denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,864 Commits 1 Branch 0 Tags
14bd0bc743abb391a5af2ff8bfb315ca071ad0a6
Commit Graph
254 Commits
Author SHA1 Message Date
Tobias Brunner 14bd0bc743 Fixed some typos, courtesy of codespell 2023-11-14 10:11:16 +01:00
Andreas Steffen 6941dcb17a x509: Fix regression introduced by commit a22147a 
Instead of the CA certificate's subjectKeyIdentifier erroneously
the CA's authorityKeyIdentifier was used as the authorityKeyIdentfier
of the certificate to be issued. This might work with a root CA
where the authorityKeyIdentifier equals its subjectKeyIdentfier
but introduces a severe regression when an intermediate CA is used.
 2023-11-14 08:00:27 +01:00
Andreas Steffen 00ab8d62c0 x509: Support generation of OCSP responses 2023-11-13 12:40:55 +01:00
Andreas Steffen 9381559754 x509: Support parsing of OCSP requests 2023-11-13 12:39:10 +01:00
Tobias Brunner 500cacf6d8 x509: Add support to encode SANs of type uniformResourceIdentifier 2023-11-13 12:33:39 +01:00
Tobias Brunner a22147a1b2 x509: Use issuer certificate's subjectKeyIdentifier if available 
Instead of just generating an authorityKeyIdentifier based on the
issuer's public key, this allows CA certificates to be issued by a
different tool that doesn't use a SHA-1 hash of the subjectPublicKey
for the subjectKeyIdentifier.

Closes strongswan/strongswan#1992
References strongswan/strongswan#1975
 2023-11-13 12:32:32 +01:00
Tobias Brunner ede96fe3db x509: Add support for IP address nameConstraints 
According to RFC 5280, section 4.2.1.10, these are encoded as address
followed by a network mask of the same length.
 2023-11-13 12:23:33 +01:00
Tobias Brunner c0a281472f x509: Fix build with DEBUG_LEVEL < 2 for structures that ignore unknown critical extensions 2023-05-08 14:07:18 +02:00
Tobias Brunner 7d1f221211 x509: Only allow certificates with cRLSign keyUsage to sign CRLs 2023-03-21 16:34:14 +01:00
Tobias Brunner 7414c06669 x509: Set X509_CRL_SIGN for CA certificates without keyUsage extension 2023-03-21 16:34:14 +01:00
Andreas Steffen 8effb06d6c pki: Use X.509v3 EKU extension in CSR 2023-01-11 19:19:09 +01:00
Andreas Steffen 18082ce2b0 certificates: Retrieve serial numbers in canonical form 
The x509 plugin retrieves serial numbers with two's complement
encoding whereas the openssl plugin partially returns them without
leading zeroes.

Serial numbers in X.509 certificates, X.509 CRL, X.509 attribute
certificates, OCSP Requests and OCSP responses are now returned in
canonical form without prepended zero octets.
 2022-12-05 20:18:24 +01:00
Tobias Brunner 7f46c76125 Make functions static that are only accessed from the same compilation unit 
Also removed some declarations for undefined functions.
 2022-10-05 19:00:46 +02:00
Andreas Steffen 3fa3d2666a pki: pki --req can use old certreq as template 
When an X.509 certificate has to be renewed it is helpful to use
the old PKCS#10 certificate request as a template, so that the
distinguishedName (DN), the subjectAlternativeName (SAN) and
a certificate profile name don't have to be typed-in again.

The old public key in the existing certreq is replaced with the
new key and the signature is re-generated using the new private key.
 2022-08-31 15:10:34 +02:00
Andreas Steffen 1ef8b92211 pkcs10: Support of Microsoft CertTypeExtension 
The msCertificateTypeExtension OID (1.3.6.1.4.1.311.20.2) can
be used in a PKCS#10 certificate request to define a certificate
profile. It consists of an UTF8 string.

pki: profile option
 2022-08-24 20:46:44 +02:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Adrian-Ken Rueegsegger 027c5c9dcb x509: Consider authorityKeyIdentifier in issued_by() 
Prior to verifying the cryptographic signature, check if the
authorityKeyIdentifier matches the key ID of the issuing certificate if
it is available.
 2021-05-07 14:29:24 +02:00
Josh Soref b3ab7a48cc Spelling fixes 
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior

Closes strongswan/strongswan#164.
 2020-02-11 18:23:07 +01:00
Tobias Brunner 776433505b x509: Replace problematic calls of chunk_from_chars() for keyUsage extension 
As noted in 8ea13bbc5c newer compilers might optimize out the
assignment leading to invalid values in the keyUsage extension (as the
length was still set, the extension was encoded, just not with the
intended values).

Fixes #3249.
 2020-01-30 18:18:28 +01:00
Tobias Brunner cd0e4d5297 x509: Correctly parse nonce in OCSP response 
Fixes: d7dc677ee5 ("x509: Correctly encode nonce in OCSP request")
 2019-12-06 09:52:30 +01:00
Tobias Brunner 5333db58ac x509: Add getter for nonce in OCSP request/response implementations 2019-12-06 09:50:55 +01:00
Andreas Steffen df6441a13f pki: Allow inclusion of [unsupported] critical X.509 extension 2019-05-08 14:56:48 +02:00
Andreas Steffen 6d087b33de libstrongswan: xmppaddr prefix designates an xmppAddr otherName ID type 2018-05-30 17:25:28 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner a0902d1ae0 x509: Fail CRL validity check if thisUpdate is in the future 2018-05-22 09:50:47 +02:00
Tobias Brunner 920366e688 x509: Set IKE compliance flag depending on keyUsage 2018-05-22 09:50:47 +02:00
Tobias Brunner 9ba01ce380 x509: Fix leak if a CRL contains multiple authorityKeyIdentifiers 2018-02-21 11:13:42 +01:00
Tobias Brunner 7a659c0f99 x509: Initialize signature params when parsing attribute certificates 2017-11-15 14:41:56 +01:00
Tobias Brunner bbfe39f597 x509: Add support for signature schemes with parameters 
Also adds support for specifying the hash algorithm for attribute
certificate signatures.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 024b979522 certificate: Return signature scheme and parameters from issued_by() method 
This also required some include restructuring (avoid including library.h
in headers) to avoid unresolvable circular dependencies.
 2017-11-08 16:48:10 +01:00
Tobias Brunner de280c2e03 private-key: Add optional parameters argument to sign() method 2017-11-08 16:48:10 +01:00
Tobias Brunner a413571f3b public-key: Add optional parameters argument to verify() method 2017-11-08 16:48:10 +01:00
Tobias Brunner 4e7b7db62f certificates: Use shared destructor for x509_cdp_t 2017-09-18 10:54:19 +02:00
Tobias Brunner d7dc677ee5 x509: Correctly encode nonce in OCSP request 
The nonce value is encoded as OCTET STRING, however, the extension
values themselves must also be encoded as OCTET STRING.
 2017-07-07 08:57:14 +02:00
Andreas Steffen 38a8ecadb7 x509: nameConstraints sequence does not require a loop 
Fixes: CVE-2017-9023
 2017-05-29 11:05:04 +02:00
Andreas Steffen 407fcca200 asn1-parser: Fix CHOICE parsing 
Fixes: CVE-2017-9023
 2017-05-29 11:05:04 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 9c42126297 x509: Fix leak when parsing CDPs if an invalid one follows valid ones 2017-05-23 18:29:12 +02:00
Tobias Brunner 92a10e4645 x509: Manually print CRL/OCSP URIs when fuzzing 
This avoids a warning about the custom %Y printf specifier.
 2017-05-23 18:29:12 +02:00
Tobias Brunner 388351609d x509: Fix leak if there is an empty CDP 2017-05-23 18:29:11 +02:00
Tobias Brunner 5e37f7e550 x509: Fix leak if a certificate contains multiple authorityKeyIdentifiers 2017-05-23 18:29:11 +02:00
Andreas Steffen b0dcf33f0f x509: Evaluate return codes of parsing functions 2017-05-08 16:44:25 +02:00
Martin Willi a115f48428 x509: Do not mark generated addrblock extension as critical 
While RFC 3779 says we SHOULD mark it is critical, this has severe side effects
in practice. The addrblock extension is not widely used nor implemented, and
only a few applications can handle this extension. By marking it critical,
none of these applications can make use of such certificates where included
addrblocks do not matter, such as TLS/HTTPS.

If an application wants to make use of addrblocks, that is usually an explicit
decision. Then the very same application obviously can handle addrblocks, and
there is no need for the extension to be critical. In other words, for local
policy checks it is a local matter to handle the extension, hence making it
critical is usually not of much help.
 2017-02-27 09:36:48 +01:00
Martin Willi 6734d7a51a x509: Support encoding the RFC 3779 addrblock extension 2017-02-27 09:36:48 +01:00
Tobias Brunner 9aaea4dbfe x509: Properly wrap keyid in authorityKeyIdentifier in attribute certificates 
The correct encoding got lost in bdec2e4f52 ("refactored openac and
its attribute certificate factory").

Fixes #1370.
 2016-06-06 13:46:11 +02:00
Andreas Steffen ef43df6cbe Allow msSmartcardLogon EKU to be built 2015-12-11 18:26:54 +01:00
Andreas Steffen fd90f0613c Print OCSP single responses 2015-12-11 18:26:53 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Tobias Brunner 6133770db4 x509: Use subjectKeyIdentifier provided by issuer cert when checking CRL issuer 
Some CAs don't use SHA-1 hashes of the public key as subjectKeyIdentifier and
authorityKeyIdentifier.  If that's the case we can't force the
calculation of the hash to compare that to authorityKeyIdentifier in the CRL,
instead we use the subjectKeyIdentifier stored in the issuer certificate, if
available.  Otherwise, we fall back to the SHA-1 hash (or comparing the
DNs) as before.
 2015-03-06 16:49:12 +01:00
Martin Willi b851f0a105 x509: Fix public key reference leak if authority key identifier does not match 2015-02-06 13:58:58 +01:00