support sha2 for main mode hmacs and aesctr for quick mode encryption.

ok markus@ ho@

5 files changed, 72 insertions, 19 deletions

diff --git a/sbin/isakmpd/conf.c b/sbin/isakmpd/conf.c
index 49363840d35..306ac2bc18a 100644
--- a/sbin/isakmpd/conf.c
+++ b/sbin/isakmpd/conf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: conf.c,v 1.87 2006/05/27 17:01:46 hshoexer Exp $	 */
+/* $OpenBSD: conf.c,v 1.88 2006/06/10 20:10:02 hshoexer Exp $	 */
 /* $EOM: conf.c,v 1.48 2000/12/04 02:04:29 angelos Exp $	 */
 
 /*
@@ -297,13 +297,14 @@ conf_parse(int trans, char *buf, size_t sz)
  *
  * Resulting section names can be:
  *  For main mode:
- *     {DES,BLF,3DES,CAST,AES}-{MD5,SHA}[-GRP{1,2,5,14,15}][-{DSS,RSA_SIG}]
+ *     {DES,BLF,3DES,CAST,AES}-{MD5,SHA,SHA2-{256,384,512}}[-GRP{1,2,5,14,15}] \
+ *         [-{DSS,RSA_SIG}]
  *  For quick mode:
  *     QM-{proto}[-TRP]-{cipher}[-{hash}][-PFS[-{group}]]-SUITE
  *     where
  *       {proto}  = ESP, AH
- *       {cipher} = DES, 3DES, CAST, BLF, AES
- *       {hash}   = MD5, SHA, RIPEMD, SHA2-{-256,384,512}
+ *       {cipher} = DES, 3DES, CAST, BLF, AES, AESCTR
+ *       {hash}   = MD5, SHA, RIPEMD, SHA2-{256,384,512}
  *       {group}  = GRP1, GRP2, GRP5, GRP14, GRP15
  *
  * DH group defaults to MODP_1024.
@@ -357,11 +358,11 @@ conf_find_trans_xf(int phase, char *xf)
 
 static void
 conf_load_defaults_mm(int tr, char *mme, char *mmh, char *mma, char *dhg,
-    char *mme_p, char *mma_p, char *dhg_p)
+    char *mme_p, char *mma_p, char *dhg_p, char *mmh_p)
 {
 	char sect[CONF_SECT_MAX];
 
-	snprintf(sect, sizeof sect, "%s-%s%s%s", mme_p, mmh, dhg_p, mma_p);
+	snprintf(sect, sizeof sect, "%s%s%s%s", mme_p, mmh_p, dhg_p, mma_p);
 
 	LOG_DBG((LOG_MISC, 95, "conf_load_defaults_mm: main mode %s", sect));
 
@@ -441,7 +442,10 @@ conf_load_defaults(int tr)
 
 	char	*mm_auth[] = {"PRE_SHARED", "DSS", "RSA_SIG", 0};
 	char	*mm_auth_p[] = {"", "-DSS", "-RSA_SIG", 0};
-	char	*mm_hash[] = {"MD5", "SHA", 0};
+	char	*mm_hash[] = {"MD5", "SHA", "SHA2_256", "SHA2_384", "SHA2_512",
+		     0};
+	char	*mm_hash_p[] = {"-MD5", "-SHA", "-SHA2-256", "-SHA2-384",
+		    "-SHA2-512", "", 0 };
 	char	*mm_enc[] = {"DES_CBC", "BLOWFISH_CBC", "3DES_CBC", "CAST_CBC",
 		    "AES_CBC", 0};
 	char	*mm_enc_p[] = {"DES", "BLF", "3DES", "CAST", "AES", 0};
@@ -449,8 +453,10 @@ conf_load_defaults(int tr)
 		    "MODP_1536", "MODP_2048", "MODP_3072", 0};
 	char	*dhgroup_p[] = {"", "-GRP1", "-GRP2", "-GRP5", "-GRP14",
 		    "-GRP15", 0};
-	char	*qm_enc[] = {"DES", "3DES", "CAST", "BLOWFISH", "AES", 0};
-	char	*qm_enc_p[] = {"-DES", "-3DES", "-CAST", "-BLF", "-AES", 0};
+	char	*qm_enc[] = {"DES", "3DES", "CAST", "BLOWFISH", "AES",
+		    "AES_128_CTR", 0};
+	char	*qm_enc_p[] = {"-DES", "-3DES", "-CAST", "-BLF", "-AES",
+		    "-AESCTR", 0};
 	char	*qm_hash[] = {"HMAC_MD5", "HMAC_SHA", "HMAC_RIPEMD",
 		    "HMAC_SHA2_256", "HMAC_SHA2_384", "HMAC_SHA2_512", "NONE",
 		    0};
@@ -478,6 +484,8 @@ conf_load_defaults(int tr)
 	conf_set(tr, "KeyNote", "Credential-directory",
 	    CONF_DFLT_KEYNOTE_CRED_DIR, 0, 1);
 
+	conf_set(tr, "General", "Delete-SAs", CONF_DFLT_DELETE_SAS, 0, 1);
+
 	/* Lifetimes. XXX p1/p2 vs main/quick mode may be unclear.  */
 	dflt = conf_get_trans_str(tr, "General", "Default-phase-1-lifetime");
 	conf_set(tr, CONF_DFLT_TAG_LIFE_MAIN_MODE, "LIFE_TYPE",
@@ -505,7 +513,8 @@ conf_load_defaults(int tr)
 					conf_load_defaults_mm (tr, mm_enc[enc],
 					    mm_hash[hash], mm_auth[auth],
 					    dhgroup[group], mm_enc_p[enc],
-					    mm_auth_p[auth], dhgroup_p[group]);
+					    mm_auth_p[auth], dhgroup_p[group],
+					    mm_hash_p[hash]);
 
 	/* Setup a default Phase 1 entry */
 	conf_set(tr, "Phase 1", "Default", "Default-phase-1", 0, 1);
diff --git a/sbin/isakmpd/hash.c b/sbin/isakmpd/hash.c
index f2e0f5cc014..6309a4a4d4a 100644
--- a/sbin/isakmpd/hash.c
+++ b/sbin/isakmpd/hash.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: hash.c,v 1.20 2005/04/08 22:32:10 cloder Exp $	 */
+/* $OpenBSD: hash.c,v 1.21 2006/06/10 20:10:02 hshoexer Exp $	 */
 /* $EOM: hash.c,v 1.10 1999/04/17 23:20:34 niklas Exp $	 */
 
 /*
@@ -34,6 +34,7 @@
 #include <string.h>
 #include <md5.h>
 #include <sha1.h>
+#include <sha2.h>
 
 #include "hash.h"
 #include "log.h"
@@ -45,6 +46,9 @@ void	hmac_final(unsigned char *, struct hash *);
 static union {
 	MD5_CTX		md5ctx;
 	SHA1_CTX        sha1ctx;
+	SHA256_CTX	sha256ctx;
+	SHA384_CTX	sha384ctx;
+	SHA512_CTX	sha512ctx;
 } Ctx, Ctx2;
 
 /* Temporary hash digest.  */
@@ -69,7 +73,31 @@ static struct hash hashes[] = {
 	(void (*)(unsigned char *, void *))SHA1Final,
 	hmac_init,
 	hmac_final
-    },
+    }, {
+	HASH_SHA2_256, 7, SHA2_256_SIZE, (void *)&Ctx.sha256ctx, digest,
+	sizeof(SHA256_CTX), (void *)&Ctx2.sha256ctx,
+	(void (*)(void *))SHA256_Init,
+	(void (*)(void *, unsigned char *, unsigned int))SHA256_Update,
+	(void (*)(u_int8_t *, void *))SHA256_Final,
+	hmac_init,
+	hmac_final
+    }, {
+	HASH_SHA2_384, 8, SHA2_384_SIZE, (void *)&Ctx.sha384ctx, digest,
+	sizeof(SHA384_CTX), (void *)&Ctx2.sha384ctx,
+	(void (*)(void *))SHA384_Init,
+	(void (*)(void *, unsigned char *, unsigned int))SHA384_Update,
+	(void (*)(u_int8_t *, void *))SHA384_Final,
+	hmac_init,
+	hmac_final
+    }, {
+	HASH_SHA2_512, 9, SHA2_512_SIZE, (void *)&Ctx.sha512ctx, digest,
+	sizeof(SHA512_CTX), (void *)&Ctx2.sha512ctx,
+	(void (*)(void *))SHA512_Init,
+	(void (*)(void *, unsigned char *, unsigned int))SHA512_Update,
+	(void (*)(u_int8_t *, void *))SHA512_Final,
+	hmac_init,
+	hmac_final
+    }
 };
 
 struct hash *
diff --git a/sbin/isakmpd/hash.h b/sbin/isakmpd/hash.h
index 3af23508138..426c899a4c5 100644
--- a/sbin/isakmpd/hash.h
+++ b/sbin/isakmpd/hash.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: hash.h,v 1.7 2004/04/15 18:39:25 deraadt Exp $	 */
+/* $OpenBSD: hash.h,v 1.8 2006/06/10 20:10:02 hshoexer Exp $	 */
 /* $EOM: hash.h,v 1.6 1998/07/25 22:04:36 niklas Exp $	 */
 
 /*
@@ -36,11 +36,17 @@
 
 #define MD5_SIZE	16
 #define SHA1_SIZE	20
-#define HASH_MAX	SHA1_SIZE
+#define SHA2_256_SIZE	32
+#define SHA2_384_SIZE	48
+#define SHA2_512_SIZE	64
+#define HASH_MAX	SHA2_512_SIZE
 
 enum hashes {
 	HASH_MD5 = 0,
-	HASH_SHA1
+	HASH_SHA1,
+	HASH_SHA2_256,
+	HASH_SHA2_384,
+	HASH_SHA2_512
 };
 
 struct hash {
diff --git a/sbin/isakmpd/ipsec.c b/sbin/isakmpd/ipsec.c
index 793be46c94f..ab8bbaba787 100644
--- a/sbin/isakmpd/ipsec.c
+++ b/sbin/isakmpd/ipsec.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ipsec.c,v 1.125 2006/06/09 21:37:17 naddy Exp $	 */
+/* $OpenBSD: ipsec.c,v 1.126 2006/06/10 20:10:02 hshoexer Exp $	 */
 /* $EOM: ipsec.c,v 1.143 2000/12/11 23:57:42 niklas Exp $	 */
 
 /*
@@ -1068,6 +1068,12 @@ from_ike_hash(u_int16_t hash)
 		return HASH_MD5;
 	case IKE_HASH_SHA:
 		return HASH_SHA1;
+	case IKE_HASH_SHA2_256:
+		return HASH_SHA2_256;
+	case IKE_HASH_SHA2_384:
+		return HASH_SHA2_384;
+	case IKE_HASH_SHA2_512:
+		return HASH_SHA2_512;
 	}
 	return -1;
 }
@@ -1665,8 +1671,9 @@ ipsec_esp_enckeylength(struct proto *proto)
 		if (!iproto->keylen)
 			return 16;
 		return iproto->keylen / 8;
-	case IPSEC_ESP_AES:
 	case IPSEC_ESP_AES_128_CTR:
+		return 20;
+	case IPSEC_ESP_AES:
 		if (!iproto->keylen)
 			return 16;
 		/* FALLTHROUGH */
diff --git a/sbin/isakmpd/pf_key_v2.c b/sbin/isakmpd/pf_key_v2.c
index 91041061503..0a9e0217b39 100644
--- a/sbin/isakmpd/pf_key_v2.c
+++ b/sbin/isakmpd/pf_key_v2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pf_key_v2.c,v 1.171 2006/05/31 04:58:13 hshoexer Exp $  */
+/* $OpenBSD: pf_key_v2.c,v 1.172 2006/06/10 20:10:02 hshoexer Exp $  */
 /* $EOM: pf_key_v2.c,v 1.79 2000/12/12 00:33:19 niklas Exp $	 */
 
 /*
@@ -934,10 +934,13 @@ pf_key_v2_set_spi(struct sa *sa, struct proto *proto, int incoming,
 			break;
 
 		case IPSEC_ESP_AES:
-			/* case IPSEC_ESP_AES_128_CTR: */
 			ssa.sadb_sa_encrypt = SADB_X_EALG_AES;
 			break;
 
+		case IPSEC_ESP_AES_128_CTR:
+			ssa.sadb_sa_encrypt = SADB_X_EALG_AESCTR;
+			break;
+
 		case IPSEC_ESP_CAST:
 			ssa.sadb_sa_encrypt = SADB_X_EALG_CAST;
 			break;