denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proposal: Add ESN transform to default ESP AEAD proposal

Browse Source 
The commit mentioned below adds an AES-GCM default proposal for ESP. That
proposal does not include any ESN or non-ESN transform to indicate if
extended sequence numbers are supported.

A standards-compliant peer will include one or more ESN support transforms,
and will be unable to select this proposal due to a proposal mismatch.

Fix the default AES-GCM proposal by adding a NO_ESN algorithm. While ESN has
been supported in the Linux kernel for a while, having it in the default
proposal can be problematic with kernel-libipsec or on other platforms.

Fixes: c7bef954ee ("proposal: Add AES-GCM to the ESP default AEAD proposal")
Closes strongswan/strongswan#868
This commit is contained in:
Martin Willi
2022-02-01 13:06:42 +01:00
committed by Tobias Brunner
parent 912d0520b9
commit 956b25a4cc
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/crypto/proposal/proposal.c
+1
View File
@@ -1304,6 +1304,7 @@ proposal_t *proposal_create_default_aead(protocol_id_t protocol)
add_algorithm(this, ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV16, 128);
add_algorithm(this, ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV16, 192);
add_algorithm(this, ENCRYPTION_ALGORITHM, ENCR_AES_GCM_ICV16, 256);
add_algorithm(this, EXTENDED_SEQUENCE_NUMBERS, NO_EXT_SEQ_NUMBERS, 0);
return &this->public;
case PROTO_AH:
default: