denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,926 Commits 1 Branch 0 Tags
8e3b921abed7eefcd55e91a42981260f3345a68c
Commit Graph
14691 Commits
Author SHA1 Message Date
Andreas Steffen 3f19a951cf TCG TNC attribute name changes 
The TCG TNC IF-M Segmentation standard was implemented based on a
draft version. The attribute names are updated to comply with the
final TCG IF-M Segmentation Specification Version 1.0 Rev. 5
dated 4 April 2016
 2022-05-26 17:37:43 +02:00
Tobias Brunner 14f082177e nm: Version bump to 1.6.0 2022-05-16 14:18:48 +02:00
Tobias Brunner 790e0b1cd4 nm: Add support for GTK4 2022-05-16 14:18:48 +02:00
Tobias Brunner 49e30dbed4 nm: Change layout of file chooser dialog 
GTK4 does not support buttons at the bottom, so we put them in a header
bar, which is the preferred layout by current desktop environments. And
while it doesn't look ideal on older desktops, it also works with GTK3
and changing it avoids having to maintain multiple UI files.

Note that this layout is not supported by glade, so we generally can't
use it to edit the GUI anymore (it also doesn't support GTK4 in general).
 2022-05-16 14:18:48 +02:00
Tobias Brunner b404440192 nm: Split NM plugin and editor widget into separate libs 
This will allow the plugin to load the editor widget matching the current
GTK version dynamically.
 2022-05-16 14:18:48 +02:00
Tobias Brunner 4f4778d792 nm: Replace GtkFileChooserButton 
GTK4 does not provide that widget anymore, so we replace it with buttons,
labels and a GtkFileChooserDialog widgets.
 2022-05-16 11:46:22 +02:00
Tobias Brunner 7740e8bb0f nm: Update Glade file 2022-05-16 11:46:22 +02:00
Tobias Brunner 94e0ef33db nm: Load GtkBuilder data from resource instead of file 
This makes it easier to build a GTK4 version later.
 2022-05-16 11:46:22 +02:00
Tobias Brunner 085daf4743 nm: Remove old libnm-glib compat stuff 
This shouldn't be necessary anymore.
 2022-05-16 11:46:22 +02:00
Tobias Brunner 64d73235c4 adopt-children-job: Avoid reordering CHILD_SAs 
References strongswan/strongswan#1041
 2022-05-10 09:08:17 +02:00
Xiao Liang 3b742c75ab quick-mode: Remove outbound SA/policy of rekeyed CHILD_SA 
Remove outbound SA and policy of rekeyed CHILD_SA since only one is valid.
Otherwise, during update-SA job (when NAT mapping changed), CHILD_SA are
updated and installed one by one, leaving a window where old SAs are being
used. There are also circumstances where the new SA is not processed last.

Closes strongswan/strongswan#1041
 2022-05-10 09:07:37 +02:00
Tobias Brunner 5cf82de69a proposal: Demote AES-XCBC/CMAC PRFs in default proposal 
These are rarely used, so strictly propose HMAC-based PRFs first.

References strongswan/strongswan#1026
References strongswan/strongswan#1044
 2022-05-10 09:04:42 +02:00
Tobias Brunner af9c78d393 plugin-loader: Print an error message if plugin constructor is not found 2022-05-06 12:02:45 +02:00
Tobias Brunner 4de8b81dea keymat_v2: Fix error message if KDF can't be created 
Fixes: f619b833ac ("keymat_v2: Use plugin-provided KDF_PRF to derive SKEYSEED")
References strongswan/strongswan#1026
 2022-05-06 11:45:10 +02:00
Tobias Brunner d23c0ea81e enum: Fix compiler warning 
Closes strongswan/strongswan#1025
 2022-05-02 09:31:49 +02:00
Tobias Brunner c9d471091f Use mallinfo2() if available 
mallinfo() is deprecated because it uses `int` for the members of the
returned struct, whereas mallinfo2() uses `size_t`.  It's available
since glibc 2.33.
 2022-04-25 14:16:20 +02:00
Tobias Brunner a6a0fa980f tls-crypto: Initialize cipher suites arrays to avoid warnings 2022-04-22 09:49:37 +02:00
Tobias Brunner 352fa96dfc gcrypt: Initialize variables when en-/decrypting with RSA to avoid warnings 2022-04-22 09:49:37 +02:00
Tobias Brunner 2283a19b80 kdf: Fix Doxygen comments 2022-04-22 09:49:37 +02:00
Tobias Brunner c508b904b8 openssl: Fix typo in comment 2022-04-21 11:06:30 +02:00
Tobias Brunner f4d6539b49 ikev2: Maintain labels during make-before-break reauthentication 2022-04-20 14:45:41 +02:00
Tobias Brunner 76ff49b761 unit-tests: Add environment variable to skip IPv6 stream tests 
This is an issue e.g. when running tests in default Docker containers.
 2022-04-14 19:05:45 +02:00
Tobias Brunner 7d99b29b99 unit-tests: Add support for more than one warning per test case 
Warnings are usually short (as compared to failures that contain data
dumps), so the buffer size can be reduced.
 2022-04-14 19:05:44 +02:00
Tobias Brunner a8bab0ee15 openssl: Move ENGINE-specific code into a separate file 
This way we can compile it with OPENSSL_SUPPRESS_DEPRECATED for
OpenSSL 3.0, which deprecated the ENGINE API.
 2022-04-14 19:05:44 +02:00
Tobias Brunner f26639de2c openssl: Remove checks and legacy compatibility code for OpenSSL < 1.0.2 
More of this code was already removed with previous commits.

While versions < 1.1.1 are not officially supported anymore, 1.0.2 might
still be in use because before 3.x that was the latest version with
official FIPS support (OpenSSL apparently also provides extended commercial
support for it).
 2022-04-14 19:05:44 +02:00
Tobias Brunner db0c53c207 openssl: Fixes for HMAC with OpenSSL 3.0 2022-04-14 19:05:44 +02:00
Tobias Brunner 293a912c7d openssl: Fixes for ECDSA with OpenSSL 3.0 2022-04-14 19:05:44 +02:00
Tobias Brunner 544fb1cf92 pkcs8: Parse the decrypted PKCS#8 structure via regular builders 
This allows other plugins to parse such structures directly.  The pkcs8
plugin is called recursively again if necessary.
 2022-04-14 19:05:44 +02:00
Tobias Brunner 21b586c61c openssl: Fixes for RSA with OpenSSL 3.0 2022-04-14 19:05:44 +02:00
Tobias Brunner 36cf74f5d9 openssl: Fixes for DH with OpenSSL 3.0 
While we could assign the DH object to a EVP_PKEY object, this won't work
with BoringSSL as it doesn't seem to support EVP_PKEY_derive() for DH.
 2022-04-14 19:05:44 +02:00
Tobias Brunner f5710c9ccb openssl: Fixes for ECDH with OpenSSL 3.0 
Uses new and non-deprecated APIs to create/generate key pairs.
 2022-04-14 19:05:44 +02:00
Tobias Brunner 13efce489e openssl: PRF_KEYED_SHA1 might not be supported 
The old API has been deprecated with OpenSSL 3 and direct access to the
state isn't possible via EVP API.  In the future we might just remove this
implementation but we'd probably have to implement EAP-AKA' first, which
uses HMAC-SHA-256 with IKEv2's prf+ construct to derive keys instead
of this weird construct (plus what fips-prf builds around it) that's used
by EAP-AKA.
 2022-04-14 19:05:44 +02:00
Tobias Brunner 519bc22091 leak-detective: Whitelist OpenSSL 3.0 functions 2022-04-14 19:05:44 +02:00
Tobias Brunner 1c1213f4b6 openssl: Move shared secret calculation to get_shared_secret() 
This is a change from the multi-KE branch.
 2022-04-14 19:05:44 +02:00
Tobias Brunner f619b833ac keymat_v2: Use plugin-provided KDF_PRF to derive SKEYSEED 2022-04-14 19:02:56 +02:00
Tobias Brunner 743b486118 unit-tests: Hand out an actual shared secret and pubkey in mock KE implementation 
Makes this a bit more realistic and makes key derivation via OpenSSL's
HKDF work during tests.
 2022-04-14 19:02:56 +02:00
Tobias Brunner 56afc6e298 wolfssl: Implement HMAC-based IKEv2 PRFs via wolfSSL's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner 7498769aba botan: Implement HMAC-based IKEv2 PRFs via Botan's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner e0fc786ecd openssl: Implement HMAC-based IKEv2 PRFs via OpenSSL's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner 0339ce34f6 kdf: Implement wrapper for IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner ad0e94b6ed test-vectors: Add vectors for HMAC-based IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner 37dbc87960 crypto: Add new KDF type for IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner 7bde56a9bc crypto: Adapt kdf_t interface to support KDFs with fixed output length 2022-04-14 19:02:56 +02:00
Tobias Brunner 96c7692661 wolfssl: Implement prf+ via wolfSSL's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner cb8f924051 botan: Implement prf+ via Botan's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner f535f1ed53 crypto: Remove unused prf_plus_t 2022-04-14 19:02:56 +02:00
Tobias Brunner f0957d1250 kdf: Implement prf+ directly without relying on prf_plus_t 2022-04-14 19:02:56 +02:00
Tobias Brunner 9cb3c10418 keymat_v1: Derive CHILD_SA keys without using prf_plus_t 
We already expand skeyid_e in a similar fashion so do this analogous
without relying on prf_plus_t.
 2022-04-14 19:02:56 +02:00
Tobias Brunner be07b9dc01 unit-tests: Use plugin-provided prf+ in unit test 
This tests the params API and the counter overflow.
 2022-04-14 19:02:56 +02:00
Tobias Brunner df16d7902a tls-hkdf: Use plugin-provided prf+ 2022-04-14 19:02:56 +02:00