We are happy to announce the release of strongSwan 5.6.2 which includes rekeying and MOBIKE improvements, supports accessing certificates in a TPM 2.0, and fixes a DoS vulnerability and several other issues.
A denial-of-service vulnerability in parser for PKCS#1 RSASSA-PSS signatures was fixed that was caused by insufficient input validation. One of the configurable parameters in algorithm identifier structures for RSASSA-PSS signatures is the mask generation function (MGF). Only MGF1 is currently specified for this purpose. However, this in turn takes itself a parameter that specifies the underlying hash function. strongSwan's parser did not correctly handle the case of this parameter being absent, causing an undefined data read. strongSwan 5.6.1 is affected.
More information is provided in a separate blog entry.
When rekeying IKEv2 IKE_SAs the previously negotiated DH group will now be reused, instead of using the first configured group, which avoids an additional exchange if the peer previously selected a different DH group via INVALID_KE_PAYLOAD notify. The same is also done when rekeying CHILD_SAs except for the first rekeying of the CHILD_SA that was created with the IKE_SA, where no DH group was negotiated yet.
Also, the selected DH group is moved to the front in all sent proposals that contain it and all proposals that don't are moved to the back in order to convey the preference for this group to the peer.
Handling of MOBIKE task queuing has been improved. In particular, the response to an address update (with NAT-D payloads) is not ignored anymore if only an address list update or DPD is queued as that could prevent updating the UDP encapsulation in the kernel.
The fallback drop policies installed to avoid traffic leaks when replacing addresses in installed policies are now replaced by temporary drop policies, which also prevent acquires because we currently delete and reinstall IPsec SAs to update their addresses (the temporary SAs created by the kernel with acquires could have conflicted with reinstalling the SAs).
It's now possible to access X.509 certificates held in non-volatile storage of a TPM 2.0 referenced via the NV index.
Adding the --keyid parameter to pki --print allows to print private keys or certificates stored in a smartcard or a TPM 2.0.