Compare commits
No commits in common. 'cs10' and 'c9' have entirely different histories.
@ -1,4 +1,4 @@
|
|||||||
SOURCES/ikev1_dsa.fax.bz2
|
SOURCES/ikev1_dsa.fax.bz2
|
||||||
SOURCES/ikev1_psk.fax.bz2
|
SOURCES/ikev1_psk.fax.bz2
|
||||||
SOURCES/ikev2.fax.bz2
|
SOURCES/ikev2.fax.bz2
|
||||||
SOURCES/libreswan-5.1.tar.gz
|
SOURCES/libreswan-4.12.tar.gz
|
||||||
|
|||||||
@ -1,4 +1,4 @@
|
|||||||
b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
|
b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
|
||||||
861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
|
861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
|
||||||
fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
|
fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
|
||||||
12d2ddd7cad4aab849456e2175378f034eab27bb SOURCES/libreswan-5.1.tar.gz
|
786c14a4755311ea3103683a3294e1536b1e44a6 SOURCES/libreswan-4.12.tar.gz
|
||||||
|
|||||||
@ -1,51 +0,0 @@
|
|||||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
|
||||||
|
|
||||||
mQINBFDjilcBEAChkfasfBKTzGys9DwgBsmDVsPConW60uyKnu16+wO1kIKMFWi6
|
|
||||||
wGllwKUJmCBY2FSQHbOBy5eHPPT1ijJhYt4j7WU+YJVh5Ca5RE3trFt31FX0vzp+
|
|
||||||
KMqdQ8HOofA7jO6bgyHUwOJ539YkqYj1jHKfrdRqOnzB9fFyEb7485sq1F8j/rHk
|
|
||||||
cSar1Hd9QfGAZHxXqgncgHFobB/xXEGRJIi+4kNL5SYasbw9tfYUGPrUXVol1+pn
|
|
||||||
tsG92736O5Qe5K+wH2nAS4hwPJ1Xr4XIKeNNwxQW25wWqn4mLa4Vly+PA2uSE7ZP
|
|
||||||
RcxE3yBCaLFMlw4rLhFAzd6TeslQONZ+9K51yfBYm7m0vWM3Ixq8yuD8E49OkKr8
|
|
||||||
QRMaA2g89NW3AuNLExiTE0zQzAs/g6eX8WZdeWCvKxhRTAUYkw0QTimFgv6LXIeS
|
|
||||||
//5DOAAO9WwzlseTGmUgek3BbnnJJiGHVLBgnLaqWLOZ1Y8ON1uC8lQnbIeYbTQq
|
|
||||||
EE5R0cbVLVXBJoKakBF8gwHF51HC2pSBYmHNZsSbjMuHpJWJM4fVldNWPNaqriKC
|
|
||||||
OkL8QgvNoapgk20k1ajLl/ibv32k7QBKy3cTMtbQYPdreXcoZuMw38ysQcgFxPCs
|
|
||||||
Zh92aaWW0ceWowkJ7CFnes2jdPcMSOYE37wodmV3/VV7cusmTD8wikyUdQARAQAB
|
|
||||||
tCxMaWJyZXN3YW4gKFNpZ25pbmcgS2V5KSA8dGVhbUBsaWJyZXN3YW4ub3JnPokC
|
|
||||||
TgQTAQoAOBYhBJB+eQ8lwejlYc1ztYX/S0OzD8b5BQJi4cg4AhsDBQsJCAcDBRUK
|
|
||||||
CQgLBRYCAwEAAh4FAheAAAoJEIX/S0OzD8b5zNcP/RuDb05Xr+IpuGWtJ38yGMWG
|
|
||||||
mZglLHrzCAOXNAr/QXt6Kz3sThJoZFIh2E4Ab5yW59iFLFpW3VuZIGVCyh7vsuVw
|
|
||||||
MuKoJtrZtdbHSdLbE+FHpY7osQDrcuodTv5b7STfG2Wje18iG/dCATVIDDgbPmuJ
|
|
||||||
FpNLcR3scuoIlgxmP3Y1AFgufLR5MiN60PKnS2Husyj0f5Gqc3USLofWKgEQ4wFa
|
|
||||||
gT1iIjkf4zkFcVlJ5K0SE1ULn8K7umkOUvLcKg6ji+1sEwEM1kCNmxI8HkiNt296
|
|
||||||
9Z/TLK1h8McFGwG7x1p8fZ7Kjmzwnv1TSxAt1wHMoa0m9LntQOXnn3hVJaC74AzX
|
|
||||||
heFtqDHmATpcGtQLR0zutrZ+ohUb6AEt+hAPfyDDYIR5y3oNdSLozJkJ1wlrhsYh
|
|
||||||
SR1Hv4b3fdD6XgyUPggituOYm+yv1PuHrSEaoznnlX2z0MaVJyJIN0zUHlPBmWKC
|
|
||||||
LmzQX2A7l9bHhkXYgHoSdeBHdwvcQQGWwkVmN2WUwsM/m9Abk8OdLdE13nI8824R
|
|
||||||
0+b6XzJ2g4L+RIsVseerX2WIMHSMvkbFuLpEE4ILOrL+9Lq5bdx9MvZPtsZ/ZutY
|
|
||||||
QVVvJ+nJtmPp0HpybnJdXzB7Za02A0r2gXIUrund32K97qe8XblCwxkZbZCeLcSL
|
|
||||||
5+mb8O1XPGD39S6CCZbRuQINBFDjilcBEADXDN9o3icyDy+ity45CsQfo1f84xL6
|
|
||||||
oJIgCLGGwm3RFPgOzdgxaE7TiLzW2NBui+yHyw48WRTxZ9XC6HtGKjH6XPvP5nF4
|
|
||||||
8wss7tjzRNzmNgTp7G47HkW3lD0VYX4NqfCmxQK9gTXob1+JFmWkEXkXmZYg2dbn
|
|
||||||
1REtHb03x370Z547rjvdpopQW6jaSw0C556DOxb9weJqLqAd2uZO4nwhuDs/VM+Q
|
|
||||||
yy+/MlHTbnsmnYIMozDLMmHZ1PMeJlTFPMfapaux9UDTgQ5dwLj2FiQ/uEMzvfVv
|
|
||||||
W23hxlpWVHsccwZR77PMDt4Nbj/7QlOIKpgid2r8SyBmhjET2u/USSzFYzK8J2Wj
|
|
||||||
oLcxiuMTwrnM6b3bqiuSDUMAEoNN814Cbpz6yLB2wyKs5N7ZA/lVLNE8MV7to8OD
|
|
||||||
ww1nS2bDDf5/JMNt5aWu/iO2bBrYE30LqHR3bSV6QP57JnzunM9Y4V1BnEKYW14A
|
|
||||||
9+rRH1k1e5CuS5tqxpSubniF80AdUyPjF8rXOY0URD6zY0s4843Nf9TNr8ke/1ma
|
|
||||||
qLEkUAF03AwBR8oz247ylu75q94ytpYUFJAkNeqpk8XypqKJMVcl4NfEP930JR82
|
|
||||||
sGjNylVu/b4EsqKfmkoU8VFM1lfuaqX1u2ZDoUpG2Io/zpeV07RQ0KTHdKBejzix
|
|
||||||
2IN0T7W4G0JXcwARAQABiQIfBBgBAgAJBQJQ44pXAhsMAAoJEIX/S0OzD8b5KR8P
|
|
||||||
/jdWNVVw74/oCPtt79V1r0XN4I0ZBTQZgKp3JmZdcZlS2Uzx4u1VhxcevDQ7fh/Z
|
|
||||||
5Y1xDBh+IKwF83hJKXy56+PJBlYIGjc2GTEmU1yo4E9iudPq56FFb6eelX1qBfxI
|
|
||||||
0ZHdWgzWmrtnCF65zGTmeYMpck4ZuKdJAX2AM6kWcBikt4jT/SqrcS8t/duWRSSV
|
|
||||||
iikwXD8aPexAz9XuezI+y3Exupt/lqUyVtCV3t0/gWRAMuwrMH/RABEPTaQdmxKz
|
|
||||||
i0OkMDlHhweXZWg0/t32XLhhmy4f/30NhKYnntN6/pdNDb8vin5OP2MRyJDHIykA
|
|
||||||
2HZcYvjdZS43+PbiuqDCTILMvxUDYjxHszgEheLariRvmRwE1HRjZWNTzGTjUgyv
|
|
||||||
83XUhrIoAlgMVy2tQAatKbNVYAn5dmA0NCDKnSszas43gApSSjh2UXmq/owwpVj6
|
|
||||||
zYHcoV0gdCuLJ1BPLstN0ZGO+g+eRpTI97+/04sgz/hImDsm7G3Diners/FDaebt
|
|
||||||
pMRzVshh5lIgVBnCT36hdHW8buyiAgRQtjq7bX8JLN4Ermxlq4a33OYc7TGNC3jF
|
|
||||||
Rm4XSY6RUDMd6uhRD5hKZB2N8az079603K7nc93x32CualHCJD+M7Z2/j9r3T3Tc
|
|
||||||
y69oM+pgP48wySo+XEGHCM5OG7YNNiJ8xQ/J+CKCyLQV
|
|
||||||
=ZaKB
|
|
||||||
-----END PGP PUBLIC KEY BLOCK-----
|
|
||||||
@ -0,0 +1,92 @@
|
|||||||
|
From 5101913b1e623121a9222f11eefa18f0a2708b00 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Wed, 27 Mar 2024 10:43:19 -0400
|
||||||
|
Subject: [PATCH] ikev1: in compute_proto_keymat() only allow explicitly
|
||||||
|
handled ESP algorithms
|
||||||
|
|
||||||
|
---
|
||||||
|
programs/pluto/ikev1_quick.c | 41 ++++++++++++++----------------------
|
||||||
|
1 file changed, 16 insertions(+), 25 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/programs/pluto/ikev1_quick.c b/programs/pluto/ikev1_quick.c
|
||||||
|
index 81c522c148..22c346afb4 100644
|
||||||
|
--- a/programs/pluto/ikev1_quick.c
|
||||||
|
+++ b/programs/pluto/ikev1_quick.c
|
||||||
|
@@ -203,7 +203,7 @@ static bool emit_subnet_id(enum perspective perspective,
|
||||||
|
* RFC 2409 "IKE" section 5.5
|
||||||
|
* specifies how this is to be done.
|
||||||
|
*/
|
||||||
|
-static void compute_proto_keymat(struct state *st,
|
||||||
|
+static bool compute_proto_keymat(struct state *st,
|
||||||
|
uint8_t protoid,
|
||||||
|
struct ipsec_proto_info *pi,
|
||||||
|
const char *satypename)
|
||||||
|
@@ -297,27 +297,13 @@ static void compute_proto_keymat(struct state *st,
|
||||||
|
}
|
||||||
|
break;
|
||||||
|
|
||||||
|
- case ESP_CAST:
|
||||||
|
- case ESP_TWOFISH:
|
||||||
|
- case ESP_SERPENT:
|
||||||
|
- /* ESP_SEED is for IKEv1 only and not supported. Its number in IKEv2 has been re-used */
|
||||||
|
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
|
||||||
|
-
|
||||||
|
default:
|
||||||
|
- /* bytes */
|
||||||
|
- needed_len = encrypt_max_key_bit_length(pi->attrs.transattrs.ta_encrypt) / BITS_PER_BYTE;
|
||||||
|
- if (needed_len > 0) {
|
||||||
|
- /* XXX: check key_len coupling with kernel.c's */
|
||||||
|
- if (pi->attrs.transattrs.enckeylen) {
|
||||||
|
- needed_len =
|
||||||
|
- pi->attrs.transattrs.enckeylen
|
||||||
|
- / BITS_PER_BYTE;
|
||||||
|
- dbg("compute_proto_keymat: key_len=%d from peer",
|
||||||
|
- (int)needed_len);
|
||||||
|
- }
|
||||||
|
- break;
|
||||||
|
- }
|
||||||
|
- bad_case(pi->attrs.transattrs.ta_ikev1_encrypt);
|
||||||
|
+ {
|
||||||
|
+ enum_buf eb;
|
||||||
|
+ llog(RC_LOG, st->st_logger, "rejecting request for keymat for %s",
|
||||||
|
+ str_enum(&esp_transformid_names, protoid, &eb));
|
||||||
|
+ return false;
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
dbg("compute_proto_keymat: needed_len (after ESP enc)=%d", (int)needed_len);
|
||||||
|
needed_len += pi->attrs.transattrs.ta_integ->integ_keymat_size;
|
||||||
|
@@ -359,14 +345,17 @@ static void compute_proto_keymat(struct state *st,
|
||||||
|
DBG_dump_hunk(" inbound:", pi->inbound.keymat);
|
||||||
|
DBG_dump_hunk(" outbound:", pi->outbound.keymat);
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
-static void compute_keymats(struct state *st)
|
||||||
|
+static bool compute_keymats(struct state *st)
|
||||||
|
{
|
||||||
|
if (st->st_ah.present)
|
||||||
|
- compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
|
||||||
|
+ return compute_proto_keymat(st, PROTO_IPSEC_AH, &st->st_ah, "AH");
|
||||||
|
if (st->st_esp.present)
|
||||||
|
- compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
|
||||||
|
+ return compute_proto_keymat(st, PROTO_IPSEC_ESP, &st->st_esp, "ESP");
|
||||||
|
+ return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
@@ -1460,7 +1449,9 @@ static stf_status quick_inI1_outR1_continue12_tail(struct state *st, struct msg_
|
||||||
|
fixup_v1_HASH(st, &hash_fixup, st->st_v1_msgid.id, rbody.cur);
|
||||||
|
|
||||||
|
/* Derive new keying material */
|
||||||
|
- compute_keymats(st);
|
||||||
|
+ if (!compute_keymats(st)) {
|
||||||
|
+ return STF_FATAL;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
/* Tell the kernel to establish the new inbound SA
|
||||||
|
* (unless the commit bit is set -- which we don't support).
|
||||||
|
--
|
||||||
|
2.45.0
|
||||||
|
|
||||||
@ -0,0 +1,54 @@
|
|||||||
|
From 2ec448884a7467743699803f8a36ee28d237666c Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Wed, 28 Feb 2024 08:29:53 -0500
|
||||||
|
Subject: [PATCH] ikev2: return STF_FATAL when initiator fails to emit AUTH
|
||||||
|
packet
|
||||||
|
|
||||||
|
---
|
||||||
|
programs/pluto/ikev2_ike_auth.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
|
||||||
|
index 192eb1b3b6..a54a109699 100644
|
||||||
|
--- a/programs/pluto/ikev2_ike_auth.c
|
||||||
|
+++ b/programs/pluto/ikev2_ike_auth.c
|
||||||
|
@@ -1267,7 +1267,7 @@ static stf_status process_v2_IKE_AUTH_request_auth_signature_continue(struct ike
|
||||||
|
/* now send AUTH payload */
|
||||||
|
|
||||||
|
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, response.pbs)) {
|
||||||
|
- return STF_INTERNAL_ERROR;
|
||||||
|
+ return STF_FATAL;
|
||||||
|
}
|
||||||
|
ike->sa.st_v2_ike_intermediate.used = false;
|
||||||
|
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
||||||
|
From 16272f2475d25baab58fbed2af7c67cfb459137f Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Thu, 29 Feb 2024 12:19:20 -0500
|
||||||
|
Subject: [PATCH] ikev2: always return STF_FATAL if emitting AUTH fails
|
||||||
|
|
||||||
|
Fix:
|
||||||
|
ikev2: return STF_FATAL when initiator fails to emit AUTH packet
|
||||||
|
which really fixed the responder.
|
||||||
|
---
|
||||||
|
programs/pluto/ikev2_ike_auth.c | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/programs/pluto/ikev2_ike_auth.c b/programs/pluto/ikev2_ike_auth.c
|
||||||
|
index a54a109699..491053fb10 100644
|
||||||
|
--- a/programs/pluto/ikev2_ike_auth.c
|
||||||
|
+++ b/programs/pluto/ikev2_ike_auth.c
|
||||||
|
@@ -397,7 +397,7 @@ stf_status initiate_v2_IKE_AUTH_request_signature_continue(struct ike_sa *ike,
|
||||||
|
/* send out the AUTH payload */
|
||||||
|
|
||||||
|
if (!emit_local_v2AUTH(ike, auth_sig, &ike->sa.st_v2_id_payload.mac, request.pbs)) {
|
||||||
|
- return STF_INTERNAL_ERROR;
|
||||||
|
+ return STF_FATAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (LIN(POLICY_MOBIKE, ike->sa.st_connection->policy)) {
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
||||||
@ -0,0 +1,198 @@
|
|||||||
|
From 474d75be074799efa9e38f346d3fdb76dec3eead Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Tue, 5 Dec 2023 13:55:37 -0500
|
||||||
|
Subject: [PATCH] x509: unpack IPv6 general names based on length
|
||||||
|
|
||||||
|
fix #1321
|
||||||
|
---
|
||||||
|
programs/pluto/x509.c | 35 +++++++++++++++++++++++++++++------
|
||||||
|
1 file changed, 29 insertions(+), 6 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/programs/pluto/x509.c b/programs/pluto/x509.c
|
||||||
|
index fbbf5a553e..f7e97b9979 100644
|
||||||
|
--- a/programs/pluto/x509.c
|
||||||
|
+++ b/programs/pluto/x509.c
|
||||||
|
@@ -336,7 +336,7 @@ generalName_t *collect_rw_ca_candidates(struct msg_digest *md)
|
||||||
|
*/
|
||||||
|
static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger)
|
||||||
|
{
|
||||||
|
- *id = empty_id;
|
||||||
|
+ *id = empty_id; /* aka ID_NONE */
|
||||||
|
|
||||||
|
switch (gn->kind) {
|
||||||
|
case GN_DNS_NAME: /* ID type: ID_FQDN */
|
||||||
|
@@ -345,18 +345,37 @@ static void gntoid(struct id *id, const generalName_t *gn, struct logger *logger
|
||||||
|
break;
|
||||||
|
case GN_IP_ADDRESS: /* ID type: ID_IPV4_ADDR */
|
||||||
|
{
|
||||||
|
+ const struct ip_info *afi = NULL;
|
||||||
|
+ for (enum ip_index i = 0; i < IP_INDEX_ROOF; i++) {
|
||||||
|
+ if (ip_families[i].ip_size == gn->name.len) {
|
||||||
|
+ afi = &ip_families[i];
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ if (afi == NULL) {
|
||||||
|
+ llog(RC_LOG, logger,
|
||||||
|
+ "warning: invalid IP_ADDRESS general name: %zu byte length is not valid",
|
||||||
|
+ gn->name.len);
|
||||||
|
+ PEXPECT(logger, id->kind == ID_NONE);
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/*
|
||||||
|
* XXX: why could this fail; and what happens when it
|
||||||
|
* is ignored?
|
||||||
|
*/
|
||||||
|
- const struct ip_info *afi = &ipv4_info;
|
||||||
|
- id->kind = afi->id_ip_addr;
|
||||||
|
- err_t ugh = hunk_to_address(gn->name, afi, &id->ip_addr);
|
||||||
|
+ ip_address addr;
|
||||||
|
+ err_t ugh = hunk_to_address(gn->name, afi, &addr);
|
||||||
|
if (ugh != NULL) {
|
||||||
|
llog(RC_LOG, logger,
|
||||||
|
- "warning: gntoid() failed to initaddr(): %s",
|
||||||
|
- ugh);
|
||||||
|
+ "warning: invalid IP_ADDRESS general name: %s",
|
||||||
|
+ ugh);
|
||||||
|
+ PEXPECT(logger, id->kind == ID_NONE);
|
||||||
|
+ return;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+ id->kind = afi->id_ip_addr;
|
||||||
|
+ id->ip_addr = addr;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
case GN_RFC822_NAME: /* ID type: ID_USER_FQDN */
|
||||||
|
@@ -464,14 +483,18 @@ bool add_pubkey_from_nss_cert(struct pubkey_list **pubkey_db,
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ ldbg(logger, "adding cert using subject name");
|
||||||
|
replace_public_key(pubkey_db, &pk);
|
||||||
|
passert(pk == NULL); /*stolen*/
|
||||||
|
|
||||||
|
+ ldbg(logger, "adding cert using general names");
|
||||||
|
add_cert_san_pubkeys(pubkey_db, cert, logger);
|
||||||
|
|
||||||
|
if (keyid != NULL && keyid->kind != ID_DER_ASN1_DN &&
|
||||||
|
keyid->kind != ID_NONE &&
|
||||||
|
keyid->kind != ID_FROMCERT) {
|
||||||
|
+ id_buf idb;
|
||||||
|
+ ldbg(logger, "adding cert using keyid %s", str_id(keyid, &idb));
|
||||||
|
struct pubkey *pk2 = NULL;
|
||||||
|
diag_t d = create_pubkey_from_cert(keyid, cert, &pk2, logger);
|
||||||
|
if (d != NULL) {
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
||||||
|
From 1e27be95cd710a840681d1a51913e6a32ce75a2a Mon Sep 17 00:00:00 2001
|
||||||
|
From: Andrew Cagney <cagney@gnu.org>
|
||||||
|
Date: Mon, 11 Mar 2024 17:18:51 -0400
|
||||||
|
Subject: [PATCH] building: back-port ip_families[] and ip_index
|
||||||
|
|
||||||
|
---
|
||||||
|
include/ip_index.h | 27 +++++++++++++++++++++++++++
|
||||||
|
include/ip_info.h | 7 +++++--
|
||||||
|
lib/libswan/ip_info.c | 9 ++++++---
|
||||||
|
3 files changed, 38 insertions(+), 5 deletions(-)
|
||||||
|
create mode 100644 include/ip_index.h
|
||||||
|
|
||||||
|
diff --git a/include/ip_index.h b/include/ip_index.h
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..508589b05e
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/include/ip_index.h
|
||||||
|
@@ -0,0 +1,27 @@
|
||||||
|
+/* ip address type index, for libreswan
|
||||||
|
+ *
|
||||||
|
+ * Copyright (C) 2022 Andrew Cagney
|
||||||
|
+ *
|
||||||
|
+ * This library is free software; you can redistribute it and/or modify it
|
||||||
|
+ * under the terms of the GNU Library General Public License as published by
|
||||||
|
+ * the Free Software Foundation; either version 2 of the License, or (at your
|
||||||
|
+ * option) any later version. See <https://www.gnu.org/licenses/lgpl-2.1.txt>.
|
||||||
|
+ *
|
||||||
|
+ * This library is distributed in the hope that it will be useful, but
|
||||||
|
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||||
|
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Library General Public
|
||||||
|
+ * License for more details.
|
||||||
|
+ *
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+#ifndef IP_INDEX_H
|
||||||
|
+#define IP_INDEX_H
|
||||||
|
+
|
||||||
|
+enum ip_index {
|
||||||
|
+ IPv4_INDEX,
|
||||||
|
+ IPv6_INDEX,
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+#define IP_INDEX_ROOF (IPv6_INDEX+1)
|
||||||
|
+
|
||||||
|
+#endif
|
||||||
|
diff --git a/include/ip_info.h b/include/ip_info.h
|
||||||
|
index 40e99ef687..c1329a8569 100644
|
||||||
|
--- a/include/ip_info.h
|
||||||
|
+++ b/include/ip_info.h
|
||||||
|
@@ -9,6 +9,7 @@
|
||||||
|
#include "ip_subnet.h"
|
||||||
|
#include "ip_selector.h"
|
||||||
|
#include "ip_sockaddr.h"
|
||||||
|
+#include "ip_index.h"
|
||||||
|
|
||||||
|
struct ip_info {
|
||||||
|
/*
|
||||||
|
@@ -113,8 +114,10 @@ struct ip_info {
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
-extern const struct ip_info ipv4_info;
|
||||||
|
-extern const struct ip_info ipv6_info;
|
||||||
|
+extern const struct ip_info ip_families[IP_INDEX_ROOF];
|
||||||
|
+
|
||||||
|
+#define ipv4_info ip_families[IPv4_INDEX]
|
||||||
|
+#define ipv6_info ip_families[IPv6_INDEX]
|
||||||
|
|
||||||
|
extern const struct ip_info *aftoinfo(int af);
|
||||||
|
|
||||||
|
diff --git a/lib/libswan/ip_info.c b/lib/libswan/ip_info.c
|
||||||
|
index 70cd6a368f..97296d3a11 100644
|
||||||
|
--- a/lib/libswan/ip_info.c
|
||||||
|
+++ b/lib/libswan/ip_info.c
|
||||||
|
@@ -158,7 +158,9 @@ static ip_port port_from_ipv6_sockaddr(const ip_sockaddr sa)
|
||||||
|
|
||||||
|
#define IPv4_FF { { 255, 255, 255, 255, }, }
|
||||||
|
|
||||||
|
-const struct ip_info ipv4_info = {
|
||||||
|
+const struct ip_info ip_families[IP_INDEX_ROOF] = {
|
||||||
|
+
|
||||||
|
+ [IPv4_INDEX] = {
|
||||||
|
|
||||||
|
.ip_version = IPv4,
|
||||||
|
.ip_size = sizeof(struct in_addr),
|
||||||
|
@@ -210,11 +212,11 @@ const struct ip_info ipv4_info = {
|
||||||
|
.id_ip_addr = ID_IPV4_ADDR,
|
||||||
|
.id_ip_addr_subnet = ID_IPV4_ADDR_SUBNET,
|
||||||
|
.id_ip_addr_range = ID_IPV4_ADDR_RANGE,
|
||||||
|
-};
|
||||||
|
+ },
|
||||||
|
|
||||||
|
#define IPv6_FF { { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, }, }
|
||||||
|
|
||||||
|
-const struct ip_info ipv6_info = {
|
||||||
|
+ [IPv6_INDEX] = {
|
||||||
|
|
||||||
|
.ip_version = IPv6,
|
||||||
|
.ip_size = sizeof(struct in6_addr),
|
||||||
|
@@ -266,6 +268,7 @@ const struct ip_info ipv6_info = {
|
||||||
|
.id_ip_addr = ID_IPV6_ADDR,
|
||||||
|
.id_ip_addr_subnet = ID_IPV6_ADDR_SUBNET,
|
||||||
|
.id_ip_addr_range = ID_IPV6_ADDR_RANGE,
|
||||||
|
+ }
|
||||||
|
};
|
||||||
|
|
||||||
|
const struct ip_info *aftoinfo(int af)
|
||||||
|
--
|
||||||
|
2.44.0
|
||||||
|
|
||||||
@ -1,20 +0,0 @@
|
|||||||
diff --git a/programs/ipsec/ipsec.in b/programs/ipsec/ipsec.in
|
|
||||||
index 40ff9f4138..41813b5258 100755
|
|
||||||
--- a/programs/ipsec/ipsec.in
|
|
||||||
+++ b/programs/ipsec/ipsec.in
|
|
||||||
@@ -758,7 +758,14 @@ ipsec_import() {
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
- pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
|
|
||||||
+ # First try blanc password to avoid uselessly prompting interactively
|
|
||||||
+ pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}" -W '' 2>/dev/null
|
|
||||||
+ # check for SEC_ERROR_BAD_PASSWORD
|
|
||||||
+ if [ $? -eq 18 ]; then
|
|
||||||
+ # Not the empty password
|
|
||||||
+ pk12util -i "${pkcs12bundle}" -d "${IPSEC_NSSDIR_SQL}"
|
|
||||||
+ fi
|
|
||||||
+
|
|
||||||
# check and correct trust bits
|
|
||||||
set_nss_db_trusts
|
|
||||||
exit 0
|
|
||||||
@ -0,0 +1,63 @@
|
|||||||
|
From 13720e0dedcab1eaf3334a73a42b68581acd9f3b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
|
||||||
|
Date: Fri, 7 Jan 2022 18:36:47 -0500
|
||||||
|
Subject: [PATCH] ikev1-policy defaults to drop
|
||||||
|
|
||||||
|
IKEv2 has been available for 16 years (RFC 4306 was published December
|
||||||
|
2005). At some point, we should be discouraging IKEv1 adoption.
|
||||||
|
|
||||||
|
To the extent that a user needs IKEv1, they can manually add
|
||||||
|
ikev1-policy=accept to /etc/ipsec.conf.
|
||||||
|
---
|
||||||
|
configs/d.ipsec.conf/ikev1-policy.xml | 7 ++++---
|
||||||
|
include/ipsecconf/keywords.h | 2 +-
|
||||||
|
lib/libipsecconf/confread.c | 1 +
|
||||||
|
programs/pluto/server.c | 5 -----
|
||||||
|
4 files changed, 6 insertions(+), 9 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/configs/d.ipsec.conf/ikev1-policy.xml b/configs/d.ipsec.conf/ikev1-policy.xml
|
||||||
|
index 17d1747e3b..3bd6702564 100644
|
||||||
|
--- a/configs/d.ipsec.conf/ikev1-policy.xml
|
||||||
|
+++ b/configs/d.ipsec.conf/ikev1-policy.xml
|
||||||
|
@@ -3,9 +3,10 @@
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
What to do with received IKEv1 packets. Valid options are
|
||||||
|
-<emphasis remap='B'>accept</emphasis> (default), <emphasis remap='B'>reject</emphasis> which
|
||||||
|
-will reply with an error, and <emphasis remap='B'>drop</emphasis> which will silently drop
|
||||||
|
-any received IKEv1 packet. If this option is set to drop or reject, an attempt to load an
|
||||||
|
+<emphasis remap='B'>drop</emphasis> (default) which will silently drop
|
||||||
|
+any received IKEv1 packet, <emphasis remap='B'>accept</emphasis>, and
|
||||||
|
+<emphasis remap='B'>reject</emphasis> which will reply with an error.
|
||||||
|
+If this option is set to drop or reject, an attempt to load an
|
||||||
|
IKEv1 connection will fail, as these connections would never be able to receive a packet
|
||||||
|
for processing.
|
||||||
|
</para>
|
||||||
|
diff --git a/include/ipsecconf/keywords.h b/include/ipsecconf/keywords.h
|
||||||
|
index 660847733c..31b519242a 100644
|
||||||
|
--- a/include/ipsecconf/keywords.h
|
||||||
|
+++ b/include/ipsecconf/keywords.h
|
||||||
|
@@ -111,7 +111,7 @@ enum keyword_numeric_config_field {
|
||||||
|
|
||||||
|
KBF_LISTEN_TCP, /* listen on TCP port 4500 - default no */
|
||||||
|
KBF_LISTEN_UDP, /* listen on UDP port 500/4500 - default yes */
|
||||||
|
- KBF_GLOBAL_IKEv1, /* global ikev1 policy - default accept */
|
||||||
|
+ KBF_GLOBAL_IKEv1, /* global ikev1 policy - default drop */
|
||||||
|
KBF_ROOF
|
||||||
|
};
|
||||||
|
|
||||||
|
diff --git a/lib/libipsecconf/confread.c b/lib/libipsecconf/confread.c
|
||||||
|
index 5b5aba723f..68fbccf442 100644
|
||||||
|
--- a/lib/libipsecconf/confread.c
|
||||||
|
+++ b/lib/libipsecconf/confread.c
|
||||||
|
@@ -95,6 +95,7 @@ static void ipsecconf_default_values(struct starter_config *cfg)
|
||||||
|
/* Don't inflict BSI requirements on everyone */
|
||||||
|
SOPT(KBF_SEEDBITS, 0);
|
||||||
|
SOPT(KBF_DROP_OPPO_NULL, false);
|
||||||
|
+ SOPT(KBF_GLOBAL_IKEv1, GLOBAL_IKEv1_DROP);
|
||||||
|
|
||||||
|
#ifdef HAVE_LABELED_IPSEC
|
||||||
|
SOPT(KBF_SECCTX, SECCTX);
|
||||||
|
--
|
||||||
|
2.34.1
|
||||||
|
|
||||||
@ -1,582 +0,0 @@
|
|||||||
From ddf4fcee5812e453f784e7b453f52d242baf060c Mon Sep 17 00:00:00 2001
|
|
||||||
From: Daiki Ueno <dueno@redhat.com>
|
|
||||||
Date: Sat, 23 Nov 2024 10:18:03 +0900
|
|
||||||
Subject: [PATCH 1/2] secrets: allocate secret_pubkey_stuff separately from
|
|
||||||
heap
|
|
||||||
|
|
||||||
Signed-off-by: Daiki Ueno <dueno@redhat.com>
|
|
||||||
---
|
|
||||||
include/secrets.h | 2 +-
|
|
||||||
lib/libswan/pubkey_ecdsa.c | 10 +++---
|
|
||||||
lib/libswan/pubkey_rsa.c | 18 +++++------
|
|
||||||
.../secret_pubkey_stuff_to_pubkey_der.c | 2 +-
|
|
||||||
lib/libswan/secrets.c | 32 ++++++++++---------
|
|
||||||
programs/pluto/ikev2_eap.c | 2 +-
|
|
||||||
programs/pluto/keys.c | 6 ++--
|
|
||||||
programs/showhostkey/showhostkey.c | 31 ++++++++++--------
|
|
||||||
8 files changed, 54 insertions(+), 49 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/include/secrets.h b/include/secrets.h
|
|
||||||
index 8f9f990c10..c9272d71e0 100644
|
|
||||||
--- a/include/secrets.h
|
|
||||||
+++ b/include/secrets.h
|
|
||||||
@@ -88,7 +88,7 @@ struct secret_stuff {
|
|
||||||
int line;
|
|
||||||
union {
|
|
||||||
chunk_t preshared_secret;
|
|
||||||
- struct secret_pubkey_stuff pubkey;
|
|
||||||
+ struct secret_pubkey_stuff *pubkey;
|
|
||||||
} u;
|
|
||||||
|
|
||||||
chunk_t ppk;
|
|
||||||
diff --git a/lib/libswan/pubkey_ecdsa.c b/lib/libswan/pubkey_ecdsa.c
|
|
||||||
index f8d0fe5dae..a4250d9356 100644
|
|
||||||
--- a/lib/libswan/pubkey_ecdsa.c
|
|
||||||
+++ b/lib/libswan/pubkey_ecdsa.c
|
|
||||||
@@ -288,7 +288,7 @@ static struct hash_signature ECDSA_raw_sign_hash(const struct secret_stuff *pks,
|
|
||||||
{
|
|
||||||
ldbgf(DBG_CRYPT, logger, "%s: started using NSS", __func__);
|
|
||||||
|
|
||||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
|
||||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
|
||||||
dbg("no private key!");
|
|
||||||
return (struct hash_signature) { .len = 0, };
|
|
||||||
}
|
|
||||||
@@ -304,7 +304,7 @@ static struct hash_signature ECDSA_raw_sign_hash(const struct secret_stuff *pks,
|
|
||||||
/* point signature at the SIG_VAL buffer */
|
|
||||||
struct hash_signature signature = {0};
|
|
||||||
SECItem raw_signature;
|
|
||||||
- SECStatus s = SGN_Digest(pks->u.pubkey.private_key,
|
|
||||||
+ SECStatus s = SGN_Digest(pks->u.pubkey->private_key,
|
|
||||||
hash_alg->nss.oid_tag,
|
|
||||||
&raw_signature, &hash_to_sign);
|
|
||||||
if (s != SECSuccess) {
|
|
||||||
@@ -411,7 +411,7 @@ static struct hash_signature ECDSA_digsig_sign_hash(const struct secret_stuff *p
|
|
||||||
struct logger *logger)
|
|
||||||
{
|
|
||||||
|
|
||||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
|
||||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
|
||||||
dbg("no private key!");
|
|
||||||
return (struct hash_signature) { .len = 0, };
|
|
||||||
}
|
|
||||||
@@ -429,14 +429,14 @@ static struct hash_signature ECDSA_digsig_sign_hash(const struct secret_stuff *p
|
|
||||||
uint8_t raw_signature_data[sizeof(struct hash_signature)];
|
|
||||||
SECItem raw_signature = {
|
|
||||||
.type = siBuffer,
|
|
||||||
- .len = PK11_SignatureLen(pks->u.pubkey.private_key),
|
|
||||||
+ .len = PK11_SignatureLen(pks->u.pubkey->private_key),
|
|
||||||
.data = raw_signature_data,
|
|
||||||
};
|
|
||||||
passert(raw_signature.len <= sizeof(raw_signature_data));
|
|
||||||
dbg("ECDSA signature.len %d", raw_signature.len);
|
|
||||||
|
|
||||||
/* create the raw signature */
|
|
||||||
- SECStatus s = PK11_Sign(pks->u.pubkey.private_key, &raw_signature, &hash_to_sign);
|
|
||||||
+ SECStatus s = PK11_Sign(pks->u.pubkey->private_key, &raw_signature, &hash_to_sign);
|
|
||||||
if (DBGP(DBG_CRYPT)) {
|
|
||||||
DBG_dump("sig_from_nss", raw_signature.data, raw_signature.len);
|
|
||||||
}
|
|
||||||
diff --git a/lib/libswan/pubkey_rsa.c b/lib/libswan/pubkey_rsa.c
|
|
||||||
index 78620620d6..796748bdaa 100644
|
|
||||||
--- a/lib/libswan/pubkey_rsa.c
|
|
||||||
+++ b/lib/libswan/pubkey_rsa.c
|
|
||||||
@@ -350,7 +350,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk
|
|
||||||
return (struct hash_signature) { .len = 0, };
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
|
||||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
|
||||||
dbg("no private key!");
|
|
||||||
return (struct hash_signature) { .len = 0, };
|
|
||||||
}
|
|
||||||
@@ -361,7 +361,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk
|
|
||||||
.data = DISCARD_CONST(uint8_t *, hash_val),
|
|
||||||
};
|
|
||||||
|
|
||||||
- struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey.private_key), };
|
|
||||||
+ struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey->private_key), };
|
|
||||||
passert(sig.len <= sizeof(sig.ptr/*array*/));
|
|
||||||
SECItem signature = {
|
|
||||||
.type = siBuffer,
|
|
||||||
@@ -369,7 +369,7 @@ static struct hash_signature RSA_sign_hash_raw_rsa(const struct secret_stuff *pk
|
|
||||||
.data = sig.ptr,
|
|
||||||
};
|
|
||||||
|
|
||||||
- SECStatus s = PK11_Sign(pks->u.pubkey.private_key, &signature, &data);
|
|
||||||
+ SECStatus s = PK11_Sign(pks->u.pubkey->private_key, &signature, &data);
|
|
||||||
if (s != SECSuccess) {
|
|
||||||
/* PR_GetError() returns the thread-local error */
|
|
||||||
llog_nss_error(RC_LOG, logger,
|
|
||||||
@@ -485,7 +485,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
|
|
||||||
{
|
|
||||||
dbg("%s: started using NSS", __func__);
|
|
||||||
|
|
||||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
|
||||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
|
||||||
dbg("no private key!");
|
|
||||||
return (struct hash_signature) { .len = 0, };
|
|
||||||
}
|
|
||||||
@@ -501,7 +501,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
|
|
||||||
* used to generate the signature.
|
|
||||||
*/
|
|
||||||
SECItem signature_result = {0};
|
|
||||||
- SECStatus s = SGN_Digest(pks->u.pubkey.private_key,
|
|
||||||
+ SECStatus s = SGN_Digest(pks->u.pubkey->private_key,
|
|
||||||
hash_algo->nss.oid_tag,
|
|
||||||
&signature_result, &digest);
|
|
||||||
if (s != SECSuccess) {
|
|
||||||
@@ -516,7 +516,7 @@ static struct hash_signature RSA_sign_hash_pkcs1_1_5_rsa(const struct secret_stu
|
|
||||||
/* save the signature, free the returned pointer */
|
|
||||||
|
|
||||||
struct hash_signature signature = {
|
|
||||||
- .len = PK11_SignatureLen(pks->u.pubkey.private_key),
|
|
||||||
+ .len = PK11_SignatureLen(pks->u.pubkey->private_key),
|
|
||||||
};
|
|
||||||
passert(signature.len <= sizeof(signature.ptr/*array*/));
|
|
||||||
memcpy(signature.ptr, signature_result.data, signature.len);
|
|
||||||
@@ -629,7 +629,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff
|
|
||||||
{
|
|
||||||
dbg("%s: started using NSS", __func__);
|
|
||||||
|
|
||||||
- if (!pexpect(pks->u.pubkey.private_key != NULL)) {
|
|
||||||
+ if (!pexpect(pks->u.pubkey->private_key != NULL)) {
|
|
||||||
dbg("no private key!");
|
|
||||||
return (struct hash_signature) { .len = 0, };
|
|
||||||
}
|
|
||||||
@@ -640,7 +640,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff
|
|
||||||
.data = DISCARD_CONST(uint8_t *, hash_val),
|
|
||||||
};
|
|
||||||
|
|
||||||
- struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey.private_key), };
|
|
||||||
+ struct hash_signature sig = { .len = PK11_SignatureLen(pks->u.pubkey->private_key), };
|
|
||||||
passert(sig.len <= sizeof(sig.ptr/*array*/));
|
|
||||||
SECItem signature = {
|
|
||||||
.type = siBuffer,
|
|
||||||
@@ -661,7 +661,7 @@ static struct hash_signature RSA_sign_hash_rsassa_pss(const struct secret_stuff
|
|
||||||
.data = (void*)mech, /* strip const */
|
|
||||||
.len = sizeof(*mech),
|
|
||||||
};
|
|
||||||
- SECStatus s = PK11_SignWithMechanism(pks->u.pubkey.private_key, CKM_RSA_PKCS_PSS,
|
|
||||||
+ SECStatus s = PK11_SignWithMechanism(pks->u.pubkey->private_key, CKM_RSA_PKCS_PSS,
|
|
||||||
&mech_item, &signature, &data);
|
|
||||||
if (s != SECSuccess) {
|
|
||||||
/* PR_GetError() returns the thread-local error */
|
|
||||||
diff --git a/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c b/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c
|
|
||||||
index 1b5de6917e..3f28cbd765 100644
|
|
||||||
--- a/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c
|
|
||||||
+++ b/lib/libswan/secret_pubkey_stuff_to_pubkey_der.c
|
|
||||||
@@ -32,7 +32,7 @@ static diag_t seckey_pubkey_to_der(SECKEYPublicKey *seckey_pubkey, chunk_t *der)
|
|
||||||
|
|
||||||
diag_t secret_pubkey_stuff_to_pubkey_der(struct secret_stuff *pks, chunk_t *der)
|
|
||||||
{
|
|
||||||
- SECKEYPublicKey *seckey_pubkey = SECKEY_ConvertToPublicKey(pks->u.pubkey.private_key);
|
|
||||||
+ SECKEYPublicKey *seckey_pubkey = SECKEY_ConvertToPublicKey(pks->u.pubkey->private_key);
|
|
||||||
if (seckey_pubkey == NULL) {
|
|
||||||
return diag_nss_error("extracting Public Key from Private Key");
|
|
||||||
}
|
|
||||||
diff --git a/lib/libswan/secrets.c b/lib/libswan/secrets.c
|
|
||||||
index 01cf90e4f3..1088f914af 100644
|
|
||||||
--- a/lib/libswan/secrets.c
|
|
||||||
+++ b/lib/libswan/secrets.c
|
|
||||||
@@ -186,7 +186,7 @@ const ckaid_t *secret_ckaid(const struct secret *secret)
|
|
||||||
case SECRET_RSA:
|
|
||||||
case SECRET_ECDSA:
|
|
||||||
/* some sort of PKI */
|
|
||||||
- return &secret->stuff.u.pubkey.content.ckaid;
|
|
||||||
+ return &secret->stuff.u.pubkey->content.ckaid;
|
|
||||||
default:
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
@@ -198,7 +198,7 @@ const keyid_t *secret_keyid(const struct secret *secret)
|
|
||||||
case SECRET_RSA:
|
|
||||||
case SECRET_ECDSA:
|
|
||||||
/* some sort of PKI */
|
|
||||||
- return &secret->stuff.u.pubkey.content.keyid;
|
|
||||||
+ return &secret->stuff.u.pubkey->content.keyid;
|
|
||||||
default:
|
|
||||||
return NULL;
|
|
||||||
}
|
|
||||||
@@ -241,12 +241,12 @@ static struct secret *find_secret_by_pubkey_ckaid_1(struct secret *secrets,
|
|
||||||
dbg(" not PKI");
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
- if (type != NULL && pks->u.pubkey.content.type != type) {
|
|
||||||
+ if (type != NULL && pks->u.pubkey->content.type != type) {
|
|
||||||
/* need exact or wildcard */
|
|
||||||
dbg(" not %s", type->name);
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
- if (!ckaid_eq_nss(&pks->u.pubkey.content.ckaid, pubkey_ckaid)) {
|
|
||||||
+ if (!ckaid_eq_nss(&pks->u.pubkey->content.ckaid, pubkey_ckaid)) {
|
|
||||||
dbg(" wrong ckaid");
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
@@ -276,12 +276,12 @@ bool secret_pubkey_same(struct secret *lhs, struct secret *rhs)
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
- if (lhs->stuff.u.pubkey.content.type != rhs->stuff.u.pubkey.content.type) {
|
|
||||||
+ if (lhs->stuff.u.pubkey->content.type != rhs->stuff.u.pubkey->content.type) {
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
|
|
||||||
- return lhs->stuff.u.pubkey.content.type->pubkey_same(&lhs->stuff.u.pubkey.content,
|
|
||||||
- &rhs->stuff.u.pubkey.content);
|
|
||||||
+ return lhs->stuff.u.pubkey->content.type->pubkey_same(&lhs->stuff.u.pubkey->content,
|
|
||||||
+ &rhs->stuff.u.pubkey->content);
|
|
||||||
}
|
|
||||||
|
|
||||||
struct secret *lsw_find_secret_by_id(struct secret *secrets,
|
|
||||||
@@ -954,8 +954,9 @@ void lsw_free_preshared_secrets(struct secret **psecrets, struct logger *logger)
|
|
||||||
case SECRET_RSA:
|
|
||||||
case SECRET_ECDSA:
|
|
||||||
/* Note: pub is all there is */
|
|
||||||
- SECKEY_DestroyPrivateKey(s->stuff.u.pubkey.private_key);
|
|
||||||
- s->stuff.u.pubkey.content.type->free_pubkey_content(&s->stuff.u.pubkey.content);
|
|
||||||
+ SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key);
|
|
||||||
+ s->stuff.u.pubkey->content.type->free_pubkey_content(&s->stuff.u.pubkey->content);
|
|
||||||
+ pfree(s->stuff.u.pubkey);
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
bad_case(s->stuff.kind);
|
|
||||||
@@ -1180,19 +1181,20 @@ static err_t add_private_key(struct secret **secrets, const struct secret_stuff
|
|
||||||
s->stuff.kind = type->private_key_kind;
|
|
||||||
s->stuff.line = 0;
|
|
||||||
/* make an unpacked copy of the private key */
|
|
||||||
- s->stuff.u.pubkey.private_key = copy_private_key(private_key);
|
|
||||||
- err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey.content,
|
|
||||||
+ s->stuff.u.pubkey = alloc_thing(struct secret_pubkey_stuff, "secret_pubkey_stuff");
|
|
||||||
+ s->stuff.u.pubkey->private_key = copy_private_key(private_key);
|
|
||||||
+ err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey->content,
|
|
||||||
pubk, ckaid_nss);
|
|
||||||
if (err != NULL) {
|
|
||||||
/* extract should leave pubkey_content clean */
|
|
||||||
- SECKEY_DestroyPrivateKey(s->stuff.u.pubkey.private_key); /* allocated above */
|
|
||||||
+ SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key); /* allocated above */
|
|
||||||
pfree(s);
|
|
||||||
return err;
|
|
||||||
}
|
|
||||||
|
|
||||||
- passert(s->stuff.u.pubkey.content.type == type);
|
|
||||||
- pexpect(s->stuff.u.pubkey.content.ckaid.len > 0);
|
|
||||||
- pexpect(s->stuff.u.pubkey.content.keyid.keyid[0] != '\0');
|
|
||||||
+ passert(s->stuff.u.pubkey->content.type == type);
|
|
||||||
+ pexpect(s->stuff.u.pubkey->content.ckaid.len > 0);
|
|
||||||
+ pexpect(s->stuff.u.pubkey->content.keyid.keyid[0] != '\0');
|
|
||||||
|
|
||||||
add_secret(secrets, s, "lsw_add_rsa_secret");
|
|
||||||
*pks = &s->stuff;
|
|
||||||
diff --git a/programs/pluto/ikev2_eap.c b/programs/pluto/ikev2_eap.c
|
|
||||||
index c43bd59b6d..118c4c484e 100644
|
|
||||||
--- a/programs/pluto/ikev2_eap.c
|
|
||||||
+++ b/programs/pluto/ikev2_eap.c
|
|
||||||
@@ -282,7 +282,7 @@ static bool start_eap(struct ike_sa *ike, struct pbs_out *pbs)
|
|
||||||
SSL_OptionSet(pr, SSL_ENABLE_SSL3, PR_FALSE) != SECSuccess ||
|
|
||||||
SSL_BadCertHook(pr, eaptls_bad_cert_cb, eap) != SECSuccess ||
|
|
||||||
SSL_HandshakeCallback(pr, eaptls_handshake_cb, eap) != SECSuccess ||
|
|
||||||
- SSL_ConfigServerCert(pr, mycert->nss_cert, pks->u.pubkey.private_key, 0, 0) != SECSuccess) {
|
|
||||||
+ SSL_ConfigServerCert(pr, mycert->nss_cert, pks->u.pubkey->private_key, 0, 0) != SECSuccess) {
|
|
||||||
llog_nss_error(RC_LOG, logger, "Failed to start configure TLS options");
|
|
||||||
return false;
|
|
||||||
}
|
|
||||||
diff --git a/programs/pluto/keys.c b/programs/pluto/keys.c
|
|
||||||
index 359ed87f75..e71fccb825 100644
|
|
||||||
--- a/programs/pluto/keys.c
|
|
||||||
+++ b/programs/pluto/keys.c
|
|
||||||
@@ -697,7 +697,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c,
|
|
||||||
* etc) then best will end up as NULL
|
|
||||||
*/
|
|
||||||
pexpect(pks->kind == type->private_key_kind);
|
|
||||||
- pexpect(pks->u.pubkey.content.type == type);
|
|
||||||
+ pexpect(pks->u.pubkey->content.type == type);
|
|
||||||
dbg("connection %s's %s private key found in NSS DB using cert",
|
|
||||||
c->name, type->name);
|
|
||||||
return pks;
|
|
||||||
@@ -745,7 +745,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c,
|
|
||||||
* etc) then best will end up as NULL
|
|
||||||
*/
|
|
||||||
pexpect(pks->kind == type->private_key_kind);
|
|
||||||
- pexpect(pks->u.pubkey.content.type == type);
|
|
||||||
+ pexpect(pks->u.pubkey->content.type == type);
|
|
||||||
dbg("connection %s's %s private key found in NSS DB using CKAID",
|
|
||||||
c->name, type->name);
|
|
||||||
return pks;
|
|
||||||
@@ -764,7 +764,7 @@ const struct secret_stuff *get_local_private_key(const struct connection *c,
|
|
||||||
passert(pks != NULL);
|
|
||||||
|
|
||||||
pexpect(pks->kind == type->private_key_kind);
|
|
||||||
- pexpect(pks->u.pubkey.content.type == type);
|
|
||||||
+ pexpect(pks->u.pubkey->content.type == type);
|
|
||||||
dbg("connection %s's %s private key found",
|
|
||||||
c->name, type->name);
|
|
||||||
return pks;
|
|
||||||
diff --git a/programs/showhostkey/showhostkey.c b/programs/showhostkey/showhostkey.c
|
|
||||||
index aaef793914..65b95ba596 100644
|
|
||||||
--- a/programs/showhostkey/showhostkey.c
|
|
||||||
+++ b/programs/showhostkey/showhostkey.c
|
|
||||||
@@ -172,14 +172,14 @@ static void print(struct secret_stuff *pks,
|
|
||||||
case SECRET_RSA:
|
|
||||||
case SECRET_ECDSA:
|
|
||||||
{
|
|
||||||
- printf("%s", pks->u.pubkey.content.type->name);
|
|
||||||
- keyid_t keyid = pks->u.pubkey.content.keyid;
|
|
||||||
+ printf("%s", pks->u.pubkey->content.type->name);
|
|
||||||
+ keyid_t keyid = pks->u.pubkey->content.keyid;
|
|
||||||
printf(" keyid: %s", str_keyid(keyid)[0] ? str_keyid(keyid) : "<missing-pubkey>");
|
|
||||||
if (id) {
|
|
||||||
printf(" id: %s", idb);
|
|
||||||
}
|
|
||||||
ckaid_buf cb;
|
|
||||||
- const ckaid_t *ckaid = &pks->u.pubkey.content.ckaid;
|
|
||||||
+ const ckaid_t *ckaid = &pks->u.pubkey->content.ckaid;
|
|
||||||
printf(" ckaid: %s\n", str_ckaid(ckaid, &cb));
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
@@ -237,7 +237,7 @@ static int pick_by_rsaid(struct secret *secret UNUSED,
|
|
||||||
{
|
|
||||||
char *rsaid = (char *)uservoid;
|
|
||||||
|
|
||||||
- if (pks->kind == SECRET_RSA && streq(pks->u.pubkey.content.keyid.keyid, rsaid)) {
|
|
||||||
+ if (pks->kind == SECRET_RSA && streq(pks->u.pubkey->content.keyid.keyid, rsaid)) {
|
|
||||||
/* stop */
|
|
||||||
return 0;
|
|
||||||
} else {
|
|
||||||
@@ -254,7 +254,7 @@ static int pick_by_ckaid(struct secret *secret UNUSED,
|
|
||||||
switch (pks->kind) {
|
|
||||||
case SECRET_RSA:
|
|
||||||
case SECRET_ECDSA:
|
|
||||||
- if (ckaid_starts_with(&pks->u.pubkey.content.ckaid, start)) {
|
|
||||||
+ if (ckaid_starts_with(&pks->u.pubkey->content.ckaid, start)) {
|
|
||||||
/* stop */
|
|
||||||
return 0;
|
|
||||||
}
|
|
||||||
@@ -283,7 +283,7 @@ static char *base64_ipseckey_rdata_from_pubkey_secret(struct secret_stuff *pks,
|
|
||||||
enum ipseckey_algorithm_type *ipseckey_algorithm)
|
|
||||||
{
|
|
||||||
chunk_t ipseckey_pubkey = empty_chunk; /* must free */
|
|
||||||
- err_t e = pks->u.pubkey.content.type->pubkey_content_to_ipseckey_rdata(&pks->u.pubkey.content,
|
|
||||||
+ err_t e = pks->u.pubkey->content.type->pubkey_content_to_ipseckey_rdata(&pks->u.pubkey->content,
|
|
||||||
&ipseckey_pubkey,
|
|
||||||
ipseckey_algorithm);
|
|
||||||
if (e != NULL) {
|
|
||||||
@@ -390,7 +390,7 @@ static int show_leftright(struct secret_stuff *pks,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
- passert(pks->u.pubkey.content.type != NULL);
|
|
||||||
+ passert(pks->u.pubkey->content.type != NULL);
|
|
||||||
|
|
||||||
char *base64 = NULL;
|
|
||||||
if (pubkey_flg) {
|
|
||||||
@@ -408,11 +408,11 @@ static int show_leftright(struct secret_stuff *pks,
|
|
||||||
} else {
|
|
||||||
switch (pks->kind) {
|
|
||||||
case SECRET_RSA:
|
|
||||||
- printf("\t# rsakey %s\n", pks->u.pubkey.content.keyid.keyid);
|
|
||||||
+ printf("\t# rsakey %s\n", pks->u.pubkey->content.keyid.keyid);
|
|
||||||
printf("\t%srsasigkey=0s", side);
|
|
||||||
break;
|
|
||||||
case SECRET_ECDSA:
|
|
||||||
- printf("\t# ecdsakey %s\n", pks->u.pubkey.content.keyid.keyid);
|
|
||||||
+ printf("\t# ecdsakey %s\n", pks->u.pubkey->content.keyid.keyid);
|
|
||||||
printf("\t%secdsakey=0s", side);
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
@@ -481,14 +481,17 @@ static struct secret_stuff *foreach_nss_private_key(secret_eval func,
|
|
||||||
continue;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ struct secret_pubkey_stuff pubkey = {
|
|
||||||
+ .private_key = SECKEY_CopyPrivateKey(private_key), /* add reference */
|
|
||||||
+ };
|
|
||||||
+ type->extract_pubkey_content(&pubkey.content, pubk, ckaid_nss);
|
|
||||||
+
|
|
||||||
struct secret_stuff pks = {
|
|
||||||
.kind = type->private_key_kind,
|
|
||||||
.line = 0,
|
|
||||||
- .u.pubkey.private_key = SECKEY_CopyPrivateKey(private_key), /* add reference */
|
|
||||||
+ .u.pubkey = &pubkey,
|
|
||||||
};
|
|
||||||
|
|
||||||
- type->extract_pubkey_content(&pks.u.pubkey.content, pubk, ckaid_nss);
|
|
||||||
-
|
|
||||||
/*
|
|
||||||
* Only count private keys that get processed.
|
|
||||||
*/
|
|
||||||
@@ -513,8 +516,8 @@ static struct secret_stuff *foreach_nss_private_key(secret_eval func,
|
|
||||||
break;
|
|
||||||
}
|
|
||||||
|
|
||||||
- SECKEY_DestroyPrivateKey(pks.u.pubkey.private_key); /* destroy reference */
|
|
||||||
- type->free_pubkey_content(&pks.u.pubkey.content);
|
|
||||||
+ SECKEY_DestroyPrivateKey(pks.u.pubkey->private_key); /* destroy reference */
|
|
||||||
+ type->free_pubkey_content(&pks.u.pubkey->content);
|
|
||||||
|
|
||||||
if (ret < 0) {
|
|
||||||
break;
|
|
||||||
--
|
|
||||||
2.47.0
|
|
||||||
|
|
||||||
|
|
||||||
From 9e9bdbc27aedb035e769660b65a92e173ee9a5f9 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Andrew Cagney <cagney@gnu.org>
|
|
||||||
Date: Fri, 8 Nov 2024 17:45:53 -0500
|
|
||||||
Subject: [PATCH 2/2] crypto: refcnt struct secret_pubkey_stuff when passing to
|
|
||||||
helper thread
|
|
||||||
|
|
||||||
fix problem where a thread was trying to use a key when which
|
|
||||||
was being deleted by reloadsecrets.
|
|
||||||
|
|
||||||
close #1894 Segmentation fault in PK11_SignatureLen (key=0xa5a5a5a5a5a5a5a5)
|
|
||||||
|
|
||||||
Modified-by: Daiki Ueno <dueno@redhat.com>
|
|
||||||
---
|
|
||||||
include/secrets.h | 4 ++++
|
|
||||||
lib/libswan/secrets.c | 23 ++++++++++++++++++-----
|
|
||||||
programs/pluto/ikev2_auth_helper.c | 27 ++++++++++++++++++---------
|
|
||||||
3 files changed, 40 insertions(+), 14 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/include/secrets.h b/include/secrets.h
|
|
||||||
index c9272d71e0..488d12e8c5 100644
|
|
||||||
--- a/include/secrets.h
|
|
||||||
+++ b/include/secrets.h
|
|
||||||
@@ -74,10 +74,14 @@ enum secret_kind {
|
|
||||||
};
|
|
||||||
|
|
||||||
struct secret_pubkey_stuff {
|
|
||||||
+ struct refcnt refcnt;
|
|
||||||
SECKEYPrivateKey *private_key;
|
|
||||||
struct pubkey_content content;
|
|
||||||
};
|
|
||||||
|
|
||||||
+struct secret_pubkey_stuff *secret_pubkey_stuff_addref(struct secret_pubkey_stuff *, where_t where);
|
|
||||||
+void secret_pubkey_stuff_delref(struct secret_pubkey_stuff **, where_t where);
|
|
||||||
+
|
|
||||||
struct secret_stuff {
|
|
||||||
enum secret_kind kind;
|
|
||||||
/*
|
|
||||||
diff --git a/lib/libswan/secrets.c b/lib/libswan/secrets.c
|
|
||||||
index 1088f914af..3fed6a55da 100644
|
|
||||||
--- a/lib/libswan/secrets.c
|
|
||||||
+++ b/lib/libswan/secrets.c
|
|
||||||
@@ -953,10 +953,7 @@ void lsw_free_preshared_secrets(struct secret **psecrets, struct logger *logger)
|
|
||||||
break;
|
|
||||||
case SECRET_RSA:
|
|
||||||
case SECRET_ECDSA:
|
|
||||||
- /* Note: pub is all there is */
|
|
||||||
- SECKEY_DestroyPrivateKey(s->stuff.u.pubkey->private_key);
|
|
||||||
- s->stuff.u.pubkey->content.type->free_pubkey_content(&s->stuff.u.pubkey->content);
|
|
||||||
- pfree(s->stuff.u.pubkey);
|
|
||||||
+ secret_pubkey_stuff_delref(&s->stuff.u.pubkey, HERE);
|
|
||||||
break;
|
|
||||||
default:
|
|
||||||
bad_case(s->stuff.kind);
|
|
||||||
@@ -1173,6 +1170,22 @@ static const struct pubkey_type *private_key_type_nss(SECKEYPrivateKey *private_
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
+struct secret_pubkey_stuff *secret_pubkey_stuff_addref(struct secret_pubkey_stuff *pks,
|
|
||||||
+ where_t where)
|
|
||||||
+{
|
|
||||||
+ return addref_where(pks, where);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+void secret_pubkey_stuff_delref(struct secret_pubkey_stuff **pks, where_t where)
|
|
||||||
+{
|
|
||||||
+ struct secret_pubkey_stuff *last = delref_where(pks, &global_logger, where);
|
|
||||||
+ if (last != NULL) {
|
|
||||||
+ SECKEY_DestroyPrivateKey(last->private_key);
|
|
||||||
+ last->content.type->free_pubkey_content(&last->content);
|
|
||||||
+ pfree(last);
|
|
||||||
+ }
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
static err_t add_private_key(struct secret **secrets, const struct secret_stuff **pks,
|
|
||||||
SECKEYPublicKey *pubk, SECItem *ckaid_nss,
|
|
||||||
const struct pubkey_type *type, SECKEYPrivateKey *private_key)
|
|
||||||
@@ -1181,7 +1194,7 @@ static err_t add_private_key(struct secret **secrets, const struct secret_stuff
|
|
||||||
s->stuff.kind = type->private_key_kind;
|
|
||||||
s->stuff.line = 0;
|
|
||||||
/* make an unpacked copy of the private key */
|
|
||||||
- s->stuff.u.pubkey = alloc_thing(struct secret_pubkey_stuff, "secret_pubkey_stuff");
|
|
||||||
+ s->stuff.u.pubkey = refcnt_alloc(struct secret_pubkey_stuff, HERE);
|
|
||||||
s->stuff.u.pubkey->private_key = copy_private_key(private_key);
|
|
||||||
err_t err = type->extract_pubkey_content(&s->stuff.u.pubkey->content,
|
|
||||||
pubk, ckaid_nss);
|
|
||||||
diff --git a/programs/pluto/ikev2_auth_helper.c b/programs/pluto/ikev2_auth_helper.c
|
|
||||||
index 4fe661b559..2973569a90 100644
|
|
||||||
--- a/programs/pluto/ikev2_auth_helper.c
|
|
||||||
+++ b/programs/pluto/ikev2_auth_helper.c
|
|
||||||
@@ -38,7 +38,7 @@ struct task {
|
|
||||||
const struct crypt_mac hash_to_sign;
|
|
||||||
const struct hash_desc *hash_algo;
|
|
||||||
v2_auth_signature_cb *cb;
|
|
||||||
- const struct secret_stuff *pks;
|
|
||||||
+ struct secret_pubkey_stuff *pks;
|
|
||||||
const struct pubkey_signer *signer;
|
|
||||||
/* out */
|
|
||||||
struct hash_signature signature;
|
|
||||||
@@ -63,19 +63,21 @@ bool submit_v2_auth_signature(struct ike_sa *ike, struct msg_digest *md,
|
|
||||||
where_t where)
|
|
||||||
{
|
|
||||||
const struct connection *c = ike->sa.st_connection;
|
|
||||||
+ const struct secret_stuff *s = get_local_private_key(c, signer->type,
|
|
||||||
+ ike->sa.logger);
|
|
||||||
+ if (s == NULL) {
|
|
||||||
+ /* failure: no key to use */
|
|
||||||
+ return false;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
struct task task = {
|
|
||||||
.cb = cb,
|
|
||||||
.hash_algo = hash_algo,
|
|
||||||
.hash_to_sign = *hash_to_sign,
|
|
||||||
.signer = signer,
|
|
||||||
- .pks = get_local_private_key(c, signer->type,
|
|
||||||
- ike->sa.logger),
|
|
||||||
+ .pks = secret_pubkey_stuff_addref(s->u.pubkey, HERE),
|
|
||||||
};
|
|
||||||
|
|
||||||
- if (task.pks == NULL)
|
|
||||||
- /* failure: no key to use */
|
|
||||||
- return false;
|
|
||||||
-
|
|
||||||
submit_task(/*callback*/&ike->sa, /*task*/&ike->sa, md,
|
|
||||||
/*detach_whack*/false,
|
|
||||||
clone_thing(task, "signature task"),
|
|
||||||
@@ -86,7 +88,7 @@ bool submit_v2_auth_signature(struct ike_sa *ike, struct msg_digest *md,
|
|
||||||
static struct hash_signature v2_auth_signature(struct logger *logger,
|
|
||||||
const struct crypt_mac *hash_to_sign,
|
|
||||||
const struct hash_desc *hash_algo,
|
|
||||||
- const struct secret_stuff *pks,
|
|
||||||
+ const struct secret_pubkey_stuff *pks,
|
|
||||||
const struct pubkey_signer *signer)
|
|
||||||
{
|
|
||||||
passert(hash_to_sign->len <= sizeof(hash_to_sign->ptr/*array*/)); /*hint to coverity*/
|
|
||||||
@@ -96,8 +98,14 @@ static struct hash_signature v2_auth_signature(struct logger *logger,
|
|
||||||
DBG_dump_hunk("hash to sign", *hash_to_sign);
|
|
||||||
}
|
|
||||||
|
|
||||||
+ struct secret_stuff s = {
|
|
||||||
+ .kind = pks->content.type->private_key_kind,
|
|
||||||
+ .line = 0,
|
|
||||||
+ .u.pubkey = (struct secret_pubkey_stuff *)pks,
|
|
||||||
+ };
|
|
||||||
+
|
|
||||||
logtime_t sign_time = logtime_start(logger);
|
|
||||||
- struct hash_signature sig = signer->sign_hash(pks,
|
|
||||||
+ struct hash_signature sig = signer->sign_hash(&s,
|
|
||||||
hash_to_sign->ptr,
|
|
||||||
hash_to_sign->len,
|
|
||||||
hash_algo,
|
|
||||||
@@ -125,5 +133,6 @@ static stf_status v2_auth_signature_completed(struct state *st,
|
|
||||||
|
|
||||||
static void v2_auth_signature_cleanup(struct task **task)
|
|
||||||
{
|
|
||||||
+ secret_pubkey_stuff_delref(&(*task)->pks, HERE);
|
|
||||||
pfreeany(*task);
|
|
||||||
}
|
|
||||||
--
|
|
||||||
2.47.0
|
|
||||||
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
-----BEGIN PGP SIGNATURE-----
|
|
||||||
|
|
||||||
iQJHBAABCgAxFiEEkH55DyXB6OVhzXO1hf9LQ7MPxvkFAmcFdvUTHHRlYW1AbGli
|
|
||||||
cmVzd2FuLm9yZwAKCRCF/0tDsw/G+aDLD/9SxgIFhOgqE+X7HT7JN2bDRyZuEUCP
|
|
||||||
0FK7q2bcBNDgA7AlEiSqYFiHVQcAzmZLrx39IqMfAIGNDoB5jSUUl+Ij4zT/qEfU
|
|
||||||
nMJ1pxt+GqUwOeVkz+89KOS6KkQ9N3W8Y0HZjlI3LB/rvL8+/eytXv9ckbrQZuwL
|
|
||||||
Anqv4pdgYO/ybVF/n8vz/8vgAhDM0Rhm3Xqft4w8sxyWrl3LU11/mmaOyD5eXdCD
|
|
||||||
QvLtvhQg10W+/MKNzrKHfbIgFjtzEeKo3CMSniNAgkHtNwXTVIR09RkACvfCtAhv
|
|
||||||
yO4gmsTl4ftGAtvUeq3pexJsbpyJTywwwCVNFn1ustrwxatbn0oDdo1aqd33Dt/w
|
|
||||||
gb1yt14smwahRyMCROK1Ozrk1KBYl7lQ3eek1SXKEJ33GzxDw6HB2PCy1Y+ni54W
|
|
||||||
NGuN9oJQNVGZiU/kD7mWWWGeHCNetTIZLNRaV7RoGxZFH1zn0n7jvhk5SezPsQNN
|
|
||||||
e4y5HSd8sEoUtmgYN2uf902Iq0Af5QErqieSPCz130F9lndGbGxMlAF64wVgaNfq
|
|
||||||
/jjH8whHkNqWyM3BRQE2tTtpM9AONF9GJ3RgeaAfSLZV2SMeGVs9YPNs4XFqs3xM
|
|
||||||
ToQMCE7OG6VgPQAvE/JnPoTGOk+GX2C+cXi2Vluvc+E3Sw52To+q2ZeQTjr+ejj6
|
|
||||||
EULR5f5plo88uQ==
|
|
||||||
=ieXQ
|
|
||||||
-----END PGP SIGNATURE-----
|
|
||||||
Loading…
Reference in new issue