#### 1.3.1 SPA Data Format ¶

The format of the SPA message data used by fwknop (before encryption and before an HMAC is applied) is a colon-delimited string containing the individual SPA data fields. Some of these fields are base64-encoded in the final encoding process as dictated by the current fwknop implementation.

Variable: `data` spa_message_fields ¶

  Using the libfko names for the data fields, the list of these fields (in order) follows:

  `rand_value - Default: Random (created upon context creation)`

    A 16-byte random numeric string.

  `username - Default: Current login user or Value of `SPOOF_USER` env var`

    The base64-encoded username associated with this SPA data.

  `timestamp - Default: The Unix time at creation`

    The Unix timestamp value.

  `version - Default: the current fwknop version`

    The current fwknop version that supports this format. This field is not user settable.

  `spa_message_type - Default: SPA access message (`FKO_ACCESS_MSG`)`

    The SPA message type value for this message.

  `spa_message`

    The base64-encoded SPA message itself (an access request or command string).

  `spa_nat_access`

    An optional base64-encoded request for NAT access.

  `spa_server_auth`

    An optional base64-encoded string that can be used as an additional authentication mechanism at the fwknop server.

  `spa_client_timeout`

    An optional client timeout value that can be supplied to the fwknop server.

  `spa_digest - Computed value`

    The digest of the previous fields (including the delimiters).

With all fields defined, a complete (unencoded) SPA message would look something like the following example (Note: The line is broken for readability and the username, message, nat_access, and server_auth fields are not base64-encoded):

    8307540982176539:juser:1230665172:2.5:1:1.1.1.1,tcp/22:192.168.1.2,22:
    crypt,mypw:120:xswj8V0zMR7/7MV9pQRarSKWG1l9Zfjv+kbXaKrJ+RA

For most of the fields, you need not be too concerned about the format as libfko handles that. The exceptions are the `spa_message`, `spa_nat_access`, and `spa_server_auth`. The formats for these are not handled by libfko during creation. However, they are checked for format validity during the endcoding and decoding (when parsing incoming) SPA data. More information on the specifics of the formats for these fields can be found in SPA Messages.