This is libfko.info, produced by makeinfo version 6.1 from libfko.texi. This manual is for the Firewall Knock Operator library, libfko. (version 2.6.10, last updated 7 August 2018). Copyright (C) 2009-2013 Damien Stuart. The libfko manual is free; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. The libfko manual is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this manual; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA INFO-DIR-SECTION Network Security START-INFO-DIR-ENTRY * libfko: (libfko). The FireWall KNock OPerator (fwknop) Library - libfko END-INFO-DIR-ENTRY  File: libfko.info, Node: Top, Next: Introduction, Up: (dir) Main Menu ********* This manual is for the Firewall Knock Operator library, libfko. (version 2.6.10, last updated 7 August 2018). Copyright (C) 2009-2013 Damien Stuart. The libfko manual is free; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. The libfko manual is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this manual; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA * Menu: * Introduction:: How to use this manual * Preparation:: What you should do before using the library * Using libfko:: How to use libfko in your program Appendices * Library Copying:: The GNU General Public License says how you can copy and share Indices * Concept Index:: Index of concepts and programs * Function and Data Index:: Index of functions, variables and data types -- The Detailed Node Listing -- Introduction * Getting Started:: Purpose of the manual, and how to use it * Features:: Reasons to install and use libfko * Overview:: Basic overview of SPA and architecture of the libfko library Overview * SPA Data Format:: Description of the SPA data format. Preparation * libfko Header:: What header file you need to include * Compiling with libfko:: What you need to compile and link your program with libfko * SPA Parameter Types:: The available digests, message types and modes of encryption for SPA data Using libfko * Creating Contexts:: Creating a new fko context * Destroying Contexts:: Releasing an fko context * Creating a SPA Message:: What it takes to create a SPA message * Setting SPA Data:: Setting SPA data * Retrieving SPA Data:: Retrieving SPA data * Utility Functions:: Other utility, miscellaneous, and seldom used functions * Error Handling:: Possible errors and their meaning SPA Parameter Types * Digests:: The message digest hashes supported by libfko * SPA Messages:: The fko SPA message types supported by libfko (and fwknop) * Encryption Algorithms:: Encryption schemes supported by libfko * HMAC Digests:: Digests that can be used to build an HMAC  File: libfko.info, Node: Introduction, Next: Preparation, Prev: Top, Up: Top 1 Introduction ************** The "Firewall Knock Operator Library" (libfko) is a C language library that implements the functions needed to create and/or parse "Single Packet Authorization" (SPA) data. It is designed to abstract the details of encoding, encryption, decoding, parsing, and verifying SPA messages such as those used by Michael Rash's "Firewall Knock Operator" (fwknop). "fwknop" implements an authorization scheme known as Single Packet Authorization (SPA) for strong service protection. SPA requires only a single packet which is encrypted, non-replayable, and authenticated via an HMAC in order to communicate desired access to a service that is hidden behind a firewall in a default-drop filtering stance. The main application of SPA is to use a firewall to drop all attempts to connect to services such as 'SSH' in order to make the exploitation of vulnerabilities (both 0-day and unpatched code) more difficult. Any service that is protected by SPA naturally cannot be scanned for with 'Nmap'. The fwknop project supports three different firewalls: 'iptables' on Linux systems, 'pf' on OpenBSD, and 'ipfw' on FreeBSD and Mac OS X. libfko is not an implementation of an fwknop client or server. It simply provides the functions for managing the SPA data used by those programs. For more information on fwknop and SPA, go to . * Menu: * Getting Started:: Purpose of the manual, and how to use it * Features:: Reasons to install and use libfko * Overview:: Basic architecture of the libfko library  File: libfko.info, Node: Getting Started, Next: Features, Up: Introduction 1.1 Getting Started =================== This manual documents the "Firewall Knock Operator" library programming interface. All functions and data types provided by the library are explained. This manual can be used in a couple of ways. If read from the beginning to the end, it should give a good introduction into the library and how it can be used in an application. Later on, the manual can be used as a reference manual to get just the information needed about any particular interface of the library.  File: libfko.info, Node: Features, Next: Overview, Prev: Getting Started, Up: Introduction 1.2 Features ============ The primary advantage of using libfko is it provides a single API for either creating or parsing SPA data. Additional advantages include: It's free software Anybody can use, modify, and redistribute it under the terms of the GNU General Public License v2 or any later version (*note Library Copying::). It's lightweight The Perl-based implementation requires several additional Perl modules and has a relatively large footprint in memory. This C-based library eliminates those dependencies and has a much smaller footprint. Using this library allows SPA to easily function on embedded operating systems such as OpenWRT. It's easy libfko hides many of the gory details of fwknop's SPA message data format, encoding, decoding, encrypting, decrypting, authenticating, and parsing. In most cases, only a few function calls will be needed create or parse a SPA message.  File: libfko.info, Node: Overview, Prev: Features, Up: Introduction 1.3 Overview ============ * Menu: * SPA Data Format:: Description of the SPA data format. libfko functionality can be divided into two roles. One is the creation of an encrypted SPA message together with an HMAC for authentication. The other is the taking an encrypted SPA message to authenticate, decode, parse, and extract the original data. The actual SPA data handling and operations are set within a context. The context represents a single SPA message and provides configuration parameters and data settings for defining that message. All operations on the data occur within that context. Some operations on the context must occur before others. Details of these dependencies are covered in *note Creating a SPA Message::. With libfko, working with SPA message data basically consists of the following steps in order: * Create a new context * Work with (get/set) the SPA data fields * Destroy the context  File: libfko.info, Node: SPA Data Format, Up: Overview 1.3.1 SPA Data Format --------------------- The format of the SPA message data used by fwknop (before encryption and before an HMAC is applied) is a colon-delimited string containing the individual SPA data fields. Some of these fields are base64-encoded in the final encoding process as dictated by the current fwknop implementation. -- Variable: data spa_message_fields Using the libfko names for the data fields, the list of these fields (in order) follows: '*rand_value* - _Default: Random (created upon context creation)_' A 16-byte random numeric string. '*username* - _Default: Current login user or Value of SPOOF_USER env var_' The base64-encoded username associated with this SPA data. '*timestamp* - _Default: The Unix time at creation_' The Unix timestamp value. '*version* - _Default: the current fwknop version_' The current fwknop version that supports this format. This field is not user settable. '*spa_message_type* - _Default: SPA access message (FKO_ACCESS_MSG)_' The SPA message type value for this message. '*spa_message*' The base64-encoded SPA message itself (an access request or command string). '*spa_nat_access*' An optional base64-encoded request for NAT access. '*spa_server_auth*' An optional base64-encoded string that can be used as an additional authentication mechanism at the fwknop server. '*spa_client_timeout*' An optional client timeout value that can be supplied to the fwknop server. '*spa_digest* - _Computed value_' The digest of the previous fields (including the delimiters). With all fields defined, a complete (unencoded) SPA message would look something like the following example (Note: The line is broken for readability and the username, message, nat_access, and server_auth fields are not base64-encoded): 8307540982176539:juser:1230665172:2.5:1:1.1.1.1,tcp/22:192.168.1.2,22: crypt,mypw:120:xswj8V0zMR7/7MV9pQRarSKWG1l9Zfjv+kbXaKrJ+RA For most of the fields, you need not be too concerned about the format as libfko handles that. The exceptions are the 'spa_message', 'spa_nat_access', and 'spa_server_auth'. The formats for these are not handled by libfko during creation. However, they are checked for format validity during the endcoding and decoding (when parsing incoming) SPA data. More information on the specifics of the formats for these fields can be found in *note SPA Messages::.  File: libfko.info, Node: Preparation, Next: Using libfko, Prev: Introduction, Up: Top 2 Preparation ************* This chapter provides information needed to prepare for using libfko in your programs. * Menu: * libfko Header:: What header file you need to include * Compiling with libfko:: What you need to compile and link your program with libfko * SPA Parameter Types:: The available digests, message types and modes of encryption for SPA data  File: libfko.info, Node: libfko Header, Next: Compiling with libfko, Up: Preparation 2.1 libfko Header ================= All interfaces (data types and functions) of the library are defined in the header file 'fko.h'. You must include this in all programs using the library, either directly or through some other header file, like this: #include The name space of FKO is 'fko_*' for function names and data types and 'FKO_*' for other symbols. Other symbols internal to FKO may take the form '_fko_*' and '_FKO_*'.  File: libfko.info, Node: Compiling with libfko, Next: SPA Parameter Types, Prev: libfko Header, Up: Preparation 2.2 Compiling with libfko ========================= If you want to compile a source file including the 'fko.h' header file, you must make sure that the compiler can find it in the directory hierarchy. This is accomplished by adding the path to the directory in which the header file is located to the compilers include file search path (via the '-I' option). For example, if you installed libfko in '/opt/fko', you may want to add '-I/opt/fko/include' to 'CFLAGS', or directly on the command-line: gcc -c foo.c -I/opt/fko/include ... The same is true when linking a program with the library. In this case, the linker has to find the library files. For this to work, the path to the library files has to be added to the library search path (via the '-L' option). Continuing with the example above you may want to add '-L/opt/fko/lib' to 'LDFLAGS', or directly on the command-line: gcc -o foo foo.c -I/opt/fko/include -L/opt/fko/lib -lfko  File: libfko.info, Node: SPA Parameter Types, Prev: Compiling with libfko, Up: Preparation 2.3 SPA Parameter Types ======================= * Menu: * Digests:: The message digest hashes supported by libfko * SPA Messages:: The fko SPA message types supported by libfko (and fwknop) * Encryption Algorithms:: Encryption schemes supported by libfko * HMAC Digests:: Digests that can be used to build an HMAC  File: libfko.info, Node: Digests, Next: SPA Messages, Up: SPA Parameter Types 2.3.1 Digests ------------- The fwknop system employs a message digest hash of the SPA data as one of the data fields to act a signature which can be used at the receiving end to verify the data is valid (although this feature has been superceded by the usage of an HMAC for proper message authentication and verification of integrity). The resulting digest is base64-encoded before it is added to the SPA data. Currently, libfko supports the same message digests as the legacy fwknop plus two others (SHA384 and SHA512). These are (in order of strength): -- Variable: int fko_digest_type_t 'FKO_DIGEST_MD5' 'FKO_DIGEST_SHA1' 'FKO_DIGEST_SHA256 (libfko default)' 'FKO_DIGEST_SHA384' 'FKO_DIGEST_SHA512' As indicated in the list above, SHA256 is the default. This means the digest type does not need to be explicitly set unless you wish to use one of the other values. This applies to all libfko SPA data fields that have a default value.  File: libfko.info, Node: SPA Messages, Next: Encryption Algorithms, Prev: Digests, Up: SPA Parameter Types 2.3.2 SPA Messages ------------------ The fwknop system (and subsequently libfko), support a specific set of message types. The message type value is used by fwknop to help determine the correct message format and content. These message types are: -- Variable: int fko_message_type_t 'FKO_COMMAND_MSG' A request to have the fwknop server execute the given command. The format for this type is: ','. "192.168.1.2,uname -a" 'FKO_ACCESS_MSG' A basic access request. This is the most common type in use. The format for this type is: ',/'. Note that multiple protocol/port entries are allowed. "192.168.1.2,tcp/22" "192.168.1.2,tcp/22,udp/5005" 'FKO_NAT_ACCESS_MSG' An access request that also provide information for the fwknop server to create a Network Address Translation (NAT to an internal address. The format for this string is: ','. "10.10.1.2,9922" 'FKO_CLIENT_TIMEOUT_ACCESS_MSG' This is an FKO_ACCESS_REQUEST with a timeout parameter for the fwknop server. The timeout value is provided via the 'client_timeout' data field. 'FKO_CLIENT_TIMEOUT_NAT_ACCESS_MSG' This is an FKO_NAT_ACCESS_REQUEST with a timeout parameter for the fwknop server. The timeout value is provided via the 'client_timeout' data field. 'FKO_LOCAL_NAT_ACCESS_MSG' This is similar to the FKO_NAT_ACCESS request except the NAT is to the local to the server (i.e. a service listening on 127.0.0.1). 'FKO_CLIENT_TIMEOUT_LOCAL_NAT_ACCESS_MSG' This is an FKO_LOCAL_NAT_ACCESS_REQUEST with a timeout parameter for the fwknop server. The timeout value is provided via the 'client_timeout' data field.  File: libfko.info, Node: Encryption Algorithms, Next: HMAC Digests, Prev: SPA Messages, Up: SPA Parameter Types 2.3.3 Encryption Algorithms --------------------------- One of the final steps (before the HMAC is calculated and applied) in creating an fwknop SPA message is encrypting the entire message. Currently, fwknop supports two methods of encryption: -- Variable: int fko_encryption_type_t 'FKO_ENCRYPTION_RIJNDAEL (default)' 'FKO_ENCRYPTION_GPG' As indicated, libfko uses Rijndael encryption by default. Rijndael encryption is sufficient for most users and produces a much smaller data packet than GPG (between 140 bytes with MD5 digest to around 225 bytes or so with SHA512, compared to around 1100 for signed GPG). When Rijndael is used, the encryption key itself is derived from the supplied passphrase via the PBKDF1 algorithm, and CBC mode is set. However, some may prefer the higher level of security provided by GPG. When selected, additional parameters such as _recipient_ and _signer_ may be set as well. See *note Setting SPA Data:: for detail on setting these and other SPA data fields.  File: libfko.info, Node: HMAC Digests, Prev: Encryption Algorithms, Up: SPA Parameter Types 2.3.4 HMAC Digests ------------------ The fwknop project employs an HMAC in the encrypt-then-authenticate model for strong SPA message authentication. The HMAC itself is derived from a digest of the encrypted SPA message along with a dedicated HMAC key. Currently, libfko supports the same message digests as mentioned in the Digest section above, and these are (in order of strength): -- Variable: int fko_digest_type_t 'FKO_HMAC_MD5' 'FKO_HMAC_SHA1' 'FKO_HMAC_SHA256 (libfko default)' 'FKO_HMAC_SHA384' 'FKO_HMAC_SHA512' As indicated in the list above, SHA256 is the default. This means the HMAC digest type does not need to be explicitly set unless you wish to use one of the other values. This applies to all libfko SPA data fields that have a default value.  File: libfko.info, Node: Using libfko, Next: Library Copying, Prev: Preparation, Up: Top 3 Using libfko ************** This chapter provides the "howto" for using libfko, including required functions and parameter choices. In some sections, code samples are provided to further illustrate usage. * Menu: * Creating Contexts:: Creating a new fko context * Destroying Contexts:: Releasing an fko context * Creating a SPA Message:: What it takes to create a SPA message * Setting SPA Data:: Setting SPA data * Retrieving SPA Data:: Retrieving SPA data * Utility Functions:: Other utility, miscellaneous, and seldom used functions * Error Handling:: Possible errors and their meaning  File: libfko.info, Node: Creating Contexts, Next: Destroying Contexts, Up: Using libfko 3.1 Creating Contexts ===================== Before doing anything with libfko, you need to create a context. A context is created for one of two reasons. One is for the purpose of building a new fko SPA message from scratch (typically to be packaged and sent to an fwknop server somewhere). The other would be a context for taking an existing SPA message for decoding, parsing, and data extraction. For building a new fko SPA message, you will use the 'fko_new' function: -- Function: int fko_new (fko_ctx_t *CTX) The function 'fko_new' sets up and initializes a new 'fko_ctx_t' object, pre-populates default values and returns a handle for it in CTX. The function returns the error code 'FKO_SUCCESS' if the context was successfully created. Otherwise an another error code will be returned (*note Error Handling:: for details on the various error codes and their meanings). fko_ctx_t ctx; int rc; rc = fko_new(&ctx); if(rc != FKO_SUCCESS) { fprintf(stderr, "Error %i from fko_new: %s\n", rc, fko_errstr(rc)); exit(1); } For a context that will be used for receiving and parsing an existing SPA message, you will use the 'fko_new_with_data' function: -- Function: int fko_new_with_data (fko_ctx_t *CTX, const char *DATA, const char *KEY, const char KEY_LEN, int ENCRYPTION_MODE, const char HMAC_KEY, const int HMAC_TYPE) The function 'fko_new_with_data' sets up and initializes a new 'fko_ctx_t' context, but instead of initializing default values, it stores the encrypted message data and makes it ready for parsing. This can be done in one of two ways. One is to pass 'NULL' for the third argument. The context will be created and the data will be stored, but no decryption or decoding takes place. In this case, you will need to call 'fko_decrypt_spa_data' at a later time. The other way to do it is to supply the KEY value (decryption passphrase) and assocated length. In this case, the context is created, the SPA data is decrypted, decoded, parsed, and stored in the context ready for retrieval. If an HMAC is also desired or required, then the HMAC_KEY and associated length can be passed in. This will cause libfko to authenticate the SPA data before decryption is attempted, and this is strongly recommended to do. The 'fko_new_with_data' function returns the error code 'FKO_SUCCESS' if the context was successfully created. If any of the intermediate steps in parsing the data, validating the SPA message digest, or any other internal action fails, then the appropriate error code is returned. The most common (simple) case... fko_ctx_t ctx; char *spa_data; char *key; int key_len; char *hmac_key; int hmac_key_len; int hmac_type = FKO_HMAC_SHA256; int enc_mode = FKO_ENC_MODE_CBC; int rc; /* Assume we called code that retrieves the data and key */ rc = fko_new_with_data(&ctx, spa_data, key, key_len, \\ enc_mode, hmac_key, hmac_key_len, hmac_type); if(rc != FKO_SUCCESS) { fprintf(stderr, "Error %i from fko_new_with_data: %s\n", rc, fkoerrstr(rc)); exit(1); } Or, perhaps you need to defer decryption and parsing to a later point in the program. We could use fko_new_with_data(), passing NULL for the decryption key and HMAC keys, or we could use fko_new() to create an empty context, then use fko_set_spa_data() to add the encypted data (see comments in the code samples). fko_ctx_t ctx; char *spa_data; char *key; int rc; /* Assume we called code that retrieves the data and key */ rc = fko_new_with_data(&ctx, spa_data, NULL, 0, FKO_ENC_MODE_CBC, NULL, 0, FKO_HMAC_SHA256); if(rc != FKO_SUCCESS) { fprintf(stderr, "Error from fko_new_with_data: %s\n", fko_errstr(rc)); exit(1); } /* We could also just create and empty context and add the * encrypted data as follows: * * rc = fko_new(&ctx); * ... check rc ... * rc = fko_set_spa_data(ctx, spa_data); * ... */ /* Assume we called other code and functions... */ /* Verify HMAC */ rc = fko_verify_hmac(ctx, hmac_key, hmac_key_len); if(rc != FKO_SUCCESS) { fprintf(stderr, "Error from fko_verify_hmac: %s\n", fko_errstr(rc)); exit(1); } /* Decrypt and decode... */ rc = fko_decrypt_spa_data(ctx, key, key_len); if(rc != FKO_SUCCESS) { fprintf(stderr, "Error from fko_decrypt_spa_data: %s\n", fko_errstr(rc)); exit(1); }  File: libfko.info, Node: Destroying Contexts, Next: Creating a SPA Message, Prev: Creating Contexts, Up: Using libfko 3.2 Destroying Contexts ======================= When you are done with the context, you must destroy it in order to free up the memory and resources it was using. This is especially important in programs that process SPA data repeatedly (i.e. in a loop). Failure to destroy the context can cause memory leaks in your program. -- Function: void fko_destroy (fko_ctx_t CTX) The function 'fko_destroy' destroys the context with the handle CTX and releases all associated resources.  File: libfko.info, Node: Creating a SPA Message, Next: Setting SPA Data, Prev: Destroying Contexts, Up: Using libfko 3.3 Creating a SPA Message ========================== This section describes the process for creating a new fko SPA message. After creating a context, there are still some requisite SPA data fields and SPA parameters that need to be set before the final encrypted message is ready. The following list contains the minimum required fields for a complete fko SPA message. You should also take note of the order of these parameters as well. Setting the "type" parameters first is recommended (if you want a type other than the default). * digest_type - _(default may suffice)_ * message_type - _(default may suffice)_ * encryption_type - _(default may suffice)_ * rand_val - _(default should suffice)_ * time_stamp - _(default should suffice)_ * username - _(default may suffice)_ * spa_message - _(must be explicitly set)_ _If using gpg encryption:_ * gpg_recipient - _(must be explicitly set)_ * gpg_signer - _(optional, but recommended - must be explicitly set if used)_ * gpg_home_dir - _(default may suffice - typically $HOME/.gnupg)_ When a context is initialized, some of the SPA data fields are pre-set with default values (*note SPA Data Format::). For fields such as 'rand_val', 'username', 'timestamp', 'message_type', and 'digest_type', these defaults may be sufficient. The functions used to set the various SPA data fields and parameters are described in detail in *note Setting SPA Data::. *Note*: Attempts to call any "'fko_'" function on a context that has not been initialized can have undefined consequences. Libfko will attempt to recover, and if successful, will return a status of 'FKO_ERROR_CTX_NOT_INITIALIZED'. A common SPA message is a simple access request. This request asks the fwknop server to create a temporary firewall rule to allow a particular IP address access to a particular port on the fwknop server. Assuming the defaults are fine for this, all we need to do is create the context, set the message data field, call the 'fko_spa_data_final' function to encode and encrypt, process the message, then destroy the context. Below, we have a contrived bit of code demonstrating this: int main(int argc, char **argv) { fko_ctx_t ctx; /* FKO Context */ char *key; /* Encryption passphrase */ char *hmac_key; /* HMAC key */ char *final_spa; /* Final encrypted SPA data */ int key_len; /* Length of encryption key */ int hmac_key_len; /* Length of HMAC key */ int rc; /* Result code */ int hmac_type = FKO_HMAC_SHA256; /* Default HMAC digest */ int enc_mode = FKO_ENC_MODE_ASYMMETRIC; /* Use GPG */ /* Assume we processed the command line * and retrieved the password and the HMAC key and * set their associated lengths. */ /* Create the context */ rc = fko_new(&ctx); if(rc != FKO_SUCCESS) { fprintf(stderr, "Error creating context: %s\n", fko_errstr(rc)); exit(1); } /* Set the SPA message field - asking to open tcp port 22 * for the system at 192.168.0.33 */ rc = fko_set_spa_message(ctx, "192.168.0.33,tcp/22"); if(rc != FKO_SUCCESS) { fprintf(stderr, "Set SPA message failed: %s\n", fko_errstr(rc)); exit(1); } /* Let us assume we are using GPG encryption. So we need to * set the encryption type and set the required GPG parameters * (we can skip checking return values for brevity). */ rc = fko_set_spa_encryption_type(ctx, FKO_ENCRYPTION_GPG); /* Key for the recipient */ rc = fko_set_gpg_recipient(ctx, "recip@some.where"); /* Key for the signer (if you want to sign it) */ rc = fko_set_gpg_signer(ctx, "me@right.here"); /* Finalize the SPA data */ rc = fko_spa_data_final(ctx, key, key_len, enc_mode, hmac_key, hmac_key_len, hmac_type); if(rc != FKO_SUCCESS) { fprintf(stderr, "Error encoding SPA data: %s\n", fko_errstr(rc)); exit(1); } /* Take the final message and do something with it */ rc = fko_get_spa_data(ctx, &final_spa); /* Assume this function packs the spa data into a UDP * packet and sends it to the server. */ send_spa_message(final_spa); /* Done with the context */ fko_destroy(ctx); exit(0); }  File: libfko.info, Node: Setting SPA Data, Next: Retrieving SPA Data, Prev: Creating a SPA Message, Up: Using libfko 3.4 Setting SPA Data ==================== This section describes the functions used for setting the various SPA data fields and parameters. All of these functions return an integer representing the return status of the function. When succesfull, they will return 'FKO_SUCCESS'. Otherwise, an error code value is returned. -- Function: int fko_set_spa_digest_type (fko_ctx_t CTX, short DIGEST_TYPE); Set the message digest type. Valid values can be found in *note Digests:: of this manual. If a value other than the those that are supported is given, the function will return 'FKO_ERROR_INVALID_DATA'. For example: rc = fko_set_digest_type(ctx, FKO_DIGEST_SHA1); -- Function: int fko_set_spa_hmac_type (fko_ctx_t CTX, short HMAC_TYPE); Set the message hmac type. Valid values can be found in *note HMAC Digests:: of this manual. If a value other than the those that are supported is given, the function will return 'FKO_ERROR_INVALID_DATA'. For example: rc = fko_set_hmac_type(ctx, FKO_HMAC_SHA256); -- Function: int fko_set_spa_encryption_type (fko_ctx_t CTX, short ENCRYPT_TYPE); Set the encrytion algorithm to use when ecrypting the final SPA data. Valid values can be found in *note Encryption Algorithms:: of this manual. For example: rc = fko_set_encryption_type(ctx, FKO_ENCRYPTION_RIJNDAEL); -- Function: int fko_set_rand_value (fko_ctx_t CTX, const char *VAL); Set the random value portion of the spa data to the given value (VAL). The given value must be a pointer to a 16-character decimal numeric string or NULL. If the value is NULL, the function generate a new random value. If a string value is provided, it must be a 16-character decimal string. Otherwise, the function will return 'FKO_ERROR_INVALID_DATA'. -- Function: int fko_set_username (fko_ctx_t CTX, const char *USERNAME); Set the username field of the SPA data. If USERNAME is NULL, libfko will first look for the environment variable 'SPOOF_USER' and use its value if found. Otherwise, it will try to determine the username itself using various methods starting with 'cuser' or 'getlogin', then fallback to the environment variables 'LOGNAME' or 'USER'. If none of those work, the function will return 'FKO_ERROR_USERNAME_UNKNOWN'. -- Function: int fko_set_timestamp (fko_ctx_t CTX, int OFFSET); Sets the timestamp value of the SPA data to the current time plus the offset value. -- Function: int fko_set_spa_message_type (fko_ctx_t CTX, short MSG_TYPE); Sets the message type for the SPA data. The choices for the 'spa_message_type' are listed in *note SPA Messages::. For example: rc = fko_set_spa_message_type(ctx, FKO_ACCESS_MSG); -- Function: int fko_set_spa_message (fko_ctx_t CTX, const char *MSG_STRING); Set the SPA message string to the given value. If this string does not conform to the required 'spa_nat_access' format, the function will return 'FKO_ERROR_INVALID_DATA'. -- Function: int fko_set_spa_nat_access (fko_ctx_t CTX, const char *NAT_ACCESS); Set the optional SPA nat access string to the given value. If this string does not conform to the required 'spa_nat_access' format, the function will return 'FKO_ERROR_INVALID_DATA'. -- Function: int fko_set_spa_server_auth (fko_ctx_t CTX, const char *SERVER_AUTH); Set the optional (very seldom used) SPA server auth feature to the given value. This parameter may become deprecated. -- Function: int fko_set_spa_client_timeout (fko_ctx_t CTX, int TIMEOUT); Sets the SPA client timeout value. If the timeout is set to a value greater than 0, it is assumed the 'spa_message_type' setting should be one of the "TIMEOUT" variants. This function will change the 'message_type' to the appropriate setting if necessary. However, it is recommended you set the correct 'message_type' ahead of time. -- Function: int fko_set_spa_digest (fko_ctx_t CTX); Initiates a calculation (or recalculation) of the message digest hash for the current SPA data. If the required data fields are not set this function will return 'FKO_ERROR_MISSING_ENCODED_DATA'. *Note*: It should not be necessary to call this function directly as it will be called automatically by other functions during normal processing (most notably 'fko_spa_data_final'). -- Function: int fko_set_spa_hmac (fko_ctx_t CTX, const char *HMAC_KEY, const int HMAC_KEY_LEN); Initiates a calculation (or recalculation) of the message HMAC for the current SPA data. *Note*: It should not be necessary to call this function directly as it will be called automatically by other functions during normal processing (most notably 'fko_spa_data_final'). -- Function: int fko_set_spa_data (fko_ctx_t CTX, char *ENC_DATA); This function is used to place encrypted SPA data into a newly created empty context (i.e. with 'fko_new'). In most cases, you would use 'fko_new_with_data' so you wouldn't have to take the extra step to use this function. However, some may find a reason to do it in this way. _GPG-specific functions:_ -- Function: int fko_set_gpg_recipient (fko_ctx_t CTX, const char RECIPIENT); Sets the GPG key for the recipient. This would be the recipient's public key used to encyrpt the SPA data. You can use the user name ("recip@the.dest.com") or the key ID ("5EXXXXCC"). At present, multiple recipients are not supported. -- Function: int fko_set_gpg_signer (fko_ctx_t CTX, const char SIGNER); Sets the GPG key for signing the data. This would be the sender's key used to sign the SPA data. You can use the user name or key ID. -- Function: int fko_set_gpg_home_dir (fko_ctx_t CTX, const char HOME_DIR); Sets the GPG home directory for the current gpgme context. This allows for using alternate keyrings, gpg configurations, etc. -- Function: int fko_set_gpg_signature_verify (fko_ctx_t CTX, unsigned char VERIFY); Sets the verify GPG signature flag. When set to a true value, the GPG signature is extracted and checked for validity during the decryption/decoding phase. When set to false, no attempt is made to access or check the signature. This flag is set to true by default. -- Function: int fko_set_gpg_ignore_verify_error (fko_ctx_t CTX, unsigned char IGNORE); Sets the ignore signature verify error flag. When set to a true value. Any signature verification errors are ignored (but still captured) and the decoding process will continue. The default value of this flag is false. -- Function: int fko_set_gpg_exe (fko_ctx_t CTX, const char GPG_EXE); Sets the path to the GPG executable that _gpgme_ will use. By default, _libfko_ forces _gpgme_ to use 'gpg' in case _gpgme_ was compiled to use 'gpg2' as its default engine. You can use this function to override and set what GPG executable _gpgme_ will use. *Note*: On a libfko build without GPG support, the GPG-related functions above will simply return the FKO_ERROR_UNSUPPORTED_FEATURE error code.  File: libfko.info, Node: Retrieving SPA Data, Next: Utility Functions, Prev: Setting SPA Data, Up: Using libfko 3.5 Retrieving SPA Data ======================= This section describes the functions used for retrieving the various SPA data fields and parameters settings. They all return an FKO error code. The value of the respective field or parmeter that is being retrieved will placed into the variables whose addresses are passed to the function. -- Function: int fko_get_spa_data (fko_ctx_t CTX, char **SPA_DATA); Assigns the pointer to the string holding the final encrypted SPA data to the address SPA_DATA is pointing to. This is the data that would be packaged into a packet and sent to an fwknop server. The return value is an FKO error status. -- Function: int fko_get_rand_value (fko_ctx_t CTX, char **RAND_VAL); Assigns the pointer to the string holding the random 16-character decimal number ('rand_val') associated with the current context to the address RAND_VAL is pointing to. The return value is an FKO error status. -- Function: int fko_get_username (fko_ctx_t CTX, char **USERNAME); Assigns the pointer to the string holding the username associated with the current context to the address RAND_VAL is pointing to. The return value is an FKO error status. -- Function: int fko_get_timestamp (fko_ctx_t CTX, time_t *TIMESTAMP); Sets the value of the TIMESTAMP variable to the timestamp value associated with the current context. The return value is an FKO error status. -- Function: int fko_get_spa_message_type (fko_ctx_t CTX, short *MSG_TYPE); Sets the value of the MSG_TYPE variable to the SPA message type value associated with the current context. This value can be checked against the list of valid message_types listed in *note SPA Messages:: of this manual. For example: short msg_type; rc = fko_get_spa_message_type(ctx, &msg_type); switch(msg_type) { case FKO_ACCESS_MSG: process_access_msg(...); break; case FKO_NAT_ACCESS_MSG: process_nat_access_msg(...); break; /*...and so on...*/ } The return value is an FKO error status. -- Function: int fko_get_spa_message (fko_ctx_t CTX, char **SPA_MSG); Assigns the pointer to the string holding the the fko SPA request message associated with the current context to the address SPA_MSG is pointing to. The return value is an FKO error status. -- Function: int fko_get_spa_nat_access (fko_ctx_t CTX, char **NAT_ACCESS); Assigns the pointer to the string holding the the fko SPA nat access message associated with the current context to the address NAT_ACCESS is pointing to. The return value is an FKO error status. -- Function: int fko_get_spa_server_auth (fko_ctx_t CTX, char **SERVER_AUTH); Assigns the pointer to the string holding the the fko SPA server auth message associated with the current context to the address SERVER_AUTH is pointing to. The return value is an FKO error status. -- Function: int fko_get_spa_client_timeout (fko_ctx_t CTX, int *CLIENT_TIMEOUT); Sets the value of the CLIENT_TIMEOUT variable to the client_timeout value associated with the current context. The return value is an FKO error status. -- Function: int fko_get_spa_digest_type (fko_ctx_t CTX, short *DIGEST_TYPE); Sets the value of the DIGEST_TYPE variable to the digest type value associated with the current context. This value can be checked against the list of valid digest_types listed in *note Digests:: of this manual. The return value is an FKO error status. -- Function: int fko_get_spa_hmac_type (fko_ctx_t CTX, short *HMAC_TYPE); Sets the value of the HMAC_TYPE variable to the HMAC type value associated with the current context. This value can be checked against the list of valid hmac_types listed in *note HMAC Digests:: of this manual. The return value is an FKO error status. -- Function: int fko_get_spa_digest (fko_ctx_t CTX, char **SPA_DIGEST); Assigns the pointer to the string holding the the fko SPA digest value associated with the current context to the address SPA_DIGEST is pointing to. The return value is an FKO error status. -- Function: int fko_get_spa_hmac (fko_ctx_t CTX, char **SPA_HMAC); Assigns the pointer to the string holding the the fko SPA HMAC value associated with the current context to the address SPA_HMAC is pointing to. The return value is an FKO error status. -- Function: int fko_get_spa_encryption_type (fko_ctx_t CTX, short *ENC_TYPE); Sets the value of the ENC_TYPE variable to the encryption type value associated with the current context. This value can be checked against the list of valid digest_types listed in *note Encryption Algorithms:: of this manual. The return value is an FKO error status. -- Function: int fko_get_encoded_data (fko_ctx_t CTX, char **ENC_MSG); Assigns the pointer to the string holding the the encoded SPA data (before encryption) associated with the current context to the address ENC_MSG is pointing to. This is intermediate data that would not normally be of use unless debugging the library. The return value is an FKO error status. -- Function: int fko_get_version (fko_ctx_t CTX, char **FKO_VERSION); Assigns the pointer to the string holding the the SPA version value associated with the current context to the address FKO_VERSION is pointing to. This is a static value for SPA data that is being created in a new context. For data parsed from an external source, the version string will be whatever version the sending client used. The return value is an FKO error status. _GPG-specific functions:_ -- Function: int fko_get_gpg_recipient (fko_ctx_t CTX, char **RECIPIENT); Assigns the pointer to the string holding the the GPG recipient ID associated with the current context to the address RECIPIENT is pointing to. The return value is an FKO error status. -- Function: int fko_get_gpg_signer (fko_ctx_t CTX, char **SIGNER); Assigns the pointer to the string holding the the GPG signer ID associated with the current context to the address SIGNER is pointing to. The return value is an FKO error status. -- Function: int fko_get_gpg_home_dir (fko_ctx_t CTX, char **GPG_DIR); Assigns the pointer to the string holding the the GPG home directory associated with the current context to the address GPG_DIR is pointing to. The return value is an FKO error status. -- Function: int fko_get_gpg_signature_verify (fko_ctx_t CTX, unsigned char *VAL); Sets the value of the VAL variable to the current gpg_signature_verify flag value associated with the current context. The return value is an FKO error status. -- Function: int fko_get_gpg_ignore_verify_error (fko_ctx_t CTX, unsigned char *VAL); Sets the value of the VAL variable to the current ignore_verify_error flag value associated with the current context. The return value is an FKO error status. -- Function: int fko_get_gpg_signature_id (fko_ctx_t CTX, char **SIG_ID); Assigns the pointer to the string holding the the GPG signature ID associated with the current context to the address SIG_ID is pointing to. The return value is an FKO error status. -- Function: int fko_get_gpg_signature_fpr (fko_ctx_t CTX, char **SIG_FPR); Assigns the pointer to the string holding the the GPG signature fingerprint associated with the current context to the address SIG_FPR is pointing to. The return value is an FKO error status. -- Function: int fko_get_gpg_signature_summary (fko_ctx_t CTX, int *SIG_SUM); Sets the value of the SIG_SUM variable to the GPG signature summary value associated with the current context. The return value is an FKO error status. -- Function: int fko_get_gpg_signature_status (fko_ctx_t CTX, int *SIG_STAT); Sets the value of the SIG_STAT variable to the GPG signature error status value associated with the current context. The return value is an FKO error status. -- Function: int fko_get_gpg_exe (fko_ctx_t CTX, char **GPG_EXE); Assigns the pointer to the string holding the the GPG executable path associated with the current context to the address GPG_EXE is pointing to. The return value is an FKO error status. *Note*: The char* values retrieved by the GPG-related functions above will be NULL if the context value was not previously set.  File: libfko.info, Node: Utility Functions, Next: Error Handling, Prev: Retrieving SPA Data, Up: Using libfko 3.6 Utility Functions ===================== This section describes the functions not covered elsewhere in this manual. These are utility functions that operate on the data in the fko context. All but 'fko_spa_data_final' are called by other functions and are not normally explicitly called by the user. However, they can be, so they are listed here. All of these functions return an integer representing the return status of the function. When succesfull, they will return 'FKO_SUCCESS'. Otherwise, an error code value is returned. -- Function: int fko_spa_data_final (fko_ctx_t CTX, char *ENC_KEY, int KEN_LEN, char *HMAC_KEY, int HMAC_KEY_LEN); This function is the final step in creating a complete encrypted SPA data string suitable for transmission to an fwknop server. It does require all of the requisite SPA data fields be set, otherwise it will fail with an appropriate error code. -- Function: int fko_decrypt_spa_data (fko_ctx_t CTX, char *DEC_KEY, int KEY_LEN); When given the correct KEY (password), this function decrypts, decodes, and parses the encrypted SPA data that was supplied to the context via the 'fko_new_with_data' function that was also called without the KEY value. Once the data is decrypted, this function will also call 'fko_decode_spa_data' to decode, parse, validate, and store the data fields in the context for later retrieval. -- Function: int fko_encrypt_spa_data (fko_ctx_t CTX, char *ENC_KEY, int KEY_LEN); Encrypts the intermediate encoded SPA data stored in the context. This function will call 'fko_encode' if necessary. It is normally not called directly as it is called from 'fko_spa_data_final'. -- Function: int fko_decode_spa_data (fko_ctx_t CTX); This function performs the decoding, parsing, validation of the SPA data that was just decrypted. It is normally not called directly as it is called from 'fko_decrypt_spa_data' (which is in turn called from 'fko_new_with_data' if a password is supplied to it). -- Function: int fko_encode_spa_data (fko_ctx_t CTX); Performs the base64 encoding of those SPA data fields that need to be encoded, performs some data validation, and calls 'fkp_set_spa_digest' to recompute the SPA message digest. It is normally not called directly as it is called from 'fko_encrypt_spa_data' (which is in turn called from 'fko_spa_data_final'). _GPG-specific utility functions:_ -- Function: int fko_gpg_signature_id_match (fko_ctx_t CTX, const char *ID, unsigned char *ID_MATCH); Sets the value of the ID_MATCH variable to true (1) if the value of ID matches the ID of the GPG signature associated with the current context. Otherwise, ID_MATCH is set to false (0). The return value is an FKO error status. -- Function: int fko_gpg_signature_fpr_match (fko_ctx_t CTX, const char *FPR, unsigned char *FPR_MATCH); Sets the value of the FPR_MATCH variable to true (1) if the value of FPR matches the fingerprint of the GPG signature associated with the current context. Otherwise, FPR_MATCH is set to false (0). The return value is an FKO error status.  File: libfko.info, Node: Error Handling, Prev: Utility Functions, Up: Using libfko 3.7 Error Handling ================== Most fko functions return an integer value that corresponds to either success (0), or one of the non-zero values thar corresponds to a number of possible errors. libfko provides a function to get a descriptive string for the given error code. -- Function: const char * fko_errstr (int ERR_CODE) The function 'fko_errstr' returns a pointer to a statically allocated string containing the description of the error. The list of the possible error codes and their corresponding descriptions as returned by 'fko_errstr' follows: -- Variable: int error_code 'FKO_SUCCESS' Success 'FKO_ERROR_CTX_NOT_INITIALIZED' FKO Context is not initialized 'FKO_ERROR_MEMORY_ALLOCATION' Unable to allocate memory 'FKO_ERROR_FILESYSTEM_OPERATION' Read/write bytes mismatch 'FKO_ERROR_INVALID_DATA' Args contain invalid data 'FKO_ERROR_INVALID_DATA_CLIENT_TIMEOUT_NEGATIVE' Invalid data: negative timeout value 'FKO_ERROR_INVALID_DATA_DECODE_MSGLEN_VALIDFAIL' Invalid data: invalid message length 'FKO_ERROR_INVALID_DATA_DECODE_NON_ASCII' Invalid data: contains non-ascii characters 'FKO_ERROR_INVALID_DATA_DECODE_LT_MIN_FIELDS' Invalid data: insufficient number of data fields 'FKO_ERROR_INVALID_DATA_DECODE_GT_MAX_FIELDS' Invalid data: too many data fields 'FKO_ERROR_INVALID_DATA_DECODE_WRONG_NUM_FIELDS' Invalid data: invalid number of fields 'FKO_ERROR_INVALID_DATA_DECODE_ENC_MSG_LEN_MT_T_SIZE' Invalid data: decode: encoded message - digest size is not valid 'FKO_ERROR_INVALID_DATA_DECODE_RAND_MISSING' Invalid data: decode: missing random data 'FKO_ERROR_INVALID_DATA_DECODE_USERNAME_MISSING' Invalid data: decode: missing username 'FKO_ERROR_INVALID_DATA_DECODE_USERNAME_TOOBIG' Invalid data: decode: username to large 'FKO_ERROR_INVALID_DATA_DECODE_USERNAME_DECODEFAIL' Invalid data: decode: failed to decode username 'FKO_ERROR_INVALID_DATA_DECODE_USERNAME_VALIDFAIL' Invalid data: decode: invalid username 'FKO_ERROR_INVALID_DATA_DECODE_TIMESTAMP_MISSING' Invalid data: decode: missing timestamp 'FKO_ERROR_INVALID_DATA_DECODE_TIMESTAMP_TOOBIG' Invalid data: decode: timestamp too large 'FKO_ERROR_INVALID_DATA_DECODE_TIMESTAMP_DECODEFAIL' Invalid data: decode: failed to decode timestamp 'FKO_ERROR_INVALID_DATA_DECODE_VERSION_MISSING' Invalid data: decode: missing version data 'FKO_ERROR_INVALID_DATA_DECODE_VERSION_TOOBIG' Invalid data: decode: version data is too large 'FKO_ERROR_INVALID_DATA_DECODE_MSGTYPE_MISSING' Invalid data: decode: missing message type 'FKO_ERROR_INVALID_DATA_DECODE_MSGTYPE_TOOBIG' Invalid data: decode: message type is too large 'FKO_ERROR_INVALID_DATA_DECODE_MSGTYPE_DECODEFAIL' Invalid data: decode: failed to decode message type 'FKO_ERROR_INVALID_DATA_DECODE_MESSAGE_MISSING' Invalid data: decode: missing message data 'FKO_ERROR_INVALID_DATA_DECODE_MESSAGE_TOOBIG' Invalid data: decode: message data is too large 'FKO_ERROR_INVALID_DATA_DECODE_MESSAGE_DECODEFAIL' Invalid data: decode: failed to decode message data 'FKO_ERROR_INVALID_DATA_DECODE_MESSAGE_VALIDFAIL' Invalid data: decode: invalid message data 'FKO_ERROR_INVALID_DATA_DECODE_ACCESS_VALIDFAIL' Invalid data: decode: invliad access data 'FKO_ERROR_INVALID_DATA_DECODE_NATACCESS_MISSING' Invalid data: decode: missing NAT access data 'FKO_ERROR_INVALID_DATA_DECODE_NATACCESS_TOOBIG' Invalid data: decode: NAT access data is too large 'FKO_ERROR_INVALID_DATA_DECODE_NATACCESS_DECODEFAIL' Invalid data: decode: failed to decode NAT access data 'FKO_ERROR_INVALID_DATA_DECODE_NATACCESS_VALIDFAIL' Invalid data: decode: invalid NAT access 'FKO_ERROR_INVALID_DATA_DECODE_SRVAUTH_MISSING' Invalid data: decode: missing server auth 'FKO_ERROR_INVALID_DATA_DECODE_SRVAUTH_DECODEFAIL' Invalid data: decode: server auth decode fail 'FKO_ERROR_INVALID_DATA_DECODE_SPA_EXTRA_TOOBIG' Invalid data: decode: SPA extra too large 'FKO_ERROR_INVALID_DATA_DECODE_EXTRA_TOOBIG' Invalid data: decode: extra too large 'FKO_ERROR_INVALID_DATA_DECODE_EXTRA_DECODEFAIL' Invalid data: decode: extra decode failed 'FKO_ERROR_INVALID_DATA_DECODE_TIMEOUT_MISSING' Invalid data: decode: missing timeout 'FKO_ERROR_INVALID_DATA_DECODE_TIMEOUT_TOOBIG' Invalid data: decode timeout value is too large 'FKO_ERROR_INVALID_DATA_DECODE_TIMEOUT_VALIDFAIL' Invalid data: decode invalid timeout 'FKO_ERROR_INVALID_DATA_DECODE_TIMEOUT_DECODEFAIL' Invalid data: decode: timeout decode failed 'FKO_ERROR_INVALID_DATA_ENCODE_MESSAGE_TOOBIG' Invalid data: encode: message is too large 'FKO_ERROR_INVALID_DATA_ENCODE_MSGLEN_VALIDFAIL' Invalid data: encode: invalid message length 'FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_VALIDFAIL' Invalid data: encode: invalid digest 'FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_TOOBIG' Invalid data: encode: digest is too large 'FKO_ERROR_INVALID_DATA_ENCODE_NOTBASE64' Invalid data: encoded data is not Base64 'FKO_ERROR_INVALID_DATA_ENCRYPT_MSGLEN_VALIDFAIL' Invalid data: encrypt: invalid message length 'FKO_ERROR_INVALID_DATA_ENCRYPT_DIGESTLEN_VALIDFAIL' Invalid data: encrypt: invalid digest length 'FKO_ERROR_INVALID_DATA_ENCRYPT_PTLEN_VALIDFAIL' Invalid data: encrypt: invalid plaintext length 'FKO_ERROR_INVALID_DATA_ENCRYPT_RESULT_MSGLEN_VALIDFAIL' Invalid data: encrypt: invalid encrypt result message length 'FKO_ERROR_INVALID_DATA_ENCRYPT_CIPHERLEN_DECODEFAIL' Invalid data: encrypt: decode cipher length failed 'FKO_ERROR_INVALID_DATA_ENCRYPT_CIPHERLEN_VALIDFAIL' Invalid data: encrypt: invalid cipher length 'FKO_ERROR_INVALID_DATA_ENCRYPT_DECRYPTED_MESSAGE_MISSING' Invalid data: encrypt: missing decrypted message 'FKO_ERROR_INVALID_DATA_ENCRYPT_DECRYPTED_MSGLEN_VALIDFAIL' Invalid data: encrypt: invalid decrypted message length 'FKO_ERROR_INVALID_DATA_ENCRYPT_TYPE_VALIDFAIL' Invalid data: encrypt: invalid encryption type 'FKO_ERROR_INVALID_DATA_ENCRYPT_MODE_VALIDFAIL' Invalid data: encrypt: invalid encryption mode 'FKO_ERROR_INVALID_DATA_ENCRYPT_TYPE_UNKNOWN' Invalid data: encrypt: unknown encryption type 'FKO_ERROR_INVALID_DATA_FUNCS_NEW_ENCMSG_MISSING' Invalid data: missing encoded message 'FKO_ERROR_INVALID_DATA_FUNCS_NEW_MSGLEN_VALIDFAIL' Invalid data: invalid message length from new 'FKO_ERROR_INVALID_DATA_FUNCS_GEN_KEYLEN_VALIDFAIL' Invalid data: invalid key length from gen_keylen 'FKO_ERROR_INVALID_DATA_FUNCS_GEN_HMACLEN_VALIDFAIL' Invalid data: gen_hmaclen failure 'FKO_ERROR_INVALID_DATA_FUNCS_GEN_KEY_ENCODEFAIL' Invalid data: gen_key: encode failure 'FKO_ERROR_INVALID_DATA_FUNCS_GEN_HMAC_ENCODEFAIL' Invalid data: gen_hmac: encode failure 'FKO_ERROR_INVALID_DATA_FUNCS_SET_MSGLEN_VALIDFAIL' Invalid data: set_spa_data: invalid message length 'FKO_ERROR_INVALID_DATA_HMAC_MSGLEN_VALIDFAIL' Invalid data: invalid HMAC msglen 'FKO_ERROR_INVALID_DATA_HMAC_ENCMSGLEN_VALIDFAIL' Invalid data: invalid length for encrypted message 'FKO_ERROR_INVALID_DATA_HMAC_COMPAREFAIL' Invalid data: HMAC comparison failed 'FKO_ERROR_INVALID_DATA_HMAC_TYPE_VALIDFAIL' Invalid data: invalid HMAC type 'FKO_ERROR_INVALID_DATA_HMAC_LEN_VALIDFAIL' Invalid data: invalid HMAC length 'FKO_ERROR_INVALID_DATA_MESSAGE_PORT_MISSING' Invalid data: missing port 'FKO_ERROR_INVALID_DATA_MESSAGE_TYPE_VALIDFAIL' Invalid data: invalid message type 'FKO_ERROR_INVALID_DATA_MESSAGE_EMPTY' Invalid data: empty data message 'FKO_ERROR_INVALID_DATA_MESSAGE_CMD_MISSING' Invalid data: missing command message 'FKO_ERROR_INVALID_DATA_MESSAGE_ACCESS_MISSING' Invalid data: missing access message 'FKO_ERROR_INVALID_DATA_MESSAGE_NAT_MISSING' Invalid data: missing NAT data 'FKO_ERROR_INVALID_DATA_MESSAGE_PORTPROTO_MISSING' Invalid data: missing proto/port data 'FKO_ERROR_INVALID_DATA_NAT_EMPTY' Invalid data: empty NAT value 'FKO_ERROR_INVALID_DATA_RAND_LEN_VALIDFAIL' Invalid data: invalid random data length 'FKO_ERROR_INVALID_DATA_SRVAUTH_MISSING' Invalid data: server auth missing 'FKO_ERROR_INVALID_DATA_TIMESTAMP_VALIDFAIL' Invalid data: invalid timestamp value 'FKO_ERROR_INVALID_DATA_USER_MISSING' Invalid data: missing user data 'FKO_ERROR_INVALID_DATA_USER_FIRSTCHAR_VALIDFAIL' Invalid data: user first char not valid 'FKO_ERROR_INVALID_DATA_USER_REMCHAR_VALIDFAIL' Invalid data: user remchar not valid 'FKO_ERROR_INVALID_DATA_UTIL_STRTOL_LT_MIN' Invalid data: util conversion to long less than minimum 'FKO_ERROR_INVALID_DATA_UTIL_STRTOL_GT_MAX' Invalid data: util conversion to long greater than maximum 'FKO_ERROR_DATA_TOO_LARGE' Value or Size of the data exceeded the max allowed 'FKO_ERROR_INVALID_KEY_LEN' Invalid key length 'FKO_ERROR_USERNAME_UNKNOWN' Unable to determine username 'FKO_ERROR_INCOMPLETE_SPA_DATA' Missing or incomplete SPA data 'FKO_ERROR_MISSING_ENCODED_DATA' There is no encoded data to process 'FKO_ERROR_INVALID_DIGEST_TYPE' Invalid digest type 'FKO_ERROR_INVALID_ALLOW_IP' Invalid allow IP address in the SPA message data 'FKO_ERROR_INVALID_SPA_COMMAND_MSG' Invalid SPA command message format 'FKO_ERROR_INVALID_SPA_ACCESS_MSG' Invalid SPA access message format 'FKO_ERROR_INVALID_SPA_NAT_ACCESS_MSG' Invalid SPA nat_access message format 'FKO_ERROR_INVALID_ENCRYPTION_TYPE' Invalid encryption type 'FKO_ERROR_WRONG_ENCRYPTION_TYPE' Wrong or inappropriate encryption type for this operation 'FKO_ERROR_DECRYPTION_SIZE' Unexpected or invalid size for decrypted data 'FKO_ERROR_DECRYPTION_FAILURE' Decryption failed or decrypted data is invalid 'FKO_ERROR_DIGEST_VERIFICATION_FAILED' The computed digest did not match the digest in the spa data 'FKO_ERROR_INVALID_HMAC_KEY_LEN' Invalid HMAC key length 'FKO_ERROR_UNSUPPORTED_HMAC_MODE' Unsupported HMAC mode (default: SHA256) 'FKO_ERROR_UNSUPPORTED_FEATURE' Unsupported or unimplemented feature or function 'FKO_ERROR_ZERO_OUT_DATA' Could not zero out sensitive data 'FKO_ERROR_UNKNOWN' Unknown/Unclassified error If GPG support is available, there are additional possible error conditions and error codes. The GPG support is implemented via GPGME. The libfko error handling code wraps many of the GPGME error codes that may be encountered while using libfko's GPG related functions. These are: -- Variable: int error_code (gpgme support only) 'FKO_ERROR_MISSING_GPG_KEY_DATA' Missing GPG key data (signer or recipient not set) 'FKO_ERROR_GPGME_NO_OPENPGP' This GPGME implementation does not support OpenPGP 'FKO_ERROR_GPGME_CONTEXT' Unable to create GPGME context 'FKO_ERROR_GPGME_PLAINTEXT_DATA_OBJ' Error creating the plaintext data object 'FKO_ERROR_GPGME_SET_PROTOCOL' Unable to set GPGME to use OpenPGP protocol 'FKO_ERROR_GPGME_CIPHER_DATA_OBJ' Error creating the encrypted data data object 'FKO_ERROR_GPGME_BAD_PASSPHRASE' The GPG passphrase was not valid 'FKO_ERROR_GPGME_ENCRYPT_SIGN' Error during the encrypt and sign operation 'FKO_ERROR_GPGME_CONTEXT_SIGNER_KEY' Unable to create GPGME context for the signer key 'FKO_ERROR_GPGME_SIGNER_KEYLIST_START' Error from signer keylist start operation 'FKO_ERROR_GPGME_SIGNER_KEY_NOT_FOUND' The key for the given signer was not found 'FKO_ERROR_GPGME_SIGNER_KEY_AMBIGUOUS' Ambiguous name/id for the signer key (multiple matches) 'FKO_ERROR_GPGME_ADD_SIGNER' Error adding the signer key to the gpgme context 'FKO_ERROR_GPGME_CONTEXT_RECIPIENT_KEY' Unable to create GPGME context for the recipient key 'FKO_ERROR_GPGME_RECIPIENT_KEYLIST_START' Error from signer keylist start operation 'FKO_ERROR_GPGME_RECIPIENT_KEY_NOT_FOUND' The key for the given recipient was not found 'FKO_ERROR_GPGME_RECIPIENT_KEY_AMBIGUOUS' Ambiguous name/id for the recipient key (multiple matches) 'FKO_ERROR_GPGME_DECRYPT_FAILED' Decryption operation failed 'FKO_ERROR_GPGME_BAD_GPG_EXE' Unable to stat the given GPG executable 'FKO_ERROR_GPGME_BAD_HOME_DIR' Unable to stat the given GPG home directory 'FKO_ERROR_GPGME_SET_HOME_DIR' Unable to set the given GPG home directory 'FKO_ERROR_GPGME_NO_SIGNATURE' Missing GPG signature 'FKO_ERROR_GPGME_BAD_SIGNATURE' Bad GPG signature 'FKO_ERROR_GPGME_SIGNATURE_VERIFY_DISABLED' Trying to check signature with verification disabled 'FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_MESSAGE_VALIDFAIL' Invalid data: encrypt: invalid GPG-encrypt message 'FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_DIGEST_VALIDFAIL' Invalid data: encrypt: invalid GPG digest 'FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_MSGLEN_VALIDFAIL' Invalid data: encrypt: invalid GPG message length 'FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_RESULT_MSGLEN_VALIDFAIL' Invalid data: encrypt: invalid GPG result message length 'FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_CIPHER_DECODEFAIL' Invalid data: encrypt: GPG cipher failed 'FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_ENCODEDMSG_NULL' Invalid data: encrypt: GPG-encoded message is NULL 'FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_ENCODEDMSGLEN_VALIDFAIL' Invalid data: encrypt: invalid GPG-encrypted message length You can use the 'IS_GPGME_ERROR(err_code)' macro to determine whether or not an error id GPGME related. If the macro evaluates to a true value, you may be able to get additional information about the error using the following function: -- Function: const char * fko_gpg_errstr (int ERR_CODE) The function 'fko_errstr' returns a pointer to a statically allocated string containing the description of the GPGME error. *Note*: For some errors, this function may return an empty string.  File: libfko.info, Node: Library Copying, Next: Concept Index, Prev: Using libfko, Up: Top Appendix A GNU GENERAL PUBLIC LICENSE ************************************* Version 2 (or any later version), June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. A.1 Preamble ============ The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Lesser General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE v2+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a. You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b. You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c. If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a. Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b. Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c. Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 1. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 2. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS A.2 Appendix: How to Apply These Terms to Your New Programs =========================================================== If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. ONE LINE TO GIVE THE PROGRAM'S NAME AND A BRIEF IDEA OF WHAT IT DOES. Copyright (C) YYYY NAME OF AUTHOR This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) YEAR NAME OF AUTHOR Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands 'show w' and 'show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than 'show w' and 'show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. SIGNATURE OF TY COON, 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License.  File: libfko.info, Node: Concept Index, Next: Function and Data Index, Prev: Library Copying, Up: Top Concept Index ************* [index] * Menu: * compiling, with libfko: Compiling with libfko. (line 6) * context, creation: Creating Contexts. (line 6) * context, destruction: Destroying Contexts. (line 6) * default encryption: Encryption Algorithms. (line 6) * default message digest: Digests. (line 6) * default message digest <1>: HMAC Digests. (line 6) * digest types: Digests. (line 6) * encryption types: Encryption Algorithms. (line 6) * error codes: Error Handling. (line 6) * error codes, gpgme related: Error Handling. (line 241) * error handling: Error Handling. (line 6) * error strings: Error Handling. (line 6) * Firewall Knock Operator, intro: Introduction. (line 6) * fko.h: libfko Header. (line 6) * fwknop: Introduction. (line 6) * gpg-specific functions: Setting SPA Data. (line 112) * gpg-specific functions <1>: Retrieving SPA Data. (line 128) * gpg-specific functions <2>: Utility Functions. (line 52) * gpg-specific functions <3>: Error Handling. (line 310) * GPLv2+, General Public License: Library Copying. (line 6) * header file: libfko Header. (line 6) * HMAC digest types: HMAC Digests. (line 6) * include file: libfko Header. (line 6) * linking, with libfko: Compiling with libfko. (line 6) * message digest types: Digests. (line 6) * message digest types <1>: HMAC Digests. (line 6) * message types: SPA Messages. (line 6) * Single Packet Authorization, intro: Introduction. (line 6) * spa data, retrieving values: Retrieving SPA Data. (line 6) * spa data, setting values: Setting SPA Data. (line 6) * spa data, utility functions: Utility Functions. (line 6) * spa, data creation code sample: Creating a SPA Message. (line 6) * SPA, data format: SPA Data Format. (line 6) * SPA, intro: Introduction. (line 6) * spa, message data creation: Creating a SPA Message. (line 6) * spa, message types: SPA Messages. (line 6) * utility functions: Utility Functions. (line 6)  File: libfko.info, Node: Function and Data Index, Prev: Concept Index, Up: Top Function and Data Index *********************** [index] * Menu: * error_code: Error Handling. (line 18) * error_code <1>: Error Handling. (line 241) * fko_decode_spa_data: Utility Functions. (line 38) * fko_decrypt_spa_data: Utility Functions. (line 23) * fko_destroy: Destroying Contexts. (line 11) * fko_digest_type_t: Digests. (line 17) * fko_digest_type_t <1>: HMAC Digests. (line 14) * fko_encode_spa_data: Utility Functions. (line 44) * fko_encryption_type_t: Encryption Algorithms. (line 10) * fko_encrypt_spa_data: Utility Functions. (line 32) * fko_errstr: Error Handling. (line 11) * fko_get_encoded_data: Retrieving SPA Data. (line 113) * fko_get_gpg_exe: Retrieving SPA Data. (line 182) * fko_get_gpg_home_dir: Retrieving SPA Data. (line 141) * fko_get_gpg_ignore_verify_error: Retrieving SPA Data. (line 152) * fko_get_gpg_recipient: Retrieving SPA Data. (line 130) * fko_get_gpg_signature_fpr: Retrieving SPA Data. (line 164) * fko_get_gpg_signature_id: Retrieving SPA Data. (line 158) * fko_get_gpg_signature_status: Retrieving SPA Data. (line 176) * fko_get_gpg_signature_summary: Retrieving SPA Data. (line 170) * fko_get_gpg_signature_verify: Retrieving SPA Data. (line 146) * fko_get_gpg_signer: Retrieving SPA Data. (line 136) * fko_get_rand_value: Retrieving SPA Data. (line 18) * fko_get_spa_client_timeout: Retrieving SPA Data. (line 75) * fko_get_spa_data: Retrieving SPA Data. (line 12) * fko_get_spa_digest: Retrieving SPA Data. (line 95) * fko_get_spa_digest_type: Retrieving SPA Data. (line 81) * fko_get_spa_encryption_type: Retrieving SPA Data. (line 105) * fko_get_spa_hmac: Retrieving SPA Data. (line 100) * fko_get_spa_hmac_type: Retrieving SPA Data. (line 88) * fko_get_spa_message: Retrieving SPA Data. (line 56) * fko_get_spa_message_type: Retrieving SPA Data. (line 34) * fko_get_spa_nat_access: Retrieving SPA Data. (line 61) * fko_get_spa_server_auth: Retrieving SPA Data. (line 68) * fko_get_timestamp: Retrieving SPA Data. (line 29) * fko_get_username: Retrieving SPA Data. (line 24) * fko_get_version: Retrieving SPA Data. (line 120) * fko_gpg_errstr: Error Handling. (line 310) * fko_gpg_signature_fpr_match: Utility Functions. (line 61) * fko_gpg_signature_id_match: Utility Functions. (line 54) * fko_message_type_t: SPA Messages. (line 11) * fko_new: Creating Contexts. (line 15) * fko_new_with_data: Creating Contexts. (line 38) * fko_set_gpg_exe: Setting SPA Data. (line 146) * fko_set_gpg_home_dir: Setting SPA Data. (line 126) * fko_set_gpg_ignore_verify_error: Setting SPA Data. (line 139) * fko_set_gpg_recipient: Setting SPA Data. (line 114) * fko_set_gpg_signature_verify: Setting SPA Data. (line 131) * fko_set_gpg_signer: Setting SPA Data. (line 121) * fko_set_rand_value: Setting SPA Data. (line 34) * fko_set_spa_client_timeout: Setting SPA Data. (line 80) * fko_set_spa_data: Setting SPA Data. (line 105) * fko_set_spa_digest: Setting SPA Data. (line 89) * fko_set_spa_digest_type: Setting SPA Data. (line 11) * fko_set_spa_encryption_type: Setting SPA Data. (line 27) * fko_set_spa_hmac: Setting SPA Data. (line 97) * fko_set_spa_hmac_type: Setting SPA Data. (line 19) * fko_set_spa_message: Setting SPA Data. (line 63) * fko_set_spa_message_type: Setting SPA Data. (line 56) * fko_set_spa_nat_access: Setting SPA Data. (line 69) * fko_set_spa_server_auth: Setting SPA Data. (line 75) * fko_set_timestamp: Setting SPA Data. (line 52) * fko_set_username: Setting SPA Data. (line 42) * fko_spa_data_final: Utility Functions. (line 16) * spa_message_fields: SPA Data Format. (line 12)  Tag Table: Node: Top1117 Node: Introduction4313 Node: Getting Started6023 Node: Features6619 Node: Overview7677 Node: SPA Data Format8736 Node: Preparation11372 Node: libfko Header11932 Node: Compiling with libfko12475 Node: SPA Parameter Types13560 Node: Digests14072 Node: SPA Messages15135 Node: Encryption Algorithms17255 Node: HMAC Digests18393 Node: Using libfko19294 Node: Creating Contexts20133 Node: Destroying Contexts25120 Node: Creating a SPA Message25741 Node: Setting SPA Data30575 Node: Retrieving SPA Data38136 Node: Utility Functions47119 Node: Error Handling50500 Node: Library Copying65846 Node: Concept Index85138 Node: Function and Data Index88385  End Tag Table