14 months agotesting: Reorganizing IKEv1 and IKEv2 examples
Andreas Steffen [Sun, 4 Apr 2021 08:45:46 +0000 (10:45 +0200)]
testing: Reorganizing IKEv1 and IKEv2 examples

For documentation purposes the new folders ikev1-algs, ikev2-algs,
ikev1-multi-ca and ikev2-multi-ca have been created. Most of the
test cases have now been converted to the vici interface. The
remaining legacy stroke scenarios yet to be converted have been put
into the ikev2-stroke-bye folder.

For documentation purposes some legacy stroke scenarios will be kept
in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.

15 months agonotify-payload: Update reference for notify types for PPKs
Tobias Brunner [Tue, 11 May 2021 12:27:08 +0000 (14:27 +0200)]
notify-payload: Update reference for notify types for PPKs

draft-ietf-ipsecme-qr-ikev2 was released as RFC 8784 in June of 2020.

15 months agoDon't report current text in parser error messages
Tobias Brunner [Mon, 10 May 2021 12:55:45 +0000 (14:55 +0200)]
Don't report current text in parser error messages

The values of `yytext` and `yyleng` might not be properly defined when
the error function is called (in particular if the lexer reached EOF).
While this might just cause non-printable characters in the output, it
could actually lead to a crash depending on where `yytext` points.

Closes strongswan/strongswan#346.

15 months agotesting: Replace kvm with qemu-system-x86_64
Noel Kuntze [Thu, 22 Apr 2021 14:33:34 +0000 (16:33 +0200)]
testing: Replace kvm with qemu-system-x86_64

It might not exist on all platforms and according to the man page:

  The kvm wrapper script is used to provide compatibility with old
  qemu-kvm package which has been merged into qemu as of version 1.3.

  The script executes
    qemu-system-x86_64 -enable-kvm
  passing all other command-line arguments to the qemu binary.

Closes strongswan/strongswan#385.

15 months agotesting: Use host-passthrough CPU mode for all KVM guests
Tobias Brunner [Tue, 4 May 2021 13:40:45 +0000 (15:40 +0200)]
testing: Use host-passthrough CPU mode for all KVM guests

This should give us the best performance and feature set on modern
hardware (in particular when compared to code2duo, which e.g. does not allow
nested virtualization).

Closes strongswan/strongswan#340.

15 months agoUse Botan 2.18.0 for tests
Tobias Brunner [Fri, 7 May 2021 12:48:17 +0000 (14:48 +0200)]
Use Botan 2.18.0 for tests

15 months agoopenssl: Consider authorityKeyIdentifier in issued_by()
Adrian-Ken Rueegsegger [Wed, 14 Apr 2021 13:34:29 +0000 (15:34 +0200)]
openssl: Consider authorityKeyIdentifier in issued_by()

Prior to verifying the cryptographic signature, check if the
authorityKeyIdentifier matches the key ID of the issuing certificate if
it is available.

15 months agox509: Consider authorityKeyIdentifier in issued_by()
Adrian-Ken Rueegsegger [Wed, 14 Apr 2021 13:20:27 +0000 (15:20 +0200)]
x509: Consider authorityKeyIdentifier in issued_by()

Prior to verifying the cryptographic signature, check if the
authorityKeyIdentifier matches the key ID of the issuing certificate if
it is available.

15 months agoopenssl: Bring CRL issued_by() in line with x509 plugin
Adrian-Ken Rueegsegger [Wed, 14 Apr 2021 11:45:30 +0000 (13:45 +0200)]
openssl: Bring CRL issued_by() in line with x509 plugin

15 months agoike: Set DCSP on keepalive packets
Adrian-Ken Rueegsegger [Tue, 9 Mar 2021 17:07:34 +0000 (18:07 +0100)]
ike: Set DCSP on keepalive packets

15 months agoopenssl: Add support for AES in CCM mode
Tobias Brunner [Tue, 4 May 2021 16:19:57 +0000 (18:19 +0200)]
openssl: Add support for AES in CCM mode

While CCM is available in earlier versions, we only use it with
OpenSSL 1.1.0 and newer because the generic control variables are not
available before and we default to GCM for them.

Closes strongswan/strongswan#353.

15 months agotesting: Make sure $SHAREDDIR exists before mounting it
Noel Kuntze [Thu, 22 Apr 2021 12:28:34 +0000 (14:28 +0200)]
testing: Make sure $SHAREDDIR exists before mounting it

Closes strongswan/strongswan#344.

15 months agogithub: Fix python build and checks on older Ubuntu releases
Tobias Brunner [Wed, 5 May 2021 16:46:49 +0000 (18:46 +0200)]
github: Fix python build and checks on older Ubuntu releases

On 18.04, setuptools was apparently pulled in by python-pip but is not
by python3-pip and on Ubuntu 16.04 there is an issue with tox when
installed via pip3 (syntax error in one of the dependencies) and with
pip that dependency is not even available.

15 months agowolfssl: Properly handle failure to initialize SHAKE_256
Tobias Brunner [Thu, 6 May 2021 09:03:19 +0000 (11:03 +0200)]
wolfssl: Properly handle failure to initialize SHAKE_256

15 months agogithub: Don't fail LGTM test with an error if variables are missing
Tobias Brunner [Wed, 5 May 2021 16:56:58 +0000 (18:56 +0200)]
github: Don't fail LGTM test with an error if variables are missing

That's because forks are currently not allowed to be analyzed by LGTM (unlike
with SonarCloud) so this check can't actually be successful for forks even if
variables are defined.

References strongswan/strongswan#328.

15 months agogithub: Fail LGTM test if required environment variables aren't set
Noel Kuntze [Thu, 15 Apr 2021 12:49:19 +0000 (14:49 +0200)]
github: Fail LGTM test if required environment variables aren't set

Closes strongswan/strongswan#328.

15 months agogithub: Make LGTM project ID configurable via environment variable
Tobias Brunner [Wed, 5 May 2021 14:39:26 +0000 (16:39 +0200)]
github: Make LGTM project ID configurable via environment variable

15 months agogithub: Fail sonarcloud test if required environment variables aren't set
Noel Kuntze [Sat, 17 Apr 2021 05:22:39 +0000 (07:22 +0200)]
github: Fail sonarcloud test if required environment variables aren't set

Closes strongswan/strongswan#330.

15 months agogithub: Always upload lint results from Android build
Tobias Brunner [Wed, 5 May 2021 12:30:36 +0000 (14:30 +0200)]
github: Always upload lint results from Android build

15 months agogithub: Fix build on Ubuntu 20.04 and add a job for 18.04
Tobias Brunner [Wed, 5 May 2021 08:25:05 +0000 (10:25 +0200)]
github: Fix build on Ubuntu 20.04 and add a job for 18.04

The nm test can only be done on Ubuntu 18.04 as the required libraries
are not available on newer systems.

Switch to pip3 to install tox (the only Python dependency we use).

Closes strongswan/strongswan#327.

15 months agogithub: Fix installation of Python dependencies
Tobias Brunner [Wed, 5 May 2021 16:07:47 +0000 (18:07 +0200)]
github: Fix installation of Python dependencies

15 months agoandroid: Avoid lint errors when determining column indices
Tobias Brunner [Wed, 5 May 2021 14:09:37 +0000 (16:09 +0200)]
android: Avoid lint errors when determining column indices

The lint version used on our GitHub build hosts reported these errors:

Error: Value must be ≥ 0 [Range]
        db.update(TABLE_VPNPROFILE, values, KEY_ID + " = " + cursor.getLong(cursor.getColumnIndex(KEY_ID)), null);

That's because get*() expect a valid index >= 0 but getColumnIndex()
can return -1 if the column name doesn't exist.

15 months agobacktrace: The BFD API changed in newer versions
Tobias Brunner [Wed, 5 May 2021 09:37:21 +0000 (11:37 +0200)]
backtrace: The BFD API changed in newer versions

15 months agoopenssl: Fix OpenSSL version check for EC_POINT_set_affine_coordinates
Noel Kuntze [Thu, 15 Apr 2021 14:23:18 +0000 (16:23 +0200)]
openssl: Fix OpenSSL version check for EC_POINT_set_affine_coordinates

Fixes: bd323ae6c832 ("openssl: Migrate from deprecated EC_POINT_[set|get]_affine_coordinates_GFp() functions")
Closes strongswan/strongswan#332

15 months agoforecast: Restrict strncpy() call
Noel Kuntze [Sat, 17 Apr 2021 03:02:01 +0000 (05:02 +0200)]
forecast: Restrict strncpy() call

Closes strongswan/strongswan#331.

15 months agoMerge branch 'doxygen-fixes'
Tobias Brunner [Tue, 4 May 2021 12:39:56 +0000 (14:39 +0200)]
Merge branch 'doxygen-fixes'

Closes strongswan/strongswan#326.

16 months Remove deprecated variables 326/head
Noel Kuntze [Wed, 14 Apr 2021 22:33:23 +0000 (00:33 +0200)] Remove deprecated variables

16 months agodoxygen: Fix documentation problems
Noel Kuntze [Wed, 14 Apr 2021 22:17:59 +0000 (00:17 +0200)]
doxygen: Fix documentation problems

16 months agoVersion bump to 5.9.3dr1 5.9.3dr1
Andreas Steffen [Wed, 31 Mar 2021 07:59:55 +0000 (09:59 +0200)]
Version bump to 5.9.3dr1

16 months agotesting: Migrated p2pnat/medsrv-psk scenario to vici
Andreas Steffen [Tue, 30 Mar 2021 20:05:49 +0000 (22:05 +0200)]
testing: Migrated p2pnat/medsrv-psk scenario to vici

16 months agotesting: Migrated p2pnat/behind-same-nat scenario to vici
Andreas Steffen [Tue, 30 Mar 2021 16:54:47 +0000 (18:54 +0200)]
testing: Migrated p2pnat/behind-same-nat scenario to vici

16 months agotesting: Store mars credentials in the swanctl directory
Andreas Steffen [Sun, 28 Mar 2021 13:11:28 +0000 (15:11 +0200)]
testing: Store mars credentials in the swanctl directory

16 months agotesting: Migrated redirect-active scenario to vici
Andreas Steffen [Sun, 28 Mar 2021 13:07:41 +0000 (15:07 +0200)]
testing: Migrated redirect-active scenario to vici

16 months agotesting: Migrated ha/both-active scenario to vici
Andreas Steffen [Sat, 27 Mar 2021 21:15:13 +0000 (22:15 +0100)]
testing: Migrated ha/both-active scenario to vici

16 months agotesting: Migrated ha/active-passive scenario to vici
Andreas Steffen [Sat, 27 Mar 2021 13:44:47 +0000 (14:44 +0100)]
testing: Migrated ha/active-passive scenario to vici

16 months agotesting: Switched PTS measurements to /usr/sbin
Andreas Steffen [Tue, 23 Mar 2021 09:49:32 +0000 (10:49 +0100)]
testing: Switched PTS measurements to /usr/sbin

Due to Debian 10 linking /bin to /usr/bin which drastically
increased the number of files in /bin, the PTS measurement
was switched to /usr/sbin with a lesser number of files.

16 months agowolfssl: Support SHAKE_256
Andreas Steffen [Fri, 19 Mar 2021 06:18:59 +0000 (07:18 +0100)]
wolfssl: Support SHAKE_256

16 months agowolfssl: Support SHA3
Andreas Steffen [Thu, 18 Mar 2021 06:58:21 +0000 (07:58 +0100)]
wolfssl: Support SHA3

16 months agowolfssl: Support AES_ECB
Andreas Steffen [Thu, 18 Mar 2021 06:28:00 +0000 (07:28 +0100)]
wolfssl: Support AES_ECB

17 months agoopenssl: Migrate from deprecated EC_POINT_[set|get]_affine_coordinates_GFp() functions
Andreas Steffen [Fri, 19 Mar 2021 07:50:27 +0000 (08:50 +0100)]
openssl: Migrate from deprecated EC_POINT_[set|get]_affine_coordinates_GFp() functions

17 months agolibcharon: Include libtpmtss in monolithic build
Petr Gotthard [Wed, 17 Mar 2021 11:14:47 +0000 (12:14 +0100)]
libcharon: Include libtpmtss in monolithic build

17 months agotesting: Bump guest kernel to Linux 5.11
Andreas Steffen [Sun, 7 Mar 2021 13:39:44 +0000 (14:39 +0100)]
testing: Bump guest kernel to Linux 5.11

17 months agoVersion bump to 5.9.2 5.9.2
Andreas Steffen [Fri, 26 Feb 2021 10:30:13 +0000 (11:30 +0100)]
Version bump to 5.9.2

17 months agoMerge branch 'sha2-no-trunc'
Tobias Brunner [Tue, 23 Feb 2021 16:30:11 +0000 (17:30 +0100)]
Merge branch 'sha2-no-trunc'

Closes strongswan/strongswan#215.

17 months agosave-keys: Fix length of AES-GCM with 12-byte ICV
Tobias Brunner [Tue, 23 Feb 2021 14:28:36 +0000 (15:28 +0100)]
save-keys: Fix length of AES-GCM with 12-byte ICV

17 months agosave-keys: Add support for full-length HMAC-SHA256 for ESP
Michał Skalski [Mon, 22 Feb 2021 15:41:23 +0000 (16:41 +0100)]
save-keys: Add support for full-length HMAC-SHA256 for ESP

Wireshark doesn't really support it, but this way it at least decodes
the ESP packets correctly and the encryption keys are saved and the
packets can be decrypted.  The full-length versions of SHA-384 and
SHA-512 are not supported by Wireshark as 256-bit is the longest ICV
it is able to decode currently.

17 months agokernel-netlink: Add support for full-length HMAC-SHA2 algorithms
Michał Skalski [Fri, 5 Feb 2021 05:59:13 +0000 (06:59 +0100)]
kernel-netlink: Add support for full-length HMAC-SHA2 algorithms

17 months agokeymat: Add support for full-length HMAC-SHA2 algorithms
Michał Skalski [Mon, 22 Feb 2021 14:25:45 +0000 (15:25 +0100)]
keymat: Add support for full-length HMAC-SHA2 algorithms

17 months agoaf-alg: Fix typo in algorithm mapping for full-size HMAC-SHA-256
Michał Skalski [Mon, 22 Feb 2021 14:48:37 +0000 (15:48 +0100)]
af-alg: Fix typo in algorithm mapping for full-size HMAC-SHA-256

17 months agoVersion bump to 5.9.2rc2 5.9.2rc2
Andreas Steffen [Sun, 21 Feb 2021 09:40:34 +0000 (10:40 +0100)]
Version bump to 5.9.2rc2

17 months agotesting: Use TLS 1.3 in TNC PT-TLS tests
Andreas Steffen [Sun, 21 Feb 2021 08:48:34 +0000 (09:48 +0100)]
testing: Use TLS 1.3 in TNC PT-TLS tests

17 months agotesting: Added mgf1 plugin to load statement
Andreas Steffen [Fri, 19 Feb 2021 16:41:44 +0000 (17:41 +0100)]
testing: Added mgf1 plugin to load statement

17 months agoMerge branch 'tls-fixes' 5.9.2rc1
Andreas Steffen [Thu, 18 Feb 2021 19:28:33 +0000 (20:28 +0100)]
Merge branch 'tls-fixes'

17 months agoVersion bump to 5.9.2rc1
Andreas Steffen [Wed, 17 Feb 2021 12:34:06 +0000 (13:34 +0100)]
Version bump to 5.9.2rc1

17 months agopt-tls-server: Make TLS client authentication optional as appropriate
Tobias Brunner [Thu, 18 Feb 2021 14:41:52 +0000 (15:41 +0100)]
pt-tls-server: Make TLS client authentication optional as appropriate

17 months agotls-test: Add option to make client authentication optional
Tobias Brunner [Thu, 18 Feb 2021 14:36:59 +0000 (15:36 +0100)]
tls-test: Add option to make client authentication optional

17 months agotls-server: Add flag that makes client authentication optional
Tobias Brunner [Thu, 18 Feb 2021 14:10:42 +0000 (15:10 +0100)]
tls-server: Add flag that makes client authentication optional

This allows clients to send an empty certificate payload if the server
sent a certificate request.  If an identity was set previously, it will
be reset so get_peer_id() may be used to check if the client was

17 months agolibtls: Add control flags and replace GENERIC_NULLOK purpose with one
Tobias Brunner [Thu, 18 Feb 2021 14:03:29 +0000 (15:03 +0100)]
libtls: Add control flags and replace GENERIC_NULLOK purpose with one

17 months agopt-tls-server: Explicitly request client authentication if necessary
Tobias Brunner [Thu, 18 Feb 2021 11:34:29 +0000 (12:34 +0100)]
pt-tls-server: Explicitly request client authentication if necessary

The PT_TLS_AUTH_TLS_OR_SASL case currently can't be implemented properly
as TLS authentication will be enforced if a client identity is configured
on the TLS server socket.

17 months agotls-server: Use subject DN as peer identity if it was ID_ANY
Tobias Brunner [Thu, 18 Feb 2021 11:31:17 +0000 (12:31 +0100)]
tls-server: Use subject DN as peer identity if it was ID_ANY

To request client authentication if we don't know the client's identity,
it's possible to use ID_ANY.  However, if we don't change the identity
get_peer_id() would still report ID_ANY after the authentication.

17 months agotesting: Adapt some checks as SHA-384 is now preferred for TLS signatures
Tobias Brunner [Thu, 18 Feb 2021 11:01:02 +0000 (12:01 +0100)]
testing: Adapt some checks as SHA-384 is now preferred for TLS signatures

17 months agotls-eap: Only servers conclude EAP method after processing packets
Tobias Brunner [Thu, 18 Feb 2021 09:46:56 +0000 (10:46 +0100)]
tls-eap: Only servers conclude EAP method after processing packets

As client with older TLS versions, we have to ack the receipt of the server's
Finished message instead.

Fixes: 083f38259c79 ("tls-eap: Conclude EAP method also after processing packets")

17 months agoike-sa: Properly set timing info for delete after rekeying
Stefan Berghofer [Thu, 18 Feb 2021 08:43:10 +0000 (09:43 +0100)]
ike-sa: Properly set timing info for delete after rekeying

The job is queued properly, yet the timing information is wrong.

Signed-off-by: Stefan Berghofer <>
Fixes: ee61471113c2 ("implemented RFC4478 (repeated authentication)...")

18 months agoNEWS: Add news for 5.9.2
Tobias Brunner [Wed, 17 Feb 2021 14:24:36 +0000 (15:24 +0100)]
NEWS: Add news for 5.9.2

18 months agodhcp: Properly initialize struct when binding to interface
Tobias Brunner [Tue, 16 Feb 2021 14:22:18 +0000 (15:22 +0100)]
dhcp: Properly initialize struct when binding to interface

18 months agopts: Don't rely on BIOS event buffer to be null terminated
Tobias Brunner [Tue, 16 Feb 2021 14:15:38 +0000 (15:15 +0100)]
pts: Don't rely on BIOS event buffer to be null terminated

18 months agotls-crypto: Fix potential memory leak
Tobias Brunner [Tue, 16 Feb 2021 13:50:50 +0000 (14:50 +0100)]
tls-crypto: Fix potential memory leak

Fixes: d8e42a3d4e3c ("tls-crypto: Share private key search between client and server")

18 months agoike-sa-manager: Ensure we were able to create a new IKE_SA
Tobias Brunner [Tue, 16 Feb 2021 13:43:52 +0000 (14:43 +0100)]
ike-sa-manager: Ensure we were able to create a new IKE_SA

This may happen if we are unable to allocate an SPI.

18 months agogithub: Bump wolfSSL to 4.7.0
Tobias Brunner [Tue, 16 Feb 2021 08:08:12 +0000 (09:08 +0100)]
github: Bump wolfSSL to 4.7.0

18 months agocirrus: Use FreeBSD 12.2
Fedor Korotkov [Mon, 15 Feb 2021 18:58:55 +0000 (13:58 -0500)]
cirrus: Use FreeBSD 12.2

This seems to fix the build with Autotools that recently started to fail

autom4te-2.69: need GNU m4 1.4 or later: /usr/local/bin/gm4
aclocal: error: /usr/local/bin/autom4te-2.69 failed with exit status: 1
autoreconf-2.69: aclocal failed with exit status: 1

Closes strongswan/strongswan#197.

18 months agogithub: Fix emojis in templates
Tobias Brunner [Mon, 15 Feb 2021 14:30:03 +0000 (15:30 +0100)]
github: Fix emojis in templates

18 months agogithub: Add security policy
Tobias Brunner [Thu, 21 Jan 2021 16:10:22 +0000 (17:10 +0100)]
github: Add security policy

18 months agogithub: Add issue templates
Tobias Brunner [Thu, 21 Jan 2021 15:19:25 +0000 (16:19 +0100)]
github: Add issue templates

18 months agobotan: Use strongSwan's RNG interface in Botan plugin
René Fischer [Fri, 22 Jan 2021 12:38:01 +0000 (13:38 +0100)]
botan: Use strongSwan's RNG interface in Botan plugin

This allows using rng_t implementations provided by other plugins to
serve as RNG for Botan.

Closes strongswan/strongswan#192.

18 months agobotan: Extract helper function to map RNG quality to Botan RNG names
Tobias Brunner [Fri, 29 Jan 2021 15:48:03 +0000 (16:48 +0100)]
botan: Extract helper function to map RNG quality to Botan RNG names

18 months agobotan: Look for Botan 3 in configure script
Tobias Brunner [Fri, 29 Jan 2021 15:45:02 +0000 (16:45 +0100)]
botan: Look for Botan 3 in configure script

18 months agoike-sa: Avoid possible integer underflow when scheduling reauth after rekeying
Tobias Brunner [Fri, 15 Jan 2021 15:19:49 +0000 (16:19 +0100)]
ike-sa: Avoid possible integer underflow when scheduling reauth after rekeying

If the reauthentication is scheduled while rekeying, the difference
might be negative, however, schedule_job() takes an unsigned int,
so the reauth would get scheduled very far in the future.

18 months agoha: Register new IKE_SAs before calling inherit_post()
Tobias Brunner [Fri, 15 Jan 2021 15:28:24 +0000 (16:28 +0100)]
ha: Register new IKE_SAs before calling inherit_post()

18 months agoike-rekey: Register new IKE_SA before calling inherit_post()
Tobias Brunner [Fri, 15 Jan 2021 15:25:54 +0000 (16:25 +0100)]
ike-rekey: Register new IKE_SA before calling inherit_post()

If rekeying and reauthetication coincided, the reauth job could get
scheduled to run immediately i.e. before checkin() was called.  So the
new IKE_SA would not get reauthenticated, however, the further delayed
delete job would later find the new IKE_SA and delete it.

18 months agoike-sa-manager: Add a method to register/check out new IKE_SAs
Tobias Brunner [Fri, 15 Jan 2021 15:09:59 +0000 (16:09 +0100)]
ike-sa-manager: Add a method to register/check out new IKE_SAs

This way, jobs for new IKE_SAs (created via create_new()) may be
scheduled/queued before checkin() is called.  If they run before
that happens, they will now correctly block in checkout() instead of
doing nothing because the IKE_SA was not found.

18 months agoike-sa-manager: Rename checkout_new() to create_new()
Tobias Brunner [Fri, 15 Jan 2021 15:08:20 +0000 (16:08 +0100)]
ike-sa-manager: Rename checkout_new() to create_new()

We don't actually check that SA out (i.e. it's not registered with the
manager).  That was originally different but had to be changed with
86993d6b9037 to avoid that SAs created for rekeying don't block other
threads on the manager.

18 months agoRemove redundant calls to set peer config after checking out IKE_SAs by config
Tobias Brunner [Fri, 15 Jan 2021 16:14:07 +0000 (17:14 +0100)]
Remove redundant calls to set peer config after checking out IKE_SAs by config

18 months agoike-sa-manager: Make checkout_by_config() atomic
Tobias Brunner [Tue, 17 Mar 2020 08:39:17 +0000 (09:39 +0100)]
ike-sa-manager: Make checkout_by_config() atomic

These changes should ensure that concurrent calls to checkout_by_config()
result in a single IKE_SA.  For instance, when acquires for different
children of the same connection are triggered concurrently.

There are two major changes to the interface:

 1) The peer config object is now always set on the returned IKE_SA.
    That was previously only the case if an existing IKE_SA was

 2) The IKE_SA is now always registered with the manager and properly
    checked out, which also was only the case for existing IKE_SAs

18 months agoMerge branch 'tls13'
Tobias Brunner [Fri, 12 Feb 2021 14:14:37 +0000 (15:14 +0100)]
Merge branch 'tls13'

This adds support for TLS 1.3 to libtls and adds several new features to
existing TLS versions (e.g. support for x25519/x448, EdDSA or RSA-PSS).

Unfortunately, TLS 1.3 is not really usable for TLS-based EAP methods in
practice because, in particular, key derivation is not yet standardized.
While it works between two strongSwan instances and even FreeRADIUS 3.0.21,
there will be compatibility issues in the future when implementations move
to a standardized scheme.  There are currently two Internet-Drafts in
development to specify that (see 121ac4b9e37e for details).  Until they are
more stable, the default maximum version is set to 1.2.

The default minimum version has also been increased to 1.2 and several
older/weaker cipher suites have been removed (e.g. with 3DES and MD5).

18 months agotls-crypto: Simplify and extend cipher config filter
Tobias Brunner [Thu, 11 Feb 2021 17:10:56 +0000 (18:10 +0100)]
tls-crypto: Simplify and extend cipher config filter

This way we automatically can filter for newer algorithms (e.g.

18 months agoproposal: Add aliases for AES-GCM/CCM without explicit ICV length
Tobias Brunner [Thu, 11 Feb 2021 17:06:49 +0000 (18:06 +0100)]
proposal: Add aliases for AES-GCM/CCM without explicit ICV length

These are mapped to use the default, maximum ICV length of 16 bytes.

18 months agotls-server: Support x25519/448 for TLS 1.2
Tobias Brunner [Thu, 11 Feb 2021 16:47:55 +0000 (17:47 +0100)]
tls-server: Support x25519/448 for TLS 1.2

18 months agotls-crypto: Fallback to any supported ECDH group
Tobias Brunner [Thu, 11 Feb 2021 16:46:17 +0000 (17:46 +0100)]
tls-crypto: Fallback to any supported ECDH group

If the default group listed in the cipher suite is not supported, we try
to use any other supported group (the groups are negotiated separately
so we are not locked in to a specific group).

18 months agotls-crypto: Don't filter suites with specific ECDH group if any is available
Tobias Brunner [Thu, 11 Feb 2021 16:09:04 +0000 (17:09 +0100)]
tls-crypto: Don't filter suites with specific ECDH group if any is available

Since DH groups (or with TLS < 1.3 curves) are negotiated separately,
it doesn't matter which one is listed in the cipher suite as any one could
be used.

18 months agodiffie-hellman: Classify x25519 and x448 as ECDH methods
Tobias Brunner [Thu, 11 Feb 2021 16:00:05 +0000 (17:00 +0100)]
diffie-hellman: Classify x25519 and x448 as ECDH methods

18 months agotls-crypto: Add signature scheme config file filter
Pascal Knecht [Mon, 1 Feb 2021 20:41:56 +0000 (21:41 +0100)]
tls-crypto: Add signature scheme config file filter

And add signature scheme unit tests.

18 months agotls-crypto: Rename DH group/key exchange method config option
Pascal Knecht [Mon, 18 Jan 2021 17:11:55 +0000 (18:11 +0100)]
tls-crypto: Rename DH group/key exchange method config option

TLS key exchange methods are now configured with `ke_group`.

18 months agolibtls: Increase default min version to 1.2
Tobias Brunner [Wed, 27 Jan 2021 13:40:22 +0000 (14:40 +0100)]
libtls: Increase default min version to 1.2

The older versions are generally considered deprecated (there is an
Internet-Draft that aims to do that formally).

18 months agotls-peer: Verify server selects the same cipher suite after HelloRetryRequest
Tobias Brunner [Fri, 22 Jan 2021 09:19:57 +0000 (10:19 +0100)]
tls-peer: Verify server selects the same cipher suite after HelloRetryRequest

This is as per RFC 8446, section 4.1.4.

18 months agotls-server: Select cipher suite also when handling HelloRetryRequest
Tobias Brunner [Fri, 22 Jan 2021 09:06:05 +0000 (10:06 +0100)]
tls-server: Select cipher suite also when handling HelloRetryRequest

This was previously treated like a resumption, which it is clearly not.
Also added a check that verifies that the same cipher suite is selected
during the retry, as per RFC 8446, section 4.1.4.

18 months agotls-server: Remove unused variable
Tobias Brunner [Fri, 22 Jan 2021 08:41:22 +0000 (09:41 +0100)]
tls-server: Remove unused variable

18 months agolibtls: Add downgrade protection for TLS 1.3 and TLS 1.2
Pascal Knecht [Sun, 17 Jan 2021 15:33:02 +0000 (16:33 +0100)]
libtls: Add downgrade protection for TLS 1.3 and TLS 1.2

Section 4.1.3 in RFC 8446 defines a new downgrade protection mechanism
that also affects TLS 1.2.

18 months agotls-server: Optionally omit CAs in CertificateRequest messages
Shmulik Ladkani [Fri, 15 Jan 2021 13:45:34 +0000 (14:45 +0100)]
tls-server: Optionally omit CAs in CertificateRequest messages

Usually, the DNs of all loaded CA certificates are included in the
CertificateRequest messages sent by the server.

Alas, certain EAP-TLS clients fail to process this message if the
list is too long, returning the fatal TLS alert 'illegal parameter'.

This new option allows configuring whether CAs are included or an
empty list is sent (TLS 1.2), or the certificate_authorities extension
is omitted (TLS 1.3).  The list only serves as hint/constraint
for clients during certificate selection, they still have to provide
a certificate but are free to select any one they have available.

Closes strongswan/strongswan#187.

18 months agotls-eap: Conclude EAP method also after processing packets
Tobias Brunner [Thu, 14 Jan 2021 17:02:00 +0000 (18:02 +0100)]
tls-eap: Conclude EAP method also after processing packets

With TLS 1.3, the server sends its Finished message first, so the
session is complete after processing the client's Finished message,
without having to send anything else (in particular no acknowledgement
as the last message from the client is no fragment).

18 months agolibtls: Only run socket tests with EdDSA keys if they are supported
Tobias Brunner [Thu, 14 Jan 2021 14:45:34 +0000 (15:45 +0100)]
libtls: Only run socket tests with EdDSA keys if they are supported

ECDSA support is currently required to run the tests because ECDSA
cipher suites are not filtered when determining the supported cipher
suites.  Also required are ECDH groups.