denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

openssl: Require min version 3.0.0 for HKDF to support larger MODP groups and nonces

Browse Source 
Also enables the `kdf` plugin automatically if building against an older
version of OpenSSL.

Closes strongswan/strongswan#2602

Co-authored-by: Tobias Brunner <[email protected]>
This commit is contained in:
Nathan Tran
2025-01-15 18:11:18 +01:00
committed by Tobias Brunner
co-authored by Tobias Brunner
parent d860c26e95
commit 1d5c5a1d72
3 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
+15 -2
View File
@@ -525,15 +525,28 @@ if test x$cert_enroll = xtrue; then
fi fi
if test x$kdf = xfalse; then if test x$kdf = xfalse; then
openssl_hkdf=false
if test x$openssl = xtrue; then
AC_MSG_CHECKING(for OpenSSL >= 3.0 for HKDF)
AC_COMPILE_IFELSE(
[AC_LANG_PROGRAM(
[[#include <openssl/opensslv.h>]],
[[#if OPENSSL_VERSION_NUMBER < 0x30000000L && !defined(OPENSSL_IS_AWSLC)
#error OpenSSL version unusable
#endif]])],
[AC_MSG_RESULT([yes]); openssl_hkdf=true],
[AC_MSG_RESULT([no])]
)
fi
if test x$aesni = xtrue -o x$cmac = xtrue -o x$xcbc = xtrue; then if test x$aesni = xtrue -o x$cmac = xtrue -o x$xcbc = xtrue; then
AC_MSG_WARN(m4_normalize([ AC_MSG_WARN(m4_normalize([
kdf plugin is required for possible use of PRF_AES128_XCBC/CMAC kdf plugin is required for possible use of PRF_AES128_XCBC/CMAC
by one of these plugins: aesni, cmac, xcbc])) by one of these plugins: aesni, cmac, xcbc]))
kdf=true kdf=true
elif test x$botan = xfalse -a x$openssl = xfalse -a x$wolfssl = xfalse; then elif test x$botan = xfalse -a x$openssl_hkdf = xfalse -a x$wolfssl = xfalse; then
AC_MSG_WARN(m4_normalize([ AC_MSG_WARN(m4_normalize([
kdf plugin is required because none of the following plugins is kdf plugin is required because none of the following plugins is
enabled: botan, openssl, wolfssl])) enabled or usable: botan, openssl, wolfssl]))
kdf=true kdf=true
fi fi
fi fi
scripts/test.sh
+3 -7
View File
@@ -240,6 +240,9 @@ openssl*)
use_custom_openssl $1 use_custom_openssl $1
elif system_uses_openssl3; then elif system_uses_openssl3; then
prepare_system_openssl $1 prepare_system_openssl $1
else
# the kdf plugin is necessary to build against older OpenSSL versions
TESTS_PLUGINS="$TESTS_PLUGINS kdf"
fi fi
;; ;;
gcrypt) gcrypt)
@@ -352,13 +355,6 @@ win*)
TARGET= TARGET=
else else
CONFIG="$CONFIG --enable-openssl" CONFIG="$CONFIG --enable-openssl"
case "$IMG" in
2015|2017)
# old OpenSSL versions don't provide HKDF
CONFIG="$CONFIG --enable-kdf"
;;
esac
CFLAGS="$CFLAGS -I$OPENSSL_DIR/include" CFLAGS="$CFLAGS -I$OPENSSL_DIR/include"
LDFLAGS="-L$OPENSSL_DIR/lib" LDFLAGS="-L$OPENSSL_DIR/lib"
case "$IMG" in case "$IMG" in
src/libstrongswan/plugins/openssl/openssl_plugin.c
+5 -2
View File
@@ -496,8 +496,11 @@ METHOD(plugin_t, get_features, int,
PLUGIN_PROVIDE(SIGNER, AUTH_HMAC_SHA2_512_256), PLUGIN_PROVIDE(SIGNER, AUTH_HMAC_SHA2_512_256),
PLUGIN_PROVIDE(SIGNER, AUTH_HMAC_SHA2_512_512), PLUGIN_PROVIDE(SIGNER, AUTH_HMAC_SHA2_512_512),
#endif #endif
#if OPENSSL_VERSION_NUMBER >= 0x10101000L #if OPENSSL_VERSION_NUMBER >= 0x30000000L || \
/* HKDF is available since 1.1.0, expand-only mode only since 1.1.1 */ defined (OPENSSL_IS_AWSLC)
/* HKDF is available since 1.1.0, expand-only mode only since 1.1.1,
* but 3.0.0 is required to support larger MODP groups and nonces
* with its 2048 byte buffer size */
PLUGIN_REGISTER(KDF, openssl_kdf_create), PLUGIN_REGISTER(KDF, openssl_kdf_create),
PLUGIN_PROVIDE(KDF, KDF_PRF), PLUGIN_PROVIDE(KDF, KDF_PRF),
PLUGIN_PROVIDE(KDF, KDF_PRF_PLUS), PLUGIN_PROVIDE(KDF, KDF_PRF_PLUS),