denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,449 Commits 1 Branch 0 Tags
c58ba0cb9f863147ad48ac1ae1d36fb3fc1cef10
Commit Graph
18449 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner e0fc786ecd openssl: Implement HMAC-based IKEv2 PRFs via OpenSSL's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner 0339ce34f6 kdf: Implement wrapper for IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner ad0e94b6ed test-vectors: Add vectors for HMAC-based IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner 37dbc87960 crypto: Add new KDF type for IKEv2 PRFs 2022-04-14 19:02:56 +02:00
Tobias Brunner 7bde56a9bc crypto: Adapt kdf_t interface to support KDFs with fixed output length 2022-04-14 19:02:56 +02:00
Tobias Brunner 96c7692661 wolfssl: Implement prf+ via wolfSSL's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner cb8f924051 botan: Implement prf+ via Botan's HKDF implementation 2022-04-14 19:02:56 +02:00
Tobias Brunner f535f1ed53 crypto: Remove unused prf_plus_t 2022-04-14 19:02:56 +02:00
Tobias Brunner f0957d1250 kdf: Implement prf+ directly without relying on prf_plus_t 2022-04-14 19:02:56 +02:00
Tobias Brunner 9cb3c10418 keymat_v1: Derive CHILD_SA keys without using prf_plus_t 
We already expand skeyid_e in a similar fashion so do this analogous
without relying on prf_plus_t.
 2022-04-14 19:02:56 +02:00
Tobias Brunner be07b9dc01 unit-tests: Use plugin-provided prf+ in unit test 
This tests the params API and the counter overflow.
 2022-04-14 19:02:56 +02:00
Tobias Brunner df16d7902a tls-hkdf: Use plugin-provided prf+ 2022-04-14 19:02:56 +02:00
Tobias Brunner 7161c87617 keymat_v2: Use plugin-provided prf+ to derive keys 2022-04-14 19:02:56 +02:00
Tobias Brunner 08e31138bd appveyor: Enable kdf plugin on old images with OpenSSL 1.0.2/1.1.0 
HKDF with expand-only mode is only available since OpenSSL 1.1.1.
 2022-04-14 19:02:56 +02:00
Tobias Brunner 5cc47c11f2 android: Build and load kdf plugin for prf+ 
Not necessary with newer versions of OpenSSL, but our BoringSSL release
does not support HKDF yet.
 2022-04-14 19:02:56 +02:00
Tobias Brunner 3a52fc83f8 testing: Load kdf plugin in all scenarios that require it 
Once we use plugin-provided prf+() these won't work otherwise.
 2022-04-14 19:02:48 +02:00
Tobias Brunner 742134c112 keymat_v2: Refactor CHILD_SA key derivation so it only needs one prf+ call 2022-04-14 18:54:24 +02:00
Tobias Brunner 00cfc05467 keymat_v2: Refactor IKE key derivation so it only needs one prf+ call 2022-04-14 18:54:24 +02:00
Tobias Brunner 2b9b579af9 openssl: Add a prf+ implementation based on OpenSSL's HKDF implementation 
The HKDF-Expand() function defined in RFC 5869 is basically the same as
IKEv2's prf+(), so we can use the former to implement the latter.
However, we can only support HMAC-based PRFs this way, which should be
fine as others are rarely used.
 2022-04-14 18:54:24 +02:00
Tobias Brunner 9e228de60a kdf: Add plugin that provides a default prf+ implementation 2022-04-14 18:54:24 +02:00
Tobias Brunner ce431366e6 test-vectors: Add test vectors for prf+ 2022-04-14 18:54:24 +02:00
Tobias Brunner 71ba969884 plugin-feature: Add plugin feature for KDFs 2022-04-14 18:54:24 +02:00
Tobias Brunner 961cb781b9 plugin-feature: Remove 'default' case in plugin_feature_un|load() 2022-04-14 18:54:24 +02:00
Tobias Brunner 86d526876d test-vectors: Add support for KDF test vectors 2022-04-14 18:54:24 +02:00
Tobias Brunner 02f7d63e52 crypto-factory: Use actual plugin name when testing during construction 2022-04-14 18:54:24 +02:00
Tobias Brunner 0c6baa8997 crypto-tester: Add facility to test KDFs 2022-04-14 18:54:24 +02:00
Tobias Brunner ec17fa2fef vici: Report registered KDFs 2022-04-14 18:54:24 +02:00
Tobias Brunner 07bf428ad1 stroke: List registered KDFs 2022-04-14 18:54:24 +02:00
Tobias Brunner fbb0bdebe7 crypto-factory: Add constructor and methods to create KDFs 
Using some arguments directly in the constructor will allow us to fall
back on other implementations.
 2022-04-14 18:54:24 +02:00
Tobias Brunner 35ad267fce pkcs5: Rename kdf_t to avoid conflict 2022-04-14 18:54:24 +02:00
Tobias Brunner e93882c6a0 transform: Add private transform for KDFs 2022-04-14 18:54:24 +02:00
Tobias Brunner 40a09613d2 crypto: Add interface for key derivation functions 2022-04-14 18:54:24 +02:00
Tobias Brunner 8b8a2ee43a Merge branch 'labeled-ipsec' 
This adds support for labeled IPsec with SELinux (and a proprietary mode
that can be used to match child configs).  For SELinux support, compile
with --enable-selinux.

Other changes include a combined start action (trap|start), avoiding
initiating duplicate CHILD_SAs, updating reqids if dynamic traffic
selectors change, removing reqid errors on policy updates, or querying
specific CHILD_SAs with vici's list-sas command.

Closes #3075
 2022-04-14 18:52:38 +02:00
Tobias Brunner 6910347d1a testing: Add DSCP scenario that uses simple labels 
Instead of creating two IKE_SAs with different identities, this scenario
uses simple labels to select the correct child config.
 2022-04-14 18:42:01 +02:00
Tobias Brunner 955b526be8 swanctl: Add options to filter CHILD_SAs in --list-sas 2022-04-14 18:42:01 +02:00
Tobias Brunner b1c7fac768 vici: Add options to only return specific CHILD_SAs in list-sas() 2022-04-14 18:42:01 +02:00
Tobias Brunner 994d9d37d4 testing: Copy comments to test log 2022-04-14 18:42:01 +02:00
Tobias Brunner b67f7fb861 swanctl: Report labels in --list-* commands 2022-04-14 18:42:01 +02:00
Tobias Brunner 2994347d18 vici: Report security label on CHILD_SA, policies and configs 2022-04-14 18:42:01 +02:00
Tobias Brunner 7cf6f29ac5 vici: Make security labels and mode configurable 2022-04-14 18:42:01 +02:00
Tobias Brunner f52e565ad3 kernel-netlink: Forward labels from acquires 2022-04-14 18:42:01 +02:00
Tobias Brunner 0a673794d8 trap-manager: Add support to handle acquires with security labels 2022-04-14 18:42:01 +02:00
Tobias Brunner 81c362829e kernel-handler: Log security label received with acquire 2022-04-14 18:42:01 +02:00
Tobias Brunner 52a05d7f6c kernel-interface: Optionally pass security label with an acquire 2022-04-14 18:42:01 +02:00
Tobias Brunner 3f3838d1f9 ike-sa: Accept optional security label when initiating CHILD_SAs 2022-04-14 18:42:01 +02:00
Tobias Brunner 92f54e55e9 child-rekey: Maintain security label during rekeying 2022-04-14 18:42:01 +02:00
Tobias Brunner b00a4e778f selinux: Add plugin to install trap policies with generic labels 
After establishing an IKE_SA, we check if any of its child configs
define generic SELinux labels and install trap policies for them if
necessary narrowed to the current (virtual) IPs.
 2022-04-14 18:42:01 +02:00
Tobias Brunner 065685dde7 ike-sa: Add helper to determine an IKE_SA's dynamic hosts 2022-04-14 18:42:01 +02:00
Tobias Brunner 3c65cf6456 trap-manager: Add facility to install externally managed trap policies 
This allows managing trap policies outside of the trap manager.

We'll use this to create trap policies with generic labels if trap policies
can't (or won't) be used (e.g. as responder for roadwarriors).
 2022-04-14 18:42:01 +02:00
Tobias Brunner 8f4cfe9669 child-sa: Allocate a new reqid if dynamic traffic selectors are updated 
If update_sa() is called and dynamic traffic selectors are changed using
new addresses, this might cause issues if we continue to use a reqid that
doesn't match the updated traffic selectors.  For instance, if the initiator
then uses make-before-break reauth from the new IP.  It's also a particular
problem in the SELinux case where multiple CHILD_SAs with specific labels
all share the same (trap) policy with generic label.  However, SAs created
after the update would not match due to the new reqid.
 2022-04-14 18:42:01 +02:00