2.03; FreeS/WAN not vulnerable to CERT exploit; new Mac IPsec product

-----BEGIN PGP SIGNED MESSAGE-----



lists.freeswan.org Email Summary for Thursday October 16, 2003
===============================================================================
by Claudia Schmeing                                        [email protected]


This time around, there's a new FreeS/WAN release (2.03), with a matching
X.509 patch. You may be pleased to note that that patch is not vulnerable
to a recently publicised OpenSSL CERT exploit; see item 2.

Enjoy.



This Week in Brief....

1.  Latest FreeS/WAN: 2.03
2.  FreeS/WAN with X.509 not vulnerable to CERT exploit
3.  New Mac IPsec product compatible with FreeS/WAN
4.  Bug reports (Super FreeS/WAN & SMP, NAT-T with 2 subnets) 
5.  FreeS/WAN in LinkSys router: GPL violation?

- ------------------------------------------------------------------------------

1.  Latest FreeS/WAN: 2.03
    ======================
    4 posts Oct 8 - 14
    http://lists.freeswan.org/archives/users/2003-October/msg00252.html
    http://lists.freeswan.org/archives/users/2003-October/msg00379.html


FreeS/WAN 2.03 is out. From the announcement on www.freeswan.org:

    It features preliminary support for 2.6 kernels, either via KLIPS or the 
    native 2.6 kernel IPsec. See the new 2.6.known-issues document 
    (http://www.freeswan.org/freeswan_trees/CURRENT-TREE/doc/2.6.known-issues) 
    for more details. 2.03 also ships with an iproute2 based _updown script. 
    Several bugfixes are included, notably a fix for SHA1 packet reception. 

Andreas Steffen and his team have released a matching X.509 patch, v. 1.4.7,
In response to a question from Nilesh Trivedi, Andreas added,

    In principle port selectors should work with the native stack.

    I simply didn't have the time yet to have a closer look at the Linux 2.6
    userland/kernel interface to check if all parameters are set correctly
    and secondly I haven't got hold of a 2.6 platform yet.

Andreas requested feedback from folks testing port selectors with 2.6. He can 
be reached via [email protected].



2.  FreeS/WAN with X.509 not vulnerable to CERT exploit
    ===================================================
    3 posts Oct 2 - 3
    http://lists.freeswan.org/archives/users/2003-October/msg00057.html


According to Carnegie Mellon's Cert Coordination Center 
(http://www.cert.org/advisories/CA-2003-26.html):

    There are multiple vulnerabilities in different implementations of the 
    Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. 
    These vulnerabilities occur primarily in Abstract Syntax Notation One 
    (ASN.1) parsing code. The most serious vulnerabilities may allow a remote 
    attacker to execute arbitrary code. The common impact is denial of service.

Jim Carter, who pointed out this link to the list, asked whether Super 
FreeS/WAN (e.g. Andreas Steffen's X.509 patch for FreeS/WAN) is open to this 
type of exploit. Andreas answered that it was not, since it was not based
on OpenSSL. He elaborated:

    In response to the published OpenSSL vulnerability I inspected my 
    home-grown ASN.1 parser's behaviour in respect to wrong ASN.1 tags. 
    Since every ASN.1 object within an X.509 certificate or CRL is 
    syntactically verified against the specifications defined by RFC 3280 
    before actually decoding it, the parsing process is automatically 
    aborted in an orderly way whenever a mismatch occurs. All dynamically 
    assigned memory is freed so that the described DoS attacks are not 
    possible in FreeS/WAN.

Andreas added this challenge:

    I would be grateful for any malformed certificate and/or CRL that could 
    be used to practically demonstrate the robustness my ASN.1 parser.

to which Wes Hardaker responded:

    FYI, the problem with most ASN.1 parsers isn't that they don't reject
    invalid ASN.1 but that they don't handle valid, but odd, ASN.1.



3.  New Mac IPsec product compatible with FreeS/WAN
    ===============================================
    2 posts Oct 7
    http://lists.freeswan.org/archives/users/2003-October/msg00167.html


Equinux VPN Tracker (http://www.equinux.com/us/products/vpntracker/) is a
new IPsec product for Mac OS X. It features a graphical interface, and 
interoperates with FreeS/WAN using preshared keys (PSK), RSA keys, or X.509
certificates. The latter requires the X.509 patch to FreeS/WAN, which is 
included in Super FreeS/WAN.

Equinux provides a PDF (http://www.equinux.com/download/HowTo_FreeSWAN.pdf) 
explaining how to set up the VPN Tracker for use with FreeS/WAN.
Thanks to Marc Weinberger for notifying the list.



4.  Bug reports (Super FreeS/WAN & SMP, NAT-T with 2 subnets) 
    ==========================================================================
    4 posts Sep 1 - 30 
    http://lists.freeswan.org/archives/users/2003-September/msg00022.html
    http://lists.freeswan.org/archives/users/2003-September/msg00791.html
    3 posts Sep 27-29
    http://lists.freeswan.org/archives/users/2003-September/msg00772.html


A couple of bugs having to do with extended uses of FreeS/WAN have been 
discussed on-list in the last little while. Here's a synopsis.


About a bug with Super FreeS/WAN and SMP (symmetric multiprocessors), list
manager Sam Sgro wrote:

    Passing packets between two ipsec interfaces on a box with smp architecture
    causes a kernel freeze... ...There hasn't been a fix posted, but [the Super
    FreeS/WAN developers] are aware of it.
   
See also this discussion of the topic on the Super FreeS/WAN developers' list:                                                                           
    http://lists.freeswan.ca/pipermail/sfs-dev/2003-September/000354.html

The other bug of interest concerns FreeS/WAN with the NAT-T (Network 
Address Translation traversal) patch, also included in Super FreeS/WAN.

Martin Bene reported,

    There seems to be problems within nat-t patch 0.6 with more than one
    connection/vhost. I have not had time to debug it any more. That's
    partly because I'm using static virtual ip and don't need vhost stuff at
    all.

Tuomo Soini suggested that allowing connections from the subnet 0.0.0.0/0
(e.g. any IP), would furnish a workaround.



5.  FreeS/WAN in LinkSys router: GPL violation?
    ===========================================
    1 post Oct 12
    http://lists.freeswan.org/archives/design/2003-October/msg00037.html


Harald Welte pointed out that FreeS/WAN is shipped as part of a closed-source 
router product. This appears to be a violation of the GPL (Gnu Public License) 
agreement under which FreeS/WAN is licensed. The agreement states, among 
other things, that the source code of a product derived from a GPL'd product
must be freely available. Its text is available in FreeS/WAN's LICENSE file.

Harald provided these Linksys links:

   http://www.linksys.com/products/product.asp?grid=33&scid=35&prid=565
   http://www.linksys.com/download/firmware.asp?fwid=185

He commented:

    This is a different product based on a different linux SDK than the
    slashdotted linksys gpl case (busybox/pppd/iptables/etc) that was made
    public in july.

and added:

    It seems like they built this solution using the Jungo OpenRG, who even
    mention that particular product as design example (and openly admint
    that they are using Linux).   Despite that fact, there is no indication
    of the GPL and/or any source code offering.


 ------------------------------------------------------------------------------
lists.freeswan.org Email Summary                         Thursday, Oct 16, 2003

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBP49HuHDIYXPDEHodAQGisgP+OYaW6frBTdooODeZwiSgKetmRLeotG6f
0anRdi49ZLz0Ama5yzaGyoElJ02kE5AKM/Dxsrw5BCRCgNBhcxZ/U1ol49ToOXP3
lNNH4NEWV7LBARMrH7bjn86YPLEwcMep9NylTZVIlyCW2JDZzOMOLbcmxb8bVsx4
OnYcq3twXbI=
=IQSV
-----END PGP SIGNATURE-----