denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bliss: Remove legacy BLISS signatures

Browse Source
This commit is contained in:
Andreas Steffen
2024-11-22 14:05:36 +01:00
committed by Tobias Brunner
parent ec982171d9
commit 4833f29b15
116 changed files with 36 additions and 7719 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/credentials/auth_cfg.c
-23
View File
@@ -53,7 +53,6 @@ ENUM(auth_rule_names, AUTH_RULE_IDENTITY, AUTH_HELPER_AC_CERT,
"RULE_GROUP",
"RULE_RSA_STRENGTH",
"RULE_ECDSA_STRENGTH",
"RULE_BLISS_STRENGTH",
"RULE_SIGNATURE_SCHEME",
"RULE_IKE_SIGNATURE_SCHEME",
"RULE_CERT_POLICY",
@@ -96,7 +95,6 @@ static inline bool is_multi_value_rule(auth_rule_t type)
case AUTH_RULE_CERT_POLICY:
case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH:
case AUTH_RULE_BLISS_STRENGTH:
case AUTH_RULE_SIGNATURE_SCHEME:
case AUTH_RULE_IKE_SIGNATURE_SCHEME:
case AUTH_HELPER_IM_CERT:
@@ -218,7 +216,6 @@ static void init_entry(entry_t *this, auth_rule_t type, va_list args)
case AUTH_RULE_OCSP_VALIDATION:
case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH:
case AUTH_RULE_BLISS_STRENGTH:
case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
/* integer type */
this->value = (void*)(uintptr_t)va_arg(args, u_int);
@@ -270,7 +267,6 @@ static bool entry_equals(entry_t *e1, entry_t *e2)
case AUTH_RULE_OCSP_VALIDATION:
case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH:
case AUTH_RULE_BLISS_STRENGTH:
case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
{
return e1->value == e2->value;
@@ -374,7 +370,6 @@ static void destroy_entry_value(entry_t *entry)
case AUTH_RULE_OCSP_VALIDATION:
case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH:
case AUTH_RULE_BLISS_STRENGTH:
case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
case AUTH_RULE_MAX:
break;
@@ -406,7 +401,6 @@ static void replace(private_auth_cfg_t *this, entry_enumerator_t *enumerator,
case AUTH_RULE_OCSP_VALIDATION:
case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH:
case AUTH_RULE_BLISS_STRENGTH:
case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
/* integer type */
entry->value = (void*)(uintptr_t)va_arg(args, u_int);
@@ -484,7 +478,6 @@ METHOD(auth_cfg_t, get, void*,
case AUTH_RULE_EAP_VENDOR:
case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH:
case AUTH_RULE_BLISS_STRENGTH:
return (void*)0;
case AUTH_RULE_CRL_VALIDATION:
case AUTH_RULE_OCSP_VALIDATION:
@@ -604,9 +597,6 @@ METHOD(auth_cfg_t, add_pubkey_constraints, void,
{ "sha256", SIGN_ECDSA_256, KEY_ECDSA, },
{ "sha384", SIGN_ECDSA_384, KEY_ECDSA, },
{ "sha512", SIGN_ECDSA_521, KEY_ECDSA, },
{ "sha256", SIGN_BLISS_WITH_SHA2_256, KEY_BLISS, },
{ "sha384", SIGN_BLISS_WITH_SHA2_384, KEY_BLISS, },
{ "sha512", SIGN_BLISS_WITH_SHA2_512, KEY_BLISS, },
{ "identity", SIGN_ED25519, KEY_ED25519, },
{ "identity", SIGN_ED448, KEY_ED448, },
};
@@ -657,13 +647,6 @@ METHOD(auth_cfg_t, add_pubkey_constraints, void,
expected_type = KEY_ED448;
continue;
}
if (streq(token, "bliss") || streq(token, "ike:bliss"))
{
key_token = token;
expected_type = KEY_BLISS;
expected_strength = AUTH_RULE_BLISS_STRENGTH;
continue;
}
if (streq(token, "pubkey") || streq(token, "ike:pubkey"))
{
key_token = token;
@@ -1053,7 +1036,6 @@ METHOD(auth_cfg_t, complies, bool,
}
case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH:
case AUTH_RULE_BLISS_STRENGTH:
{
strength = (uintptr_t)value;
break;
@@ -1145,9 +1127,6 @@ METHOD(auth_cfg_t, complies, bool,
case AUTH_RULE_ECDSA_STRENGTH:
key_type = "ECDSA";
break;
case AUTH_RULE_BLISS_STRENGTH:
key_type = "BLISS";
break;
}
success = FALSE;
e1 = constraints->create_enumerator(constraints);
@@ -1246,7 +1225,6 @@ static void merge(private_auth_cfg_t *this, private_auth_cfg_t *other, bool copy
case AUTH_RULE_EAP_VENDOR:
case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH:
case AUTH_RULE_BLISS_STRENGTH:
case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
{
add(this, type, (uintptr_t)value);
@@ -1424,7 +1402,6 @@ METHOD(auth_cfg_t, clone_, auth_cfg_t*,
case AUTH_RULE_OCSP_VALIDATION:
case AUTH_RULE_RSA_STRENGTH:
case AUTH_RULE_ECDSA_STRENGTH:
case AUTH_RULE_BLISS_STRENGTH:
case AUTH_RULE_CERT_VALIDATION_SUSPENDED:
clone->add(clone, type, (uintptr_t)value);
break;
src/libstrongswan/credentials/auth_cfg.h
-2
View File
@@ -107,8 +107,6 @@ enum auth_rule_t {
AUTH_RULE_RSA_STRENGTH,
/** required ECDSA public key strength, u_int in bits */
AUTH_RULE_ECDSA_STRENGTH,
/** required BLISS public key strength, u_int in bits */
AUTH_RULE_BLISS_STRENGTH,
/** required signature scheme, signature_params_t* */
AUTH_RULE_SIGNATURE_SCHEME,
/** required signature scheme for IKE authentication, signature_params_t* */
src/libstrongswan/credentials/cred_encoding.h
-5
View File
@@ -149,11 +149,6 @@ enum cred_encoding_part_t {
CRED_PART_EDDSA_PUB_ASN1_DER,
/** a DER encoded EdDSA private key */
CRED_PART_EDDSA_PRIV_ASN1_DER,
/** a DER encoded BLISS public key */
CRED_PART_BLISS_PUB_ASN1_DER,
/** a DER encoded BLISS private key */
CRED_PART_BLISS_PRIV_ASN1_DER,
CRED_PART_END,
};
src/libstrongswan/credentials/credential_manager.c
-3
View File
@@ -732,9 +732,6 @@ static void get_key_strength(certificate_t *cert, auth_cfg_t *auth)
case KEY_ECDSA:
auth->add(auth, AUTH_RULE_ECDSA_STRENGTH, strength);
break;
case KEY_BLISS:
auth->add(auth, AUTH_RULE_BLISS_STRENGTH, strength);
break;
default:
break;
}
src/libstrongswan/credentials/keys/public_key.c
+3 -45
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2015-2017 Tobias Brunner
* Copyright (C) 2014-2016 Andreas Steffen
* Copyright (C) 2014-2020 Andreas Steffen
* Copyright (C) 2007 Martin Willi
*
* Copyright (C) secunet Security Networks AG
@@ -21,17 +21,16 @@
#include "public_key.h"
#include "signature_params.h"
ENUM(key_type_names, KEY_ANY, KEY_BLISS,
ENUM(key_type_names, KEY_ANY, KEY_ED448,
"ANY",
"RSA",
"ECDSA",
"DSA",
"ED25519",
"ED448",
"BLISS"
);
ENUM(signature_scheme_names, SIGN_UNKNOWN, SIGN_BLISS_WITH_SHA3_512,
ENUM(signature_scheme_names, SIGN_UNKNOWN, SIGN_ED448,
"UNKNOWN",
"RSA_EMSA_PKCS1_NULL",
"RSA_EMSA_PKCS1_MD5",
@@ -55,12 +54,6 @@ ENUM(signature_scheme_names, SIGN_UNKNOWN, SIGN_BLISS_WITH_SHA3_512,
"ECDSA-521",
"ED25519",
"ED448",
"BLISS_WITH_SHA2_256",
"BLISS_WITH_SHA2_384",
"BLISS_WITH_SHA2_512",
"BLISS_WITH_SHA3_256",
"BLISS_WITH_SHA3_384",
"BLISS_WITH_SHA3_512",
);
ENUM(encryption_scheme_names, ENCRYPT_UNKNOWN, ENCRYPT_RSA_OAEP_SHA512,
@@ -164,19 +157,6 @@ signature_scheme_t signature_scheme_from_oid(int oid)
return SIGN_ED25519;
case OID_ED448:
return SIGN_ED448;
case OID_BLISS_PUBLICKEY:
case OID_BLISS_WITH_SHA2_512:
return SIGN_BLISS_WITH_SHA2_512;
case OID_BLISS_WITH_SHA2_384:
return SIGN_BLISS_WITH_SHA2_384;
case OID_BLISS_WITH_SHA2_256:
return SIGN_BLISS_WITH_SHA2_256;
case OID_BLISS_WITH_SHA3_512:
return SIGN_BLISS_WITH_SHA3_512;
case OID_BLISS_WITH_SHA3_384:
return SIGN_BLISS_WITH_SHA3_384;
case OID_BLISS_WITH_SHA3_256:
return SIGN_BLISS_WITH_SHA3_256;
}
return SIGN_UNKNOWN;
}
@@ -229,18 +209,6 @@ int signature_scheme_to_oid(signature_scheme_t scheme)
return OID_ED25519;
case SIGN_ED448:
return OID_ED448;
case SIGN_BLISS_WITH_SHA2_256:
return OID_BLISS_WITH_SHA2_256;
case SIGN_BLISS_WITH_SHA2_384:
return OID_BLISS_WITH_SHA2_384;
case SIGN_BLISS_WITH_SHA2_512:
return OID_BLISS_WITH_SHA2_512;
case SIGN_BLISS_WITH_SHA3_256:
return OID_BLISS_WITH_SHA3_256;
case SIGN_BLISS_WITH_SHA3_384:
return OID_BLISS_WITH_SHA3_384;
case SIGN_BLISS_WITH_SHA3_512:
return OID_BLISS_WITH_SHA3_512;
}
return OID_UNKNOWN;
}
@@ -279,9 +247,6 @@ static struct {
{ KEY_ECDSA, 0, { .scheme = SIGN_ECDSA_WITH_SHA512_DER }},
{ KEY_ED25519, 0, { .scheme = SIGN_ED25519 }},
{ KEY_ED448, 0, { .scheme = SIGN_ED448 }},
{ KEY_BLISS, 128, { .scheme = SIGN_BLISS_WITH_SHA2_256 }},
{ KEY_BLISS, 192, { .scheme = SIGN_BLISS_WITH_SHA2_384 }},
{ KEY_BLISS, 0, { .scheme = SIGN_BLISS_WITH_SHA2_512 }},
};
/**
@@ -370,13 +335,6 @@ key_type_t key_type_from_signature_scheme(signature_scheme_t scheme)
return KEY_ED25519;
case SIGN_ED448:
return KEY_ED448;
case SIGN_BLISS_WITH_SHA2_256:
case SIGN_BLISS_WITH_SHA2_384:
case SIGN_BLISS_WITH_SHA2_512:
case SIGN_BLISS_WITH_SHA3_256:
case SIGN_BLISS_WITH_SHA3_384:
case SIGN_BLISS_WITH_SHA3_512:
return KEY_BLISS;
}
return KEY_ANY;
}
src/libstrongswan/credentials/keys/public_key.h
+1 -15
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2015-2017 Tobias Brunner
* Copyright (C) 2014-2017 Andreas Steffen
* Copyright (C) 2014-2020 Andreas Steffen
* Copyright (C) 2007 Martin Willi
*
* Copyright (C) secunet Security Networks AG
@@ -48,8 +48,6 @@ enum key_type_t {
KEY_ED25519 = 4,
/** Ed448 PureEdDSA instance as in RFC 8032 */
KEY_ED448 = 5,
/** BLISS */
KEY_BLISS = 6,
};
/**
@@ -111,18 +109,6 @@ enum signature_scheme_t {
SIGN_ED25519,
/** PureEdDSA on Curve448 as in RFC 8410 */
SIGN_ED448,
/** BLISS with SHA-2_256 */
SIGN_BLISS_WITH_SHA2_256,
/** BLISS with SHA-2_384 */
SIGN_BLISS_WITH_SHA2_384,
/** BLISS with SHA-2_512 */
SIGN_BLISS_WITH_SHA2_512,
/** BLISS with SHA-3_256 */
SIGN_BLISS_WITH_SHA3_256,
/** BLISS with SHA-3_384 */
SIGN_BLISS_WITH_SHA3_384,
/** BLISS with SHA-3_512 */
SIGN_BLISS_WITH_SHA3_512,
};
/**