denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

puto uses proposal_get_token() from libstrongswan

Browse Source
This commit is contained in:
Andreas Steffen
2009-05-19 10:02:24 +02:00
parent 5908478527
commit b0471fb272
9 changed files with 350 additions and 773 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libfreeswan/ipsec_policy.h
+1 -1
View File
@@ -91,7 +91,7 @@ enum ipsec_authentication_algo {
*/
enum ipsec_cipher_algo {
ESP_NONE = 0,
ESP_NONE = 0,
ESP_DES_IV64 = 1,
ESP_DES = 2,
ESP_3DES = 3,
src/pluto/alg_info.c
+146 -674
View File
File diff suppressed because it is too large Load Diff
src/pluto/alg_info.h
+3 -6
View File
@@ -65,13 +65,10 @@ extern int alg_info_esp_sadb2aa(int sadb_aalg);
extern void alg_info_free(struct alg_info *alg_info);
extern void alg_info_addref(struct alg_info *alg_info);
extern void alg_info_delref(struct alg_info **alg_info);
extern struct alg_info_esp* alg_info_esp_create_from_str(const char *alg_str
, const char **err_p);
extern struct alg_info_ike* alg_info_ike_create_from_str(const char *alg_str
, const char **err_p);
extern struct alg_info_esp* alg_info_esp_create_from_str(char *alg_str);
extern struct alg_info_ike* alg_info_ike_create_from_str(char *alg_str);
extern int alg_info_parse(const char *str);
extern int alg_info_snprint(char *buf, int buflen
, struct alg_info *alg_info);
extern int alg_info_snprint(char *buf, int buflen, struct alg_info *alg_info);
extern int alg_info_snprint_esp(char *buf, int buflen
, struct alg_info_esp *alg_info);
extern int alg_info_snprint_ike(char *buf, int buflen
src/pluto/connections.c
+4 -10
View File
@@ -985,12 +985,10 @@ add_connection(const whack_message_t *wm)
if (wm->esp)
{
const char *ugh;
DBG(DBG_CONTROL,
DBG_log("from whack: got --esp=%s", wm->esp ? wm->esp: "NULL")
)
c->alg_info_esp= alg_info_esp_create_from_str(wm->esp? wm->esp : "", &ugh);
c->alg_info_esp= alg_info_esp_create_from_str(wm->esp? wm->esp : "");
DBG(DBG_CRYPT|DBG_CONTROL,
static char buf[256]="<NULL>";
@@ -1008,19 +1006,16 @@ add_connection(const whack_message_t *wm)
}
else
{
loglog(RC_LOG_SERIOUS
, "esp string error: %s", ugh? ugh : "Unknown");
loglog(RC_LOG_SERIOUS, "esp string error");
}
}
if (wm->ike)
{
const char *ugh;
DBG(DBG_CONTROL,
DBG_log("from whack: got --ike=%s", wm->ike ? wm->ike: "NULL")
)
c->alg_info_ike= alg_info_ike_create_from_str(wm->ike? wm->ike : "", &ugh);
c->alg_info_ike= alg_info_ike_create_from_str(wm->ike? wm->ike : "");
DBG(DBG_CRYPT|DBG_CONTROL,
static char buf[256]="<NULL>";
@@ -1038,8 +1033,7 @@ add_connection(const whack_message_t *wm)
}
else
{
loglog(RC_LOG_SERIOUS
, "ike string error: %s", ugh? ugh : "Unknown");
loglog(RC_LOG_SERIOUS, "ike string error:");
}
}
src/pluto/constants.c
+65 -69
View File
@@ -373,37 +373,33 @@ enum_names ah_transformid_names =
/* IPsec ESP transform values */
static const char *const esp_transform_name[] = {
"ESP_DES_IV64",
"ESP_DES",
"ESP_3DES",
"ESP_RC5",
"ESP_IDEA",
"ESP_CAST",
"ESP_BLOWFISH",
"ESP_3IDEA",
"ESP_DES_IV32",
"ESP_RC4",
"ESP_NULL",
"ESP_AES",
"ESP_AES-CTR",
"ESP_AES-CCM_8",
"ESP_AES-CCM_12",
"ESP_AES-CCM_16",
"ESP_UNASSIGNED_17",
"ESP_AES_GCM_8",
"ESP_AES_GCM_12",
"ESP_AES_GCM_16",
"ESP_SEED_CBC",
"ESP_CAMELLIA"
"DES_IV64",
"DES",
"3DES",
"RC5",
"IDEA",
"CAST",
"BLOWFISH",
"3IDEA",
"DES_IV32",
"RC4",
"NULL",
"AES_CBC",
"AES_CTR",
"AES_CCM_8",
"AES_CCM_12",
"AES_CCM_16",
"UNASSIGNED_17",
"AES_GCM_8",
"AES_GCM_12",
"AES_GCM_16",
"SEED_CBC",
"CAMELLIA_CBC"
};
/*
* ipsec drafts suggest "high" ESP ids values for testing,
* assign generic ESP_ID<num> if not officially defined
*/
static const char *const esp_transform_name_high[] = {
"ESP_SERPENT",
"ESP_TWOFISH"
"SERPENT_CBC",
"TWOFISH_CBC"
};
enum_names esp_transformid_names_high =
@@ -668,20 +664,20 @@ enum_names enc_mode_names =
/* Auth Algorithm attribute */
static const char *const auth_alg_name[] = {
"AUTH_ALGORITHM_HMAC_MD5",
"AUTH_ALGORITHM_HMAC_SHA1",
"AUTH_ALGORITHM_DES_MAC",
"AUTH_ALGORITHM_KPDK",
"AUTH_ALGORITHM_HMAC_SHA2_256",
"AUTH_ALGORITHM_HMAC_SHA2_384",
"AUTH_ALGORITHM_HMAC_SHA2_512",
"AUTH_ALGORITHM_HMAC_RIPEMD",
"AUTH_ALGORITHM_AES_XCBC_MAC",
"AUTH_ALGORITHM_SIG_RSA"
"HMAC_MD5",
"HMAC_SHA1",
"DES_MAC",
"KPDK",
"HMAC_SHA2_256",
"HMAC_SHA2_384",
"HMAC_SHA2_512",
"HMAC_RIPEMD",
"AES_XCBC_MAC",
"SIG_RSA"
};
static const char *const extended_auth_alg_name[] = {
"AUTH_ALGORITHM_NULL"
"NULL"
};
enum_names extended_auth_alg_names =
@@ -797,14 +793,14 @@ enum_names oakley_prf_names =
/* Oakley Encryption Algorithm attribute */
static const char *const oakley_enc_name[] = {
"OAKLEY_DES_CBC",
"OAKLEY_IDEA_CBC",
"OAKLEY_BLOWFISH_CBC",
"OAKLEY_RC5_R16_B64_CBC",
"OAKLEY_3DES_CBC",
"OAKLEY_CAST_CBC",
"OAKLEY_AES_CBC",
"OAKLEY_CAMELLIA_CBC"
"DES_CBC",
"IDEA_CBC",
"BLOWFISH_CBC",
"RC5_R16_B64_CBC",
"3DES_CBC",
"CAST_CBC",
"AES_CBC",
"CAMELLIA_CBC"
};
#ifdef NO_EXTRA_IKE
@@ -812,15 +808,15 @@ enum_names oakley_enc_names =
{ OAKLEY_DES_CBC, OAKLEY_CAMELLIA_CBC, oakley_enc_name, NULL };
#else
static const char *const oakley_enc_name_draft_aes_cbc_02[] = {
"OAKLEY_MARS_CBC" /* 65001 */,
"OAKLEY_RC6_CBC" /* 65002 */,
"OAKLEY_ID_65003" /* 65003 */,
"OAKLEY_SERPENT_CBC" /* 65004 */,
"OAKLEY_TWOFISH_CBC" /* 65005 */,
"MARS_CBC" /* 65001 */,
"RC6_CBC" /* 65002 */,
"ID_65003" /* 65003 */,
"SERPENT_CBC" /* 65004 */,
"TWOFISH_CBC" /* 65005 */,
};
static const char *const oakley_enc_name_ssh[] = {
"OAKLEY_TWOFISH_CBC_SSH",
"TWOFISH_CBC_SSH",
};
enum_names oakley_enc_names_ssh =
@@ -839,12 +835,12 @@ enum_names oakley_enc_names =
/* Oakley Hash Algorithm attribute */
static const char *const oakley_hash_name[] = {
"OAKLEY_MD5",
"OAKLEY_SHA",
"OAKLEY_TIGER",
"OAKLEY_SHA2_256",
"OAKLEY_SHA2_384",
"OAKLEY_SHA2_512",
"HMAC_MD5",
"HMAC_SHA1",
"HMAC_TIGER",
"HMAC_SHA2_256",
"HMAC_SHA2_384",
"HMAC_SHA2_512",
};
enum_names oakley_hash_names =
@@ -897,19 +893,19 @@ enum_names oakley_auth_names =
/* Oakley Group Description attribute */
static const char *const oakley_group_name[] = {
"OAKLEY_GROUP_MODP768",
"OAKLEY_GROUP_MODP1024",
"OAKLEY_GROUP_GP155",
"OAKLEY_GROUP_GP185",
"OAKLEY_GROUP_MODP1536",
"MODP_768",
"MODP_1024",
"GP_155",
"GP_185",
"MODP_1536",
};
static const char *const oakley_group_name_rfc3526[] = {
"OAKLEY_GROUP_MODP2048",
"OAKLEY_GROUP_MODP3072",
"OAKLEY_GROUP_MODP4096",
"OAKLEY_GROUP_MODP6144",
"OAKLEY_GROUP_MODP8192"
"MODP_2048",
"MODP_3072",
"MODP_4096",
"MODP_6144",
"MODP_8192"
};
enum_names oakley_group_names_rfc3526 =
src/pluto/crypto.c
+123 -3
View File
@@ -16,9 +16,7 @@
#include <gmp.h>
#include <freeswan.h>
#include <crypto/crypters/crypter.h>
#include <crypto/hashers/hasher.h>
#include <ipsec_policy.h>
#include "constants.h"
#include "defs.h"
@@ -266,3 +264,125 @@ pseudo_random_function_t oakley_to_prf(int alg)
return PRF_UNDEFINED;
}
}
/**
* Converts IKEv2 encryption to IKEv1 encryption algorithm
*/
int oakley_from_encryption_algorithm(encryption_algorithm_t alg)
{
switch (alg)
{
case ENCR_DES:
return OAKLEY_DES_CBC;
case ENCR_3DES:
return OAKLEY_3DES_CBC;
case ENCR_RC5:
return OAKLEY_RC5_R16_B64_CBC;
case ENCR_IDEA:
return OAKLEY_IDEA_CBC;
case ENCR_CAST:
return OAKLEY_CAST_CBC;
case ENCR_BLOWFISH:
return OAKLEY_BLOWFISH_CBC;
case ENCR_AES_CBC:
return OAKLEY_AES_CBC;
case ENCR_CAMELLIA_CBC:
return OAKLEY_CAMELLIA_CBC;
case ENCR_SERPENT_CBC:
return OAKLEY_SERPENT_CBC;
case ENCR_TWOFISH_CBC:
return OAKLEY_TWOFISH_CBC;
default:
return 0;
}
}
/**
* Converts IKEv2 integrity to IKEv1 hash algorithm
*/
int oakley_from_integrity_algorithm(integrity_algorithm_t alg)
{
switch (alg)
{
case AUTH_HMAC_MD5_96:
return OAKLEY_MD5;
case AUTH_HMAC_SHA1_96:
return OAKLEY_SHA;
case AUTH_HMAC_SHA2_256_128:
return OAKLEY_SHA2_256;
case AUTH_HMAC_SHA2_384_192:
return OAKLEY_SHA2_384;
case AUTH_HMAC_SHA2_512_256:
return OAKLEY_SHA2_512;
default:
return 0;
}
}
/**
* Converts IKEv2 encryption to IKEv1 ESP encryption algorithm
*/
int esp_from_encryption_algorithm(encryption_algorithm_t alg)
{
switch (alg)
{
case ENCR_DES:
return ESP_DES;
case ENCR_3DES:
return ESP_3DES;
case ENCR_RC5:
return ESP_RC5;
case ENCR_IDEA:
return ESP_IDEA;
case ENCR_CAST:
return ESP_CAST;
case ENCR_BLOWFISH:
return ESP_BLOWFISH;
case ENCR_AES_CBC:
return OAKLEY_AES_CBC;
case ENCR_AES_CTR:
return ESP_AES_CTR;
case ENCR_AES_CCM_ICV8:
return ESP_AES_CCM_8;
case ENCR_AES_CCM_ICV12:
return ESP_AES_CCM_12;
case ENCR_AES_CCM_ICV16:
return ESP_AES_CCM_16;
case ENCR_AES_GCM_ICV8:
return ESP_AES_GCM_8;
case ENCR_AES_GCM_ICV12:
return ESP_AES_GCM_12;
case ENCR_AES_GCM_ICV16:
return ESP_AES_GCM_16;
case ENCR_CAMELLIA_CBC:
return ESP_CAMELLIA;
case ENCR_SERPENT_CBC:
return ESP_SERPENT;
case ENCR_TWOFISH_CBC:
return ESP_TWOFISH;
default:
return 0;
}
}
/**
* Converts IKEv2 integrity to IKEv1 ESP authentication algorithm
*/
int esp_from_integrity_algorithm(integrity_algorithm_t alg)
{
switch (alg)
{
case AUTH_HMAC_MD5_96:
return AUTH_ALGORITHM_HMAC_MD5;
case AUTH_HMAC_SHA1_96:
return AUTH_ALGORITHM_HMAC_SHA1;
case AUTH_HMAC_SHA2_256_128:
return AUTH_ALGORITHM_HMAC_SHA2_256;
case AUTH_HMAC_SHA2_384_192:
return AUTH_ALGORITHM_HMAC_SHA2_384;
case AUTH_HMAC_SHA2_512_256:
return AUTH_ALGORITHM_HMAC_SHA2_512;
default:
return 0;
}
}
src/pluto/crypto.h
+5
View File
@@ -13,6 +13,7 @@
*/
#include <crypto/crypters/crypter.h>
#include <crypto/signers/signer.h>
#include <crypto/hashers/hasher.h>
#include <crypto/prfs/prf.h>
@@ -60,4 +61,8 @@ struct state; /* forward declaration, dammit */
extern encryption_algorithm_t oakley_to_encryption_algorithm(int alg);
extern hash_algorithm_t oakley_to_hash_algorithm(int alg);
extern pseudo_random_function_t oakley_to_prf(int alg);
extern int oakley_from_encryption_algorithm(encryption_algorithm_t alg);
extern int oakley_from_integrity_algorithm(integrity_algorithm_t alg);
extern int esp_from_encryption_algorithm(encryption_algorithm_t alg);
extern int esp_from_integrity_algorithm(integrity_algorithm_t alg);
src/pluto/ike_alg.c
+1 -5
View File
@@ -399,17 +399,13 @@ void ike_alg_show_connection(struct connection *c, const char *instance)
st = state_with_serialno(c->newest_isakmp_sa);
if (st)
whack_log(RC_COMMENT
, "\"%s\"%s: IKE algorithm newest: %s_%d-%s-%s"
, "\"%s\"%s: IKE algorithm newest: %s-%d/%s/%s"
, c->name
, instance
, enum_show(&oakley_enc_names, st->st_oakley.encrypt)
+7 /* strlen("OAKLEY_") */
/* , st->st_oakley.encrypter->keydeflen */
, st->st_oakley.enckeylen
, enum_show(&oakley_hash_names, st->st_oakley.hash)
+7 /* strlen("OAKLEY_") */
, enum_show(&oakley_group_names, st->st_oakley.group->group)
+13 /* strlen("OAKLEY_GROUP_") */
);
}
src/pluto/kernel_alg.c
+2 -5
View File
@@ -510,19 +510,16 @@ kernel_alg_show_connection(struct connection *c, const char *instance)
st = state_with_serialno(c->newest_ipsec_sa);
if (st && st->st_esp.present)
whack_log(RC_COMMENT
, "\"%s\"%s: ESP algorithm newest: %s_%d-%s; pfsgroup=%s"
, "\"%s\"%s: ESP algorithm newest: %s-%d/%s/%s"
, c->name
, instance
, enum_show(&esp_transformid_names, st->st_esp.attrs.transid)
+4 /* strlen("ESP_") */
, st->st_esp.attrs.key_len
, enum_show(&auth_alg_names, st->st_esp.attrs.auth)+
+15 /* strlen("AUTH_ALGORITHM_") */
, enum_show(&auth_alg_names, st->st_esp.attrs.auth)
, c->policy & POLICY_PFS ?
c->alg_info_esp->esp_pfsgroup ?
enum_show(&oakley_group_names,
c->alg_info_esp->esp_pfsgroup)
+13 /*strlen("OAKLEY_GROUP_")*/
: "<Phase1>"
: "<N/A>"
);