.\" Automatically generated by Pod::Man 2.28 (Pod::Simple 3.28)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is turned on, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{
.    if \nF \{
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "FKO 3pm"
.TH FKO 3pm "2014-01-13" "perl v5.20.0" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
FKO \- Perl module wrapper for libfko
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
.Vb 1
\&  use FKO;
\&
\&  # Create a new empty FKO object.
\&  #
\&  my $fko = FKO\->new();
\&
\&  if(!$fko) {
\&    die "Unable to create FKO object: $FKO::error_str\en";
\&  }
\&
\&  # Override the username (default is current user).
\&  #
\&  my $err = $fko\->username(\*(Aqjoeuser\*(Aq);
\&  if($err) {
\&    die "Error setting username: ", $fko\->errstr($err), "\en";
\&  }
\&
\&  # Set the SPA message (see libfko docs for details).
\&  #
\&  $err = $fko\->spa_message(\*(Aq1.2.3.4,tcp/22\*(Aq);
\&    # ..error checking, etc...
\&
\&  $err = $fko\->spa_data_final(\*(Aqmycryptkey\*(Aq, \*(Aqmyhmackey\*(Aq);
\&    # ..error checking, etc...
\&
\&  # Get the encrypted/authenticated/encoded SPA data.
\&  #
\&  my $spa_data = $fko\->spa_data();
\&
\&  ## Incoming SPA data ##
\&
\&  # Create an FKO object to process incoming (or existing)
\&  # SPA data.
\&  #
\&  my $fko_in = FKO\->new($enc_spa_data, \*(Aqmycryptkey\*(Aq,
\&        FKO::FKO_ENC_MODE_CBC, \*(Aqmyhmackey\*(Aq, FKO::FKO_HMAC_SHA256)
\&    or die "Unable to create FKO object: $FKO::error_str\en";
\&
\&  my $timestamp = $fko_in\->timestamp();
\&  my $fko_user  = $fko_in\->username();
\&  my $spa_msg   = $fko_in\->spa_message();
\&  my $digest    = $fko_in\->spa_digest();
\&
\&  # Pull the digest type.
\&  my $digest_type = $fko_in\->spa_digest_type();
\&
\&  if($digest_type == FKO::FKO_DIGEST_SHA256) {
\&      # do something
\&  } elsif($digest_type == FKO::FKO_DIGEST_MD5) {
\&      # do something else
\&  }
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
This module is essentially a Perl wrapper for the \fIFirewall Knock Operator\fR
(fwknop) library, \f(CW\*(C`libfko\*(C'\fR.  Fwknop is an open source implementation of
\&\fISingle Packet Authorization\fR (\fI\s-1SPA\s0\fR) for access to networked resources
that are protected by a default-drop packet filter.
.PP
The original \fIfwknop\fR is implemented in Perl.  The \fIlibfko\fR library is
an implementation of the \fIfwknop\fR back-end data processing routines written
in C as part of the project to move all of \fIfwknop\fR to C.
.PP
See the \f(CW\*(C`libfko\*(C'\fR documentation for additional information on usage and the
functionality provided by \f(CW\*(C`libfko\*(C'\fR.  More information on \fI\s-1SPA\s0\fR and \fIfwknop\fR
can be found at http://www.cipherdyne.org/fwknop.
.SH "CONSTRUCTOR"
.IX Header "CONSTRUCTOR"
.IP "\fBnew( )\fR" 4
.IX Item "new( )"
.PD 0
.ie n .IP "\fBnew($spa_data, \fB$password\fB, \f(BI$enc_type\fB, \f(CB$hmac_key\fB, \f(CB$hmac_type\fB)\fR" 4
.el .IP "\fBnew($spa_data, \f(CB$password\fB, \f(CB$enc_type\fB, \f(CB$hmac_key\fB, \f(CB$hmac_type\fB)\fR" 4
.IX Item "new($spa_data, $password, $enc_type, $hmac_key, $hmac_type)"
.PD
The \f(CW\*(C`new\*(C'\fR method creates the \fI\s-1FKO\s0\fR object.  With no arguments, it creates
creates and empty \fI\s-1FKO\s0\fR object ready to be popluated with data (i.e. create
a new \s-1SPA\s0 data packet to send).
.Sp
You can also pass existing encoded/encrypted \fI\s-1SPA\s0\fR data, a decryption
password, and an \s-1HMAC\s0 key (along with associated encryption and \s-1HMAC\s0 modes) to
\&\f(CW\*(C`new\*(C'\fR.  This will create a new object, authenticate, decrypt, and decode the
data, and store it within the object for later retrieval using the various
methods described below.
.Sp
If there are any errors during the creation or decoding of the data \fInew\fR
will return undef and the appropriate error message will be available in the
\&\f(CW$FKO::error_str\fR variable.
.Sp
Create an empty object:
.Sp
.Vb 1
\&    my $fko = FKO\->new();
.Ve
.Sp
Create an object using existing data:
.Sp
.Vb 2
\&    my $fko = FKO\->new($spa_data, \*(Aqdecrypt_pw\*(Aq, FKO::FKO_ENC_MODE_CBC,
\&            \*(Aqmyhmackey\*(Aq, FKO::FKO_HMAC_SHA256);
.Ve
.SH "METHODS"
.IX Header "METHODS"
.SS "Utility Methods"
.IX Subsection "Utility Methods"
The utility methods are those that perform the non\-data\-set/get functions
like error messages, data processing, and clean-up.
.IP "\fBdestroy( )\fR" 4
.IX Item "destroy( )"
The \f(CW\*(C`destroy\*(C'\fR method is used when you are done with the \fI\s-1FKO\s0\fR object and its
data.  This method will make the appropriate \fIlibfko\fR calls to clean-up and
release resources used by the object.
.Sp
Though \f(CW\*(C`destroy\*(C'\fR will be called if the object goes out of scope, it is good
practice to clean up after yourself.  This is especially true if you are
processing multiple \fI\s-1SPA\s0\fR messages in a loop, etc.
.IP "\fBerrstr($err_code)\fR" 4
.IX Item "errstr($err_code)"
This method returns the descriptive error message string for the given
error code value.
.IP "\fBgpg_errstr( )\fR" 4
.IX Item "gpg_errstr( )"
If the previous \fI\s-1FKO\s0\fR error was from a GPG-related function, then calling
this method may return more detailed information from the \s-1GPG\s0 error handling
system.
.ie n .IP "\fBspa_data_final($enc_key, \fB$hmac_key\fB)\fR" 4
.el .IP "\fBspa_data_final($enc_key, \f(CB$hmac_key\fB)\fR" 4
.IX Item "spa_data_final($enc_key, $hmac_key)"
This function is the final step in creating a complete encrypted and
authenticated \fI\s-1SPA\s0\fR data string suitable for transmission to an fwknop server.
It does require all of the requisite \fI\s-1SPA\s0\fR data fields be set.  Otherwise it
will fail and return the appropriate error code.
.IP "\fBencrypt_spa_data( )\fR" 4
.IX Item "encrypt_spa_data( )"
Encrypts the intermediate encoded \fI\s-1SPA\s0\fR data stored in the context. The
internal \fIlibfko\fR encryption function will call the internal
\&\f(CW\*(C`encode_spa_data\*(C'\fR if necessary.
.Sp
This function is normally not called directly as it is automatically called
from the internal \f(CW\*(C`fko_spa_data_final\*(C'\fR function (which is wrapped by this
module's \f(CW\*(C`spa_data_final\*(C'\fR function.
.IP "\fBdecrypt_spa_data( )\fR" 4
.IX Item "decrypt_spa_data( )"
When given the correct \fIkey\fR (passsword), this function decrypts, decodes,
and parses the encrypted \fI\s-1SPA\s0\fR data contained in the current context.
Once the data is decrypted, the \fIlibfko\fR internal function will also call
the \fIlibfko\fR decode function to decode, parse, validate, and store the data
fields in the context for later retrieval.
.Sp
Note: This function does not need to be called directly if encrypted \fI\s-1SPA\s0\fR
data was passed to this module's constructor when the object was created as
the \f(CW\*(C`new\*(C'\fR function will call decrypt and decode itself.
.IP "\fBencode_spa_data( )\fR" 4
.IX Item "encode_spa_data( )"
Instructs \fIlibfko\fR to perform the base64 encoding of those \fI\s-1SPA\s0\fR data
fields that need to be encoded, perform some data validation, compute and
store the message digest hash for the \fI\s-1SPA\s0\fR data.
.Sp
This function is normally not called directly as it is called by other
\&\fIlibfko\fR functions during normal processing (i.e during encypt and/or final
functions.
.IP "\fBdecode_spa_data( )\fR" 4
.IX Item "decode_spa_data( )"
This function hands of the data to the \fIlibfko\fR decoding routines which
perform the decoding, parsing, and validation of the \fI\s-1SPA\s0\fR data that was
just decrypted.
.Sp
This function is normally not called directly as it is called by other
\&\fIlibfko\fR functions during normal processing.
.SS "Working with \s-1SPA\s0 Data Types"
.IX Subsection "Working with SPA Data Types"
There are a few data and method types supported by \fIlibfko\fR, along with a
few functions for getting and setting them.  Most of these \fItypes\fR are
represented using constants defined in the \fI\s-1FKO\s0\fR module.
.IP "\fBencryption_type( )\fR" 4
.IX Item "encryption_type( )"
.PD 0
.IP "\fBencryption_type(\s-1FKO_ENCRYPTION_TYPE\s0)\fR" 4
.IX Item "encryption_type(FKO_ENCRYPTION_TYPE)"
.PD
Get or set the encryption type for the current context.  If no argument is
given, the current value is returned.  Otherwise the encryption type will be
set to the given value.
.Sp
The encryption type parameter is an integer value.  Constants have been
defined to represent this value.  Currently, the only supported encryption
types are:
.RS 4
.IP "\(bu" 4
\&\fB\s-1FKO_ENCRYPTION_RIJNDAEL\s0\fR
.Sp
The default \fIlibfko\fR encryption algorithm.
.IP "\(bu" 4
\&\fB\s-1FKO_ENCRYPTION_GPG\s0\fR
.Sp
GnuPG encryption (if supported by the underlying \fIlibfko\fR implementation).
.RE
.RS 4
.RE
.IP "\fBhmac_type( )\fR" 4
.IX Item "hmac_type( )"
.PD 0
.IP "\fBhmac_type(\s-1FKO_HMAC_TYPE\s0)\fR" 4
.IX Item "hmac_type(FKO_HMAC_TYPE)"
.PD
Get or set the \s-1HMAC\s0 digest algorithm for the current context.  If no argument
is given, the current value is returned.  Otherwise the \s-1HMAC\s0 type will be set
to the given value.
.Sp
The \s-1HMAC\s0 type parameter is an integer value.  Constants have been
defined to represent this value.  Currently, the supported \s-1HMAC\s0 types are:
.RS 4
.IP "\(bu" 4
\&\fB\s-1FKO_HMAC_SHA256\s0\fR
.Sp
The default \fIlibfko\fR \s-1HMAC\s0 digest algorithm is \s-1SHA\-256\s0
.IP "\(bu" 4
\&\fB\s-1FKO_HMAC_MD5\s0\fR
.Sp
Use the \s-1MD5\s0 digest algorithm (not recommended) to generate the \s-1HMAC.\s0
.IP "\(bu" 4
\&\fB\s-1FKO_HMAC_SHA1\s0\fR
.Sp
Use the \s-1SHA\-1\s0 digest algorithm to generate the \s-1HMAC.\s0
.IP "\(bu" 4
\&\fB\s-1FKO_HMAC_SHA512\s0\fR
.Sp
Use the \s-1SHA\-512\s0 digest algorithm to generate the \s-1HMAC.\s0
.RE
.RS 4
.RE
.IP "\fBdigest_type( )\fR" 4
.IX Item "digest_type( )"
.PD 0
.IP "\fBdigest_type(\s-1FKO_DIGEST_TYPE\s0)\fR" 4
.IX Item "digest_type(FKO_DIGEST_TYPE)"
.PD
Get or set the digest type for the current context.  If no argument is
given, the current value is returned.  Otherwise digest type will be set
to the given value.
.Sp
The digest type parameter is an integer value.  Constants have been
defined to represent this value.  Currently, the supported digest
types are:
.RS 4
.IP "\(bu" 4
\&\fB\s-1FKO_DIGEST_MD5\s0\fR
.Sp
The \s-1MD5\s0 message digest algorithm.
.IP "\(bu" 4
\&\fB\s-1FKO_DIGEST_SHA1\s0\fR
.Sp
The \s-1SHA1\s0 message digest algorithm.
.IP "\(bu" 4
\&\fB\s-1FKO_DIGEST_SHA256\s0\fR
.Sp
The \s-1SHA256\s0 message digest algorithm. This is the \fIlibfko\fR default.
.IP "\(bu" 4
\&\fB\s-1FKO_DIGEST_SHA384\s0\fR
.Sp
The \s-1SHA384\s0 message digest algorithm. This is the \fIlibfko\fR default.
.IP "\(bu" 4
\&\fB\s-1FKO_DIGEST_SHA512\s0\fR
.Sp
The \s-1SHA512\s0 message digest algorithm. This is the \fIlibfko\fR default.
.RE
.RS 4
.RE
.IP "\fBspa_message_type( )\fR" 4
.IX Item "spa_message_type( )"
.PD 0
.IP "\fBspa_message_type(\s-1FKO_MSG_TYPE\s0)\fR" 4
.IX Item "spa_message_type(FKO_MSG_TYPE)"
.PD
Get or set the \fI\s-1SPA\s0\fR message type.  If no argument is given, the current
value is returned.  Otherwise message type will be set to the given value.
.Sp
The message type parameter is an integer value.  Constants have been
defined to represent this value.  Currently, the supported digest
types are:
.RS 4
.IP "\(bu" 4
\&\fB\s-1FKO_COMMAND_MSG\s0\fR
.Sp
A request to have the fwknop server execute the given command.  The format
for this type is: \f(CW\*(C`<ip of requestor>:<command text>\*(C'\fR
.Sp
For example:
    \*(L"192.168.1.2:uname \-a\*(R"
.IP "\(bu" 4
\&\fB\s-1FKO_ACCESS_MSG\s0\fR
.Sp
A basic access request.  This is the most common type in use. The format
for this type is: \f(CW\*(C`<ip of requestor>:<protocol>/<port>\*(C'\fR.
.Sp
For example:
    \*(L"192.168.1.2:tcp/22\*(R"
.IP "\(bu" 4
\&\fB\s-1FKO_NAT_ACCESS_MSG\s0\fR
.Sp
An access request that also provide information for the fwknop server to
create a Network Address Translation (\s-1NAT\s0 to an internal address. The format
for this string is: \f(CW\*(C`<internal ip>,<ext nat port>\*(C'\fR.
.Sp
For example:
    \*(L"10.10.1.2,9922\*(R"
.IP "\(bu" 4
\&\fB\s-1FKO_CLIENT_TIMEOUT_ACCESS_MSG\s0\fR
.Sp
This is an \f(CW\*(C`FKO_ACCESS_REQUEST\*(C'\fR with a timeout parameter for the fwknop
server.  The timeout value is provided via the \f(CW\*(C`client_timeout\*(C'\fR data field.
.IP "\(bu" 4
\&\fB\s-1FKO_CLIENT_TIMEOUT_NAT_ACCESS_MSG\s0\fR
.Sp
This is an \f(CW\*(C`FKO_NAT_ACCESS_REQUEST\*(C'\fR with a timeout parameter for the fwknop
server.  The timeout value is provided via the \f(CW\*(C`client_timeout\*(C'\fR data field.
.IP "\(bu" 4
\&\fB\s-1FKO_LOCAL_NAT_ACCESS_MSG\s0\fR
.Sp
This is similar to the \f(CW\*(C`FKO_NAT_ACCESS\*(C'\fR request exept the \s-1NAT\s0 is to the
local to the server (i.e. a service listening on 127.0.0.1).
.IP "\(bu" 4
\&\fB\s-1FKO_CLIENT_TIMEOUT_LOCAL_NAT_ACCES_MSG\s0\fR
.Sp
This is an \f(CW\*(C`FKO_LOCAL_NAT_ACCESS_REQUEST\*(C'\fR with a timeout parameter for the
fwknop server.  The timeout value is provided via the \f(CW\*(C`client_timeout\*(C'\fR data
field.
.RE
.RS 4
.RE
.SS "Working With \s-1SPA\s0 Data"
.IX Subsection "Working With SPA Data"
The \fI\s-1SPA\s0\fR data methods are used for setting or retrieving the various \fI\s-1SPA\s0\fR
data field values.  Some of these simply return a read-only value, while
others are used to set or get values.
.PP
\&\fBNote:\fR The following methods are presented roughly in the order their
respective data values appear in an \fIfwknop\fR \fI\s-1SPA\s0\fR message.  Many of these
have reasonable default values at creation and are not typically used in
most circumstances.
.IP "\fBrand_value( )\fR" 4
.IX Item "rand_value( )"
.PD 0
.IP "\fBrand_value($new_value)\fR" 4
.IX Item "rand_value($new_value)"
.PD
Get or set the random value portion of the \fI\s-1SPA\s0\fR data. If setting the
random value, you must pass either a 16\-character decimal number (to
set it to the given number), or the value \f(CW0\fR to have a new random value
generated by \fIlibfko\fR.
.Sp
If a provided value is not a valid 16\-character decimal string, the function
will return the \f(CW\*(C`FKO_ERROR_INVALID_DATA\*(C'\fR error code.
.Sp
Upon creation of a new \fI\s-1FKO\s0\fR object, this value is automatically generated.
.IP "\fBusername( )\fR" 4
.IX Item "username( )"
.PD 0
.IP "\fBusername($username)\fR" 4
.IX Item "username($username)"
.PD
Set or get the username field of the \fI\s-1SPA\s0\fR data. If no argument is given,
given, this function will return the current value.  Otherwise, the username
value will be set to the name provided.
.Sp
If a value of \f(CW0\fR is given, \fIlibfko\fR will attempt to determine and set the
username by first looking for the environment variable \f(CW\*(C`SPOOF_USER\*(C'\fR and use
its value if found.  Otherwise, it will try to determine the username
itself using various system methods, then fallback to the environment
variables \f(CW\*(C`LOGNAME\*(C'\fR or \f(CW\*(C`USER\*(C'\fR. If none of those work, the function will
return the \f(CW\*(C`FKO_ERROR_USERNAME_UNKNOWN\*(C'\fR error code.
.Sp
Upon creation of a new \fI\s-1FKO\s0\fR object, this value is automatically generated
based on the \fIlibfko\fR method described above.
.IP "\fBtimestamp( )\fR" 4
.IX Item "timestamp( )"
.PD 0
.IP "\fBtimestamp($offset)\fR" 4
.IX Item "timestamp($offset)"
.PD
Gets or sets the timestamp value of the \s-1SPA\s0 data.  If no argument is given,
the current value is returned.
.Sp
If an argument is provided, it will represent an offset to be applied to the
current timestamp value at the time this function was called.
.Sp
Upon creation of a new \fI\s-1FKO\s0\fR object, this value is automatically generated
based on the time of object creation.
.IP "\fBversion( )\fR" 4
.IX Item "version( )"
Returns the \fIfwknop\fR version string.  This version represents the supported
\&\fIfwknop\fR \fI\s-1SPA\s0\fR message format and features.  This has nothing to do with
the version of this module.
.IP "\fBspa_message( )\fR" 4
.IX Item "spa_message( )"
.PD 0
.IP "\fBspa_message($spa_msg)\fR" 4
.IX Item "spa_message($spa_msg)"
.PD
Get or set the \fI\s-1SPA\s0\fR message string.  If no argument is given, the current
value is returned.  Otherwise \fI\s-1SPA\s0\fR message string will be set to the given
value.
.IP "\fBspa_nat_access( )\fR" 4
.IX Item "spa_nat_access( )"
.PD 0
.IP "\fBspa_nat_access($nat_access)\fR" 4
.IX Item "spa_nat_access($nat_access)"
.PD
Get or set the \fI\s-1SPA\s0\fR nat access string.  If no argument is given, the
current value is returned.  Otherwise \fI\s-1SPA\s0\fR nat access string will be set
to the given value.
.IP "\fBspa_server_auth( )\fR" 4
.IX Item "spa_server_auth( )"
.PD 0
.IP "\fBspa_server_auth($server_auth)\fR" 4
.IX Item "spa_server_auth($server_auth)"
.PD
Get or set the \fI\s-1SPA\s0\fR server auth string.  If no argument is given, the
current value is returned.  Otherwise \fI\s-1SPA\s0\fR server auth string will be set
to the given value.
.IP "\fBspa_client_timeout( )\fR" 4
.IX Item "spa_client_timeout( )"
.PD 0
.IP "\fBspa_client_timeout($new_timeout)\fR" 4
.IX Item "spa_client_timeout($new_timeout)"
.PD
Get or set the \fI\s-1SPA\s0\fR message client timeout value.  This is an integer
value. If no argument is given, the current value is returned.  Otherwise
\&\fI\s-1SPA\s0\fR message client timeout value will be set to the given value.
.IP "\fBspa_digest( )\fR" 4
.IX Item "spa_digest( )"
.PD 0
.IP "\fB\f(BIspa_digest\fB\|(1)\fR" 4
.IX Item "spa_digest"
.PD
When called with no argument, the \f(CW\*(C`spa_digest\*(C'\fR function returns the digest
associated with the current data (if available).  If a true value (i.e. \f(CW1\fR)
is given as the argument, it will force a recompute of the digest based on
the data and the configured \fIdigest_type\fR.
.Sp
This function is normally not called directly as it is called by other
\&\fIlibfko\fR functions during normal processing.
.IP "\fBencoded_data( )\fR" 4
.IX Item "encoded_data( )"
Returns the encoded \fI\s-1SPA\s0\fR data as it would be just before the encryption
step.  This is not generally useful unless you are debugging a data issue.
.IP "\fBspa_data( )\fR" 4
.IX Item "spa_data( )"
.PD 0
.IP "\fBspa_data($spa_data)\fR" 4
.IX Item "spa_data($spa_data)"
.PD
Get or set the \fI\s-1SPA\s0\fR data string.  If no argument is given, the current
value is returned.  This would be the final encrypted and encoded string
of data that is suitable for sending to an \fIfwkno\fR server.
.Sp
If an argument is given, it is expected to be an existing encrypted and
encoded \fI\s-1SPA\s0\fR data string (perhaps data received by an \fIfwknop\fR server).
The provided data is stored in the object (the current context).
.Sp
Note: When data is provided via this function, it is not automatically
decoded. You would need to call \f(CW\*(C`decrypt_spa_data($pw)\*(C'\fR to complete the
decryption, decoding, and parsing process.
.IP "\fBgpg_recipient( )\fR" 4
.IX Item "gpg_recipient( )"
.PD 0
.IP "\fBgpg_recipient($gpg_id)\fR" 4
.IX Item "gpg_recipient($gpg_id)"
.PD
Get or set the gpg_recipient.  This is the \s-1ID\s0 or email of the public \s-1GPG\s0 key
of the intended recipient.  In order for this function to work, the following
condition must be met:
.RS 4
.IP "\(bu" 4
The underlying \fIlibfko\fR implementation nust have \s-1GPG\s0 support.
.IP "\(bu" 4
The \fIencryption_type\fR must be set to \f(CW\*(C`FKO_ENCRYPTION_GPG\*(C'\fR.
.IP "\(bu" 4
The specified \s-1GPG\s0 key must exist and be valid.
.RE
.RS 4
.Sp
If no argument is given, the current value is returned.  Otherwise,
gpg_recipient will be set to the given value.
.RE
.IP "\fBgpg_signer( )\fR" 4
.IX Item "gpg_signer( )"
.PD 0
.IP "\fBgpg_signer($gpg_id)\fR" 4
.IX Item "gpg_signer($gpg_id)"
.PD
Get or set the gpg_signer.  This is the \s-1ID\s0 or email for the secret \s-1GPG\s0 key
to be used to sign the encryped data.  In order for this function to work,
the following condition must be met:
.RS 4
.IP "\(bu" 4
The underlying \fIlibfko\fR implementation nust have \s-1GPG\s0 support.
.IP "\(bu" 4
The \fIencryption_type\fR must be set to \f(CW\*(C`FKO_ENCRYPTION_GPG\*(C'\fR.
.IP "\(bu" 4
The specified \s-1GPG\s0 key must exist and be valid.
.RE
.RS 4
.Sp
If no argument is given, the current value is returned.  Otherwise,
gpg_signer will be set to the given value.
.RE
.IP "\fBgpg_home_dir( )\fR" 4
.IX Item "gpg_home_dir( )"
.PD 0
.IP "\fBgpg_home_dir($new_dir)\fR" 4
.IX Item "gpg_home_dir($new_dir)"
.PD
Get or set the \s-1GPG\s0 home directory.  This is the directory that holds the
\&\s-1GPG\s0 keyrings, etc. In order for this function to work, the following
condition must be met:
.RS 4
.IP "\(bu" 4
The underlying \fIlibfko\fR implementation nust have \s-1GPG\s0 support.
.IP "\(bu" 4
The \fIencryption_type\fR must be set to \f(CW\*(C`FKO_ENCRYPTION_GPG\*(C'\fR.
.IP "\(bu" 4
The specified \s-1GPG\s0 home directory must exist.
.RE
.RS 4
.Sp
If no argument is given, the current value is returned.  Otherwise,
gpg_home_dir will be set to the given value.
.RE
.PP
\fI\s-1GPG\s0 Signature Verification\fR
.IX Subsection "GPG Signature Verification"
.PP
By default libfko will attempt to verify \s-1GPG\s0 signatures when decrypting
GPG-encrypted data.  If the signature is missing, expired, revoked, or 
otherwise bad, the decoding operation will fail.
.PP
The following functions are provided to process \s-1GPG\s0 key information, or
manage how libfko deals with \s-1GPG\s0 signatures.  Like the other GPG-related
functions, these also have the following prerequisites:
.IP "\(bu" 4
The underlying \fIlibfko\fR implementation nust have \s-1GPG\s0 support.
.IP "\(bu" 4
The \fIencryption_type\fR must be set to \f(CW\*(C`FKO_ENCRYPTION_GPG\*(C'\fR.
.IP "\fBgpg_signature_verify( )\fR" 4
.IX Item "gpg_signature_verify( )"
.PD 0
.IP "\fBgpg_signature_verify($bool)\fR" 4
.IX Item "gpg_signature_verify($bool)"
.PD
Get or set the \s-1GPG\s0 signature verification flag.  If true (1), then \s-1GPG\s0
signatures are processed by libfko.  This is the default behavior.  If
set to false (0), then libfko will not even look for or at any \s-1GPG\s0
signatures and will proceed with a decoding the \s-1SPA\s0 data.
.Sp
If no argument is given, the current value is returned.  Otherwise,
the gpg_signature_verify flag will be set to the given value.
.IP "\fBgpg_ignore_verify_error( )\fR" 4
.IX Item "gpg_ignore_verify_error( )"
.PD 0
.IP "\fBgpg_ignore_verify_error($bool)\fR" 4
.IX Item "gpg_ignore_verify_error($bool)"
.PD
Get or set the \s-1GPG\s0 signature ignore verification error flag.  If true (1),
then \s-1GPG\s0 signatures are processed and retained by libfko, but a bad signature
will not prevent the decoding phase.  The default is to not ignore errors.
.Sp
If no argument is given, the current value is returned.  Otherwise,
the gpg_ignore_verify_error flag will be set to the given value.
.IP "\fBgpg_signature_id( )\fR" 4
.IX Item "gpg_signature_id( )"
Get \s-1ID\s0 of the \s-1GPG\s0 signature from the last decryption operation.
.IP "\fBgpg_signature_fpr( )\fR" 4
.IX Item "gpg_signature_fpr( )"
Get Fingerprint of the \s-1GPG\s0 signature from the last decryption operation.
.IP "\fBgpg_signature_summary( )\fR" 4
.IX Item "gpg_signature_summary( )"
Get \s-1GPGME\s0 signature summary value of the \s-1GPG\s0 signature from the last
decryption operation. This value is a bitmask that hold additional 
information on the signature (see \s-1GPGME\s0 docs for more information).
.IP "\fBgpg_signature_status( )\fR" 4
.IX Item "gpg_signature_status( )"
Get error status of the \s-1GPG\s0 signature from the last decryption operation.
This value is a \s-1GPGME\s0 error code (see \s-1GPGME\s0 docs for more information).
.IP "\fBgpg_signature_id_match($id)\fR" 4
.IX Item "gpg_signature_id_match($id)"
Compare the given \s-1ID\s0 with the id of the \s-1GPG\s0 signature of the last decryption
operation.  If the \s-1ID\s0's match, then a true value is returned. Otherwise
false is returned.
.IP "\fBgpg_signature_fpr_match($id)\fR" 4
.IX Item "gpg_signature_fpr_match($id)"
Compare the given fingerprint value with the fingerprint of the \s-1GPG\s0 signature
of the last decryption operation.  If the \s-1ID\s0's match, then a true value is
returned. Otherwise false is returned.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
Perl, the \f(CW\*(C`libfko\*(C'\fR manual.
.PP
Additional information on the Firewall Knock Operater (\fIfwknop\fR) can
be found at http://www.cipherdyne.org/fwknop.
.SH "AUTHOR"
.IX Header "AUTHOR"
Damien S. Stuart, <dstuart@dstuart.org>
.SH "COPYRIGHT AND LICENSE"
.IX Header "COPYRIGHT AND LICENSE"
Copyright (C) 2009 by Damien S. Stuart
.PP
This library is free software; you can redistribute it and/or modify
it under the same terms as Perl itself, either Perl version 5.8.8 or,
at your option, any later version of Perl 5 you may have available.