forked from pool/strongswan
removed obsolete patch files [deletion noted in changelog already]
OBS-URL: https://build.opensuse.org/package/show/network:vpn/strongswan?expand=0&rev=86
This commit is contained in:
Git OBS Bridge
parent
055879bc1c
commit
8a2afb449d
@ -1,413 +0,0 @@
|
||||
From 76ad8a6f4c83c999b9eb6d1a3506b1a8e593307e Mon Sep 17 00:00:00 2001
|
||||
From: Tobias Brunner <tobias@strongswan.org>
|
||||
Date: Fri, 20 Jun 2014 16:22:15 +0200
|
||||
Subject: [PATCH] Merge branch 'algorithm-order'
|
||||
Upstream: yes
|
||||
References: bsc#897512
|
||||
|
||||
Restores the behavior we had before 2e22333fb (except for RNGs), that is,
|
||||
algorithms are stored in the registration order again. Which is not optimal
|
||||
as we must rely on plugins to register them in a sensible order, but ordering
|
||||
them by identifier definitely caused weaker algorithms to be proposed first
|
||||
in the default proposal, which was even worse.
|
||||
---
|
||||
src/libstrongswan/crypto/crypto_factory.c | 18 +-
|
||||
src/libstrongswan/tests/Makefile.am | 1 +
|
||||
.../tests/suites/test_crypto_factory.c | 312 +++++++++++++++++++++
|
||||
src/libstrongswan/tests/tests.h | 1 +
|
||||
4 files changed, 327 insertions(+), 5 deletions(-)
|
||||
create mode 100644 src/libstrongswan/tests/suites/test_crypto_factory.c
|
||||
|
||||
diff --git a/src/libstrongswan/crypto/crypto_factory.c b/src/libstrongswan/crypto/crypto_factory.c
|
||||
index 6dea30e..96fbc0d 100644
|
||||
--- a/src/libstrongswan/crypto/crypto_factory.c
|
||||
+++ b/src/libstrongswan/crypto/crypto_factory.c
|
||||
@@ -392,10 +392,10 @@ METHOD(crypto_factory_t, create_dh, diffie_hellman_t*,
|
||||
/**
|
||||
* Insert an algorithm entry to a list
|
||||
*
|
||||
- * Entries are sorted by algorithm identifier (which is important for RNGs)
|
||||
- * while maintaining the order in which algorithms were added, unless they were
|
||||
+ * Entries maintain the order in which algorithms were added, unless they were
|
||||
* benchmarked and speed is provided, which then is used to order entries of
|
||||
* the same algorithm.
|
||||
+ * An exception are RNG entries, which are sorted by algorithm identifier.
|
||||
*/
|
||||
static void add_entry(private_crypto_factory_t *this, linked_list_t *list,
|
||||
int algo, const char *plugin_name,
|
||||
@@ -403,6 +403,7 @@ static void add_entry(private_crypto_factory_t *this, linked_list_t *list,
|
||||
{
|
||||
enumerator_t *enumerator;
|
||||
entry_t *entry, *current;
|
||||
+ bool sort = (list == this->rngs), found = FALSE;
|
||||
|
||||
INIT(entry,
|
||||
.algo = algo,
|
||||
@@ -415,12 +416,19 @@ static void add_entry(private_crypto_factory_t *this, linked_list_t *list,
|
||||
enumerator = list->create_enumerator(list);
|
||||
while (enumerator->enumerate(enumerator, ¤t))
|
||||
{
|
||||
- if (current->algo > algo)
|
||||
+ if (sort && current->algo > algo)
|
||||
{
|
||||
break;
|
||||
}
|
||||
- else if (current->algo == algo && speed &&
|
||||
- current->speed < speed)
|
||||
+ else if (current->algo == algo)
|
||||
+ {
|
||||
+ if (speed > current->speed)
|
||||
+ {
|
||||
+ break;
|
||||
+ }
|
||||
+ found = TRUE;
|
||||
+ }
|
||||
+ else if (found)
|
||||
{
|
||||
break;
|
||||
}
|
||||
diff --git a/src/libstrongswan/tests/Makefile.am b/src/libstrongswan/tests/Makefile.am
|
||||
index 331a548..0bdf2b3 100644
|
||||
--- a/src/libstrongswan/tests/Makefile.am
|
||||
+++ b/src/libstrongswan/tests/Makefile.am
|
||||
@@ -42,6 +42,7 @@ tests_SOURCES = tests.h tests.c \
|
||||
suites/test_host.c \
|
||||
suites/test_hasher.c \
|
||||
suites/test_crypter.c \
|
||||
+ suites/test_crypto_factory.c \
|
||||
suites/test_pen.c \
|
||||
suites/test_asn1.c \
|
||||
suites/test_asn1_parser.c \
|
||||
diff --git a/src/libstrongswan/tests/suites/test_crypto_factory.c b/src/libstrongswan/tests/suites/test_crypto_factory.c
|
||||
new file mode 100644
|
||||
index 0000000..94f45da
|
||||
--- /dev/null
|
||||
+++ b/src/libstrongswan/tests/suites/test_crypto_factory.c
|
||||
@@ -0,0 +1,312 @@
|
||||
+/*
|
||||
+ * Copyright (C) 2014 Tobias Brunner
|
||||
+ * Hochschule fuer Technik Rapperswil
|
||||
+ *
|
||||
+ * This program is free software; you can redistribute it and/or modify it
|
||||
+ * under the terms of the GNU General Public License as published by the
|
||||
+ * Free Software Foundation; either version 2 of the License, or (at your
|
||||
+ * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
|
||||
+ *
|
||||
+ * This program is distributed in the hope that it will be useful, but
|
||||
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
|
||||
+ * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
+ * for more details.
|
||||
+ */
|
||||
+
|
||||
+#include "test_suite.h"
|
||||
+
|
||||
+#include <crypto/crypto_factory.h>
|
||||
+
|
||||
+static rng_t *rng_create(rng_quality_t quality)
|
||||
+{
|
||||
+ rng_quality_t *q = malloc_thing(rng_quality_t);
|
||||
+ *q = quality;
|
||||
+ return (rng_t*)q;
|
||||
+}
|
||||
+
|
||||
+static rng_t *rng_create_weak(rng_quality_t quality)
|
||||
+{
|
||||
+ ck_assert(quality == RNG_WEAK);
|
||||
+ return rng_create(RNG_WEAK);
|
||||
+}
|
||||
+
|
||||
+static rng_t *rng_create_strong(rng_quality_t quality)
|
||||
+{
|
||||
+ ck_assert(quality <= RNG_STRONG);
|
||||
+ return rng_create(RNG_STRONG);
|
||||
+}
|
||||
+
|
||||
+static rng_t *rng_create_true(rng_quality_t quality)
|
||||
+{
|
||||
+ ck_assert(quality <= RNG_TRUE);
|
||||
+ return rng_create(RNG_TRUE);
|
||||
+}
|
||||
+
|
||||
+static rng_t *rng_create_true_second(rng_quality_t quality)
|
||||
+{
|
||||
+ fail("should never be called");
|
||||
+ return rng_create(RNG_TRUE);
|
||||
+}
|
||||
+
|
||||
+static rng_quality_t rng_weak = RNG_WEAK;
|
||||
+static rng_quality_t rng_strong = RNG_STRONG;
|
||||
+static rng_quality_t rng_true = RNG_TRUE;
|
||||
+
|
||||
+static struct {
|
||||
+ rng_quality_t *exp_weak;
|
||||
+ rng_quality_t *exp_strong;
|
||||
+ rng_quality_t *exp_true;
|
||||
+ struct {
|
||||
+ rng_quality_t *q;
|
||||
+ rng_constructor_t create;
|
||||
+ } data[4];
|
||||
+} rng_data[] = {
|
||||
+ { NULL, NULL, NULL, {
|
||||
+ { NULL, NULL }
|
||||
+ }},
|
||||
+ { &rng_weak, NULL, NULL, {
|
||||
+ { &rng_weak, rng_create_weak },
|
||||
+ { NULL, NULL }
|
||||
+ }},
|
||||
+ { &rng_strong, &rng_strong, NULL, {
|
||||
+ { &rng_strong, rng_create_strong },
|
||||
+ { NULL, NULL }
|
||||
+ }},
|
||||
+ { &rng_true, &rng_true, &rng_true, {
|
||||
+ { &rng_true, rng_create_true },
|
||||
+ { NULL, NULL }
|
||||
+ }},
|
||||
+ { &rng_true, &rng_true, &rng_true, {
|
||||
+ { &rng_true, rng_create_true },
|
||||
+ { &rng_true, rng_create_true_second },
|
||||
+ { NULL, NULL }
|
||||
+ }},
|
||||
+ { &rng_weak, &rng_true, &rng_true, {
|
||||
+ { &rng_weak, rng_create_weak },
|
||||
+ { &rng_true, rng_create_true },
|
||||
+ { NULL, NULL }
|
||||
+ }},
|
||||
+ { &rng_weak, &rng_strong, &rng_true, {
|
||||
+ { &rng_true, rng_create_true },
|
||||
+ { &rng_strong, rng_create_strong },
|
||||
+ { &rng_weak, rng_create_weak },
|
||||
+ { NULL, NULL }
|
||||
+ }},
|
||||
+ { &rng_weak, &rng_strong, &rng_true, {
|
||||
+ { &rng_weak, rng_create_weak },
|
||||
+ { &rng_strong, rng_create_strong },
|
||||
+ { &rng_true, rng_create_true },
|
||||
+ { NULL, NULL }
|
||||
+ }},
|
||||
+};
|
||||
+
|
||||
+static void verify_rng(crypto_factory_t *factory, rng_quality_t request,
|
||||
+ rng_quality_t *expected)
|
||||
+{
|
||||
+ rng_quality_t *res;
|
||||
+
|
||||
+ res = (rng_quality_t*)factory->create_rng(factory, request);
|
||||
+ if (!expected)
|
||||
+ {
|
||||
+ ck_assert(!res);
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ ck_assert(res);
|
||||
+ ck_assert_int_eq(*expected, *res);
|
||||
+ free(res);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+START_TEST(test_create_rng)
|
||||
+{
|
||||
+ crypto_factory_t *factory;
|
||||
+ int i;
|
||||
+
|
||||
+ factory = crypto_factory_create();
|
||||
+ for (i = 0; rng_data[_i].data[i].q; i++)
|
||||
+ {
|
||||
+ ck_assert(factory->add_rng(factory, *rng_data[_i].data[i].q, "test",
|
||||
+ rng_data[_i].data[i].create));
|
||||
+ }
|
||||
+ verify_rng(factory, RNG_WEAK, rng_data[_i].exp_weak);
|
||||
+ verify_rng(factory, RNG_STRONG, rng_data[_i].exp_strong);
|
||||
+ verify_rng(factory, RNG_TRUE, rng_data[_i].exp_true);
|
||||
+ for (i = 0; rng_data[_i].data[i].q; i++)
|
||||
+ {
|
||||
+ factory->remove_rng(factory, rng_data[_i].data[i].create);
|
||||
+ }
|
||||
+ factory->destroy(factory);
|
||||
+}
|
||||
+END_TEST
|
||||
+
|
||||
+static diffie_hellman_t *dh_create(char *plugin)
|
||||
+{
|
||||
+ return (diffie_hellman_t*)plugin;
|
||||
+}
|
||||
+
|
||||
+static diffie_hellman_t *dh_create_modp1024(diffie_hellman_group_t group, ...)
|
||||
+{
|
||||
+ ck_assert(group == MODP_1024_BIT);
|
||||
+ return dh_create("plugin1");
|
||||
+}
|
||||
+
|
||||
+static diffie_hellman_t *dh_create_modp1024_second(diffie_hellman_group_t group,
|
||||
+ ...)
|
||||
+{
|
||||
+ ck_assert(group == MODP_1024_BIT);
|
||||
+ return dh_create("plugin2");
|
||||
+}
|
||||
+
|
||||
+static diffie_hellman_t *dh_create_modp2048(diffie_hellman_group_t group, ...)
|
||||
+{
|
||||
+ ck_assert(group == MODP_2048_BIT);
|
||||
+ return dh_create("plugin1");
|
||||
+}
|
||||
+
|
||||
+static diffie_hellman_t *dh_create_modp2048_second(diffie_hellman_group_t group,
|
||||
+ ...)
|
||||
+{
|
||||
+ ck_assert(group == MODP_2048_BIT);
|
||||
+ return dh_create("plugin2");
|
||||
+}
|
||||
+
|
||||
+static struct {
|
||||
+ char *exp1024;
|
||||
+ char *exp2048;
|
||||
+ struct {
|
||||
+ diffie_hellman_group_t g;
|
||||
+ dh_constructor_t create;
|
||||
+ char *plugin;
|
||||
+ } data[4];
|
||||
+} dh_data[] = {
|
||||
+ { NULL, NULL, {
|
||||
+ { MODP_NONE, NULL, NULL }
|
||||
+ }},
|
||||
+ { "plugin1", NULL, {
|
||||
+ { MODP_1024_BIT, dh_create_modp1024, "plugin1" },
|
||||
+ { MODP_NONE, NULL, NULL }
|
||||
+ }},
|
||||
+ { "plugin1", NULL, {
|
||||
+ { MODP_1024_BIT, dh_create_modp1024, "plugin1" },
|
||||
+ { MODP_1024_BIT, dh_create_modp1024_second, "plugin2" },
|
||||
+ { MODP_NONE, NULL, NULL }
|
||||
+ }},
|
||||
+ { "plugin2", NULL, {
|
||||
+ { MODP_1024_BIT, dh_create_modp1024_second, "plugin2" },
|
||||
+ { MODP_1024_BIT, dh_create_modp1024, "plugin1" },
|
||||
+ { MODP_NONE, NULL, NULL }
|
||||
+ }},
|
||||
+ { "plugin1", "plugin1", {
|
||||
+ { MODP_1024_BIT, dh_create_modp1024, "plugin1" },
|
||||
+ { MODP_2048_BIT, dh_create_modp2048, "plugin1" },
|
||||
+ { MODP_NONE, NULL }
|
||||
+ }},
|
||||
+ { "plugin1", "plugin1", {
|
||||
+ { MODP_2048_BIT, dh_create_modp2048, "plugin1" },
|
||||
+ { MODP_1024_BIT, dh_create_modp1024, "plugin1" },
|
||||
+ { MODP_NONE, NULL }
|
||||
+ }},
|
||||
+ { "plugin1", "plugin1", {
|
||||
+ { MODP_2048_BIT, dh_create_modp2048, "plugin1" },
|
||||
+ { MODP_2048_BIT, dh_create_modp2048_second, "plugin2" },
|
||||
+ { MODP_1024_BIT, dh_create_modp1024, "plugin1" },
|
||||
+ { MODP_NONE, NULL }
|
||||
+ }},
|
||||
+ { "plugin1", "plugin2", {
|
||||
+ { MODP_2048_BIT, dh_create_modp2048_second, "plugin2" },
|
||||
+ { MODP_2048_BIT, dh_create_modp2048, "plugin1" },
|
||||
+ { MODP_1024_BIT, dh_create_modp1024, "plugin1" },
|
||||
+ { MODP_NONE, NULL }
|
||||
+ }},
|
||||
+};
|
||||
+
|
||||
+static void verify_dh(crypto_factory_t *factory, diffie_hellman_group_t request,
|
||||
+ char *expected)
|
||||
+{
|
||||
+ char *plugin;
|
||||
+
|
||||
+ plugin = (char*)factory->create_dh(factory, request);
|
||||
+ if (!expected)
|
||||
+ {
|
||||
+ ck_assert(!plugin);
|
||||
+ }
|
||||
+ else
|
||||
+ {
|
||||
+ ck_assert(plugin);
|
||||
+ ck_assert_str_eq(expected, plugin);
|
||||
+ }
|
||||
+}
|
||||
+
|
||||
+START_TEST(test_create_dh)
|
||||
+{
|
||||
+ enumerator_t *enumerator;
|
||||
+ crypto_factory_t *factory;
|
||||
+ diffie_hellman_group_t group;
|
||||
+ char *plugin;
|
||||
+ int i, len = 0;
|
||||
+
|
||||
+
|
||||
+ factory = crypto_factory_create();
|
||||
+ for (i = 0; dh_data[_i].data[i].g != MODP_NONE; i++)
|
||||
+ {
|
||||
+ ck_assert(factory->add_dh(factory, dh_data[_i].data[i].g,
|
||||
+ dh_data[_i].data[i].plugin,
|
||||
+ dh_data[_i].data[i].create));
|
||||
+ }
|
||||
+ verify_dh(factory, MODP_1024_BIT, dh_data[_i].exp1024);
|
||||
+ verify_dh(factory, MODP_2048_BIT, dh_data[_i].exp2048);
|
||||
+
|
||||
+ len = countof(dh_data[_i].data);
|
||||
+ enumerator = factory->create_dh_enumerator(factory);
|
||||
+ for (i = 0; enumerator->enumerate(enumerator, &group, &plugin) && i < len;)
|
||||
+ {
|
||||
+ ck_assert_int_eq(dh_data[_i].data[i].g, group);
|
||||
+ while (dh_data[_i].data[i].g == group)
|
||||
+ { /* skip other entries by the same group */
|
||||
+ i++;
|
||||
+ }
|
||||
+ switch (group)
|
||||
+ {
|
||||
+ case MODP_1024_BIT:
|
||||
+ ck_assert(dh_data[_i].exp1024);
|
||||
+ ck_assert_str_eq(dh_data[_i].exp1024, plugin);
|
||||
+ break;
|
||||
+ case MODP_2048_BIT:
|
||||
+ ck_assert(dh_data[_i].exp2048);
|
||||
+ ck_assert_str_eq(dh_data[_i].exp2048, plugin);
|
||||
+ break;
|
||||
+ default:
|
||||
+ fail("unexpected DH group");
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+ ck_assert(!enumerator->enumerate(enumerator));
|
||||
+ ck_assert_int_eq(dh_data[_i].data[i].g, MODP_NONE);
|
||||
+ enumerator->destroy(enumerator);
|
||||
+
|
||||
+ for (i = 0; dh_data[_i].data[i].g != MODP_NONE; i++)
|
||||
+ {
|
||||
+ factory->remove_dh(factory, dh_data[_i].data[i].create);
|
||||
+ }
|
||||
+ factory->destroy(factory);
|
||||
+}
|
||||
+END_TEST
|
||||
+
|
||||
+Suite *crypto_factory_suite_create()
|
||||
+{
|
||||
+ Suite *s;
|
||||
+ TCase *tc;
|
||||
+
|
||||
+ s = suite_create("crypto-factory");
|
||||
+
|
||||
+ tc = tcase_create("create_rng");
|
||||
+ tcase_add_loop_test(tc, test_create_rng, 0, countof(rng_data));
|
||||
+ suite_add_tcase(s, tc);
|
||||
+
|
||||
+ tc = tcase_create("create_dh");
|
||||
+ tcase_add_loop_test(tc, test_create_dh, 0, countof(dh_data));
|
||||
+ suite_add_tcase(s, tc);
|
||||
+
|
||||
+ return s;
|
||||
+}
|
||||
diff --git a/src/libstrongswan/tests/tests.h b/src/libstrongswan/tests/tests.h
|
||||
index 82a5137..ab0f642 100644
|
||||
--- a/src/libstrongswan/tests/tests.h
|
||||
+++ b/src/libstrongswan/tests/tests.h
|
||||
@@ -35,6 +35,7 @@ TEST_SUITE(host_suite_create)
|
||||
TEST_SUITE(printf_suite_create)
|
||||
TEST_SUITE(hasher_suite_create)
|
||||
TEST_SUITE(crypter_suite_create)
|
||||
+TEST_SUITE(crypto_factory_suite_create)
|
||||
TEST_SUITE(pen_suite_create)
|
||||
TEST_SUITE(asn1_suite_create)
|
||||
TEST_SUITE(asn1_parser_suite_create)
|
||||
--
|
||||
2.1.2
|
||||
|
||||
@ -1,166 +0,0 @@
|
||||
From a78ecdd47509626711a13481f53696e01d4b8c62 Mon Sep 17 00:00:00 2001
|
||||
From: Tobias Brunner <tobias@strongswan.org>
|
||||
Date: Mon, 1 Dec 2014 17:21:59 +0100
|
||||
Subject: [PATCH] crypto: Define MODP_CUSTOM outside of IKE DH range
|
||||
References: bsc#910491,CVE-2014-9221
|
||||
Upstream: yes
|
||||
|
||||
Before this fix it was possible to crash charon with an IKE_SA_INIT
|
||||
message containing a KE payload with DH group MODP_CUSTOM(1025).
|
||||
Defining MODP_CUSTOM outside of the two byte IKE DH identifier range
|
||||
prevents it from getting negotiated.
|
||||
|
||||
Fixes CVE-2014-9221 in version 5.1.2 and newer.
|
||||
---
|
||||
src/charon-tkm/src/tkm/tkm_diffie_hellman.c | 2 +-
|
||||
src/libstrongswan/crypto/diffie_hellman.c | 11 ++++++-----
|
||||
src/libstrongswan/crypto/diffie_hellman.h | 6 ++++--
|
||||
src/libstrongswan/plugins/gcrypt/gcrypt_dh.c | 2 +-
|
||||
src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c | 2 +-
|
||||
src/libstrongswan/plugins/ntru/ntru_ke.c | 2 +-
|
||||
src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c | 2 +-
|
||||
src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c | 2 +-
|
||||
src/libstrongswan/plugins/pkcs11/pkcs11_dh.c | 2 +-
|
||||
9 files changed, 17 insertions(+), 14 deletions(-)
|
||||
|
||||
diff --git a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
|
||||
index 67db5e6d87d6..836e0b7f088d 100644
|
||||
--- a/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
|
||||
+++ b/src/charon-tkm/src/tkm/tkm_diffie_hellman.c
|
||||
@@ -41,7 +41,7 @@ struct private_tkm_diffie_hellman_t {
|
||||
/**
|
||||
* Diffie Hellman group number.
|
||||
*/
|
||||
- u_int16_t group;
|
||||
+ diffie_hellman_group_t group;
|
||||
|
||||
/**
|
||||
* Diffie Hellman public value.
|
||||
diff --git a/src/libstrongswan/crypto/diffie_hellman.c b/src/libstrongswan/crypto/diffie_hellman.c
|
||||
index bada1c529951..ac106e9c4d45 100644
|
||||
--- a/src/libstrongswan/crypto/diffie_hellman.c
|
||||
+++ b/src/libstrongswan/crypto/diffie_hellman.c
|
||||
@@ -42,15 +42,16 @@ ENUM_NEXT(diffie_hellman_group_names, MODP_1024_160, ECP_512_BP, ECP_521_BIT,
|
||||
"ECP_256_BP",
|
||||
"ECP_384_BP",
|
||||
"ECP_512_BP");
|
||||
-ENUM_NEXT(diffie_hellman_group_names, MODP_NULL, MODP_CUSTOM, ECP_512_BP,
|
||||
- "MODP_NULL",
|
||||
- "MODP_CUSTOM");
|
||||
-ENUM_NEXT(diffie_hellman_group_names, NTRU_112_BIT, NTRU_256_BIT, MODP_CUSTOM,
|
||||
+ENUM_NEXT(diffie_hellman_group_names, MODP_NULL, MODP_NULL, ECP_512_BP,
|
||||
+ "MODP_NULL");
|
||||
+ENUM_NEXT(diffie_hellman_group_names, NTRU_112_BIT, NTRU_256_BIT, MODP_NULL,
|
||||
"NTRU_112",
|
||||
"NTRU_128",
|
||||
"NTRU_192",
|
||||
"NTRU_256");
|
||||
-ENUM_END(diffie_hellman_group_names, NTRU_256_BIT);
|
||||
+ENUM_NEXT(diffie_hellman_group_names, MODP_CUSTOM, MODP_CUSTOM, NTRU_256_BIT,
|
||||
+ "MODP_CUSTOM");
|
||||
+ENUM_END(diffie_hellman_group_names, MODP_CUSTOM);
|
||||
|
||||
|
||||
/**
|
||||
diff --git a/src/libstrongswan/crypto/diffie_hellman.h b/src/libstrongswan/crypto/diffie_hellman.h
|
||||
index 105db22f14d4..d5161d077bb2 100644
|
||||
--- a/src/libstrongswan/crypto/diffie_hellman.h
|
||||
+++ b/src/libstrongswan/crypto/diffie_hellman.h
|
||||
@@ -63,12 +63,14 @@ enum diffie_hellman_group_t {
|
||||
/** insecure NULL diffie hellman group for testing, in PRIVATE USE */
|
||||
MODP_NULL = 1024,
|
||||
/** MODP group with custom generator/prime */
|
||||
- MODP_CUSTOM = 1025,
|
||||
/** Parameters defined by IEEE 1363.1, in PRIVATE USE */
|
||||
NTRU_112_BIT = 1030,
|
||||
NTRU_128_BIT = 1031,
|
||||
NTRU_192_BIT = 1032,
|
||||
- NTRU_256_BIT = 1033
|
||||
+ NTRU_256_BIT = 1033,
|
||||
+ /** internally used DH group with additional parameters g and p, outside
|
||||
+ * of PRIVATE USE (i.e. IKEv2 DH group range) so it can't be negotiated */
|
||||
+ MODP_CUSTOM = 65536,
|
||||
};
|
||||
|
||||
/**
|
||||
diff --git a/src/libstrongswan/plugins/gcrypt/gcrypt_dh.c b/src/libstrongswan/plugins/gcrypt/gcrypt_dh.c
|
||||
index f418b941db86..299865da2e09 100644
|
||||
--- a/src/libstrongswan/plugins/gcrypt/gcrypt_dh.c
|
||||
+++ b/src/libstrongswan/plugins/gcrypt/gcrypt_dh.c
|
||||
@@ -35,7 +35,7 @@ struct private_gcrypt_dh_t {
|
||||
/**
|
||||
* Diffie Hellman group number
|
||||
*/
|
||||
- u_int16_t group;
|
||||
+ diffie_hellman_group_t group;
|
||||
|
||||
/*
|
||||
* Generator value
|
||||
diff --git a/src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c b/src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c
|
||||
index b74d35169f44..9936f7e4518f 100644
|
||||
--- a/src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c
|
||||
+++ b/src/libstrongswan/plugins/gmp/gmp_diffie_hellman.c
|
||||
@@ -42,7 +42,7 @@ struct private_gmp_diffie_hellman_t {
|
||||
/**
|
||||
* Diffie Hellman group number.
|
||||
*/
|
||||
- u_int16_t group;
|
||||
+ diffie_hellman_group_t group;
|
||||
|
||||
/*
|
||||
* Generator value.
|
||||
diff --git a/src/libstrongswan/plugins/ntru/ntru_ke.c b/src/libstrongswan/plugins/ntru/ntru_ke.c
|
||||
index abaa22336221..e64f32b91d0e 100644
|
||||
--- a/src/libstrongswan/plugins/ntru/ntru_ke.c
|
||||
+++ b/src/libstrongswan/plugins/ntru/ntru_ke.c
|
||||
@@ -56,7 +56,7 @@ struct private_ntru_ke_t {
|
||||
/**
|
||||
* Diffie Hellman group number.
|
||||
*/
|
||||
- u_int16_t group;
|
||||
+ diffie_hellman_group_t group;
|
||||
|
||||
/**
|
||||
* NTRU Parameter Set
|
||||
diff --git a/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c b/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c
|
||||
index ff3382473666..1e68ac59b838 100644
|
||||
--- a/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c
|
||||
+++ b/src/libstrongswan/plugins/openssl/openssl_diffie_hellman.c
|
||||
@@ -38,7 +38,7 @@ struct private_openssl_diffie_hellman_t {
|
||||
/**
|
||||
* Diffie Hellman group number.
|
||||
*/
|
||||
- u_int16_t group;
|
||||
+ diffie_hellman_group_t group;
|
||||
|
||||
/**
|
||||
* Diffie Hellman object
|
||||
diff --git a/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c b/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c
|
||||
index b487d59a59a3..50853d6f0bde 100644
|
||||
--- a/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c
|
||||
+++ b/src/libstrongswan/plugins/openssl/openssl_ec_diffie_hellman.c
|
||||
@@ -40,7 +40,7 @@ struct private_openssl_ec_diffie_hellman_t {
|
||||
/**
|
||||
* Diffie Hellman group number.
|
||||
*/
|
||||
- u_int16_t group;
|
||||
+ diffie_hellman_group_t group;
|
||||
|
||||
/**
|
||||
* EC private (public) key
|
||||
diff --git a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
|
||||
index 36cc284bf2b5..23b63d2386af 100644
|
||||
--- a/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
|
||||
+++ b/src/libstrongswan/plugins/pkcs11/pkcs11_dh.c
|
||||
@@ -47,7 +47,7 @@ struct private_pkcs11_dh_t {
|
||||
/**
|
||||
* Diffie Hellman group number.
|
||||
*/
|
||||
- u_int16_t group;
|
||||
+ diffie_hellman_group_t group;
|
||||
|
||||
/**
|
||||
* Handle for own private value
|
||||
--
|
||||
1.9.1
|
||||
|
||||
Loading…
Reference in New Issue
Block a user