IPT_INPUT_ACCESS) == 0)
-            add_jump_rule(IPT_INPUT_ACCESS);
+            add_jump_rule(opts, IPT_INPUT_ACCESS);
 
         if(out_chain->to_chain != NULL && strlen(out_chain->to_chain))
             if(jump_rule_exists(IPT_OUTPUT_ACCESS) == 0)
-                add_jump_rule(IPT_OUTPUT_ACCESS);
+                add_jump_rule(opts, IPT_OUTPUT_ACCESS);
 
         /* Create an access command for each proto/port for the source ip.
         */
@@ -536,9 +556,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
                 in_chain->target
             );
 
-//--DSS tmp
-//fprintf(stderr, "ADD CMD: %s\n", cmd_buf);
             res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+            if (opts->verbose)
+                log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
+                    cmd_buf, res, err_buf);
+
             if(EXTCMD_IS_SUCCESS(res))
             {
                 log_msg(LOG_INFO, "Added Rule to %s for %s, %s expires at %u",
@@ -575,9 +598,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
                     out_chain->target
                 );
 
-//--DSS tmp
-//fprintf(stderr, "ADD OUTPUT CMD: %s\n", cmd_buf);
                 res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+                if (opts->verbose)
+                    log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
+                        cmd_buf, res, err_buf);
+
                 if(EXTCMD_IS_SUCCESS(res))
                 {
                     log_msg(LOG_INFO, "Added OUTPUT Rule to %s for %s, %s expires at %u",
@@ -632,7 +658,7 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
             /* Make sure the required jump rule exists
             */
             if (jump_rule_exists(IPT_FORWARD_ACCESS) == 0)
-                add_jump_rule(IPT_FORWARD_ACCESS);
+                add_jump_rule(opts, IPT_FORWARD_ACCESS);
 
             zero_cmd_buffers();
 
@@ -648,9 +674,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
                 fwd_chain->target
             );
 
-//--DSS tmp
-//fprintf(stderr, "ADD OUTPUT CMD: %s\n", cmd_buf);
             res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+            if (opts->verbose)
+                log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
+                    cmd_buf, res, err_buf);
+
             if(EXTCMD_IS_SUCCESS(res))
             {
                 log_msg(LOG_INFO, "Added FORWARD Rule to %s for %s, %s expires at %u",
@@ -676,7 +705,7 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
             /* Make sure the required jump rule exists
             */
             if (jump_rule_exists(IPT_DNAT_ACCESS) == 0)
-                add_jump_rule(IPT_DNAT_ACCESS);
+                add_jump_rule(opts, IPT_DNAT_ACCESS);
 
             zero_cmd_buffers();
 
@@ -693,9 +722,12 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
                 nat_port
             );
 
-//--DSS tmp
-//fprintf(stderr, "ADD DNAT CMD: %s\n", cmd_buf);
             res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+            if (opts->verbose)
+                log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
+                    cmd_buf, res, err_buf);
+
             if(EXTCMD_IS_SUCCESS(res))
             {
                 log_msg(LOG_INFO, "Added DNAT Rule to %s for %s, %s expires at %u",
@@ -753,6 +785,11 @@ process_spa_request(const fko_srv_options_t *opts, spa_data_t *spadat)
             );
 
             res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+            if (opts->verbose)
+                log_msg(LOG_INFO, "process_spa_request() CMD: '%s' (res: %d, err: %s)",
+                    cmd_buf, res, err_buf);
+
             if(EXTCMD_IS_SUCCESS(res))
             {
                 log_msg(LOG_INFO, "Added Source NAT Rule to %s for %s, %s expires at %u",
@@ -818,13 +855,17 @@ check_firewall_rules(const fko_srv_options_t *opts)
 
         res = run_extcmd(cmd_buf, cmd_out, STANDARD_CMD_OUT_BUFSIZE, 0);
 
+        if (opts->verbose)
+            log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d, err: %s)",
+                cmd_buf, res, err_buf);
+
         if(!EXTCMD_IS_SUCCESS(res))
         {
             log_msg(LOG_ERR, "Error %i from cmd:'%s': %s", res, cmd_buf, cmd_out);
             continue;
         }
 
-        if(opts->verbose > 2)
+        if(opts->verbose > 1)
             log_msg(LOG_INFO, "RES=%i, CMD_BUF: %s\nRULES LIST: %s", res, cmd_buf, cmd_out);
 
         ndx = strstr(cmd_out, EXPIRE_COMMENT_PREFIX);
@@ -856,7 +897,6 @@ check_firewall_rules(const fko_srv_options_t *opts)
             strlcpy(exp_str, ndx, 11);
             rule_exp = (time_t)atoll(exp_str);
 
-//fprintf(stderr, "RULE_EXP=%u, NOW=%u\n", rule_exp, now);
             if(rule_exp <= now)
             {
                 /* Backtrack and get the rule number and delete it.
@@ -910,8 +950,12 @@ check_firewall_rules(const fko_srv_options_t *opts)
                 );
 
 
-//fprintf(stderr, "DELETE RULE CMD: %s\n", cmd_buf);
                 res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
+
+                if (opts->verbose)
+                    log_msg(LOG_INFO, "check_firewall_rules() CMD: '%s' (res: %d, err: %s)",
+                        cmd_buf, res, err_buf);
+
                 if(EXTCMD_IS_SUCCESS(res))
                 {
                     log_msg(LOG_INFO, "Removed rule %s from %s with expire time of %u.",

diff --git a/server/fw_util_pf.c b/server/fw_util_pf.c
index ac26c00..0fe2ce6 100644 (file)
--- a/server/fw_util_pf.c
+++ b/server/fw_util_pf.c
@@ -135,7 +135,7 @@ anchor_active(const fko_srv_options_t *opts)
 }
 
 static void
-delete_all_anchor_rules(void)
+delete_all_anchor_rules(const fko_srv_options_t *opts)
 {
     int res = 0;
 
@@ -193,9 +193,9 @@ fw_initialize(const fko_srv_options_t *opts)
 }
 
 int
-fw_cleanup(void)
+fw_cleanup(const fko_srv_options_t *opts)
 {
-    delete_all_anchor_rules();
+    delete_all_anchor_rules(opts);
     return(0);
 }
 

diff --git a/server/fwknopd.c b/server/fwknopd.c
index bae1431..efe857b 100644 (file)
--- a/server/fwknopd.c
+++ b/server/fwknopd.c
@@ -185,7 +185,7 @@ main(int argc, char **argv)
         if(opts.fw_flush == 1)
         {
             fprintf(stdout, "Deleting any existing firewall rules...\n");
-            fw_cleanup();
+            fw_cleanup(&opts);
             exit(EXIT_SUCCESS);
         }
 
@@ -367,7 +367,7 @@ main(int argc, char **argv)
 
     /* Other cleanup.
     */
-    fw_cleanup();
+    fw_cleanup(&opts);
     free_logging();
 
 #if USE_FILE_CACHE

diff --git a/server/incoming_spa.c b/server/incoming_spa.c
index 37f6ad1..915a671 100644 (file)
--- a/server/incoming_spa.c
+++ b/server/incoming_spa.c
@@ -326,7 +326,7 @@ incoming_spa(fko_srv_options_t *opts)
     /* At this point, we assume the SPA data is valid.  Now we need to see
      * if it meets our access criteria.
     */
-    if(opts->verbose > 2)
+    if(opts->verbose > 1)
         log_msg(LOG_INFO, "SPA Decode (res=%i):\n%s", res, dump_ctx(ctx));
 
     /* First, if this is a GPG message, and GPG_REMOTE_ID list is not empty,
@@ -498,7 +498,7 @@ incoming_spa(fko_srv_options_t *opts)
             */
             status = WEXITSTATUS(res);
 
-            if(opts->verbose > 2)
+            if(opts->verbose > 1)
                 log_msg(LOG_WARNING,
                     "CMD_EXEC: command returned %i", status);
 

diff --git a/server/log_msg.c b/server/log_msg.c
index d0e4ef7..f680c2a 100644 (file)
--- a/server/log_msg.c
+++ b/server/log_msg.c
@@ -66,7 +66,7 @@ init_logging(fko_srv_options_t *opts) {
     /* In case this is a re-init.
     */
     free_logging();
- 
+
     /* Allocate memory for the log_name and set the my_name to point to the
      * appropriate name. The name should already be set in the config struct
      * but if it is not, fallback to the default as defined by 'MY_NAME'.

diff --git a/test/test-fwknop.pl b/test/test-fwknop.pl
index 18a1fab..b4faaba 100755 (executable)
--- a/test/test-fwknop.pl
+++ b/test/test-fwknop.pl
@@ -87,7 +87,7 @@ exit 1 unless GetOptions(
 &identify_loopback_intf();
 
 my $default_client_args = "LD_LIBRARY_PATH=$lib_dir $fwknopCmd -A tcp/22 -a $fake_ip " .
-    "-D $loopback_ip --get-key $local_key_file --verbose";
+    "-D $loopback_ip --get-key $local_key_file --verbose --verbose";
 
 my $default_client_gpg_args = "LD_LIBRARY_PATH=$lib_dir $default_client_args " .
     "--gpg-recipient-key $gpg_server_key " .
@@ -98,7 +98,7 @@ my $default_server_conf_args = "-c $default_conf -a $default_access_conf " .
     "-d $default_digest_file -p $default_pid_file";
 
 my $default_server_gpg_args = "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd -c $default_conf " .
-    "-a $gpg_access_conf -i $loopback_intf --foreground --verbose " .
+    "-a $gpg_access_conf -i $loopback_intf --foreground --verbose --verbose " .
     "-d $default_digest_file -p $default_pid_file";
 
 ### point the compiled binaries at the local libary path
@@ -437,7 +437,7 @@ my @tests = (
         'err_msg'  => 'start error',
         'function' => \&server_start,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose",
+            "-i $loopback_intf --foreground --verbose --verbose",
         'fatal'    => $NO
     },
     {
@@ -447,7 +447,7 @@ my @tests = (
         'err_msg'  => 'stop error',
         'function' => \&server_stop,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose",
+            "-i $loopback_intf --foreground --verbose --verbose",
         'fatal'    => $NO
     },
     {
@@ -457,7 +457,7 @@ my @tests = (
         'err_msg'  => 'did not write PID',
         'function' => \&write_pid,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose",
+            "-i $loopback_intf --foreground --verbose --verbose",
         'fatal'    => $NO
     },
 
@@ -468,7 +468,7 @@ my @tests = (
         'err_msg'  => 'did not exit after one packet',
         'function' => \&server_packet_limit,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --packet-limit 1 --foreground --verbose",
+            "-i $loopback_intf --packet-limit 1 --foreground --verbose --verbose",
         'fatal'    => $NO
     },
     {
@@ -478,7 +478,7 @@ my @tests = (
         'err_msg'  => 'did not ignore small packets',
         'function' => \&server_ignore_small_packets,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --packet-limit 1 --foreground --verbose",
+            "-i $loopback_intf --packet-limit 1 --foreground --verbose --verbose",
         'fatal'    => $NO
     },
     {
@@ -489,7 +489,7 @@ my @tests = (
         'function' => \&server_bpf_ignore_packet,
         'cmdline'  => $default_client_args,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --packet-limit 1 --foreground --verbose " .
+            "-i $loopback_intf --packet-limit 1 --foreground --verbose  --verbose " .
             qq|-P "udp port $non_std_spa_port"|,
         'fatal'    => $NO
     },
@@ -502,7 +502,7 @@ my @tests = (
         'function' => \&spa_cycle,
         'cmdline'  => $default_client_args,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose",
+            "-i $loopback_intf --foreground --verbose --verbose",
         'fatal'    => $NO
     },
     {
@@ -513,7 +513,7 @@ my @tests = (
         'function' => \&spa_over_non_std_port,
         'cmdline'  => "$default_client_args --server-port $non_std_spa_port",
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose " .
+            "-i $loopback_intf --foreground --verbose --verbose " .
             qq|-P "udp port $non_std_spa_port"|,
         'fatal'    => $NO
     },
@@ -525,7 +525,7 @@ my @tests = (
         'function' => \&replay_detection,
         'cmdline'  => $default_client_args,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose",
+            "-i $loopback_intf --foreground --verbose --verbose",
         'fatal'    => $NO
     },
     {
@@ -545,7 +545,7 @@ my @tests = (
         'function' => \&altered_non_base64_spa_data,
         'cmdline'  => $default_client_args,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose",
+            "-i $loopback_intf --foreground --verbose --verbose",
         'fatal'    => $NO
     },
     {
@@ -556,7 +556,7 @@ my @tests = (
         'function' => \&altered_base64_spa_data,
         'cmdline'  => $default_client_args,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose",
+            "-i $loopback_intf --foreground --verbose --verbose",
         'fatal'    => $NO
     },
     {
@@ -567,7 +567,7 @@ my @tests = (
         'function' => \&appended_spa_data,
         'cmdline'  => $default_client_args,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose",
+            "-i $loopback_intf --foreground --verbose --verbose",
         'fatal'    => $NO
     },
     {
@@ -578,7 +578,7 @@ my @tests = (
         'function' => \&prepended_spa_data,
         'cmdline'  => $default_client_args,
         'fwknopd_cmdline'  => "LD_LIBRARY_PATH=$lib_dir $fwknopdCmd $default_server_conf_args " .
-            "-i $loopback_intf --foreground --verbose",
+            "-i $loopback_intf --foreground --verbose --verbose",
         'fatal'    => $NO
     },
 
@@ -892,7 +892,7 @@ sub spa_cycle() {
     my $rv = &client_server_interaction($test_hr, [],
             $USE_CLIENT, $REQUIRE_FW_RULE, $NO_FORCE_STOP);
 
-    sleep 2;
+    sleep 3;
 
     ### the firewall rule should be timed out (3 second timeout
     ### as defined in the access.conf file
@@ -920,30 +920,7 @@ sub spa_cycle() {
 sub spa_over_non_std_port() {
     my $test_hr = shift;
 
-    my $rv = &client_server_interaction($test_hr, [],
-            $USE_CLIENT, $REQUIRE_FW_RULE, $NO_FORCE_STOP);
-
-    sleep 2;
-
-    ### the firewall rule should be timed out (3 second timeout
-    ### as defined in the access.conf file
-    if (&is_fw_rule_active()) {
-        &write_test_file("[-] new fw rule not timed out.\n");
-        $rv = 0;
-    } else {
-        &write_test_file("[+] new fw rule timed out.\n");
-    }
-
-    if (&is_fwknopd_running()) {
-        &stop_fwknopd();
-        unless (&file_find_regex([qr/Got\sSIGTERM/],
-                $server_test_file)) {
-            $rv = 0;
-        }
-    } else {
-        &write_test_file("[-] server is not running.\n");
-        $rv = 0;
-    }
+    my $rv = &spa_cycle($test_hr);
 
     unless (&file_find_regex([qr/PCAP\sfilter.*\s$non_std_spa_port/],
             $server_test_file)) {
@@ -1897,7 +1874,7 @@ sub identify_loopback_intf() {
 sub is_fw_rule_active() {
     return 1 if &run_cmd("LD_LIBRARY_PATH=$lib_dir $fwknopdCmd " .
             "$default_server_conf_args " .
-            "--fw-list | grep $fake_ip |grep _exp_",
+            qq{--fw-list | grep -v "# DISABLED" |grep $fake_ip |grep _exp_},
             $cmd_out_tmp, $current_test_file);
     return 0;
 }