Compare commits
No commits in common. 'c9' and 'cs10' have entirely different histories.
@ -1,4 +1,4 @@
|
||||
SOURCES/ikev1_dsa.fax.bz2
|
||||
SOURCES/ikev1_psk.fax.bz2
|
||||
SOURCES/ikev2.fax.bz2
|
||||
SOURCES/libreswan-4.12.tar.gz
|
||||
SOURCES/libreswan-5.1.tar.gz
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
|
||||
861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
|
||||
fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
|
||||
786c14a4755311ea3103683a3294e1536b1e44a6 SOURCES/libreswan-4.12.tar.gz
|
||||
12d2ddd7cad4aab849456e2175378f034eab27bb SOURCES/libreswan-5.1.tar.gz
|
||||
|
||||
@ -0,0 +1,51 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
mQINBFDjilcBEAChkfasfBKTzGys9DwgBsmDVsPConW60uyKnu16+wO1kIKMFWi6
|
||||
wGllwKUJmCBY2FSQHbOBy5eHPPT1ijJhYt4j7WU+YJVh5Ca5RE3trFt31FX0vzp+
|
||||
KMqdQ8HOofA7jO6bgyHUwOJ539YkqYj1jHKfrdRqOnzB9fFyEb7485sq1F8j/rHk
|
||||
cSar1Hd9QfGAZHxXqgncgHFobB/xXEGRJIi+4kNL5SYasbw9tfYUGPrUXVol1+pn
|
||||
tsG92736O5Qe5K+wH2nAS4hwPJ1Xr4XIKeNNwxQW25wWqn4mLa4Vly+PA2uSE7ZP
|
||||
RcxE3yBCaLFMlw4rLhFAzd6TeslQONZ+9K51yfBYm7m0vWM3Ixq8yuD8E49OkKr8
|
||||
QRMaA2g89NW3AuNLExiTE0zQzAs/g6eX8WZdeWCvKxhRTAUYkw0QTimFgv6LXIeS
|
||||
//5DOAAO9WwzlseTGmUgek3BbnnJJiGHVLBgnLaqWLOZ1Y8ON1uC8lQnbIeYbTQq
|
||||
EE5R0cbVLVXBJoKakBF8gwHF51HC2pSBYmHNZsSbjMuHpJWJM4fVldNWPNaqriKC
|
||||
OkL8QgvNoapgk20k1ajLl/ibv32k7QBKy3cTMtbQYPdreXcoZuMw38ysQcgFxPCs
|
||||
Zh92aaWW0ceWowkJ7CFnes2jdPcMSOYE37wodmV3/VV7cusmTD8wikyUdQARAQAB
|
||||
tCxMaWJyZXN3YW4gKFNpZ25pbmcgS2V5KSA8dGVhbUBsaWJyZXN3YW4ub3JnPokC
|
||||
TgQTAQoAOBYhBJB+eQ8lwejlYc1ztYX/S0OzD8b5BQJi4cg4AhsDBQsJCAcDBRUK
|
||||
CQgLBRYCAwEAAh4FAheAAAoJEIX/S0OzD8b5zNcP/RuDb05Xr+IpuGWtJ38yGMWG
|
||||
mZglLHrzCAOXNAr/QXt6Kz3sThJoZFIh2E4Ab5yW59iFLFpW3VuZIGVCyh7vsuVw
|
||||
MuKoJtrZtdbHSdLbE+FHpY7osQDrcuodTv5b7STfG2Wje18iG/dCATVIDDgbPmuJ
|
||||
FpNLcR3scuoIlgxmP3Y1AFgufLR5MiN60PKnS2Husyj0f5Gqc3USLofWKgEQ4wFa
|
||||
gT1iIjkf4zkFcVlJ5K0SE1ULn8K7umkOUvLcKg6ji+1sEwEM1kCNmxI8HkiNt296
|
||||
9Z/TLK1h8McFGwG7x1p8fZ7Kjmzwnv1TSxAt1wHMoa0m9LntQOXnn3hVJaC74AzX
|
||||
heFtqDHmATpcGtQLR0zutrZ+ohUb6AEt+hAPfyDDYIR5y3oNdSLozJkJ1wlrhsYh
|
||||
SR1Hv4b3fdD6XgyUPggituOYm+yv1PuHrSEaoznnlX2z0MaVJyJIN0zUHlPBmWKC
|
||||
LmzQX2A7l9bHhkXYgHoSdeBHdwvcQQGWwkVmN2WUwsM/m9Abk8OdLdE13nI8824R
|
||||
0+b6XzJ2g4L+RIsVseerX2WIMHSMvkbFuLpEE4ILOrL+9Lq5bdx9MvZPtsZ/ZutY
|
||||
QVVvJ+nJtmPp0HpybnJdXzB7Za02A0r2gXIUrund32K97qe8XblCwxkZbZCeLcSL
|
||||
5+mb8O1XPGD39S6CCZbRuQINBFDjilcBEADXDN9o3icyDy+ity45CsQfo1f84xL6
|
||||
oJIgCLGGwm3RFPgOzdgxaE7TiLzW2NBui+yHyw48WRTxZ9XC6HtGKjH6XPvP5nF4
|
||||
8wss7tjzRNzmNgTp7G47HkW3lD0VYX4NqfCmxQK9gTXob1+JFmWkEXkXmZYg2dbn
|
||||
1REtHb03x370Z547rjvdpopQW6jaSw0C556DOxb9weJqLqAd2uZO4nwhuDs/VM+Q
|
||||
yy+/MlHTbnsmnYIMozDLMmHZ1PMeJlTFPMfapaux9UDTgQ5dwLj2FiQ/uEMzvfVv
|
||||
W23hxlpWVHsccwZR77PMDt4Nbj/7QlOIKpgid2r8SyBmhjET2u/USSzFYzK8J2Wj
|
||||
oLcxiuMTwrnM6b3bqiuSDUMAEoNN814Cbpz6yLB2wyKs5N7ZA/lVLNE8MV7to8OD
|
||||
ww1nS2bDDf5/JMNt5aWu/iO2bBrYE30LqHR3bSV6QP57JnzunM9Y4V1BnEKYW14A
|
||||
9+rRH1k1e5CuS5tqxpSubniF80AdUyPjF8rXOY0URD6zY0s4843Nf9TNr8ke/1ma
|
||||
qLEkUAF03AwBR8oz247ylu75q94ytpYUFJAkNeqpk8XypqKJMVcl4NfEP930JR82
|
||||
sGjNylVu/b4EsqKfmkoU8VFM1lfuaqX1u2ZDoUpG2Io/zpeV07RQ0KTHdKBejzix
|
||||
2IN0T7W4G0JXcwARAQABiQIfBBgBAgAJBQJQ44pXAhsMAAoJEIX/S0OzD8b5KR8P
|
||||
/jdWNVVw74/oCPtt79V1r0XN4I0ZBTQZgKp3JmZdcZlS2Uzx4u1VhxcevDQ7fh/Z
|
||||
5Y1xDBh+IKwF83hJKXy56+PJBlYIGjc2GTEmU1yo4E9iudPq56FFb6eelX1qBfxI
|
||||
0ZHdWgzWmrtnCF65zGTmeYMpck4ZuKdJAX2AM6kWcBikt4jT/SqrcS8t/duWRSSV
|
||||
iikwXD8aPexAz9XuezI+y3Exupt/lqUyVtCV3t0/gWRAMuwrMH/RABEPTaQdmxKz
|
||||
i0OkMDlHhweXZWg0/t32XLhhmy4f/30NhKYnntN6/pdNDb8vin5OP2MRyJDHIykA
|
||||
2HZcYvjdZS43+PbiuqDCTILMvxUDYjxHszgEheLariRvmRwE1HRjZWNTzGTjUgyv
|
||||
83XUhrIoAlgMVy2tQAatKbNVYAn5dmA0NCDKnSszas43gApSSjh2UXmq/owwpVj6
|
||||
zYHcoV0gdCuLJ1BPLstN0ZGO+g+eRpTI97+/04sgz/hImDsm7G3Diners/FDaebt
|
||||
pMRzVshh5lIgVBnCT36hdHW8buyiAgRQtjq7bX8JLN4Ermxlq4a33OYc7TGNC3jF
|
||||
Rm4XSY6RUDMd6uhRD5hKZB2N8az079603K7nc93x32CualHCJD+M7Z2/j9r3T3Tc
|
||||
y69oM+pgP48wySo+XEGHCM5OG7YNNiJ8xQ/J+CKCyLQV
|
||||
=ZaKB
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
@ -1,92 +0,0 @@
|
||||
From 5101913b1e623121a9222f11eefa18f0a2708b00 Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Wed, 27 Mar 2024 10:43:19 -0400
|
||||
Subject: [PATCH] ikev1: in compute_proto_keymat() only allow explicitly
|
||||
handled ESP algorithms
|
||||
|
||||
---
|
||||
programs/pluto/ikev1_quick.c | 41 ++++++++++++++----------------------
|
||||
1 file changed, 16 insertions(+), 25 deletions(-)
|
||||
|
||||
diff --git a/programs/pluto/ikev1_quick.c b/programs/pluto/ikev1_quick.c
|
||||
index 81c522c148..22c346afb4 100644
|
||||
--- a/programs/pluto/ikev1_quick.c
|
||||
+++ b/programs/pluto/ikev1_quick.c
|
||||
@@ -203,7 +203,7 @@ static bool emit_subnet_id(enum perspective perspective,
|
||||
* RFC 2409 "IKE" section 5.5
|
||||
* specifies how this is to be done.
|
||||
*/
|
||||
-static void compute_proto_keymat(struct state *st,
|
||||
+static bool compute_proto_keymat(struct state *st,
|
||||
uint8_t protoid,
|
||||
struct ipsec_proto_info *pi,
|
||||
const char *satypename)
|
||||
@@ -297,27 +297,13 @@ static void compute_proto_keymat(struct state *st,
|
||||
}
|
||||
break;
|
||||
|
||||
- case ESP_CAST:
|
||||
- case ESP_TWOFISH:
|
||||
- case ESP_SERPENT:
|
||||
- /* ESP_SEED is for IKEv1 only and not supported. Its number in IKEv2 has been re-used */
|
||||
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
|
||||
-
|
||||
default:
|
||||
- /* bytes */
|
||||
- needed_len = encrypt_max_key_bit_length(pi->attrs.transattrs.ta_encrypt) / BITS_PER_BYTE;
|
||||
- if (needed_len > 0) {
|
||||
- /* XXX: check key_len coupling with kernel.c's */
|
||||
- if (pi->attrs.transattrs.enckeylen) {
|
||||
- needed_len =
|
||||
- pi->attrs.transattrs.enckeylen
|
||||
- / BITS_PER_BYTE;
|
||||
- dbg("compute_proto_keymat: key_len=%d from peer",
|
||||
- (int)needed_len);
|
||||
- }
|
||||
- break;
|
||||
- }
|
||||
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
|
||||
+ {
|
||||
+ enum_buf eb;
|
||||
+ llog(RC_LOG, st->st_logger, "rejecting request for keymat for %s",
|
||||
+ str_enum(&esp_transformid_names, protoid, &eb));
|
||||
+ return false;
|
||||
+ }
|
||||
}
|
||||
dbg("compute_proto_keymat: needed_len (after ESP enc)=%d", (int)needed_len);
|
||||
needed_len += pi->attrs.transattrs.ta_integ->integ_keymat_size;
|
||||
@@ -359,14 +345,17 @@ static void compute_proto_keymat(struct state *st,
|
||||
DBG_dump_hunk(" inbound:", pi->inbound.keymat);
|
||||
DBG_dump_hunk(" outbound:", pi->outbound.keymat);
|
||||
}
|
||||
+
|
||||
+ return true;
|
||||
}
|
||||
|
||||
-static void compute_keymats(struct state *st)
|
||||
+static bool compute_keymats(struct state *st)
|
||||
{
|
||||
if (st->st_ah.present)
|
||||
- compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
|
||||
+ return compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
|
||||
if (st->st_esp.present)
|
||||
- compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
|
||||
+ return compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
|
||||
+ return false;
|
||||
}
|
||||
|
||||
/*
|
||||
@@ -1460,7 +1449,9 @@ static stf_status quick_inI1_outR1_continue12_tail(struct state *st, struct msg_
|
||||
fixup_v1_HASH(st, &hash_fixup, st->st_v1_msgid.id, rbody.cur);
|
||||
|
||||
/* Derive new keying material */
|
||||
- compute_keymats(st);
|
||||
+ if (!compute_keymats(st)) {
|
||||
+ return STF_FATAL;
|
||||
+ }
|
||||
|
||||
/* Tell the kernel to establish the new inbound SA
|
||||
* (unless the commit bit is set -- which we don't support).
|
||||
--
|
||||
2.45.0
|
||||
|
||||
@ -1,54 +0,0 @@
|
||||
From 2ec448884a7467743699803f8a36ee28d237666c Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Wed, 28 Feb 2024 08:29:53 -0500
|
||||
Subject: [PATCH] ikev2: return STF_FATAL when initiator fails to emit AUTH
|
||||
packet
|
||||
|
||||
---
|
||||
programs/pluto/ikev2_ike_auth.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
|
||||
index 192eb1b3b6..a54a109699 100644
|
||||
--- a/programs/pluto/ikev2_ike_auth.c
|
||||
+++ b/programs/pluto/ikev2_ike_auth.c
|
||||
@@ -1267,7 +1267,7 @@ static stf_status process_v2_IKE_AUTH_request_auth_signature_continue(struct ike
|
||||
/* now send AUTH payload */
|
||||
|
||||
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, response.pbs)) {
|
||||
- return STF_INTERNAL_ERROR;
|
||||
+ return STF_FATAL;
|
||||
}
|
||||
ike->sa.st_v2_ike_intermediate.used = false;
|
||||
|
||||
--
|
||||
2.44.0
|
||||
|
||||
From 16272f2475d25baab58fbed2af7c67cfb459137f Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Thu, 29 Feb 2024 12:19:20 -0500
|
||||
Subject: [PATCH] ikev2: always return STF_FATAL if emitting AUTH fails
|
||||
|
||||
Fix:
|
||||
ikev2: return STF_FATAL when initiator fails to emit AUTH packet
|
||||
which really fixed the responder.
|
||||
---
|
||||
programs/pluto/ikev2_ike_auth.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
|
||||
index a54a109699..491053fb10 100644
|
||||
--- a/programs/pluto/ikev2_ike_auth.c
|
||||
+++ b/programs/pluto/ikev2_ike_auth.c
|
||||
@@ -397,7 +397,7 @@ stf_status initiate_v2_IKE_AUTH_request_signature_continue(struct ike_sa *ike,
|
||||
/* send out the AUTH payload */
|
||||
|
||||
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, request.pbs)) {
|
||||
- return STF_INTERNAL_ERROR;
|
||||
+ return STF_FATAL;
|
||||
}
|
||||
|
||||
if (LIN(POLICY_MOBIKE, ike->sa.st_connection->policy)) {
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -1,198 +0,0 @@
|
||||
From 474d75be074799efa9e38f346d3fdb76dec3eead Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Tue, 5 Dec 2023 13:55:37 -0500
|
||||
Subject: [PATCH] x509: unpack IPv6 general names based on length
|
||||
|
||||
fix #1321
|
||||
---
|
||||
programs/pluto/x509.c | 35 +++++++++++++++++++++++++++++------
|
||||
1 file changed, 29 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/programs/pluto/x509.c b/programs/pluto/x509.c
|
||||
index fbbf5a553e..f7e97b9979 100644
|
||||
--- a/programs/pluto/x509.c
|
||||
+++ b/programs/pluto/x509.c
|
||||
@@ -336,7 +336,7 @@ generalName_t *collect_rw_ca_candidates(struct msg_digest *md)
|
||||
*/
|
||||
static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger)
|
||||
{
|
||||
- *id = empty_id;
|
||||
+ *id = empty_id; /* aka ID_NONE */
|
||||
|
||||
switch (gn->kind) {
|
||||
case GN_DNS_NAME: /* ID type: ID_FQDN */
|
||||
@@ -345,18 +345,37 @@ static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger
|
||||
break;
|
||||
case GN_IP_ADDRESS: /* ID type: ID_IPV4_ADDR */
|
||||
{
|
||||
+ const struct ip_info *afi = NULL;
|
||||
+ for (enum ip_index i = 0; i < IP_INDEX_ROOF; i++) {
|
||||
+ if (ip_families[i].ip_size == gn->name.len) {
|
||||
+ afi = &ip_families[i];
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+ if (afi == NULL) {
|
||||
+ llog(RC_LOG, logger,
|
||||
+ "warning: invalid IP_ADDRESS general name: %zu byte length is not valid",
|
||||
+ gn->name.len);
|
||||
+ PEXPECT(logger, id->kind == ID_NONE);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
/*
|
||||
* XXX: why could this fail; and what happens when it
|
||||
* is ignored?
|
||||
*/
|
||||
- const struct ip_info *afi = &ipv4_info;
|
||||
- id->kind = afi->id_ip_addr;
|
||||
- err_t ugh = hunk_to_address(gn->name, afi, &id->ip_addr);
|
||||
+ ip_address addr;
|
||||
+ err_t ugh = hunk_to_address(gn->name, afi, &addr);
|
||||
if (ugh != NULL) {
|
||||
llog(RC_LOG, logger,
|
||||
- "warning: gntoid() failed to initaddr(): %s",
|
||||
- ugh);
|
||||
+ "warning: invalid IP_ADDRESS general name: %s",
|
||||
+ ugh);
|
||||
+ PEXPECT(logger, id->kind == ID_NONE);
|
||||
+ return;
|
||||
}
|
||||
+
|
||||
+ id->kind = afi->id_ip_addr;
|
||||
+ id->ip_addr = addr;
|
||||
break;
|
||||
}
|
||||
case GN_RFC822_NAME: /* ID type: ID_USER_FQDN */
|
||||
@@ -464,14 +483,18 @@ bool add_pubkey_from_nss_cert(struct pubkey_list **pubkey_db,
|
||||
return false;
|
||||
}
|
||||
|
||||
+ ldbg(logger, "adding cert using subject name");
|
||||
replace_public_key(pubkey_db, &pk);
|
||||
passert(pk == NULL); /*stolen*/
|
||||
|
||||
+ ldbg(logger, "adding cert using general names");
|
||||
add_cert_san_pubkeys(pubkey_db, cert, logger);
|
||||
|
||||
if (keyid != NULL && keyid->kind != ID_DER_ASN1_DN &&
|
||||
keyid->kind != ID_NONE &&
|
||||
keyid->kind != ID_FROMCERT) {
|
||||
+ id_buf idb;
|
||||
+ ldbg(logger, "adding cert using keyid %s", str_id(keyid, &idb));
|
||||
struct pubkey *pk2 = NULL;
|
||||
diag_t d = create_pubkey_from_cert(keyid, cert, &pk2, logger);
|
||||
if (d != NULL) {
|
||||
--
|
||||
2.44.0
|
||||
|
||||
From 1e27be95cd710a840681d1a51913e6a32ce75a2a Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Mon, 11 Mar 2024 17:18:51 -0400
|
||||
Subject: [PATCH] building: back-port ip_families[] and ip_index
|
||||
|
||||
---
|
||||
include/ip_index.h | 27 +++++++++++++++++++++++++++
|
||||
include/ip_info.h | 7 +++++--
|
||||
lib/libswan/ip_info.c | 9 ++++++---
|
||||
3 files changed, 38 insertions(+), 5 deletions(-)
|
||||
create mode 100644 include/ip_index.h
|
||||
|
||||
diff --git a/include/ip_index.h b/include/ip_index.h
|
||||
new file mode 100644
|
||||
index 0000000000..508589b05e
|
||||
--- /dev/null
|
||||
+++ b/include/ip_index.h
|
||||
@@ -0,0 +1,27 @@
|
||||
+/* ip address type index, for libreswan
|
||||
+ *
|
||||
+ * Copyright (C) 2022 Andrew Cagney
|
||||
+ *
|
||||
+ * This library is free software; you can redistribute it and/or modify it
|
||||
+ * under the terms of the GNU Library General Public License as published by
|
||||
+ * the Free Software Foundation; either version 2 of the License, or (at your
|
||||
+ * option) any later version. See <https://www.gnu.org/licenses/lgpl-2.1.txt>.
|
||||
+ *
|
||||
+ * This library is distributed in the hope that it will be useful, but
|
||||
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
|
||||
+ * License for more details.
|
||||
+ *
|
||||
+ */
|
||||
+
|
||||
+#ifndef IP_INDEX_H
|
||||
+#define IP_INDEX_H
|
||||
+
|
||||
+enum ip_index {
|
||||
+ IPv4_INDEX,
|
||||
+ IPv6_INDEX,
|
||||
+};
|
||||
+
|
||||
+#define IP_INDEX_ROOF (IPv6_INDEX+1)
|
||||
+
|
||||
+#endif
|
||||
diff --git a/include/ip_info.h b/include/ip_info.h
|
||||
index 40e99ef687..c1329a8569 100644
|
||||
--- a/include/ip_info.h
|
||||
+++ b/include/ip_info.h
|
||||
@@ -9,6 +9,7 @@
|
||||
#include "ip_subnet.h"
|
||||
#include "ip_selector.h"
|
||||
#include "ip_sockaddr.h"
|
||||
+#include "ip_index.h"
|
||||
|
||||
struct ip_info {
|
||||
/*
|
||||
@@ -113,8 +114,10 @@ struct ip_info {
|
||||
|
||||
};
|
||||
|
||||
-extern const struct ip_info ipv4_info;
|
||||
-extern const struct ip_info ipv6_info;
|
||||
+extern const struct ip_info ip_families[IP_INDEX_ROOF];
|
||||
+
|
||||
+#define ipv4_info ip_families[IPv4_INDEX]
|
||||
+#define ipv6_info ip_families[IPv6_INDEX]
|
||||
|
||||
extern const struct ip_info *aftoinfo(int af);
|
||||
|
||||
diff --git a/lib/libswan/ip_info.c b/lib/libswan/ip_info.c
|
||||
index 70cd6a368f..97296d3a11 100644
|
||||
--- a/lib/libswan/ip_info.c
|
||||
+++ b/lib/libswan/ip_info.c
|
||||
@@ -158,7 +158,9 @@ static ip_port port_from_ipv6_sockaddr(const ip_sockaddr sa)
|
||||
|
||||
#define IPv4_FF { { 255, 255, 255, 255, }, }
|
||||
|
||||
-const struct ip_info ipv4_info = {
|
||||
+const struct ip_info ip_families[IP_INDEX_ROOF] = {
|
||||
+
|
||||
+ [IPv4_INDEX] = {
|
||||
|
||||
.ip_version = IPv4,
|
||||
.ip_size = sizeof(struct in_addr),
|
||||
@@ -210,11 +212,11 @@ const struct ip_info ipv4_info = {
|
||||
.id_ip_addr = ID_IPV4_ADDR,
|
||||
.id_ip_addr_subnet = ID_IPV4_ADDR_SUBNET,
|
||||
.id_ip_addr_range = ID_IPV4_ADDR_RANGE,
|
||||
-};
|
||||
+ },
|
||||
|
||||
#define IPv6_FF { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }, }
|
||||
|
||||
-const struct ip_info ipv6_info = {
|
||||
+ [IPv6_INDEX] = {
|
||||
|
||||
.ip_version = IPv6,
|
||||
.ip_size = sizeof(struct in6_addr),
|
||||
@@ -266,6 +268,7 @@ const struct ip_info ipv6_info = {
|
||||
.id_ip_addr = ID_IPV6_ADDR,
|
||||
.id_ip_addr_subnet = ID_IPV6_ADDR_SUBNET,
|
||||
.id_ip_addr_range = ID_IPV6_ADDR_RANGE,
|
||||
+ }
|
||||
};
|
||||
|
||||
const struct ip_info *aftoinfo(int af)
|
||||
--
|
||||
2.44.0
|
||||
|
||||
@ -0,0 +1,20 @@
|
||||
diff --git a/programs/ipsec/ipsec.in b/programs/ipsec/ipsec.in
|
||||
index 40ff9f4138..41813b5258 100755
|
||||
--- a/programs/ipsec/ipsec.in
|
||||
+++ b/programs/ipsec/ipsec.in
|
||||
@@ -758,7 +758,14 @@ ipsec_import() {
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
|
||||
+ # First try blanc password to avoid uselessly prompting interactively
|
||||
+ pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" -W '' 2>/dev/null
|
||||
+ # check for SEC_ERROR_BAD_PASSWORD
|
||||
+ if [ $? -eq 18 ]; then
|
||||
+ # Not the empty password
|
||||
+ pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
|
||||
+ fi
|
||||
+
|
||||
# check and correct trust bits
|
||||
set_nss_db_trusts
|
||||
exit 0
|
||||
@ -1,63 +0,0 @@
|
||||
From 13720e0dedcab1eaf3334a73a42b68581acd9f3b Mon Sep 17 00:00:00 2001
|
||||
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
|
||||
Date: Fri, 7 Jan 2022 18:36:47 -0500
|
||||
Subject: [PATCH] ikev1-policy defaults to drop
|
||||
|
||||
IKEv2 has been available for 16 years (RFC 4306 was published December
|
||||
2005). At some point, we should be discouraging IKEv1 adoption.
|
||||
|
||||
To the extent that a user needs IKEv1, they can manually add
|
||||
ikev1-policy=accept to /etc/ipsec.conf.
|
||||
---
|
||||
configs/d.ipsec.conf/ikev1-policy.xml | 7 ++++---
|
||||
include/ipsecconf/keywords.h | 2 +-
|
||||
lib/libipsecconf/confread.c | 1 +
|
||||
programs/pluto/server.c | 5 -----
|
||||
4 files changed, 6 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/configs/d.ipsec.conf/ikev1-policy.xml b/configs/d.ipsec.conf/ikev1-policy.xml
|
||||
index 17d1747e3b..3bd6702564 100644
|
||||
--- a/configs/d.ipsec.conf/ikev1-policy.xml
|
||||
+++ b/configs/d.ipsec.conf/ikev1-policy.xml
|
||||
@@ -3,9 +3,10 @@
|
||||
<listitem>
|
||||
<para>
|
||||
What to do with received IKEv1 packets. Valid options are
|
||||
-<emphasis remap='B'>accept</emphasis> (default), <emphasis remap='B'>reject</emphasis> which
|
||||
-will reply with an error, and <emphasis remap='B'>drop</emphasis> which will silently drop
|
||||
-any received IKEv1 packet. If this option is set to drop or reject, an attempt to load an
|
||||
+<emphasis remap='B'>drop</emphasis> (default) which will silently drop
|
||||
+any received IKEv1 packet, <emphasis remap='B'>accept</emphasis>, and
|
||||
+<emphasis remap='B'>reject</emphasis> which will reply with an error.
|
||||
+If this option is set to drop or reject, an attempt to load an
|
||||
IKEv1 connection will fail, as these connections would never be able to receive a packet
|
||||
for processing.
|
||||
</para>
|
||||
diff --git a/include/ipsecconf/keywords.h b/include/ipsecconf/keywords.h
|
||||
index 660847733c..31b519242a 100644
|
||||
--- a/include/ipsecconf/keywords.h
|
||||
+++ b/include/ipsecconf/keywords.h
|
||||
@@ -111,7 +111,7 @@ enum keyword_numeric_config_field {
|
||||
|
||||
KBF_LISTEN_TCP, /* listen on TCP port 4500 - default no */
|
||||
KBF_LISTEN_UDP, /* listen on UDP port 500/4500 - default yes */
|
||||
- KBF_GLOBAL_IKEv1, /* global ikev1 policy - default accept */
|
||||
+ KBF_GLOBAL_IKEv1, /* global ikev1 policy - default drop */
|
||||
KBF_ROOF
|
||||
};
|
||||
|
||||
diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
|
||||
index 5b5aba723f..68fbccf442 100644
|
||||
--- a/lib/libipsecconf/confread.c
|
||||
+++ b/lib/libipsecconf/confread.c
|
||||
@@ -95,6 +95,7 @@ static void ipsecconf_default_values(struct starter_config *cfg)
|
||||
/* Don't inflict BSI requirements on everyone */
|
||||
SOPT(KBF_SEEDBITS, 0);
|
||||
SOPT(KBF_DROP_OPPO_NULL, false);
|
||||
+ SOPT(KBF_GLOBAL_IKEv1, GLOBAL_IKEv1_DROP);
|
||||
|
||||
#ifdef HAVE_LABELED_IPSEC
|
||||
SOPT(KBF_SECCTX, SECCTX);
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@ -0,0 +1,582 @@
|
||||
From ddf4fcee5812e453f784e7b453f52d242baf060c Mon Sep 17 00:00:00 2001
|
||||
From: Daiki Ueno <dueno@redhat.com>
|
||||
Date: Sat, 23 Nov 2024 10:18:03 +0900
|
||||
Subject: [PATCH 1/2] secrets: allocate secret_pubkey_stuff separately from
|
||||
heap
|
||||
|
||||
Signed-off-by: Daiki Ueno <dueno@redhat.com>
|
||||
---
|
||||
include/secrets.h | 2 +-
|
||||
lib/libswan/pubkey_ecdsa.c | 10 +++---
|
||||
lib/libswan/pubkey_rsa.c | 18 +++++------
|
||||
.../secret_pubkey_stuff_to_pubkey_der.c | 2 +-
|
||||
lib/libswan/secrets.c | 32 ++++++++++---------
|
||||
programs/pluto/ikev2_eap.c | 2 +-
|
||||
programs/pluto/keys.c | 6 ++--
|
||||
programs/showhostkey/showhostkey.c | 31 ++++++++++--------
|
||||
8 files changed, 54 insertions(+), 49 deletions(-)
|
||||
|
||||
diff --git a/include/secrets.h b/include/secrets.h
|
||||
index 8f9f990c10..c9272d71e0 100644
|
||||
--- a/include/secrets.h
|
||||
+++ b/include/secrets.h
|
||||
@@ -88,7 +88,7 @@ struct secret_stuff {
|
||||
int line;
|
||||
union {
|
||||
chunk_t preshared_secret;
|
||||
- struct secret_pubkey_stuff pubkey;
|
||||
+ struct secret_pubkey_stuff *pubkey;
|
||||
} u;
|
||||
|
||||
chunk_t ppk;
|
||||
diff --git a/lib/libswan/pubkey_ecdsa.c b/lib/libswan/pubkey_ecdsa.c
|
||||
index f8d0fe5dae..a4250d9356 100644
|
||||
--- a/lib/libswan/pubkey_ecdsa.c
|
||||
+++ b/lib/libswan/pubkey_ecdsa.c
|
||||
@@ -288,7 +288,7 @@ static struct hash_signature ECDSA_raw_sign_hash(const struct secret_stuff *pks,
|
||||
{
|
||||
ldbgf(DBG_CRYPT, logger, "%s: started using NSS", __func__);
|
||||
|
||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
||||
dbg("no private key!");
|
||||
return (struct hash_signature) { .len = 0, };
|
||||
}
|
||||
@@ -304,7 +304,7 @@ static struct hash_signature ECDSA_raw_sign_hash(const struct secret_stuff *pks,
|
||||
/* point signature at the SIG_VAL buffer */
|
||||
struct hash_signature signature = {0};
|
||||
SECItem raw_signature;
|
||||
- SECStatus s = SGN_Digest(pks->u.pubkey.private_key,
|
||||
+ SECStatus s = SGN_Digest(pks->u.pubkey->private_key,
|
||||
hash_alg->nss.oid_tag,
|
||||
&raw_signature, &hash_to_sign);
|
||||
if (s != SECSuccess) {
|
||||
@@ -411,7 +411,7 @@ static struct hash_signature ECDSA_digsig_sign_hash(const struct secret_stuff *p
|
||||
struct logger *logger)
|
||||
{
|
||||
|
||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
||||
dbg("no private key!");
|
||||
return (struct hash_signature) { .len = 0, };
|
||||
}
|
||||
@@ -429,14 +429,14 @@ static struct hash_signature ECDSA_digsig_sign_hash(const struct secret_stuff *p
|
||||
uint8_t raw_signature_data[sizeof(struct hash_signature)];
|
||||
SECItem raw_signature = {
|
||||
.type = siBuffer,
|
||||
- .len = PK11_SignatureLen(pks->u.pubkey.private_key),
|
||||
+ .len = PK11_SignatureLen(pks->u.pubkey->private_key),
|
||||
.data = raw_signature_data,
|
||||
};
|
||||
passert(raw_signature.len <= sizeof(raw_signature_data));
|
||||
dbg("ECDSA signature.len %d", raw_signature.len);
|
||||
|
||||
/* create the raw signature */
|
||||
- SECStatus s = PK11_Sign(pks->u.pubkey.private_key, &raw_signature, &hash_to_sign);
|
||||
+ SECStatus s = PK11_Sign(pks->u.pubkey->private_key, &raw_signature, &hash_to_sign);
|
||||
if (DBGP(DBG_CRYPT)) {
|
||||
DBG_dump("sig_from_nss", raw_signature.data, raw_signature.len);
|
||||
}
|
||||
diff --git a/lib/libswan/pubkey_rsa.c b/lib/libswan/pubkey_rsa.c
|
||||
index 78620620d6..796748bdaa 100644
|
||||
--- a/lib/libswan/pubkey_rsa.c
|
||||
+++ b/lib/libswan/pubkey_rsa.c
|
||||
@@ -350,7 +350,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk
|
||||
return (struct hash_signature) { .len = 0, };
|
||||
}
|
||||
|
||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
||||
dbg("no private key!");
|
||||
return (struct hash_signature) { .len = 0, };
|
||||
}
|
||||
@@ -361,7 +361,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk
|
||||
.data = DISCARD_CONST(uint8_t *, hash_val),
|
||||
};
|
||||
|
||||
- struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey.private_key), };
|
||||
+ struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey->private_key), };
|
||||
passert(sig.len <= sizeof(sig.ptr/*array*/));
|
||||
SECItem signature = {
|
||||
.type = siBuffer,
|
||||
@@ -369,7 +369,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk
|
||||
.data = sig.ptr,
|
||||
};
|
||||
|
||||
- SECStatus s = PK11_Sign(pks->u.pubkey.private_key, &signature, &data);
|
||||
+ SECStatus s = PK11_Sign(pks->u.pubkey->private_key, &signature, &data);
|
||||
if (s != SECSuccess) {
|
||||
/* PR_GetError() returns the thread-local error */
|
||||
llog_nss_error(RC_LOG, logger,
|
||||
@@ -485,7 +485,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
|
||||
{
|
||||
dbg("%s: started using NSS", __func__);
|
||||
|
||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
||||
dbg("no private key!");
|
||||
return (struct hash_signature) { .len = 0, };
|
||||
}
|
||||
@@ -501,7 +501,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
|
||||
* used to generate the signature.
|
||||
*/
|
||||
SECItem signature_result = {0};
|
||||
- SECStatus s = SGN_Digest(pks->u.pubkey.private_key,
|
||||
+ SECStatus s = SGN_Digest(pks->u.pubkey->private_key,
|
||||
hash_algo->nss.oid_tag,
|
||||
&signature_result, &digest);
|
||||
if (s != SECSuccess) {
|
||||
@@ -516,7 +516,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
|
||||
/* save the signature, free the returned pointer */
|
||||
|
||||
struct hash_signature signature = {
|
||||
- .len = PK11_SignatureLen(pks->u.pubkey.private_key),
|
||||
+ .len = PK11_SignatureLen(pks->u.pubkey->private_key),
|
||||
};
|
||||
passert(signature.len <= sizeof(signature.ptr/*array*/));
|
||||
memcpy(signature.ptr, signature_result.data, signature.len);
|
||||
@@ -629,7 +629,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff
|
||||
{
|
||||
dbg("%s: started using NSS", __func__);
|
||||
|
||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
||||
dbg("no private key!");
|
||||
return (struct hash_signature) { .len = 0, };
|
||||
}
|
||||
@@ -640,7 +640,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff
|
||||
.data = DISCARD_CONST(uint8_t *, hash_val),
|
||||
};
|
||||
|
||||
- struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey.private_key), };
|
||||
+ struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey->private_key), };
|
||||
passert(sig.len <= sizeof(sig.ptr/*array*/));
|
||||
SECItem signature = {
|
||||
.type = siBuffer,
|
||||
@@ -661,7 +661,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff
|
||||
.data = (void*)mech, /* strip const */
|
||||
.len = sizeof(*mech),
|
||||
};
|
||||
- SECStatus s = PK11_SignWithMechanism(pks->u.pubkey.private_key, CKM_RSA_PKCS_PSS,
|
||||
+ SECStatus s = PK11_SignWithMechanism(pks->u.pubkey->private_key, CKM_RSA_PKCS_PSS,
|
||||
&mech_item, &signature, &data);
|
||||
if (s != SECSuccess) {
|
||||
/* PR_GetError() returns the thread-local error */
|
||||
diff --git a/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c b/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c
|
||||
index 1b5de6917e..3f28cbd765 100644
|
||||
--- a/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c
|
||||
+++ b/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c
|
||||
@@ -32,7 +32,7 @@ static diag_t seckey_pubkey_to_der(SECKEYPublicKey *seckey_pubkey, chunk_t *der)
|
||||
|
||||
diag_t secret_pubkey_stuff_to_pubkey_der(struct secret_stuff *pks, chunk_t *der)
|
||||
{
|
||||
- SECKEYPublicKey *seckey_pubkey = SECKEY_ConvertToPublicKey(pks->u.pubkey.private_key);
|
||||
+ SECKEYPublicKey *seckey_pubkey = SECKEY_ConvertToPublicKey(pks->u.pubkey->private_key);
|
||||
if (seckey_pubkey == NULL) {
|
||||
return diag_nss_error("extracting Public Key from Private Key");
|
||||
}
|
||||
diff --git a/lib/libswan/secrets.c b/lib/libswan/secrets.c
|
||||
index 01cf90e4f3..1088f914af 100644
|
||||
--- a/lib/libswan/secrets.c
|
||||
+++ b/lib/libswan/secrets.c
|
||||
@@ -186,7 +186,7 @@ const ckaid_t *secret_ckaid(const struct secret *secret)
|
||||
case SECRET_RSA:
|
||||
case SECRET_ECDSA:
|
||||
/* some sort of PKI */
|
||||
- return &secret->stuff.u.pubkey.content.ckaid;
|
||||
+ return &secret->stuff.u.pubkey->content.ckaid;
|
||||
default:
|
||||
return NULL;
|
||||
}
|
||||
@@ -198,7 +198,7 @@ const keyid_t *secret_keyid(const struct secret *secret)
|
||||
case SECRET_RSA:
|
||||
case SECRET_ECDSA:
|
||||
/* some sort of PKI */
|
||||
- return &secret->stuff.u.pubkey.content.keyid;
|
||||
+ return &secret->stuff.u.pubkey->content.keyid;
|
||||
default:
|
||||
return NULL;
|
||||
}
|
||||
@@ -241,12 +241,12 @@ static struct secret *find_secret_by_pubkey_ckaid_1(struct secret *secrets,
|
||||
dbg(" not PKI");
|
||||
continue;
|
||||
}
|
||||
- if (type != NULL && pks->u.pubkey.content.type != type) {
|
||||
+ if (type != NULL && pks->u.pubkey->content.type != type) {
|
||||
/* need exact or wildcard */
|
||||
dbg(" not %s", type->name);
|
||||
continue;
|
||||
}
|
||||
- if (!ckaid_eq_nss(&pks->u.pubkey.content.ckaid, pubkey_ckaid)) {
|
||||
+ if (!ckaid_eq_nss(&pks->u.pubkey->content.ckaid, pubkey_ckaid)) {
|
||||
dbg(" wrong ckaid");
|
||||
continue;
|
||||
}
|
||||
@@ -276,12 +276,12 @@ bool secret_pubkey_same(struct secret *lhs, struct secret *rhs)
|
||||
return false;
|
||||
}
|
||||
|
||||
- if (lhs->stuff.u.pubkey.content.type != rhs->stuff.u.pubkey.content.type) {
|
||||
+ if (lhs->stuff.u.pubkey->content.type != rhs->stuff.u.pubkey->content.type) {
|
||||
return false;
|
||||
}
|
||||
|
||||
- return lhs->stuff.u.pubkey.content.type->pubkey_same(&lhs->stuff.u.pubkey.content,
|
||||
- &rhs->stuff.u.pubkey.content);
|
||||
+ return lhs->stuff.u.pubkey->content.type->pubkey_same(&lhs->stuff.u.pubkey->content,
|
||||
+ &rhs->stuff.u.pubkey->content);
|
||||
}
|
||||
|
||||
struct secret *lsw_find_secret_by_id(struct secret *secrets,
|
||||
@@ -954,8 +954,9 @@ void lsw_free_preshared_secrets(struct secret **psecrets, struct logger *logger)
|
||||
case SECRET_RSA:
|
||||
case SECRET_ECDSA:
|
||||
/* Note: pub is all there is */
|
||||
- SECKEY_DestroyPrivateKey(s->stuff.u.pubkey.private_key);
|
||||
- s->stuff.u.pubkey.content.type->free_pubkey_content(&s->stuff.u.pubkey.content);
|
||||
+ SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key);
|
||||
+ s->stuff.u.pubkey->content.type->free_pubkey_content(&s->stuff.u.pubkey->content);
|
||||
+ pfree(s->stuff.u.pubkey);
|
||||
break;
|
||||
default:
|
||||
bad_case(s->stuff.kind);
|
||||
@@ -1180,19 +1181,20 @@ static err_t add_private_key(struct secret **secrets, const struct secret_stuff
|
||||
s->stuff.kind = type->private_key_kind;
|
||||
s->stuff.line = 0;
|
||||
/* make an unpacked copy of the private key */
|
||||
- s->stuff.u.pubkey.private_key = copy_private_key(private_key);
|
||||
- err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey.content,
|
||||
+ s->stuff.u.pubkey = alloc_thing(struct secret_pubkey_stuff, "secret_pubkey_stuff");
|
||||
+ s->stuff.u.pubkey->private_key = copy_private_key(private_key);
|
||||
+ err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey->content,
|
||||
pubk, ckaid_nss);
|
||||
if (err != NULL) {
|
||||
/* extract should leave pubkey_content clean */
|
||||
- SECKEY_DestroyPrivateKey(s->stuff.u.pubkey.private_key); /* allocated above */
|
||||
+ SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key); /* allocated above */
|
||||
pfree(s);
|
||||
return err;
|
||||
}
|
||||
|
||||
- passert(s->stuff.u.pubkey.content.type == type);
|
||||
- pexpect(s->stuff.u.pubkey.content.ckaid.len > 0);
|
||||
- pexpect(s->stuff.u.pubkey.content.keyid.keyid[0] != '\0');
|
||||
+ passert(s->stuff.u.pubkey->content.type == type);
|
||||
+ pexpect(s->stuff.u.pubkey->content.ckaid.len > 0);
|
||||
+ pexpect(s->stuff.u.pubkey->content.keyid.keyid[0] != '\0');
|
||||
|
||||
add_secret(secrets, s, "lsw_add_rsa_secret");
|
||||
*pks = &s->stuff;
|
||||
diff --git a/programs/pluto/ikev2_eap.c b/programs/pluto/ikev2_eap.c
|
||||
index c43bd59b6d..118c4c484e 100644
|
||||
--- a/programs/pluto/ikev2_eap.c
|
||||
+++ b/programs/pluto/ikev2_eap.c
|
||||
@@ -282,7 +282,7 @@ static bool start_eap(struct ike_sa *ike, struct pbs_out *pbs)
|
||||
SSL_OptionSet(pr, SSL_ENABLE_SSL3, PR_FALSE) != SECSuccess ||
|
||||
SSL_BadCertHook(pr, eaptls_bad_cert_cb, eap) != SECSuccess ||
|
||||
SSL_HandshakeCallback(pr, eaptls_handshake_cb, eap) != SECSuccess ||
|
||||
- SSL_ConfigServerCert(pr, mycert->nss_cert, pks->u.pubkey.private_key, 0, 0) != SECSuccess) {
|
||||
+ SSL_ConfigServerCert(pr, mycert->nss_cert, pks->u.pubkey->private_key, 0, 0) != SECSuccess) {
|
||||
llog_nss_error(RC_LOG, logger, "Failed to start configure TLS options");
|
||||
return false;
|
||||
}
|
||||
diff --git a/programs/pluto/keys.c b/programs/pluto/keys.c
|
||||
index 359ed87f75..e71fccb825 100644
|
||||
--- a/programs/pluto/keys.c
|
||||
+++ b/programs/pluto/keys.c
|
||||
@@ -697,7 +697,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c,
|
||||
* etc) then best will end up as NULL
|
||||
*/
|
||||
pexpect(pks->kind == type->private_key_kind);
|
||||
- pexpect(pks->u.pubkey.content.type == type);
|
||||
+ pexpect(pks->u.pubkey->content.type == type);
|
||||
dbg("connection %s's %s private key found in NSS DB using cert",
|
||||
c->name, type->name);
|
||||
return pks;
|
||||
@@ -745,7 +745,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c,
|
||||
* etc) then best will end up as NULL
|
||||
*/
|
||||
pexpect(pks->kind == type->private_key_kind);
|
||||
- pexpect(pks->u.pubkey.content.type == type);
|
||||
+ pexpect(pks->u.pubkey->content.type == type);
|
||||
dbg("connection %s's %s private key found in NSS DB using CKAID",
|
||||
c->name, type->name);
|
||||
return pks;
|
||||
@@ -764,7 +764,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c,
|
||||
passert(pks != NULL);
|
||||
|
||||
pexpect(pks->kind == type->private_key_kind);
|
||||
- pexpect(pks->u.pubkey.content.type == type);
|
||||
+ pexpect(pks->u.pubkey->content.type == type);
|
||||
dbg("connection %s's %s private key found",
|
||||
c->name, type->name);
|
||||
return pks;
|
||||
diff --git a/programs/showhostkey/showhostkey.c b/programs/showhostkey/showhostkey.c
|
||||
index aaef793914..65b95ba596 100644
|
||||
--- a/programs/showhostkey/showhostkey.c
|
||||
+++ b/programs/showhostkey/showhostkey.c
|
||||
@@ -172,14 +172,14 @@ static void print(struct secret_stuff *pks,
|
||||
case SECRET_RSA:
|
||||
case SECRET_ECDSA:
|
||||
{
|
||||
- printf("%s", pks->u.pubkey.content.type->name);
|
||||
- keyid_t keyid = pks->u.pubkey.content.keyid;
|
||||
+ printf("%s", pks->u.pubkey->content.type->name);
|
||||
+ keyid_t keyid = pks->u.pubkey->content.keyid;
|
||||
printf(" keyid: %s", str_keyid(keyid)[0] ? str_keyid(keyid) : "<missing-pubkey>");
|
||||
if (id) {
|
||||
printf(" id: %s", idb);
|
||||
}
|
||||
ckaid_buf cb;
|
||||
- const ckaid_t *ckaid = &pks->u.pubkey.content.ckaid;
|
||||
+ const ckaid_t *ckaid = &pks->u.pubkey->content.ckaid;
|
||||
printf(" ckaid: %s\n", str_ckaid(ckaid, &cb));
|
||||
break;
|
||||
}
|
||||
@@ -237,7 +237,7 @@ static int pick_by_rsaid(struct secret *secret UNUSED,
|
||||
{
|
||||
char *rsaid = (char *)uservoid;
|
||||
|
||||
- if (pks->kind == SECRET_RSA && streq(pks->u.pubkey.content.keyid.keyid, rsaid)) {
|
||||
+ if (pks->kind == SECRET_RSA && streq(pks->u.pubkey->content.keyid.keyid, rsaid)) {
|
||||
/* stop */
|
||||
return 0;
|
||||
} else {
|
||||
@@ -254,7 +254,7 @@ static int pick_by_ckaid(struct secret *secret UNUSED,
|
||||
switch (pks->kind) {
|
||||
case SECRET_RSA:
|
||||
case SECRET_ECDSA:
|
||||
- if (ckaid_starts_with(&pks->u.pubkey.content.ckaid, start)) {
|
||||
+ if (ckaid_starts_with(&pks->u.pubkey->content.ckaid, start)) {
|
||||
/* stop */
|
||||
return 0;
|
||||
}
|
||||
@@ -283,7 +283,7 @@ static char *base64_ipseckey_rdata_from_pubkey_secret(struct secret_stuff *pks,
|
||||
enum ipseckey_algorithm_type *ipseckey_algorithm)
|
||||
{
|
||||
chunk_t ipseckey_pubkey = empty_chunk; /* must free */
|
||||
- err_t e = pks->u.pubkey.content.type->pubkey_content_to_ipseckey_rdata(&pks->u.pubkey.content,
|
||||
+ err_t e = pks->u.pubkey->content.type->pubkey_content_to_ipseckey_rdata(&pks->u.pubkey->content,
|
||||
&ipseckey_pubkey,
|
||||
ipseckey_algorithm);
|
||||
if (e != NULL) {
|
||||
@@ -390,7 +390,7 @@ static int show_leftright(struct secret_stuff *pks,
|
||||
}
|
||||
}
|
||||
|
||||
- passert(pks->u.pubkey.content.type != NULL);
|
||||
+ passert(pks->u.pubkey->content.type != NULL);
|
||||
|
||||
char *base64 = NULL;
|
||||
if (pubkey_flg) {
|
||||
@@ -408,11 +408,11 @@ static int show_leftright(struct secret_stuff *pks,
|
||||
} else {
|
||||
switch (pks->kind) {
|
||||
case SECRET_RSA:
|
||||
- printf("\t# rsakey %s\n", pks->u.pubkey.content.keyid.keyid);
|
||||
+ printf("\t# rsakey %s\n", pks->u.pubkey->content.keyid.keyid);
|
||||
printf("\t%srsasigkey=0s", side);
|
||||
break;
|
||||
case SECRET_ECDSA:
|
||||
- printf("\t# ecdsakey %s\n", pks->u.pubkey.content.keyid.keyid);
|
||||
+ printf("\t# ecdsakey %s\n", pks->u.pubkey->content.keyid.keyid);
|
||||
printf("\t%secdsakey=0s", side);
|
||||
break;
|
||||
default:
|
||||
@@ -481,14 +481,17 @@ static struct secret_stuff *foreach_nss_private_key(secret_eval func,
|
||||
continue;
|
||||
}
|
||||
|
||||
+ struct secret_pubkey_stuff pubkey = {
|
||||
+ .private_key = SECKEY_CopyPrivateKey(private_key), /* add reference */
|
||||
+ };
|
||||
+ type->extract_pubkey_content(&pubkey.content, pubk, ckaid_nss);
|
||||
+
|
||||
struct secret_stuff pks = {
|
||||
.kind = type->private_key_kind,
|
||||
.line = 0,
|
||||
- .u.pubkey.private_key = SECKEY_CopyPrivateKey(private_key), /* add reference */
|
||||
+ .u.pubkey = &pubkey,
|
||||
};
|
||||
|
||||
- type->extract_pubkey_content(&pks.u.pubkey.content, pubk, ckaid_nss);
|
||||
-
|
||||
/*
|
||||
* Only count private keys that get processed.
|
||||
*/
|
||||
@@ -513,8 +516,8 @@ static struct secret_stuff *foreach_nss_private_key(secret_eval func,
|
||||
break;
|
||||
}
|
||||
|
||||
- SECKEY_DestroyPrivateKey(pks.u.pubkey.private_key); /* destroy reference */
|
||||
- type->free_pubkey_content(&pks.u.pubkey.content);
|
||||
+ SECKEY_DestroyPrivateKey(pks.u.pubkey->private_key); /* destroy reference */
|
||||
+ type->free_pubkey_content(&pks.u.pubkey->content);
|
||||
|
||||
if (ret < 0) {
|
||||
break;
|
||||
--
|
||||
2.47.0
|
||||
|
||||
|
||||
From 9e9bdbc27aedb035e769660b65a92e173ee9a5f9 Mon Sep 17 00:00:00 2001
|
||||
From: Andrew Cagney <cagney@gnu.org>
|
||||
Date: Fri, 8 Nov 2024 17:45:53 -0500
|
||||
Subject: [PATCH 2/2] crypto: refcnt struct secret_pubkey_stuff when passing to
|
||||
helper thread
|
||||
|
||||
fix problem where a thread was trying to use a key when which
|
||||
was being deleted by reloadsecrets.
|
||||
|
||||
close #1894 Segmentation fault in PK11_SignatureLen (key=0xa5a5a5a5a5a5a5a5)
|
||||
|
||||
Modified-by: Daiki Ueno <dueno@redhat.com>
|
||||
---
|
||||
include/secrets.h | 4 ++++
|
||||
lib/libswan/secrets.c | 23 ++++++++++++++++++-----
|
||||
programs/pluto/ikev2_auth_helper.c | 27 ++++++++++++++++++---------
|
||||
3 files changed, 40 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/include/secrets.h b/include/secrets.h
|
||||
index c9272d71e0..488d12e8c5 100644
|
||||
--- a/include/secrets.h
|
||||
+++ b/include/secrets.h
|
||||
@@ -74,10 +74,14 @@ enum secret_kind {
|
||||
};
|
||||
|
||||
struct secret_pubkey_stuff {
|
||||
+ struct refcnt refcnt;
|
||||
SECKEYPrivateKey *private_key;
|
||||
struct pubkey_content content;
|
||||
};
|
||||
|
||||
+struct secret_pubkey_stuff *secret_pubkey_stuff_addref(struct secret_pubkey_stuff *, where_t where);
|
||||
+void secret_pubkey_stuff_delref(struct secret_pubkey_stuff **, where_t where);
|
||||
+
|
||||
struct secret_stuff {
|
||||
enum secret_kind kind;
|
||||
/*
|
||||
diff --git a/lib/libswan/secrets.c b/lib/libswan/secrets.c
|
||||
index 1088f914af..3fed6a55da 100644
|
||||
--- a/lib/libswan/secrets.c
|
||||
+++ b/lib/libswan/secrets.c
|
||||
@@ -953,10 +953,7 @@ void lsw_free_preshared_secrets(struct secret **psecrets, struct logger *logger)
|
||||
break;
|
||||
case SECRET_RSA:
|
||||
case SECRET_ECDSA:
|
||||
- /* Note: pub is all there is */
|
||||
- SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key);
|
||||
- s->stuff.u.pubkey->content.type->free_pubkey_content(&s->stuff.u.pubkey->content);
|
||||
- pfree(s->stuff.u.pubkey);
|
||||
+ secret_pubkey_stuff_delref(&s->stuff.u.pubkey, HERE);
|
||||
break;
|
||||
default:
|
||||
bad_case(s->stuff.kind);
|
||||
@@ -1173,6 +1170,22 @@ static const struct pubkey_type *private_key_type_nss(SECKEYPrivateKey *private_
|
||||
}
|
||||
}
|
||||
|
||||
+struct secret_pubkey_stuff *secret_pubkey_stuff_addref(struct secret_pubkey_stuff *pks,
|
||||
+ where_t where)
|
||||
+{
|
||||
+ return addref_where(pks, where);
|
||||
+}
|
||||
+
|
||||
+void secret_pubkey_stuff_delref(struct secret_pubkey_stuff **pks, where_t where)
|
||||
+{
|
||||
+ struct secret_pubkey_stuff *last = delref_where(pks, &global_logger, where);
|
||||
+ if (last != NULL) {
|
||||
+ SECKEY_DestroyPrivateKey(last->private_key);
|
||||
+ last->content.type->free_pubkey_content(&last->content);
|
||||
+ pfree(last);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
static err_t add_private_key(struct secret **secrets, const struct secret_stuff **pks,
|
||||
SECKEYPublicKey *pubk, SECItem *ckaid_nss,
|
||||
const struct pubkey_type *type, SECKEYPrivateKey *private_key)
|
||||
@@ -1181,7 +1194,7 @@ static err_t add_private_key(struct secret **secrets, const struct secret_stuff
|
||||
s->stuff.kind = type->private_key_kind;
|
||||
s->stuff.line = 0;
|
||||
/* make an unpacked copy of the private key */
|
||||
- s->stuff.u.pubkey = alloc_thing(struct secret_pubkey_stuff, "secret_pubkey_stuff");
|
||||
+ s->stuff.u.pubkey = refcnt_alloc(struct secret_pubkey_stuff, HERE);
|
||||
s->stuff.u.pubkey->private_key = copy_private_key(private_key);
|
||||
err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey->content,
|
||||
pubk, ckaid_nss);
|
||||
diff --git a/programs/pluto/ikev2_auth_helper.c b/programs/pluto/ikev2_auth_helper.c
|
||||
index 4fe661b559..2973569a90 100644
|
||||
--- a/programs/pluto/ikev2_auth_helper.c
|
||||
+++ b/programs/pluto/ikev2_auth_helper.c
|
||||
@@ -38,7 +38,7 @@ struct task {
|
||||
const struct crypt_mac hash_to_sign;
|
||||
const struct hash_desc *hash_algo;
|
||||
v2_auth_signature_cb *cb;
|
||||
- const struct secret_stuff *pks;
|
||||
+ struct secret_pubkey_stuff *pks;
|
||||
const struct pubkey_signer *signer;
|
||||
/* out */
|
||||
struct hash_signature signature;
|
||||
@@ -63,19 +63,21 @@ bool submit_v2_auth_signature(struct ike_sa *ike, struct msg_digest *md,
|
||||
where_t where)
|
||||
{
|
||||
const struct connection *c = ike->sa.st_connection;
|
||||
+ const struct secret_stuff *s = get_local_private_key(c, signer->type,
|
||||
+ ike->sa.logger);
|
||||
+ if (s == NULL) {
|
||||
+ /* failure: no key to use */
|
||||
+ return false;
|
||||
+ }
|
||||
+
|
||||
struct task task = {
|
||||
.cb = cb,
|
||||
.hash_algo = hash_algo,
|
||||
.hash_to_sign = *hash_to_sign,
|
||||
.signer = signer,
|
||||
- .pks = get_local_private_key(c, signer->type,
|
||||
- ike->sa.logger),
|
||||
+ .pks = secret_pubkey_stuff_addref(s->u.pubkey, HERE),
|
||||
};
|
||||
|
||||
- if (task.pks == NULL)
|
||||
- /* failure: no key to use */
|
||||
- return false;
|
||||
-
|
||||
submit_task(/*callback*/&ike->sa, /*task*/&ike->sa, md,
|
||||
/*detach_whack*/false,
|
||||
clone_thing(task, "signature task"),
|
||||
@@ -86,7 +88,7 @@ bool submit_v2_auth_signature(struct ike_sa *ike, struct msg_digest *md,
|
||||
static struct hash_signature v2_auth_signature(struct logger *logger,
|
||||
const struct crypt_mac *hash_to_sign,
|
||||
const struct hash_desc *hash_algo,
|
||||
- const struct secret_stuff *pks,
|
||||
+ const struct secret_pubkey_stuff *pks,
|
||||
const struct pubkey_signer *signer)
|
||||
{
|
||||
passert(hash_to_sign->len <= sizeof(hash_to_sign->ptr/*array*/)); /*hint to coverity*/
|
||||
@@ -96,8 +98,14 @@ static struct hash_signature v2_auth_signature(struct logger *logger,
|
||||
DBG_dump_hunk("hash to sign", *hash_to_sign);
|
||||
}
|
||||
|
||||
+ struct secret_stuff s = {
|
||||
+ .kind = pks->content.type->private_key_kind,
|
||||
+ .line = 0,
|
||||
+ .u.pubkey = (struct secret_pubkey_stuff *)pks,
|
||||
+ };
|
||||
+
|
||||
logtime_t sign_time = logtime_start(logger);
|
||||
- struct hash_signature sig = signer->sign_hash(pks,
|
||||
+ struct hash_signature sig = signer->sign_hash(&s,
|
||||
hash_to_sign->ptr,
|
||||
hash_to_sign->len,
|
||||
hash_algo,
|
||||
@@ -125,5 +133,6 @@ static stf_status v2_auth_signature_completed(struct state *st,
|
||||
|
||||
static void v2_auth_signature_cleanup(struct task **task)
|
||||
{
|
||||
+ secret_pubkey_stuff_delref(&(*task)->pks, HERE);
|
||||
pfreeany(*task);
|
||||
}
|
||||
--
|
||||
2.47.0
|
||||
|
||||
@ -0,0 +1,17 @@
|
||||
-----BEGIN PGP SIGNATURE-----
|
||||
|
||||
iQJHBAABCgAxFiEEkH55DyXB6OVhzXO1hf9LQ7MPxvkFAmcFdvUTHHRlYW1AbGli
|
||||
cmVzd2FuLm9yZwAKCRCF/0tDsw/G+aDLD/9SxgIFhOgqE+X7HT7JN2bDRyZuEUCP
|
||||
0FK7q2bcBNDgA7AlEiSqYFiHVQcAzmZLrx39IqMfAIGNDoB5jSUUl+Ij4zT/qEfU
|
||||
nMJ1pxt+GqUwOeVkz+89KOS6KkQ9N3W8Y0HZjlI3LB/rvL8+/eytXv9ckbrQZuwL
|
||||
Anqv4pdgYO/ybVF/n8vz/8vgAhDM0Rhm3Xqft4w8sxyWrl3LU11/mmaOyD5eXdCD
|
||||
QvLtvhQg10W+/MKNzrKHfbIgFjtzEeKo3CMSniNAgkHtNwXTVIR09RkACvfCtAhv
|
||||
yO4gmsTl4ftGAtvUeq3pexJsbpyJTywwwCVNFn1ustrwxatbn0oDdo1aqd33Dt/w
|
||||
gb1yt14smwahRyMCROK1Ozrk1KBYl7lQ3eek1SXKEJ33GzxDw6HB2PCy1Y+ni54W
|
||||
NGuN9oJQNVGZiU/kD7mWWWGeHCNetTIZLNRaV7RoGxZFH1zn0n7jvhk5SezPsQNN
|
||||
e4y5HSd8sEoUtmgYN2uf902Iq0Af5QErqieSPCz130F9lndGbGxMlAF64wVgaNfq
|
||||
/jjH8whHkNqWyM3BRQE2tTtpM9AONF9GJ3RgeaAfSLZV2SMeGVs9YPNs4XFqs3xM
|
||||
ToQMCE7OG6VgPQAvE/JnPoTGOk+GX2C+cXi2Vluvc+E3Sw52To+q2ZeQTjr+ejj6
|
||||
EULR5f5plo88uQ==
|
||||
=ieXQ
|
||||
-----END PGP SIGNATURE-----
|
||||
Loading…
Reference in new issue