Skip to content

Commit

Permalink
Allow manual selection of IPsec IKE Pseudo-Random Function (PRF). Iss…
Browse files Browse the repository at this point in the history 
…ue #9309
  • Loading branch information
@vktg
vktg committed Jan 24, 2020
1 parent 23328e8 commit f5ddbec
Show file tree
Hide file tree
Showing 3 changed files with 66 additions and 7 deletions.
12 changes: 10 additions & 2 deletions src/etc/inc/ipsec.inc
View file
Expand Up @@ -1859,7 +1859,7 @@ function ipsec_setup_authentication(& $ph1ent, & $conn) {
* Values left empty will not be added to the string. Some combinations may
* require one or more parts to be omitted.
******/
function ipsec_setup_proposal_algo($ealg_id, $keylen, $halgo, $modp) {
function ipsec_setup_proposal_algo($ealg_id, $keylen, $halgo, $prfalgo, $modp) {
$palgo = "";

/* Add the encryption algorithm (if present) */
Expand All @@ -1883,6 +1883,10 @@ function ipsec_setup_proposal_algo($ealg_id, $keylen, $halgo, $modp) {
$palgo .= "{$halgo}";
}

if (!empty($prfalgo)) {
$palgo .= "-prf{$prfalgo}";
}

/* Convert the DH group to its keyword and add (if present) */
$modp = ipsec_convert_to_modp($modp);
if (!empty($modp)) {
Expand Down Expand Up @@ -1912,7 +1916,7 @@ function ipsec_setup_proposal_entry(& $ph2ent, & $algo_arr, $ealg_id, $keylen) {
/* If multiple hash algorithms are present, loop through and add them all. */
if (!empty($ph2ent['hash-algorithm-option']) && is_array($ph2ent['hash-algorithm-option'])) {
foreach ($ph2ent['hash-algorithm-option'] as $halgo) {
$proposal[] = ipsec_setup_proposal_algo($ealg_id, $keylen, $halgo, $ph2ent['pfsgroup']);
$proposal[] = ipsec_setup_proposal_algo($ealg_id, $keylen, $halgo, false, $ph2ent['pfsgroup']);
}
} else {
$proposal[] = ipsec_setup_proposal_algo($ealg_id, $keylen, '', $ph2ent['pfsgroup']);
Expand Down Expand Up @@ -2030,9 +2034,13 @@ function ipsec_setup_tunnels() {
empty($p1enc['hash-algorithm'])) {
continue;
}
if ($ph1ent['prfselect_enable'] != 'yes') {
$p1enc['prf-algorithm'] = false;
}
$ciphers[] = ipsec_setup_proposal_algo($p1enc['encryption-algorithm']['name'],
$p1enc['encryption-algorithm']['keylen'],
$p1enc['hash-algorithm'],
$p1enc['prf-algorithm'],
$p1enc['dhgroup']);
}
$conn['proposals'] = implode(",", $ciphers);
Expand Down
3 changes: 3 additions & 0 deletions src/usr/local/www/vpn_ipsec.php
View file
Expand Up @@ -389,6 +389,9 @@
echo "<br/>";
}
echo $p1_halgos[$p1algo['hash-algorithm']];
if (isset($ph1ent['prfselect_enable'])) {
echo " / PRF" . $p1_halgos[$p1algo['prf-algorithm']];
}
$first = false;
}
}
Expand Down
58 changes: 53 additions & 5 deletions src/usr/local/www/vpn_ipsec_phase1.php
View file
Expand Up @@ -127,6 +127,10 @@
$pconfig['dpd_maxfail'] = $a_phase1[$p1index]['dpd_maxfail'];
}

if (isset($a_phase1[$p1index]['prfselect_enable'])) {
$pconfig['prfselect_enable'] = 'yes';
}

if (isset($a_phase1[$p1index]['splitconn'])) {
$pconfig['splitconn'] = true;
}
Expand All @@ -152,6 +156,7 @@
$pconfig['reauth_time'] = "28800";
$pconfig['nat_traversal'] = 'on';
$pconfig['mobike'] = 'off';
$pconfig['prfselect_enable'] = false;
$pconfig['dpd_enable'] = true;
$pconfig['iketype'] = "ikev1";

Expand All @@ -166,6 +171,7 @@
$item = array();
$item['encryption-algorithm'] = array('name' => "aes", 'keylen' => 128);
$item['hash-algorithm'] = "sha256";
$item['prf-algorithm'] = "sha256";
$item['dhgroup'] = "14";
$pconfig['encryption']['item'][] = $item;
}
Expand All @@ -184,6 +190,7 @@
$item['encryption-algorithm']['name'] = $_POST['ealgo_algo'.$i];
$item['encryption-algorithm']['keylen'] = $_POST['ealgo_keylen'.$i];
$item['hash-algorithm'] = $_POST['halgo'.$i];
$item['prf-algorithm'] = $_POST['prfalgo'.$i];
$item['dhgroup'] = $_POST['dhgroup'.$i];
$pconfig['encryption']['item'][] = $item;
}
Expand Down Expand Up @@ -502,6 +509,12 @@
$ph1ent['mobike'] = $pconfig['mobike'];
$ph1ent['closeaction'] = $pconfig['closeaction'];

if (isset($pconfig['prfselect_enable'])) {
$ph1ent['prfselect_enable'] = 'yes';
} else {
unset($ph1ent['prfselect_enable']);
}

if (isset($pconfig['responderonly'])) {
$ph1ent['responderonly'] = true;
} else {
Expand Down Expand Up @@ -825,35 +838,47 @@ function build_eal_list() {
null,
$p1enc['encryption-algorithm']['name'],
build_eal_list()
))->setHelp($lastrow ? 'Algorithm' : '');
))->setHelp($lastrow ? 'Algorithm' : '')->setWidth(2);

$group->add(new Form_Select(
'ealgo_keylen'.$key,
null,
$p1enc['encryption-algorithm']['keylen'],
array()
))->setHelp($lastrow ? 'Key length' : '');
))->setHelp($lastrow ? 'Key length' : '')->setWidth(2);

$group->add(new Form_Select(
'halgo'.$key,
'*Hash Algorithm',
$p1enc['hash-algorithm'],
$p1_halgos
))->setHelp($lastrow ? 'Hash' : '');
))->setHelp($lastrow ? 'Hash' : '')->setWidth(2);

$group->add(new Form_Select(
'dhgroup'.$key,
'*DH Group',
$p1enc['dhgroup'],
$p1_dhgroups
))->setHelp($lastrow ? 'DH Group' : '');
))->setHelp($lastrow ? 'DH Group' : '')->setWidth(2);

$group->add(new Form_Button(
'deleterow' . $counter,
'Delete',
null,
'fa-trash'
))->addClass('btn-warning');
))->addClass('btn-warning')->setWidth(2);

$group->add(new Form_StaticText(
null,
null,
))->setWidth(6);

$group->add(new Form_Select(
'prfalgo'.$key,
'*PRF Algorithm',
$p1enc['prf-algorithm'],
$p1_halgos
))->setHelp($lastrow ? 'PRF' : '')->setWidth(2);

$section->add($group);
$counter += 1;
Expand Down Expand Up @@ -940,6 +965,13 @@ function build_eal_list() {
$pconfig['splitconn']
));

$section->addInput(new Form_Checkbox(
'prfselect_enable',
'PRF Selection',
'Enable manual Pseudo-Random Function (PRF) selection',
$pconfig['prfselect_enable'],
))->setHelp('Manual PRF selection is typically not required, but can be useful in combination with AEAD Encryption Algorithms such as AES-GCM');

/* FreeBSD doesn't yet have TFC support. this is ready to go once it does
https://redmine.pfsense.org/issues/4688
Expand Down Expand Up @@ -1043,13 +1075,15 @@ function iketype_change() {
//hideCheckbox('tfc_enable', false);
hideInput('rekey_time', false);
hideCheckbox('splitconn', false);
hideCheckbox('prfselect_enable', false);
} else {
hideInput('mode', false);
hideInput('mobike', true);
//hideCheckbox('tfc_enable', true);
//hideInput('tfc_bytes', true);
hideInput('rekey_time', !($('#iketype').val() == 'auto'));
hideCheckbox('splitconn', true);
hideCheckbox('prfselect_enable', true);
}
}

Expand Down Expand Up @@ -1173,6 +1207,14 @@ function ealgosel_change(id, bits) {
}
}

function prfselectchkbox_change() {
hide = !$('#prfselect_enable').prop('checked');
var i;
for (i = 0; i < 50; i++) {
hideGroupInput('prfalgo' + i , hide);
}
}

function dpdchkbox_change() {
hide = !$('#dpd_enable').prop('checked');

Expand All @@ -1196,6 +1238,11 @@ function dpdchkbox_change() {

// ---------- Monitor elements for change and call the appropriate display functions ----------

// Enable PRF
$('#prfselect_enable').click(function () {
prfselectchkbox_change();
});

// Enable DPD
$('#dpd_enable').click(function () {
dpdchkbox_change();
Expand Down Expand Up @@ -1238,6 +1285,7 @@ function dpdchkbox_change() {
iketype_change();
methodsel_change();
dpdchkbox_change();
prfselectchkbox_change();
<?php
foreach($pconfig['encryption']['item'] as $key => $p1enc) {
$keylen = $p1enc['encryption-algorithm']['keylen'];
Expand Down

0 comments on commit f5ddbec

Please sign in to comment.