From 248c9155931ea78f21738ddfb1e9ba52dac045ac Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 24 Jul 2026 15:12:03 +0200 Subject: [PATCH] af-alg: Remove plugin for deprecated AF_ALG interface The 7.2 kernel has officially deprecated the interface and it will soon be removed (support for hardware crypto offload has already been removed). Also removed the corresponding test scenarios. --- configure.ac | 4 - scripts/test.sh | 2 - src/include/Makefile.am | 2 +- src/include/linux/if_alg.h | 40 --- src/libstrongswan/Makefile.am | 7 - src/libstrongswan/plugins/af_alg/Makefile.am | 22 -- .../plugins/af_alg/af_alg_crypter.c | 232 ---------------- .../plugins/af_alg/af_alg_crypter.h | 62 ----- .../plugins/af_alg/af_alg_hasher.c | 173 ------------ .../plugins/af_alg/af_alg_hasher.h | 60 ----- src/libstrongswan/plugins/af_alg/af_alg_ops.c | 255 ------------------ src/libstrongswan/plugins/af_alg/af_alg_ops.h | 94 ------- .../plugins/af_alg/af_alg_plugin.c | 110 -------- .../plugins/af_alg/af_alg_plugin.h | 43 --- src/libstrongswan/plugins/af_alg/af_alg_prf.c | 212 --------------- src/libstrongswan/plugins/af_alg/af_alg_prf.h | 60 ----- .../plugins/af_alg/af_alg_signer.c | 208 -------------- .../plugins/af_alg/af_alg_signer.h | 60 ----- testing/scripts/recipes/013_strongswan.mk | 1 - .../tests/af-alg/alg-camellia/description.txt | 3 - .../tests/af-alg/alg-camellia/evaltest.dat | 7 - .../hosts/carol/etc/strongswan.conf | 9 - .../hosts/carol/etc/swanctl/swanctl.conf | 27 -- .../hosts/moon/etc/strongswan.conf | 9 - .../hosts/moon/etc/swanctl/swanctl.conf | 25 -- .../tests/af-alg/alg-camellia/posttest.dat | 5 - testing/tests/af-alg/alg-camellia/pretest.dat | 7 - testing/tests/af-alg/alg-camellia/test.conf | 25 -- testing/tests/af-alg/rw-cert/description.txt | 12 - testing/tests/af-alg/rw-cert/evaltest.dat | 10 - .../rw-cert/hosts/carol/etc/strongswan.conf | 9 - .../hosts/carol/etc/swanctl/swanctl.conf | 27 -- .../rw-cert/hosts/dave/etc/strongswan.conf | 9 - .../hosts/dave/etc/swanctl/swanctl.conf | 27 -- .../rw-cert/hosts/moon/etc/strongswan.conf | 14 - .../hosts/moon/etc/swanctl/swanctl.conf | 25 -- testing/tests/af-alg/rw-cert/posttest.dat | 8 - testing/tests/af-alg/rw-cert/pretest.dat | 11 - testing/tests/af-alg/rw-cert/test.conf | 25 -- 39 files changed, 1 insertion(+), 1940 deletions(-) delete mode 100644 src/include/linux/if_alg.h delete mode 100644 src/libstrongswan/plugins/af_alg/Makefile.am delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_crypter.c delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_crypter.h delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_hasher.c delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_hasher.h delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_ops.c delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_ops.h delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_plugin.c delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_plugin.h delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_prf.c delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_prf.h delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_signer.c delete mode 100644 src/libstrongswan/plugins/af_alg/af_alg_signer.h delete mode 100644 testing/tests/af-alg/alg-camellia/description.txt delete mode 100644 testing/tests/af-alg/alg-camellia/evaltest.dat delete mode 100644 testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf delete mode 100755 testing/tests/af-alg/alg-camellia/hosts/carol/etc/swanctl/swanctl.conf delete mode 100644 testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf delete mode 100755 testing/tests/af-alg/alg-camellia/hosts/moon/etc/swanctl/swanctl.conf delete mode 100644 testing/tests/af-alg/alg-camellia/posttest.dat delete mode 100644 testing/tests/af-alg/alg-camellia/pretest.dat delete mode 100644 testing/tests/af-alg/alg-camellia/test.conf delete mode 100644 testing/tests/af-alg/rw-cert/description.txt delete mode 100644 testing/tests/af-alg/rw-cert/evaltest.dat delete mode 100644 testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf delete mode 100755 testing/tests/af-alg/rw-cert/hosts/carol/etc/swanctl/swanctl.conf delete mode 100644 testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf delete mode 100755 testing/tests/af-alg/rw-cert/hosts/dave/etc/swanctl/swanctl.conf delete mode 100644 testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf delete mode 100755 testing/tests/af-alg/rw-cert/hosts/moon/etc/swanctl/swanctl.conf delete mode 100644 testing/tests/af-alg/rw-cert/posttest.dat delete mode 100644 testing/tests/af-alg/rw-cert/pretest.dat delete mode 100644 testing/tests/af-alg/rw-cert/test.conf diff --git a/configure.ac b/configure.ac index 2cf4133f6..e9b7b27d1 100644 --- a/configure.ac +++ b/configure.ac @@ -129,7 +129,6 @@ AC_SUBST(ipsec_script_upper, [`echo -n "$ipsec_script" | tr a-z A-Z`]) # crypto plugins ARG_ENABL_SET([aes], [enable AES software implementation plugin.]) -ARG_ENABL_SET([af-alg], [enable AF_ALG crypto interface to Linux Crypto API.]) ARG_ENABL_SET([botan], [enables the Botan crypto plugin.]) ARG_ENABL_SET([ccm], [enables the CCM AEAD wrapper crypto plugin.]) ARG_ENABL_SET([chapoly], [enables the ChaCha20/Poly1305 AEAD plugin.]) @@ -1522,7 +1521,6 @@ ADD_PLUGIN([wolfssl], [s charon swanctl pki scripts attest nm cmd a ADD_PLUGIN([gcrypt], [s charon swanctl pki scripts attest nm cmd aikgen]) ADD_PLUGIN([botan], [s charon swanctl pki scripts attest nm cmd aikgen]) ADD_PLUGIN([pkcs8], [s charon swanctl pki scripts attest nm cmd]) -ADD_PLUGIN([af-alg], [s charon swanctl pki scripts attest nm cmd aikgen]) ADD_PLUGIN([fips-prf], [s charon nm cmd]) ADD_PLUGIN([gmp], [s charon swanctl pki scripts attest nm cmd aikgen fc]) ADD_PLUGIN([curve25519], [s charon swanctl pki scripts nm cmd]) @@ -1692,7 +1690,6 @@ AM_CONDITIONAL(USE_CHAPOLY, test x$chapoly = xtrue) AM_CONDITIONAL(USE_CTR, test x$ctr = xtrue) AM_CONDITIONAL(USE_CCM, test x$ccm = xtrue) AM_CONDITIONAL(USE_GCM, test x$gcm = xtrue) -AM_CONDITIONAL(USE_AF_ALG, test x$af_alg = xtrue) AM_CONDITIONAL(USE_DRBG, test x$drbg = xtrue) AM_CONDITIONAL(USE_ML, test x$ml = xtrue) @@ -1974,7 +1971,6 @@ AC_CONFIG_FILES([ src/libstrongswan/plugins/ctr/Makefile src/libstrongswan/plugins/ccm/Makefile src/libstrongswan/plugins/gcm/Makefile - src/libstrongswan/plugins/af_alg/Makefile src/libstrongswan/plugins/drbg/Makefile src/libstrongswan/plugins/ml/Makefile src/libstrongswan/plugins/test_vectors/Makefile diff --git a/scripts/test.sh b/scripts/test.sh index b055754c6..b6b702c8b 100755 --- a/scripts/test.sh +++ b/scripts/test.sh @@ -268,8 +268,6 @@ all|alpine|codeql|coverage|sonarcloud|no-dbg|no-testable-ke) --disable-unwind-backtraces --disable-svc --disable-dbghelp-backtraces --disable-socket-win --disable-kernel-wfp --disable-kernel-iph --disable-winhttp" - # not enabled on the build server - CONFIG="$CONFIG --disable-af-alg" if test "$TEST" != "coverage"; then CONFIG="$CONFIG --disable-coverage" else diff --git a/src/include/Makefile.am b/src/include/Makefile.am index 8e6db88a4..3d7e99794 100644 --- a/src/include/Makefile.am +++ b/src/include/Makefile.am @@ -1,2 +1,2 @@ -EXTRA_DIST = linux/if_alg.h linux/ipsec.h linux/netlink.h linux/rtnetlink.h \ +EXTRA_DIST = linux/ipsec.h linux/netlink.h linux/rtnetlink.h \ linux/pfkeyv2.h linux/udp.h linux/socket.h linux/xfrm.h sys/queue.h diff --git a/src/include/linux/if_alg.h b/src/include/linux/if_alg.h deleted file mode 100644 index 0f9acce5b..000000000 --- a/src/include/linux/if_alg.h +++ /dev/null @@ -1,40 +0,0 @@ -/* - * if_alg: User-space algorithm interface - * - * Copyright (c) 2010 Herbert Xu - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the Free - * Software Foundation; either version 2 of the License, or (at your option) - * any later version. - * - */ - -#ifndef _LINUX_IF_ALG_H -#define _LINUX_IF_ALG_H - -#include - -struct sockaddr_alg { - __u16 salg_family; - __u8 salg_type[14]; - __u32 salg_feat; - __u32 salg_mask; - __u8 salg_name[64]; -}; - -struct af_alg_iv { - __u32 ivlen; - __u8 iv[0]; -}; - -/* Socket options */ -#define ALG_SET_KEY 1 -#define ALG_SET_IV 2 -#define ALG_SET_OP 3 - -/* Operations */ -#define ALG_OP_DECRYPT 0 -#define ALG_OP_ENCRYPT 1 - -#endif /* _LINUX_IF_ALG_H */ diff --git a/src/libstrongswan/Makefile.am b/src/libstrongswan/Makefile.am index 0a5d77955..2848bf77e 100644 --- a/src/libstrongswan/Makefile.am +++ b/src/libstrongswan/Makefile.am @@ -285,13 +285,6 @@ endif # build plugins with their own Makefile ####################################### -if USE_AF_ALG - SUBDIRS += plugins/af_alg -if MONOLITHIC - libstrongswan_la_LIBADD += plugins/af_alg/libstrongswan-af-alg.la -endif -endif - if USE_AES SUBDIRS += plugins/aes if MONOLITHIC diff --git a/src/libstrongswan/plugins/af_alg/Makefile.am b/src/libstrongswan/plugins/af_alg/Makefile.am deleted file mode 100644 index bd3985367..000000000 --- a/src/libstrongswan/plugins/af_alg/Makefile.am +++ /dev/null @@ -1,22 +0,0 @@ -AM_CPPFLAGS = \ - -I${linux_headers} \ - -I$(top_srcdir)/src/libstrongswan - -AM_CFLAGS = \ - $(PLUGIN_CFLAGS) - -if MONOLITHIC -noinst_LTLIBRARIES = libstrongswan-af-alg.la -else -plugin_LTLIBRARIES = libstrongswan-af-alg.la -endif - -libstrongswan_af_alg_la_SOURCES = \ - af_alg_plugin.h af_alg_plugin.c \ - af_alg_ops.h af_alg_ops.c \ - af_alg_hasher.h af_alg_hasher.c \ - af_alg_signer.h af_alg_signer.c \ - af_alg_prf.h af_alg_prf.c \ - af_alg_crypter.h af_alg_crypter.c - -libstrongswan_af_alg_la_LDFLAGS = -module -avoid-version diff --git a/src/libstrongswan/plugins/af_alg/af_alg_crypter.c b/src/libstrongswan/plugins/af_alg/af_alg_crypter.c deleted file mode 100644 index a8731265a..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_crypter.c +++ /dev/null @@ -1,232 +0,0 @@ -/* - * Copyright (C) 2019 Andreas Steffen - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_crypter.h" -#include "af_alg_ops.h" - -typedef struct private_af_alg_crypter_t private_af_alg_crypter_t; - -/** - * Private data of af_alg_crypter_t - */ -struct private_af_alg_crypter_t { - - /** - * Public part of this class. - */ - af_alg_crypter_t public; - - /** - * AF_ALG operations - */ - af_alg_ops_t *ops; - - /** - * Size of the truncated signature - */ - size_t block_size; - - /** - * Size of the keymat - */ - size_t keymat_size; - - /** - * Size of initialization vector - */ - size_t iv_size; -}; - -/** - * Algorithm database - */ -static struct { - encryption_algorithm_t id; - char *name; - size_t block_size; - /* key size of the algorithm */ - size_t key_size; - /* size of the keying material (key + nonce for ctr mode) */ - size_t keymat_size; - size_t iv_size; -} algs[AF_ALG_CRYPTER] = { - {ENCR_DES, "cbc(des)", 8, 8, 8, 8, }, - {ENCR_DES_ECB, "ecb(des)", 8, 8, 8, 0, }, - {ENCR_3DES, "cbc(des3_ede)", 8, 24, 24, 8, }, - {ENCR_AES_CBC, "cbc(aes)", 16, 16, 16, 16, }, - {ENCR_AES_CBC, "cbc(aes)", 16, 24, 24, 16, }, - {ENCR_AES_CBC, "cbc(aes)", 16, 32, 32, 16, }, - {ENCR_AES_ECB, "ecb(aes)", 16, 16, 16, 0, }, - {ENCR_AES_ECB, "ecb(aes)", 16, 24, 24, 0, }, - {ENCR_AES_ECB, "ecb(aes)", 16, 32, 32, 0, }, - {ENCR_AES_CTR, "rfc3686(ctr(aes))", 1, 16, 20, 8, }, - {ENCR_AES_CTR, "rfc3686(ctr(aes))", 1, 24, 28, 8, }, - {ENCR_AES_CTR, "rfc3686(ctr(aes))", 1, 32, 36, 8, }, - {ENCR_CAMELLIA_CBC, "cbc(camellia)", 16, 16, 16, 16, }, - {ENCR_CAMELLIA_CBC, "cbc(camellia)", 16, 24, 24, 16, }, - {ENCR_CAMELLIA_CBC, "cbc(camellia)", 16, 32, 32, 16, }, - {ENCR_CAMELLIA_CTR, "rfc3686(ctr(camellia))", 1, 16, 20, 8, }, - {ENCR_CAMELLIA_CTR, "rfc3686(ctr(camellia))", 1, 24, 28, 8, }, - {ENCR_CAMELLIA_CTR, "rfc3686(ctr(camellia))", 1, 32, 36, 8, }, - {ENCR_CAST, "cbc(cast5)", 8, 16, 16, 8, }, - {ENCR_BLOWFISH, "cbc(blowfish)", 8, 16, 16, 8, }, - {ENCR_BLOWFISH, "cbc(blowfish)", 8, 24, 24, 8, }, - {ENCR_BLOWFISH, "cbc(blowfish)", 8, 32, 32, 8, }, - {ENCR_SERPENT_CBC, "cbc(serpent)", 16, 16, 16, 16, }, - {ENCR_SERPENT_CBC, "cbc(serpent)", 16, 24, 24, 16, }, - {ENCR_SERPENT_CBC, "cbc(serpent)", 16, 32, 32, 16, }, - {ENCR_TWOFISH_CBC, "cbc(twofish)", 16, 16, 16, 16, }, - {ENCR_TWOFISH_CBC, "cbc(twofish)", 16, 24, 24, 16, }, - {ENCR_TWOFISH_CBC, "cbc(twofish)", 16, 32, 32, 16, }, -}; - -/** - * See header. - */ -void af_alg_crypter_probe(plugin_feature_t *features, int *pos) -{ - af_alg_ops_t *ops; - int i; - - for (i = 0; i < countof(algs); i++) - { - ops = af_alg_ops_create("skcipher", algs[i].name); - if (ops) - { - ops->destroy(ops); - features[(*pos)++] = PLUGIN_PROVIDE(CRYPTER, - algs[i].id, algs[i].key_size); - } - } -} - -/** - * Get the kernel algorithm string and block/key size for our identifier - */ -static size_t lookup_alg(encryption_algorithm_t algo, char **name, - size_t key_size, size_t *keymat_size, size_t *iv_size) -{ - int i; - - for (i = 0; i < countof(algs); i++) - { - if (algs[i].id == algo && - (key_size == 0 || algs[i].key_size == key_size)) - { - *name = algs[i].name; - *keymat_size = algs[i].keymat_size; - *iv_size = algs[i].iv_size; - return algs[i].block_size; - } - } - return 0; -} - -METHOD(crypter_t, decrypt, bool, - private_af_alg_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst) -{ - if (dst) - { - *dst = chunk_alloc(data.len); - return this->ops->crypt(this->ops, ALG_OP_DECRYPT, iv, data, dst->ptr); - } - return this->ops->crypt(this->ops, ALG_OP_DECRYPT, iv, data, data.ptr); -} - -METHOD(crypter_t, encrypt, bool, - private_af_alg_crypter_t *this, chunk_t data, chunk_t iv, chunk_t *dst) -{ - if (dst) - { - *dst = chunk_alloc(data.len); - return this->ops->crypt(this->ops, ALG_OP_ENCRYPT, iv, data, dst->ptr); - } - return this->ops->crypt(this->ops, ALG_OP_ENCRYPT, iv, data, data.ptr); -} - -METHOD(crypter_t, get_block_size, size_t, - private_af_alg_crypter_t *this) -{ - return this->block_size; -} - -METHOD(crypter_t, get_iv_size, size_t, - private_af_alg_crypter_t *this) -{ - return this->iv_size; -} - -METHOD(crypter_t, get_key_size, size_t, - private_af_alg_crypter_t *this) -{ - return this->keymat_size; -} - -METHOD(crypter_t, set_key, bool, - private_af_alg_crypter_t *this, chunk_t key) -{ - return this->ops->set_key(this->ops, key); -} - -METHOD(crypter_t, destroy, void, - private_af_alg_crypter_t *this) -{ - this->ops->destroy(this->ops); - free(this); -} - -/* - * Described in header - */ -af_alg_crypter_t *af_alg_crypter_create(encryption_algorithm_t algo, - size_t key_size) -{ - private_af_alg_crypter_t *this; - size_t block_size, keymat_size, iv_size; - char *name; - - block_size = lookup_alg(algo, &name, key_size, &keymat_size, &iv_size); - if (!block_size) - { /* not supported by kernel */ - return NULL; - } - - INIT(this, - .public = { - .crypter = { - .encrypt = _encrypt, - .decrypt = _decrypt, - .get_block_size = _get_block_size, - .get_iv_size = _get_iv_size, - .get_key_size = _get_key_size, - .set_key = _set_key, - .destroy = _destroy, - }, - }, - .block_size = block_size, - .keymat_size = keymat_size, - .iv_size = iv_size, - .ops = af_alg_ops_create("skcipher", name), - ); - - if (!this->ops) - { - free(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_crypter.h b/src/libstrongswan/plugins/af_alg/af_alg_crypter.h deleted file mode 100644 index 757152f28..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_crypter.h +++ /dev/null @@ -1,62 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg_crypter af_alg_crypter - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_CRYPTER_H_ -#define AF_ALG_CRYPTER_H_ - -typedef struct af_alg_crypter_t af_alg_crypter_t; - -#include -#include - -/** Number of crypters */ -#define AF_ALG_CRYPTER 28 - -/** - * Implementation of signers using AF_ALG. - */ -struct af_alg_crypter_t { - - /** - * The crypter_t interface. - */ - crypter_t crypter; -}; - -/** - * Constructor to create af_alg_crypter_t. - * - * @param algo algorithm to implement - * @param key_size key size in bytes - * @return af_alg_crypter_t, NULL if not supported - */ -af_alg_crypter_t *af_alg_crypter_create(encryption_algorithm_t algo, - size_t key_size); - -/** - * Probe algorithms and return plugin features. - * - * @param features plugin features to create - * @param pos current position in features - */ -void af_alg_crypter_probe(plugin_feature_t *features, int *pos); - -#endif /** AF_ALG_CRYPTER_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_hasher.c b/src/libstrongswan/plugins/af_alg/af_alg_hasher.c deleted file mode 100644 index 3b07472fb..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_hasher.c +++ /dev/null @@ -1,173 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_hasher.h" -#include "af_alg_ops.h" - -typedef struct private_af_alg_hasher_t private_af_alg_hasher_t; - -/** - * Private data of af_alg_hasher_t - */ -struct private_af_alg_hasher_t { - - /** - * Public part of this class. - */ - af_alg_hasher_t public; - - /** - * AF_ALG operations - */ - af_alg_ops_t *ops; - - /** - * Size of the hash - */ - size_t size; -}; - -/** - * Algorithm database - */ -static struct { - hash_algorithm_t id; - char *name; - size_t size; -} algs[AF_ALG_HASHER] = { - {HASH_MD4, "md4", HASH_SIZE_MD4 }, - {HASH_MD5, "md5", HASH_SIZE_MD5 }, - {HASH_SHA1, "sha1", HASH_SIZE_SHA1 }, - {HASH_SHA224, "sha224", HASH_SIZE_SHA224 }, - {HASH_SHA256, "sha256", HASH_SIZE_SHA256 }, - {HASH_SHA384, "sha384", HASH_SIZE_SHA384 }, - {HASH_SHA512, "sha512", HASH_SIZE_SHA512 }, -}; - -/** - * See header. - */ -void af_alg_hasher_probe(plugin_feature_t *features, int *pos) -{ - af_alg_ops_t *ops; - int i; - - for (i = 0; i < countof(algs); i++) - { - ops = af_alg_ops_create("hash", algs[i].name); - if (ops) - { - ops->destroy(ops); - features[(*pos)++] = PLUGIN_PROVIDE(HASHER, algs[i].id); - } - } -} - -/** - * Get the kernel algorithm string and hash size for our identifier - */ -static size_t lookup_alg(hash_algorithm_t algo, char **name) -{ - int i; - - for (i = 0; i < countof(algs); i++) - { - if (algs[i].id == algo) - { - *name = algs[i].name; - return algs[i].size; - } - } - return 0; -} - -METHOD(hasher_t, get_hash_size, size_t, - private_af_alg_hasher_t *this) -{ - return this->size; -} - -METHOD(hasher_t, reset, bool, - private_af_alg_hasher_t *this) -{ - this->ops->reset(this->ops); - return TRUE; -} - -METHOD(hasher_t, get_hash, bool, - private_af_alg_hasher_t *this, chunk_t chunk, uint8_t *hash) -{ - return this->ops->hash(this->ops, chunk, hash, this->size); -} - -METHOD(hasher_t, allocate_hash, bool, - private_af_alg_hasher_t *this, chunk_t chunk, chunk_t *hash) -{ - if (hash) - { - *hash = chunk_alloc(get_hash_size(this)); - if (!get_hash(this, chunk, hash->ptr)) - { - chunk_free(hash); - return FALSE; - } - return TRUE; - } - return get_hash(this, chunk, NULL); -} - -METHOD(hasher_t, destroy, void, - private_af_alg_hasher_t *this) -{ - this->ops->destroy(this->ops); - free(this); -} - -/* - * Described in header - */ -af_alg_hasher_t *af_alg_hasher_create(hash_algorithm_t algo) -{ - private_af_alg_hasher_t *this; - char *name; - size_t size; - - size = lookup_alg(algo, &name); - if (!size) - { /* not supported by kernel */ - return NULL; - } - - INIT(this, - .public = { - .hasher = { - .get_hash = _get_hash, - .allocate_hash = _allocate_hash, - .get_hash_size = _get_hash_size, - .reset = _reset, - .destroy = _destroy, - }, - }, - .ops = af_alg_ops_create("hash", name), - .size = size, - ); - if (!this->ops) - { - free(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_hasher.h b/src/libstrongswan/plugins/af_alg/af_alg_hasher.h deleted file mode 100644 index 0d9f64e9b..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_hasher.h +++ /dev/null @@ -1,60 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg_hasher af_alg_hasher - * @{ @ingroup af_alg - */ - -#ifndef af_alg_HASHER_H_ -#define af_alg_HASHER_H_ - -typedef struct af_alg_hasher_t af_alg_hasher_t; - -#include -#include - -/** Number of hashers */ -#define AF_ALG_HASHER 7 - -/** - * Implementation of hashers using AF_ALG. - */ -struct af_alg_hasher_t { - - /** - * Implements hasher_t interface. - */ - hasher_t hasher; -}; - -/** - * Constructor to create af_alg_hasher_t. - * - * @param algo algorithm - * @return af_alg_hasher_t, NULL if not supported - */ -af_alg_hasher_t *af_alg_hasher_create(hash_algorithm_t algo); - -/** - * Probe algorithms and return plugin features. - * - * @param features plugin features to create - * @param pos current position in deps - */ -void af_alg_hasher_probe(plugin_feature_t *features, int *pos); - -#endif /** af_alg_HASHER_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_ops.c b/src/libstrongswan/plugins/af_alg/af_alg_ops.c deleted file mode 100644 index 4afd1bf4f..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_ops.c +++ /dev/null @@ -1,255 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_ops.h" - -#include -#include -#include - -#include - -typedef struct private_af_alg_ops_t private_af_alg_ops_t; - -/** - * Private data of an af_alg_ops_t object. - */ -struct private_af_alg_ops_t { - - /** - * Public af_alg_ops_t interface. - */ - af_alg_ops_t public; - - /** - * Transform FD - */ - int tfm; - - /** - * Operation FD - */ - int op; -}; - -METHOD(af_alg_ops_t, reset, void, - private_af_alg_ops_t *this) -{ - if (this->op != -1) - { - close(this->op); - this->op = -1; - } -} - -METHOD(af_alg_ops_t, hash, bool, - private_af_alg_ops_t *this, chunk_t data, char *out, size_t outlen) -{ - ssize_t len; - - while (this->op == -1) - { - this->op = accept(this->tfm, NULL, 0); - if (this->op == -1 && errno != EINTR) - { - DBG1(DBG_LIB, "opening AF_ALG hasher failed: %s", strerror(errno)); - return FALSE; - } - } - - do - { - len = send(this->op, data.ptr, data.len, out ? 0 : MSG_MORE); - if (len == -1) - { - if (errno == EINTR) - { - continue; - } - DBG1(DBG_LIB, "writing to AF_ALG hasher failed: %s", strerror(errno)); - return FALSE; - } - data = chunk_skip(data, len); - } - while (data.len); - - if (out) - { - while (outlen) - { - len = read(this->op, out, outlen); - if (len == -1) - { - if (errno == EINTR) - { - continue; - } - DBG1(DBG_LIB, "reading AF_ALG hasher failed: %s", strerror(errno)); - return FALSE; - } - outlen -= len; - out += len; - } - reset(this); - } - return TRUE; -} - -METHOD(af_alg_ops_t, crypt_, bool, - private_af_alg_ops_t *this, uint32_t type, chunk_t iv, chunk_t data, - char *out) -{ - struct msghdr msg = {}; - struct cmsghdr *cmsg; - struct af_alg_iv *ivm; - struct iovec iov; - char buf[CMSG_SPACE(sizeof(type)) + - CMSG_SPACE(offsetof(struct af_alg_iv, iv) + iv.len)]; - ssize_t len; - int op; - - do - { - op = accept(this->tfm, NULL, 0); - if (op == -1 && errno != EINTR) - { - DBG1(DBG_LIB, "accepting AF_ALG crypter failed: %s", strerror(errno)); - return FALSE; - } - } - while (op == -1); - - memset(buf, 0, sizeof(buf)); - - msg.msg_control = buf; - msg.msg_controllen = sizeof(buf); - - cmsg = CMSG_FIRSTHDR(&msg); - cmsg->cmsg_level = SOL_ALG; - cmsg->cmsg_type = ALG_SET_OP; - cmsg->cmsg_len = CMSG_LEN(sizeof(type)); - memcpy(CMSG_DATA(cmsg), &type, sizeof(type)); - - cmsg = CMSG_NXTHDR(&msg, cmsg); - cmsg->cmsg_level = SOL_ALG; - cmsg->cmsg_type = ALG_SET_IV; - cmsg->cmsg_len = CMSG_LEN(offsetof(struct af_alg_iv, iv) + iv.len); - ivm = (void*)CMSG_DATA(cmsg); - ivm->ivlen = iv.len; - memcpy(ivm->iv, iv.ptr, iv.len); - - msg.msg_iov = &iov; - msg.msg_iovlen = 1; - - while (data.len) - { - iov.iov_base = data.ptr; - iov.iov_len = data.len; - - len = sendmsg(op, &msg, 0); - if (len == -1) - { - if (errno == EINTR) - { - continue; - } - DBG1(DBG_LIB, "writing to AF_ALG crypter failed: %s", strerror(errno)); - close(op); - return FALSE; - } - while (read(op, out, len) != len) - { - if (errno != EINTR) - { - DBG1(DBG_LIB, "reading from AF_ALG crypter failed: %s", - strerror(errno)); - close(op); - return FALSE; - } - } - data = chunk_skip(data, len); - out += len; - /* no IV for subsequent data chunks */ - msg.msg_controllen = 0; - } - close(op); - return TRUE; -} - -METHOD(af_alg_ops_t, set_key, bool, - private_af_alg_ops_t *this, chunk_t key) -{ - if (setsockopt(this->tfm, SOL_ALG, ALG_SET_KEY, key.ptr, key.len) == -1) - { - DBG1(DBG_LIB, "setting AF_ALG key failed: %s", strerror(errno)); - return FALSE; - } - return TRUE; -} - -METHOD(af_alg_ops_t, destroy, void, - private_af_alg_ops_t *this) -{ - close(this->tfm); - if (this->op != -1) - { - close(this->op); - } - free(this); -} - -/** - * See header - */ -af_alg_ops_t *af_alg_ops_create(char *type, char *alg) -{ - private_af_alg_ops_t *this; - struct sockaddr_alg sa = { - .salg_family = AF_ALG, - }; - - strncpy(sa.salg_type, type, sizeof(sa.salg_type) - 1); - strncpy(sa.salg_name, alg, sizeof(sa.salg_name) - 1); - - INIT(this, - .public = { - .hash = _hash, - .reset = _reset, - .crypt = _crypt_, - .set_key = _set_key, - .destroy = _destroy, - }, - .tfm = socket(AF_ALG, SOCK_SEQPACKET, 0), - .op = -1, - ); - if (this->tfm == -1) - { - DBG1(DBG_LIB, "opening AF_ALG socket failed: %s", strerror(errno)); - free(this); - return NULL; - } - if (bind(this->tfm, (struct sockaddr*)&sa, sizeof(sa)) == -1) - { - if (errno != ENOENT) - { /* fail silently if algorithm not supported */ - DBG1(DBG_LIB, "binding AF_ALG socket for '%s' failed: %s", - sa.salg_name, strerror(errno)); - } - destroy(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_ops.h b/src/libstrongswan/plugins/af_alg/af_alg_ops.h deleted file mode 100644 index 68f3e6a98..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_ops.h +++ /dev/null @@ -1,94 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** -* @defgroup af_alg_ops af_alg_ops - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_OPS_H_ -#define AF_ALG_OPS_H_ - -#include - -#include - -#ifndef AF_ALG -#define AF_ALG 38 -#endif /* AF_ALG */ - -#ifndef SOL_ALG -#define SOL_ALG 279 -#endif /* SOL_ALG */ - -typedef struct af_alg_ops_t af_alg_ops_t; - -/** - * Helper to run AF_ALG operations. - */ -struct af_alg_ops_t { - - /** - * Hash a chunk of data. - * - * @param data data to hash - * @param out buffer to write hash to, NULL for append mode - * @param outlen number of bytes to read into out - * @return TRUE if successful - */ - bool (*hash)(af_alg_ops_t *this, chunk_t data, char *out, size_t outlen); - - /** - * Reset hasher state. - */ - void (*reset)(af_alg_ops_t *this); - - /** - * En-/Decrypt a chunk of data. - * - * @param type crypto operation (ALG_OP_DECRYPT/ALG_OP_ENCRYPT) - * @param iv iv to use - * @param data data to encrypt/decrypt - * @param out buffer write processed data to - * @return TRUE if successful - */ - bool (*crypt)(af_alg_ops_t *this, uint32_t type, chunk_t iv, chunk_t data, - char *out); - - /** - * Set the key for en-/decryption or HMAC/XCBC operations. - * - * @param key key to set for transform - * @return TRUE if successful - */ - bool (*set_key)(af_alg_ops_t *this, chunk_t key); - - /** - * Destroy a af_alg_ops_t. - */ - void (*destroy)(af_alg_ops_t *this); -}; - -/** - * Create a af_alg_ops instance. - * - * @param type algorithm type (hash, skcipher) - * @param alg algorithm name - * @return TRUE if AF_ALG socket bound successfully - */ -af_alg_ops_t *af_alg_ops_create(char *type, char *alg); - -#endif /** AF_ALG_OPS_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_plugin.c b/src/libstrongswan/plugins/af_alg/af_alg_plugin.c deleted file mode 100644 index 1323f9b5f..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_plugin.c +++ /dev/null @@ -1,110 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_plugin.h" - -#include - -#include "af_alg_hasher.h" -#include "af_alg_signer.h" -#include "af_alg_prf.h" -#include "af_alg_crypter.h" - -#include - -typedef struct private_af_alg_plugin_t private_af_alg_plugin_t; - -/** - * private data of af_alg_plugin - */ -struct private_af_alg_plugin_t { - - /** - * public functions - */ - af_alg_plugin_t public; -}; - -METHOD(plugin_t, get_name, char*, - private_af_alg_plugin_t *this) -{ - return "af-alg"; -} - -static bool af_alg_supported() -{ - int fd; - - fd = socket(AF_ALG, SOCK_SEQPACKET, 0); - if (fd != -1) - { - close(fd); - return true; - } - return false; -} - -METHOD(plugin_t, get_features, int, - private_af_alg_plugin_t *this, plugin_feature_t *features[]) -{ - static plugin_feature_t f[AF_ALG_HASHER + AF_ALG_SIGNER + - AF_ALG_PRF + AF_ALG_CRYPTER + 4] = {}; - static int count = 0; - - if (!count) - { /* initialize only once */ - if (!af_alg_supported()) - { - return 0; - } - f[count++] = PLUGIN_REGISTER(HASHER, af_alg_hasher_create); - af_alg_hasher_probe(f, &count); - f[count++] = PLUGIN_REGISTER(SIGNER, af_alg_signer_create); - af_alg_signer_probe(f, &count); - f[count++] = PLUGIN_REGISTER(PRF, af_alg_prf_create); - af_alg_prf_probe(f, &count); - f[count++] = PLUGIN_REGISTER(CRYPTER, af_alg_crypter_create); - af_alg_crypter_probe(f, &count); - } - *features = f; - return count; -} - -METHOD(plugin_t, destroy, void, - private_af_alg_plugin_t *this) -{ - free(this); -} - -/* - * see header file - */ -PLUGIN_DEFINE(af_alg) -{ - private_af_alg_plugin_t *this; - - INIT(this, - .public = { - .plugin = { - .get_name = _get_name, - .get_features = _get_features, - .destroy = _destroy, - }, - }, - ); - - return &this->public.plugin; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_plugin.h b/src/libstrongswan/plugins/af_alg/af_alg_plugin.h deleted file mode 100644 index 24db0841c..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_plugin.h +++ /dev/null @@ -1,43 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg af_alg - * @ingroup plugins - * - * @defgroup af_alg_plugin af_alg_plugin - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_PLUGIN_H_ -#define AF_ALG_PLUGIN_H_ - -#include - -typedef struct af_alg_plugin_t af_alg_plugin_t; - -/** - * Plugin providing the AF_ALG interface to the Linux Crypto API. - */ -struct af_alg_plugin_t { - - /** - * Implements plugin interface. - */ - plugin_t plugin; -}; - -#endif /** AF_ALG_PLUGIN_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_prf.c b/src/libstrongswan/plugins/af_alg/af_alg_prf.c deleted file mode 100644 index 731ebcd4e..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_prf.c +++ /dev/null @@ -1,212 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_prf.h" -#include "af_alg_ops.h" - -typedef struct private_af_alg_prf_t private_af_alg_prf_t; - -/** - * Private data of a af_alg_prf_t object. - */ -struct private_af_alg_prf_t { - - /** - * Public af_alg_prf_t interface. - */ - af_alg_prf_t public; - - /** - * AF_ALG operations - */ - af_alg_ops_t *ops; - - /** - * Size of the PRF output - */ - size_t block_size; - - /** - * Default key size - */ - size_t key_size; - - /** - * Using an XCBC algorithm? - */ - bool xcbc; -}; - -/** - * Algorithm database - */ -static struct { - pseudo_random_function_t id; - char *name; - size_t block_size; - bool xcbc; -} algs[AF_ALG_PRF] = { - {PRF_HMAC_SHA1, "hmac(sha1)", 20, FALSE, }, - {PRF_HMAC_SHA2_256, "hmac(sha256)", 32, FALSE, }, - {PRF_HMAC_MD5, "hmac(md5)", 16, FALSE, }, - {PRF_HMAC_SHA2_384, "hmac(sha384)", 48, FALSE, }, - {PRF_HMAC_SHA2_512, "hmac(sha512)", 64, FALSE, }, - {PRF_AES128_XCBC, "xcbc(aes)", 16, TRUE, }, - {PRF_CAMELLIA128_XCBC, "xcbc(camellia)", 16, TRUE, }, -}; - -/** - * See header. - */ -void af_alg_prf_probe(plugin_feature_t *features, int *pos) -{ - af_alg_ops_t *ops; - int i; - - for (i = 0; i < countof(algs); i++) - { - ops = af_alg_ops_create("hash", algs[i].name); - if (ops) - { - ops->destroy(ops); - features[(*pos)++] = PLUGIN_PROVIDE(PRF, algs[i].id); - } - } -} - -/** - * Get the kernel algorithm string and block size for our identifier - */ -static size_t lookup_alg(pseudo_random_function_t algo, char **name, bool *xcbc) -{ - int i; - - for (i = 0; i < countof(algs); i++) - { - if (algs[i].id == algo) - { - *name = algs[i].name; - *xcbc = algs[i].xcbc; - return algs[i].block_size; - } - } - return 0; -} - -METHOD(prf_t, get_bytes, bool, - private_af_alg_prf_t *this, chunk_t seed, uint8_t *buffer) -{ - return this->ops->hash(this->ops, seed, buffer, this->block_size); -} - -METHOD(prf_t, allocate_bytes, bool, - private_af_alg_prf_t *this, chunk_t seed, chunk_t *chunk) -{ - if (chunk) - { - *chunk = chunk_alloc(this->block_size); - return get_bytes(this, seed, chunk->ptr); - } - return get_bytes(this, seed, NULL); -} - -METHOD(prf_t, get_block_size, size_t, - private_af_alg_prf_t *this) -{ - return this->block_size; -} - -METHOD(prf_t, get_key_size, size_t, - private_af_alg_prf_t *this) -{ - return this->block_size; -} - -METHOD(prf_t, set_key, bool, - private_af_alg_prf_t *this, chunk_t key) -{ - char buf[this->block_size]; - - this->ops->reset(this->ops); - if (this->xcbc) - { - /* The kernel currently does not support variable length XCBC keys, - * do RFC4434 key padding/reduction manually. */ - if (key.len < this->block_size) - { - memset(buf, 0, this->block_size); - memcpy(buf, key.ptr, key.len); - key = chunk_from_thing(buf); - } - else if (key.len > this->block_size) - { - memset(buf, 0, this->block_size); - if (!this->ops->set_key(this->ops, chunk_from_thing(buf)) || - !this->ops->hash(this->ops, key, buf, this->block_size)) - { - return FALSE; - } - key = chunk_from_thing(buf); - } - } - return this->ops->set_key(this->ops, key); -} - -METHOD(prf_t, destroy, void, - private_af_alg_prf_t *this) -{ - this->ops->destroy(this->ops); - free(this); -} - -/* - * Described in header. - */ -af_alg_prf_t *af_alg_prf_create(pseudo_random_function_t algo) -{ - private_af_alg_prf_t *this; - size_t block_size; - bool xcbc; - char *name; - - block_size = lookup_alg(algo, &name, &xcbc); - if (!block_size) - { /* not supported by kernel */ - return NULL; - } - - INIT(this, - .public = { - .prf = { - .get_bytes = _get_bytes, - .allocate_bytes = _allocate_bytes, - .get_block_size = _get_block_size, - .get_key_size = _get_key_size, - .set_key = _set_key, - .destroy = _destroy, - }, - }, - .ops = af_alg_ops_create("hash", name), - .block_size = block_size, - .xcbc = xcbc, - ); - if (!this->ops) - { - free(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_prf.h b/src/libstrongswan/plugins/af_alg/af_alg_prf.h deleted file mode 100644 index 4892e7ce5..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_prf.h +++ /dev/null @@ -1,60 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg_prf af_alg_prf - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_PRF_H_ -#define AF_ALG_PRF_H_ - -typedef struct af_alg_prf_t af_alg_prf_t; - -#include -#include - -/** Number of PRFs */ -#define AF_ALG_PRF 7 - -/** - * Implementation of PRFs using AF_ALG. - */ -struct af_alg_prf_t { - - /** - * Implements prf_t interface. - */ - prf_t prf; -}; - -/** - * Creates a new af_alg_prf_t object. - * - * @param algo algorithm to implement - * @return af_alg_prf_t object, NULL if hash not supported - */ -af_alg_prf_t *af_alg_prf_create(pseudo_random_function_t algo); - -/** - * Probe algorithms and return plugin features. - * - * @param features plugin features to create - * @param pos current position in features - */ -void af_alg_prf_probe(plugin_feature_t *features, int *pos); - -#endif /** AF_ALG_PRF_H_ @}*/ diff --git a/src/libstrongswan/plugins/af_alg/af_alg_signer.c b/src/libstrongswan/plugins/af_alg/af_alg_signer.c deleted file mode 100644 index d24cc4859..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_signer.c +++ /dev/null @@ -1,208 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -#include "af_alg_signer.h" -#include "af_alg_ops.h" - -typedef struct private_af_alg_signer_t private_af_alg_signer_t; - -/** - * Private data structure with signing context. - */ -struct private_af_alg_signer_t { - - /** - * Public interface of af_alg_signer_t. - */ - af_alg_signer_t public; - - /** - * AF_ALG operations - */ - af_alg_ops_t *ops; - - /** - * Size of the truncated signature - */ - size_t block_size; - - /** - * Default key size - */ - size_t key_size; -}; - -/** - * Algorithm database - */ -static struct { - integrity_algorithm_t id; - char *name; - size_t block_size; - size_t key_size; -} algs[AF_ALG_SIGNER] = { - {AUTH_HMAC_SHA1_96, "hmac(sha1)", 12, 20, }, - {AUTH_HMAC_SHA1_128, "hmac(sha1)", 16, 20, }, - {AUTH_HMAC_SHA1_160, "hmac(sha1)", 20, 20, }, - {AUTH_HMAC_SHA2_256_96, "hmac(sha256)", 12, 32, }, - {AUTH_HMAC_SHA2_256_128, "hmac(sha256)", 16, 32, }, - {AUTH_HMAC_MD5_96, "hmac(md5)", 12, 16, }, - {AUTH_HMAC_MD5_128, "hmac(md5)", 16, 16, }, - {AUTH_HMAC_SHA2_256_256, "hmac(sha256)", 32, 32, }, - {AUTH_HMAC_SHA2_384_192, "hmac(sha384)", 24, 48, }, - {AUTH_HMAC_SHA2_384_384, "hmac(sha384)", 48, 48, }, - {AUTH_HMAC_SHA2_512_256, "hmac(sha512)", 32, 64, }, - {AUTH_HMAC_SHA2_512_512, "hmac(sha512)", 64, 64, }, - {AUTH_AES_XCBC_96, "xcbc(aes)", 12, 16, }, - {AUTH_CAMELLIA_XCBC_96, "xcbc(camellia)", 12, 16, }, -}; - -/** - * See header. - */ -void af_alg_signer_probe(plugin_feature_t *features, int *pos) -{ - af_alg_ops_t *ops; - int i; - - for (i = 0; i < countof(algs); i++) - { - ops = af_alg_ops_create("hash", algs[i].name); - if (ops) - { - ops->destroy(ops); - features[(*pos)++] = PLUGIN_PROVIDE(SIGNER, algs[i].id); - } - } -} - -/** - * Get the kernel algorithm string and block/key size for our identifier - */ -static size_t lookup_alg(integrity_algorithm_t algo, char **name, - size_t *key_size) -{ - int i; - - for (i = 0; i < countof(algs); i++) - { - if (algs[i].id == algo) - { - *name = algs[i].name; - *key_size = algs[i].key_size; - return algs[i].block_size; - } - } - return 0; -} - -METHOD(signer_t, get_signature, bool, - private_af_alg_signer_t *this, chunk_t data, uint8_t *buffer) -{ - return this->ops->hash(this->ops, data, buffer, this->block_size); -} - -METHOD(signer_t, allocate_signature, bool, - private_af_alg_signer_t *this, chunk_t data, chunk_t *chunk) -{ - if (chunk) - { - *chunk = chunk_alloc(this->block_size); - return get_signature(this, data, chunk->ptr); - } - return get_signature(this, data, NULL); -} - -METHOD(signer_t, verify_signature, bool, - private_af_alg_signer_t *this, chunk_t data, chunk_t signature) -{ - char sig[this->block_size]; - - if (signature.len != this->block_size) - { - return FALSE; - } - if (!get_signature(this, data, sig)) - { - return FALSE; - } - return memeq_const(signature.ptr, sig, signature.len); -} - -METHOD(signer_t, get_key_size, size_t, - private_af_alg_signer_t *this) -{ - return this->key_size; -} - -METHOD(signer_t, get_block_size, size_t, - private_af_alg_signer_t *this) -{ - return this->block_size; -} - -METHOD(signer_t, set_key, bool, - private_af_alg_signer_t *this, chunk_t key) -{ - this->ops->reset(this->ops); - return this->ops->set_key(this->ops, key); -} - -METHOD(signer_t, destroy, void, - private_af_alg_signer_t *this) -{ - this->ops->destroy(this->ops); - free(this); -} - -/* - * Described in header - */ -af_alg_signer_t *af_alg_signer_create(integrity_algorithm_t algo) -{ - private_af_alg_signer_t *this; - size_t block_size, key_size = 0; - char *name; - - block_size = lookup_alg(algo, &name, &key_size); - if (!block_size) - { /* not supported by kernel */ - return NULL; - } - - INIT(this, - .public = { - .signer = { - .get_signature = _get_signature, - .allocate_signature = _allocate_signature, - .verify_signature = _verify_signature, - .get_key_size = _get_key_size, - .get_block_size = _get_block_size, - .set_key = _set_key, - .destroy = _destroy, - }, - }, - .ops = af_alg_ops_create("hash", name), - .block_size = block_size, - .key_size = key_size, - ); - if (!this->ops) - { - free(this); - return NULL; - } - return &this->public; -} diff --git a/src/libstrongswan/plugins/af_alg/af_alg_signer.h b/src/libstrongswan/plugins/af_alg/af_alg_signer.h deleted file mode 100644 index e80a6ba87..000000000 --- a/src/libstrongswan/plugins/af_alg/af_alg_signer.h +++ /dev/null @@ -1,60 +0,0 @@ -/* - * Copyright (C) 2010 Martin Willi - * - * Copyright (C) secunet Security Networks AG - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. See . - * - * This program is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY - * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * for more details. - */ - -/** - * @defgroup af_alg_signer af_alg_signer - * @{ @ingroup af_alg - */ - -#ifndef AF_ALG_SIGNER_H_ -#define AF_ALG_SIGNER_H_ - -typedef struct af_alg_signer_t af_alg_signer_t; - -#include -#include - -/** Number of signers */ -#define AF_ALG_SIGNER 14 - -/** - * Implementation of signers using AF_ALG. - */ -struct af_alg_signer_t { - - /** - * Implements signer_t interface. - */ - signer_t signer; -}; - -/** - * Creates a new af_alg_signer_t. - * - * @param algo algorithm to implement - * @return af_alg_signer_t, NULL if not supported - */ -af_alg_signer_t *af_alg_signer_create(integrity_algorithm_t algo); - -/** - * Probe algorithms and return plugin features. - * - * @param features plugin features to create - * @param pos current position in features - */ -void af_alg_signer_probe(plugin_feature_t *features, int *pos); - -#endif /** AF_ALG_SIGNER_H_ @}*/ diff --git a/testing/scripts/recipes/013_strongswan.mk b/testing/scripts/recipes/013_strongswan.mk index 8e36bcf57..3f07261cc 100644 --- a/testing/scripts/recipes/013_strongswan.mk +++ b/testing/scripts/recipes/013_strongswan.mk @@ -82,7 +82,6 @@ CONFIG_OPTS = \ --enable-hmac \ --enable-chapoly \ --enable-ha \ - --enable-af-alg \ --enable-whitelist \ --enable-xauth-generic \ --enable-xauth-eap \ diff --git a/testing/tests/af-alg/alg-camellia/description.txt b/testing/tests/af-alg/alg-camellia/description.txt deleted file mode 100644 index 995ab4c65..000000000 --- a/testing/tests/af-alg/alg-camellia/description.txt +++ /dev/null @@ -1,3 +0,0 @@ -Roadwarrior carol proposes to gateway moon the IKE cipher suite camellia256-sha512-modp3072 -well as the ESP cipher suite camellia192-sha384. A ping from carol to alice successfully -checks the established tunnel. diff --git a/testing/tests/af-alg/alg-camellia/evaltest.dat b/testing/tests/af-alg/alg-camellia/evaltest.dat deleted file mode 100644 index 8a2e36baa..000000000 --- a/testing/tests/af-alg/alg-camellia/evaltest.dat +++ /dev/null @@ -1,7 +0,0 @@ -carol::ping -c 1 -s 120 -p deadbeef PH_IP_ALICE::128 bytes from PH_IP_ALICE: icmp_.eq=1::YES -carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES -moon:: swanctl --list-sas --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=CAMELLIA_CBC encr-keysize=256 integ-alg=HMAC_SHA2_512_256 prf-alg=PRF_HMAC_SHA2_512 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=CAMELLIA_CBC encr-keysize=192 integ-alg=HMAC_SHA2_384_192.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES -moon:: ip xfrm state::enc cbc(camellia)::YES -carol::ip xfrm state::enc cbc(camellia)::YES -moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP.*length 208::YES -moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP.*length 208::YES diff --git a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf b/testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf deleted file mode 100644 index a60e16147..000000000 --- a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/strongswan.conf +++ /dev/null @@ -1,9 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce pem pkcs1 af-alg openssl revocation kernel-netlink curl socket-default updown vici -} diff --git a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/swanctl/swanctl.conf b/testing/tests/af-alg/alg-camellia/hosts/carol/etc/swanctl/swanctl.conf deleted file mode 100755 index acba9cecb..000000000 --- a/testing/tests/af-alg/alg-camellia/hosts/carol/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,27 +0,0 @@ -connections { - - home { - local_addrs = 192.168.0.100 - remote_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = carolCert.pem - id = carol@strongswan.org - } - remote { - auth = pubkey - id = moon.strongswan.org - } - children { - home { - remote_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = camellia192-sha384 - } - } - version = 2 - proposals = camellia256-sha512-modp3072 - } -} diff --git a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf b/testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf deleted file mode 100644 index a60e16147..000000000 --- a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/strongswan.conf +++ /dev/null @@ -1,9 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce pem pkcs1 af-alg openssl revocation kernel-netlink curl socket-default updown vici -} diff --git a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/af-alg/alg-camellia/hosts/moon/etc/swanctl/swanctl.conf deleted file mode 100755 index 1c06bb2ce..000000000 --- a/testing/tests/af-alg/alg-camellia/hosts/moon/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,25 +0,0 @@ -connections { - - rw { - local_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = moonCert.pem - id = moon.strongswan.org - } - remote { - auth = pubkey - } - children { - net { - local_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = camellia192-sha384 - } - } - version = 2 - proposals = camellia256-sha512-modp3072 - } -} diff --git a/testing/tests/af-alg/alg-camellia/posttest.dat b/testing/tests/af-alg/alg-camellia/posttest.dat deleted file mode 100644 index af9cda6ca..000000000 --- a/testing/tests/af-alg/alg-camellia/posttest.dat +++ /dev/null @@ -1,5 +0,0 @@ -carol::swanctl --terminate --ike home -carol::systemctl stop strongswan -moon::systemctl stop strongswan -moon::iptables-restore < /etc/iptables.flush -carol::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/af-alg/alg-camellia/pretest.dat b/testing/tests/af-alg/alg-camellia/pretest.dat deleted file mode 100644 index 22e1eae93..000000000 --- a/testing/tests/af-alg/alg-camellia/pretest.dat +++ /dev/null @@ -1,7 +0,0 @@ -moon::iptables-restore < /etc/iptables.rules -carol::iptables-restore < /etc/iptables.rules -moon::systemctl start strongswan -carol::systemctl start strongswan -moon::expect-connection net -carol::expect-connection home -carol::swanctl --initiate --child home 2> /dev/null diff --git a/testing/tests/af-alg/alg-camellia/test.conf b/testing/tests/af-alg/alg-camellia/test.conf deleted file mode 100644 index 307c7e9cc..000000000 --- a/testing/tests/af-alg/alg-camellia/test.conf +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash -# -# This configuration file provides information on the -# guest instances used for this test - -# All guest instances that are required for this test -# -VIRTHOSTS="alice moon carol winnetou" - -# Corresponding block diagram -# -DIAGRAM="a-m-c-w.png" - -# Guest instances on which tcpdump is to be started -# -TCPDUMPHOSTS="moon" - -# Guest instances on which IPsec is started -# Used for IPsec logging purposes -# -IPSECHOSTS="moon carol" - -# charon controlled by swanctl -# -SWANCTL=1 diff --git a/testing/tests/af-alg/rw-cert/description.txt b/testing/tests/af-alg/rw-cert/description.txt deleted file mode 100644 index 042800278..000000000 --- a/testing/tests/af-alg/rw-cert/description.txt +++ /dev/null @@ -1,12 +0,0 @@ -The roadwarrior carol and the gateway moon use the Crypto API -of the Linux kernel via the af_alg userland interface for all symmetric -encryption and hash functions whereas roadwarrior dave uses openssl -as the default strongSwan cryptographical plugin. -

-The roadwarriors carol and dave set up a connection each -to gateway moon. The authentication is based on X.509 certificates. -Upon the successful establishment of the IPsec tunnel automatically iptables-based -firewall rules are inserted which let pass the tunneled traffic. -In order to test both tunnel and firewall, both carol and dave ping -the client alice behind the gateway moon. - diff --git a/testing/tests/af-alg/rw-cert/evaltest.dat b/testing/tests/af-alg/rw-cert/evaltest.dat deleted file mode 100644 index eccdcf0c1..000000000 --- a/testing/tests/af-alg/rw-cert/evaltest.dat +++ /dev/null @@ -1,10 +0,0 @@ -carol::ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES -dave:: ping -c 1 PH_IP_ALICE::64 bytes from PH_IP_ALICE: icmp_.eq=1::YES -carol::swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.100 local-port=4500 local-id=carol@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[192.168.0.100/32] remote-ts=\[10.1.0.0/16]::YES -dave:: swanctl --list-sas --raw 2> /dev/null::home.*version=2 state=ESTABLISHED local-host=192.168.0.200 local-port=4500 local-id=dave@strongswan.org remote-host=192.168.0.1 remote-port=4500 remote-id=moon.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*home.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[192.168.0.200/32] remote-ts=\[10.1.0.0/16]::YES -moon:: swanctl --list-sas --ike-id 1 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.100 remote-port=4500 remote-id=carol@strongswan.org.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96 prf-alg=PRF_HMAC_SHA1 dh-group=MODP_1536.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=3DES_CBC integ-alg=HMAC_SHA1_96.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.100/32]::YES -moon:: swanctl --list-sas --ike-id 2 --raw 2> /dev/null::rw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=4500 local-id=moon.strongswan.org remote-host=192.168.0.200 remote-port=4500 remote-id=dave@strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=MODP_3072.*child-sas.*net.*state=INSTALLED mode=TUNNEL protocol=ESP.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128.*local-ts=\[10.1.0.0/16] remote-ts=\[192.168.0.200/32]::YES -moon::tcpdump::IP carol.strongswan.org > moon.strongswan.org: ESP::YES -moon::tcpdump::IP moon.strongswan.org > carol.strongswan.org: ESP::YES -moon::tcpdump::IP dave.strongswan.org > moon.strongswan.org: ESP::YES -moon::tcpdump::IP moon.strongswan.org > dave.strongswan.org: ESP::YES diff --git a/testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf b/testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf deleted file mode 100644 index ceedb1e19..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/carol/etc/strongswan.conf +++ /dev/null @@ -1,9 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce test-vectors pem pkcs1 af-alg ccm gcm openssl revocation curl kernel-netlink socket-default updown vici -} diff --git a/testing/tests/af-alg/rw-cert/hosts/carol/etc/swanctl/swanctl.conf b/testing/tests/af-alg/rw-cert/hosts/carol/etc/swanctl/swanctl.conf deleted file mode 100755 index 22fe14f92..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/carol/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,27 +0,0 @@ -connections { - - home { - local_addrs = 192.168.0.100 - remote_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = carolCert.pem - id = carol@strongswan.org - } - remote { - auth = pubkey - id = moon.strongswan.org - } - children { - home { - remote_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = 3des-sha1-modp1536 - } - } - version = 2 - proposals = 3des-sha1-modp1536 - } -} diff --git a/testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf b/testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf deleted file mode 100644 index d275d6777..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/dave/etc/strongswan.conf +++ /dev/null @@ -1,9 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce openssl test-vectors pem pkcs1 revocation curl kernel-netlink socket-default updown vici -} diff --git a/testing/tests/af-alg/rw-cert/hosts/dave/etc/swanctl/swanctl.conf b/testing/tests/af-alg/rw-cert/hosts/dave/etc/swanctl/swanctl.conf deleted file mode 100755 index b3622f50e..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/dave/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,27 +0,0 @@ -connections { - - home { - local_addrs = 192.168.0.200 - remote_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = daveCert.pem - id = dave@strongswan.org - } - remote { - auth = pubkey - id = moon.strongswan.org - } - children { - home { - remote_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = aes128-sha256-modp3072 - } - } - version = 2 - proposals = aes128-sha256-modp3072 - } -} diff --git a/testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf b/testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf deleted file mode 100644 index b8effd883..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/moon/etc/strongswan.conf +++ /dev/null @@ -1,14 +0,0 @@ -# /etc/strongswan.conf - strongSwan configuration file - - swanctl { - load = pem pkcs1 pubkey openssl random -} - -charon-systemd { - load = random nonce test-vectors pem pkcs1 af-alg ccm gcm openssl revocation curl kernel-netlink socket-default updown vici - - integrity_test = yes - crypto_test { - on_add = yes - } -} diff --git a/testing/tests/af-alg/rw-cert/hosts/moon/etc/swanctl/swanctl.conf b/testing/tests/af-alg/rw-cert/hosts/moon/etc/swanctl/swanctl.conf deleted file mode 100755 index ccd247af0..000000000 --- a/testing/tests/af-alg/rw-cert/hosts/moon/etc/swanctl/swanctl.conf +++ /dev/null @@ -1,25 +0,0 @@ -connections { - - rw { - local_addrs = 192.168.0.1 - - local { - auth = pubkey - certs = moonCert.pem - id = moon.strongswan.org - } - remote { - auth = pubkey - } - children { - net { - local_ts = 10.1.0.0/16 - - updown = /usr/local/libexec/ipsec/_updown iptables - esp_proposals = aes128-sha256-modp3072,3des-sha1-modp1536 - } - } - version = 2 - proposals = aes128-sha256-modp3072,3des-sha1-modp1536 - } -} diff --git a/testing/tests/af-alg/rw-cert/posttest.dat b/testing/tests/af-alg/rw-cert/posttest.dat deleted file mode 100644 index eb2100856..000000000 --- a/testing/tests/af-alg/rw-cert/posttest.dat +++ /dev/null @@ -1,8 +0,0 @@ -carol::swanctl --terminate --ike home -dave::swanctl --terminate --ike home -carol::systemctl stop strongswan -dave::systemctl stop strongswan -moon::systemctl stop strongswan -moon::iptables-restore < /etc/iptables.flush -carol::iptables-restore < /etc/iptables.flush -dave::iptables-restore < /etc/iptables.flush diff --git a/testing/tests/af-alg/rw-cert/pretest.dat b/testing/tests/af-alg/rw-cert/pretest.dat deleted file mode 100644 index 7d27f62c6..000000000 --- a/testing/tests/af-alg/rw-cert/pretest.dat +++ /dev/null @@ -1,11 +0,0 @@ -moon::iptables-restore < /etc/iptables.rules -carol::iptables-restore < /etc/iptables.rules -dave::iptables-restore < /etc/iptables.rules -moon::systemctl start strongswan -carol::systemctl start strongswan -dave::systemctl start strongswan -moon::expect-connection net -carol::expect-connection home -carol::swanctl --initiate --child home 2> /dev/null -dave::expect-connection home -dave::swanctl --initiate --child home 2> /dev/null diff --git a/testing/tests/af-alg/rw-cert/test.conf b/testing/tests/af-alg/rw-cert/test.conf deleted file mode 100644 index 1227b9d1c..000000000 --- a/testing/tests/af-alg/rw-cert/test.conf +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash -# -# This configuration file provides information on the -# guest instances used for this test - -# All guest instances that are required for this test -# -VIRTHOSTS="alice moon carol winnetou dave" - -# Corresponding block diagram -# -DIAGRAM="a-m-c-w-d.png" - -# Guest instances on which tcpdump is to be started -# -TCPDUMPHOSTS="moon" - -# Guest instances on which IPsec is started -# Used for IPsec logging purposes -# -IPSECHOSTS="moon carol dave" - -# charon controlled by swanctl -# -SWANCTL=1