sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-04 00:00:14 -04:00
Code Issues Projects Releases Wiki Activity
19,486 Commits 101 Branches 327 Tags
Commit Graph

19486 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner
3d426cbfee Merge branch 'wolfssl-fips' 
Fixes various issues when building the wolfssl plugin against wolfSSL's
FIPS module.

References strongswan/strongswan#2603
Closes strongswan/strongswan#2771
 2025-06-02 11:31:03 +02:00
Juliusz Sosinowicz
f38bb91654 wolfssl: Unlock keys if necessary when using FIPS module 
Wrap the functions that require it in PRIVATE_KEY_UNLOCK/PRIVATE_KEY_LOCK.
This can't be done at plugin initialization because it needs to be done
for every thread. strongSwan currently doesn't provide on-thread-create
callbacks for plugins so we need to wrap each direct call. Another reason
to do so is that some functions we call (e.g. wc_EccKeyToDer) internally
call PRIVATE_KEY_UNLOCK/PRIVATE_KEY_LOCK and would leave the keys locked
for that particular thread.
 2025-06-02 09:15:05 +02:00
Juliusz Sosinowicz
85eb5c7812 wolfssl: Properly initialize ECC private key object 2025-06-02 09:15:05 +02:00
Tobias Brunner
879e3ce05a wolfssl: Set a dummy key when testing KDF implementations 
In FIPS mode, wolfSSL enforces a minimum key size for these algorithms.
 2025-06-02 09:15:05 +02:00
Tobias Brunner
757e00c0ae test-vectors: Remove HMAC PRF test vectors with key size 4 
Some implementations enforce a minimum key size (e.g. wolfSSL in FIPS
mode) and in practice, the keys will be longer anyway (e.g. our nonces
are 32 bytes).
 2025-06-02 09:15:05 +02:00
Tobias Brunner
d0292a6f50 wolfssl: Include settings.h in case WOLFSSL_USER_SETTINGS is defined 2025-06-02 09:15:05 +02:00
Tobias Brunner
217049606b wolfssl: Use consistent defines for ECC public/private key loading 
HAVE_ECC_KEY_IMPORT can be defined while HAVE_ECC_SIGN is not.
So just use the same defines we use when defining the load functions.
 2025-06-02 09:15:04 +02:00
Tobias Brunner
7bfd81d78a wolfssl: Call wc_SetSeed_Cb() as required for FIPS-mode 2025-06-02 09:15:04 +02:00
Tobias Brunner
3a5f203958 Merge branch 'iptfs' 
This adds basic support for IP-TFS/AGGFRAG (RFC 9347).  The Linux kernel,
since 6.14, only supports aggregation/fragmentation so far.  The actual
TFS features will get added later.
 2025-05-28 16:48:42 +02:00
Tobias Brunner
dc4fef146a testing: Add ikev2/net2net-iptfs scenario 2025-05-28 16:37:47 +02:00
Tobias Brunner
b4a0eb3603 testing: Add config for Linux 6.14 
This has IP-TFS enabled.
 2025-05-28 16:37:46 +02:00
Tobias Brunner
a7a3c4a22a conf: Document global IP-TFS settings 2025-05-28 16:37:46 +02:00
Tobias Brunner
46525cdc4f child-create: Negotiate IP-TFS mode if configured 2025-05-28 16:37:46 +02:00
Tobias Brunner
f5f7424e1d notify-payload: Add notify type for IP-TFS/AGGFRAG 2025-05-28 16:37:46 +02:00
Tobias Brunner
6372b2890f kernel-netlink: Support IPTFS mode and attributes 2025-05-28 16:37:46 +02:00
Tobias Brunner
f32773b3a8 child-sa: Allow disabling fragmenting packets across AGGFRAG payloads 
This is necessary if the peer isn't able to handle such fragments.
 2025-05-28 16:37:46 +02:00
Tobias Brunner
33db7a200f kernel-ipsec: Add flag to disable sending fragments across AGGFRAG payloads 
We have to set this if the peer indicates that it doesn't support
handling such fragments in the notify.
 2025-05-28 16:37:46 +02:00
Tobias Brunner
1afc76dd56 vici: Make IP-TFS mode configurable 2025-05-28 16:37:46 +02:00
Tobias Brunner
e175abaf89 include: Add XFRM mode and attributes for IP-TFS 2025-05-28 16:37:46 +02:00
Tobias Brunner
419528f2ac ipsec-types: Add new mode for IP-TFS 
Added at the end as the numeric mode is e.g. used in SQL databases.
 2025-05-28 16:37:27 +02:00
Tobias Brunner
72e3b7dcc8 Merge branch 'per-cpu-sas' 
This adds support for per-CPU SAs (RFC 9611).
 2025-05-28 16:36:10 +02:00
Tobias Brunner
b7d3349000 testing: Add ikev2/per-cpu-sas-encap-transport scenario 
Tests transport mode and UDP encapsulation with random source ports.
Interestingly, the responder always uses the same SA to respond (maybe
due to the cache on the policy).
 2025-05-28 16:35:27 +02:00
Tobias Brunner
3b2f8cf282 testing: Add ikev2/per-cpu-sas-encap scenario 
Basically the same as the one without UDP encapsulation, but here the
outbound SAs use random source ports.
 2025-05-28 16:35:27 +02:00
Tobias Brunner
d83fbe82e4 kernel-netlink: Suppress NAT mapping updates for per-CPU SAs 
As we set the remote port to 0, we'd get a mapping change message with
every packet. Setting the threshold avoids all kernel messages after the
first, which we suppress explicitly as well.
 2025-05-28 16:35:27 +02:00
Tobias Brunner
14e1ec2b77 child-sa: Configure UDP encapsulation for per-CPU SAs 
As the kernel does not support processing UDP-encapsulated and plain ESP
for the same SA, we require forcing UDP encapsulation if there is no NAT.
 2025-05-28 16:35:27 +02:00
Tobias Brunner
73083503f2 vici: Make UDP encapsulation for per-CPU SAs configurable 2025-05-28 16:35:27 +02:00
Tobias Brunner
d594171d9e child-cfg: Add flag to enable UDP encapsulation for per-CPU SAs 2025-05-28 16:35:27 +02:00
Tobias Brunner
bf34484d24 testing: Add per-CPU SA test scenario 2025-05-28 16:35:27 +02:00
Tobias Brunner
e24edb2991 testing: Configure multiple virtual CPUs for moon and sun 
This allows testing per-CPU SAs by e.g. pinging over a specific CPU
via taskset.
 2025-05-28 16:35:27 +02:00
Tobias Brunner
0edaadfc94 testing: Enable SMP support for latest kernels 2025-05-28 16:35:27 +02:00
Tobias Brunner
f95bdb6fb0 swanctl: Report per-CPU information in --list-sas 2025-05-28 16:35:27 +02:00
Tobias Brunner
c176d32a73 vici: Report per-CPU SA information 2025-05-28 16:35:27 +02:00
Tobias Brunner
fbfae44dd1 vici: Make per-CPU CHILD_SAs configurable 2025-05-28 16:35:27 +02:00
Tobias Brunner
a950ca3ec2 kernel-netlink: Forward CPU ID from acquires 2025-05-28 16:35:27 +02:00
Tobias Brunner
4a595508b7 trap-manager: Add support to handle acquires for per-CPU SAs 2025-05-28 16:35:27 +02:00
Tobias Brunner
65b7f9d563 kernel-handler: Log CPU ID that's passed with an acquire 2025-05-28 16:35:27 +02:00
Tobias Brunner
d6eed3979b kernel-interface: Optionally pass CPU ID for which an acquire was triggered 2025-05-28 16:35:27 +02:00
Tobias Brunner
2082fa5dd2 ike-sa: Accept optional CPU ID when initiating CHILD_SAs 2025-05-28 16:35:26 +02:00
Tobias Brunner
8e7f379f71 ike-sa: Sort CHILD_SAs by CPU ID 
This might make debugging easier and also ensures that a possible
fallback SA without CPU ID is established first when reestablishing
an IKE_SA.  Because even if such an SA is established first initially,
that might change later depending on when per-CPU SAs are rekeyed.
 2025-05-28 16:35:26 +02:00
Tobias Brunner
af34b5b1dc child-rekey: Maintain per-CPU values during rekeying 2025-05-28 16:35:26 +02:00
Tobias Brunner
bdf882d3af child-create: Add support to negotiate per-CPU SAs 2025-05-28 16:35:26 +02:00
Tobias Brunner
3a8bb93761 updown: Don't call the script for per-CPU SAs 
Rules are installed for the fallback SA that has no CPU ID assigned.
 2025-05-28 16:35:26 +02:00
Tobias Brunner
297be45275 ha: Ignore per-CPU CHILD_SAs 
These only work on initiators (with trap policies), which is something
the plugin doesn't support.
 2025-05-28 16:35:26 +02:00
Tobias Brunner
17f2188756 forecast: Ignore per-CPU CHILD_SAs 
Not sure if this combination does make sense as the plugin itself would
be a major bottleneck.

Similar to the connmark plugin, PREROUTING rules list SPIs or UDP ports,
which would be necessary for all SAs while the OUTPUT rules would only be
required once.
 2025-05-28 16:35:26 +02:00
Tobias Brunner
5faf884285 connmark: Ignore per-CPU CHILD_SAs 
The combination probably doesn't make much sense.

The OUTPUT rules would definitely only be required once, while the INPUT
and PREROUTING rules list individual SPIs and/or UDP ports, which would
be necessary for all SAs.

By the way, the rules in PREROUTING might actually not be necessary
anymore if the set_mark_in option was used for such SAs.
 2025-05-28 16:35:26 +02:00
Tobias Brunner
a505f4b9b0 child-sa: Add support for per-CPU SAs 
The CPU ID is also set on inbound SAs as it can be used to configure RSS
or some eBPF program.
 2025-05-28 16:35:26 +02:00
Tobias Brunner
bdfcfea1f2 kernel-netlink: Add support to enable per-CPU acquires on policies 2025-05-28 16:35:26 +02:00
Tobias Brunner
53be94d06c kernel-netlink: Add support to set CPU ID on SA 2025-05-28 16:35:26 +02:00
Tobias Brunner
12395cedf3 ipsec-types: Add identifier for the maximum (=no) CPU ID 2025-05-28 16:35:26 +02:00
Tobias Brunner
aa1322aed5 include: Add XFRM identifiers for per-CPU SAs/acquires 2025-05-28 16:35:26 +02:00