denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19,108 Commits 1 Branch 0 Tags
012d99ecf4ce66eca44388fab9580a9c912d1e2f
Commit Graph
565 Commits
Author SHA1 Message Date
Tobias Brunner 012d99ecf4 proposal: Prevent selection of duplicate key exchange methods 
All additional (and the initial) key exchanges must use a different method.
 2024-08-07 16:20:19 +02:00
Tobias Brunner 1d5e921911 proposal: Add helper to check if additional key exchanges are contained 2024-08-07 16:20:19 +02:00
Tobias Brunner 882ff93bfd proposal: Accept NONE for additional key exchanges also for IKE proposals 2024-08-07 16:20:19 +02:00
Tobias Brunner c5a6938b9e proposal: Add prefix for additional key exchanges when logging proposals 2024-08-07 16:20:18 +02:00
Tobias Brunner e05d86b27a key-exchange: Add dynamic parser for additional key exchange methods 2024-08-07 16:20:18 +02:00
Tobias Brunner c36eaf42da key-exchange: Add helper to concatenate shared secrets of several key exchanges 2024-08-07 16:20:18 +02:00
Tobias Brunner 9cc5f4a511 proposal: Make all key exchange transforms optional in ESP/AH proposals 2024-08-07 16:20:18 +02:00
Tobias Brunner fb6b8c833b proposal: Skip all KE transforms if PROPOSAL_SKIP_KE given 2024-08-07 16:20:18 +02:00
Tobias Brunner 2e059e0c27 transform: Add helper to check if transform type negotiates key exchange 2024-08-07 16:20:18 +02:00
Tobias Brunner 22550bd262 transform: Add additional key exchange transform types 2024-08-07 16:20:18 +02:00
Tobias Brunner 14bd0bc743 Fixed some typos, courtesy of codespell 2023-11-14 10:11:16 +01:00
Tobias Brunner f73d8699b3 crypto-tester: Fix build with DEBUG_LEVEL < 1 2023-05-08 14:06:43 +02:00
Tobias Brunner 0351b5af3b key-exchange: Warn about costly operations in set_public_key() 2022-06-29 10:28:50 +02:00
Tobias Brunner 3bebf5bf8d proposal: Generalize KE methods 2022-06-29 10:28:50 +02:00
Andreas Steffen b7c167f972 Rename MODP_NONE to KE_NONE 2022-06-29 10:28:50 +02:00
Tobias Brunner 3af7c6db87 Rename diffie_hellman_t to key_exchange_t and change the interface etc. 
This makes it more generic so we can use it for QSKE methods.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Tobias Brunner 5cf82de69a proposal: Demote AES-XCBC/CMAC PRFs in default proposal 
These are rarely used, so strictly propose HMAC-based PRFs first.

References strongswan/strongswan#1026
References strongswan/strongswan#1044
 2022-05-10 09:04:42 +02:00
Tobias Brunner 37dbc87960 crypto: Add new KDF type for IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner 7bde56a9bc crypto: Adapt kdf_t interface to support KDFs with fixed output length 2022-04-14 19:02:56 +02:00
Tobias Brunner f535f1ed53 crypto: Remove unused prf_plus_t 2022-04-14 19:02:56 +02:00
Tobias Brunner 02f7d63e52 crypto-factory: Use actual plugin name when testing during construction 2022-04-14 18:54:24 +02:00
Tobias Brunner 0c6baa8997 crypto-tester: Add facility to test KDFs 2022-04-14 18:54:24 +02:00
Tobias Brunner fbb0bdebe7 crypto-factory: Add constructor and methods to create KDFs 
Using some arguments directly in the constructor will allow us to fall
back on other implementations.
 2022-04-14 18:54:24 +02:00
Tobias Brunner 35ad267fce pkcs5: Rename kdf_t to avoid conflict 2022-04-14 18:54:24 +02:00
Tobias Brunner e93882c6a0 transform: Add private transform for KDFs 2022-04-14 18:54:24 +02:00
Tobias Brunner 40a09613d2 crypto: Add interface for key derivation functions 2022-04-14 18:54:24 +02:00
Tobias Brunner 963adc7637 xof: Fix typo in documentation for set_seed() 2022-02-17 16:34:56 +01:00
Martin Willi 956b25a4cc proposal: Add ESN transform to default ESP AEAD proposal 
The commit mentioned below adds an AES-GCM default proposal for ESP. That
proposal does not include any ESN or non-ESN transform to indicate if
extended sequence numbers are supported.

A standards-compliant peer will include one or more ESN support transforms,
and will be unable to select this proposal due to a proposal mismatch.

Fix the default AES-GCM proposal by adding a NO_ESN algorithm. While ESN has
been supported in the Linux kernel for a while, having it in the default
proposal can be problematic with kernel-libipsec or on other platforms.

Fixes: c7bef954ee ("proposal: Add AES-GCM to the ESP default AEAD proposal")
Closes strongswan/strongswan#868
 2022-02-01 13:06:42 +01:00
Andreas Steffen 695a04d146 openssl: Support of AES-CFB encryption 2021-12-06 12:52:37 +01:00
Tobias Brunner 8b2b5a647b proposal: Add aliases for AES-GCM/CCM without explicit ICV length 
These are mapped to use the default, maximum ICV length of 16 bytes.
 2021-02-12 14:35:23 +01:00
Tobias Brunner 85bde019d3 diffie-hellman: Classify x25519 and x448 as ECDH methods 2021-02-12 14:35:23 +01:00
Tobias Brunner 9514aa2dcc diffie-hellman: Add enum names that match proposal keywords 2021-02-12 14:35:23 +01:00
Tobias Brunner c7bef954ee proposal: Add AES-GCM to the ESP default AEAD proposal 
References #3461.
 2020-06-12 13:45:58 +02:00
Tobias Brunner e630f2d373 proposal: Add IKEv1 transform number on which a proposal is based 2020-03-06 10:31:30 +01:00
Josh Soref b3ab7a48cc Spelling fixes 
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior

Closes strongswan/strongswan#164.
 2020-02-11 18:23:07 +01:00
Andreas Steffen 20f3d04b13 aesni: Added AES_ECB support 2019-11-28 17:03:08 +01:00
Andreas Steffen 11e9d2b8d1 drbg: The drbg instance owns the entropy rng 2019-11-28 09:55:56 +01:00
Tobias Brunner 07083788e5 proposal: Fix typos and clarify things in comments 2019-11-04 15:22:18 +01:00
Tobias Brunner ec93acff03 proposal: Remove unused strip_dh() method 2019-10-24 17:43:21 +02:00
Tobias Brunner a2cb2c9cc8 proposal: Add selection flags to clone() method 
This avoids having to call strip_dh() in child_cfg_t::get_proposals().
It also inverts the ALLOW_PRIVATE flag (i.e. makes it SKIP_PRIVATE) so
nothing has to be supplied to clone complete proposals.
 2019-10-24 17:43:21 +02:00
Tobias Brunner c9599d4101 proposal: Extract proposal selection code in ike/child_cfg_t 
Also invert the PREFER_CONFIGURED flag (i.e. make it PREFER_SUPPLIED)
so the default, without flags, is what we preferred so far.
 2019-10-24 17:36:33 +02:00
Tobias Brunner a406bc60c5 proposal: Handle skipping DH groups directly in select() and matches() 
Also renames the flag.
 2019-10-24 17:33:57 +02:00
Thomas Egerer f930b732c4 proposal: Use flags to select/match proposals 
During proposal selection with ike/child_cfgs a couple of boolean
variables can be set (e.g. private, prefer_self, strip_dh). To simplify
the addition of new parameters, these functions now use a set of flags
instead of indiviual boolean values.

Signed-off-by: Thomas Egerer <[email protected]>
 2019-10-24 17:22:53 +02:00
Tobias Brunner 768e013790 prf-plus: Fail after counter has wrapped around 
The behavior is undefined if this happens (RFC 7296, section 2.13).
Instead of switching to the non-counter mode, or letting the counter
wrap, this makes it clear that the usage was not as intended.
 2019-10-21 13:53:11 +02:00
Tobias Brunner c75010080a prf-plus: Fix a potential memory leak if get_bytes() fails 2019-10-21 12:22:22 +02:00
Andreas Steffen 737375a2d2 drbg: Implemented NIST SP-800-90A DRBG 2019-10-16 16:46:24 +02:00
Tobias Brunner b9949e98c2 Some whitespace fixes 
Didn't change some of the larger testing scripts that use an inconsistent
indentation style.
 2019-08-22 15:18:06 +02:00
Tobias Brunner fbfe5a2724 proposal: Add missing curve448/x448 keywords 
Fixes #3064.
 2019-05-20 09:43:59 +02:00
Tobias Brunner db82c0f594 Fixed some typos, courtesy of codespell 2018-12-18 11:14:19 +01:00