Tobias Brunner
2283a19b80
kdf: Fix Doxygen comments
2022-04-22 09:49:37 +02:00
Tobias Brunner
c508b904b8
openssl: Fix typo in comment
2022-04-21 11:06:30 +02:00
Tobias Brunner
76ff49b761
unit-tests: Add environment variable to skip IPv6 stream tests
...
This is an issue e.g. when running tests in default Docker containers.
2022-04-14 19:05:45 +02:00
Tobias Brunner
7d99b29b99
unit-tests: Add support for more than one warning per test case
...
Warnings are usually short (as compared to failures that contain data
dumps), so the buffer size can be reduced.
2022-04-14 19:05:44 +02:00
Tobias Brunner
a8bab0ee15
openssl: Move ENGINE-specific code into a separate file
...
This way we can compile it with OPENSSL_SUPPRESS_DEPRECATED for
OpenSSL 3.0, which deprecated the ENGINE API.
2022-04-14 19:05:44 +02:00
Tobias Brunner
f26639de2c
openssl: Remove checks and legacy compatibility code for OpenSSL < 1.0.2
...
More of this code was already removed with previous commits.
While versions < 1.1.1 are not officially supported anymore, 1.0.2 might
still be in use because before 3.x that was the latest version with
official FIPS support (OpenSSL apparently also provides extended commercial
support for it).
2022-04-14 19:05:44 +02:00
Tobias Brunner
db0c53c207
openssl: Fixes for HMAC with OpenSSL 3.0
2022-04-14 19:05:44 +02:00
Tobias Brunner
293a912c7d
openssl: Fixes for ECDSA with OpenSSL 3.0
2022-04-14 19:05:44 +02:00
Tobias Brunner
544fb1cf92
pkcs8: Parse the decrypted PKCS#8 structure via regular builders
...
This allows other plugins to parse such structures directly. The pkcs8
plugin is called recursively again if necessary.
2022-04-14 19:05:44 +02:00
Tobias Brunner
21b586c61c
openssl: Fixes for RSA with OpenSSL 3.0
2022-04-14 19:05:44 +02:00
Tobias Brunner
36cf74f5d9
openssl: Fixes for DH with OpenSSL 3.0
...
While we could assign the DH object to a EVP_PKEY object, this won't work
with BoringSSL as it doesn't seem to support EVP_PKEY_derive() for DH.
2022-04-14 19:05:44 +02:00
Tobias Brunner
f5710c9ccb
openssl: Fixes for ECDH with OpenSSL 3.0
...
Uses new and non-deprecated APIs to create/generate key pairs.
2022-04-14 19:05:44 +02:00
Tobias Brunner
13efce489e
openssl: PRF_KEYED_SHA1 might not be supported
...
The old API has been deprecated with OpenSSL 3 and direct access to the
state isn't possible via EVP API. In the future we might just remove this
implementation but we'd probably have to implement EAP-AKA' first, which
uses HMAC-SHA-256 with IKEv2's prf+ construct to derive keys instead
of this weird construct (plus what fips-prf builds around it) that's used
by EAP-AKA.
2022-04-14 19:05:44 +02:00
Tobias Brunner
519bc22091
leak-detective: Whitelist OpenSSL 3.0 functions
2022-04-14 19:05:44 +02:00
Tobias Brunner
1c1213f4b6
openssl: Move shared secret calculation to get_shared_secret()
...
This is a change from the multi-KE branch.
2022-04-14 19:05:44 +02:00
Tobias Brunner
56afc6e298
wolfssl: Implement HMAC-based IKEv2 PRFs via wolfSSL's HKDF implementation
2022-04-14 19:02:56 +02:00
Tobias Brunner
7498769aba
botan: Implement HMAC-based IKEv2 PRFs via Botan's HKDF implementation
2022-04-14 19:02:56 +02:00
Tobias Brunner
e0fc786ecd
openssl: Implement HMAC-based IKEv2 PRFs via OpenSSL's HKDF implementation
2022-04-14 19:02:56 +02:00
Tobias Brunner
0339ce34f6
kdf: Implement wrapper for IKEv2 PRFs
2022-04-14 19:02:56 +02:00
Tobias Brunner
ad0e94b6ed
test-vectors: Add vectors for HMAC-based IKEv2 PRFs
2022-04-14 19:02:56 +02:00
Tobias Brunner
37dbc87960
crypto: Add new KDF type for IKEv2 PRFs
2022-04-14 19:02:56 +02:00
Tobias Brunner
7bde56a9bc
crypto: Adapt kdf_t interface to support KDFs with fixed output length
2022-04-14 19:02:56 +02:00
Tobias Brunner
96c7692661
wolfssl: Implement prf+ via wolfSSL's HKDF implementation
2022-04-14 19:02:56 +02:00
Tobias Brunner
cb8f924051
botan: Implement prf+ via Botan's HKDF implementation
2022-04-14 19:02:56 +02:00
Tobias Brunner
f535f1ed53
crypto: Remove unused prf_plus_t
2022-04-14 19:02:56 +02:00
Tobias Brunner
f0957d1250
kdf: Implement prf+ directly without relying on prf_plus_t
2022-04-14 19:02:56 +02:00
Tobias Brunner
be07b9dc01
unit-tests: Use plugin-provided prf+ in unit test
...
This tests the params API and the counter overflow.
2022-04-14 19:02:56 +02:00
Tobias Brunner
2b9b579af9
openssl: Add a prf+ implementation based on OpenSSL's HKDF implementation
...
The HKDF-Expand() function defined in RFC 5869 is basically the same as
IKEv2's prf+(), so we can use the former to implement the latter.
However, we can only support HMAC-based PRFs this way, which should be
fine as others are rarely used.
2022-04-14 18:54:24 +02:00
Tobias Brunner
9e228de60a
kdf: Add plugin that provides a default prf+ implementation
2022-04-14 18:54:24 +02:00
Tobias Brunner
ce431366e6
test-vectors: Add test vectors for prf+
2022-04-14 18:54:24 +02:00
Tobias Brunner
71ba969884
plugin-feature: Add plugin feature for KDFs
2022-04-14 18:54:24 +02:00
Tobias Brunner
961cb781b9
plugin-feature: Remove 'default' case in plugin_feature_un|load()
2022-04-14 18:54:24 +02:00
Tobias Brunner
86d526876d
test-vectors: Add support for KDF test vectors
2022-04-14 18:54:24 +02:00
Tobias Brunner
02f7d63e52
crypto-factory: Use actual plugin name when testing during construction
2022-04-14 18:54:24 +02:00
Tobias Brunner
0c6baa8997
crypto-tester: Add facility to test KDFs
2022-04-14 18:54:24 +02:00
Tobias Brunner
fbb0bdebe7
crypto-factory: Add constructor and methods to create KDFs
...
Using some arguments directly in the constructor will allow us to fall
back on other implementations.
2022-04-14 18:54:24 +02:00
Tobias Brunner
35ad267fce
pkcs5: Rename kdf_t to avoid conflict
2022-04-14 18:54:24 +02:00
Tobias Brunner
e93882c6a0
transform: Add private transform for KDFs
2022-04-14 18:54:24 +02:00
Tobias Brunner
40a09613d2
crypto: Add interface for key derivation functions
2022-04-14 18:54:24 +02:00
Tobias Brunner
d71d181d28
traffic-selector: Add TS_SECLABEL type
2022-04-14 18:42:01 +02:00
Tobias Brunner
ebb99484e3
leak-detective: Whitelist selinux_check_access()
2022-04-14 18:42:01 +02:00
Tobias Brunner
2dd60e4946
sec-label: Add enum for security label mode
2022-04-14 18:42:01 +02:00
Tobias Brunner
decfe44433
sec-label: Add class to represent security labels
...
In accordance with SELinux, we include the null-terminator in the encoding
for now.
2022-04-14 18:42:01 +02:00
Tobias Brunner
fe5f27336d
configure: Add option to link against libselinux
2022-04-14 18:42:01 +02:00
Tobias Brunner
7137fd96c2
enum: Add helper to parse enum flags from strings
...
Individual flag names are separated by |.
2022-04-14 18:42:01 +02:00
Tobias Brunner
927103ece4
enum: Allow specifying the name used when none of the flags are set
2022-04-14 18:42:01 +02:00
Tobias Brunner
3c028686de
traffic-selector: Avoid out-of-bound array access when calculating range
...
This happens for `/0` subnet masks. In practice, it's not an issue because
if `bytes` is 0, then so are `netbits`, `bits` and `mask`. So the two
incorrectly addressed array elements are not actually modified. The first
operation is a `&= 0xff` and the second a `|= 0`, so nothing changes.
But some tools might not consider the values and report this as undefined
behavior, which it technically is.
2022-03-16 11:54:34 +01:00
Tobias Brunner
3eecd40cec
openssl: Don't unload providers
...
There is a conflict between atexit() handlers registered by OpenSSL and
some executables (e.g. swanctl or pki) to deinitialize libstrongswan.
Because plugins are usually loaded after atexit() has been called, the
handler registered by OpenSSL will run before our handler. So when the
latter destroys the plugins it's a bad idea to try to access any OpenSSL
objects as they might already be invalid.
Fixes: f556fce16bCloses strongswan/strongswan#921
2022-02-24 15:03:09 +01:00
Tobias Brunner
9e3978259e
mgf1: Fix Doxygen group for XOF implementation
2022-02-17 16:34:56 +01:00
Tobias Brunner
963adc7637
xof: Fix typo in documentation for set_seed()
2022-02-17 16:34:56 +01:00
Tobias Brunner