Tobias Brunner
1c080407b2
stroke: Fail silently if another builder calls PW callback after giving up
...
Also reduced the number of tries to 3.
2013-05-08 15:02:41 +02:00
Tobias Brunner
4a64c3e9a0
stroke: Cache passwords so the user is not prompted multiple times for the same password
...
To verify/decrypt a PKCS#12 container a password might be needed
multiple times. If it was entered correctly we don't want to bother the
user again with another password prompt.
The passwords for MAC creation and encryption could be different so the
user might be prompted multiple times after all.
2013-05-08 15:02:41 +02:00
Tobias Brunner
e240b03e68
stroke: Fix prompt and error messages in passphrase callback
2013-05-08 15:02:41 +02:00
Tobias Brunner
7971278c92
stroke: Load credentials from PKCS#12 files (P12 token)
2013-05-08 15:02:41 +02:00
Tobias Brunner
904390e887
openssl: Cleanup thread specific error buffer
2013-05-08 15:02:40 +02:00
Tobias Brunner
3ee2af97bf
openssl: Don't use deprecated CRYPTO_set_id_callback() with OpenSSL >= 1.0.0
2013-05-08 15:02:40 +02:00
Tobias Brunner
780900ab0e
openssl: Add PKCS#12 parsing via OpenSSL
2013-05-08 15:02:40 +02:00
Tobias Brunner
651d5ab8e7
openssl: Properly cleanup OpenSSL library
2013-05-08 15:02:40 +02:00
Tobias Brunner
02116fdc2d
charon-cmd: Add support for PKCS#12 files
2013-05-08 15:02:40 +02:00
Tobias Brunner
3bd498284e
PEM plugin loads PKCS#12 containers from (DER-encoded) files
...
It is not actually able to handle PEM encoded PKCS#12 files produced
by OpenSSL.
2013-05-08 15:02:40 +02:00
Tobias Brunner
abc04e6b3f
Remove pluto specific certificate types
2013-05-08 15:02:40 +02:00
Tobias Brunner
f77d6e16d2
charon-cmd: match_me/match_other are optional in callback credentials
2013-05-08 15:02:40 +02:00
Tobias Brunner
89d350f46a
charon-cmd: Request password for private keys
2013-05-08 15:02:40 +02:00
Tobias Brunner
1f2a34d6d8
Add support for untruncated HMAC-SHA-512
2013-05-08 15:02:39 +02:00
Tobias Brunner
d8be7d38bf
Also support 128-bit RC2
2013-05-08 15:02:39 +02:00
Tobias Brunner
feef637368
Add pkcs12 plugin which adds support for decoding PKCS#12 containers
2013-05-08 15:02:39 +02:00
Tobias Brunner
199fdcadae
Function added to convert a hash algorithm to an HMAC integrity algorithm
2013-05-08 15:02:39 +02:00
Tobias Brunner
047fca1169
Support the PKCS#5/PKCS#12 encryption scheme used by OpenSSL for private keys
2013-05-08 15:02:39 +02:00
Tobias Brunner
0d0929fa0c
Register PKCS#8 builder for KEY_ANY
2013-05-08 15:02:39 +02:00
Tobias Brunner
8e48e0009a
Add support for PKCS#7/CMS encrypted-data
2013-05-08 15:02:39 +02:00
Tobias Brunner
d41e54c68d
Move PKCS#12 key derivation to a separate file
2013-05-08 15:02:39 +02:00
Tobias Brunner
594d847f79
PKCS#5 wrapper can decrypt PKCS#12-like schemes
2013-05-08 15:02:38 +02:00
Tobias Brunner
cb38e2f30a
Add test vectors for RC2
2013-05-08 15:02:38 +02:00
Tobias Brunner
162c06f2f5
Fix cleanup in crypto_tester if a crypter fails
2013-05-08 15:02:38 +02:00
Tobias Brunner
9d4fc8677f
Add implementation of the RC2 block cipher (RFC 2268)
2013-05-08 15:02:34 +02:00
Tobias Brunner
c734c2d875
Extract function to convert ASN.1 INTEGER object to u_int64_t
2013-05-08 14:53:08 +02:00
Tobias Brunner
4076e3ee91
Extract PKCS#5 handling from pkcs8 plugin to separate helper class
2013-05-08 14:53:08 +02:00
Tobias Brunner
b715176ec4
Merge branch 'charon-cmd-agent'
...
Adds support for authentication via ssh-agent to charon-cmd (RSA and ECDSA keys
are currently supported).
The new sshkey plugin parses SSH public keys in RFC 4253 format.
SSH public keys can be configured with the left|rightsigkey ipsec.conf option,
which replaces left|rightrsasigkey and takes a public key in one of three
formats: SSH (RFC 4253, ssh: prefix), DNSKEY (RFC 3110, dns: prefix, not the
full RR, only the actual RSA key), or PKCS#1 (the default, no prefix).
As before the keys are either encoded in hex (0x) or base64 (0s).
left|rightsigkey also accepts the path to a file containing a PEM or DER
encoded public key.
2013-05-08 14:35:05 +02:00
Tobias Brunner
4d38a698b8
charon-cmd: Changed formatting of optional arguments in usage information
...
Optional arguments have to be specified with = after the option.
2013-05-08 12:30:36 +02:00
Tobias Brunner
6a6d0ea7cd
charon-cmd: --agent optionally takes the path to an ssh-agent socket
...
If not given it is read from the SSH_AUTH_SOCK environment variable.
2013-05-08 12:30:36 +02:00
Tobias Brunner
efb4cb0bf9
charon-cmd: Stop processing options if an argument is missing or an option not recognized
2013-05-08 12:30:33 +02:00
Tobias Brunner
410abbd35f
charon-cmd: Properly initialize options with no additional lines
2013-05-07 17:08:31 +02:00
Tobias Brunner
e07e489d5f
agent: Use sshkey plugin to parse keys, adds support for ECDSA
2013-05-07 17:08:31 +02:00
Tobias Brunner
dd9e366814
sshkey: Add support for ECDSA keys
2013-05-07 17:08:31 +02:00
Tobias Brunner
87692be215
Load any type (RSA/ECDSA) of public key via left|rightsigkey
2013-05-07 17:08:31 +02:00
Tobias Brunner
fa1d3d39dc
left|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly
...
The default is now PKCS#1. With the dns: and ssh: prefixes other formats
can be selected.
2013-05-07 15:38:28 +02:00
Tobias Brunner
cc4408abcb
sshkey: Added builder for SSHKEY RSA keys
2013-05-07 15:38:28 +02:00
Tobias Brunner
584d656b77
Add sshkey plugin stub that will parse RFC 4253 public keys
2013-05-07 14:08:51 +02:00
Tobias Brunner
c0bbddfa42
Try to load raw keys from ipsec.conf as PKCS#1 blob first
...
The DNSKEY builder is quite eager and parses pretty much anything
as RSA key, so this has to be done before.
2013-05-07 14:08:51 +02:00
Tobias Brunner
ee7b73832c
charon-cmd: Add --agent option to authenticate using ssh-agent(1)
...
The socket path is read from the SSH_AUTH_SOCK environment variable.
So using this with sudo might require the -E command line (or an appropriate
sudoers config) to preserve the environment.
2013-05-07 14:08:51 +02:00
Tobias Brunner
4dc50bf9de
charon-cmd: Use loose matching of gateway identity
2013-05-07 13:53:48 +02:00
Tobias Brunner
8372b8fc54
charon-cmd: Load pubkey plugin to load raw keys
2013-05-07 13:46:02 +02:00
Tobias Brunner
e74bca9e19
testing: Don't run tests when building tkm
...
The problem with XML/Ada described in 9c2aba27fixes #336 .
2013-05-07 10:19:37 +02:00
Tobias Brunner
9c2aba2735
testing: Don't run tests when building tkm-rpc
...
There are issues with some versions of the XML/Ada library on i386,
blocking the build of the testing environment when these tests are run.
TKM tests won't work in such a case but at least make-testing does not
block with this patch.
Fixes #336 .
2013-05-06 18:17:58 +02:00
Martin Willi
a8849e0713
Merge branch 'tun-vip'
...
Beside some OS X love, this merge introduces virtual IP and route installation
support on the pfkey/pfroute kernel interfaces.
Each virtual IP gets installed on a dedicated TUN device. As Linux-like source
routes are not supported, routes for the negotiated traffic selectors get
installed using the TUN device.
To prevent IKE packets from using those routes, special exclude routes get
installed to the IKE gateway. This works for most road-warrior deployments, but
certainly does not for some more exotic configurations, such as those using
virtual-IP-to-host. Mobility is not yet supported, either.
2013-05-06 17:07:36 +02:00
Martin Willi
c9a323c1d9
kernel-pfroute: allow only one thread to do a route look up simultaneously
...
Otherwise we mess up the sequence number another thread is waiting for.
2013-05-06 17:01:13 +02:00
Martin Willi
5c12700f9a
kernel-interface: query SAD for last use time if SPD query didn't yield one
2013-05-06 17:01:13 +02:00
Martin Willi
bdaf9f97e6
child-sa: query SAD/SPD just for what we actually need to update statistics
2013-05-06 17:01:13 +02:00
Martin Willi
470aad7e0c
kernel-pfkey: be less verbose about unexpected sequence numbers
2013-05-06 17:01:13 +02:00
Martin Willi
df919d50d0
kernel-pfkey: install exclude routes if kernel-net requires them
2013-05-06 17:01:13 +02:00
Tobias Brunner