Commit 7deea87d authored by Timo Teräs's avatar Timo Teräs

main/strongswan: security upgrade to 5.3.2 (CVE-2015-4171)

and apply the quagga-nhrp required patches
parent d17bb766
From b47b7feba0a45d70c8909fad37e97baa0d317144 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Thu, 30 Apr 2015 12:08:13 +0300
Subject: [PATCH 2/4] vici: send certificates for ike-sa events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
---
src/libcharon/plugins/vici/vici_query.c | 42 +++++++++++++++++++++++++++++----
1 file changed, 38 insertions(+), 4 deletions(-)
diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
index d94d760..3d461f7 100644
--- a/src/libcharon/plugins/vici/vici_query.c
+++ b/src/libcharon/plugins/vici/vici_query.c
@@ -225,13 +225,15 @@ static void list_task_queue(private_vici_query_t *this, vici_builder_t *b,
* List details of an IKE_SA
*/
static void list_ike(private_vici_query_t *this, vici_builder_t *b,
- ike_sa_t *ike_sa, time_t now)
+ ike_sa_t *ike_sa, time_t now, bool add_certs)
{
time_t t;
ike_sa_id_t *id;
identification_t *eap;
proposal_t *proposal;
u_int16_t alg, ks;
+ auth_cfg_t *auth_cfg;
+ enumerator_t *enumerator;
b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa));
b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa));
@@ -239,9 +241,41 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
b->add_kv(b, "local-host", "%H", ike_sa->get_my_host(ike_sa));
b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa));
+ if (add_certs)
+ {
+ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, TRUE);
+ if (enumerator->enumerate(enumerator, &auth_cfg))
+ {
+ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
+ chunk_t encoding;
+
+ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
+ {
+ b->add(b, VICI_KEY_VALUE, "local-cert-data", encoding);
+ free(encoding.ptr);
+ }
+ }
+ enumerator->destroy(enumerator);
+ }
b->add_kv(b, "remote-host", "%H", ike_sa->get_other_host(ike_sa));
b->add_kv(b, "remote-id", "%Y", ike_sa->get_other_id(ike_sa));
+ if (add_certs)
+ {
+ enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
+ if (enumerator->enumerate(enumerator, &auth_cfg))
+ {
+ certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
+ chunk_t encoding;
+
+ if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
+ {
+ b->add(b, VICI_KEY_VALUE, "remote-cert-data", encoding);
+ free(encoding.ptr);
+ }
+ }
+ enumerator->destroy(enumerator);
+ }
eap = ike_sa->get_other_eap_id(ike_sa);
@@ -348,7 +382,7 @@ CALLBACK(list_sas, vici_message_t*,
b = vici_builder_create();
b->begin_section(b, ike_sa->get_name(ike_sa));
- list_ike(this, b, ike_sa, now);
+ list_ike(this, b, ike_sa, now, TRUE);
b->begin_section(b, "child-sas");
csas = ike_sa->create_child_sa_enumerator(ike_sa);
@@ -1055,7 +1089,7 @@ METHOD(listener_t, ike_updown, bool,
b = vici_builder_create();
b->begin_section(b, ike_sa->get_name(ike_sa));
- list_ike(this, b, ike_sa, now);
+ list_ike(this, b, ike_sa, now, up);
b->begin_section(b, "child-sas");
b->end_section(b);
b->end_section(b);
@@ -1081,7 +1115,7 @@ METHOD(listener_t, child_updown, bool,
b = vici_builder_create();
b->begin_section(b, ike_sa->get_name(ike_sa));
- list_ike(this, b, ike_sa, now);
+ list_ike(this, b, ike_sa, now, up);
b->begin_section(b, "child-sas");
b->begin_section(b, child_sa->get_name(child_sa));
--
2.4.2
From 228bfd9f9c0fb27a6802f5d4dc8d747cf4644a1d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Thu, 30 Apr 2015 10:58:15 +0300
Subject: [PATCH 3/4] vici: add support rekeying events, and individual sa
state changes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Useful for monitoring and tracking full SA.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
---
src/libcharon/plugins/vici/vici_query.c | 160 ++++++++++++++++++++++++++++++++
1 file changed, 160 insertions(+)
diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
index 3d461f7..ade181c 100644
--- a/src/libcharon/plugins/vici/vici_query.c
+++ b/src/libcharon/plugins/vici/vici_query.c
@@ -1065,7 +1065,13 @@ static void manage_commands(private_vici_query_t *this, bool reg)
this->dispatcher->manage_event(this->dispatcher, "list-conn", reg);
this->dispatcher->manage_event(this->dispatcher, "list-cert", reg);
this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg);
+ this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg);
+ this->dispatcher->manage_event(this->dispatcher, "ike-state-established", reg);
+ this->dispatcher->manage_event(this->dispatcher, "ike-state-destroying", reg);
this->dispatcher->manage_event(this->dispatcher, "child-updown", reg);
+ this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg);
+ this->dispatcher->manage_event(this->dispatcher, "child-state-installed", reg);
+ this->dispatcher->manage_event(this->dispatcher, "child-state-destroying", reg);
manage_command(this, "list-sas", list_sas, reg);
manage_command(this, "list-policies", list_policies, reg);
manage_command(this, "list-conns", list_conns, reg);
@@ -1100,6 +1106,77 @@ METHOD(listener_t, ike_updown, bool,
return TRUE;
}
+METHOD(listener_t, ike_rekey, bool,
+ private_vici_query_t *this, ike_sa_t *old, ike_sa_t *new)
+{
+ vici_builder_t *b;
+ time_t now;
+
+ if (!this->dispatcher->has_event_listeners(this->dispatcher, "ike-rekey"))
+ {
+ return TRUE;
+ }
+
+ now = time_monotonic(NULL);
+
+ b = vici_builder_create();
+ b->begin_section(b, old->get_name(old));
+ list_ike(this, b, old, now, TRUE);
+ b->begin_section(b, "child-sas");
+ b->end_section(b);
+ b->end_section(b);
+
+ b->begin_section(b, new->get_name(new));
+ list_ike(this, b, new, now, TRUE);
+ b->begin_section(b, "child-sas");
+ b->end_section(b);
+ b->end_section(b);
+
+ this->dispatcher->raise_event(this->dispatcher,
+ "ike-rekey", 0, b->finalize(b));
+
+ return TRUE;
+}
+
+METHOD(listener_t, ike_state_change, bool,
+ private_vici_query_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
+{
+ char *event;
+ vici_builder_t *b;
+ time_t now;
+
+ switch (state)
+ {
+ case IKE_ESTABLISHED:
+ event = "ike-state-established";
+ break;
+ case IKE_DESTROYING:
+ event = "ike-state-destroying";
+ break;
+ default:
+ return TRUE;
+ }
+
+ if (!this->dispatcher->has_event_listeners(this->dispatcher, event))
+ {
+ return TRUE;
+ }
+
+ now = time_monotonic(NULL);
+
+ b = vici_builder_create();
+ b->begin_section(b, ike_sa->get_name(ike_sa));
+ list_ike(this, b, ike_sa, now, state != IKE_DESTROYING);
+ b->begin_section(b, "child-sas");
+ b->end_section(b);
+ b->end_section(b);
+
+ this->dispatcher->raise_event(this->dispatcher,
+ event, 0, b->finalize(b));
+
+ return TRUE;
+}
+
METHOD(listener_t, child_updown, bool,
private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up)
{
@@ -1131,6 +1208,85 @@ METHOD(listener_t, child_updown, bool,
return TRUE;
}
+METHOD(listener_t, child_rekey, bool,
+ private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *old, child_sa_t *new)
+{
+ vici_builder_t *b;
+ time_t now;
+
+ if (!this->dispatcher->has_event_listeners(this->dispatcher, "child-rekey"))
+ {
+ return TRUE;
+ }
+
+ now = time_monotonic(NULL);
+ b = vici_builder_create();
+
+ b->begin_section(b, ike_sa->get_name(ike_sa));
+ list_ike(this, b, ike_sa, now, TRUE);
+ b->begin_section(b, "child-sas");
+
+ b->begin_section(b, old->get_name(old));
+ list_child(this, b, old, now);
+ b->end_section(b);
+
+ b->begin_section(b, new->get_name(new));
+ list_child(this, b, new, now);
+ b->end_section(b);
+
+ b->end_section(b);
+ b->end_section(b);
+
+ this->dispatcher->raise_event(this->dispatcher,
+ "child-rekey", 0, b->finalize(b));
+
+ return TRUE;
+}
+
+METHOD(listener_t, child_state_change, bool,
+ private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state)
+{
+ char *event;
+ vici_builder_t *b;
+ time_t now;
+
+ switch (state)
+ {
+ case CHILD_INSTALLED:
+ event = "child-state-installed";
+ break;
+ case CHILD_DESTROYING:
+ event = "child-state-destroying";
+ break;
+ default:
+ return TRUE;
+ }
+
+ if (!this->dispatcher->has_event_listeners(this->dispatcher, event))
+ {
+ return TRUE;
+ }
+
+ now = time_monotonic(NULL);
+
+ b = vici_builder_create();
+ b->begin_section(b, ike_sa->get_name(ike_sa));
+ list_ike(this, b, ike_sa, now, state != CHILD_DESTROYING);
+ b->begin_section(b, "child-sas");
+
+ b->begin_section(b, child_sa->get_name(child_sa));
+ list_child(this, b, child_sa, now);
+ b->end_section(b);
+
+ b->end_section(b);
+ b->end_section(b);
+
+ this->dispatcher->raise_event(this->dispatcher,
+ event, 0, b->finalize(b));
+
+ return TRUE;
+}
+
METHOD(vici_query_t, destroy, void,
private_vici_query_t *this)
{
@@ -1149,7 +1305,11 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
.public = {
.listener = {
.ike_updown = _ike_updown,
+ .ike_rekey = _ike_rekey,
+ .ike_state_change = _ike_state_change,
.child_updown = _child_updown,
+ .child_rekey = _child_rekey,
+ .child_state_change = _child_state_change,
},
.destroy = _destroy,
},
--
2.4.2
From 18c8cb346648a385878d6cde8d1d95fa22cf0a9b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
Date: Thu, 28 May 2015 13:06:51 +0300
Subject: [PATCH 4/4] vici: support asynchronous initiation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
---
src/libcharon/plugins/vici/vici_control.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
index 9a58399..e9bcb90 100644
--- a/src/libcharon/plugins/vici/vici_control.c
+++ b/src/libcharon/plugins/vici/vici_control.c
@@ -186,7 +186,7 @@ CALLBACK(initiate, vici_message_t*,
peer_cfg_t *peer_cfg;
host_t *my_host = NULL, *other_host = NULL;
char *child, *my_host_str, *other_host_str;
- u_int timeout;
+ u_int timeout, async;
log_info_t log = {
.dispatcher = this->dispatcher,
.id = id,
@@ -194,6 +194,7 @@ CALLBACK(initiate, vici_message_t*,
child = request->get_str(request, NULL, "child");
timeout = request->get_int(request, 0, "timeout");
+ async = request->get_int(request, 0, "async");
log.level = request->get_int(request, 1, "loglevel");
my_host_str = request->get_str(request, NULL, "my-host");
other_host_str = request->get_str(request, NULL, "other-host");
@@ -222,7 +223,8 @@ CALLBACK(initiate, vici_message_t*,
}
switch (charon->controller->initiate(charon->controller,
peer_cfg, child_cfg, my_host, other_host,
- (controller_cb_t)log_vici, &log, timeout))
+ async ? NULL : (controller_cb_t)log_vici,
+ &log, timeout))
{
case SUCCESS:
msg = send_reply(this, NULL);
--
2.4.2
# Contributor: Jesse Young <jlyo@jlyo.org>
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=strongswan
pkgver=5.3.1
pkgver=5.3.2
_pkgver=${pkgver//_rc/rc}
pkgrel=0
pkgdesc="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
......@@ -14,8 +14,12 @@ depends="iproute2 openssl"
depends_dev="sqlite-dev openssl-dev curl-dev gmp-dev libcap-dev"
makedepends="$depends_dev linux-headers"
install="$pkgname.pre-install"
subpackages="$pkgname-doc"
subpackages="$pkgname-doc $pkgname-dbg"
source="http://download.strongswan.org/$pkgname-$_pkgver.tar.bz2
0001-charon-add-optional-source-and-remote-overrides-for-.patch
0002-vici-send-certificates-for-ike-sa-events.patch
0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
0004-vici-support-asynchronous-initiation.patch
strongswan.initd
charon.initd"
......@@ -98,12 +102,24 @@ package() {
rm "$pkgdir"/usr/lib/ipsec/*.la || return 1
}
md5sums="66f258901a3d6c271da1a0c7fb3e5013 strongswan-5.3.1.tar.bz2
md5sums="fab014be1477ef4ebf9a765e10f8802c strongswan-5.3.2.tar.bz2
e553c5e9a895a2d95b1cbc33407d64a0 0001-charon-add-optional-source-and-remote-overrides-for-.patch
8bea05feac6f4e90c4973b2459864437 0002-vici-send-certificates-for-ike-sa-events.patch
125c4e648f73b0dbdaa741ac13ed6d87 0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
f65811bd1ae6e7f98cf9d76928a0aa03 0004-vici-support-asynchronous-initiation.patch
85ebc1b6c6b9c0c6640d8136e97da8e1 strongswan.initd
7962a720ebef6892d80a3cbdab72c204 charon.initd"
sha256sums="83fa7b004e65356ff5bb755d9d0e03901d578a99e90b6328a350a4335a32f6de strongswan-5.3.1.tar.bz2
sha256sums="a4a9bc8c4e42bdc4366a87a05a02bf9f425169a7ab0c6f4482d347e44acbf225 strongswan-5.3.2.tar.bz2
a472df28677d4f43a063926a65b52b317dfca0b74f8c6a2e3bf852b94fbf5f0f 0001-charon-add-optional-source-and-remote-overrides-for-.patch
c1cfe3d1e3345238e125a46a492f8dc0800aa3dc75aea060d54cdbab35fd60cb 0002-vici-send-certificates-for-ike-sa-events.patch
4e08d4fe01717de0601411b4756141394ced2d3107adc47f2c2beac2f92a967e 0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
42171ee35e7679fe3d4efb80fdb121b0a7ea8df5cf3395bbcccb97d56327027c 0004-vici-support-asynchronous-initiation.patch
ad43d1ed2585d84e12ad1e67fbdfe93983c424c5c64b230d5027c0aae496c65f strongswan.initd
97b018796f0f15106b70694449cff36e8fc586292aab09ef83a05c0c13142e73 charon.initd"
sha512sums="b789c18de1fa6663d8140c4173c2fe9b668e7741098340aad439e7346d4542df702f59760d1886d82d68c070ebde3121b5b29ccdab031876399d0d5d771f1381 strongswan-5.3.1.tar.bz2
sha512sums="60b17645c00769d497f4cea2229b41a217c29fe1109b58be256a0d4a6ccf4765348b9eb89466539c2528756344c2fa969f25ea1cd8856d56c5d55aa78e632e68 strongswan-5.3.2.tar.bz2
682c768e82c6b8e48680ab73db49eb3a462b90ee317c943a42a82812d171a19da27ff4139bff0fc9af7b228cdcef44a75b86979f4b1b3af0bbc9698e4329fb4a 0001-charon-add-optional-source-and-remote-overrides-for-.patch
ca6eec72f75f243234baa1b361ab6dba82a810d1efb01dbcfd16cd7ce104c3f18fb932c1f6f280a566bfcbe16bc67d7d55e024f72c9eef82a62fe78505293c5c 0002-vici-send-certificates-for-ike-sa-events.patch
2e28af9043cab41f16c57f41ccb65b6591ec32d50a811bd393c4dcf7f0ffe81fac67679c41b716dfc74fca9ebedd178fe0b572b1c2cda3ccc685a0ad0d02f65a 0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
39e4a9839b2f6f42f662620b20697c684b90949622f8cc21c393ca55ab40e669befd1d2055e0f0c799cf37733a37bbf4df2b9cebc984a45bb66ecba6fa0ef116 0004-vici-support-asynchronous-initiation.patch
b56008c07b804dacb3441d3802880058986ab7b314297fe485649a771861885b9232f9fd53b94faa3388a5e9330e2b38a86af5c04f3ff119199720043967ec64 strongswan.initd
6f3abaaa8da0925f06cdd184fdf534518e40c49533dba427dbf31dbe88172e5626bdc9aadf798d791f82fbded08801c1f565d514e2c289e1f28448d0c2e72b79 charon.initd"
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment