denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

af-alg: Remove plugin for deprecated AF_ALG interface

Browse Source 
The 7.2 kernel has officially deprecated the interface and it will soon
be removed (support for hardware crypto offload has already been removed).

Also removed the corresponding test scenarios.
This commit is contained in:
Tobias Brunner
2026-07-27 08:09:39 +02:00
parent 10beab8bcd
commit 248c915593
39 changed files with 1 additions and 1940 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configure.ac
-4
View File
@@ -129,7 +129,6 @@ AC_SUBST(ipsec_script_upper, [`echo -n "$ipsec_script" | tr a-z A-Z`])
# crypto plugins
ARG_ENABL_SET([aes], [enable AES software implementation plugin.])
ARG_ENABL_SET([af-alg], [enable AF_ALG crypto interface to Linux Crypto API.])
ARG_ENABL_SET([botan], [enables the Botan crypto plugin.])
ARG_ENABL_SET([ccm], [enables the CCM AEAD wrapper crypto plugin.])
ARG_ENABL_SET([chapoly], [enables the ChaCha20/Poly1305 AEAD plugin.])
@@ -1522,7 +1521,6 @@ ADD_PLUGIN([wolfssl], [s charon swanctl pki scripts attest nm cmd a
ADD_PLUGIN([gcrypt], [s charon swanctl pki scripts attest nm cmd aikgen])
ADD_PLUGIN([botan], [s charon swanctl pki scripts attest nm cmd aikgen])
ADD_PLUGIN([pkcs8], [s charon swanctl pki scripts attest nm cmd])
ADD_PLUGIN([af-alg], [s charon swanctl pki scripts attest nm cmd aikgen])
ADD_PLUGIN([fips-prf], [s charon nm cmd])
ADD_PLUGIN([gmp], [s charon swanctl pki scripts attest nm cmd aikgen fc])
ADD_PLUGIN([curve25519], [s charon swanctl pki scripts nm cmd])
@@ -1692,7 +1690,6 @@ AM_CONDITIONAL(USE_CHAPOLY, test x$chapoly = xtrue)
AM_CONDITIONAL(USE_CTR, test x$ctr = xtrue)
AM_CONDITIONAL(USE_CCM, test x$ccm = xtrue)
AM_CONDITIONAL(USE_GCM, test x$gcm = xtrue)
AM_CONDITIONAL(USE_AF_ALG, test x$af_alg = xtrue)
AM_CONDITIONAL(USE_DRBG, test x$drbg = xtrue)
AM_CONDITIONAL(USE_ML, test x$ml = xtrue)
@@ -1974,7 +1971,6 @@ AC_CONFIG_FILES([
src/libstrongswan/plugins/ctr/Makefile
src/libstrongswan/plugins/ccm/Makefile
src/libstrongswan/plugins/gcm/Makefile
src/libstrongswan/plugins/af_alg/Makefile
src/libstrongswan/plugins/drbg/Makefile
src/libstrongswan/plugins/ml/Makefile
src/libstrongswan/plugins/test_vectors/Makefile
scripts/test.sh
-2
View File
@@ -268,8 +268,6 @@ all|alpine|codeql|coverage|sonarcloud|no-dbg|no-testable-ke)
--disable-unwind-backtraces
--disable-svc --disable-dbghelp-backtraces --disable-socket-win
--disable-kernel-wfp --disable-kernel-iph --disable-winhttp"
# not enabled on the build server
CONFIG="$CONFIG --disable-af-alg"
if test "$TEST" != "coverage"; then
CONFIG="$CONFIG --disable-coverage"
else
src/include/Makefile.am
+1 -1
View File
@@ -1,2 +1,2 @@
EXTRA_DIST = linux/if_alg.h linux/ipsec.h linux/netlink.h linux/rtnetlink.h \
EXTRA_DIST = linux/ipsec.h linux/netlink.h linux/rtnetlink.h \
linux/pfkeyv2.h linux/udp.h linux/socket.h linux/xfrm.h sys/queue.h
src/include/linux/if_alg.h
-40
View File
@@ -1,40 +0,0 @@
/*
* if_alg: User-space algorithm interface
*
* Copyright (c) 2010 Herbert Xu <[email protected]>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
* Software Foundation; either version 2 of the License, or (at your option)
* any later version.
*
*/
#ifndef _LINUX_IF_ALG_H
#define _LINUX_IF_ALG_H
#include <linux/types.h>
struct sockaddr_alg {
__u16 salg_family;
__u8 salg_type[14];
__u32 salg_feat;
__u32 salg_mask;
__u8 salg_name[64];
};
struct af_alg_iv {
__u32 ivlen;
__u8 iv[0];
};
/* Socket options */
#define ALG_SET_KEY 1
#define ALG_SET_IV 2
#define ALG_SET_OP 3
/* Operations */
#define ALG_OP_DECRYPT 0
#define ALG_OP_ENCRYPT 1
#endif /* _LINUX_IF_ALG_H */
src/libstrongswan/Makefile.am
-7
View File
@@ -285,13 +285,6 @@ endif
# build plugins with their own Makefile
#######################################
if USE_AF_ALG
SUBDIRS += plugins/af_alg
if MONOLITHIC
libstrongswan_la_LIBADD += plugins/af_alg/libstrongswan-af-alg.la
endif
endif
if USE_AES
SUBDIRS += plugins/aes
if MONOLITHIC
src/libstrongswan/plugins/af_alg/Makefile.am
-22
View File
@@ -1,22 +0,0 @@
AM_CPPFLAGS = \
-I${linux_headers} \
-I$(top_srcdir)/src/libstrongswan
AM_CFLAGS = \
$(PLUGIN_CFLAGS)
if MONOLITHIC
noinst_LTLIBRARIES = libstrongswan-af-alg.la
else
plugin_LTLIBRARIES = libstrongswan-af-alg.la
endif
libstrongswan_af_alg_la_SOURCES = \
af_alg_plugin.h af_alg_plugin.c \
af_alg_ops.h af_alg_ops.c \
af_alg_hasher.h af_alg_hasher.c \
af_alg_signer.h af_alg_signer.c \
af_alg_prf.h af_alg_prf.c \
af_alg_crypter.h af_alg_crypter.c
libstrongswan_af_alg_la_LDFLAGS = -module -avoid-version
src/libstrongswan/plugins/af_alg/af_alg_crypter.c
-232
View File
@@ -1,232 +0,0 @@
/*
* Copyright (C) 2019 Andreas Steffen
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "af_alg_crypter.h"
#include "af_alg_ops.h"
typedef struct private_af_alg_crypter_t private_af_alg_crypter_t;
/**
* Private data of af_alg_crypter_t
*/
struct private_af_alg_crypter_t {
/**
* Public part of this class.
*/
af_alg_crypter_t public;
/**
* AF_ALG operations
*/
af_alg_ops_t *ops;
/**
* Size of the truncated signature
*/
size_t block_size;
/**
* Size of the keymat
*/
size_t keymat_size;
/**
* Size of initialization vector
*/
size_t iv_size;
};
/**
* Algorithm database
*/
static struct {
encryption_algorithm_t id;
char *name;
size_t block_size;
/* key size of the algorithm */
size_t key_size;
/* size of the keying material (key + nonce for ctr mode) */
size_t keymat_size;
size_t iv_size;
} algs[AF_ALG_CRYPTER] = {
{ENCR_DES, "cbc(des)", 8, 8, 8, 8, },
{ENCR_DES_ECB, "ecb(des)", 8, 8, 8, 0, },
{ENCR_3DES, "cbc(des3_ede)", 8, 24, 24, 8, },
{ENCR_AES_CBC, "cbc(aes)", 16, 16, 16, 16, },
{ENCR_AES_CBC, "cbc(aes)", 16, 24, 24, 16, },
{ENCR_AES_CBC, "cbc(aes)", 16, 32, 32, 16, },
{ENCR_AES_ECB, "ecb(aes)", 16, 16, 16, 0, },
{ENCR_AES_ECB, "ecb(aes)", 16, 24, 24, 0, },
{ENCR_AES_ECB, "ecb(aes)", 16, 32, 32, 0, },
{ENCR_AES_CTR, "rfc3686(ctr(aes))", 1, 16, 20, 8, },
{ENCR_AES_CTR, "rfc3686(ctr(aes))", 1, 24, 28, 8, },
{ENCR_AES_CTR, "rfc3686(ctr(aes))", 1, 32, 36, 8, },
{ENCR_CAMELLIA_CBC, "cbc(camellia)", 16, 16, 16, 16, },
{ENCR_CAMELLIA_CBC, "cbc(camellia)", 16, 24, 24, 16, },
{ENCR_CAMELLIA_CBC, "cbc(camellia)", 16, 32, 32, 16, },
{ENCR_CAMELLIA_CTR, "rfc3686(ctr(camellia))", 1, 16, 20, 8, },
{ENCR_CAMELLIA_CTR, "rfc3686(ctr(camellia))", 1, 24, 28, 8, },
{ENCR_CAMELLIA_CTR, "rfc3686(ctr(camellia))", 1, 32, 36, 8, },
{ENCR_CAST, "cbc(cast5)", 8, 16, 16, 8, },
{ENCR_BLOWFISH, "cbc(blowfish)", 8, 16, 16, 8, },
{ENCR_BLOWFISH, "cbc(blowfish)", 8, 24, 24, 8, },
{ENCR_BLOWFISH, "cbc(blowfish)", 8, 32, 32, 8, },
{ENCR_SERPENT_CBC, "cbc(serpent)", 16, 16, 16, 16, },
{ENCR_SERPENT_CBC, "cbc(serpent)", 16, 24, 24, 16, },
{ENCR_SERPENT_CBC, "cbc(serpent)", 16, 32, 32, 16, },
{ENCR_TWOFISH_CBC, "cbc(twofish)", 16, 16, 16, 16, },
{ENCR_TWOFISH_CBC, "cbc(twofish)", 16, 24, 24, 16, },
{ENCR_TWOFISH_CBC, "cbc(twofish)", 16, 32, 32, 16, },
};
/**
* See header.
*/
void af_alg_crypter_probe(plugin_feature_t *features, int *pos)
{
af_alg_ops_t *ops;
int i;
for (i = 0; i < countof(algs); i++)
{
ops = af_alg_ops_create("skcipher", algs[i].name);
if (ops)
{
ops->destroy(ops);
features[(*pos)++] = PLUGIN_PROVIDE(CRYPTER,
algs[i].id, algs[i].key_size);
}
}
}
/**
* Get the kernel algorithm string and block/key size for our identifier
*/
static size_t lookup_alg(encryption_algorithm_t algo, char **name,
size_t key_size, size_t *keymat_size, size_t *iv_size)
{
int i;
for (i = 0; i < countof(algs); i++)
{
if (algs[i].id == algo &&
(key_size == 0 || algs[i].key_size == key_size))
{
*name = algs[i].name;
*keymat_size = algs[i].keymat_size;
*iv_size = algs[i].iv_size;
return algs[i].block_size;
}
}
return 0;
}
METHOD(crypter_t, decrypt, bool,
private_af_alg_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst)
{
if (dst)
{
*dst = chunk_alloc(data.len);
return this->ops->crypt(this->ops, ALG_OP_DECRYPT, iv, data, dst->ptr);
}
return this->ops->crypt(this->ops, ALG_OP_DECRYPT, iv, data, data.ptr);
}
METHOD(crypter_t, encrypt, bool,
private_af_alg_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst)
{
if (dst)
{
*dst = chunk_alloc(data.len);
return this->ops->crypt(this->ops, ALG_OP_ENCRYPT, iv, data, dst->ptr);
}
return this->ops->crypt(this->ops, ALG_OP_ENCRYPT, iv, data, data.ptr);
}
METHOD(crypter_t, get_block_size, size_t,
private_af_alg_crypter_t *this)
{
return this->block_size;
}
METHOD(crypter_t, get_iv_size, size_t,
private_af_alg_crypter_t *this)
{
return this->iv_size;
}
METHOD(crypter_t, get_key_size, size_t,
private_af_alg_crypter_t *this)
{
return this->keymat_size;
}
METHOD(crypter_t, set_key, bool,
private_af_alg_crypter_t *this, chunk_t key)
{
return this->ops->set_key(this->ops, key);
}
METHOD(crypter_t, destroy, void,
private_af_alg_crypter_t *this)
{
this->ops->destroy(this->ops);
free(this);
}
/*
* Described in header
*/
af_alg_crypter_t *af_alg_crypter_create(encryption_algorithm_t algo,
size_t key_size)
{
private_af_alg_crypter_t *this;
size_t block_size, keymat_size, iv_size;
char *name;
block_size = lookup_alg(algo, &name, key_size, &keymat_size, &iv_size);
if (!block_size)
{ /* not supported by kernel */
return NULL;
}
INIT(this,
.public = {
.crypter = {
.encrypt = _encrypt,
.decrypt = _decrypt,
.get_block_size = _get_block_size,
.get_iv_size = _get_iv_size,
.get_key_size = _get_key_size,
.set_key = _set_key,
.destroy = _destroy,
},
},
.block_size = block_size,
.keymat_size = keymat_size,
.iv_size = iv_size,
.ops = af_alg_ops_create("skcipher", name),
);
if (!this->ops)
{
free(this);
return NULL;
}
return &this->public;
}
src/libstrongswan/plugins/af_alg/af_alg_crypter.h
-62
View File
@@ -1,62 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup af_alg_crypter af_alg_crypter
* @{ @ingroup af_alg
*/
#ifndef AF_ALG_CRYPTER_H_
#define AF_ALG_CRYPTER_H_
typedef struct af_alg_crypter_t af_alg_crypter_t;
#include <plugins/plugin.h>
#include <crypto/crypters/crypter.h>
/** Number of crypters */
#define AF_ALG_CRYPTER 28
/**
* Implementation of signers using AF_ALG.
*/
struct af_alg_crypter_t {
/**
* The crypter_t interface.
*/
crypter_t crypter;
};
/**
* Constructor to create af_alg_crypter_t.
*
* @param algo algorithm to implement
* @param key_size key size in bytes
* @return af_alg_crypter_t, NULL if not supported
*/
af_alg_crypter_t *af_alg_crypter_create(encryption_algorithm_t algo,
size_t key_size);
/**
* Probe algorithms and return plugin features.
*
* @param features plugin features to create
* @param pos current position in features
*/
void af_alg_crypter_probe(plugin_feature_t *features, int *pos);
#endif /** AF_ALG_CRYPTER_H_ @}*/
src/libstrongswan/plugins/af_alg/af_alg_hasher.c
-173
View File
@@ -1,173 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "af_alg_hasher.h"
#include "af_alg_ops.h"
typedef struct private_af_alg_hasher_t private_af_alg_hasher_t;
/**
* Private data of af_alg_hasher_t
*/
struct private_af_alg_hasher_t {
/**
* Public part of this class.
*/
af_alg_hasher_t public;
/**
* AF_ALG operations
*/
af_alg_ops_t *ops;
/**
* Size of the hash
*/
size_t size;
};
/**
* Algorithm database
*/
static struct {
hash_algorithm_t id;
char *name;
size_t size;
} algs[AF_ALG_HASHER] = {
{HASH_MD4, "md4", HASH_SIZE_MD4 },
{HASH_MD5, "md5", HASH_SIZE_MD5 },
{HASH_SHA1, "sha1", HASH_SIZE_SHA1 },
{HASH_SHA224, "sha224", HASH_SIZE_SHA224 },
{HASH_SHA256, "sha256", HASH_SIZE_SHA256 },
{HASH_SHA384, "sha384", HASH_SIZE_SHA384 },
{HASH_SHA512, "sha512", HASH_SIZE_SHA512 },
};
/**
* See header.
*/
void af_alg_hasher_probe(plugin_feature_t *features, int *pos)
{
af_alg_ops_t *ops;
int i;
for (i = 0; i < countof(algs); i++)
{
ops = af_alg_ops_create("hash", algs[i].name);
if (ops)
{
ops->destroy(ops);
features[(*pos)++] = PLUGIN_PROVIDE(HASHER, algs[i].id);
}
}
}
/**
* Get the kernel algorithm string and hash size for our identifier
*/
static size_t lookup_alg(hash_algorithm_t algo, char **name)
{
int i;
for (i = 0; i < countof(algs); i++)
{
if (algs[i].id == algo)
{
*name = algs[i].name;
return algs[i].size;
}
}
return 0;
}
METHOD(hasher_t, get_hash_size, size_t,
private_af_alg_hasher_t *this)
{
return this->size;
}
METHOD(hasher_t, reset, bool,
private_af_alg_hasher_t *this)
{
this->ops->reset(this->ops);
return TRUE;
}
METHOD(hasher_t, get_hash, bool,
private_af_alg_hasher_t *this, chunk_t chunk, uint8_t *hash)
{
return this->ops->hash(this->ops, chunk, hash, this->size);
}
METHOD(hasher_t, allocate_hash, bool,
private_af_alg_hasher_t *this, chunk_t chunk, chunk_t *hash)
{
if (hash)
{
*hash = chunk_alloc(get_hash_size(this));
if (!get_hash(this, chunk, hash->ptr))
{
chunk_free(hash);
return FALSE;
}
return TRUE;
}
return get_hash(this, chunk, NULL);
}
METHOD(hasher_t, destroy, void,
private_af_alg_hasher_t *this)
{
this->ops->destroy(this->ops);
free(this);
}
/*
* Described in header
*/
af_alg_hasher_t *af_alg_hasher_create(hash_algorithm_t algo)
{
private_af_alg_hasher_t *this;
char *name;
size_t size;
size = lookup_alg(algo, &name);
if (!size)
{ /* not supported by kernel */
return NULL;
}
INIT(this,
.public = {
.hasher = {
.get_hash = _get_hash,
.allocate_hash = _allocate_hash,
.get_hash_size = _get_hash_size,
.reset = _reset,
.destroy = _destroy,
},
},
.ops = af_alg_ops_create("hash", name),
.size = size,
);
if (!this->ops)
{
free(this);
return NULL;
}
return &this->public;
}
src/libstrongswan/plugins/af_alg/af_alg_hasher.h
-60
View File
@@ -1,60 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup af_alg_hasher af_alg_hasher
* @{ @ingroup af_alg
*/
#ifndef af_alg_HASHER_H_
#define af_alg_HASHER_H_
typedef struct af_alg_hasher_t af_alg_hasher_t;
#include <plugins/plugin.h>
#include <crypto/hashers/hasher.h>
/** Number of hashers */
#define AF_ALG_HASHER 7
/**
* Implementation of hashers using AF_ALG.
*/
struct af_alg_hasher_t {
/**
* Implements hasher_t interface.
*/
hasher_t hasher;
};
/**
* Constructor to create af_alg_hasher_t.
*
* @param algo algorithm
* @return af_alg_hasher_t, NULL if not supported
*/
af_alg_hasher_t *af_alg_hasher_create(hash_algorithm_t algo);
/**
* Probe algorithms and return plugin features.
*
* @param features plugin features to create
* @param pos current position in deps
*/
void af_alg_hasher_probe(plugin_feature_t *features, int *pos);
#endif /** af_alg_HASHER_H_ @}*/
src/libstrongswan/plugins/af_alg/af_alg_ops.c
-255
View File
@@ -1,255 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "af_alg_ops.h"
#include <unistd.h>
#include <errno.h>
#include <linux/socket.h>
#include <utils/debug.h>
typedef struct private_af_alg_ops_t private_af_alg_ops_t;
/**
* Private data of an af_alg_ops_t object.
*/
struct private_af_alg_ops_t {
/**
* Public af_alg_ops_t interface.
*/
af_alg_ops_t public;
/**
* Transform FD
*/
int tfm;
/**
* Operation FD
*/
int op;
};
METHOD(af_alg_ops_t, reset, void,
private_af_alg_ops_t *this)
{
if (this->op != -1)
{
close(this->op);
this->op = -1;
}
}
METHOD(af_alg_ops_t, hash, bool,
private_af_alg_ops_t *this, chunk_t data, char *out, size_t outlen)
{
ssize_t len;
while (this->op == -1)
{
this->op = accept(this->tfm, NULL, 0);
if (this->op == -1 && errno != EINTR)
{
DBG1(DBG_LIB, "opening AF_ALG hasher failed: %s", strerror(errno));
return FALSE;
}
}
do
{
len = send(this->op, data.ptr, data.len, out ? 0 : MSG_MORE);
if (len == -1)
{
if (errno == EINTR)
{
continue;
}
DBG1(DBG_LIB, "writing to AF_ALG hasher failed: %s", strerror(errno));
return FALSE;
}
data = chunk_skip(data, len);
}
while (data.len);
if (out)
{
while (outlen)
{
len = read(this->op, out, outlen);
if (len == -1)
{
if (errno == EINTR)
{
continue;
}
DBG1(DBG_LIB, "reading AF_ALG hasher failed: %s", strerror(errno));
return FALSE;
}
outlen -= len;
out += len;
}
reset(this);
}
return TRUE;
}
METHOD(af_alg_ops_t, crypt_, bool,
private_af_alg_ops_t *this, uint32_t type, chunk_t iv, chunk_t data,
char *out)
{
struct msghdr msg = {};
struct cmsghdr *cmsg;
struct af_alg_iv *ivm;
struct iovec iov;
char buf[CMSG_SPACE(sizeof(type)) +
CMSG_SPACE(offsetof(struct af_alg_iv, iv) + iv.len)];
ssize_t len;
int op;
do
{
op = accept(this->tfm, NULL, 0);
if (op == -1 && errno != EINTR)
{
DBG1(DBG_LIB, "accepting AF_ALG crypter failed: %s", strerror(errno));
return FALSE;
}
}
while (op == -1);
memset(buf, 0, sizeof(buf));
msg.msg_control = buf;
msg.msg_controllen = sizeof(buf);
cmsg = CMSG_FIRSTHDR(&msg);
cmsg->cmsg_level = SOL_ALG;
cmsg->cmsg_type = ALG_SET_OP;
cmsg->cmsg_len = CMSG_LEN(sizeof(type));
memcpy(CMSG_DATA(cmsg), &type, sizeof(type));
cmsg = CMSG_NXTHDR(&msg, cmsg);
cmsg->cmsg_level = SOL_ALG;
cmsg->cmsg_type = ALG_SET_IV;
cmsg->cmsg_len = CMSG_LEN(offsetof(struct af_alg_iv, iv) + iv.len);
ivm = (void*)CMSG_DATA(cmsg);
ivm->ivlen = iv.len;
memcpy(ivm->iv, iv.ptr, iv.len);
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
while (data.len)
{
iov.iov_base = data.ptr;
iov.iov_len = data.len;
len = sendmsg(op, &msg, 0);
if (len == -1)
{
if (errno == EINTR)
{
continue;
}
DBG1(DBG_LIB, "writing to AF_ALG crypter failed: %s", strerror(errno));
close(op);
return FALSE;
}
while (read(op, out, len) != len)
{
if (errno != EINTR)
{
DBG1(DBG_LIB, "reading from AF_ALG crypter failed: %s",
strerror(errno));
close(op);
return FALSE;
}
}
data = chunk_skip(data, len);
out += len;
/* no IV for subsequent data chunks */
msg.msg_controllen = 0;
}
close(op);
return TRUE;
}
METHOD(af_alg_ops_t, set_key, bool,
private_af_alg_ops_t *this, chunk_t key)
{
if (setsockopt(this->tfm, SOL_ALG, ALG_SET_KEY, key.ptr, key.len) == -1)
{
DBG1(DBG_LIB, "setting AF_ALG key failed: %s", strerror(errno));
return FALSE;
}
return TRUE;
}
METHOD(af_alg_ops_t, destroy, void,
private_af_alg_ops_t *this)
{
close(this->tfm);
if (this->op != -1)
{
close(this->op);
}
free(this);
}
/**
* See header
*/
af_alg_ops_t *af_alg_ops_create(char *type, char *alg)
{
private_af_alg_ops_t *this;
struct sockaddr_alg sa = {
.salg_family = AF_ALG,
};
strncpy(sa.salg_type, type, sizeof(sa.salg_type) - 1);
strncpy(sa.salg_name, alg, sizeof(sa.salg_name) - 1);
INIT(this,
.public = {
.hash = _hash,
.reset = _reset,
.crypt = _crypt_,
.set_key = _set_key,
.destroy = _destroy,
},
.tfm = socket(AF_ALG, SOCK_SEQPACKET, 0),
.op = -1,
);
if (this->tfm == -1)
{
DBG1(DBG_LIB, "opening AF_ALG socket failed: %s", strerror(errno));
free(this);
return NULL;
}
if (bind(this->tfm, (struct sockaddr*)&sa, sizeof(sa)) == -1)
{
if (errno != ENOENT)
{ /* fail silently if algorithm not supported */
DBG1(DBG_LIB, "binding AF_ALG socket for '%s' failed: %s",
sa.salg_name, strerror(errno));
}
destroy(this);
return NULL;
}
return &this->public;
}
src/libstrongswan/plugins/af_alg/af_alg_ops.h
-94
View File
@@ -1,94 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup af_alg_ops af_alg_ops
* @{ @ingroup af_alg
*/
#ifndef AF_ALG_OPS_H_
#define AF_ALG_OPS_H_
#include <library.h>
#include <linux/if_alg.h>
#ifndef AF_ALG
#define AF_ALG 38
#endif /* AF_ALG */
#ifndef SOL_ALG
#define SOL_ALG 279
#endif /* SOL_ALG */
typedef struct af_alg_ops_t af_alg_ops_t;
/**
* Helper to run AF_ALG operations.
*/
struct af_alg_ops_t {
/**
* Hash a chunk of data.
*
* @param data data to hash
* @param out buffer to write hash to, NULL for append mode
* @param outlen number of bytes to read into out
* @return TRUE if successful
*/
bool (*hash)(af_alg_ops_t *this, chunk_t data, char *out, size_t outlen);
/**
* Reset hasher state.
*/
void (*reset)(af_alg_ops_t *this);
/**
* En-/Decrypt a chunk of data.
*
* @param type crypto operation (ALG_OP_DECRYPT/ALG_OP_ENCRYPT)
* @param iv iv to use
* @param data data to encrypt/decrypt
* @param out buffer write processed data to
* @return TRUE if successful
*/
bool (*crypt)(af_alg_ops_t *this, uint32_t type, chunk_t iv, chunk_t data,
char *out);
/**
* Set the key for en-/decryption or HMAC/XCBC operations.
*
* @param key key to set for transform
* @return TRUE if successful
*/
bool (*set_key)(af_alg_ops_t *this, chunk_t key);
/**
* Destroy a af_alg_ops_t.
*/
void (*destroy)(af_alg_ops_t *this);
};
/**
* Create a af_alg_ops instance.
*
* @param type algorithm type (hash, skcipher)
* @param alg algorithm name
* @return TRUE if AF_ALG socket bound successfully
*/
af_alg_ops_t *af_alg_ops_create(char *type, char *alg);
#endif /** AF_ALG_OPS_H_ @}*/
src/libstrongswan/plugins/af_alg/af_alg_plugin.c
-110
View File
@@ -1,110 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "af_alg_plugin.h"
#include <library.h>
#include "af_alg_hasher.h"
#include "af_alg_signer.h"
#include "af_alg_prf.h"
#include "af_alg_crypter.h"
#include <unistd.h>
typedef struct private_af_alg_plugin_t private_af_alg_plugin_t;
/**
* private data of af_alg_plugin
*/
struct private_af_alg_plugin_t {
/**
* public functions
*/
af_alg_plugin_t public;
};
METHOD(plugin_t, get_name, char*,
private_af_alg_plugin_t *this)
{
return "af-alg";
}
static bool af_alg_supported()
{
int fd;
fd = socket(AF_ALG, SOCK_SEQPACKET, 0);
if (fd != -1)
{
close(fd);
return true;
}
return false;
}
METHOD(plugin_t, get_features, int,
private_af_alg_plugin_t *this, plugin_feature_t *features[])
{
static plugin_feature_t f[AF_ALG_HASHER + AF_ALG_SIGNER +
AF_ALG_PRF + AF_ALG_CRYPTER + 4] = {};
static int count = 0;
if (!count)
{ /* initialize only once */
if (!af_alg_supported())
{
return 0;
}
f[count++] = PLUGIN_REGISTER(HASHER, af_alg_hasher_create);
af_alg_hasher_probe(f, &count);
f[count++] = PLUGIN_REGISTER(SIGNER, af_alg_signer_create);
af_alg_signer_probe(f, &count);
f[count++] = PLUGIN_REGISTER(PRF, af_alg_prf_create);
af_alg_prf_probe(f, &count);
f[count++] = PLUGIN_REGISTER(CRYPTER, af_alg_crypter_create);
af_alg_crypter_probe(f, &count);
}
*features = f;
return count;
}
METHOD(plugin_t, destroy, void,
private_af_alg_plugin_t *this)
{
free(this);
}
/*
* see header file
*/
PLUGIN_DEFINE(af_alg)
{
private_af_alg_plugin_t *this;
INIT(this,
.public = {
.plugin = {
.get_name = _get_name,
.get_features = _get_features,
.destroy = _destroy,
},
},
);
return &this->public.plugin;
}
src/libstrongswan/plugins/af_alg/af_alg_plugin.h
-43
View File
@@ -1,43 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup af_alg af_alg
* @ingroup plugins
*
* @defgroup af_alg_plugin af_alg_plugin
* @{ @ingroup af_alg
*/
#ifndef AF_ALG_PLUGIN_H_
#define AF_ALG_PLUGIN_H_
#include <plugins/plugin.h>
typedef struct af_alg_plugin_t af_alg_plugin_t;
/**
* Plugin providing the AF_ALG interface to the Linux Crypto API.
*/
struct af_alg_plugin_t {
/**
* Implements plugin interface.
*/
plugin_t plugin;
};
#endif /** AF_ALG_PLUGIN_H_ @}*/
src/libstrongswan/plugins/af_alg/af_alg_prf.c
-212
View File
@@ -1,212 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "af_alg_prf.h"
#include "af_alg_ops.h"
typedef struct private_af_alg_prf_t private_af_alg_prf_t;
/**
* Private data of a af_alg_prf_t object.
*/
struct private_af_alg_prf_t {
/**
* Public af_alg_prf_t interface.
*/
af_alg_prf_t public;
/**
* AF_ALG operations
*/
af_alg_ops_t *ops;
/**
* Size of the PRF output
*/
size_t block_size;
/**
* Default key size
*/
size_t key_size;
/**
* Using an XCBC algorithm?
*/
bool xcbc;
};
/**
* Algorithm database
*/
static struct {
pseudo_random_function_t id;
char *name;
size_t block_size;
bool xcbc;
} algs[AF_ALG_PRF] = {
{PRF_HMAC_SHA1, "hmac(sha1)", 20, FALSE, },
{PRF_HMAC_SHA2_256, "hmac(sha256)", 32, FALSE, },
{PRF_HMAC_MD5, "hmac(md5)", 16, FALSE, },
{PRF_HMAC_SHA2_384, "hmac(sha384)", 48, FALSE, },
{PRF_HMAC_SHA2_512, "hmac(sha512)", 64, FALSE, },
{PRF_AES128_XCBC, "xcbc(aes)", 16, TRUE, },
{PRF_CAMELLIA128_XCBC, "xcbc(camellia)", 16, TRUE, },
};
/**
* See header.
*/
void af_alg_prf_probe(plugin_feature_t *features, int *pos)
{
af_alg_ops_t *ops;
int i;
for (i = 0; i < countof(algs); i++)
{
ops = af_alg_ops_create("hash", algs[i].name);
if (ops)
{
ops->destroy(ops);
features[(*pos)++] = PLUGIN_PROVIDE(PRF, algs[i].id);
}
}
}
/**
* Get the kernel algorithm string and block size for our identifier
*/
static size_t lookup_alg(pseudo_random_function_t algo, char **name, bool *xcbc)
{
int i;
for (i = 0; i < countof(algs); i++)
{
if (algs[i].id == algo)
{
*name = algs[i].name;
*xcbc = algs[i].xcbc;
return algs[i].block_size;
}
}
return 0;
}
METHOD(prf_t, get_bytes, bool,
private_af_alg_prf_t *this, chunk_t seed, uint8_t *buffer)
{
return this->ops->hash(this->ops, seed, buffer, this->block_size);
}
METHOD(prf_t, allocate_bytes, bool,
private_af_alg_prf_t *this, chunk_t seed, chunk_t *chunk)
{
if (chunk)
{
*chunk = chunk_alloc(this->block_size);
return get_bytes(this, seed, chunk->ptr);
}
return get_bytes(this, seed, NULL);
}
METHOD(prf_t, get_block_size, size_t,
private_af_alg_prf_t *this)
{
return this->block_size;
}
METHOD(prf_t, get_key_size, size_t,
private_af_alg_prf_t *this)
{
return this->block_size;
}
METHOD(prf_t, set_key, bool,
private_af_alg_prf_t *this, chunk_t key)
{
char buf[this->block_size];
this->ops->reset(this->ops);
if (this->xcbc)
{
/* The kernel currently does not support variable length XCBC keys,
* do RFC4434 key padding/reduction manually. */
if (key.len < this->block_size)
{
memset(buf, 0, this->block_size);
memcpy(buf, key.ptr, key.len);
key = chunk_from_thing(buf);
}
else if (key.len > this->block_size)
{
memset(buf, 0, this->block_size);
if (!this->ops->set_key(this->ops, chunk_from_thing(buf)) ||
!this->ops->hash(this->ops, key, buf, this->block_size))
{
return FALSE;
}
key = chunk_from_thing(buf);
}
}
return this->ops->set_key(this->ops, key);
}
METHOD(prf_t, destroy, void,
private_af_alg_prf_t *this)
{
this->ops->destroy(this->ops);
free(this);
}
/*
* Described in header.
*/
af_alg_prf_t *af_alg_prf_create(pseudo_random_function_t algo)
{
private_af_alg_prf_t *this;
size_t block_size;
bool xcbc;
char *name;
block_size = lookup_alg(algo, &name, &xcbc);
if (!block_size)
{ /* not supported by kernel */
return NULL;
}
INIT(this,
.public = {
.prf = {
.get_bytes = _get_bytes,
.allocate_bytes = _allocate_bytes,
.get_block_size = _get_block_size,
.get_key_size = _get_key_size,
.set_key = _set_key,
.destroy = _destroy,
},
},
.ops = af_alg_ops_create("hash", name),
.block_size = block_size,
.xcbc = xcbc,
);
if (!this->ops)
{
free(this);
return NULL;
}
return &this->public;
}
src/libstrongswan/plugins/af_alg/af_alg_prf.h
-60
View File
@@ -1,60 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup af_alg_prf af_alg_prf
* @{ @ingroup af_alg
*/
#ifndef AF_ALG_PRF_H_
#define AF_ALG_PRF_H_
typedef struct af_alg_prf_t af_alg_prf_t;
#include <plugins/plugin.h>
#include <crypto/prfs/prf.h>
/** Number of PRFs */
#define AF_ALG_PRF 7
/**
* Implementation of PRFs using AF_ALG.
*/
struct af_alg_prf_t {
/**
* Implements prf_t interface.
*/
prf_t prf;
};
/**
* Creates a new af_alg_prf_t object.
*
* @param algo algorithm to implement
* @return af_alg_prf_t object, NULL if hash not supported
*/
af_alg_prf_t *af_alg_prf_create(pseudo_random_function_t algo);
/**
* Probe algorithms and return plugin features.
*
* @param features plugin features to create
* @param pos current position in features
*/
void af_alg_prf_probe(plugin_feature_t *features, int *pos);
#endif /** AF_ALG_PRF_H_ @}*/
src/libstrongswan/plugins/af_alg/af_alg_signer.c
-208
View File
@@ -1,208 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "af_alg_signer.h"
#include "af_alg_ops.h"
typedef struct private_af_alg_signer_t private_af_alg_signer_t;
/**
* Private data structure with signing context.
*/
struct private_af_alg_signer_t {
/**
* Public interface of af_alg_signer_t.
*/
af_alg_signer_t public;
/**
* AF_ALG operations
*/
af_alg_ops_t *ops;
/**
* Size of the truncated signature
*/
size_t block_size;
/**
* Default key size
*/
size_t key_size;
};
/**
* Algorithm database
*/
static struct {
integrity_algorithm_t id;
char *name;
size_t block_size;
size_t key_size;
} algs[AF_ALG_SIGNER] = {
{AUTH_HMAC_SHA1_96, "hmac(sha1)", 12, 20, },
{AUTH_HMAC_SHA1_128, "hmac(sha1)", 16, 20, },
{AUTH_HMAC_SHA1_160, "hmac(sha1)", 20, 20, },
{AUTH_HMAC_SHA2_256_96, "hmac(sha256)", 12, 32, },
{AUTH_HMAC_SHA2_256_128, "hmac(sha256)", 16, 32, },
{AUTH_HMAC_MD5_96, "hmac(md5)", 12, 16, },
{AUTH_HMAC_MD5_128, "hmac(md5)", 16, 16, },
{AUTH_HMAC_SHA2_256_256, "hmac(sha256)", 32, 32, },
{AUTH_HMAC_SHA2_384_192, "hmac(sha384)", 24, 48, },
{AUTH_HMAC_SHA2_384_384, "hmac(sha384)", 48, 48, },
{AUTH_HMAC_SHA2_512_256, "hmac(sha512)", 32, 64, },
{AUTH_HMAC_SHA2_512_512, "hmac(sha512)", 64, 64, },
{AUTH_AES_XCBC_96, "xcbc(aes)", 12, 16, },
{AUTH_CAMELLIA_XCBC_96, "xcbc(camellia)", 12, 16, },
};
/**
* See header.
*/
void af_alg_signer_probe(plugin_feature_t *features, int *pos)
{
af_alg_ops_t *ops;
int i;
for (i = 0; i < countof(algs); i++)
{
ops = af_alg_ops_create("hash", algs[i].name);
if (ops)
{
ops->destroy(ops);
features[(*pos)++] = PLUGIN_PROVIDE(SIGNER, algs[i].id);
}
}
}
/**
* Get the kernel algorithm string and block/key size for our identifier
*/
static size_t lookup_alg(integrity_algorithm_t algo, char **name,
size_t *key_size)
{
int i;
for (i = 0; i < countof(algs); i++)
{
if (algs[i].id == algo)
{
*name = algs[i].name;
*key_size = algs[i].key_size;
return algs[i].block_size;
}
}
return 0;
}
METHOD(signer_t, get_signature, bool,
private_af_alg_signer_t *this, chunk_t data, uint8_t *buffer)
{
return this->ops->hash(this->ops, data, buffer, this->block_size);
}
METHOD(signer_t, allocate_signature, bool,
private_af_alg_signer_t *this, chunk_t data, chunk_t *chunk)
{
if (chunk)
{
*chunk = chunk_alloc(this->block_size);
return get_signature(this, data, chunk->ptr);
}
return get_signature(this, data, NULL);
}
METHOD(signer_t, verify_signature, bool,
private_af_alg_signer_t *this, chunk_t data, chunk_t signature)
{
char sig[this->block_size];
if (signature.len != this->block_size)
{
return FALSE;
}
if (!get_signature(this, data, sig))
{
return FALSE;
}
return memeq_const(signature.ptr, sig, signature.len);
}
METHOD(signer_t, get_key_size, size_t,
private_af_alg_signer_t *this)
{
return this->key_size;
}
METHOD(signer_t, get_block_size, size_t,
private_af_alg_signer_t *this)
{
return this->block_size;
}
METHOD(signer_t, set_key, bool,
private_af_alg_signer_t *this, chunk_t key)
{
this->ops->reset(this->ops);
return this->ops->set_key(this->ops, key);
}
METHOD(signer_t, destroy, void,
private_af_alg_signer_t *this)
{
this->ops->destroy(this->ops);
free(this);
}
/*
* Described in header
*/
af_alg_signer_t *af_alg_signer_create(integrity_algorithm_t algo)
{
private_af_alg_signer_t *this;
size_t block_size, key_size = 0;
char *name;
block_size = lookup_alg(algo, &name, &key_size);
if (!block_size)
{ /* not supported by kernel */
return NULL;
}
INIT(this,
.public = {
.signer = {
.get_signature = _get_signature,
.allocate_signature = _allocate_signature,
.verify_signature = _verify_signature,
.get_key_size = _get_key_size,
.get_block_size = _get_block_size,
.set_key = _set_key,
.destroy = _destroy,
},
},
.ops = af_alg_ops_create("hash", name),
.block_size = block_size,
.key_size = key_size,
);
if (!this->ops)
{
free(this);
return NULL;
}
return &this->public;
}
src/libstrongswan/plugins/af_alg/af_alg_signer.h
-60
View File
@@ -1,60 +0,0 @@
/*
* Copyright (C) 2010 Martin Willi
*
* Copyright (C) secunet Security Networks AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup af_alg_signer af_alg_signer
* @{ @ingroup af_alg
*/
#ifndef AF_ALG_SIGNER_H_
#define AF_ALG_SIGNER_H_
typedef struct af_alg_signer_t af_alg_signer_t;
#include <plugins/plugin.h>
#include <crypto/signers/signer.h>
/** Number of signers */
#define AF_ALG_SIGNER 14
/**
* Implementation of signers using AF_ALG.
*/
struct af_alg_signer_t {
/**
* Implements signer_t interface.
*/
signer_t signer;
};
/**
* Creates a new af_alg_signer_t.
*
* @param algo algorithm to implement
* @return af_alg_signer_t, NULL if not supported
*/
af_alg_signer_t *af_alg_signer_create(integrity_algorithm_t algo);
/**
* Probe algorithms and return plugin features.
*
* @param features plugin features to create
* @param pos current position in features
*/
void af_alg_signer_probe(plugin_feature_t *features, int *pos);
#endif /** AF_ALG_SIGNER_H_ @}*/
testing/scripts/recipes/013_strongswan.mk
-1
View File
@@ -82,7 +82,6 @@ CONFIG_OPTS = \
--enable-hmac \
--enable-chapoly \
--enable-ha \
--enable-af-alg \
--enable-whitelist \
--enable-xauth-generic \
--enable-xauth-eap \
testing/tests/af-alg/alg-camellia/description.txt
-3
View File
@@ -1,3 +0,0 @@
Roadwarrior <b>carol</b> proposes to gateway <b>moon</b> the IKE cipher suite <b>camellia256-sha512-modp3072</b>
well as the ESP cipher suite <b>camellia192-sha384</b>. A ping from <b>carol</b> to <b>alice</b> successfully
checks the established tunnel.
testing/tests/af-alg/alg-camellia/evaltest.dat
-7
View File
@@ -1,7 +0,0 @@
carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon:: ip xfrm state::enc cbc(camellia)::YES
carol::ip xfrm state::enc cbc(camellia)::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES
testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf
-9
View File
@@ -1,9 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 pubkey openssl random
}
charon-systemd {
load = random nonce pem pkcs1 af-alg openssl revocation kernel-netlink curl socket-default updown vici
}
testing/tests/af-alg/alg-camellia/hosts/carol/etc/swanctl/swanctl.conf
-27
View File
@@ -1,27 +0,0 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = camellia192-sha384
}
}
version = 2
proposals = camellia256-sha512-modp3072
}
}
testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf
-9
View File
@@ -1,9 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 pubkey openssl random
}
charon-systemd {
load = random nonce pem pkcs1 af-alg openssl revocation kernel-netlink curl socket-default updown vici
}
testing/tests/af-alg/alg-camellia/hosts/moon/etc/swanctl/swanctl.conf
-25
View File
@@ -1,25 +0,0 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = camellia192-sha384
}
}
version = 2
proposals = camellia256-sha512-modp3072
}
}
testing/tests/af-alg/alg-camellia/posttest.dat
-5
View File
@@ -1,5 +0,0 @@
carol::swanctl --terminate --ike home
carol::systemctl stop strongswan
moon::systemctl stop strongswan
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
testing/tests/af-alg/alg-camellia/pretest.dat
-7
View File
@@ -1,7 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
moon::systemctl start strongswan
carol::systemctl start strongswan
moon::expect-connection net
carol::expect-connection home
carol::swanctl --initiate --child home 2> /dev/null
testing/tests/af-alg/alg-camellia/test.conf
-25
View File
@@ -1,25 +0,0 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice moon carol winnetou"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol"
# charon controlled by swanctl
#
SWANCTL=1
testing/tests/af-alg/rw-cert/description.txt
-12
View File
@@ -1,12 +0,0 @@
The roadwarrior <b>carol</b> and the gateway <b>moon</b> use the <b>Crypto API</b>
of the Linux kernel via the <b>af_alg</b> userland interface for all symmetric
encryption and hash functions whereas roadwarrior <b>dave</b> uses <b>openssl</b>
as the default <b>strongSwan</b> cryptographical plugin.
<p>
The roadwarriors <b>carol</b> and <b>dave</b> set up a connection each
to gateway <b>moon</b>. The authentication is based on <b>X.509 certificates</b>.
Upon the successful establishment of the IPsec tunnel automatically iptables-based
firewall rules are inserted which let pass the tunneled traffic.
In order to test both tunnel and firewall, both <b>carol</b> and <b>dave</b> ping
the client <b>alice</b> behind the gateway <b>moon</b>.
testing/tests/af-alg/rw-cert/evaltest.dat
-10
View File
@@ -1,10 +0,0 @@
carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES
carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES
dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 [email protected] remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES
moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 [email protected].*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES
moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 [email protected].*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES
moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES
moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES
moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES
testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf
-9
View File
@@ -1,9 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 pubkey openssl random
}
charon-systemd {
load = random nonce test-vectors pem pkcs1 af-alg ccm gcm openssl revocation curl kernel-netlink socket-default updown vici
}
testing/tests/af-alg/rw-cert/hosts/carol/etc/swanctl/swanctl.conf
-27
View File
@@ -1,27 +0,0 @@
connections {
home {
local_addrs = 192.168.0.100
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = carolCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = 3des-sha1-modp1536
}
}
version = 2
proposals = 3des-sha1-modp1536
}
}
testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf
-9
View File
@@ -1,9 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 pubkey openssl random
}
charon-systemd {
load = random nonce openssl test-vectors pem pkcs1 revocation curl kernel-netlink socket-default updown vici
}
testing/tests/af-alg/rw-cert/hosts/dave/etc/swanctl/swanctl.conf
-27
View File
@@ -1,27 +0,0 @@
connections {
home {
local_addrs = 192.168.0.200
remote_addrs = 192.168.0.1
local {
auth = pubkey
certs = daveCert.pem
id = [email protected]
}
remote {
auth = pubkey
id = moon.strongswan.org
}
children {
home {
remote_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128-sha256-modp3072
}
}
version = 2
proposals = aes128-sha256-modp3072
}
}
testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf
-14
View File
@@ -1,14 +0,0 @@
# /etc/strongswan.conf - strongSwan configuration file
swanctl {
load = pem pkcs1 pubkey openssl random
}
charon-systemd {
load = random nonce test-vectors pem pkcs1 af-alg ccm gcm openssl revocation curl kernel-netlink socket-default updown vici
integrity_test = yes
crypto_test {
on_add = yes
}
}
testing/tests/af-alg/rw-cert/hosts/moon/etc/swanctl/swanctl.conf
-25
View File
@@ -1,25 +0,0 @@
connections {
rw {
local_addrs = 192.168.0.1
local {
auth = pubkey
certs = moonCert.pem
id = moon.strongswan.org
}
remote {
auth = pubkey
}
children {
net {
local_ts = 10.1.0.0/16
updown = /usr/local/libexec/ipsec/_updown iptables
esp_proposals = aes128-sha256-modp3072,3des-sha1-modp1536
}
}
version = 2
proposals = aes128-sha256-modp3072,3des-sha1-modp1536
}
}
testing/tests/af-alg/rw-cert/posttest.dat
-8
View File
@@ -1,8 +0,0 @@
carol::swanctl --terminate --ike home
dave::swanctl --terminate --ike home
carol::systemctl stop strongswan
dave::systemctl stop strongswan
moon::systemctl stop strongswan
moon::iptables-restore < /etc/iptables.flush
carol::iptables-restore < /etc/iptables.flush
dave::iptables-restore < /etc/iptables.flush
testing/tests/af-alg/rw-cert/pretest.dat
-11
View File
@@ -1,11 +0,0 @@
moon::iptables-restore < /etc/iptables.rules
carol::iptables-restore < /etc/iptables.rules
dave::iptables-restore < /etc/iptables.rules
moon::systemctl start strongswan
carol::systemctl start strongswan
dave::systemctl start strongswan
moon::expect-connection net
carol::expect-connection home
carol::swanctl --initiate --child home 2> /dev/null
dave::expect-connection home
dave::swanctl --initiate --child home 2> /dev/null
testing/tests/af-alg/rw-cert/test.conf
-25
View File
@@ -1,25 +0,0 @@
#!/bin/bash
#
# This configuration file provides information on the
# guest instances used for this test
# All guest instances that are required for this test
#
VIRTHOSTS="alice moon carol winnetou dave"
# Corresponding block diagram
#
DIAGRAM="a-m-c-w-d.png"
# Guest instances on which tcpdump is to be started
#
TCPDUMPHOSTS="moon"
# Guest instances on which IPsec is started
# Used for IPsec logging purposes
#
IPSECHOSTS="moon carol dave"
# charon controlled by swanctl
#
SWANCTL=1