denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,529 Commits 1 Branch 0 Tags
77b91e6d0eaffb3c69b47221c3de3bb8ff80e01a
Commit Graph
4010 Commits
Author SHA1 Message Date
Andreas Steffen 2b474073d9 pem: Support PEM-encoded PKCS#7 container 2022-07-06 20:38:00 +02:00
Tobias Brunner 23b0220b1c unit-tests: Allow configuring log levels for individual groups 2022-06-29 10:28:50 +02:00
Tobias Brunner 35edbc4048 debug: Support configuring different log levels for groups in default logger 2022-06-29 10:28:50 +02:00
Tobias Brunner 4e5a2037e7 wolfssl: Move shared secret calculation to get_shared_secret() 
The ECDH implementation gets a bit simpler since we removed the
ecp_x_coordinate_only option a while ago.

Also added calls to verify public keys.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 26ca0c9f70 pkcs11: Move shared secret calculation to get_shared_secret() 2022-06-29 10:28:50 +02:00
Tobias Brunner d95082ce0d gcrypt: Move shared secret calculation to get_shared_secret() 2022-06-29 10:28:50 +02:00
Tobias Brunner ed3494ef7b curve25519: Move shared secret calculation to get_shared_secret() 2022-06-29 10:28:50 +02:00
Tobias Brunner 31f467d70b botan: Move shared secret calculation to get_shared_secret() 2022-06-29 10:28:50 +02:00
Tobias Brunner 0e82d5cc2c gmp: Move shared secret calculation to get_shared_secret() 
This avoids doing costly operations when just setting the public key.
For the same reason the optional extended public key check is moved.
 2022-06-29 10:28:50 +02:00
Tobias Brunner 0351b5af3b key-exchange: Warn about costly operations in set_public_key() 2022-06-29 10:28:50 +02:00
Tobias Brunner f00e80d759 status: Add return_need_more() utility function 2022-06-29 10:28:50 +02:00
Tobias Brunner 3bebf5bf8d proposal: Generalize KE methods 2022-06-29 10:28:50 +02:00
Andreas Steffen b7c167f972 Rename MODP_NONE to KE_NONE 2022-06-29 10:28:50 +02:00
Tobias Brunner 3af7c6db87 Rename diffie_hellman_t to key_exchange_t and change the interface etc. 
This makes it more generic so we can use it for QSKE methods.
 2022-06-29 10:28:50 +02:00
Tobias Brunner ec95fd9b93 bliss: Remove stray URLs from headers 2022-06-29 10:28:17 +02:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Tobias Brunner 8dbcff1e8b openssl: Use dynamically allocated array to determine EC curves 
This avoids the use of a variable length array, which should probably
be avoided in general due to potential performance, portability and
security issues (not in this particular case, though).

Closes strongswan/strongswan#1095
 2022-06-27 15:54:23 +02:00
Tobias Brunner 1c198bf22b fips-prf: Add explicit bound check to avoid GCC 12 compile warning 
GCC assumes this->b is zero (or may be zero) and spits out the following
warning (or error with -Werror):

src/libstrongswan/plugins/fips_prf/fips_prf.c:124:12: error: array subscript 18446744073709551615 is above array bounds of ‘uint8_t[<U8090>]’ {aka ‘unsigned char[<U8090>]’} [-Werror=array-bounds]
  124 |         one[this->b - 1] = 0x01;
      |         ~~~^~~~~~~~~~~~~
 2022-06-27 14:09:11 +02:00
Tobias Brunner 585666aa97 hashtable: Avoid compiler warning with GCC 12 
Even though the assignment of `removed` to `out_row` is tied to the
`found_removed` flag, which is only set if `removed` is set, the
compiler complains that it may be used uninitialized.
 2022-06-27 14:09:11 +02:00
Tobias Brunner 993ea32825 object: Fix CALLBACK macros with GCC 12 
GCC 12 produces weird code when a callback is called directly (e.g.
parse_bool() via parse_option() in vici_config.c).  Instead of the actual
pointer, it explicitly passes 0 as first argument, which likely causes
a segmentation fault.  It doesn't happen when called indirectly via
function pointer that has void* as first argument, which this patch
kinda replicates for direct calls to avoid the issue.

Closes strongswan/strongswan#1053
 2022-06-27 14:03:32 +02:00
Tobias Brunner 735515b3a7 credential-manager: Log subject of trusted cert before building trust chain 
This should make it clearer to what the log messages generated by
verify_trust_chain() are related (in particular if building the chain
fails or the cert has expired).
 2022-06-02 11:25:19 +02:00
Tobias Brunner 5cf82de69a proposal: Demote AES-XCBC/CMAC PRFs in default proposal 
These are rarely used, so strictly propose HMAC-based PRFs first.

References strongswan/strongswan#1026
References strongswan/strongswan#1044
 2022-05-10 09:04:42 +02:00
Tobias Brunner af9c78d393 plugin-loader: Print an error message if plugin constructor is not found 2022-05-06 12:02:45 +02:00
Tobias Brunner d23c0ea81e enum: Fix compiler warning 
Closes strongswan/strongswan#1025
 2022-05-02 09:31:49 +02:00
Tobias Brunner 352fa96dfc gcrypt: Initialize variables when en-/decrypting with RSA to avoid warnings 2022-04-22 09:49:37 +02:00
Tobias Brunner 2283a19b80 kdf: Fix Doxygen comments 2022-04-22 09:49:37 +02:00
Tobias Brunner c508b904b8 openssl: Fix typo in comment 2022-04-21 11:06:30 +02:00
Tobias Brunner 76ff49b761 unit-tests: Add environment variable to skip IPv6 stream tests 
This is an issue e.g. when running tests in default Docker containers.
 2022-04-14 19:05:45 +02:00
Tobias Brunner 7d99b29b99 unit-tests: Add support for more than one warning per test case 
Warnings are usually short (as compared to failures that contain data
dumps), so the buffer size can be reduced.
 2022-04-14 19:05:44 +02:00
Tobias Brunner a8bab0ee15 openssl: Move ENGINE-specific code into a separate file 
This way we can compile it with OPENSSL_SUPPRESS_DEPRECATED for
OpenSSL 3.0, which deprecated the ENGINE API.
 2022-04-14 19:05:44 +02:00
Tobias Brunner f26639de2c openssl: Remove checks and legacy compatibility code for OpenSSL < 1.0.2 
More of this code was already removed with previous commits.

While versions < 1.1.1 are not officially supported anymore, 1.0.2 might
still be in use because before 3.x that was the latest version with
official FIPS support (OpenSSL apparently also provides extended commercial
support for it).
 2022-04-14 19:05:44 +02:00
Tobias Brunner db0c53c207 openssl: Fixes for HMAC with OpenSSL 3.0 2022-04-14 19:05:44 +02:00
Tobias Brunner 293a912c7d openssl: Fixes for ECDSA with OpenSSL 3.0 2022-04-14 19:05:44 +02:00
Tobias Brunner 544fb1cf92 pkcs8: Parse the decrypted PKCS#8 structure via regular builders 
This allows other plugins to parse such structures directly.  The pkcs8
plugin is called recursively again if necessary.
 2022-04-14 19:05:44 +02:00
Tobias Brunner 21b586c61c openssl: Fixes for RSA with OpenSSL 3.0 2022-04-14 19:05:44 +02:00
Tobias Brunner 36cf74f5d9 openssl: Fixes for DH with OpenSSL 3.0 
While we could assign the DH object to a EVP_PKEY object, this won't work
with BoringSSL as it doesn't seem to support EVP_PKEY_derive() for DH.
 2022-04-14 19:05:44 +02:00
Tobias Brunner f5710c9ccb openssl: Fixes for ECDH with OpenSSL 3.0 
Uses new and non-deprecated APIs to create/generate key pairs.
 2022-04-14 19:05:44 +02:00
Tobias Brunner 13efce489e openssl: PRF_KEYED_SHA1 might not be supported 
The old API has been deprecated with OpenSSL 3 and direct access to the
state isn't possible via EVP API.  In the future we might just remove this
implementation but we'd probably have to implement EAP-AKA' first, which
uses HMAC-SHA-256 with IKEv2's prf+ construct to derive keys instead
of this weird construct (plus what fips-prf builds around it) that's used
by EAP-AKA.
 2022-04-14 19:05:44 +02:00
Tobias Brunner 519bc22091 leak-detective: Whitelist OpenSSL 3.0 functions 2022-04-14 19:05:44 +02:00
Tobias Brunner 1c1213f4b6 openssl: Move shared secret calculation to get_shared_secret() 
This is a change from the multi-KE branch.
 2022-04-14 19:05:44 +02:00
Tobias Brunner 56afc6e298 wolfssl: Implement HMAC-based IKEv2 PRFs via wolfSSL's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner 7498769aba botan: Implement HMAC-based IKEv2 PRFs via Botan's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner e0fc786ecd openssl: Implement HMAC-based IKEv2 PRFs via OpenSSL's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner 0339ce34f6 kdf: Implement wrapper for IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner ad0e94b6ed test-vectors: Add vectors for HMAC-based IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner 37dbc87960 crypto: Add new KDF type for IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner 7bde56a9bc crypto: Adapt kdf_t interface to support KDFs with fixed output length 2022-04-14 19:02:56 +02:00
Tobias Brunner 96c7692661 wolfssl: Implement prf+ via wolfSSL's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner cb8f924051 botan: Implement prf+ via Botan's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner f535f1ed53 crypto: Remove unused prf_plus_t 2022-04-14 19:02:56 +02:00