     [file version.texi not included]

Main Menu
*********

This manual is for the Firewall Knock Operator library, libfko. (version VERSION, last updated UPDATED).

Copyright © 2009-2013 Damien Stuart.

     The libfko manual is free; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

     The libfko manual is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

     You should have received a copy of the GNU General Public License along with this manual; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA

Introduction
************

The ``Firewall Knock Operator Library'' (libfko) is a C language library that implements the functions needed to create and/or parse Single Packet Authorization (SPA) data.  It is designed to abstract the details of encoding, encryption, decoding, parsing, and verifying SPA messages such as those used by Michael Rash's Firewall Knock Operator (fwknop).

fwknop implements an authorization scheme known as Single Packet Authorization (SPA) for strong service protection.  SPA requires only a single packet which is encrypted, non-replayable, and authenticated via an HMAC in order to communicate desired access to a service that is hidden behind a firewall in a default-drop filtering stance.  The main application of SPA is to use a firewall to drop all attempts to connect to services such as 'SSH' in order to make the exploitation of vulnerabilities (both 0-day and unpatched code) more difficult.  Any service that is protected by SPA naturally cannot be scanned for with 'Nmap'.  The fwknop project supports three different firewalls: 'iptables' on Linux systems, 'pf' on OpenBSD, and 'ipfw' on FreeBSD and Mac OS X.

libfko is not an implementation of an fwknop client or server.  It simply provides the functions for managing the SPA data used by those programs.

For more information on fwknop and SPA, go to http://www.cipherdyne.org/fwknop.

Getting Started
===============

This manual documents the ``Firewall Knock Operator'' library programming interface.  All functions and data types provided by the library are explained.

This manual can be used in a couple of ways.  If read from the beginning to the end, it should give a good introduction into the library and how it can be used in an application.  Later on, the manual can be used as a reference manual to get just the information needed about any particular interface of the library.

Features
========

The primary advantage of using libfko is it provides a single API for either creating or parsing SPA data.  Additional advantages include:

It's free software
     Anybody can use, modify, and redistribute it under the terms of the GNU General Public License v2 or any later version (see Library Copying).

It's lightweight
     The Perl-based implementation requires several additional Perl modules and has a relatively large footprint in memory.  This C-based library eliminates those dependencies and has a much smaller footprint. Using this library allows SPA to easily function on embedded operating systems such as OpenWRT.

It's easy
     libfko hides many of the gory details of fwknop's SPA message data format, encoding, decoding, encrypting, decrypting, authenticating, and parsing. In most cases, only a few function calls will be needed create or parse a SPA message.

Overview
========

libfko functionality can be divided into two roles.  One is the creation of an encrypted SPA message together with an HMAC for authentication. The other is the taking an encrypted SPA message to authenticate, decode, parse, and extract the original data.

The actual SPA data handling and operations are set within a context.  The context represents a single SPA message and provides configuration parameters and data settings for defining that message. All operations on the data occur within that context.

Some operations on the context must occur before others.  Details of these dependencies are covered in Creating a SPA Message.

With libfko, working with SPA message data basically consists of the following steps in order:

  * Create a new context

  * Work with (get/set) the SPA data fields

  * Destroy the context

SPA Data Format
---------------

The format of the SPA message data used by fwknop (before encryption and before an HMAC is applied) is a colon-delimited string containing the individual SPA data fields. Some of these fields are base64-encoded in the final encoding process as dictated by the current fwknop implementation.

 -- Variable: data spa_message_fields
     Using the libfko names for the data fields, the list of these fields (in order) follows:

     rand_value - Default: Random (created upon context creation)
          A 16-byte random numeric string.

     username - Default: Current login user or Value of SPOOF_USER env var
          The base64-encoded username associated with this SPA data.

     timestamp - Default: The Unix time at creation
          The Unix timestamp value.

     version - Default: the current fwknop version
          The current fwknop version that supports this format.  This field is not user settable.

     spa_message_type - Default: SPA access message (FKO_ACCESS_MSG)
          The SPA message type value for this message.

     spa_message
          The base64-encoded SPA message itself (an access request or command string).

     spa_nat_access
          An optional base64-encoded request for NAT access.

     spa_server_auth
          An optional base64-encoded string that can  be used as an additional authentication mechanism at the fwknop server.

     spa_client_timeout
          An optional client timeout value that can be supplied to the fwknop server.

     spa_digest - Computed value
          The digest of the previous fields (including the delimiters).

With all fields defined, a complete (unencoded) SPA message would look something like the following example (Note: The line is broken for readability and the username, message, nat_access, and server_auth fields are not base64-encoded):

     8307540982176539:juser:1230665172:2.5:1:1.1.1.1,tcp/22:192.168.1.2,22:
     crypt,mypw:120:xswj8V0zMR7/7MV9pQRarSKWG1l9Zfjv+kbXaKrJ+RA

For most of the fields, you need not be too concerned about the format as libfko handles that.  The exceptions are the spa_message, spa_nat_access, and spa_server_auth.  The formats for these are not handled by libfko during creation.  However, they are checked for format validity during the endcoding and decoding (when parsing incoming) SPA data.  More information on the specifics of the formats for these fields can be found in SPA Messages.

Preparation
***********

This chapter provides information needed to prepare for using libfko in your programs.

libfko Header
=============

All interfaces (data types and functions) of the library are defined in the header file `fko.h'.  You must include this in all programs using the library, either directly or through some other header file, like this:

     #include <fko.h>

The name space of FKO is fko_* for function names and data types and FKO_* for other symbols. Other symbols internal to FKO may take the form _fko_* and _FKO_*.

Compiling with libfko
=====================

If you want to compile a source file including the `fko.h' header file, you must make sure that the compiler can find it in the directory hierarchy.  This is accomplished by adding the path to the directory in which the header file is located to the compilers include file search path (via the -I option).

For example, if you installed libfko in /opt/fko, you may want to add -I/opt/fko/include to CFLAGS, or directly on the command-line:

     gcc -c foo.c -I/opt/fko/include ...

The same is true when linking a program with the library.  In this case, the linker has to find the library files.  For this to work, the path to the library files has to be added to the library search path (via the -L option).

Continuing with the example above you may want to add -L/opt/fko/lib to LDFLAGS, or directly on the command-line:

     gcc -o foo foo.c -I/opt/fko/include -L/opt/fko/lib -lfko

SPA Parameter Types
===================

Digests
-------

The fwknop system employs a message digest hash of the SPA data as one of the data fields to act a signature which can be used at the receiving end to verify the data is valid (although this feature has been superceded by the usage of an HMAC for proper message authentication and verification of integrity).  The resulting digest is base64-encoded before it is added to the SPA data.

Currently, libfko supports the same message digests as the legacy fwknop plus two others (SHA384 and SHA512).  These are (in order of strength):

 -- Variable: int fko_digest_type_t

     FKO_DIGEST_MD5

     FKO_DIGEST_SHA1

     FKO_DIGEST_SHA256  (libfko default)

     FKO_DIGEST_SHA384

     FKO_DIGEST_SHA512

As indicated in the list above, SHA256 is the default.  This means the digest type does not need to be explicitly set unless you wish to use one of the other values.  This applies to all libfko SPA data fields that have a default value.

SPA Messages
------------

The fwknop system (and subsequently libfko), support a specific set of message types.  The message type value is used by fwknop to help determine the correct message format and content.  These message types are:

 -- Variable: int fko_message_type_t

     FKO_COMMAND_MSG
          A request to have the fwknop server execute the given command.  The format for this type is: <ip of requestor>,<command text>.

               "192.168.1.2,uname -a"

     FKO_ACCESS_MSG
          A basic access request.  This is the most common type in use. The format for this type is: <ip of requestor>,<protocol>/<port>.  Note that mulitple protocol/port entries are allowed.

               "192.168.1.2,tcp/22"
               "192.168.1.2,tcp/22,udp/5005"

     FKO_NAT_ACCESS_MSG
          An access request that also provide information for the fwknop server to create a Network Address Translation (NAT to an internal address. The format for this string is: <internal ip>,<ext nat port>.

               "10.10.1.2,9922"

     FKO_CLIENT_TIMEOUT_ACCESS_MSG
          This is an FKO_ACCESS_REQUEST with a timeout parameter for the fwknop server. The timeout value is provided via the client_timeout data field.

     FKO_CLIENT_TIMEOUT_NAT_ACCESS_MSG
          This is an FKO_NAT_ACCESS_REQUEST with a timeout parameter for the fwknop server.  The timeout value is provided via the client_timeout data field.

     FKO_LOCAL_NAT_ACCESS_MSG
          This is similar to the FKO_NAT_ACCESS request except the NAT is to the local to the server (i.e. a service listening on 127.0.0.1).

     FKO_CLIENT_TIMEOUT_LOCAL_NAT_ACCESS_MSG
          This is an FKO_LOCAL_NAT_ACCESS_REQUEST with a timeout parameter for the fwknop server.  The timeout value is provided via the client_timeout data field.

Encryption Algorithms
---------------------

One of the final steps (before the HMAC is calculated and applied) in creating an fwknop SPA message is encrypting the entire message.  Currently, fwknop supports two methods of encryption:

 -- Variable: int fko_encryption_type_t

     FKO_ENCRYPTION_RIJNDAEL (default)

     FKO_ENCRYPTION_GPG

As indicated, libfko uses Rijndael encryption by default.  Rijndael encryption is sufficient for most users and produces a much smaller data packet than GPG (between 140 bytes with MD5 digest to around 225 bytes or so with SHA512, compared to around 1100 for signed GPG). When Rijndael is used, the encryption key itself is derived from the supplied passphrase via the PBKDF1 algorithm, and CBC mode is set.

However, some may prefer the higher level of security provided by GPG. When selected, additional parameters such as recipient and signer may be set as well. See Setting SPA Data for detail on setting these and other SPA data fields.

HMAC Digests
------------

The fwknop project employs an HMAC in the encrypt-then-authenticate model for strong SPA message authentication.  The HMAC itself is derived from a digest of the encrypted SPA message along with a dedicated HMAC key.

Currently, libfko supports the same message digests as mentioned in the Digest section above, and these are (in order of strength):

 -- Variable: int fko_digest_type_t

     FKO_HMAC_MD5

     FKO_HMAC_SHA1

     FKO_HMAC_SHA256  (libfko default)

     FKO_HMAC_SHA384

     FKO_HMAC_SHA512

As indicated in the list above, SHA256 is the default.  This means the HMAC digest type does not need to be explicitly set unless you wish to use one of the other values.  This applies to all libfko SPA data fields that have a default value.

Using libfko
************

This chapter provides the ``howto'' for using libfko, including required functions and parameter choices.  In some sections, code samples are provided to further illustrate usage.

Creating Contexts
=================

Before doing anything with libfko, you need to create a context. A context is created for one of two reasons.  One is for the purpose of building a new fko SPA message from scratch (typically to be packaged and sent to an fwknop server somewhere). The other would be a context for taking an existing SPA message for decoding, parsing, and data extraction.

For building a new fko SPA message, you will use the fko_new function:

 -- Function: int fko_new (fko_ctx_t *CTX)
     The function fko_new sets up and initializes a new fko_ctx_t object, pre-populates default values and returns a handle for it in CTX. The function returns the error code FKO_SUCCESS if the context was successfully created.  Otherwise an another error code will be returned (see Error Handling for details on the various error codes and their meanings).

     fko_ctx_t   ctx;
     int         rc;

     rc = fko_new(&ctx);

     if(rc != FKO_SUCCESS)
     {
         fprintf(stderr, "Error %i from fko_new: %s\n",
             rc, fko_errstr(rc));
         exit(1);
     }

For a context that will be used for receiving and parsing an existing SPA message, you will use the fko_new_with_data function:

 -- Function: int fko_new_with_data
     (fko_ctx_t *CTX, const char *DATA, const char *KEY, const char KEY_LEN, int ENCRYPTION_MODE, const char HMAC_KEY, const int HMAC_TYPE)

     The function fko_new_with_data sets up and initializes a new fko_ctx_t context, but instead of initializing default values, it stores the encrypted message data and makes it ready for parsing.  This can be done in one of two ways.  One is to pass NULL for the third argument.  The context will be created and the data will be stored, but no decryption or decoding takes place.  In this case, you will need to call fko_decrypt_spa_data at a later time.  The other way to do it is to supply the KEY value (decryption passphrase) and assocated length. In this case, the context is created, the SPA data is decrypted, decoded, parsed, and stored in the context ready for retrieval. If an HMAC is also desired or required, then the HMAC_KEY and associated length can be passed in.  This will cause libfko to authenticate the SPA data before decryption is attempted, and this is strongly recommended to do.

     The fko_new_with_data function returns the error code FKO_SUCCESS if the context was successfully created.  If any of the intermediate steps in parsing the data, validating the SPA message digest, or any other internal action fails, then the appropriate error code is returned.

The most common (simple) case...

     fko_ctx_t   ctx;
     char       *spa_data;
     char       *key;
     int         key_len;
     char       *hmac_key;
     int         hmac_key_len;
     int         hmac_type = FKO_HMAC_SHA256;
     int         enc_mode  = FKO_ENC_MODE_CBC;
     int rc;

     /* Assume we called code that retrieves the data and key
     */

     rc = fko_new_with_data(&ctx, spa_data, key, key_len, \\
         enc_mode, hmac_key, hmac_key_len, hmac_type);

     if(rc != FKO_SUCCESS)
     {
         fprintf(stderr, "Error %i from fko_new_with_data: %s\n",
             rc, fkoerrstr(rc));
         exit(1);
     }

Or, perhaps you need to defer decryption and parsing to a later point in the program.  We could use fko_new_with_data(), passing NULL for the decryption key and HMAC keys, or we could use fko_new() to create an empty context, then use fko_set_spa_data() to add the encypted data (see comments in the code samples).

     fko_ctx_t   ctx;
     char       *spa_data;
     char       *key;
     int rc;

     /* Assume we called code that retrieves the data and key
     */

     rc = fko_new_with_data(&ctx, spa_data, NULL, 0,
             FKO_ENC_MODE_CBC, NULL, 0, FKO_HMAC_SHA256);

     if(rc != FKO_SUCCESS)
     {
         fprintf(stderr, "Error from fko_new_with_data: %s\n",
             fko_errstr(rc));
         exit(1);
     }

     /* We could also just create and empty context and add the
      * encrypted data as follows:
      *
      * rc = fko_new(&ctx);
      * ... check rc ...
      * rc = fko_set_spa_data(ctx, spa_data);
      * ...
     */

     /* Assume we called other code and functions...  */

     /* Verify HMAC
     */
     rc = fko_verify_hmac(ctx, hmac_key, hmac_key_len);
     if(rc != FKO_SUCCESS)
     {
         fprintf(stderr, "Error from fko_verify_hmac: %s\n",
             fko_errstr(rc));
         exit(1);
     }

     /* Decrypt and decode...
     */
     rc = fko_decrypt_spa_data(ctx, key, key_len);

     if(rc != FKO_SUCCESS)
     {
         fprintf(stderr, "Error from fko_decrypt_spa_data: %s\n",
             fko_errstr(rc));
         exit(1);
     }

Destroying Contexts
===================

When you are done with the context, you must destroy it in order to free up the memory and resources it was using.  This is especially important in programs that process SPA data repeatedly (i.e. in a loop). Failure to destroy the context can cause memory leaks in your program.

 -- Function: void fko_destroy (fko_ctx_t CTX)
     The function fko_destroy destroys the context with the handle CTX and releases all associated resources.

Creating a SPA Message
======================

This section describes the process for creating a new fko SPA message.  After creating a context, there are still some requisite SPA data fields and SPA parameters that need to be set before the final encrypted message is ready.

The following list contains the minimum required fields for a complete fko SPA message.  You should also take note of the order of these parameters as well.  Setting the ``type'' parameters first is recommended (if you want a type other than the default).

  * digest_type -- (default may suffice)

  * message_type -- (default may suffice)

  * encryption_type -- (default may suffice)

  * rand_val -- (default should suffice)

  * time_stamp -- (default should suffice)

  * username -- (default may suffice)

  * spa_message -- (must be explicitly set)

If using gpg encryption:

  * gpg_recipient -- (must be explicitly set)

  * gpg_signer -- (optional, but recommended - must be explicitly set if used)

  * gpg_home_dir -- (default may suffice - typically $HOME/.gnupg)

When a context is initialized, some of the SPA data fields are pre-set with default values (see SPA Data Format).  For fields such as rand_val, username, timestamp, message_type, and digest_type, these defaults may be sufficient.

The functions used to set the various SPA data fields and parameters are described in detail in Setting SPA Data.

Note: Attempts to call any ``fko_'' function on a context that has not been initialized can have undefined consequences.  Libfko will attempt to recover, and if successful, will return a status of FKO_ERROR_CTX_NOT_INITIALIZED.

A common SPA message is a simple access request.  This request asks the fwknop server to create a temporary firewall rule to allow a particular IP address access to a particular port on the fwknop server.  Assuming the defaults are fine for this, all we need to do is create the context, set the message data field, call the fko_spa_data_final function to encode and encrypt, process the message, then destroy the context.  Below, we have a contrived bit of code demonstrating this:

     int
     main(int argc, char **argv)
     {
         fko_ctx_t   ctx;           /* FKO Context */
         char       *key;           /* Encryption passphrase */
         char       *hmac_key;      /* HMAC key */
         char       *final_spa;     /* Final encrypted SPA data */
         int         key_len;       /* Length of encryption key */
         int         hmac_key_len;  /* Length of HMAC key */
         int         rc;            /* Result code */
         int         hmac_type = FKO_HMAC_SHA256;   /* Default HMAC digest */
         int         enc_mode  = FKO_ENC_MODE_ASYMMETRIC;  /* Use GPG */

         /*  Assume we processed the command line
          *  and retrieved the password and the HMAC key and
         *   set their associated lengths.
         */

         /* Create the context */
         rc = fko_new(&ctx);
         if(rc != FKO_SUCCESS)
         {
             fprintf(stderr, "Error creating context: %s\n", fko_errstr(rc));
             exit(1);
         }

         /* Set the SPA message field - asking to open tcp port 22
          * for the system at 192.168.0.33
         */
         rc = fko_set_spa_message(ctx, "192.168.0.33,tcp/22");
         if(rc != FKO_SUCCESS)
         {
             fprintf(stderr, "Set SPA message failed: %s\n", fko_errstr(rc));
             exit(1);
         }

         /* Let us assume we are using GPG encryption.  So we need to
          * set the encryption type and set the required GPG parameters
          * (we can skip checking return values for brevity).
         */
         rc = fko_set_spa_encryption_type(ctx, FKO_ENCRYPTION_GPG);

         /* Key for the recipient */
         rc = fko_set_gpg_recipient(ctx, "recip@some.where");

         /* Key for the signer (if you want to sign it) */
         rc = fko_set_gpg_signer(ctx, "me@right.here");

         /* Finalize the SPA data */
         rc = fko_spa_data_final(ctx, key, key_len, enc_mode,
                 hmac_key, hmac_key_len, hmac_type);
         if(rc != FKO_SUCCESS)
         {
             fprintf(stderr, "Error encoding SPA data: %s\n",
                 fko_errstr(rc));
             exit(1);
         }

         /* Take the final message and do something with it */
         rc = fko_get_spa_data(ctx, &final_spa);

         /* Assume this function packs the spa data into a UDP
          * packet and sends it to the server.
         */
         send_spa_message(final_spa);

         /* Done with the context */
         fko_destroy(ctx);

         exit(0);
     }

Setting SPA Data
================

This section describes the functions used for setting the various SPA data fields and parameters.  All of these functions return an integer representing the return status of the function. When succesfull, they will return FKO_SUCCESS.  Otherwise, an error code value is returned.

 -- Function: int fko_set_spa_digest_type (fko_ctx_t CTX, short DIGEST_TYPE);
     Set the message digest type.  Valid values can be found in Digests of this manual. If a value other than the those that are supported is given, the function will return FKO_ERROR_INVALID_DATA. For example:

              rc = fko_set_digest_type(ctx, FKO_DIGEST_SHA1);

 -- Function: int fko_set_spa_hmac_type (fko_ctx_t CTX, short HMAC_TYPE);
     Set the message hmac type.  Valid values can be found in HMAC Digests of this manual. If a value other than the those that are supported is given, the function will return FKO_ERROR_INVALID_DATA. For example:

              rc = fko_set_hmac_type(ctx, FKO_HMAC_SHA256);

 -- Function: int fko_set_spa_encryption_type (fko_ctx_t CTX, short ENCRYPT_TYPE);
     Set the encrytion algorithm to use when ecrypting the final SPA data. Valid values can be found in Encryption Algorithms of this manual. For example:

              rc = fko_set_encryption_type(ctx, FKO_ENCRYPTION_RIJNDAEL);

 -- Function: int fko_set_rand_value (fko_ctx_t CTX, const char *VAL);
     Set the random value portion of the spa data to the given value (VAL). The given value must be a pointer to a 16-character decimal numeric string or NULL.  If the value is NULL, the function generate a new random value. If a string value is provided, it must be a 16-character decimal string. Otherwise, the function will return FKO_ERROR_INVALID_DATA.

 -- Function: int fko_set_username (fko_ctx_t CTX, const char *USERNAME);
     Set the username field of the SPA data. If USERNAME is NULL, libfko will first look for the environment variable SPOOF_USER and use its value if found.  Otherwise, it will try to determine the username itself using various methods starting with cuser or getlogin, then fallback to the environment variables LOGNAME or USER. If none of those work, the function will return FKO_ERROR_USERNAME_UNKNOWN.

 -- Function: int fko_set_timestamp (fko_ctx_t CTX, int OFFSET);
     Sets the timestamp value of the SPA data to the current time plus the offset value.

 -- Function: int fko_set_spa_message_type (fko_ctx_t CTX, short MSG_TYPE);
     Sets the message type for the SPA data. The choices for the spa_message_type are listed in SPA Messages. For example:

              rc = fko_set_spa_message_type(ctx, FKO_ACCESS_MSG);

 -- Function: int fko_set_spa_message (fko_ctx_t CTX, const char *MSG_STRING);
     Set the SPA message string to the given value. If this string does not conform to the required spa_nat_access format, the function will return FKO_ERROR_INVALID_DATA.

 -- Function: int fko_set_spa_nat_access (fko_ctx_t CTX, const char *NAT_ACCESS);
     Set the optional SPA nat access string to the given value. If this string does not conform to the required spa_nat_access format, the function will return FKO_ERROR_INVALID_DATA.

 -- Function: int fko_set_spa_server_auth (fko_ctx_t CTX, const char *SERVER_AUTH);
     Set the optional (very seldom used) SPA server auth feature to the given value.  This parameter may become deprecated.

 -- Function: int fko_set_spa_client_timeout (fko_ctx_t CTX, int TIMEOUT);
     Sets the SPA client timeout value.  If the timeout is set to a value greater than 0, it is assumed the spa_message_type setting should be one of the ``TIMEOUT'' variants.  This function will change the message_type to the appropriate setting if necessary.  However, it is recommended you set the correct message_type ahead of time.

 -- Function: int fko_set_spa_digest (fko_ctx_t CTX);
     Initiates a calculation (or recalculation) of the message digest hash for the current SPA data. If the required data fields are not set this function will return FKO_ERROR_MISSING_ENCODED_DATA. Note: It should not be necessary to call this function directly as it will be called automatically by other functions during normal processing (most notably fko_spa_data_final).

 -- Function: int fko_set_spa_hmac (fko_ctx_t CTX, const char *HMAC_KEY, const int HMAC_KEY_LEN);
     Initiates a calculation (or recalculation) of the message HMAC for the current SPA data. Note: It should not be necessary to call this function directly as it will be called automatically by other functions during normal processing (most notably fko_spa_data_final).

 -- Function: int fko_set_spa_data (fko_ctx_t CTX, char *ENC_DATA);
     This function is used to place encrypted SPA data into a newly created empty context (i.e. with fko_new). In most cases, you would use fko_new_with_data so you wouldn't have to take the extra step to use this function.  However, some may find a reason to do it in this way.

GPG-specific functions:

 -- Function: int fko_set_gpg_recipient (fko_ctx_t CTX, const char RECIPIENT);
     Sets the GPG key for the recipient.  This would be the recipient's public key used to encyrpt the SPA data.  You can use the user name ("recip@the.dest.com") or the key ID ("5EXXXXCC").  At present, multiple recipients are not supported.

 -- Function: int fko_set_gpg_signer (fko_ctx_t CTX, const char SIGNER);
     Sets the GPG key for signing the data.  This would be the sender's key used to sign the SPA data. You can use the user name or key ID.

 -- Function: int fko_set_gpg_home_dir (fko_ctx_t CTX, const char HOME_DIR);
     Sets the GPG home directory for the current gpgme context.  This allows for using alternate keyrings, gpg configurations, etc.

 -- Function: int fko_set_gpg_signature_verify (fko_ctx_t CTX, unsigned char VERIFY);
     Sets the verify GPG signature flag.  When set to a true value, the GPG signature is extracted and checked for validity during the decryption/decoding phase.  When set to false, no attempt is made to access or check the signature.  This flag is set to true by default.

 -- Function: int fko_set_gpg_ignore_verify_error (fko_ctx_t CTX, unsigned char IGNORE);
     Sets the ignore signature verify error flag.  When set to a true value. Any signature verification errors are ignored (but still captured) and the decoding process will continue.  The default value of this flag is false.

 -- Function: int fko_set_gpg_exe (fko_ctx_t CTX, const char GPG_EXE);
     Sets the path to the GPG executable that gpgme will use. By default, libfko forces gpgme to use gpg in case gpgme was compiled to use gpg2 as its default engine.  You can use this function to override and set what GPG executable gpgme will use.

Note: On a libfko build without GPG support, the GPG-related functions above will simply return the FKO_ERROR_UNSUPPORTED_FEATURE error code.

Retrieving SPA Data
===================

This section describes the functions used for retrieving the various SPA data fields and parameters settings.  They all return an FKO error code. The value of the respective field or parmeter that is being retrieved will placed into the variables whose addresses are passed to the function.

 -- Function: int fko_get_spa_data (fko_ctx_t CTX, char **SPA_DATA);
     Assigns the pointer to the string holding the final encrypted SPA data to the address SPA_DATA is pointing to.  This is the data that would be packaged into a packet and sent to an fwknop server. The return value is an FKO error status.

 -- Function: int fko_get_rand_value (fko_ctx_t CTX, char **RAND_VAL);
     Assigns the pointer to the string holding the random 16-character decimal number (rand_val) associated with the current context to the address RAND_VAL is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_username (fko_ctx_t CTX, char **USERNAME);
     Assigns the pointer to the string holding the username associated with the current context to the address RAND_VAL is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_timestamp (fko_ctx_t CTX, time_t *TIMESTAMP);
     Sets the value of the TIMESTAMP variable to the timestamp value associated with the current context.  The return value is an FKO error status.

 -- Function: int fko_get_spa_message_type (fko_ctx_t CTX, short *MSG_TYPE);
     Sets the value of the MSG_TYPE variable to the SPA message type value associated with the current context.  This value can be checked against the list of valid message_types listed in SPA Messages of this manual.  For example:

              short msg_type;

              rc = fko_get_spa_message_type(ctx, &msg_type);

              switch(msg_type)
              {
                  case FKO_ACCESS_MSG:
                      process_access_msg(...);
                      break;
                  case FKO_NAT_ACCESS_MSG:
                      process_nat_access_msg(...);
                      break;
              /*...and so on...*/
              }

     The return value is an FKO error status.

 -- Function: int fko_get_spa_message (fko_ctx_t CTX, char **SPA_MSG);
     Assigns the pointer to the string holding the the fko SPA request message associated with the current context to the address SPA_MSG is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_spa_nat_access (fko_ctx_t CTX, char **NAT_ACCESS);
     Assigns the pointer to the string holding the the fko SPA nat access message associated with the current context to the address NAT_ACCESS is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_spa_server_auth (fko_ctx_t CTX, char **SERVER_AUTH);
     Assigns the pointer to the string holding the the fko SPA server auth message associated with the current context to the address SERVER_AUTH is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_spa_client_timeout (fko_ctx_t CTX, int *CLIENT_TIMEOUT);
     Sets the value of the CLIENT_TIMEOUT variable to the client_timeout value associated with the current context. The return value is an FKO error status.

 -- Function: int fko_get_spa_digest_type (fko_ctx_t CTX, short *DIGEST_TYPE);
     Sets the value of the DIGEST_TYPE variable to the digest type value associated with the current context. This value can be checked against the list of valid digest_types listed in Digests of this manual.  The return value is an FKO error status.

 -- Function: int fko_get_spa_hmac_type (fko_ctx_t CTX, short *HMAC_TYPE);
     Sets the value of the HMAC_TYPE variable to the HMAC type value associated with the current context. This value can be checked against the list of valid hmac_types listed in HMAC Digests of this manual.  The return value is an FKO error status.

 -- Function: int fko_get_spa_digest (fko_ctx_t CTX, char **SPA_DIGEST);
     Assigns the pointer to the string holding the the fko SPA digest value associated with the current context to the address SPA_DIGEST is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_spa_hmac (fko_ctx_t CTX, char **SPA_HMAC);
     Assigns the pointer to the string holding the the fko SPA HMAC value associated with the current context to the address SPA_HMAC is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_spa_encryption_type (fko_ctx_t CTX, short *ENC_TYPE);
     Sets the value of the ENC_TYPE variable to the encryption type value associated with the current context. This value can be checked against the list of valid digest_types listed in Encryption Algorithms of this manual.  The return value is an FKO error status.

 -- Function: int fko_get_encoded_data (fko_ctx_t CTX, char **ENC_MSG);
     Assigns the pointer to the string holding the the encoded SPA data (before encryption) associated with the current context to the address ENC_MSG is pointing to.  This is intermediate data that would not normally be of use unless debugging the library. The return value is an FKO error status.

 -- Function: int fko_get_version (fko_ctx_t CTX, char **FKO_VERSION);
     Assigns the pointer to the string holding the the SPA version value associated with the current context to the address FKO_VERSION is pointing to.  This is a static value for SPA data that is being created in a new context.  For data parsed from an external source, the version string will be whatever version the sending client used. The return value is an FKO error status.

GPG-specific functions:

 -- Function: int fko_get_gpg_recipient (fko_ctx_t CTX, char **RECIPIENT);
     Assigns the pointer to the string holding the the GPG recipient ID associated with the current context to the address RECIPIENT is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_gpg_signer (fko_ctx_t CTX, char **SIGNER);
     Assigns the pointer to the string holding the the GPG signer ID associated with the current context to the address SIGNER is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_gpg_home_dir (fko_ctx_t CTX, char **GPG_DIR);
     Assigns the pointer to the string holding the the GPG home directory associated with the current context to the address GPG_DIR is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_gpg_signature_verify (fko_ctx_t CTX, unsigned char *VAL);
     Sets the value of the VAL variable to the current gpg_signature_verify flag value associated with the current context. The return value is an FKO error status.

 -- Function: int fko_get_gpg_ignore_verify_error (fko_ctx_t CTX, unsigned char *VAL);
     Sets the value of the VAL variable to the current ignore_verify_error flag value associated with the current context. The return value is an FKO error status.

 -- Function: int fko_get_gpg_signature_id (fko_ctx_t CTX, char **SIG_ID);
     Assigns the pointer to the string holding the the GPG signature ID associated with the current context to the address SIG_ID is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_gpg_signature_fpr (fko_ctx_t CTX, char **SIG_FPR);
     Assigns the pointer to the string holding the the GPG signature fingerprint associated with the current context to the address SIG_FPR is pointing to.  The return value is an FKO error status.

 -- Function: int fko_get_gpg_signature_summary (fko_ctx_t CTX, int *SIG_SUM);
     Sets the value of the SIG_SUM variable to the GPG signature summary value associated with the current context. The return value is an FKO error status.

 -- Function: int fko_get_gpg_signature_status (fko_ctx_t CTX, int *SIG_STAT);
     Sets the value of the SIG_STAT variable to the GPG signature error status value associated with the current context. The return value is an FKO error status.

 -- Function: int fko_get_gpg_exe (fko_ctx_t CTX, char **GPG_EXE);
     Assigns the pointer to the string holding the the GPG executable path associated with the current context to the address GPG_EXE is pointing to.  The return value is an FKO error status.

Note:  The char* values retrieved by the GPG-related functions above will be NULL if the context value was not previously set.

Utility Functions
=================

This section describes the functions not covered elsewhere in this manual.  These are utility functions that operate on the data in the fko context.  All but fko_spa_data_final are called by other functions and are not normally explicitly called by the user.  However, they can be, so they are listed here.

All of these functions return an integer representing the return status of the function. When succesfull, they will return FKO_SUCCESS. Otherwise, an error code value is returned.

 -- Function: int fko_spa_data_final (fko_ctx_t CTX, char *ENC_KEY, int KEN_LEN, char *HMAC_KEY, int HMAC_KEY_LEN);
     This function is the final step in creating a complete encrypted SPA data string suitable for transmission to an fwknop server. It does require all of the requisite SPA data fields be set, otherwise it will fail with an appropriate error code.

 -- Function: int fko_decrypt_spa_data (fko_ctx_t CTX, char *DEC_KEY, int KEY_LEN);
     When given the correct KEY (password), this function decrypts, decodes, and parses the encrypted SPA data that was supplied to the context via the fko_new_with_data function that was also called without the KEY value.  Once the data is decrypted, this function will also call fko_decode_spa_data to decode, parse, validate, and store the data fields in the context for later retrieval.

 -- Function: int fko_encrypt_spa_data (fko_ctx_t CTX, char *ENC_KEY, int KEY_LEN);
     Encrypts the intermediate encoded SPA data stored in the context. This function will call fko_encode if necessary.  It is normally not called directly as it is called from fko_spa_data_final.

 -- Function: int fko_decode_spa_data (fko_ctx_t CTX);
     This function performs the decoding, parsing, validation of the SPA data that was just decrypted. It is normally not called directly as it is called from fko_decrypt_spa_data (which is in turn called from fko_new_with_data if a password is supplied to it).

 -- Function: int fko_encode_spa_data (fko_ctx_t CTX);
     Performs the base64 encoding of those SPA data fields that need to be encoded, performs some data validation, and calls fkp_set_spa_digest to recompute the SPA message digest.  It is normally not called directly as it is called from fko_encrypt_spa_data (which is in turn called from fko_spa_data_final).

GPG-specific utility functions:

 -- Function: int fko_gpg_signature_id_match (fko_ctx_t CTX, const char *ID, unsigned char *ID_MATCH);
     Sets the value of the ID_MATCH variable to true (1) if the value of ID matches the ID of the GPG signature associated with the current context. Otherwise, ID_MATCH is set to false (0). The return value is an FKO error status.

 -- Function: int fko_gpg_signature_fpr_match (fko_ctx_t CTX, const char *FPR, unsigned char *FPR_MATCH);
     Sets the value of the FPR_MATCH variable to true (1) if the value of FPR matches the fingerprint of the GPG signature associated with the current context. Otherwise, FPR_MATCH is set to false (0). The return value is an FKO error status.

Error Handling
==============

Most fko functions return an integer value that corresponds to either success (0), or one of the non-zero values thar corresponds to a number of possible errors.  libfko provides a function to get a descriptive string for the given error code.

 -- Function: const char * fko_errstr (int ERR_CODE)
     The function fko_errstr returns a pointer to a statically allocated string containing the description of the error.

The list of the possible error codes and their corresponding descriptions as returned by fko_errstr follows:

 -- Variable: int error_code

     FKO_SUCCESS
          Success

     FKO_ERROR_CTX_NOT_INITIALIZED
          FKO Context is not initialized

     FKO_ERROR_MEMORY_ALLOCATION
          Unable to allocate memory

     FKO_ERROR_FILESYSTEM_OPERATION
          Read/write bytes mismatch

     FKO_ERROR_INVALID_DATA
          Args contain invalid data

     FKO_ERROR_INVALID_DATA_CLIENT_TIMEOUT_NEGATIVE
          Invalid data: negative timeout value

     FKO_ERROR_INVALID_DATA_DECODE_MSGLEN_VALIDFAIL
          Invalid data: invalid message length

     FKO_ERROR_INVALID_DATA_DECODE_NON_ASCII
          Invalid data: contains non-ascii characters

     FKO_ERROR_INVALID_DATA_DECODE_LT_MIN_FIELDS
          Invalid data: insufficient number of data fields

     FKO_ERROR_INVALID_DATA_DECODE_GT_MAX_FIELDS
          Invalid data: too many data fields

     FKO_ERROR_INVALID_DATA_DECODE_WRONG_NUM_FIELDS
          Invalid data: invalid number of fields

     FKO_ERROR_INVALID_DATA_DECODE_ENC_MSG_LEN_MT_T_SIZE
          Invalid data: decode: encoded message - digest size is not valid

     FKO_ERROR_INVALID_DATA_DECODE_RAND_MISSING
          Invalid data: decode: missing random data

     FKO_ERROR_INVALID_DATA_DECODE_USERNAME_MISSING
          Invalid data: decode: missing username

     FKO_ERROR_INVALID_DATA_DECODE_USERNAME_TOOBIG
          Invalid data: decode: username to large

     FKO_ERROR_INVALID_DATA_DECODE_USERNAME_DECODEFAIL
          Invalid data: decode: failed to decode username

     FKO_ERROR_INVALID_DATA_DECODE_USERNAME_VALIDFAIL
          Invalid data: decode: invalid username

     FKO_ERROR_INVALID_DATA_DECODE_TIMESTAMP_MISSING
          Invalid data: decode: missing timestamp

     FKO_ERROR_INVALID_DATA_DECODE_TIMESTAMP_TOOBIG
          Invalid data: decode: timestamp too large

     FKO_ERROR_INVALID_DATA_DECODE_TIMESTAMP_DECODEFAIL
          Invalid data: decode: failed to decode timestamp

     FKO_ERROR_INVALID_DATA_DECODE_VERSION_MISSING
          Invalid data: decode: missing version data

     FKO_ERROR_INVALID_DATA_DECODE_VERSION_TOOBIG
          Invalid data: decode: version data is too large

     FKO_ERROR_INVALID_DATA_DECODE_MSGTYPE_MISSING
          Invalid data: decode: missing message type

     FKO_ERROR_INVALID_DATA_DECODE_MSGTYPE_TOOBIG
          Invalid data: decode: message type is too large

     FKO_ERROR_INVALID_DATA_DECODE_MSGTYPE_DECODEFAIL
          Invalid data: decode: failed to decode message type

     FKO_ERROR_INVALID_DATA_DECODE_MESSAGE_MISSING
          Invalid data: decode: missing message data

     FKO_ERROR_INVALID_DATA_DECODE_MESSAGE_TOOBIG
          Invalid data: decode: message data is too large

     FKO_ERROR_INVALID_DATA_DECODE_MESSAGE_DECODEFAIL
          Invalid data: decode: failed to decode message data

     FKO_ERROR_INVALID_DATA_DECODE_MESSAGE_VALIDFAIL
          Invalid data: decode: invalid message data

     FKO_ERROR_INVALID_DATA_DECODE_ACCESS_VALIDFAIL
          Invalid data: decode: invliad access data

     FKO_ERROR_INVALID_DATA_DECODE_NATACCESS_MISSING
          Invalid data: decode: missing NAT access data

     FKO_ERROR_INVALID_DATA_DECODE_NATACCESS_TOOBIG
          Invalid data: decode: NAT access data is too large

     FKO_ERROR_INVALID_DATA_DECODE_NATACCESS_DECODEFAIL
          Invalid data: decode: failed to decode NAT access data

     FKO_ERROR_INVALID_DATA_DECODE_NATACCESS_VALIDFAIL
          Invalid data: decode: invalid NAT access

     FKO_ERROR_INVALID_DATA_DECODE_SRVAUTH_MISSING
          Invalid data: decode: missing server auth

     FKO_ERROR_INVALID_DATA_DECODE_SRVAUTH_DECODEFAIL
          Invalid data: decode: server auth decode fail

     FKO_ERROR_INVALID_DATA_DECODE_SPA_EXTRA_TOOBIG
          Invalid data: decode: SPA extra too large

     FKO_ERROR_INVALID_DATA_DECODE_EXTRA_TOOBIG
          Invalid data: decode: extra too large

     FKO_ERROR_INVALID_DATA_DECODE_EXTRA_DECODEFAIL
          Invalid data: decode: extra decode failed

     FKO_ERROR_INVALID_DATA_DECODE_TIMEOUT_MISSING
          Invalid data: decode: missing timeout

     FKO_ERROR_INVALID_DATA_DECODE_TIMEOUT_TOOBIG
          Invalid data: decode timeout value is too large

     FKO_ERROR_INVALID_DATA_DECODE_TIMEOUT_VALIDFAIL
          Invalid data: decode invalid timeout

     FKO_ERROR_INVALID_DATA_DECODE_TIMEOUT_DECODEFAIL
          Invalid data: decode: timeout decode failed

     FKO_ERROR_INVALID_DATA_ENCODE_MESSAGE_TOOBIG
          Invalid data: encode: message is too large

     FKO_ERROR_INVALID_DATA_ENCODE_MSGLEN_VALIDFAIL
          Invalid data: encode: invalid message length

     FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_VALIDFAIL
          Invalid data: encode: invalid digest

     FKO_ERROR_INVALID_DATA_ENCODE_DIGEST_TOOBIG
          Invalid data: encode: digest is too large

     FKO_ERROR_INVALID_DATA_ENCODE_NOTBASE64
          Invalid data: encoded data is not Base64

     FKO_ERROR_INVALID_DATA_ENCRYPT_MSGLEN_VALIDFAIL
          Invalid data: encrypt: invalid message length

     FKO_ERROR_INVALID_DATA_ENCRYPT_DIGESTLEN_VALIDFAIL
          Invalid data: encrypt: invalid digest length

     FKO_ERROR_INVALID_DATA_ENCRYPT_PTLEN_VALIDFAIL
          Invalid data: encrypt: invalid plaintext length

     FKO_ERROR_INVALID_DATA_ENCRYPT_RESULT_MSGLEN_VALIDFAIL
          Invalid data: encrypt: invalid encrypt result message length

     FKO_ERROR_INVALID_DATA_ENCRYPT_CIPHERLEN_DECODEFAIL
          Invalid data: encrypt: decode cipher length failed

     FKO_ERROR_INVALID_DATA_ENCRYPT_CIPHERLEN_VALIDFAIL
          Invalid data: encrypt: invalid cipher length

     FKO_ERROR_INVALID_DATA_ENCRYPT_DECRYPTED_MESSAGE_MISSING
          Invalid data: encrypt: missing decrypted message

     FKO_ERROR_INVALID_DATA_ENCRYPT_DECRYPTED_MSGLEN_VALIDFAIL
          Invalid data: encrypt: invalid decrypted message length

     FKO_ERROR_INVALID_DATA_ENCRYPT_TYPE_VALIDFAIL
          Invalid data: encrypt: invalid encryption type

     FKO_ERROR_INVALID_DATA_ENCRYPT_MODE_VALIDFAIL
          Invalid data: encrypt: invalid encryption mode

     FKO_ERROR_INVALID_DATA_ENCRYPT_TYPE_UNKNOWN
          Invalid data: encrypt: unknown encryption type

     FKO_ERROR_INVALID_DATA_FUNCS_NEW_ENCMSG_MISSING
          Invalid data: missing encoded message

     FKO_ERROR_INVALID_DATA_FUNCS_NEW_MSGLEN_VALIDFAIL
          Invalid data: invalid message length from new

     FKO_ERROR_INVALID_DATA_FUNCS_GEN_KEYLEN_VALIDFAIL
          Invalid data: invalid key length from gen_keylen

     FKO_ERROR_INVALID_DATA_FUNCS_GEN_HMACLEN_VALIDFAIL
          Invalid data: gen_hmaclen failure

     FKO_ERROR_INVALID_DATA_FUNCS_GEN_KEY_ENCODEFAIL
          Invalid data: gen_key: encode failure

     FKO_ERROR_INVALID_DATA_FUNCS_GEN_HMAC_ENCODEFAIL
          Invalid data: gen_hmac: encode failure

     FKO_ERROR_INVALID_DATA_FUNCS_SET_MSGLEN_VALIDFAIL
          Invalid data: set_spa_data: invalid message length

     FKO_ERROR_INVALID_DATA_HMAC_MSGLEN_VALIDFAIL
          Invalid data: invalid HMAC msglen

     FKO_ERROR_INVALID_DATA_HMAC_ENCMSGLEN_VALIDFAIL
          Invalid data: invalid length for encrypted message

     FKO_ERROR_INVALID_DATA_HMAC_COMPAREFAIL
          Invalid data: HMAC comparison failed

     FKO_ERROR_INVALID_DATA_HMAC_TYPE_VALIDFAIL
          Invalid data: invalid HMAC type

     FKO_ERROR_INVALID_DATA_HMAC_LEN_VALIDFAIL
          Invalid data: invalid HMAC length

     FKO_ERROR_INVALID_DATA_MESSAGE_PORT_MISSING
          Invalid data: missing port

     FKO_ERROR_INVALID_DATA_MESSAGE_TYPE_VALIDFAIL
          Invalid data: invalid message type

     FKO_ERROR_INVALID_DATA_MESSAGE_EMPTY
          Invalid data: empty data message

     FKO_ERROR_INVALID_DATA_MESSAGE_CMD_MISSING
          Invalid data: missing command message

     FKO_ERROR_INVALID_DATA_MESSAGE_ACCESS_MISSING
          Invalid data: missing access message

     FKO_ERROR_INVALID_DATA_MESSAGE_NAT_MISSING
          Invalid data: missing NAT data

     FKO_ERROR_INVALID_DATA_MESSAGE_PORTPROTO_MISSING
          Invalid data: missing proto/port data

     FKO_ERROR_INVALID_DATA_NAT_EMPTY
          Invalid data: empty NAT value

     FKO_ERROR_INVALID_DATA_RAND_LEN_VALIDFAIL
          Invalid data: invalid random data length

     FKO_ERROR_INVALID_DATA_SRVAUTH_MISSING
          Invalid data: server auth missing

     FKO_ERROR_INVALID_DATA_TIMESTAMP_VALIDFAIL
          Invalid data: invalid timestamp value

     FKO_ERROR_INVALID_DATA_USER_MISSING
          Invalid data: missing user data

     FKO_ERROR_INVALID_DATA_USER_FIRSTCHAR_VALIDFAIL
          Invalid data: user first char not valid

     FKO_ERROR_INVALID_DATA_USER_REMCHAR_VALIDFAIL
          Invalid data: user remchar not valid

     FKO_ERROR_INVALID_DATA_UTIL_STRTOL_LT_MIN
          Invalid data: util conversion to long less than minimum

     FKO_ERROR_INVALID_DATA_UTIL_STRTOL_GT_MAX
          Invalid data: util conversion to long greater than maximum

     FKO_ERROR_DATA_TOO_LARGE
          Value or Size of the data exceeded the max allowed

     FKO_ERROR_INVALID_KEY_LEN
          Invalid key length

     FKO_ERROR_USERNAME_UNKNOWN
          Unable to determine username

     FKO_ERROR_INCOMPLETE_SPA_DATA
          Missing or incomplete SPA data

     FKO_ERROR_MISSING_ENCODED_DATA
          There is no encoded data to process

     FKO_ERROR_INVALID_DIGEST_TYPE
          Invalid digest type

     FKO_ERROR_INVALID_ALLOW_IP
          Invalid allow IP address in the SPA message data

     FKO_ERROR_INVALID_SPA_COMMAND_MSG
          Invalid SPA command message format

     FKO_ERROR_INVALID_SPA_ACCESS_MSG
          Invalid SPA access message format

     FKO_ERROR_INVALID_SPA_NAT_ACCESS_MSG
          Invalid SPA nat_access message format

     FKO_ERROR_INVALID_ENCRYPTION_TYPE
          Invalid encryption type

     FKO_ERROR_WRONG_ENCRYPTION_TYPE
          Wrong or inappropriate encryption type for this operation

     FKO_ERROR_DECRYPTION_SIZE
          Unexpected or invalid size for decrypted data

     FKO_ERROR_DECRYPTION_FAILURE
          Decryption failed or decrypted data is invalid

     FKO_ERROR_DIGEST_VERIFICATION_FAILED
          The computed digest did not match the digest in the spa data

     FKO_ERROR_INVALID_HMAC_KEY_LEN
          Invalid HMAC key length

     FKO_ERROR_UNSUPPORTED_HMAC_MODE
          Unsupported HMAC mode (default: SHA256)

     FKO_ERROR_UNSUPPORTED_FEATURE
          Unsupported or unimplemented feature or function

     FKO_ERROR_ZERO_OUT_DATA
          Could not zero out sensitive data

     FKO_ERROR_UNKNOWN
          Unknown/Unclassified error

If GPG support is available, there are additional possible error conditions and error codes.  The GPG support is implemented via GPGME. The libfko error handling code wraps many of the GPGME error codes that may be encountered while using libfko's GPG related functions. These are:

 -- Variable: int error_code (gpgme support only)

     FKO_ERROR_MISSING_GPG_KEY_DATA
          Missing GPG key data (signer or recipient not set)

     FKO_ERROR_GPGME_NO_OPENPGP
          This GPGME implementation does not support OpenPGP

     FKO_ERROR_GPGME_CONTEXT
          Unable to create GPGME context

     FKO_ERROR_GPGME_PLAINTEXT_DATA_OBJ
          Error creating the plaintext data object

     FKO_ERROR_GPGME_SET_PROTOCOL
          Unable to set GPGME to use OpenPGP protocol

     FKO_ERROR_GPGME_CIPHER_DATA_OBJ
          Error creating the encrypted data data object

     FKO_ERROR_GPGME_BAD_PASSPHRASE
          The GPG passphrase was not valid

     FKO_ERROR_GPGME_ENCRYPT_SIGN
          Error during the encrypt and sign operation

     FKO_ERROR_GPGME_CONTEXT_SIGNER_KEY
          Unable to create GPGME context for the signer key

     FKO_ERROR_GPGME_SIGNER_KEYLIST_START
          Error from signer keylist start operation

     FKO_ERROR_GPGME_SIGNER_KEY_NOT_FOUND
          The key for the given signer was not found

     FKO_ERROR_GPGME_SIGNER_KEY_AMBIGUOUS
          Ambiguous name/id for the signer key (mulitple matches)

     FKO_ERROR_GPGME_ADD_SIGNER
          Error adding the signer key to the gpgme context

     FKO_ERROR_GPGME_CONTEXT_RECIPIENT_KEY
          Unable to create GPGME context for the recipient key

     FKO_ERROR_GPGME_RECIPIENT_KEYLIST_START
          Error from signer keylist start operation

     FKO_ERROR_GPGME_RECIPIENT_KEY_NOT_FOUND
          The key for the given recipient was not found

     FKO_ERROR_GPGME_RECIPIENT_KEY_AMBIGUOUS
          Ambiguous name/id for the recipient key (mulitple matches)

     FKO_ERROR_GPGME_DECRYPT_FAILED
          Decryption operation failed

     FKO_ERROR_GPGME_BAD_GPG_EXE
          Unable to stat the given GPG executable

     FKO_ERROR_GPGME_BAD_HOME_DIR
          Unable to stat the given GPG home directory

     FKO_ERROR_GPGME_SET_HOME_DIR
          Unable to set the given GPG home directory

     FKO_ERROR_GPGME_NO_SIGNATURE
          Missing GPG signature

     FKO_ERROR_GPGME_BAD_SIGNATURE
          Bad GPG signature

     FKO_ERROR_GPGME_SIGNATURE_VERIFY_DISABLED
          Trying to check signature with verification disabled

     FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_MESSAGE_VALIDFAIL
          Invalid data: encrypt: invalid GPG-encrypt message

     FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_DIGEST_VALIDFAIL
          Invalid data: encrypt: invalid GPG digest

     FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_MSGLEN_VALIDFAIL
          Invalid data: encrypt: invalid GPG message length

     FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_RESULT_MSGLEN_VALIDFAIL
          Invalid data: encrypt: invalid GPG result message length

     FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_CIPHER_DECODEFAIL
          Invalid data: encrypt: GPG cipher failed

     FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_ENCODEDMSG_NULL
          Invalid data: encrypt: GPG-encoded message is NULL

     FKO_ERROR_INVALID_DATA_ENCRYPT_GPG_ENCODEDMSGLEN_VALIDFAIL
          Invalid data: encrypt: invalid GPG-encrypted message length

You can use the IS_GPGME_ERROR(err_code) macro to determine whether or not an error id GPGME related.  If the macro evaluates to a true value, you may be able to get additional information about the error using the following function:

 -- Function: const char * fko_gpg_errstr (int ERR_CODE)
     The function fko_errstr returns a pointer to a statically allocated string containing the description of the GPGME error.

Note: For some errors, this function may return an empty string.

     [file gpl-2.0.texi not included]