Code

NCL-2292 - Upgrade strongswan to 5.9.6#5

Code

Merged

akodithy merged 146 commits intosophos-win-5.9.6sophos/strongswan:sophos-win-5.9.6from bugfix/NCL-2292-strongswan-5-9-5-vulnerabilitiessophos/strongswan:bugfix/NCL-2292-strongswan-5-9-5-vulnerabilitiesCopy head branch name to clipboardJan 30, 2025

+12,674-3,965

Commits

Commits on Jan 24, 2022

• Use Botan 2.19.1 for tests

  tobiasbrunner

  committed
  1bb0500

  Copy full SHA for 1bb0500

• addrblock: Allow limiting validation depth of issuer addrblock extensions

  Show description for e3d1766
  

  martinwilli

  authored and

  tobiasbrunner

  committed
  e3d1766

  Copy full SHA for e3d1766

• sys-logger: Optionally support mapping strongSwan loglevels to syslog levels

  Show description for 9877ce6
  

  martinwilli

  authored and

  tobiasbrunner

  committed
  9877ce6

  Copy full SHA for 9877ce6

Commits on Jan 25, 2022

• SECURITY: Fix link to PGP key

  tobiasbrunner

  committed
  912d052

  Copy full SHA for 912d052

Commits on Feb 1, 2022

• proposal: Add ESN transform to default ESP AEAD proposal

  Show description for 956b25a
  

  martinwilli

  authored and

  tobiasbrunner

  committed
  956b25a

  Copy full SHA for 956b25a

Commits on Feb 4, 2022

• openssl: Return correct number of plugin features if ECDH groups are omitted

  Show description for 34a6cb8
  tobiasbrunner

  committed
  34a6cb8

  Copy full SHA for 34a6cb8

Commits on Feb 7, 2022

• appveyor: Install autotools package on 2019 image

  Show description for 7314e09
  tobiasbrunner

  committed
  7314e09

  Copy full SHA for 7314e09

Commits on Feb 9, 2022

• testing: Print the actual start time of a command for do-tests -t

  Show description for b47e991
  tobiasbrunner

  committed
  b47e991

  Copy full SHA for b47e991

Commits on Feb 15, 2022

• error-notify: Handle missing alerts

  Show description for 801bb85
  tobiasbrunner

  committed
  801bb85

  Copy full SHA for 801bb85

• ha: Streamline handling of conditions and extensions

  Show description for d6879ef
  

  spellingmistake

  authored and

  tobiasbrunner

  committed
  d6879ef

  Copy full SHA for d6879ef

• ike-natd: Fake NAT situation or disable NAT-D if source IP is undetermined

  Show description for aaa505d
  tobiasbrunner

  committed
  aaa505d

  Copy full SHA for aaa505d

• ike-mobike: Make task a no-op if MOBIKE is not supported

  Show description for 90b1d09
  tobiasbrunner

  committed
  90b1d09

  Copy full SHA for 90b1d09

• ike-natd: Queue DPD after faking local NAT to check if UDP-encap can be disabled

  tobiasbrunner

  committed
  011de0f

  Copy full SHA for 011de0f

• Merge branch 'natd-fixes'

  Show description for 3f7d40d
  tobiasbrunner

  committed
  3f7d40d

  Copy full SHA for 3f7d40d

• libtls: Enforce client/server identity when looking for public key

  Show description for e4b4aab
  tobiasbrunner

  committed
  e4b4aab

  Copy full SHA for e4b4aab

• tls-test: Add option to specify a specific remote identity

  tobiasbrunner

  committed
  42704f6

  Copy full SHA for 42704f6

• tls-peer: Simplify identity check for server certificate

  Show description for eccfd27
  tobiasbrunner

  committed
  eccfd27

  Copy full SHA for eccfd27

Commits on Feb 17, 2022

• xof: Fix typo in documentation for set_seed()

  tobiasbrunner

  committed
  963adc7

  Copy full SHA for 963adc7

• mgf1: Fix Doxygen group for XOF implementation

  tobiasbrunner

  committed
  9e39782

  Copy full SHA for 9e39782

Commits on Feb 22, 2022

• Use wolfSSL 5.2.0 for tests

  tobiasbrunner

  committed
  e694384

  Copy full SHA for e694384

Commits on Feb 24, 2022

• openssl: Don't unload providers

  Show description for 3eecd40
  tobiasbrunner

  committed
  3eecd40

  Copy full SHA for 3eecd40

Commits on Mar 1, 2022

• tls-server: Use correct error alerts if client doesn't send a certificate

  Show description for 2ade431
  tobiasbrunner

  committed
  2ade431

  Copy full SHA for 2ade431

• testing: Increase memory on winnetou even more

  tobiasbrunner

  committed
  c8045f8

  Copy full SHA for c8045f8

Commits on Mar 2, 2022

• README: Added link to docs.strongswan.org

  strongX509

  committed
  b2cf5af

  Copy full SHA for b2cf5af

Commits on Mar 14, 2022

• kernel-netlink: Remove unimplemented XFRM_OFFLOAD_IPV6 flag

  Show description for 012e4cd
  

  rleon

  authored and

  tobiasbrunner

  committed
  012e4cd

  Copy full SHA for 012e4cd

Commits on Mar 15, 2022

• kernel-pfkey: Only install exclude route if not routing via outbound interface

  Show description for 5de6ab8
  tobiasbrunner

  committed
  5de6ab8

  Copy full SHA for 5de6ab8

• kernel-pfkey: Don't install exclude routes for locally connected peers

  Show description for 8a76c5a
  tobiasbrunner

  committed
  8a76c5a

  Copy full SHA for 8a76c5a

• Merge branch 'pfkey-exclude-routes'

  Show description for 8100f2f
  tobiasbrunner

  committed
  8100f2f

  Copy full SHA for 8100f2f

Commits on Mar 16, 2022

• traffic-selector: Avoid out-of-bound array access when calculating range

  Show description for 3c02868
  tobiasbrunner

  committed
  3c02868

  Copy full SHA for 3c02868

Commits on Apr 14, 2022

• lgtm: Fix query for chunk_from_chars()

  Show description for 63260a1
  tobiasbrunner

  committed
  63260a1

  Copy full SHA for 63260a1

• receiver: Use a time based limit to switch COOKIE secrets

  Show description for 902fbd1
  tobiasbrunner

  committed
  902fbd1

  Copy full SHA for 902fbd1

• receiver: Add per-IP cookie threshold

  Show description for d8104b7
  tobiasbrunner

  committed
  d8104b7

  Copy full SHA for d8104b7

• ike: Track unprocessed initial IKE messages like half-open IKE_SAs

  Show description for b866ee8
  tobiasbrunner

  committed
  b866ee8

  Copy full SHA for b866ee8

• cirrus: Use FreeBSD 12.3

  Show description for 93d8177
  tobiasbrunner

  committed
  93d8177

  Copy full SHA for 93d8177

• ike: Don't reset optional CHILD_SA properties when migrating child-creating tasks

  Show description for 366ac36
  tobiasbrunner

  committed
  366ac36

  Copy full SHA for 366ac36

• ike-sa: Use a struct to pass optional arguments when initiating CHILD_SAs

  tobiasbrunner

  committed
  7f30e1a

  Copy full SHA for 7f30e1a

• kernel-netlink: Read protocol of acquire not from template

  Show description for 9983326
  tobiasbrunner

  committed
  9983326

  Copy full SHA for 9983326

• kernel-listener: Use a struct to pass data from acquires

  tobiasbrunner

  committed
  3b699c7

  Copy full SHA for 3b699c7

• child-create: Just abort CREATE_CHILD_SA request if nonce creation fails

  Show description for 511033b
  tobiasbrunner

  committed
  511033b

  Copy full SHA for 511033b

• child-create: Abort initiating a duplicate CHILD_SA

  Show description for a5430e1
  tobiasbrunner

  committed
  a5430e1

  Copy full SHA for a5430e1

• enum: Allow specifying the name used when none of the flags are set

  tobiasbrunner

  committed
  927103e

  Copy full SHA for 927103e

• ike: Treat action_t as flags so 'start' and 'trap' can be combined

  Show description for 4f4d402
  tobiasbrunner

  committed
  4f4d402

  Copy full SHA for 4f4d402

• enum: Add helper to parse enum flags from strings

  Show description for 7137fd9
  tobiasbrunner

  committed
  7137fd9

  Copy full SHA for 7137fd9

• vici: Make combination of 'trap' and 'start' configurable

  tobiasbrunner

  committed
  c00c5e5

  Copy full SHA for c00c5e5

• configure: Add option to link against libselinux

  tobiasbrunner

  committed
  fe5f273

  Copy full SHA for fe5f273

• sec-label: Add class to represent security labels

  Show description for decfe44
  tobiasbrunner

  committed
  decfe44

  Copy full SHA for decfe44

• sec-label: Add enum for security label mode

  tobiasbrunner

  committed
  2dd60e4

  Copy full SHA for 2dd60e4

• leak-detective: Whitelist selinux_check_access()

  tobiasbrunner

  committed
  ebb9948

  Copy full SHA for ebb9948

• traffic-selector: Add TS_SECLABEL type

  tobiasbrunner

  committed
  d71d181

  Copy full SHA for d71d181

• traffic-selector-substructure: Add support for TS_SECLABEL

  Show description for a44de0b
  tobiasbrunner

  committed
  a44de0b

  Copy full SHA for a44de0b

• ts-payload: Add support for TS of type TS_SECLABEL

  Show description for f4c0ec0
  tobiasbrunner

  committed
  f4c0ec0

  Copy full SHA for f4c0ec0

• encoding: Remove unused TS_TYPE and ADDRESS encodings

  tobiasbrunner

  committed
  c4e2b76

  Copy full SHA for c4e2b76

• kernel-netlink: Add support for optional security label on SAs and policies

  tobiasbrunner

  committed
  bf0542c

  Copy full SHA for bf0542c

• child-cfg: Add optional security label and mode

  tobiasbrunner

  committed
  ef72ac8

  Copy full SHA for ef72ac8

• child-cfg: Add method to select a security label

  tobiasbrunner

  committed
  63d4bd0

  Copy full SHA for 63d4bd0

• peer-cfg: Consider security labels when selecting child configs

  tobiasbrunner

  committed
  0372995

  Copy full SHA for 0372995

• kernel-interface: Optionally consider security label when allocating reqids

  tobiasbrunner

  committed
  6cb83c3

  Copy full SHA for 6cb83c3

• child-sa: Add support for security labels

  Show description for 139d655
  tobiasbrunner

  committed
  139d655

  Copy full SHA for 139d655

• child-create: Consider security label when comparing CHILD_SAs

  tobiasbrunner

  committed
  7a8d110

  Copy full SHA for 7a8d110

• child-create: Add support to handle security labels

  Show description for f9b895b
  tobiasbrunner

  committed
  f9b895b

  Copy full SHA for f9b895b

• child-sa: Support dynamically updating trap policies

  tobiasbrunner

  committed
  9619b1e

  Copy full SHA for 9619b1e

• kernel-wfp: Use new UDP ports in update_sa()

  tobiasbrunner

  committed
  1f06035

  Copy full SHA for 1f06035

• kernel-interface: Add support to change the reqid in update_sa()

  tobiasbrunner

  committed
  1b3af3e

  Copy full SHA for 1b3af3e

• kernel-netlink: Allow reqid updates for policies again

  Show description for 96ecc39
  tobiasbrunner

  committed
  96ecc39

  Copy full SHA for 96ecc39

• child-sa: Allocate a new reqid if dynamic traffic selectors are updated

  Show description for 8f4cfe9
  tobiasbrunner

  committed
  8f4cfe9

  Copy full SHA for 8f4cfe9

• trap-manager: Add facility to install externally managed trap policies

  Show description for 3c65cf6
  tobiasbrunner

  committed
  3c65cf6

  Copy full SHA for 3c65cf6

• ike-sa: Add helper to determine an IKE_SA's dynamic hosts

  tobiasbrunner

  committed
  065685d

  Copy full SHA for 065685d

• selinux: Add plugin to install trap policies with generic labels

  Show description for b00a4e7
  tobiasbrunner

  committed
  b00a4e7

  Copy full SHA for b00a4e7

• child-rekey: Maintain security label during rekeying

  tobiasbrunner

  committed
  92f54e5

  Copy full SHA for 92f54e5

• ike-sa: Accept optional security label when initiating CHILD_SAs

  tobiasbrunner

  committed
  3f3838d

  Copy full SHA for 3f3838d

• kernel-interface: Optionally pass security label with an acquire

  tobiasbrunner

  committed
  52a05d7

  Copy full SHA for 52a05d7

• kernel-handler: Log security label received with acquire

  tobiasbrunner

  committed
  81c3628

  Copy full SHA for 81c3628

• trap-manager: Add support to handle acquires with security labels

  tobiasbrunner

  committed
  0a67379

  Copy full SHA for 0a67379

• kernel-netlink: Forward labels from acquires

  tobiasbrunner

  committed
  f52e565

  Copy full SHA for f52e565

• vici: Make security labels and mode configurable

  tobiasbrunner

  committed
  7cf6f29

  Copy full SHA for 7cf6f29

• vici: Report security label on CHILD_SA, policies and configs

  tobiasbrunner

  committed
  2994347

  Copy full SHA for 2994347

• swanctl: Report labels in --list-* commands

  tobiasbrunner

  committed
  b67f7fb

  Copy full SHA for b67f7fb

• testing: Copy comments to test log

  tobiasbrunner

  committed
  994d9d3

  Copy full SHA for 994d9d3

• vici: Add options to only return specific CHILD_SAs in list-sas()

  tobiasbrunner

  committed
  b1c7fac

  Copy full SHA for b1c7fac

• swanctl: Add options to filter CHILD_SAs in --list-sas

  tobiasbrunner

  committed
  955b526

  Copy full SHA for 955b526

• testing: Add DSCP scenario that uses simple labels

  Show description for 6910347
  tobiasbrunner

  committed
  6910347

  Copy full SHA for 6910347

• Merge branch 'labeled-ipsec'

  Show description for 8b8a2ee
  tobiasbrunner

  committed
  8b8a2ee

  Copy full SHA for 8b8a2ee

• crypto: Add interface for key derivation functions

  tobiasbrunner

  committed
  40a0961

  Copy full SHA for 40a0961

• transform: Add private transform for KDFs

  tobiasbrunner

  committed
  e93882c

  Copy full SHA for e93882c

• pkcs5: Rename kdf_t to avoid conflict

  tobiasbrunner

  committed
  35ad267

  Copy full SHA for 35ad267

• crypto-factory: Add constructor and methods to create KDFs

  Show description for fbb0bde
  tobiasbrunner

  committed
  fbb0bde

  Copy full SHA for fbb0bde

• stroke: List registered KDFs

  tobiasbrunner

  committed
  07bf428

  Copy full SHA for 07bf428

• vici: Report registered KDFs

  tobiasbrunner

  committed
  ec17fa2

  Copy full SHA for ec17fa2

• crypto-tester: Add facility to test KDFs

  tobiasbrunner

  committed
  0c6baa8

  Copy full SHA for 0c6baa8

• crypto-factory: Use actual plugin name when testing during construction

  tobiasbrunner

  committed
  02f7d63

  Copy full SHA for 02f7d63

• test-vectors: Add support for KDF test vectors

  tobiasbrunner

  committed
  86d5268

  Copy full SHA for 86d5268

• plugin-feature: Remove 'default' case in plugin_feature_un|load()

  tobiasbrunner

  committed
  961cb78

  Copy full SHA for 961cb78

• plugin-feature: Add plugin feature for KDFs

  tobiasbrunner

  committed
  71ba969

  Copy full SHA for 71ba969

• test-vectors: Add test vectors for prf+

  tobiasbrunner

  committed
  ce43136

  Copy full SHA for ce43136

• kdf: Add plugin that provides a default prf+ implementation

  tobiasbrunner

  committed
  9e228de

  Copy full SHA for 9e228de

• openssl: Add a prf+ implementation based on OpenSSL's HKDF implementation

  Show description for 2b9b579
  tobiasbrunner

  committed
  2b9b579

  Copy full SHA for 2b9b579

• keymat_v2: Refactor IKE key derivation so it only needs one prf+ call

  tobiasbrunner

  committed
  00cfc05

  Copy full SHA for 00cfc05

• keymat_v2: Refactor CHILD_SA key derivation so it only needs one prf+ call

  tobiasbrunner

  committed
  742134c

  Copy full SHA for 742134c

• testing: Load kdf plugin in all scenarios that require it

  Show description for 3a52fc8
  tobiasbrunner

  committed
  3a52fc8

  Copy full SHA for 3a52fc8

• android: Build and load kdf plugin for prf+

  Show description for 5cc47c1
  tobiasbrunner

  committed
  5cc47c1

  Copy full SHA for 5cc47c1

• appveyor: Enable kdf plugin on old images with OpenSSL 1.0.2/1.1.0

  Show description for 08e3113
  tobiasbrunner

  committed
  08e3113

  Copy full SHA for 08e3113

• keymat_v2: Use plugin-provided prf+ to derive keys

  tobiasbrunner

  committed
  7161c87

  Copy full SHA for 7161c87

• tls-hkdf: Use plugin-provided prf+

  tobiasbrunner

  committed
  df16d79

  Copy full SHA for df16d79

• unit-tests: Use plugin-provided prf+ in unit test

  Show description for be07b9d
  tobiasbrunner

  committed
  be07b9d

  Copy full SHA for be07b9d

• keymat_v1: Derive CHILD_SA keys without using prf_plus_t

  Show description for 9cb3c10
  tobiasbrunner

  committed
  9cb3c10

  Copy full SHA for 9cb3c10

• kdf: Implement prf+ directly without relying on prf_plus_t

  tobiasbrunner

  committed
  f0957d1

  Copy full SHA for f0957d1

• crypto: Remove unused prf_plus_t

  tobiasbrunner

  committed
  f535f1e

  Copy full SHA for f535f1e

• botan: Implement prf+ via Botan's HKDF implementation

  tobiasbrunner

  committed
  cb8f924

  Copy full SHA for cb8f924

• wolfssl: Implement prf+ via wolfSSL's HKDF implementation

  tobiasbrunner

  committed
  96c7692

  Copy full SHA for 96c7692

• crypto: Adapt kdf_t interface to support KDFs with fixed output length

  tobiasbrunner

  committed
  7bde56a

  Copy full SHA for 7bde56a

• crypto: Add new KDF type for IKEv2 PRFs

  tobiasbrunner

  committed
  37dbc87

  Copy full SHA for 37dbc87

• test-vectors: Add vectors for HMAC-based IKEv2 PRFs

  tobiasbrunner

  committed
  ad0e94b

  Copy full SHA for ad0e94b

• kdf: Implement wrapper for IKEv2 PRFs

  tobiasbrunner

  committed
  0339ce3

  Copy full SHA for 0339ce3

• openssl: Implement HMAC-based IKEv2 PRFs via OpenSSL's HKDF implementation

  tobiasbrunner

  committed
  e0fc786

  Copy full SHA for e0fc786

• botan: Implement HMAC-based IKEv2 PRFs via Botan's HKDF implementation

  tobiasbrunner

  committed
  7498769

  Copy full SHA for 7498769

• wolfssl: Implement HMAC-based IKEv2 PRFs via wolfSSL's HKDF implementation

  tobiasbrunner

  committed
  56afc6e

  Copy full SHA for 56afc6e

• unit-tests: Hand out an actual shared secret and pubkey in mock KE implementation

  Show description for 743b486
  tobiasbrunner

  committed
  743b486

  Copy full SHA for 743b486

• keymat_v2: Use plugin-provided KDF_PRF to derive SKEYSEED

  tobiasbrunner

  committed
  f619b83

  Copy full SHA for f619b83

• Merge branch 'ikev2-kdf-modularization'

  Show description for 94a3563
  tobiasbrunner

  committed
  94a3563

  Copy full SHA for 94a3563

• openssl: Move shared secret calculation to get_shared_secret()

  Show description for 1c1213f
  tobiasbrunner

  committed
  1c1213f

  Copy full SHA for 1c1213f

• leak-detective: Whitelist OpenSSL 3.0 functions

  tobiasbrunner

  committed
  519bc22

  Copy full SHA for 519bc22

• openssl: PRF_KEYED_SHA1 might not be supported

  Show description for 13efce4
  tobiasbrunner

  committed
  13efce4

  Copy full SHA for 13efce4

• openssl: Fixes for ECDH with OpenSSL 3.0

  Show description for f5710c9
  tobiasbrunner

  committed
  f5710c9

  Copy full SHA for f5710c9

• openssl: Fixes for DH with OpenSSL 3.0

  Show description for 36cf74f
  tobiasbrunner

  committed
  36cf74f

  Copy full SHA for 36cf74f

• openssl: Fixes for RSA with OpenSSL 3.0

  tobiasbrunner

  committed
  21b586c

  Copy full SHA for 21b586c

• pkcs8: Parse the decrypted PKCS#8 structure via regular builders

  Show description for 544fb1c
  tobiasbrunner

  committed
  544fb1c

  Copy full SHA for 544fb1c

• configure: Move pkcs8 plugin after plugins that can parse PKCS#8 directly

  Show description for be0ce6d
  tobiasbrunner

  committed
  be0ce6d

  Copy full SHA for be0ce6d

• openssl: Fixes for ECDSA with OpenSSL 3.0

  tobiasbrunner

  committed
  293a912

  Copy full SHA for 293a912

• openssl: Fixes for HMAC with OpenSSL 3.0

  tobiasbrunner

  committed
  db0c53c

  Copy full SHA for db0c53c

• openssl: Remove checks and legacy compatibility code for OpenSSL < 1.0.2

  Show description for f26639d
  tobiasbrunner

  committed
  f26639d

  Copy full SHA for f26639d

• openssl: Move ENGINE-specific code into a separate file

  Show description for a8bab0e
  tobiasbrunner

  committed
  a8bab0e

  Copy full SHA for a8bab0e

• unit-tests: Add support for more than one warning per test case

  Show description for 7d99b29
  tobiasbrunner

  committed
  7d99b29

  Copy full SHA for 7d99b29

• unit-tests: Add environment variable to skip IPv6 stream tests

  Show description for 76ff49b
  tobiasbrunner

  committed
  76ff49b

  Copy full SHA for 76ff49b

• github: Add a build against OpenSSL 3.0

  tobiasbrunner

  committed
  a5cfa57

  Copy full SHA for a5cfa57

• Merge branch 'openssl-3.0'

  Show description for 9aa7e12
  tobiasbrunner

  committed
  9aa7e12

  Copy full SHA for 9aa7e12

Commits on Apr 16, 2022

• Version bump to 5.9.6rc1

  strongX509

  committed
  7df7100

  Copy full SHA for 7df7100

Commits on Apr 19, 2022

• github: Use run_number instead run_id as external-id for LGTM

  Show description for 312437b
  tobiasbrunner

  committed
  312437b

  Copy full SHA for 312437b

Commits on Apr 20, 2022

• ikev2: Maintain labels during make-before-break reauthentication

  tobiasbrunner

  committed
  f4d6539

  Copy full SHA for f4d6539

Commits on Apr 21, 2022

• openssl: Fix typo in comment

  tobiasbrunner

  committed
  c508b90

  Copy full SHA for c508b90

Commits on Apr 22, 2022

• kdf: Fix Doxygen comments

  tobiasbrunner

  committed
  2283a19

  Copy full SHA for 2283a19

• gcrypt: Initialize variables when en-/decrypting with RSA to avoid warnings

  tobiasbrunner

  committed
  352fa96

  Copy full SHA for 352fa96

• tls-crypto: Initialize cipher suites arrays to avoid warnings

  tobiasbrunner

  committed
  a6a0fa9

  Copy full SHA for a6a0fa9

• NEWS: Add news for 5.9.6

  tobiasbrunner

  committed
  8ce4105

  Copy full SHA for 8ce4105

Commits on Apr 25, 2022

• Use mallinfo2() if available

  Show description for c9d4710
  tobiasbrunner

  committed
  c9d4710

  Copy full SHA for c9d4710

Commits on Apr 28, 2022

• Version bump to 5.9.6

  strongX509

  committed
  4cf8cd0

  Copy full SHA for 4cf8cd0

Commits on Jan 30, 2025

• Merge tag '5.9.6' of https://github.com/strongswan/strongswan into bugfix/NCL-2292-strongswan-5-9-5-vulnerabilities

  Show description for 39aef1e
  akodithy

  committed
  39aef1e

  Copy full SHA for 39aef1e