Andreas Steffen [Sun, 4 Apr 2021 08:45:46 +0000 (10:45 +0200)]
testing: Reorganizing IKEv1 and IKEv2 examples
For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.
For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
Tobias Brunner [Mon, 10 May 2021 12:55:45 +0000 (14:55 +0200)]
Don't report current text in parser error messages
The values of `yytext` and `yyleng` might not be properly defined when
the error function is called (in particular if the lexer reached EOF).
While this might just cause non-printable characters in the output, it
could actually lead to a crash depending on where `yytext` points.
Tobias Brunner [Tue, 4 May 2021 13:40:45 +0000 (15:40 +0200)]
testing: Use host-passthrough CPU mode for all KVM guests
This should give us the best performance and feature set on modern
hardware (in particular when compared to code2duo, which e.g. does not allow
nested virtualization).
Tobias Brunner [Tue, 4 May 2021 16:19:57 +0000 (18:19 +0200)]
openssl: Add support for AES in CCM mode
While CCM is available in earlier versions, we only use it with
OpenSSL 1.1.0 and newer because the generic control variables are not
available before and we default to GCM for them.
Tobias Brunner [Wed, 5 May 2021 16:46:49 +0000 (18:46 +0200)]
github: Fix python build and checks on older Ubuntu releases
On 18.04, setuptools was apparently pulled in by python-pip but is not
by python3-pip and on Ubuntu 16.04 there is an issue with tox when
installed via pip3 (syntax error in one of the dependencies) and with
pip that dependency is not even available.
Tobias Brunner [Wed, 5 May 2021 16:56:58 +0000 (18:56 +0200)]
github: Don't fail LGTM test with an error if variables are missing
That's because forks are currently not allowed to be analyzed by LGTM (unlike
with SonarCloud) so this check can't actually be successful for forks even if
variables are defined.
Andreas Steffen [Tue, 23 Mar 2021 09:49:32 +0000 (10:49 +0100)]
testing: Switched PTS measurements to /usr/sbin
Due to Debian 10 linking /bin to /usr/bin which drastically
increased the number of files in /bin, the PTS measurement
was switched to /usr/sbin with a lesser number of files.
Michał Skalski [Mon, 22 Feb 2021 15:41:23 +0000 (16:41 +0100)]
save-keys: Add support for full-length HMAC-SHA256 for ESP
Wireshark doesn't really support it, but this way it at least decodes
the ESP packets correctly and the encryption keys are saved and the
packets can be decrypted. The full-length versions of SHA-384 and
SHA-512 are not supported by Wireshark as 256-bit is the longest ICV
it is able to decode currently.
Tobias Brunner [Thu, 18 Feb 2021 14:10:42 +0000 (15:10 +0100)]
tls-server: Add flag that makes client authentication optional
This allows clients to send an empty certificate payload if the server
sent a certificate request. If an identity was set previously, it will
be reset so get_peer_id() may be used to check if the client was
authenticated.
Tobias Brunner [Thu, 18 Feb 2021 11:34:29 +0000 (12:34 +0100)]
pt-tls-server: Explicitly request client authentication if necessary
The PT_TLS_AUTH_TLS_OR_SASL case currently can't be implemented properly
as TLS authentication will be enforced if a client identity is configured
on the TLS server socket.
Tobias Brunner [Thu, 18 Feb 2021 11:31:17 +0000 (12:31 +0100)]
tls-server: Use subject DN as peer identity if it was ID_ANY
To request client authentication if we don't know the client's identity,
it's possible to use ID_ANY. However, if we don't change the identity
get_peer_id() would still report ID_ANY after the authentication.
Fedor Korotkov [Mon, 15 Feb 2021 18:58:55 +0000 (13:58 -0500)]
cirrus: Use FreeBSD 12.2
This seems to fix the build with Autotools that recently started to fail
with:
autom4te-2.69: need GNU m4 1.4 or later: /usr/local/bin/gm4
aclocal: error: /usr/local/bin/autom4te-2.69 failed with exit status: 1
autoreconf-2.69: aclocal failed with exit status: 1
Tobias Brunner [Fri, 15 Jan 2021 15:19:49 +0000 (16:19 +0100)]
ike-sa: Avoid possible integer underflow when scheduling reauth after rekeying
If the reauthentication is scheduled while rekeying, the difference
might be negative, however, schedule_job() takes an unsigned int,
so the reauth would get scheduled very far in the future.
Tobias Brunner [Fri, 15 Jan 2021 15:25:54 +0000 (16:25 +0100)]
ike-rekey: Register new IKE_SA before calling inherit_post()
If rekeying and reauthetication coincided, the reauth job could get
scheduled to run immediately i.e. before checkin() was called. So the
new IKE_SA would not get reauthenticated, however, the further delayed
delete job would later find the new IKE_SA and delete it.
Tobias Brunner [Fri, 15 Jan 2021 15:09:59 +0000 (16:09 +0100)]
ike-sa-manager: Add a method to register/check out new IKE_SAs
This way, jobs for new IKE_SAs (created via create_new()) may be
scheduled/queued before checkin() is called. If they run before
that happens, they will now correctly block in checkout() instead of
doing nothing because the IKE_SA was not found.
Tobias Brunner [Fri, 15 Jan 2021 15:08:20 +0000 (16:08 +0100)]
ike-sa-manager: Rename checkout_new() to create_new()
We don't actually check that SA out (i.e. it's not registered with the
manager). That was originally different but had to be changed with 86993d6b9037 to avoid that SAs created for rekeying don't block other
threads on the manager.
Tobias Brunner [Tue, 17 Mar 2020 08:39:17 +0000 (09:39 +0100)]
ike-sa-manager: Make checkout_by_config() atomic
These changes should ensure that concurrent calls to checkout_by_config()
result in a single IKE_SA. For instance, when acquires for different
children of the same connection are triggered concurrently.
There are two major changes to the interface:
1) The peer config object is now always set on the returned IKE_SA.
That was previously only the case if an existing IKE_SA was
returned.
2) The IKE_SA is now always registered with the manager and properly
checked out, which also was only the case for existing IKE_SAs
before.
Tobias Brunner [Fri, 12 Feb 2021 14:14:37 +0000 (15:14 +0100)]
Merge branch 'tls13'
This adds support for TLS 1.3 to libtls and adds several new features to
existing TLS versions (e.g. support for x25519/x448, EdDSA or RSA-PSS).
Unfortunately, TLS 1.3 is not really usable for TLS-based EAP methods in
practice because, in particular, key derivation is not yet standardized.
While it works between two strongSwan instances and even FreeRADIUS 3.0.21,
there will be compatibility issues in the future when implementations move
to a standardized scheme. There are currently two Internet-Drafts in
development to specify that (see 121ac4b9e37e for details). Until they are
more stable, the default maximum version is set to 1.2.
The default minimum version has also been increased to 1.2 and several
older/weaker cipher suites have been removed (e.g. with 3DES and MD5).
Tobias Brunner [Thu, 11 Feb 2021 16:46:17 +0000 (17:46 +0100)]
tls-crypto: Fallback to any supported ECDH group
If the default group listed in the cipher suite is not supported, we try
to use any other supported group (the groups are negotiated separately
so we are not locked in to a specific group).
Tobias Brunner [Thu, 11 Feb 2021 16:09:04 +0000 (17:09 +0100)]
tls-crypto: Don't filter suites with specific ECDH group if any is available
Since DH groups (or with TLS < 1.3 curves) are negotiated separately,
it doesn't matter which one is listed in the cipher suite as any one could
be used.
Tobias Brunner [Fri, 22 Jan 2021 09:06:05 +0000 (10:06 +0100)]
tls-server: Select cipher suite also when handling HelloRetryRequest
This was previously treated like a resumption, which it is clearly not.
Also added a check that verifies that the same cipher suite is selected
during the retry, as per RFC 8446, section 4.1.4.
Shmulik Ladkani [Fri, 15 Jan 2021 13:45:34 +0000 (14:45 +0100)]
tls-server: Optionally omit CAs in CertificateRequest messages
Usually, the DNs of all loaded CA certificates are included in the
CertificateRequest messages sent by the server.
Alas, certain EAP-TLS clients fail to process this message if the
list is too long, returning the fatal TLS alert 'illegal parameter'.
This new option allows configuring whether CAs are included or an
empty list is sent (TLS 1.2), or the certificate_authorities extension
is omitted (TLS 1.3). The list only serves as hint/constraint
for clients during certificate selection, they still have to provide
a certificate but are free to select any one they have available.
Tobias Brunner [Thu, 14 Jan 2021 17:02:00 +0000 (18:02 +0100)]
tls-eap: Conclude EAP method also after processing packets
With TLS 1.3, the server sends its Finished message first, so the
session is complete after processing the client's Finished message,
without having to send anything else (in particular no acknowledgement
as the last message from the client is no fragment).