src/patches/strongswan-5.1.2-5.2.1_modp_custom.patch

   1 From a78ecdd47509626711a13481f53696e01d4b8c62 Mon Sep 17 00:00:00 2001
   2 From: Tobias Brunner <tobias@strongswan.org>
   3 Date: Mon, 1 Dec 2014 17:21:59 +0100
   4 Subject: [PATCH] crypto: Define MODP_CUSTOM outside of IKE DH range
   5
   6 Before this fix it was possible to crash charon with an IKE_SA_INIT
   7 message containing a KE payload with DH group MODP_CUSTOM(1025).
   8 Defining MODP_CUSTOM outside of the two byte IKE DH identifier range
   9 prevents it from getting negotiated.
  10
  11 Fixes CVE-2014-9221 in version 5.1.2 and newer.
  12 ---
  13  src/charon-tkm/src/tkm/tkm_diffie_hellman.c                   |  2 +-
  14  src/libstrongswan/crypto/diffie_hellman.c                     | 11 ++++++-----
  15  src/libstrongswan/crypto/diffie_hellman.h                     |  6 ++++--
  16  src/libstrongswan/plugins/gcrypt/gcrypt_dh.c                  |  2 +-
  17  src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c            |  2 +-
  18  src/libstrongswan/plugins/ntru/ntru_ke.c                      |  2 +-
  19  src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c    |  2 +-
  20  src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c |  2 +-
  21  src/libstrongswan/plugins/pkcs11/pkcs11_dh.c                  |  2 +-
  22  9 files changed, 17 insertions(+), 14 deletions(-)
  23
  24 diff --git a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
  25 index 67db5e6d87d6..836e0b7f088d 100644
  26 --- a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
  27 +++ b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
  28 @@ -41,7 +41,7 @@ struct private_tkm_diffie_hellman_t {
  29         /**
  30          * Diffie Hellman group number.
  31          */
  32 -       u_int16_t group;
  33 +       diffie_hellman_group_t group;
  34
  35         /**
  36          * Diffie Hellman public value.
  37 diff --git a/src/libstrongswan/crypto/diffie_hellman.c b/src/libstrongswan/crypto/diffie_hellman.c
  38 index bada1c529951..ac106e9c4d45 100644
  39 --- a/src/libstrongswan/crypto/diffie_hellman.c
  40 +++ b/src/libstrongswan/crypto/diffie_hellman.c
  41 @@ -42,15 +42,16 @@ ENUM_NEXT(diffie_hellman_group_names, MODP_1024_160, ECP_512_BP, ECP_521_BIT,
  42         "ECP_256_BP",
  43         "ECP_384_BP",
  44         "ECP_512_BP");
  45 -ENUM_NEXT(diffie_hellman_group_names, MODP_NULL, MODP_CUSTOM, ECP_512_BP,
  46 -       "MODP_NULL",
  47 -       "MODP_CUSTOM");
  48 -ENUM_NEXT(diffie_hellman_group_names, NTRU_112_BIT, NTRU_256_BIT, MODP_CUSTOM,
  49 +ENUM_NEXT(diffie_hellman_group_names, MODP_NULL, MODP_NULL, ECP_512_BP,
  50 +       "MODP_NULL");
  51 +ENUM_NEXT(diffie_hellman_group_names, NTRU_112_BIT, NTRU_256_BIT, MODP_NULL,
  52         "NTRU_112",
  53         "NTRU_128",
  54         "NTRU_192",
  55         "NTRU_256");
  56 -ENUM_END(diffie_hellman_group_names, NTRU_256_BIT);
  57 +ENUM_NEXT(diffie_hellman_group_names, MODP_CUSTOM, MODP_CUSTOM, NTRU_256_BIT,
  58 +       "MODP_CUSTOM");
  59 +ENUM_END(diffie_hellman_group_names, MODP_CUSTOM);
  60
  61
  62  /**
  63 diff --git a/src/libstrongswan/crypto/diffie_hellman.h b/src/libstrongswan/crypto/diffie_hellman.h
  64 index 105db22f14d4..d5161d077bb2 100644
  65 --- a/src/libstrongswan/crypto/diffie_hellman.h
  66 +++ b/src/libstrongswan/crypto/diffie_hellman.h
  67 @@ -63,12 +63,14 @@ enum diffie_hellman_group_t {
  68         /** insecure NULL diffie hellman group for testing, in PRIVATE USE */
  69         MODP_NULL = 1024,
  70         /** MODP group with custom generator/prime */
  71 -       MODP_CUSTOM = 1025,
  72         /** Parameters defined by IEEE 1363.1, in PRIVATE USE */
  73         NTRU_112_BIT = 1030,
  74         NTRU_128_BIT = 1031,
  75         NTRU_192_BIT = 1032,
  76 -       NTRU_256_BIT = 1033
  77 +       NTRU_256_BIT = 1033,
  78 +       /** internally used DH group with additional parameters g and p, outside
  79 +        * of PRIVATE USE (i.e. IKEv2 DH group range) so it can't be negotiated */
  80 +       MODP_CUSTOM = 65536,
  81  };
  82
  83  /**
  84 diff --git a/src/libstrongswan/plugins/gcrypt/gcrypt_dh.c b/src/libstrongswan/plugins/gcrypt/gcrypt_dh.c
  85 index f418b941db86..299865da2e09 100644
  86 --- a/src/libstrongswan/plugins/gcrypt/gcrypt_dh.c
  87 +++ b/src/libstrongswan/plugins/gcrypt/gcrypt_dh.c
  88 @@ -35,7 +35,7 @@ struct private_gcrypt_dh_t {
  89         /**
  90          * Diffie Hellman group number
  91          */
  92 -       u_int16_t group;
  93 +       diffie_hellman_group_t group;
  94
  95         /*
  96          * Generator value
  97 diff --git a/src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c b/src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c
  98 index b74d35169f44..9936f7e4518f 100644
  99 --- a/src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c
 100 +++ b/src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c
 101 @@ -42,7 +42,7 @@ struct private_gmp_diffie_hellman_t {
 102         /**
 103          * Diffie Hellman group number.
 104          */
 105 -       u_int16_t group;
 106 +       diffie_hellman_group_t group;
 107
 108         /*
 109          * Generator value.
 110 diff --git a/src/libstrongswan/plugins/ntru/ntru_ke.c b/src/libstrongswan/plugins/ntru/ntru_ke.c
 111 index abaa22336221..e64f32b91d0e 100644
 112 --- a/src/libstrongswan/plugins/ntru/ntru_ke.c
 113 +++ b/src/libstrongswan/plugins/ntru/ntru_ke.c
 114 @@ -56,7 +56,7 @@ struct private_ntru_ke_t {
 115         /**
 116          * Diffie Hellman group number.
 117          */
 118 -       u_int16_t group;
 119 +       diffie_hellman_group_t group;
 120
 121         /**
 122          * NTRU Parameter Set
 123 diff --git a/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c b/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c
 124 index ff3382473666..1e68ac59b838 100644
 125 --- a/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c
 126 +++ b/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c
 127 @@ -38,7 +38,7 @@ struct private_openssl_diffie_hellman_t {
 128         /**
 129          * Diffie Hellman group number.
 130          */
 131 -       u_int16_t group;
 132 +       diffie_hellman_group_t group;
 133
 134         /**
 135          * Diffie Hellman object
 136 diff --git a/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c b/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c
 137 index b487d59a59a3..50853d6f0bde 100644
 138 --- a/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c
 139 +++ b/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c
 140 @@ -40,7 +40,7 @@ struct private_openssl_ec_diffie_hellman_t {
 141         /**
 142          * Diffie Hellman group number.
 143          */
 144 -       u_int16_t group;
 145 +       diffie_hellman_group_t group;
 146
 147         /**
 148          * EC private (public) key
 149 diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
 150 index 36cc284bf2b5..23b63d2386af 100644
 151 --- a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
 152 +++ b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
 153 @@ -47,7 +47,7 @@ struct private_pkcs11_dh_t {
 154         /**
 155          * Diffie Hellman group number.
 156          */
 157 -       u_int16_t group;
 158 +       diffie_hellman_group_t group;
 159
 160         /**
 161          * Handle for own private value
 162 --
 163 1.9.1
 164