Skip to content

Commit 9be6dee

Browse files
strongX509strongX509
committed
botan: SHA-3 support
1 parent ae27181 commit 9be6dee

File tree

19 files changed

+373
-0
lines changed

19 files changed

+373
-0
lines changed

‎src/libstrongswan/plugins/botan/botan_plugin.c‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
/*
22
* Copyright (C) 2018 Tobias Brunner
3+
* Copyright (C) 2018 Andreas Steffen
34
* HSR Hochschule fuer Technik Rapperswil
45
*
56
* Copyright (C) 2018 René Korthaus
@@ -164,6 +165,13 @@ METHOD(plugin_t, get_features, int,
164165
PLUGIN_PROVIDE(HASHER, HASH_SHA384),
165166
PLUGIN_PROVIDE(HASHER, HASH_SHA512),
166167
#endif
168+
#ifdef BOTAN_HAS_SHA3
169+
PLUGIN_PROVIDE(HASHER, HASH_SHA3_224),
170+
PLUGIN_PROVIDE(HASHER, HASH_SHA3_256),
171+
PLUGIN_PROVIDE(HASHER, HASH_SHA3_384),
172+
PLUGIN_PROVIDE(HASHER, HASH_SHA3_512),
173+
#endif
174+
167175
/* prfs */
168176
#ifdef BOTAN_HAS_HMAC
169177
PLUGIN_REGISTER(PRF, botan_hmac_prf_create),
@@ -254,6 +262,16 @@ METHOD(plugin_t, get_features, int,
254262
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_RSA_EMSA_PKCS1_SHA2_384),
255263
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_RSA_EMSA_PKCS1_SHA2_512),
256264
#endif
265+
#ifdef BOTAN_HAS_SHA3
266+
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_RSA_EMSA_PKCS1_SHA3_224),
267+
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_RSA_EMSA_PKCS1_SHA3_256),
268+
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_RSA_EMSA_PKCS1_SHA3_384),
269+
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_RSA_EMSA_PKCS1_SHA3_512),
270+
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_RSA_EMSA_PKCS1_SHA3_224),
271+
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_RSA_EMSA_PKCS1_SHA3_256),
272+
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_RSA_EMSA_PKCS1_SHA3_384),
273+
PLUGIN_PROVIDE(PUBKEY_VERIFY, SIGN_RSA_EMSA_PKCS1_SHA3_512),
274+
#endif
257275
#endif
258276
#ifdef BOTAN_HAS_EMSA_PSSR
259277
PLUGIN_PROVIDE(PRIVKEY_SIGN, SIGN_RSA_EMSA_PSS),

‎src/libstrongswan/plugins/botan/botan_rsa_private_key.c‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
/*
22
* Copyright (C) 2018 Tobias Brunner
3+
* Copyright (C) 2018 Andreas Steffen
34
* HSR Hochschule fuer Technik Rapperswil
45
*
56
* Copyright (C) 2018 René Korthaus
@@ -135,6 +136,18 @@ METHOD(private_key_t, sign, bool,
135136
case SIGN_RSA_EMSA_PKCS1_SHA2_512:
136137
return botan_get_signature(this->key, "EMSA_PKCS1(SHA-512)", data,
137138
signature);
139+
case SIGN_RSA_EMSA_PKCS1_SHA3_224:
140+
return botan_get_signature(this->key, "EMSA_PKCS1(SHA-3(224))", data,
141+
signature);
142+
case SIGN_RSA_EMSA_PKCS1_SHA3_256:
143+
return botan_get_signature(this->key, "EMSA_PKCS1(SHA-3(256))", data,
144+
signature);
145+
case SIGN_RSA_EMSA_PKCS1_SHA3_384:
146+
return botan_get_signature(this->key, "EMSA_PKCS1(SHA-3(384))", data,
147+
signature);
148+
case SIGN_RSA_EMSA_PKCS1_SHA3_512:
149+
return botan_get_signature(this->key, "EMSA_PKCS1(SHA-3(512))", data,
150+
signature);
138151
case SIGN_RSA_EMSA_PSS:
139152
return build_emsa_pss_signature(this, params, data, signature);
140153
default:

‎src/libstrongswan/plugins/botan/botan_rsa_public_key.c‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
/*
22
* Copyright (C) 2018 Tobias Brunner
3+
* Copyright (C) 2018 Andreas Steffen
34
* HSR Hochschule fuer Technik Rapperswil
45
*
56
* Copyright (C) 2018 René Korthaus
@@ -115,6 +116,18 @@ METHOD(public_key_t, verify, bool,
115116
case SIGN_RSA_EMSA_PKCS1_SHA2_512:
116117
return botan_verify_signature(this->key, "EMSA_PKCS1(SHA-512)",
117118
data, signature);
119+
case SIGN_RSA_EMSA_PKCS1_SHA3_224:
120+
return botan_verify_signature(this->key, "EMSA_PKCS1(SHA-3(224)",
121+
data, signature);
122+
case SIGN_RSA_EMSA_PKCS1_SHA3_256:
123+
return botan_verify_signature(this->key, "EMSA_PKCS1(SHA-3(256))",
124+
data, signature);
125+
case SIGN_RSA_EMSA_PKCS1_SHA3_384:
126+
return botan_verify_signature(this->key, "EMSA_PKCS1(SHA-3(384))",
127+
data, signature);
128+
case SIGN_RSA_EMSA_PKCS1_SHA3_512:
129+
return botan_verify_signature(this->key, "EMSA_PKCS1(SHA-3(512))",
130+
data, signature);
118131
case SIGN_RSA_EMSA_PSS:
119132
return verify_emsa_pss_signature(this, params, data, signature);
120133
default:

‎src/libstrongswan/plugins/botan/botan_util.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
/*
22
* Copyright (C) 2018 Tobias Brunner
3+
* Copyright (C) 2018 Andreas Steffen
34
* HSR Hochschule fuer Technik Rapperswil
45
*
56
* Copyright (C) 2018 René Korthaus
@@ -67,6 +68,14 @@ const char *botan_get_hash(hash_algorithm_t hash)
6768
return "SHA-384";
6869
case HASH_SHA512:
6970
return "SHA-512";
71+
case HASH_SHA3_224:
72+
return "SHA-3(224)";
73+
case HASH_SHA3_256:
74+
return "SHA-3(256)";
75+
case HASH_SHA3_384:
76+
return "SHA-3(384)";
77+
case HASH_SHA3_512:
78+
return "SHA-3(512)";
7079
default:
7180
return NULL;
7281
}

‎testing/tests/botan/net2net-sha3-rsa-cert/description.txt‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
A connection between the subnets behind the gateways <b>moon</b> and <b>sun</b> is set up.
2+
The authentication is based on <b>X.509 certificates</b> with signatures consisting of
3+
<b>RSA-encrypted SHA-3 hashes</b>.
4+
<p/>
5+
Upon the successful establishment of the IPsec tunnel, the updown script automatically
6+
inserts iptables-based firewall rules that let pass the tunneled traffic.
7+
In order to test both tunnel and firewall, client <b>alice</b> behind gateway <b>moon</b>
8+
pings client <b>bob</b> located behind gateway <b>sun</b>.

‎testing/tests/botan/net2net-sha3-rsa-cert/evaltest.dat‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
moon::swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.1 local-port=500 local-id=moon.strongswan.org remote-host=192.168.0.2 remote-port=500 remote-id=sun.strongswan.org initiator=yes.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.1.0.0/16] remote-ts=\[10.2.0.0/16]::YES
2+
sun:: swanctl --list-sas --raw 2> /dev/null::gw-gw.*version=2 state=ESTABLISHED local-host=192.168.0.2 local-port=500 local-id=sun.strongswan.org remote-host=192.168.0.1 remote-port=500 remote-id=moon.strongswan.org.*encr-alg=AES_CBC encr-keysize=128 integ-alg=HMAC_SHA2_256_128 prf-alg=PRF_HMAC_SHA2_256 dh-group=CURVE_25519.*child-sas.*net-net.*state=INSTALLED mode=TUNNEL.*ESP.*encr-alg=AES_GCM_16 encr-keysize=128.*local-ts=\[10.2.0.0/16] remote-ts=\[10.1.0.0/16]::YES
3+
alice::ping -c 1 PH_IP_BOB::64 bytes from PH_IP_BOB: icmp_.eq=1::YES
4+
sun::tcpdump::IP moon.strongswan.org > sun.strongswan.org: ESP::YES
5+
sun::tcpdump::IP sun.strongswan.org > moon.strongswan.org: ESP::YES

‎testing/tests/botan/net2net-sha3-rsa-cert/hosts/moon/etc/strongswan.conf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# /etc/strongswan.conf - strongSwan configuration file
2+
3+
swanctl {
4+
load = pem x509 revocation constraints pubkey botan random
5+
}
6+
7+
charon-systemd {
8+
load = random nonce pem x509 revocation constraints pubkey botan curl kernel-netlink socket-default updown vici
9+
}

‎testing/tests/botan/net2net-sha3-rsa-cert/hosts/moon/etc/swanctl/rsa/moonKey.pem‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIG4wIBAAKCAYEAnD3x6bsLjwUP9BU0+hDSo28XBn1aM8+UO5n5XnnuQ8CDB+Mq
3+
pEHgNve71FBD8Gqf2dha5rfRx5HhXbw6BZMCTdUs5oxHsaOl5LGwp8W4G1BSxofV
4+
T7yzfnmW/+lPER2zJnXbOlVfW8UoEbsAfXpCr/edJvBu10kk1VHjrnMJIDGlNc4N
5+
Re06DcYSb/7AgRN6umPQr+uRzn5jFXJyROjx00gH89GzZIaNciyiYwaCZFBduByt
6+
UhaL8RKMA+MxWrB1ICQgE7hITZXvJJg2UuEe+t3lXMSfKoZHyU2sTBtctXan6rf/
7+
XmC0O3Bf7RTwoFmDvJlApgfpL1QIe8gH1hi/NukTYskm+zWYPkJAzcwCyMmyhZFY
8+
v0r0pybLWI1hZ8xeTr7MSbtImsvxl8mxwG7wRtWS5BKd0kke/gorCEI8AYZj33NA
9+
G58iX4+z745z4UNNTDg1bnjB2fTw4c0AD7TOIU76ZskhGKj4J7ZMzeQ5YXLMFRmp
10+
qn0p9obSqXwg62dXAgMBAAECggGAHb2g3efv5FKHXePniK5JGjkcPe0AjZo20j2V
11+
/UjidN0hVBAG3ut3PZ9cjqaUuB/ju7j2XLKi6QU4y/n3ZXY9Wwl4GY6cWxEWk/jK
12+
8rStPe3FQ+s5TItT84A7oQ0NMunfXzPR/kGf/D0ESpO5HSl3pj1RGcdsoehXbY+/
13+
8kYNd6Zbl2lYl3X3tgV9Hvp0NF2739z+LW5++7qNK9j0LW/WEGzGrr+9ESaXqCMc
14+
6hKkIWo23MQArf6Ctunb4yWNEIFEDi1r9DzMbZN/lVhDx77Q0KYLH1P31R5rOc1G
15+
NYXPF4F3CSfUsgd48dB2/1FCTnDJ4PmOU/R1L8jAgnSOroTAYDVzY4DJ7vyKGvIE
16+
DL7eKlbwOfS5swyANUKgHO6QiHt9WzcNUGpeinTa3wJ4KoAdG+lzDMuiwRFdSRRU
17+
z7t1ptTf2LuCAtva2daP2SPed+ITg2QB6X4BSQkqR0vPYBQIZAtFjMWH78E2PLrD
18+
01+LpOj8TBRerd834etDODg4ddiRAoHBAMiYg7hWfChw3SdnmAmkhDAZN80pvsUU
19+
bzzAiQ5EI59JYMoi/amYyLd6hUK4Z8g4gcdXzBYw9iwJuj8LMpPBZlplAxVnFdId
20+
23I+GNDmcX2ovOpl6skKy1grNhBigxRUQUGsS9oxrYeuy2VymDzeZPCQmrrhsXk/
21+
Mac237nncJj2n8I5RtDOoSOFD0+grs7MXs4P+W2HHzWgkN7mBgKeFfUPLI3Kyy3p
22+
F7tXegtJqIJsXlfZ/fzR40QTy7/VbwAW/wKBwQDHZVDYtYe4YoHKdwtAqs/J08QA
23+
29fGkM4ZawLNTY4jz9rdtOuBWg0FPAo82x21xlbRQLsaTKzy9O6a3cQ5oaKtKCh/
24+
XmKCssrnzJsYZYnhkP4f4VXK8nai/9LFo8TWhB8hNy62GGmfXffsqhAIqIqZA02F
25+
/mOfR6Wrqs7yfzYnJnVsjbR1B2zSiNAYKtk1VtQdGjuagSn/dEyhSCaQRXotXUKX
26+
SJDzPf/H2mj97Cg+3bCtdE/h//N1/cmV/5QEx6kCgcEAh1ua7oW1bBiUsuVNi5wu
27+
8sHhjJiRuS0LzsPg9/Z0zyRVorCv2IRXVK/hQl9q8Ilo0VnmRkctphO+UJI+w8Nq
28+
TK8CwKt55vnsvY83cac+h9uX9tdk8dpN0qX96lp/NvWPv0ADQy3oebkyWLdWESTE
29+
miwJrPdkqXtCByKZHzoUGbO5o/bAWWBFDdHYvhOgQb1Yb9YJqqXWInrBpxcykQuZ
30+
p25g0yE3rzgtomXp3boLck6r7r4TjEkZATQWddERAM+DAoHAEW4w6BDOYXbzA6Du
31+
ceO8sFb7vlt5fFkyOxSYtRu/fi/wYQssvy0BEGEUQAejjD1fX4F6Ga10PPTeWtli
32+
CuuvTdXB3IiCsgwxIpxHPpW5vOcw39aR6mDRsCQO58oOLfZ0xjGNustdiFntj1m6
33+
dxdMrl2UjE8VpFneCKiw2I/4SunYv/mPOd/BSpI9Jq+wNzJ07mpZpYL/Cd6/yCWH
34+
gXshWA/b/1+PlEPqNS1JmlDnn78/b5pIVWhLfxgFZEBoTxapAoHAY/58nLcWpvpY
35+
3IZC0fBuR7usTACbxr9Z4okHzJUNnoJe+MSE+wQwuE3nP+vc1CrmBSwCjN2wyVLc
36+
gy3idN77NthU9l0oElrPbGFKdFEaa85IcKtnfnspzmvo9AJn2wveZUAlZAzu2zBN
37+
vKI8ubXgoS56uHQnNsWOIugTW/P1I8FnlD4jPItaACGJ3yZWolh9g/WOGS29qJvV
38+
E/6hT4QPPXPZFEnOKO0/3YsMXBwcnEqm2mQ+c4rGMKrTcynk4KaE
39+
-----END RSA PRIVATE KEY-----

‎testing/tests/botan/net2net-sha3-rsa-cert/hosts/moon/etc/swanctl/swanctl.conf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
connections {
2+
3+
gw-gw {
4+
local_addrs = 192.168.0.1
5+
remote_addrs = 192.168.0.2
6+
7+
local {
8+
auth = pubkey
9+
certs = moonCert.pem
10+
id = moon.strongswan.org
11+
}
12+
remote {
13+
auth = pubkey
14+
id = sun.strongswan.org
15+
}
16+
children {
17+
net-net {
18+
local_ts = 10.1.0.0/16
19+
remote_ts = 10.2.0.0/16
20+
21+
updown = /usr/local/libexec/ipsec/_updown iptables
22+
rekey_time = 5400
23+
rekey_bytes = 500000000
24+
rekey_packets = 1000000
25+
esp_proposals = aes128gcm128-x25519
26+
}
27+
}
28+
version = 2
29+
mobike = no
30+
reauth_time = 10800
31+
proposals = aes128-sha256-x25519
32+
}
33+
}

‎testing/tests/botan/net2net-sha3-rsa-cert/hosts/moon/etc/swanctl/x509/moonCert.pem‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIEyDCCAzCgAwIBAgIBAjANBglghkgBZQMEAw4FADBXMQswCQYDVQQGEwJDSDEb
3+
MBkGA1UEChMSc3Ryb25nU3dhbiBQcm9qZWN0MQ4wDAYDVQQLEwVTSEEtMzEbMBkG
4+
A1UEAxMSc3Ryb25nU3dhbiBSb290IENBMB4XDTE2MDkyMjEwMzU0N1oXDTI2MDky
5+
MjEwMzU0N1owWDELMAkGA1UEBhMCQ0gxGzAZBgNVBAoTEnN0cm9uZ1N3YW4gUHJv
6+
amVjdDEOMAwGA1UECxMFU0hBLTMxHDAaBgNVBAMTE21vb24uc3Ryb25nc3dhbi5v
7+
cmcwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCcPfHpuwuPBQ/0FTT6
8+
ENKjbxcGfVozz5Q7mfleee5DwIMH4yqkQeA297vUUEPwap/Z2Frmt9HHkeFdvDoF
9+
kwJN1SzmjEexo6XksbCnxbgbUFLGh9VPvLN+eZb/6U8RHbMmdds6VV9bxSgRuwB9
10+
ekKv950m8G7XSSTVUeOucwkgMaU1zg1F7ToNxhJv/sCBE3q6Y9Cv65HOfmMVcnJE
11+
6PHTSAfz0bNkho1yLKJjBoJkUF24HK1SFovxEowD4zFasHUgJCATuEhNle8kmDZS
12+
4R763eVcxJ8qhkfJTaxMG1y1dqfqt/9eYLQ7cF/tFPCgWYO8mUCmB+kvVAh7yAfW
13+
GL826RNiySb7NZg+QkDNzALIybKFkVi/SvSnJstYjWFnzF5OvsxJu0iay/GXybHA
14+
bvBG1ZLkEp3SSR7+CisIQjwBhmPfc0AbnyJfj7PvjnPhQ01MODVueMHZ9PDhzQAP
15+
tM4hTvpmySEYqPgntkzN5DlhcswVGamqfSn2htKpfCDrZ1cCAwEAAaOBnTCBmjAf
16+
BgNVHSMEGDAWgBTkyc2M8ohtHacu1155MaVmVTXOAjAeBgNVHREEFzAVghNtb29u
17+
LnN0cm9uZ3N3YW4ub3JnMBMGA1UdJQQMMAoGCCsGAQUFBwMBMEIGA1UdHwQ7MDkw
18+
N6A1oDOGMWh0dHA6Ly9jcmwuc3Ryb25nc3dhbi5vcmcvc3Ryb25nc3dhbi1zaGEz
19+
LXJzYS5jcmwwDQYJYIZIAWUDBAMOBQADggGBAAHZATrdzGmUIq+0+EdA1AbPdcaT
20+
UDKJvDS30JyOkUnAv5jr63PHyfw+RS92zgE2UyB4+u43BiggBNmTNCjpaEUmViAo
21+
tdywkzIKm7q3dr0078IZ8LU8Wo+hoeRNkBJOxdgflsSislQYDeTd7syoQ4BW7whs
22+
jjFK2Lbthd+/33Iw3LMekYuZF7ZUbHY7D3nlBidrmTIQQCvOnsW2lJi/S83FEYzl
23+
noK+of3eo4Ryg1/428FHts26PxSmnHv+ckj9R4Jf5kH8kd1WhrgDyHQMnihWlUJ2
24+
pintDBgislbZytqiBOGeYpbpxKl57zHs421wmUs329asu7zgfJFnCynkUgvuRXdc
25+
gDJ+DAiVaXCJlYnk36P87028SR9/C0JLzHA3O5CcfUdFEUs0BvVe1D3b9kC28rdA
26+
5V86DFCL+gp6rB+wDtq6YnCddaNk+ZCs/QAPidqOFAytaBBKaagMIFk+wlsFge79
27+
ZssIfKy33Frluw0HCj0LNs2tjWvG4Ku8xkFO1Q==
28+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)