denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19,970 Commits 1 Branch 0 Tags
80f8f5e9d482e17490ecccabcd1aa01dd7402faa
Commit Graph
79 Commits
Author SHA1 Message Date
Tobias Brunner b31ce69722 eap-ttls: Add an upper bound for the length of the parsed AVP 
On typical systems that have overcommitting enabled, the 16 MiB maximum
that's allocated via the 24-bit length field in the AVP header shouldn't
be an issue as there are various limits that affect how much data can
actually be written to the allocated buffer (e.g. the maximum IKE message
size, the maximum TLS record size, or the maximum number of accepted
EAP-TTLS payloads), so this is primarily a defense-in-depth measure.

The length field of an EAP payload, which is the only type of AVP we
accept, is 16 bits, so that's what we now enforce as maximum.
 2026-07-24 08:47:36 +02:00
Tobias Brunner 73aff21077 eap-ttls: Prevent crash if AVP length header field is invalid 
The length field in the AVP header includes the 8 bytes of the header
itself.  Not checking for that and later subtracting it causes an
integer underflow that usually triggers a crash when accessing a
NULL pointer that resulted from the failing chunk_alloc() call because
of the high value.

The attempted allocations for invalid lengths (0-7) are 0xfffffff8,
0xfffffffc, or 0x100000000 (0 on 32-bit hosts), so this doesn't result
in a buffer overflow even if the allocation succeeds.

Fixes: 79f2102cb4 ("implemented server side support for EAP-TTLS")
Fixes: CVE-2026-25075
 2026-03-19 16:49:41 +01:00
Tobias Brunner 5cab5672e7 Define plugin version in all existing plugins 2025-08-22 15:32:39 +02:00
Tobias Brunner e252e1b465 eap-ttls: Fix build with DEBUG_LEVEL < 1 2023-05-08 17:32:18 +02:00
Tobias Brunner 9efd7d7e90 eap: Print vendor (PEN) names for vendor-specific EAP methods 2022-09-21 13:53:44 +02:00
Tobias Brunner f6e6fcd2f6 eap: Use pen_t instead of uint32_t for vendor ID 2022-09-21 13:53:44 +02:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Tobias Brunner 11a4687930 libtls: Add control flags and replace GENERIC_NULLOK purpose with one 2021-02-18 15:10:29 +01:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner 28649f6d91 libhydra: Remove empty unused library 2016-03-03 17:36:11 +01:00
Tobias Brunner fbb593092e eap-ttls: Limit maximum length of tunneled EAP packet to EAP-TTLS packet 2015-08-27 15:29:16 +02:00
Martin Willi 0864a31d13 eap-ttls: Support EAP auth information getter in EAP-TTLS 2015-03-03 14:08:01 +01:00
Martin Willi 4163421f91 plugins: Don't link with -rdynamic on Windows 2014-06-04 15:53:02 +02:00
Andreas Steffen 8d59090349 Implemented PT-EAP protocol (RFC 7171) 2014-05-12 06:59:21 +02:00
Tobias Brunner d223fe807a libcharon: Use lib->ns instead of charon->name 2014-02-12 14:34:32 +01:00
Martin Willi 19cb07b890 automake: replace INCLUDES by AM_CPPFLAGS 
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
 2013-07-18 14:59:19 +02:00
Tobias Brunner 31a416a5b2 Removed stray *_plugin_create() declarations from header files 2013-06-11 11:18:19 +02:00
Andreas Steffen 2a421163bf make TNC client authentication type available to IMVs 2013-02-12 20:38:05 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner cc4eec56f7 Encode EAP-Naks in expanded format if we got an expanded type request 
Since methods defined by the IETF (vendor ID 0) could also be encoded in
expanded type format the previous check was insufficient.
 2012-08-31 11:40:27 +02:00
Tobias Brunner 78e8dca94f Allow clients to request a configured EAP method via EAP-Nak 2012-08-31 11:40:27 +02:00
Tobias Brunner af04233e14 Send EAP-Nak with supported types if requested type is unsupported 2012-08-31 11:40:27 +02:00
Tobias Brunner 42500c274a Use name from initialization to access settings in libcharon. 
Also fixes several whitespace errors.
 2012-05-03 13:57:04 +02:00
Martin Willi b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
 2012-03-20 17:57:53 +01:00
Martin Willi 326a94232d Moved eap/xauth classes out of protocol specific subdirectories 2012-03-20 17:31:27 +01:00
Martin Willi 15a682f4c2 Separated libcharon/sa directory with ikev1 and ikev2 subfolders 2012-03-20 17:31:26 +01:00
Andreas Steffen fb5450a435 use MAX_RADIUS_ATTRIBUTE_SIZE constant from radius_message header file 2012-03-14 07:51:56 +01:00
Martin Willi 6a5c86b7ad Implemented TLS session resumption both as client and as server 2011-12-31 13:14:49 +01:00
Tobias Brunner 48e87e12ab Revert "fixed integrity tests of plugins using libtls or libtnccs" 
This reverts commit b597ac4a4c (not
completely).
 2011-11-08 18:35:11 +01:00
Andreas Steffen b597ac4a4c fixed integrity tests of plugins using libtls or libtnccs 2011-11-02 06:42:08 +01:00
Andreas Steffen e0f4f26ded Add features support to eap-ttls plugin 2011-10-14 17:20:33 +02:00
Andreas Steffen 7e432eff6b renamed tls_reader|writer to bio_* and moved to libstrongswan 2011-05-31 15:46:51 +02:00
Andreas Steffen 2778b6644b do not include length field in non-fragmented EAP-PEAP packets 2011-04-21 19:52:49 +02:00
Martin Willi 5b0bcfb1fc Revert alloc_str changes 
This reverts commit fdead26ffe.
This reverts commit 3e2419ebe3.
This reverts commit 17ce69b47a.
 2011-04-21 13:35:31 +02:00
Martin Willi 3e2419ebe3 Use thread save settings alloc_str function where appropriate 2011-04-21 10:48:16 +02:00
Martin Willi c55818ebb0 Added a (not yet implemented) plugin_t method to reload plugin configuration 2011-04-15 10:07:13 +02:00
Martin Willi 787b5884aa Added a get_name() function to plugin_t, create_plugin_enumerator enumerates over plugin_t 2011-04-15 10:07:12 +02:00
Andreas Steffen 30c42831a0 allow multi-pass authentication schemes as e.g. MSCHAPv2 2011-04-06 19:39:00 +02:00
Andreas Steffen c98ed04de0 display EAP identifiers in HEX format 2011-04-06 17:34:27 +02:00
Andreas Steffen 555a8ca238 added EAP identifier to debug output 2011-04-05 20:53:46 +02:00
Andreas Steffen 934216df2d added get|set_identifier() methods to eap_tls_t and eap_ttls_t 2011-04-05 18:35:22 +02:00
Andreas Steffen 2e44a2753f eap_packet_t definition moved to libstrongswan/eap/eap.h 2011-04-05 18:04:45 +02:00
Andreas Steffen 4da597631f fixed memory leak in EAP-TTLS piggy-back mode 2010-11-09 20:35:53 +01:00
Andreas Steffen 260d056170 suport certificate-based client authentication with EAP-TTLS 2010-10-14 21:00:41 +02:00
Andreas Steffen 04d000210b deactivate start_phase2_tnc flag after start 2010-10-07 15:42:00 +02:00
Andreas Steffen 888455587b added server side support for EAP-TNC 2010-10-07 15:02:51 +02:00
Andreas Steffen 20ad62026e support non EAP-TTLS conformant RADIUS-type attribute segmentation 2010-09-09 11:15:08 +02:00
Andreas Steffen 3b7eb3a9f4 added explanatory comments 2010-09-09 08:57:13 +02:00
Andreas Steffen de29e3a683 max max_message_count configurable and move it into tls_eap_t 2010-09-08 12:58:45 +02:00