diff --git a/configure.ac b/configure.ac index 2cf4133f6..e9b7b27d1 100644 --- a/configure.ac +++ b/configure.ac @@ -129,7 +129,6 @@ AC_SUBST(ipsec_script_upper, [`echo -n "$ipsec_script" | tr a-z A-Z`]) # crypto plugins ARG_ENABL_SET([aes], [enable AES software implementation plugin.]) -ARG_ENABL_SET([af-alg], [enable AF_ALG crypto interface to Linux Crypto API.]) ARG_ENABL_SET([botan], [enables the Botan crypto plugin.]) ARG_ENABL_SET([ccm], [enables the CCM AEAD wrapper crypto plugin.]) ARG_ENABL_SET([chapoly], [enables the ChaCha20/Poly1305 AEAD plugin.]) @@ -1522,7 +1521,6 @@ ADD_PLUGIN([wolfssl], [s charon swanctl pki scripts attest nm cmd a ADD_PLUGIN([gcrypt], [s charon swanctl pki scripts attest nm cmd aikgen]) ADD_PLUGIN([botan], [s charon swanctl pki scripts attest nm cmd aikgen]) ADD_PLUGIN([pkcs8], [s charon swanctl pki scripts attest nm cmd]) -ADD_PLUGIN([af-alg], [s charon swanctl pki scripts attest nm cmd aikgen]) ADD_PLUGIN([fips-prf], [s charon nm cmd]) ADD_PLUGIN([gmp], [s charon swanctl pki scripts attest nm cmd aikgen fc]) ADD_PLUGIN([curve25519], [s charon swanctl pki scripts nm cmd]) @@ -1692,7 +1690,6 @@ AM_CONDITIONAL(USE_CHAPOLY, test x$chapoly = xtrue) AM_CONDITIONAL(USE_CTR, test x$ctr = xtrue) AM_CONDITIONAL(USE_CCM, test x$ccm = xtrue) AM_CONDITIONAL(USE_GCM, test x$gcm = xtrue) -AM_CONDITIONAL(USE_AF_ALG, test x$af_alg = xtrue) AM_CONDITIONAL(USE_DRBG, test x$drbg = xtrue) AM_CONDITIONAL(USE_ML, test x$ml = xtrue) @@ -1974,7 +1971,6 @@ AC_CONFIG_FILES([ src/libstrongswan/plugins/ctr/Makefile src/libstrongswan/plugins/ccm/Makefile src/libstrongswan/plugins/gcm/Makefile - src/libstrongswan/plugins/af_alg/Makefile src/libstrongswan/plugins/drbg/Makefile src/libstrongswan/plugins/ml/Makefile src/libstrongswan/plugins/test_vectors/Makefile diff --git a/scripts/test.sh b/scripts/test.sh index b055754c6..b6b702c8b 100755 --- a/scripts/test.sh +++ b/scripts/test.sh @@ -268,8 +268,6 @@ all|alpine|codeql|coverage|sonarcloud|no-dbg|no-testable-ke) --disable-unwind-backtraces --disable-svc --disable-dbghelp-backtraces --disable-socket-win --disable-kernel-wfp --disable-kernel-iph --disable-winhttp" - # not enabled on the build server - CONFIG="$CONFIG --disable-af-alg" if test "$TEST" != "coverage"; then CONFIG="$CONFIG --disable-coverage" else diff --git a/src/include/Makefile.am b/src/include/Makefile.am index 8e6db88a4..3d7e99794 100644 --- a/src/include/Makefile.am +++ b/src/include/Makefile.am @@ -1,2 +1,2 @@ -EXTRA_DIST = linux/if_alg.h linux/ipsec.h linux/netlink.h linux/rtnetlink.h \ +EXTRA_DIST = linux/ipsec.h linux/netlink.h linux/rtnetlink.h \ linux/pfkeyv2.h linux/udp.h linux/socket.h linux/xfrm.h sys/queue.h diff --git a/src/include/linux/if_alg.h b/src/include/linux/if_alg.h deleted file mode 100644 index 0f9acce5b..000000000 --- a/src/include/linux/if_alg.h +++ /dev/null @@ -1,40 +0,0 @@ -/* - * if_alg: User-space algorithm interface - * - * Copyright (c) 2010 Herbert Xu - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) - * any later version. - * - */ - -#ifndef _LINUX_IF_ALG_H -#define _LINUX_IF_ALG_H - -#include - -struct sockaddr_alg { - __u16 salg_family; - __u8 salg_type[14]; - __u32 salg_feat; - __u32 salg_mask; - __u8 salg_name[64]; -}; - -struct af_alg_iv { - __u32 ivlen; - __u8 iv[0]; -}; - -/* Socket options */ -#define ALG_SET_KEY 1 -#define ALG_SET_IV 2 -#define ALG_SET_OP 3 - -/* Operations */ -#define ALG_OP_DECRYPT 0 -#define ALG_OP_ENCRYPT 1 - -#endif /* _LINUX_IF_ALG_H */ diff --git a/src/libstrongswan/Makefile.am b/src/libstrongswan/Makefile.am index 0a5d77955..2848bf77e 100644 --- a/src/libstrongswan/Makefile.am +++ b/src/libstrongswan/Makefile.am @@ -285,13 +285,6 @@ endif # build plugins with their own Makefile ####################################### -if USE_AF_ALG - SUBDIRS += plugins/af_alg -if MONOLITHIC - libstrongswan_la_LIBADD += plugins/af_alg/libstrongswan-af-alg.la -endif -endif - if USE_AES SUBDIRS += plugins/aes if MONOLITHIC diff --git a/src/libstrongswan/plugins/af_alg/Makefile.am b/src/libstrongswan/plugins/af_alg/Makefile.am deleted file mode 100644 index bd3985367..000000000 --- a/src/libstrongswan/plugins/af_alg/Makefile.am +++ /dev/null @@ -1,22 +0,0 @@ -AM_CPPFLAGS = \ - -I${linux_headers} \ - -I$(top_srcdir)/src/libstrongswan - -AM_CFLAGS = \ - $(PLUGIN_CFLAGS) - -if MONOLITHIC -noinst_LTLIBRARIES = libstrongswan-af-alg.la -else -plugin_LTLIBRARIES = libstrongswan-af-alg.la -endif - -libstrongswan_af_alg_la_SOURCES = \ - af_alg_plugin.h af_alg_plugin.c \ - af_alg_ops.h af_alg_ops.c \ - af_alg_hasher.h af_alg_hasher.c \ - af_alg_signer.h af_alg_signer.c \ - af_alg_prf.h af_alg_prf.c \ - af_alg_crypter.h af_alg_crypter.c - -libstrongswan_af_alg_la_LDFLAGS = -module -avoid-version diff --git a/src/libstrongswan/plugins/af_alg/af_alg_crypter.c b/src/libstrongswan/plugins/af_alg/af_alg_crypter.c deleted file mode 100644 index a8731265a..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_crypter.c +++ /dev/null @@ -1,232 +0,0 @@ -/* - * Copyright (C) 2019 Andreas Steffen - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_crypter.h" -#include "af_alg_ops.h" - -typedef struct private_af_alg_crypter_t private_af_alg_crypter_t; - -/** - * Private data of af_alg_crypter_t - */ -struct private_af_alg_crypter_t { - - /** - * Public part of this class. - */ - af_alg_crypter_t public; - - /** - * AF_ALG operations - */ - af_alg_ops_t *ops; - - /** - * Size of the truncated signature - */ - size_t block_size; - - /** - * Size of the keymat - */ - size_t keymat_size; - - /** - * Size of initialization vector - */ - size_t iv_size; -}; - -/** - * Algorithm database - */ -static struct { - encryption_algorithm_t id; - char *name; - size_t block_size; - /* key size of the algorithm */ - size_t key_size; - /* size of the keying material (key + nonce for ctr mode) */ - size_t keymat_size; - size_t iv_size; -} algs[AF_ALG_CRYPTER] = { - {ENCR_DES, "cbc(des)", 8, 8, 8, 8, }, - {ENCR_DES_ECB, "ecb(des)", 8, 8, 8, 0, }, - {ENCR_3DES, "cbc(des3_ede)", 8, 24, 24, 8, }, - {ENCR_AES_CBC, "cbc(aes)", 16, 16, 16, 16, }, - {ENCR_AES_CBC, "cbc(aes)", 16, 24, 24, 16, }, - {ENCR_AES_CBC, "cbc(aes)", 16, 32, 32, 16, }, - {ENCR_AES_ECB, "ecb(aes)", 16, 16, 16, 0, }, - {ENCR_AES_ECB, "ecb(aes)", 16, 24, 24, 0, }, - {ENCR_AES_ECB, "ecb(aes)", 16, 32, 32, 0, }, - {ENCR_AES_CTR, "rfc3686(ctr(aes))", 1, 16, 20, 8, }, - {ENCR_AES_CTR, "rfc3686(ctr(aes))", 1, 24, 28, 8, }, - {ENCR_AES_CTR, "rfc3686(ctr(aes))", 1, 32, 36, 8, }, - {ENCR_CAMELLIA_CBC, "cbc(camellia)", 16, 16, 16, 16, }, - {ENCR_CAMELLIA_CBC, "cbc(camellia)", 16, 24, 24, 16, }, - {ENCR_CAMELLIA_CBC, "cbc(camellia)", 16, 32, 32, 16, }, - {ENCR_CAMELLIA_CTR, "rfc3686(ctr(camellia))", 1, 16, 20, 8, }, - {ENCR_CAMELLIA_CTR, "rfc3686(ctr(camellia))", 1, 24, 28, 8, }, - {ENCR_CAMELLIA_CTR, "rfc3686(ctr(camellia))", 1, 32, 36, 8, }, - {ENCR_CAST, "cbc(cast5)", 8, 16, 16, 8, }, - {ENCR_BLOWFISH, "cbc(blowfish)", 8, 16, 16, 8, }, - {ENCR_BLOWFISH, "cbc(blowfish)", 8, 24, 24, 8, }, - {ENCR_BLOWFISH, "cbc(blowfish)", 8, 32, 32, 8, }, - {ENCR_SERPENT_CBC, "cbc(serpent)", 16, 16, 16, 16, }, - {ENCR_SERPENT_CBC, "cbc(serpent)", 16, 24, 24, 16, }, - {ENCR_SERPENT_CBC, "cbc(serpent)", 16, 32, 32, 16, }, - {ENCR_TWOFISH_CBC, "cbc(twofish)", 16, 16, 16, 16, }, - {ENCR_TWOFISH_CBC, "cbc(twofish)", 16, 24, 24, 16, }, - {ENCR_TWOFISH_CBC, "cbc(twofish)", 16, 32, 32, 16, }, -}; - -/** - * See header. - */ -void af_alg_crypter_probe(plugin_feature_t *features, int *pos) -{ - af_alg_ops_t *ops; - int i; - - for (i = 0; i < countof(algs); i++) - { - ops = af_alg_ops_create("skcipher", algs[i].name); - if (ops) - { - ops->destroy(ops); - features[(*pos)++] = PLUGIN_PROVIDE(CRYPTER, - algs[i].id, algs[i].key_size); - } - } -} - -/** - * Get the kernel algorithm string and block/key size for our identifier - */ -static size_t lookup_alg(encryption_algorithm_t algo, char **name, - size_t key_size, size_t *keymat_size, size_t *iv_size) -{ - int i; - - for (i = 0; i < countof(algs); i++) - { - if (algs[i].id == algo && - (key_size == 0 || algs[i].key_size == key_size)) - { - *name = algs[i].name; - *keymat_size = algs[i].keymat_size; - *iv_size = algs[i].iv_size; - return algs[i].block_size; - } - } - return 0; -} - -METHOD(crypter_t, decrypt, bool, - private_af_alg_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst) -{ - if (dst) - { - *dst = chunk_alloc(data.len); - return this->ops->crypt(this->ops, ALG_OP_DECRYPT, iv, data, dst->ptr); - } - return this->ops->crypt(this->ops, ALG_OP_DECRYPT, iv, data, data.ptr); -} - -METHOD(crypter_t, encrypt, bool, - private_af_alg_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst) -{ - if (dst) - { - *dst = chunk_alloc(data.len); - return this->ops->crypt(this->ops, ALG_OP_ENCRYPT, iv, data, dst->ptr); - } - return this->ops->crypt(this->ops, ALG_OP_ENCRYPT, iv, data, data.ptr); -} - -METHOD(crypter_t, get_block_size, size_t, - private_af_alg_crypter_t *this) -{ - return this->block_size; -} - -METHOD(crypter_t, get_iv_size, size_t, - private_af_alg_crypter_t *this) -{ - return this->iv_size; -} - -METHOD(crypter_t, get_key_size, size_t, - private_af_alg_crypter_t *this) -{ - return this->keymat_size; -} - -METHOD(crypter_t, set_key, bool, - private_af_alg_crypter_t *this, chunk_t key) -{ - return this->ops->set_key(this->ops, key); -} - -METHOD(crypter_t, destroy, void, - private_af_alg_crypter_t *this) -{ - this->ops->destroy(this->ops); - free(this); -} - -/* - * Described in header - */ -af_alg_crypter_t *af_alg_crypter_create(encryption_algorithm_t algo, - size_t key_size) -{ - private_af_alg_crypter_t *this; - size_t block_size, keymat_size, iv_size; - char *name; - - block_size = lookup_alg(algo, &name, key_size, &keymat_size, &iv_size); - if (!block_size) - { /* not supported by kernel */ - return NULL; - } - - INIT(this, - .public = { - .crypter = { - .encrypt = _encrypt, - .decrypt = _decrypt, - .get_block_size = _get_block_size, - .get_iv_size = _get_iv_size, - .get_key_size = _get_key_size, - .set_key = _set_key, - .destroy = _destroy, - }, - }, - .block_size = block_size, - .keymat_size = keymat_size, - .iv_size = iv_size, - .ops = af_alg_ops_create("skcipher", name), - ); - - if (!this->ops) - { - free(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_crypter.h b/src/libstrongswan/plugins/af_alg/af_alg_crypter.h deleted file mode 100644 index 757152f28..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_crypter.h +++ /dev/null @@ -1,62 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg_crypter af_alg_crypter - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_CRYPTER_H_ -#define AF_ALG_CRYPTER_H_ - -typedef struct af_alg_crypter_t af_alg_crypter_t; - -#include -#include - -/** Number of crypters */ -#define AF_ALG_CRYPTER 28 - -/** - * Implementation of signers using AF_ALG. - */ -struct af_alg_crypter_t { - - /** - * The crypter_t interface. - */ - crypter_t crypter; -}; - -/** - * Constructor to create af_alg_crypter_t. - * - * @param algo algorithm to implement - * @param key_size key size in bytes - * @return af_alg_crypter_t, NULL if not supported - */ -af_alg_crypter_t *af_alg_crypter_create(encryption_algorithm_t algo, - size_t key_size); - -/** - * Probe algorithms and return plugin features. - * - * @param features plugin features to create - * @param pos current position in features - */ -void af_alg_crypter_probe(plugin_feature_t *features, int *pos); - -#endif /** AF_ALG_CRYPTER_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_hasher.c b/src/libstrongswan/plugins/af_alg/af_alg_hasher.c deleted file mode 100644 index 3b07472fb..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_hasher.c +++ /dev/null @@ -1,173 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_hasher.h" -#include "af_alg_ops.h" - -typedef struct private_af_alg_hasher_t private_af_alg_hasher_t; - -/** - * Private data of af_alg_hasher_t - */ -struct private_af_alg_hasher_t { - - /** - * Public part of this class. - */ - af_alg_hasher_t public; - - /** - * AF_ALG operations - */ - af_alg_ops_t *ops; - - /** - * Size of the hash - */ - size_t size; -}; - -/** - * Algorithm database - */ -static struct { - hash_algorithm_t id; - char *name; - size_t size; -} algs[AF_ALG_HASHER] = { - {HASH_MD4, "md4", HASH_SIZE_MD4 }, - {HASH_MD5, "md5", HASH_SIZE_MD5 }, - {HASH_SHA1, "sha1", HASH_SIZE_SHA1 }, - {HASH_SHA224, "sha224", HASH_SIZE_SHA224 }, - {HASH_SHA256, "sha256", HASH_SIZE_SHA256 }, - {HASH_SHA384, "sha384", HASH_SIZE_SHA384 }, - {HASH_SHA512, "sha512", HASH_SIZE_SHA512 }, -}; - -/** - * See header. - */ -void af_alg_hasher_probe(plugin_feature_t *features, int *pos) -{ - af_alg_ops_t *ops; - int i; - - for (i = 0; i < countof(algs); i++) - { - ops = af_alg_ops_create("hash", algs[i].name); - if (ops) - { - ops->destroy(ops); - features[(*pos)++] = PLUGIN_PROVIDE(HASHER, algs[i].id); - } - } -} - -/** - * Get the kernel algorithm string and hash size for our identifier - */ -static size_t lookup_alg(hash_algorithm_t algo, char **name) -{ - int i; - - for (i = 0; i < countof(algs); i++) - { - if (algs[i].id == algo) - { - *name = algs[i].name; - return algs[i].size; - } - } - return 0; -} - -METHOD(hasher_t, get_hash_size, size_t, - private_af_alg_hasher_t *this) -{ - return this->size; -} - -METHOD(hasher_t, reset, bool, - private_af_alg_hasher_t *this) -{ - this->ops->reset(this->ops); - return TRUE; -} - -METHOD(hasher_t, get_hash, bool, - private_af_alg_hasher_t *this, chunk_t chunk, uint8_t *hash) -{ - return this->ops->hash(this->ops, chunk, hash, this->size); -} - -METHOD(hasher_t, allocate_hash, bool, - private_af_alg_hasher_t *this, chunk_t chunk, chunk_t *hash) -{ - if (hash) - { - *hash = chunk_alloc(get_hash_size(this)); - if (!get_hash(this, chunk, hash->ptr)) - { - chunk_free(hash); - return FALSE; - } - return TRUE; - } - return get_hash(this, chunk, NULL); -} - -METHOD(hasher_t, destroy, void, - private_af_alg_hasher_t *this) -{ - this->ops->destroy(this->ops); - free(this); -} - -/* - * Described in header - */ -af_alg_hasher_t *af_alg_hasher_create(hash_algorithm_t algo) -{ - private_af_alg_hasher_t *this; - char *name; - size_t size; - - size = lookup_alg(algo, &name); - if (!size) - { /* not supported by kernel */ - return NULL; - } - - INIT(this, - .public = { - .hasher = { - .get_hash = _get_hash, - .allocate_hash = _allocate_hash, - .get_hash_size = _get_hash_size, - .reset = _reset, - .destroy = _destroy, - }, - }, - .ops = af_alg_ops_create("hash", name), - .size = size, - ); - if (!this->ops) - { - free(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_hasher.h b/src/libstrongswan/plugins/af_alg/af_alg_hasher.h deleted file mode 100644 index 0d9f64e9b..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_hasher.h +++ /dev/null @@ -1,60 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg_hasher af_alg_hasher - * @{ @ingroup af_alg - */ - -#ifndef af_alg_HASHER_H_ -#define af_alg_HASHER_H_ - -typedef struct af_alg_hasher_t af_alg_hasher_t; - -#include -#include - -/** Number of hashers */ -#define AF_ALG_HASHER 7 - -/** - * Implementation of hashers using AF_ALG. - */ -struct af_alg_hasher_t { - - /** - * Implements hasher_t interface. - */ - hasher_t hasher; -}; - -/** - * Constructor to create af_alg_hasher_t. - * - * @param algo algorithm - * @return af_alg_hasher_t, NULL if not supported - */ -af_alg_hasher_t *af_alg_hasher_create(hash_algorithm_t algo); - -/** - * Probe algorithms and return plugin features. - * - * @param features plugin features to create - * @param pos current position in deps - */ -void af_alg_hasher_probe(plugin_feature_t *features, int *pos); - -#endif /** af_alg_HASHER_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_ops.c b/src/libstrongswan/plugins/af_alg/af_alg_ops.c deleted file mode 100644 index 4afd1bf4f..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_ops.c +++ /dev/null @@ -1,255 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_ops.h" - -#include -#include -#include - -#include - -typedef struct private_af_alg_ops_t private_af_alg_ops_t; - -/** - * Private data of an af_alg_ops_t object. - */ -struct private_af_alg_ops_t { - - /** - * Public af_alg_ops_t interface. - */ - af_alg_ops_t public; - - /** - * Transform FD - */ - int tfm; - - /** - * Operation FD - */ - int op; -}; - -METHOD(af_alg_ops_t, reset, void, - private_af_alg_ops_t *this) -{ - if (this->op != -1) - { - close(this->op); - this->op = -1; - } -} - -METHOD(af_alg_ops_t, hash, bool, - private_af_alg_ops_t *this, chunk_t data, char *out, size_t outlen) -{ - ssize_t len; - - while (this->op == -1) - { - this->op = accept(this->tfm, NULL, 0); - if (this->op == -1 && errno != EINTR) - { - DBG1(DBG_LIB, "opening AF_ALG hasher failed: %s", strerror(errno)); - return FALSE; - } - } - - do - { - len = send(this->op, data.ptr, data.len, out ? 0 : MSG_MORE); - if (len == -1) - { - if (errno == EINTR) - { - continue; - } - DBG1(DBG_LIB, "writing to AF_ALG hasher failed: %s", strerror(errno)); - return FALSE; - } - data = chunk_skip(data, len); - } - while (data.len); - - if (out) - { - while (outlen) - { - len = read(this->op, out, outlen); - if (len == -1) - { - if (errno == EINTR) - { - continue; - } - DBG1(DBG_LIB, "reading AF_ALG hasher failed: %s", strerror(errno)); - return FALSE; - } - outlen -= len; - out += len; - } - reset(this); - } - return TRUE; -} - -METHOD(af_alg_ops_t, crypt_, bool, - private_af_alg_ops_t *this, uint32_t type, chunk_t iv, chunk_t data, - char *out) -{ - struct msghdr msg = {}; - struct cmsghdr *cmsg; - struct af_alg_iv *ivm; - struct iovec iov; - char buf[CMSG_SPACE(sizeof(type)) + - CMSG_SPACE(offsetof(struct af_alg_iv, iv) + iv.len)]; - ssize_t len; - int op; - - do - { - op = accept(this->tfm, NULL, 0); - if (op == -1 && errno != EINTR) - { - DBG1(DBG_LIB, "accepting AF_ALG crypter failed: %s", strerror(errno)); - return FALSE; - } - } - while (op == -1); - - memset(buf, 0, sizeof(buf)); - - msg.msg_control = buf; - msg.msg_controllen = sizeof(buf); - - cmsg = CMSG_FIRSTHDR(&msg); - cmsg->cmsg_level = SOL_ALG; - cmsg->cmsg_type = ALG_SET_OP; - cmsg->cmsg_len = CMSG_LEN(sizeof(type)); - memcpy(CMSG_DATA(cmsg), &type, sizeof(type)); - - cmsg = CMSG_NXTHDR(&msg, cmsg); - cmsg->cmsg_level = SOL_ALG; - cmsg->cmsg_type = ALG_SET_IV; - cmsg->cmsg_len = CMSG_LEN(offsetof(struct af_alg_iv, iv) + iv.len); - ivm = (void*)CMSG_DATA(cmsg); - ivm->ivlen = iv.len; - memcpy(ivm->iv, iv.ptr, iv.len); - - msg.msg_iov = &iov; - msg.msg_iovlen = 1; - - while (data.len) - { - iov.iov_base = data.ptr; - iov.iov_len = data.len; - - len = sendmsg(op, &msg, 0); - if (len == -1) - { - if (errno == EINTR) - { - continue; - } - DBG1(DBG_LIB, "writing to AF_ALG crypter failed: %s", strerror(errno)); - close(op); - return FALSE; - } - while (read(op, out, len) != len) - { - if (errno != EINTR) - { - DBG1(DBG_LIB, "reading from AF_ALG crypter failed: %s", - strerror(errno)); - close(op); - return FALSE; - } - } - data = chunk_skip(data, len); - out += len; - /* no IV for subsequent data chunks */ - msg.msg_controllen = 0; - } - close(op); - return TRUE; -} - -METHOD(af_alg_ops_t, set_key, bool, - private_af_alg_ops_t *this, chunk_t key) -{ - if (setsockopt(this->tfm, SOL_ALG, ALG_SET_KEY, key.ptr, key.len) == -1) - { - DBG1(DBG_LIB, "setting AF_ALG key failed: %s", strerror(errno)); - return FALSE; - } - return TRUE; -} - -METHOD(af_alg_ops_t, destroy, void, - private_af_alg_ops_t *this) -{ - close(this->tfm); - if (this->op != -1) - { - close(this->op); - } - free(this); -} - -/** - * See header - */ -af_alg_ops_t *af_alg_ops_create(char *type, char *alg) -{ - private_af_alg_ops_t *this; - struct sockaddr_alg sa = { - .salg_family = AF_ALG, - }; - - strncpy(sa.salg_type, type, sizeof(sa.salg_type) - 1); - strncpy(sa.salg_name, alg, sizeof(sa.salg_name) - 1); - - INIT(this, - .public = { - .hash = _hash, - .reset = _reset, - .crypt = _crypt_, - .set_key = _set_key, - .destroy = _destroy, - }, - .tfm = socket(AF_ALG, SOCK_SEQPACKET, 0), - .op = -1, - ); - if (this->tfm == -1) - { - DBG1(DBG_LIB, "opening AF_ALG socket failed: %s", strerror(errno)); - free(this); - return NULL; - } - if (bind(this->tfm, (struct sockaddr*)&sa, sizeof(sa)) == -1) - { - if (errno != ENOENT) - { /* fail silently if algorithm not supported */ - DBG1(DBG_LIB, "binding AF_ALG socket for '%s' failed: %s", - sa.salg_name, strerror(errno)); - } - destroy(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_ops.h b/src/libstrongswan/plugins/af_alg/af_alg_ops.h deleted file mode 100644 index 68f3e6a98..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_ops.h +++ /dev/null @@ -1,94 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** -* @defgroup af_alg_ops af_alg_ops - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_OPS_H_ -#define AF_ALG_OPS_H_ - -#include - -#include - -#ifndef AF_ALG -#define AF_ALG 38 -#endif /* AF_ALG */ - -#ifndef SOL_ALG -#define SOL_ALG 279 -#endif /* SOL_ALG */ - -typedef struct af_alg_ops_t af_alg_ops_t; - -/** - * Helper to run AF_ALG operations. - */ -struct af_alg_ops_t { - - /** - * Hash a chunk of data. - * - * @param data data to hash - * @param out buffer to write hash to, NULL for append mode - * @param outlen number of bytes to read into out - * @return TRUE if successful - */ - bool (*hash)(af_alg_ops_t *this, chunk_t data, char *out, size_t outlen); - - /** - * Reset hasher state. - */ - void (*reset)(af_alg_ops_t *this); - - /** - * En-/Decrypt a chunk of data. - * - * @param type crypto operation (ALG_OP_DECRYPT/ALG_OP_ENCRYPT) - * @param iv iv to use - * @param data data to encrypt/decrypt - * @param out buffer write processed data to - * @return TRUE if successful - */ - bool (*crypt)(af_alg_ops_t *this, uint32_t type, chunk_t iv, chunk_t data, - char *out); - - /** - * Set the key for en-/decryption or HMAC/XCBC operations. - * - * @param key key to set for transform - * @return TRUE if successful - */ - bool (*set_key)(af_alg_ops_t *this, chunk_t key); - - /** - * Destroy a af_alg_ops_t. - */ - void (*destroy)(af_alg_ops_t *this); -}; - -/** - * Create a af_alg_ops instance. - * - * @param type algorithm type (hash, skcipher) - * @param alg algorithm name - * @return TRUE if AF_ALG socket bound successfully - */ -af_alg_ops_t *af_alg_ops_create(char *type, char *alg); - -#endif /** AF_ALG_OPS_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_plugin.c b/src/libstrongswan/plugins/af_alg/af_alg_plugin.c deleted file mode 100644 index 1323f9b5f..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_plugin.c +++ /dev/null @@ -1,110 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_plugin.h" - -#include - -#include "af_alg_hasher.h" -#include "af_alg_signer.h" -#include "af_alg_prf.h" -#include "af_alg_crypter.h" - -#include - -typedef struct private_af_alg_plugin_t private_af_alg_plugin_t; - -/** - * private data of af_alg_plugin - */ -struct private_af_alg_plugin_t { - - /** - * public functions - */ - af_alg_plugin_t public; -}; - -METHOD(plugin_t, get_name, char*, - private_af_alg_plugin_t *this) -{ - return "af-alg"; -} - -static bool af_alg_supported() -{ - int fd; - - fd = socket(AF_ALG, SOCK_SEQPACKET, 0); - if (fd != -1) - { - close(fd); - return true; - } - return false; -} - -METHOD(plugin_t, get_features, int, - private_af_alg_plugin_t *this, plugin_feature_t *features[]) -{ - static plugin_feature_t f[AF_ALG_HASHER + AF_ALG_SIGNER + - AF_ALG_PRF + AF_ALG_CRYPTER + 4] = {}; - static int count = 0; - - if (!count) - { /* initialize only once */ - if (!af_alg_supported()) - { - return 0; - } - f[count++] = PLUGIN_REGISTER(HASHER, af_alg_hasher_create); - af_alg_hasher_probe(f, &count); - f[count++] = PLUGIN_REGISTER(SIGNER, af_alg_signer_create); - af_alg_signer_probe(f, &count); - f[count++] = PLUGIN_REGISTER(PRF, af_alg_prf_create); - af_alg_prf_probe(f, &count); - f[count++] = PLUGIN_REGISTER(CRYPTER, af_alg_crypter_create); - af_alg_crypter_probe(f, &count); - } - *features = f; - return count; -} - -METHOD(plugin_t, destroy, void, - private_af_alg_plugin_t *this) -{ - free(this); -} - -/* - * see header file - */ -PLUGIN_DEFINE(af_alg) -{ - private_af_alg_plugin_t *this; - - INIT(this, - .public = { - .plugin = { - .get_name = _get_name, - .get_features = _get_features, - .destroy = _destroy, - }, - }, - ); - - return &this->public.plugin; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_plugin.h b/src/libstrongswan/plugins/af_alg/af_alg_plugin.h deleted file mode 100644 index 24db0841c..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_plugin.h +++ /dev/null @@ -1,43 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg af_alg - * @ingroup plugins - * - * @defgroup af_alg_plugin af_alg_plugin - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_PLUGIN_H_ -#define AF_ALG_PLUGIN_H_ - -#include - -typedef struct af_alg_plugin_t af_alg_plugin_t; - -/** - * Plugin providing the AF_ALG interface to the Linux Crypto API. - */ -struct af_alg_plugin_t { - - /** - * Implements plugin interface. - */ - plugin_t plugin; -}; - -#endif /** AF_ALG_PLUGIN_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_prf.c b/src/libstrongswan/plugins/af_alg/af_alg_prf.c deleted file mode 100644 index 731ebcd4e..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_prf.c +++ /dev/null @@ -1,212 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_prf.h" -#include "af_alg_ops.h" - -typedef struct private_af_alg_prf_t private_af_alg_prf_t; - -/** - * Private data of a af_alg_prf_t object. - */ -struct private_af_alg_prf_t { - - /** - * Public af_alg_prf_t interface. - */ - af_alg_prf_t public; - - /** - * AF_ALG operations - */ - af_alg_ops_t *ops; - - /** - * Size of the PRF output - */ - size_t block_size; - - /** - * Default key size - */ - size_t key_size; - - /** - * Using an XCBC algorithm? - */ - bool xcbc; -}; - -/** - * Algorithm database - */ -static struct { - pseudo_random_function_t id; - char *name; - size_t block_size; - bool xcbc; -} algs[AF_ALG_PRF] = { - {PRF_HMAC_SHA1, "hmac(sha1)", 20, FALSE, }, - {PRF_HMAC_SHA2_256, "hmac(sha256)", 32, FALSE, }, - {PRF_HMAC_MD5, "hmac(md5)", 16, FALSE, }, - {PRF_HMAC_SHA2_384, "hmac(sha384)", 48, FALSE, }, - {PRF_HMAC_SHA2_512, "hmac(sha512)", 64, FALSE, }, - {PRF_AES128_XCBC, "xcbc(aes)", 16, TRUE, }, - {PRF_CAMELLIA128_XCBC, "xcbc(camellia)", 16, TRUE, }, -}; - -/** - * See header. - */ -void af_alg_prf_probe(plugin_feature_t *features, int *pos) -{ - af_alg_ops_t *ops; - int i; - - for (i = 0; i < countof(algs); i++) - { - ops = af_alg_ops_create("hash", algs[i].name); - if (ops) - { - ops->destroy(ops); - features[(*pos)++] = PLUGIN_PROVIDE(PRF, algs[i].id); - } - } -} - -/** - * Get the kernel algorithm string and block size for our identifier - */ -static size_t lookup_alg(pseudo_random_function_t algo, char **name, bool *xcbc) -{ - int i; - - for (i = 0; i < countof(algs); i++) - { - if (algs[i].id == algo) - { - *name = algs[i].name; - *xcbc = algs[i].xcbc; - return algs[i].block_size; - } - } - return 0; -} - -METHOD(prf_t, get_bytes, bool, - private_af_alg_prf_t *this, chunk_t seed, uint8_t *buffer) -{ - return this->ops->hash(this->ops, seed, buffer, this->block_size); -} - -METHOD(prf_t, allocate_bytes, bool, - private_af_alg_prf_t *this, chunk_t seed, chunk_t *chunk) -{ - if (chunk) - { - *chunk = chunk_alloc(this->block_size); - return get_bytes(this, seed, chunk->ptr); - } - return get_bytes(this, seed, NULL); -} - -METHOD(prf_t, get_block_size, size_t, - private_af_alg_prf_t *this) -{ - return this->block_size; -} - -METHOD(prf_t, get_key_size, size_t, - private_af_alg_prf_t *this) -{ - return this->block_size; -} - -METHOD(prf_t, set_key, bool, - private_af_alg_prf_t *this, chunk_t key) -{ - char buf[this->block_size]; - - this->ops->reset(this->ops); - if (this->xcbc) - { - /* The kernel currently does not support variable length XCBC keys, - * do RFC4434 key padding/reduction manually. */ - if (key.len < this->block_size) - { - memset(buf, 0, this->block_size); - memcpy(buf, key.ptr, key.len); - key = chunk_from_thing(buf); - } - else if (key.len > this->block_size) - { - memset(buf, 0, this->block_size); - if (!this->ops->set_key(this->ops, chunk_from_thing(buf)) || - !this->ops->hash(this->ops, key, buf, this->block_size)) - { - return FALSE; - } - key = chunk_from_thing(buf); - } - } - return this->ops->set_key(this->ops, key); -} - -METHOD(prf_t, destroy, void, - private_af_alg_prf_t *this) -{ - this->ops->destroy(this->ops); - free(this); -} - -/* - * Described in header. - */ -af_alg_prf_t *af_alg_prf_create(pseudo_random_function_t algo) -{ - private_af_alg_prf_t *this; - size_t block_size; - bool xcbc; - char *name; - - block_size = lookup_alg(algo, &name, &xcbc); - if (!block_size) - { /* not supported by kernel */ - return NULL; - } - - INIT(this, - .public = { - .prf = { - .get_bytes = _get_bytes, - .allocate_bytes = _allocate_bytes, - .get_block_size = _get_block_size, - .get_key_size = _get_key_size, - .set_key = _set_key, - .destroy = _destroy, - }, - }, - .ops = af_alg_ops_create("hash", name), - .block_size = block_size, - .xcbc = xcbc, - ); - if (!this->ops) - { - free(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_prf.h b/src/libstrongswan/plugins/af_alg/af_alg_prf.h deleted file mode 100644 index 4892e7ce5..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_prf.h +++ /dev/null @@ -1,60 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg_prf af_alg_prf - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_PRF_H_ -#define AF_ALG_PRF_H_ - -typedef struct af_alg_prf_t af_alg_prf_t; - -#include -#include - -/** Number of PRFs */ -#define AF_ALG_PRF 7 - -/** - * Implementation of PRFs using AF_ALG. - */ -struct af_alg_prf_t { - - /** - * Implements prf_t interface. - */ - prf_t prf; -}; - -/** - * Creates a new af_alg_prf_t object. - * - * @param algo algorithm to implement - * @return af_alg_prf_t object, NULL if hash not supported - */ -af_alg_prf_t *af_alg_prf_create(pseudo_random_function_t algo); - -/** - * Probe algorithms and return plugin features. - * - * @param features plugin features to create - * @param pos current position in features - */ -void af_alg_prf_probe(plugin_feature_t *features, int *pos); - -#endif /** AF_ALG_PRF_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_signer.c b/src/libstrongswan/plugins/af_alg/af_alg_signer.c deleted file mode 100644 index d24cc4859..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_signer.c +++ /dev/null @@ -1,208 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_signer.h" -#include "af_alg_ops.h" - -typedef struct private_af_alg_signer_t private_af_alg_signer_t; - -/** - * Private data structure with signing context. - */ -struct private_af_alg_signer_t { - - /** - * Public interface of af_alg_signer_t. - */ - af_alg_signer_t public; - - /** - * AF_ALG operations - */ - af_alg_ops_t *ops; - - /** - * Size of the truncated signature - */ - size_t block_size; - - /** - * Default key size - */ - size_t key_size; -}; - -/** - * Algorithm database - */ -static struct { - integrity_algorithm_t id; - char *name; - size_t block_size; - size_t key_size; -} algs[AF_ALG_SIGNER] = { - {AUTH_HMAC_SHA1_96, "hmac(sha1)", 12, 20, }, - {AUTH_HMAC_SHA1_128, "hmac(sha1)", 16, 20, }, - {AUTH_HMAC_SHA1_160, "hmac(sha1)", 20, 20, }, - {AUTH_HMAC_SHA2_256_96, "hmac(sha256)", 12, 32, }, - {AUTH_HMAC_SHA2_256_128, "hmac(sha256)", 16, 32, }, - {AUTH_HMAC_MD5_96, "hmac(md5)", 12, 16, }, - {AUTH_HMAC_MD5_128, "hmac(md5)", 16, 16, }, - {AUTH_HMAC_SHA2_256_256, "hmac(sha256)", 32, 32, }, - {AUTH_HMAC_SHA2_384_192, "hmac(sha384)", 24, 48, }, - {AUTH_HMAC_SHA2_384_384, "hmac(sha384)", 48, 48, }, - {AUTH_HMAC_SHA2_512_256, "hmac(sha512)", 32, 64, }, - {AUTH_HMAC_SHA2_512_512, "hmac(sha512)", 64, 64, }, - {AUTH_AES_XCBC_96, "xcbc(aes)", 12, 16, }, - {AUTH_CAMELLIA_XCBC_96, "xcbc(camellia)", 12, 16, }, -}; - -/** - * See header. - */ -void af_alg_signer_probe(plugin_feature_t *features, int *pos) -{ - af_alg_ops_t *ops; - int i; - - for (i = 0; i < countof(algs); i++) - { - ops = af_alg_ops_create("hash", algs[i].name); - if (ops) - { - ops->destroy(ops); - features[(*pos)++] = PLUGIN_PROVIDE(SIGNER, algs[i].id); - } - } -} - -/** - * Get the kernel algorithm string and block/key size for our identifier - */ -static size_t lookup_alg(integrity_algorithm_t algo, char **name, - size_t *key_size) -{ - int i; - - for (i = 0; i < countof(algs); i++) - { - if (algs[i].id == algo) - { - *name = algs[i].name; - *key_size = algs[i].key_size; - return algs[i].block_size; - } - } - return 0; -} - -METHOD(signer_t, get_signature, bool, - private_af_alg_signer_t *this, chunk_t data, uint8_t *buffer) -{ - return this->ops->hash(this->ops, data, buffer, this->block_size); -} - -METHOD(signer_t, allocate_signature, bool, - private_af_alg_signer_t *this, chunk_t data, chunk_t *chunk) -{ - if (chunk) - { - *chunk = chunk_alloc(this->block_size); - return get_signature(this, data, chunk->ptr); - } - return get_signature(this, data, NULL); -} - -METHOD(signer_t, verify_signature, bool, - private_af_alg_signer_t *this, chunk_t data, chunk_t signature) -{ - char sig[this->block_size]; - - if (signature.len != this->block_size) - { - return FALSE; - } - if (!get_signature(this, data, sig)) - { - return FALSE; - } - return memeq_const(signature.ptr, sig, signature.len); -} - -METHOD(signer_t, get_key_size, size_t, - private_af_alg_signer_t *this) -{ - return this->key_size; -} - -METHOD(signer_t, get_block_size, size_t, - private_af_alg_signer_t *this) -{ - return this->block_size; -} - -METHOD(signer_t, set_key, bool, - private_af_alg_signer_t *this, chunk_t key) -{ - this->ops->reset(this->ops); - return this->ops->set_key(this->ops, key); -} - -METHOD(signer_t, destroy, void, - private_af_alg_signer_t *this) -{ - this->ops->destroy(this->ops); - free(this); -} - -/* - * Described in header - */ -af_alg_signer_t *af_alg_signer_create(integrity_algorithm_t algo) -{ - private_af_alg_signer_t *this; - size_t block_size, key_size = 0; - char *name; - - block_size = lookup_alg(algo, &name, &key_size); - if (!block_size) - { /* not supported by kernel */ - return NULL; - } - - INIT(this, - .public = { - .signer = { - .get_signature = _get_signature, - .allocate_signature = _allocate_signature, - .verify_signature = _verify_signature, - .get_key_size = _get_key_size, - .get_block_size = _get_block_size, - .set_key = _set_key, - .destroy = _destroy, - }, - }, - .ops = af_alg_ops_create("hash", name), - .block_size = block_size, - .key_size = key_size, - ); - if (!this->ops) - { - free(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_signer.h b/src/libstrongswan/plugins/af_alg/af_alg_signer.h deleted file mode 100644 index e80a6ba87..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_signer.h +++ /dev/null @@ -1,60 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg_signer af_alg_signer - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_SIGNER_H_ -#define AF_ALG_SIGNER_H_ - -typedef struct af_alg_signer_t af_alg_signer_t; - -#include -#include - -/** Number of signers */ -#define AF_ALG_SIGNER 14 - -/** - * Implementation of signers using AF_ALG. - */ -struct af_alg_signer_t { - - /** - * Implements signer_t interface. - */ - signer_t signer; -}; - -/** - * Creates a new af_alg_signer_t. - * - * @param algo algorithm to implement - * @return af_alg_signer_t, NULL if not supported - */ -af_alg_signer_t *af_alg_signer_create(integrity_algorithm_t algo); - -/** - * Probe algorithms and return plugin features. - * - * @param features plugin features to create - * @param pos current position in features - */ -void af_alg_signer_probe(plugin_feature_t *features, int *pos); - -#endif /** AF_ALG_SIGNER_H_ @}*/ diff --git a/testing/scripts/recipes/013_strongswan.mk b/testing/scripts/recipes/013_strongswan.mk index 8e36bcf57..3f07261cc 100644 --- a/testing/scripts/recipes/013_strongswan.mk +++ b/testing/scripts/recipes/013_strongswan.mk @@ -82,7 +82,6 @@ CONFIG_OPTS = \ --enable-hmac \ --enable-chapoly \ --enable-ha \ - --enable-af-alg \ --enable-whitelist \ --enable-xauth-generic \ --enable-xauth-eap \ diff --git a/testing/tests/af-alg/alg-camellia/description.txt b/testing/tests/af-alg/alg-camellia/description.txt deleted file mode 100644 index 995ab4c65..000000000 --- a/testing/tests/af-alg/alg-camellia/description.txt +++ /dev/null @@ -1,3 +0,0 @@ -Roadwarrior carol proposes to gateway moon the IKE cipher suite camellia256-sha512-modp3072 -well as the ESP cipher suite camellia192-sha384. A ping from carol to alice successfully -checks the established tunnel. diff --git a/testing/tests/af-alg/alg-camellia/evaltest.dat b/testing/tests/af-alg/alg-camellia/evaltest.dat deleted file mode 100644 index 8a2e36baa..000000000 --- a/testing/tests/af-alg/alg-camellia/evaltest.dat +++ /dev/null @@ -1,7 +0,0 @@ -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES -carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES -moon:: swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES -moon:: ip xfrm state::enc cbc(camellia)::YES -carol::ip xfrm state::enc cbc(camellia)::YES -moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES -moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES diff --git a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf b/testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf deleted file mode 100644 index a60e16147..000000000 --- a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf +++ /dev/null @@ -1,9 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce pem pkcs1 af-alg openssl revocation kernel-netlink curl socket-default updown vici -} diff --git a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/swanctl/swanctl.conf b/testing/tests/af-alg/alg-camellia/hosts/carol/etc/swanctl/swanctl.conf deleted file mode 100755 index acba9cecb..000000000 --- a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,27 +0,0 @@ -connections { - - home { - local_addrs = 192.168.0.100 - remote_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = carolCert.pem - id = carol@strongswan.org - } - remote { - auth = pubkey - id = moon.strongswan.org - } - children { - home { - remote_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = camellia192-sha384 - } - } - version = 2 - proposals = camellia256-sha512-modp3072 - } -} diff --git a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf b/testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf deleted file mode 100644 index a60e16147..000000000 --- a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf +++ /dev/null @@ -1,9 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce pem pkcs1 af-alg openssl revocation kernel-netlink curl socket-default updown vici -} diff --git a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/af-alg/alg-camellia/hosts/moon/etc/swanctl/swanctl.conf deleted file mode 100755 index 1c06bb2ce..000000000 --- a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,25 +0,0 @@ -connections { - - rw { - local_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = moonCert.pem - id = moon.strongswan.org - } - remote { - auth = pubkey - } - children { - net { - local_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = camellia192-sha384 - } - } - version = 2 - proposals = camellia256-sha512-modp3072 - } -} diff --git a/testing/tests/af-alg/alg-camellia/posttest.dat b/testing/tests/af-alg/alg-camellia/posttest.dat deleted file mode 100644 index af9cda6ca..000000000 --- a/testing/tests/af-alg/alg-camellia/posttest.dat +++ /dev/null @@ -1,5 +0,0 @@ -carol::swanctl --terminate --ike home -carol::systemctl stop strongswan -moon::systemctl stop strongswan -moon::iptables-restore < /etc/iptables.flush -carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/af-alg/alg-camellia/pretest.dat b/testing/tests/af-alg/alg-camellia/pretest.dat deleted file mode 100644 index 22e1eae93..000000000 --- a/testing/tests/af-alg/alg-camellia/pretest.dat +++ /dev/null @@ -1,7 +0,0 @@ -moon::iptables-restore < /etc/iptables.rules -carol::iptables-restore < /etc/iptables.rules -moon::systemctl start strongswan -carol::systemctl start strongswan -moon::expect-connection net -carol::expect-connection home -carol::swanctl --initiate --child home 2> /dev/null diff --git a/testing/tests/af-alg/alg-camellia/test.conf b/testing/tests/af-alg/alg-camellia/test.conf deleted file mode 100644 index 307c7e9cc..000000000 --- a/testing/tests/af-alg/alg-camellia/test.conf +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash -# -# This configuration file provides information on the -# guest instances used for this test - -# All guest instances that are required for this test -# -VIRTHOSTS="alice moon carol winnetou" - -# Corresponding block diagram -# -DIAGRAM="a-m-c-w.png" - -# Guest instances on which tcpdump is to be started -# -TCPDUMPHOSTS="moon" - -# Guest instances on which IPsec is started -# Used for IPsec logging purposes -# -IPSECHOSTS="moon carol" - -# charon controlled by swanctl -# -SWANCTL=1 diff --git a/testing/tests/af-alg/rw-cert/description.txt b/testing/tests/af-alg/rw-cert/description.txt deleted file mode 100644 index 042800278..000000000 --- a/testing/tests/af-alg/rw-cert/description.txt +++ /dev/null @@ -1,12 +0,0 @@ -The roadwarrior carol and the gateway moon use the Crypto API -of the Linux kernel via the af_alg userland interface for all symmetric -encryption and hash functions whereas roadwarrior dave uses openssl -as the default strongSwan cryptographical plugin. -

-The roadwarriors carol and dave set up a connection each -to gateway moon. The authentication is based on X.509 certificates. -Upon the successful establishment of the IPsec tunnel automatically iptables-based -firewall rules are inserted which let pass the tunneled traffic. -In order to test both tunnel and firewall, both carol and dave ping -the client alice behind the gateway moon. - diff --git a/testing/tests/af-alg/rw-cert/evaltest.dat b/testing/tests/af-alg/rw-cert/evaltest.dat deleted file mode 100644 index eccdcf0c1..000000000 --- a/testing/tests/af-alg/rw-cert/evaltest.dat +++ /dev/null @@ -1,10 +0,0 @@ -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES -carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES -dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 local-id=dave@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES -moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES -moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES -moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES -moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES -moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES -moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES diff --git a/testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf b/testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf deleted file mode 100644 index ceedb1e19..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf +++ /dev/null @@ -1,9 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce test-vectors pem pkcs1 af-alg ccm gcm openssl revocation curl kernel-netlink socket-default updown vici -} diff --git a/testing/tests/af-alg/rw-cert/hosts/carol/etc/swanctl/swanctl.conf b/testing/tests/af-alg/rw-cert/hosts/carol/etc/swanctl/swanctl.conf deleted file mode 100755 index 22fe14f92..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/carol/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,27 +0,0 @@ -connections { - - home { - local_addrs = 192.168.0.100 - remote_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = carolCert.pem - id = carol@strongswan.org - } - remote { - auth = pubkey - id = moon.strongswan.org - } - children { - home { - remote_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = 3des-sha1-modp1536 - } - } - version = 2 - proposals = 3des-sha1-modp1536 - } -} diff --git a/testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf b/testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf deleted file mode 100644 index d275d6777..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf +++ /dev/null @@ -1,9 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce openssl test-vectors pem pkcs1 revocation curl kernel-netlink socket-default updown vici -} diff --git a/testing/tests/af-alg/rw-cert/hosts/dave/etc/swanctl/swanctl.conf b/testing/tests/af-alg/rw-cert/hosts/dave/etc/swanctl/swanctl.conf deleted file mode 100755 index b3622f50e..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/dave/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,27 +0,0 @@ -connections { - - home { - local_addrs = 192.168.0.200 - remote_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = daveCert.pem - id = dave@strongswan.org - } - remote { - auth = pubkey - id = moon.strongswan.org - } - children { - home { - remote_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = aes128-sha256-modp3072 - } - } - version = 2 - proposals = aes128-sha256-modp3072 - } -} diff --git a/testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf b/testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf deleted file mode 100644 index b8effd883..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf +++ /dev/null @@ -1,14 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce test-vectors pem pkcs1 af-alg ccm gcm openssl revocation curl kernel-netlink socket-default updown vici - - integrity_test = yes - crypto_test { - on_add = yes - } -} diff --git a/testing/tests/af-alg/rw-cert/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/af-alg/rw-cert/hosts/moon/etc/swanctl/swanctl.conf deleted file mode 100755 index ccd247af0..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/moon/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,25 +0,0 @@ -connections { - - rw { - local_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = moonCert.pem - id = moon.strongswan.org - } - remote { - auth = pubkey - } - children { - net { - local_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = aes128-sha256-modp3072,3des-sha1-modp1536 - } - } - version = 2 - proposals = aes128-sha256-modp3072,3des-sha1-modp1536 - } -} diff --git a/testing/tests/af-alg/rw-cert/posttest.dat b/testing/tests/af-alg/rw-cert/posttest.dat deleted file mode 100644 index eb2100856..000000000 --- a/testing/tests/af-alg/rw-cert/posttest.dat +++ /dev/null @@ -1,8 +0,0 @@ -carol::swanctl --terminate --ike home -dave::swanctl --terminate --ike home -carol::systemctl stop strongswan -dave::systemctl stop strongswan -moon::systemctl stop strongswan -moon::iptables-restore < /etc/iptables.flush -carol::iptables-restore < /etc/iptables.flush -dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/af-alg/rw-cert/pretest.dat b/testing/tests/af-alg/rw-cert/pretest.dat deleted file mode 100644 index 7d27f62c6..000000000 --- a/testing/tests/af-alg/rw-cert/pretest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::iptables-restore < /etc/iptables.rules -carol::iptables-restore < /etc/iptables.rules -dave::iptables-restore < /etc/iptables.rules -moon::systemctl start strongswan -carol::systemctl start strongswan -dave::systemctl start strongswan -moon::expect-connection net -carol::expect-connection home -carol::swanctl --initiate --child home 2> /dev/null -dave::expect-connection home -dave::swanctl --initiate --child home 2> /dev/null diff --git a/testing/tests/af-alg/rw-cert/test.conf b/testing/tests/af-alg/rw-cert/test.conf deleted file mode 100644 index 1227b9d1c..000000000 --- a/testing/tests/af-alg/rw-cert/test.conf +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash -# -# This configuration file provides information on the -# guest instances used for this test - -# All guest instances that are required for this test -# -VIRTHOSTS="alice moon carol winnetou dave" - -# Corresponding block diagram -# -DIAGRAM="a-m-c-w-d.png" - -# Guest instances on which tcpdump is to be started -# -TCPDUMPHOSTS="moon" - -# Guest instances on which IPsec is started -# Used for IPsec logging purposes -# -IPSECHOSTS="moon carol dave" - -# charon controlled by swanctl -# -SWANCTL=1