Attachment 1534149 Details for Bug 1676590 – libreswan update to prevent IKE_INIT fragmentation

[patch] libreswan update to prevent IKE_INIT fragmentation

crypto-policies-libreswan.patch (text/plain), 9.17 KB, created by Paul Wouters on 2019-02-12 16:50:53 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Paul Wouters

Created: 2019-02-12 16:50:53 UTC

Size: 9.17 KB

patch

obsolete

>diff -Naur crypto-policies-orig/DEFAULT/libreswan.txt crypto-policies/DEFAULT/libreswan.txt
>--- crypto-policies-orig/DEFAULT/libreswan.txt	2019-02-12 11:14:59.000000000 -0500
>+++ crypto-policies/DEFAULT/libreswan.txt	2019-02-12 11:41:06.297229650 -0500
>@@ -1,5 +1,5 @@
> conn %default
> 	ikev2=insist
> 	pfs=yes
>-	ike=aes_gcm256-sha2_512;dh19,aes_gcm256-sha2_256;dh19,chacha20_poly1305-sha2_512;dh19,chacha20_poly1305-sha2_256;dh19,aes256-sha2_512;dh19,aes256-sha2_256;dh19,aes256-sha1;dh19,aes_gcm128-sha2_512;dh19,aes_gcm128-sha2_256;dh19,aes128-sha2_256;dh19,aes128-sha1;dh19,aes_gcm256-sha2_512;dh20,aes_gcm256-sha2_256;dh20,chacha20_poly1305-sha2_512;dh20,chacha20_poly1305-sha2_256;dh20,aes256-sha2_512;dh20,aes256-sha2_256;dh20,aes256-sha1;dh20,aes_gcm128-sha2_512;dh20,aes_gcm128-sha2_256;dh20,aes128-sha2_256;dh20,aes128-sha1;dh20,aes_gcm256-sha2_512;dh21,aes_gcm256-sha2_256;dh21,chacha20_poly1305-sha2_512;dh21,chacha20_poly1305-sha2_256;dh21,aes256-sha2_512;dh21,aes256-sha2_256;dh21,aes256-sha1;dh21,aes_gcm128-sha2_512;dh21,aes_gcm128-sha2_256;dh21,aes128-sha2_256;dh21,aes128-sha1;dh21,aes_gcm256-sha2_512;dh14,aes_gcm256-sha2_256;dh14,chacha20_poly1305-sha2_512;dh14,chacha20_poly1305-sha2_256;dh14,aes256-sha2_512;dh14,aes256-sha2_256;dh14,aes256-sha1;dh14,aes_gcm128-sha2_512;dh14,aes_gcm128-sha2_256;dh14,aes128-sha2_256;dh14,aes128-sha1;dh14,aes_gcm256-sha2_512;dh15,aes_gcm256-sha2_256;dh15,chacha20_poly1305-sha2_512;dh15,chacha20_poly1305-sha2_256;dh15,aes256-sha2_512;dh15,aes256-sha2_256;dh15,aes256-sha1;dh15,aes_gcm128-sha2_512;dh15,aes_gcm128-sha2_256;dh15,aes128-sha2_256;dh15,aes128-sha1;dh15,aes_gcm256-sha2_512;dh16,aes_gcm256-sha2_256;dh16,chacha20_poly1305-sha2_512;dh16,chacha20_poly1305-sha2_256;dh16,aes256-sha2_512;dh16,aes256-sha2_256;dh16,aes256-sha1;dh16,aes_gcm128-sha2_512;dh16,aes_gcm128-sha2_256;dh16,aes128-sha2_256;dh16,aes128-sha1;dh16,aes_gcm256-sha2_512;dh18,aes_gcm256-sha2_256;dh18,chacha20_poly1305-sha2_512;dh18,chacha20_poly1305-sha2_256;dh18,aes256-sha2_512;dh18,aes256-sha2_256;dh18,aes256-sha1;dh18,aes_gcm128-sha2_512;dh18,aes_gcm128-sha2_256;dh18,aes128-sha2_256;dh18,aes128-sha1;dh18
>-	esp=aes_gcm256,chacha20_poly1305,aes256-sha2_512,aes256-sha1,aes256-sha2_256,aes_gcm128,aes128-sha1,aes128-sha2_256
>+	ike=aes_gcm256+chacha20_poly1305-sha2_512+sha2_256-dh19+dh14+dh20+dh21+dh31+dh15+dh16+dh17+dh18,aes_gcm128-sha2_512+sha2_256-dh19+dh14+dh20+dh21+dh31+dh15+dh16+dh17+dh18,aes256-sha2_512+sha2_256-dh19+dh14+dh20+dh21+dh31+dh15+dh16+dh17+dh18,aes128-sha2_512+sha2_256-dh19+dh14+dh20+dh21+dh31+dh15+dh16+dh17+dh18
>+	esp=aes_gcm256+chacha20_poly1305,aes256-sha2_512+sha2_256,aes_gcm128,aes128-sha2_512+sha2_256
>diff -Naur crypto-policies-orig/FIPS/libreswan.txt crypto-policies/FIPS/libreswan.txt
>--- crypto-policies-orig/FIPS/libreswan.txt	2019-02-12 11:14:59.000000000 -0500
>+++ crypto-policies/FIPS/libreswan.txt	2019-02-12 11:29:54.669329377 -0500
>@@ -1,5 +1,5 @@
> conn %default
> 	ikev2=insist
> 	pfs=yes
>-	ike=aes_gcm256-sha2_512;dh19,aes_gcm256-sha2_256;dh19,aes256-sha2_512;dh19,aes256-sha2_256;dh19,aes256-sha1;dh19,aes_gcm128-sha2_512;dh19,aes_gcm128-sha2_256;dh19,aes128-sha2_256;dh19,aes128-sha1;dh19,aes_gcm256-sha2_512;dh20,aes_gcm256-sha2_256;dh20,aes256-sha2_512;dh20,aes256-sha2_256;dh20,aes256-sha1;dh20,aes_gcm128-sha2_512;dh20,aes_gcm128-sha2_256;dh20,aes128-sha2_256;dh20,aes128-sha1;dh20,aes_gcm256-sha2_512;dh21,aes_gcm256-sha2_256;dh21,aes256-sha2_512;dh21,aes256-sha2_256;dh21,aes256-sha1;dh21,aes_gcm128-sha2_512;dh21,aes_gcm128-sha2_256;dh21,aes128-sha2_256;dh21,aes128-sha1;dh21,aes_gcm256-sha2_512;dh14,aes_gcm256-sha2_256;dh14,aes256-sha2_512;dh14,aes256-sha2_256;dh14,aes256-sha1;dh14,aes_gcm128-sha2_512;dh14,aes_gcm128-sha2_256;dh14,aes128-sha2_256;dh14,aes128-sha1;dh14,aes_gcm256-sha2_512;dh15,aes_gcm256-sha2_256;dh15,aes256-sha2_512;dh15,aes256-sha2_256;dh15,aes256-sha1;dh15,aes_gcm128-sha2_512;dh15,aes_gcm128-sha2_256;dh15,aes128-sha2_256;dh15,aes128-sha1;dh15,aes_gcm256-sha2_512;dh16,aes_gcm256-sha2_256;dh16,aes256-sha2_512;dh16,aes256-sha2_256;dh16,aes256-sha1;dh16,aes_gcm128-sha2_512;dh16,aes_gcm128-sha2_256;dh16,aes128-sha2_256;dh16,aes128-sha1;dh16,aes_gcm256-sha2_512;dh18,aes_gcm256-sha2_256;dh18,aes256-sha2_512;dh18,aes256-sha2_256;dh18,aes256-sha1;dh18,aes_gcm128-sha2_512;dh18,aes_gcm128-sha2_256;dh18,aes128-sha2_256;dh18,aes128-sha1;dh18
>-	esp=aes_gcm256,aes256-sha2_512,aes256-sha1,aes256-sha2_256,aes_gcm128,aes128-sha1,aes128-sha2_256
>+	ike=aes_gcm256+aes_gcm128-sha2_512+sha2_256+sha1-dh19+dh14+dh20+dh21+dh15+dh16+dh17+dh18,aes256+aes128-sha2_512+sha2_256+sha1-dh19+dh14+dh20+dh21+dh15+dh16+dh17+dh18
>+	esp=aes_gcm256,aes256-sha2_512+sha1+sha2_256,aes_gcm128,aes128-sha1+sha2_256
>diff -Naur crypto-policies-orig/FUTURE/libreswan.txt crypto-policies/FUTURE/libreswan.txt
>--- crypto-policies-orig/FUTURE/libreswan.txt	2019-02-12 11:14:59.000000000 -0500
>+++ crypto-policies/FUTURE/libreswan.txt	2019-02-12 11:35:56.011059354 -0500
>@@ -1,5 +1,6 @@
> conn %default
> 	ikev2=insist
> 	pfs=yes
>-	ike=aes_gcm256-sha2_512;dh19,aes_gcm256-sha2_256;dh19,chacha20_poly1305-sha2_512;dh19,chacha20_poly1305-sha2_256;dh19,aes256-sha2_512;dh19,aes256-sha2_256;dh19,aes_gcm256-sha2_512;dh20,aes_gcm256-sha2_256;dh20,chacha20_poly1305-sha2_512;dh20,chacha20_poly1305-sha2_256;dh20,aes256-sha2_512;dh20,aes256-sha2_256;dh20,aes_gcm256-sha2_512;dh21,aes_gcm256-sha2_256;dh21,chacha20_poly1305-sha2_512;dh21,chacha20_poly1305-sha2_256;dh21,aes256-sha2_512;dh21,aes256-sha2_256;dh21,aes_gcm256-sha2_512;dh15,aes_gcm256-sha2_256;dh15,chacha20_poly1305-sha2_512;dh15,chacha20_poly1305-sha2_256;dh15,aes256-sha2_512;dh15,aes256-sha2_256;dh15,aes_gcm256-sha2_512;dh16,aes_gcm256-sha2_256;dh16,chacha20_poly1305-sha2_512;dh16,chacha20_poly1305-sha2_256;dh16,aes256-sha2_512;dh16,aes256-sha2_256;dh16,aes_gcm256-sha2_512;dh18,aes_gcm256-sha2_256;dh18,chacha20_poly1305-sha2_512;dh18,chacha20_poly1305-sha2_256;dh18,aes256-sha2_512;dh18,aes256-sha2_256;dh18
>-	esp=aes_gcm256,chacha20_poly1305,aes256-sha2_512,aes256-sha2_256
>+ 	ike=aes_gcm256+chacha20_poly1305-sha2_512+sha2_256-dh19+dh20+dh21+dh31+dh15+dh16+dh17+dh18,aes256-sha2_512+sha2_256-dh19+dh20+dh21+dh31+dh15+dh16+dh17+dh18
>+        esp=aes_gcm256+chacha20_poly1305,aes256-sha2_512+sha2_256
>+
>diff -Naur crypto-policies-orig/LEGACY/libreswan.txt crypto-policies/LEGACY/libreswan.txt
>--- crypto-policies-orig/LEGACY/libreswan.txt	2019-02-12 11:14:59.000000000 -0500
>+++ crypto-policies/LEGACY/libreswan.txt	2019-02-12 11:45:03.373651944 -0500
>@@ -1,5 +1,7 @@
> conn %default
> 	ikev2=insist
> 	pfs=yes
>-	ike=aes_gcm256-sha2_512;dh19,aes_gcm256-sha2_256;dh19,chacha20_poly1305-sha2_512;dh19,chacha20_poly1305-sha2_256;dh19,aes256-sha2_512;dh19,aes256-sha2_256;dh19,aes256-sha1;dh19,aes_gcm128-sha2_512;dh19,aes_gcm128-sha2_256;dh19,aes128-sha2_256;dh19,aes128-sha1;dh19,3des-sha1;dh19,aes_gcm256-sha2_512;dh20,aes_gcm256-sha2_256;dh20,chacha20_poly1305-sha2_512;dh20,chacha20_poly1305-sha2_256;dh20,aes256-sha2_512;dh20,aes256-sha2_256;dh20,aes256-sha1;dh20,aes_gcm128-sha2_512;dh20,aes_gcm128-sha2_256;dh20,aes128-sha2_256;dh20,aes128-sha1;dh20,3des-sha1;dh20,aes_gcm256-sha2_512;dh21,aes_gcm256-sha2_256;dh21,chacha20_poly1305-sha2_512;dh21,chacha20_poly1305-sha2_256;dh21,aes256-sha2_512;dh21,aes256-sha2_256;dh21,aes256-sha1;dh21,aes_gcm128-sha2_512;dh21,aes_gcm128-sha2_256;dh21,aes128-sha2_256;dh21,aes128-sha1;dh21,3des-sha1;dh21,aes_gcm256-sha2_512;dh5,aes_gcm256-sha2_256;dh5,chacha20_poly1305-sha2_512;dh5,chacha20_poly1305-sha2_256;dh5,aes256-sha2_512;dh5,aes256-sha2_256;dh5,aes256-sha1;dh5,aes_gcm128-sha2_512;dh5,aes_gcm128-sha2_256;dh5,aes128-sha2_256;dh5,aes128-sha1;dh5,3des-sha1;dh5,aes_gcm256-sha2_512;dh14,aes_gcm256-sha2_256;dh14,chacha20_poly1305-sha2_512;dh14,chacha20_poly1305-sha2_256;dh14,aes256-sha2_512;dh14,aes256-sha2_256;dh14,aes256-sha1;dh14,aes_gcm128-sha2_512;dh14,aes_gcm128-sha2_256;dh14,aes128-sha2_256;dh14,aes128-sha1;dh14,3des-sha1;dh14,aes_gcm256-sha2_512;dh15,aes_gcm256-sha2_256;dh15,chacha20_poly1305-sha2_512;dh15,chacha20_poly1305-sha2_256;dh15,aes256-sha2_512;dh15,aes256-sha2_256;dh15,aes256-sha1;dh15,aes_gcm128-sha2_512;dh15,aes_gcm128-sha2_256;dh15,aes128-sha2_256;dh15,aes128-sha1;dh15,3des-sha1;dh15,aes_gcm256-sha2_512;dh16,aes_gcm256-sha2_256;dh16,chacha20_poly1305-sha2_512;dh16,chacha20_poly1305-sha2_256;dh16,aes256-sha2_512;dh16,aes256-sha2_256;dh16,aes256-sha1;dh16,aes_gcm128-sha2_512;dh16,aes_gcm128-sha2_256;dh16,aes128-sha2_256;dh16,aes128-sha1;dh16,3des-sha1;dh16,aes_gcm256-sha2_512;dh18,aes_gcm256-sha2_256;dh18,chacha20_poly1305-sha2_512;dh18,chacha20_poly1305-sha2_256;dh18,aes256-sha2_512;dh18,aes256-sha2_256;dh18,aes256-sha1;dh18,aes_gcm128-sha2_512;dh18,aes_gcm128-sha2_256;dh18,aes128-sha2_256;dh18,aes128-sha1;dh18,3des-sha1;dh18
> 	esp=aes_gcm256,chacha20_poly1305,aes256-sha2_512,aes256-sha1,aes256-sha2_256,aes_gcm128,aes128-sha1,aes128-sha2_256,3des-sha1
>+	ike=aes_gcm256+chacha20_poly1305-sha2_512+sha2_256-dh19+dh14+dh20+dh21+dh31+dh15+dh16+dh17+dh18+dh5,aes_gcm128-sha2_512+sha2_256+sha1-dh19+dh14+dh20+dh21+dh31+dh15+dh16+dh17+dh18+dh5,aes256-sha2_512+sha2_256+sha1-dh19+dh14+dh20+dh21+dh31+dh15+dh16+dh17+dh18+dh5,aes128-sha2_512+sha2_256+sha1-dh19+dh14+dh20+dh21+dh31+dh15+dh16+dh17+dh18+dh5
>+	# favour sha1 over sha2_256 due to kernel bug. See also RFC 8221
>+	esp=aes_gcm256+chacha20_poly1305,aes256-sha2_512+sha1+sha2_256,aes_gcm128,aes128-sha2_512+sha1+sha2_256

Actions: View | Diff

Attachments on bug 1676590: 1534149