diff options
| -rw-r--r-- | sbin/ipsecctl/ike.c | 90 | ||||
| -rw-r--r-- | sbin/ipsecctl/ipsec.conf.5 | 13 | ||||
| -rw-r--r-- | sbin/ipsecctl/ipsecctl.h | 8 | ||||
| -rw-r--r-- | sbin/ipsecctl/parse.y | 52 | ||||
| -rw-r--r-- | sbin/isakmpd/conf.c | 14 | ||||
| -rw-r--r-- | sbin/isakmpd/ipsec.c | 10 | ||||
| -rw-r--r-- | sbin/isakmpd/ipsec_num.cst | 11 | ||||
| -rw-r--r-- | sbin/isakmpd/isakmpd.conf.5 | 14 |
8 files changed, 157 insertions, 55 deletions
diff --git a/sbin/ipsecctl/ike.c b/sbin/ipsecctl/ike.c index c3bd21401a0..5c46877461a 100644 --- a/sbin/ipsecctl/ike.c +++ b/sbin/ipsecctl/ike.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ike.c,v 1.81 2015/12/09 21:41:50 naddy Exp $ */ +/* $OpenBSD: ike.c,v 1.82 2017/10/27 08:29:32 mpi Exp $ */ /* * Copyright (c) 2005 Hans-Joerg Hoexer <hshoexer@openbsd.org> * @@ -330,30 +330,57 @@ ike_section_p2(struct ipsec_rule *r, FILE *fd) switch (r->p2xfs->groupxf->id) { case GROUPXF_NONE: break; - case GROUPXF_768: + case GROUPXF_1: group_desc = "MODP_768"; break; - case GROUPXF_1024: + case GROUPXF_2: group_desc = "MODP_1024"; break; - case GROUPXF_1536: + case GROUPXF_5: group_desc = "MODP_1536"; break; - case GROUPXF_2048: + case GROUPXF_14: group_desc = "MODP_2048"; break; - case GROUPXF_3072: + case GROUPXF_15: group_desc = "MODP_3072"; break; - case GROUPXF_4096: + case GROUPXF_16: group_desc = "MODP_4096"; break; - case GROUPXF_6144: + case GROUPXF_17: group_desc = "MODP_6144"; break; - case GROUPXF_8192: + case GROUPXF_18: group_desc = "MODP_8192"; break; + case GROUPXF_19: + group_desc = "ECP_256"; + break; + case GROUPXF_20: + group_desc = "ECP_384"; + break; + case GROUPXF_21: + group_desc = "ECP_521"; + break; + case GROUPXF_25: + group_desc = "ECP_192"; + break; + case GROUPXF_26: + group_desc = "ECP_224"; + break; + case GROUPXF_27: + group_desc = "BP_224"; + break; + case GROUPXF_28: + group_desc = "BP_256"; + break; + case GROUPXF_29: + group_desc = "BP_384"; + break; + case GROUPXF_30: + group_desc = "BP_512"; + break; default: warnx("illegal group %s", r->p2xfs->groupxf->name); return (-1); @@ -496,34 +523,61 @@ ike_section_p1(struct ipsec_rule *r, FILE *fd) if (r->p1xfs && r->p1xfs->groupxf) { switch (r->p1xfs->groupxf->id) { - case GROUPXF_768: + case GROUPXF_1: group_desc = "MODP_768"; break; - case GROUPXF_1024: + case GROUPXF_2: group_desc = "MODP_1024"; break; - case GROUPXF_1536: + case GROUPXF_5: group_desc = "MODP_1536"; break; - case GROUPXF_2048: + case GROUPXF_14: group_desc = "MODP_2048"; break; - case GROUPXF_3072: + case GROUPXF_15: group_desc = "MODP_3072"; break; - case GROUPXF_4096: + case GROUPXF_16: group_desc = "MODP_4096"; break; - case GROUPXF_6144: + case GROUPXF_17: group_desc = "MODP_6144"; break; - case GROUPXF_8192: + case GROUPXF_18: group_desc = "MODP_8192"; break; + case GROUPXF_19: + group_desc = "ECP_256"; + break; + case GROUPXF_20: + group_desc = "ECP_384"; + break; + case GROUPXF_21: + group_desc = "ECP_521"; + break; + case GROUPXF_25: + group_desc = "ECP_192"; + break; + case GROUPXF_26: + group_desc = "ECP_224"; + break; + case GROUPXF_27: + group_desc = "BP_224"; + break; + case GROUPXF_28: + group_desc = "BP_256"; + break; + case GROUPXF_29: + group_desc = "BP_384"; + break; + case GROUPXF_30: + group_desc = "BP_512"; + break; default: warnx("illegal group %s", r->p1xfs->groupxf->name); return (-1); - }; + } } else group_desc = "MODP_3072"; diff --git a/sbin/ipsecctl/ipsec.conf.5 b/sbin/ipsecctl/ipsec.conf.5 index c5bed67d203..995dde1ecf7 100644 --- a/sbin/ipsecctl/ipsec.conf.5 +++ b/sbin/ipsecctl/ipsec.conf.5 @@ -1,4 +1,4 @@ -.\" $OpenBSD: ipsec.conf.5,v 1.152 2017/04/14 18:06:28 bluhm Exp $ +.\" $OpenBSD: ipsec.conf.5,v 1.153 2017/10/27 08:29:32 mpi Exp $ .\" .\" Copyright (c) 2004 Mathieu Sauve-Frankel All rights reserved. .\" @@ -22,7 +22,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: April 14 2017 $ +.Dd $Mdocdate: October 27 2017 $ .Dt IPSEC.CONF 5 .Os .Sh NAME @@ -668,6 +668,15 @@ keyword: .It Li modp4096 Ta 4096 Ta "[DH group 16]" .It Li modp6144 Ta 6144 Ta "[DH group 17]" .It Li modp8192 Ta 8192 Ta "[DH group 18]" +.It Li ecp256 Ta 256 Ta "[DH group 19]" +.It Li ecp384 Ta 384 Ta "[DH group 20]" +.It Li ecp521 Ta 512 Ta "[DH group 21]" +.It Li ecp192 Ta 192 Ta "[DH group 25]" +.It Li ecp224 Ta 224 Ta "[DH group 26]" +.It Li bp224 Ta 224 Ta "[DH group 27]" +.It Li bp256 Ta 256 Ta "[DH group 28]" +.It Li bp384 Ta 384 Ta "[DH group 29]" +.It Li bp512 Ta 512 Ta "[DH group 30]" .It Li none Ta 0 Ta "[phase 2 only]" .El .Sh MANUAL FLOWS diff --git a/sbin/ipsecctl/ipsecctl.h b/sbin/ipsecctl/ipsecctl.h index 680ed1a7d92..796ddf4545b 100644 --- a/sbin/ipsecctl/ipsecctl.h +++ b/sbin/ipsecctl/ipsecctl.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ipsecctl.h,v 1.71 2017/04/19 15:59:38 bluhm Exp $ */ +/* $OpenBSD: ipsecctl.h,v 1.72 2017/10/27 08:29:32 mpi Exp $ */ /* * Copyright (c) 2004, 2005 Hans-Joerg Hoexer <hshoexer@openbsd.org> * @@ -73,8 +73,10 @@ enum { COMPXF_UNKNOWN, COMPXF_DEFLATE, COMPXF_LZS }; enum { - GROUPXF_UNKNOWN, GROUPXF_NONE, GROUPXF_768, GROUPXF_1024, GROUPXF_1536, - GROUPXF_2048, GROUPXF_3072, GROUPXF_4096, GROUPXF_6144, GROUPXF_8192, + GROUPXF_UNKNOWN, GROUPXF_NONE, GROUPXF_1, GROUPXF_2, GROUPXF_5, + GROUPXF_14, GROUPXF_15, GROUPXF_16, GROUPXF_17, GROUPXF_18, + GROUPXF_19, GROUPXF_20, GROUPXF_21, GROUPXF_25, GROUPXF_26, + GROUPXF_27, GROUPXF_28, GROUPXF_29, GROUPXF_30 }; enum { IKE_ACTIVE, IKE_PASSIVE, IKE_DYNAMIC diff --git a/sbin/ipsecctl/parse.y b/sbin/ipsecctl/parse.y index 64016a22172..d5ba39ee185 100644 --- a/sbin/ipsecctl/parse.y +++ b/sbin/ipsecctl/parse.y @@ -1,4 +1,4 @@ -/* $OpenBSD: parse.y,v 1.168 2017/04/19 15:59:38 bluhm Exp $ */ +/* $OpenBSD: parse.y,v 1.169 2017/10/27 08:29:32 mpi Exp $ */ /* * Copyright (c) 2002, 2003, 2004 Henning Brauer <henning@openbsd.org> @@ -136,22 +136,40 @@ const struct ipsec_xf compxfs[] = { const struct ipsec_xf groupxfs[] = { { "unknown", GROUPXF_UNKNOWN, 0, 0 }, { "none", GROUPXF_NONE, 0, 0 }, - { "modp768", GROUPXF_768, 768, 0 }, - { "grp1", GROUPXF_768, 768, 0 }, - { "modp1024", GROUPXF_1024, 1024, 0 }, - { "grp2", GROUPXF_1024, 1024, 0 }, - { "modp1536", GROUPXF_1536, 1536, 0 }, - { "grp5", GROUPXF_1536, 1536, 0 }, - { "modp2048", GROUPXF_2048, 2048, 0 }, - { "grp14", GROUPXF_2048, 2048, 0 }, - { "modp3072", GROUPXF_3072, 3072, 0 }, - { "grp15", GROUPXF_3072, 3072, 0 }, - { "modp4096", GROUPXF_4096, 4096, 0 }, - { "grp16", GROUPXF_4096, 4096, 0 }, - { "modp6144", GROUPXF_6144, 6144, 0 }, - { "grp17", GROUPXF_6144, 6144, 0 }, - { "modp8192", GROUPXF_8192, 8192, 0 }, - { "grp18", GROUPXF_8192, 8192, 0 }, + { "modp768", GROUPXF_1, 768, 0 }, + { "grp1", GROUPXF_1, 768, 0 }, + { "modp1024", GROUPXF_2, 1024, 0 }, + { "grp2", GROUPXF_2, 1024, 0 }, + { "modp1536", GROUPXF_5, 1536, 0 }, + { "grp5", GROUPXF_5, 1536, 0 }, + { "modp2048", GROUPXF_14, 2048, 0 }, + { "grp14", GROUPXF_14, 2048, 0 }, + { "modp3072", GROUPXF_15, 3072, 0 }, + { "grp15", GROUPXF_15, 3072, 0 }, + { "modp4096", GROUPXF_16, 4096, 0 }, + { "grp16", GROUPXF_16, 4096, 0 }, + { "modp6144", GROUPXF_17, 6144, 0 }, + { "grp17", GROUPXF_17, 6144, 0 }, + { "modp8192", GROUPXF_18, 8192, 0 }, + { "grp18", GROUPXF_18, 8192, 0 }, + { "ecp256", GROUPXF_19, 256, 0 }, + { "grp19", GROUPXF_19, 256, 0 }, + { "ecp384", GROUPXF_20, 384, 0 }, + { "grp20", GROUPXF_20, 384, 0 }, + { "ecp521", GROUPXF_21, 521, 0 }, + { "grp21", GROUPXF_21, 521, 0 }, + { "ecp192", GROUPXF_25, 192, 0 }, + { "grp25", GROUPXF_25, 192, 0 }, + { "ecp224", GROUPXF_26, 224, 0 }, + { "grp26", GROUPXF_26, 224, 0 }, + { "bp224", GROUPXF_27, 224, 0 }, + { "grp27", GROUPXF_27, 224, 0 }, + { "bp256", GROUPXF_28, 256, 0 }, + { "grp28", GROUPXF_28, 256, 0 }, + { "bp384", GROUPXF_29, 384, 0 }, + { "grp29", GROUPXF_29, 384, 0 }, + { "bp512", GROUPXF_30, 512, 0 }, + { "grp30", GROUPXF_30, 512, 0 }, { NULL, 0, 0, 0 }, }; diff --git a/sbin/isakmpd/conf.c b/sbin/isakmpd/conf.c index 47fe33a2679..aa127b2cbf1 100644 --- a/sbin/isakmpd/conf.c +++ b/sbin/isakmpd/conf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: conf.c,v 1.106 2016/03/16 15:41:10 krw Exp $ */ +/* $OpenBSD: conf.c,v 1.107 2017/10/27 08:29:32 mpi Exp $ */ /* $EOM: conf.c,v 1.48 2000/12/04 02:04:29 angelos Exp $ */ /* @@ -289,14 +289,14 @@ conf_parse(int trans, char *buf, size_t sz) * Resulting section names can be: * For main mode: * {BLF,3DES,CAST,AES,AES-{128,192,256}-{MD5,SHA,SHA2-{256,384,512}} \ - * [-GRP{1,2,5,14,15}][-{DSS,RSA_SIG}] + * [-GRP{1,2,5,14-21,25-30}][-{DSS,RSA_SIG}] * For quick mode: * QM-{proto}[-TRP]-{cipher}[-{hash}][-PFS[-{group}]]-SUITE * where * {proto} = ESP, AH * {cipher} = 3DES, CAST, BLF, AES, AES-{128,192,256}, AESCTR * {hash} = MD5, SHA, RIPEMD, SHA2-{256,384,512} - * {group} = GRP1, GRP2, GRP5, GRP14, GRP15 + * {group} = GRP{1,2,5,14-21,25-30} * * DH group defaults to MODP_1024. * @@ -483,9 +483,13 @@ conf_load_defaults(int tr) "AES-192", "AES-256", 0}; char *dhgroup[] = {"MODP_1024", "MODP_768", "MODP_1024", "MODP_1536", "MODP_2048", "MODP_3072", "MODP_4096", - "MODP_6144", "MODP_8192", 0}; + "MODP_6144", "MODP_8192", + "ECP_256", "ECP_384", "ECP_521", "ECP_192", "ECP_224", + "BP_224", "BP_256", "BP_384", "BP_512", 0}; char *dhgroup_p[] = {"", "-GRP1", "-GRP2", "-GRP5", "-GRP14", - "-GRP15", "-GRP16", "-GRP17", "-GRP18", 0}; + "-GRP15", "-GRP16", "-GRP17", "-GRP18", "-GRP19", "-GRP20", + "-GRP21", "-GRP25", "-GRP26", "-GRP27", "-GRP28", "-GRP29", + "-GRP30", 0}; char *qm_enc[] = {"3DES", "CAST", "BLOWFISH", "AES", "AES", "AES", "AES", "AES_CTR", "AES_CTR", "AES_CTR", "AES_CTR", "AES_GCM_16", diff --git a/sbin/isakmpd/ipsec.c b/sbin/isakmpd/ipsec.c index a72a9c6cf90..855462e09bb 100644 --- a/sbin/isakmpd/ipsec.c +++ b/sbin/isakmpd/ipsec.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ipsec.c,v 1.147 2017/07/18 06:19:07 mpi Exp $ */ +/* $OpenBSD: ipsec.c,v 1.148 2017/10/27 08:29:32 mpi Exp $ */ /* $EOM: ipsec.c,v 1.143 2000/12/11 23:57:42 niklas Exp $ */ /* @@ -1263,7 +1263,9 @@ ipsec_is_attribute_incompatible(u_int16_t type, u_int8_t *value, u_int16_t len, return (dv < IKE_GROUP_DESC_MODP_768 || dv > IKE_GROUP_DESC_MODP_1536) && (dv < IKE_GROUP_DESC_MODP_2048 || - dv > IKE_GROUP_DESC_MODP_8192); + dv > IKE_GROUP_DESC_ECP_521) && + (dv < IKE_GROUP_DESC_ECP_192 || + dv > IKE_GROUP_DESC_BP_512); case IKE_ATTR_GROUP_TYPE: return 1; case IKE_ATTR_GROUP_PRIME: @@ -1305,7 +1307,9 @@ ipsec_is_attribute_incompatible(u_int16_t type, u_int8_t *value, u_int16_t len, return (dv < IKE_GROUP_DESC_MODP_768 || dv > IKE_GROUP_DESC_MODP_1536) && (dv < IKE_GROUP_DESC_MODP_2048 || - IKE_GROUP_DESC_MODP_8192 < dv); + dv > IKE_GROUP_DESC_ECP_521) && + (dv < IKE_GROUP_DESC_ECP_192 || + dv > IKE_GROUP_DESC_BP_512); case IPSEC_ATTR_ENCAPSULATION_MODE: return dv != IPSEC_ENCAP_TUNNEL && dv != IPSEC_ENCAP_TRANSPORT && diff --git a/sbin/isakmpd/ipsec_num.cst b/sbin/isakmpd/ipsec_num.cst index de413040854..75b5ec32589 100644 --- a/sbin/isakmpd/ipsec_num.cst +++ b/sbin/isakmpd/ipsec_num.cst @@ -1,4 +1,4 @@ -# $OpenBSD: ipsec_num.cst,v 1.19 2012/06/30 14:51:31 naddy Exp $ +# $OpenBSD: ipsec_num.cst,v 1.20 2017/10/27 08:29:32 mpi Exp $ # $EOM: ipsec_num.cst,v 1.5 2000/10/13 17:56:52 angelos Exp $ # @@ -171,6 +171,15 @@ IKE_GROUP_DESC MODP_4096 16 MODP_6144 17 MODP_8192 18 + ECP_256 19 + ECP_384 20 + ECP_521 21 + ECP_192 25 + ECP_224 26 + BP_224 27 + BP_256 28 + BP_384 29 + BP_512 30 . # IKE Group type. diff --git a/sbin/isakmpd/isakmpd.conf.5 b/sbin/isakmpd/isakmpd.conf.5 index ab811a7eee3..667ff387d65 100644 --- a/sbin/isakmpd/isakmpd.conf.5 +++ b/sbin/isakmpd/isakmpd.conf.5 @@ -1,4 +1,4 @@ -.\" $OpenBSD: isakmpd.conf.5,v 1.133 2017/01/01 01:08:11 tb Exp $ +.\" $OpenBSD: isakmpd.conf.5,v 1.134 2017/10/27 08:29:32 mpi Exp $ .\" $EOM: isakmpd.conf.5,v 1.57 2000/12/21 14:43:17 ho Exp $ .\" .\" Copyright (c) 1998, 1999, 2000 Niklas Hallqvist. All rights reserved. @@ -28,7 +28,7 @@ .\" .\" Manual page, using -mandoc macros .\" -.Dd $Mdocdate: January 1 2017 $ +.Dd $Mdocdate: October 27 2017 $ .Dt ISAKMPD.CONF 5 .Os .Sh NAME @@ -100,7 +100,8 @@ is either BLF, 3DES, CAST, AES, AES-128, AES-192 or AES-256 .It Ar hash is either MD5, SHA, or SHA2-{256,384,512} .It Ar group -is either GRP1, GRP2, GRP5, GRP14, or GRP15 +is either GRP1, GRP2, GRP5, GRP14, GRP15, GRP16, GRP17, GRP18, +GRP19, GRP20, GRP21, GRP25, GRP26, GRP27, GRP28, GRP29 or GRP30. .El .Pp For Quick Mode: @@ -128,7 +129,8 @@ or NULL .It Ar hash is either MD5, SHA, RIPEMD, or SHA2-{256,384,512} .It Ar group -is either GRP1, GRP2, GRP5, GRP14, or GRP15 +is either GRP1, GRP2, GRP5, GRP14, GRP15, GRP16, GRP17, GRP18, +GRP19, GRP20, GRP21, GRP25, GRP26, GRP27, GRP28, GRP29 or GRP30. .El .Pp For example, AES-SHA2-256 means: AES encryption, SHA2-256 hash, and @@ -138,8 +140,8 @@ e.g. AES-SHA2-256-RSA_SIG. Similarly, QM-ESP-3DES-SHA-PFS-SUITE means: ESP protocol, 3DES encryption, SHA hash, and use Perfect Forward Secrecy. .Pp -Unless explicitly stated with -GRP1, 2, 5, 14 or 15, transforms and -PFS suites use DH group 2. +Unless explicitly stated with -GRP1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, +25, 26, 27, 28, 29 or 30, transforms and PFS suites use DH group 2. There are currently no predefined ESP+AH Quick Mode suites. .Pp The predefinitions include some default values for the special |