Tobias Brunner [Tue, 15 Jun 2021 09:11:14 +0000 (11:11 +0200)]
wip: child-sa: Configure UDP encapsulation for per-CPU SAs
wip: this is just a PoC. it needs some kind of notify to negotiate
the use (in theory it doesn't as IPsec stacks should be able to process
UDP encaped and plain ESPs for the same SA, the kernel doesn't so both
peers need to enable it - otherwise we could just enable it on the
outbound SA and send to port 4500)
To avoid lots of NAT mapping events from the kernel it needs a patch so it
doesn't produce any if the configured source port is 0
Tobias Brunner [Thu, 20 May 2021 08:12:30 +0000 (10:12 +0200)]
wip: vici: Make per-CPU CHILD_SAs configurable
wip: also, maybe add a check to ensure that start_action=trap is set (or even
set it implicitly?), but could also just be the responsibility of the
user as it's documented
Tobias Brunner [Thu, 20 May 2021 07:46:55 +0000 (09:46 +0200)]
wip: trap-manager: Add support to handle acquires for per-CPU SAs
wip: we could possibly install trap policies with num_sas set to install
per-CPU trap policies right from the start. then the first acquire would
already get us a CPU ID. however, since we don't now if the peer supports
the extension, the CPU ID might get reset and a regular SA negotiated,
rendering the match for CPU ID invalid (we could then perhaps just remove
the first acquire with has acquire->cpu != CPU_ID_MAX and stop enumerating).
the policy installed with the regular SA should hopefully prevent further
CPU-specific acquires (at least if there was no narrowing)
Tobias Brunner [Thu, 20 May 2021 07:41:54 +0000 (09:41 +0200)]
ike-sa: Sort CHILD_SAs by CPU ID
This might make debugging easier and also ensures that a possible
fallback SA without CPU ID is established first when reestablishing
an IKE_SA. Because even if such an SA is established first, that might
change if per-CPU SAs are rekeyed first.
Tobias Brunner [Mon, 31 May 2021 13:21:46 +0000 (15:21 +0200)]
forecast: Ignore per-CPU CHILD_SAs
Not sure if this combination does make sense as the plugin itself would
be a major bottleneck.
Similar to the connmark plugin, PREROUTING rules list SPIs or UDP ports,
which would be necessary for all SAs while the OUTPUT rules would only be
required once.
Tobias Brunner [Mon, 31 May 2021 13:06:41 +0000 (15:06 +0200)]
connmark: Ignore per-CPU CHILD_SAs
The combination probably doesn't make much sense.
The OUTPUT rules would definitely only be required once, while the INPUT
and PREROUTING rules list individual SPIs and/or UDP ports, which would
be necessary for all SAs.
By the way, the rules in PREROUTING might actually not be necessary
anymore if the set_mark_in option was used for such SAs.
We explicitly pass the final .info file prepared with lcov, so there is
no need to search for other files (that then won't work anyway). The
search also finds the uncleaned .info file, which includes the test code.
The latter should have gotten ignored anyway, but the patterns are
apparently not correct anymore. So fixing that as well just to be sure.
wolfssl: Avoid conflict with RNG when built without EdDSA or FIPS enabled
There are definitions of RNG in <wolfssl/wolfcrypt/settings.h> and
<wolfssl/wolfcrypt/random.h> that play havoc with the literal RNG being
used in the expansions of PLUGIN_*(RNG, ...) when ##-concatenated to
build the enum value FEATURE_RNG.
The #undef in wolfssl_cmmon.h only had an effect if wolfSSL was built
with EdDSA or FIPS enabled, otherwise, the headers that define RNG were
not pulled in before it.
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Tobias Brunner [Thu, 28 Mar 2024 10:51:15 +0000 (11:51 +0100)]
sha3: Fix Keccak when compiled with GCC 13.x
With GCC 13, the compiler apparently applies new aliasing optimizations
when compiled with -O2 and without -fno-strict-aliasing. This caused
the application of the second padding bit, where the state was accessed
via uint8_t[], to be moved before the loop that absorbs the buffer into
the state, where the state is accessed via uint64_t[], resulting in
incorrect output. By only accessing the state via uint64_t[] here the
compiler won't reorder the instructions.
Tobias Brunner [Fri, 22 Mar 2024 08:57:07 +0000 (09:57 +0100)]
pf-handler: Fix build with musl C library
musl's headers define a lot of networking structs. For some, the
definition in the Linux UAPI headers is then suppressed by e.g.
__UAPI_DEF_ETHHDR.
Since we included musl's net/ethernet.h, which includes netinet/if_ether.h
that defines `struct ethhdr` (and the above constant), **after** we
include linux/if_ether.h, there was a compilation error because the
struct was defined multiple times.
However, simply moving that include doesn't fix the problem because for
ARP-specific structs the Linux headers don't provide __UAPI_DEF* checks.
So instead of directly including the linux/ headers, we include those
provided by the C library. For glibc these usually just include the
Linux headers, but for musl this allows them to define the struct
directly. We also need to move if.h and add packet.h, which define
other structs (or include headers that do so) that we use.
Fixes: 187c72d1afdc ("dhcp: Port the plugin to FreeBSD/macOS")
Tobias Brunner [Fri, 15 Mar 2024 13:40:30 +0000 (14:40 +0100)]
ike-cfg: Change how OCSP certificate requests are enabled
The previous option caused such requests to be enabled if not explicitly
disabled, which only the vici plugin did, for all other backends requests
would have been sent.
Tobias Brunner [Thu, 14 Mar 2024 12:51:06 +0000 (13:51 +0100)]
smp: Make code that encodes identities more readable
In particular for static code analyzers. The previous nesting of case
statements inside of a while loop that's inside a switch statement and
a wrapping block with declaration was quite weird and Coverity didn't
like it (it figured that `type` was uninitialized even when it assumed
that get_type() returned a known type for which a case statement
existed).
Tobias Brunner [Wed, 13 Mar 2024 14:34:48 +0000 (15:34 +0100)]
unit-tests: Point out if ECDSA public key was rejected after private keys was not
AWS-LC rejects public keys with explicitly encoded parameters but allows
private keys that use explicit encodings of the NIST curves. Since the
more important aspect is that public keys are rejected, this addition to
the warning message points that out.
Tobias Brunner [Fri, 23 Feb 2024 16:44:44 +0000 (17:44 +0100)]
constraints: Properly validate name constraints according to RFC 5280
The previous code was in a way too simple which resulted in it being too
strict. For instance, it enforced that intermediate CA certificates
inherited the name constraints of their parents. That's not required by
RFC 5280 and prevented e.g. adding constraints in an intermediate CA
certificate that's followed by another that doesn't contain any
name constraints. That's perfectly fine as the set of constraints
specified by the parent continue to apply to that CA certificate and
the children it issues.
Name constraints were previously also applied to all identities of a
matching type, which is way too strict except for some very simple
cases. It basically prevented multiple constraints of the same type
as e.g. an intermediate CA certificate that has permitted name constraints
for example.org and example.com couldn't issue acceptable certificates
because any SAN with one domain would get rejected by the other
constraint. According to RFC 5280 matching one constraint is enough.
Also fixed is an issue with name constraints for IP addresses which were
previously only supported for a single level.
Gerardo Ravago [Thu, 22 Feb 2024 18:47:58 +0000 (13:47 -0500)]
github: Add AWS-LC CI job
AWS-LC is an OpenSSL derivative which can be used with the openssl plugin.
This adds a CI job that resembles the openssl-3 test case. It downloads
the source tarball for an AWS-LC release, builds that source using
CMake/Ninja, and then builds/tests strongSwan using the same technique
used by openssl-3.
Etay Bogner [Wed, 6 Mar 2024 22:40:51 +0000 (00:40 +0200)]
starter: Use correct type for uniqueids field
Enum arguments (ARG_ENUM with .list != LST_bool) are assumed to be of
type/size int in assign_args() in args.c.
Fixes: 0644ebd3de62 ("implemented IKE_SA uniqueness using ipsec.conf uniqueids paramater additionally supports a "keep" value to keep the old IKE_SA")
Closes strongswan/strongswan#2148
Gerardo Ravago [Wed, 6 Mar 2024 15:45:00 +0000 (10:45 -0500)]
leak-detective: Add whitelist entries for AWS-LC
AWS-LC (and likely BoringSSL) uses thread specific data to store internal
library state which gets freed via a registered destructor when the thread
terminates. If this thread happens to be the main thread, which runs the
leak-detective evaluation, the detective won't observe the corresponding free
of the related memory and erroneously reports it as a leak.
The two places this happens are:
- `RAND_bytes` for storing internal RNG state.
- `ERR_put_error` for storing the per-thread OpenSSL error queue.
Gerardo Ravago [Mon, 4 Mar 2024 15:25:12 +0000 (10:25 -0500)]
openssl: Handle BoringSSL-style ASN1_INTEGERs in cert serials
OpenSSL stores the serial number for an X509 certificate as an
`ASN1_INTEGER` type. Within BoringSSL (and AWS-LC), the library
represents the value of zero as an empty array [1] which is different
from OpenSSL which represents it as the 1-byte array [0x00]. Though the
value of zero for the certificate serial number is illegal under
X.509 [2], we need to handle/encode it consistently within strongSwan.
From 18082ce2b061 ("certificates: Retrieve serial numbers in canonical
form"), we infer that the canonical representation of the zero serial
is [0x00]. To do this, we introduce `openssl_asn1_int2chunk` to
complement the existing string version that allows us to handle the
special case for zero instead of always returning a reference to the
library-dependent encodings.
Since ESN was negotiated via proposal, just configuring the SA without
ESN won't work as the ICV will be incorrect if the peer enabled ESN
on its SA. While the Linux kernel currently doesn't support disabling
replay protection for SAs that use ESN, this at least gets users an
explicit error not just dropped packets, and it will automatically work
if the kernel supports this combination at some point.