denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,175 Commits 1 Branch 0 Tags
17c9972252cf4af5fed6a0752f1cc2c388705dcd
Commit Graph
353 Commits
Author SHA1 Message Date
Tobias Brunner 17c9972252 Fixed some typos, courtesy of codespell 2019-08-28 14:03:41 +02:00
SophieK 3aa7b2dc3a Avoid enumerating certificates with non-matching key type 
If the key type was specified but the ID was NULL or matched a subject, it
was possible that a certificate was returned that didn't actually match
the requested key type.

Closes strongswan/strongswan#141.
 2019-05-21 10:22:30 +02:00
Andreas Steffen df6441a13f pki: Allow inclusion of [unsupported] critical X.509 extension 2019-05-08 14:56:48 +02:00
Tobias Brunner 20f74adbae curve25519: Support loading Ed25519 public keys from simple blobs 2018-10-26 11:01:10 +02:00
Tobias Brunner ecfe67550d signature-params: Provide option for maximum RSA/PSS salt length 
However, the length now has to be resolved early, so we don't operate on
the negative constant values e.g. when generating the encoding.
 2018-10-26 09:03:26 +02:00
Tobias Brunner 1c4738325d private-key: Add optional method that returns supported signature schemes 2018-10-25 17:21:32 +02:00
Tobias Brunner 784d96e031 Fixed some typos, courtesy of codespell 2018-09-17 18:51:44 +02:00
Tobias Brunner bac3ca2324 shared-key: Add a new type for Postquantum Preshared Keys 
Using a separate type allows us to easily check if we have any PPKs
available at all.
 2018-09-10 18:03:01 +02:00
Andreas Steffen 375dfb9076 crypto: References to RFCs 8410 and 8420 2018-09-04 07:24:20 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner 9fcf4fdda1 x509: Add flag that marks compliance with RFC 4945 
According to RFC 4945, section 5.1.3.2, a certificate for IKE must
either not contain the keyUsage extension, or, if it does, have at least
one of the digitalSignature or nonReputiation bits set.
 2018-05-22 09:50:47 +02:00
Tobias Brunner 40da179f28 signature-params: Properly handle MGF1 algorithm identifier without parameters 
Credit to OSS-Fuzz.

Fixes: CVE-2018-6459
 2018-02-19 10:29:32 +01:00
Tobias Brunner 2db6d5b8b3 Fixed some typos, courtesy of codespell 2018-02-13 12:19:54 +01:00
Tobias Brunner c7263577b3 auth-cfg: Classify key strengths as multi value rules 
If that's not the case only the last value added would be considered
not all the keys of a trust chain.

Fixes #2515.
 2018-02-08 10:15:53 +01:00
Tobias Brunner fde0c763b6 auth-cfg: Add RSA/PSS schemes for pubkey and rsa if enabled in strongswan.conf 
Also document the rsa/pss prefix.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 0c23a5693c builder: Add builder option to pass signature scheme and params 2017-11-08 16:48:10 +01:00
Tobias Brunner eae80fdedc signature-params: Add helpers to parse/build ASN.1 algorithmIdentifier for signature schemes 2017-11-08 16:48:10 +01:00
Tobias Brunner 6f97c0d50b ikev2: Enumerate RSA/PSS schemes and use them if enabled 2017-11-08 16:48:10 +01:00
Tobias Brunner a4aaef7477 signature-params: Use helper to build MGF1 algorithmIdentifier 2017-11-08 16:48:10 +01:00
Tobias Brunner 634c6ba8ce auth-cfg: Parse rsa/pss auth tokens 2017-11-08 16:48:10 +01:00
Tobias Brunner 54f8d09261 auth-cfg: Store signature schemes as signature_params_t objects 
Due to circular references the hasher_from_signature_scheme() helper
does not take a signature_params_t object.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 024b979522 certificate: Return signature scheme and parameters from issued_by() method 
This also required some include restructuring (avoid including library.h
in headers) to avoid unresolvable circular dependencies.
 2017-11-08 16:48:10 +01:00
Tobias Brunner c2935b03c4 signature-params: Add helper struct for signature scheme and parameters 2017-11-08 16:48:10 +01:00
Tobias Brunner c380608a89 signature-params: Optionally pass a specific salt value when signing 2017-11-08 16:48:10 +01:00
Tobias Brunner a22316520b signature-params: Add functions to parse/build ASN.1 RSASSA-PSS params 2017-11-08 16:48:10 +01:00
Tobias Brunner d03c5b7994 signature-params: Add struct for RSASSA-PSS parameters 2017-11-08 16:48:10 +01:00
Tobias Brunner de280c2e03 private-key: Add optional parameters argument to sign() method 2017-11-08 16:48:10 +01:00
Tobias Brunner a413571f3b public-key: Add optional parameters argument to verify() method 2017-11-08 16:48:10 +01:00
Tobias Brunner 677072accc public-key: Add RSASSA-PSS signature scheme identifier 2017-11-08 16:48:10 +01:00
Tobias Brunner 4e7b7db62f certificates: Use shared destructor for x509_cdp_t 2017-09-18 10:54:19 +02:00
Tobias Brunner 578d893b4a credential-manager: Log issuer identity if not found 2017-07-27 13:28:13 +02:00
Tobias Brunner 0b756fbe95 auth-cfg: Don't limit subjectAltName check to received certificates 
Otherwise this won't work if the certificate is only locally available.
 2017-07-27 13:27:19 +02:00
Tobias Brunner b2473e94a2 Fixed some typos, courtesy of codespell 2017-05-26 14:44:06 +02:00
Tobias Brunner 2e4d110d1e linked-list: Change return value of find_first() and signature of its callback 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 95a63bf281 Migrate all enumerators to venumerate() interface change 2017-05-26 13:56:44 +02:00
Adrian-Ken Rueegsegger 6a8a44be88 credential-manager: Prefer local over global sets 
Invert set enumeration order to first enumerate local and then global
credential sets.
 2017-05-23 16:36:35 +02:00
Andreas Steffen db1ab1cd99 Reference Edwards-curve signature RFCs 2017-03-20 21:18:00 +01:00
Martin Willi 6c2465b446 builder: Define a builder part for X.509 RFC 3779 address blocks 2017-02-27 09:36:48 +01:00
Tobias Brunner bafd851896 mem-cred: Add methods to add/remove shared keys with unique identifiers 
Also added is a method to enumerate the unique identifiers.
 2017-02-16 19:21:12 +01:00
Tobias Brunner dd5ee9d415 mem-cred: Add method to remove a private key with a specific fingerprint 2017-02-16 19:21:12 +01:00
Andreas Steffen f2eb367adc Implemented EdDSA for IKEv2 using a pro forma Identity hash function 2016-12-14 11:15:48 +01:00
Andreas Steffen 35bc60cc68 Added support of EdDSA signatures 2016-12-14 11:15:47 +01:00
Andreas Steffen 880c312458 Fixed in-place update of cached base and delta CRLs 2016-10-30 16:37:24 +01:00
Andreas Steffen 2271ebb325 Newer CRLs replace older versions of the CRL in the cache 2016-10-26 12:48:54 +02:00
Tobias Brunner 9ba6548766 mem-cred: Support storing a delta CRL together with its base 
So far every "newer" CRL (higher serial or by date) replaced an existing
"older" CRL.  This meant that delta CRLs replaced an existing base CRL
and that base CRLs weren't added if a delta CRL was already stored.  So
the base had to be re-fetched every time after a delta CRL was added.

With this change one delta CRL to the latest base may be stored.  A newer
delta CRL will replace an existing delta CRL (but not its base, older
base CRLs are removed, though).  And a newer base will replace the existing
base and optional delta CRL.
 2016-10-11 17:18:22 +02:00
Andreas Steffen 40f2589abf gmp: Support of SHA-3 RSA signatures 2016-09-22 17:34:31 +02:00
Tobias Brunner 8efcc78f2b auth-cfg-wrapper: Fix memory leak with hash-and-URL certificates 
We wrap the auth-cfg object and its contents, so there is no need to get
an additional reference for the enumerated certificate.

Fixes a44bb9345f ("merged multi-auth branch back into trunk")
 2016-09-12 16:20:34 +02:00
Tobias Brunner 0ba905cf24 mem-cred: Fix memory leak when replacing existing CRLs 
Fixes #1442.
 2016-05-11 12:16:36 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00