denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,696 Commits 1 Branch 0 Tags
375dfb9076487a5a7ea3d8130a80de287f3301b1
Commit Graph
345 Commits
Author SHA1 Message Date
Andreas Steffen 375dfb9076 crypto: References to RFCs 8410 and 8420 2018-09-04 07:24:20 +02:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner 9fcf4fdda1 x509: Add flag that marks compliance with RFC 4945 
According to RFC 4945, section 5.1.3.2, a certificate for IKE must
either not contain the keyUsage extension, or, if it does, have at least
one of the digitalSignature or nonReputiation bits set.
 2018-05-22 09:50:47 +02:00
Tobias Brunner 40da179f28 signature-params: Properly handle MGF1 algorithm identifier without parameters 
Credit to OSS-Fuzz.

Fixes: CVE-2018-6459
 2018-02-19 10:29:32 +01:00
Tobias Brunner 2db6d5b8b3 Fixed some typos, courtesy of codespell 2018-02-13 12:19:54 +01:00
Tobias Brunner c7263577b3 auth-cfg: Classify key strengths as multi value rules 
If that's not the case only the last value added would be considered
not all the keys of a trust chain.

Fixes #2515.
 2018-02-08 10:15:53 +01:00
Tobias Brunner fde0c763b6 auth-cfg: Add RSA/PSS schemes for pubkey and rsa if enabled in strongswan.conf 
Also document the rsa/pss prefix.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 0c23a5693c builder: Add builder option to pass signature scheme and params 2017-11-08 16:48:10 +01:00
Tobias Brunner eae80fdedc signature-params: Add helpers to parse/build ASN.1 algorithmIdentifier for signature schemes 2017-11-08 16:48:10 +01:00
Tobias Brunner 6f97c0d50b ikev2: Enumerate RSA/PSS schemes and use them if enabled 2017-11-08 16:48:10 +01:00
Tobias Brunner a4aaef7477 signature-params: Use helper to build MGF1 algorithmIdentifier 2017-11-08 16:48:10 +01:00
Tobias Brunner 634c6ba8ce auth-cfg: Parse rsa/pss auth tokens 2017-11-08 16:48:10 +01:00
Tobias Brunner 54f8d09261 auth-cfg: Store signature schemes as signature_params_t objects 
Due to circular references the hasher_from_signature_scheme() helper
does not take a signature_params_t object.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 024b979522 certificate: Return signature scheme and parameters from issued_by() method 
This also required some include restructuring (avoid including library.h
in headers) to avoid unresolvable circular dependencies.
 2017-11-08 16:48:10 +01:00
Tobias Brunner c2935b03c4 signature-params: Add helper struct for signature scheme and parameters 2017-11-08 16:48:10 +01:00
Tobias Brunner c380608a89 signature-params: Optionally pass a specific salt value when signing 2017-11-08 16:48:10 +01:00
Tobias Brunner a22316520b signature-params: Add functions to parse/build ASN.1 RSASSA-PSS params 2017-11-08 16:48:10 +01:00
Tobias Brunner d03c5b7994 signature-params: Add struct for RSASSA-PSS parameters 2017-11-08 16:48:10 +01:00
Tobias Brunner de280c2e03 private-key: Add optional parameters argument to sign() method 2017-11-08 16:48:10 +01:00
Tobias Brunner a413571f3b public-key: Add optional parameters argument to verify() method 2017-11-08 16:48:10 +01:00
Tobias Brunner 677072accc public-key: Add RSASSA-PSS signature scheme identifier 2017-11-08 16:48:10 +01:00
Tobias Brunner 4e7b7db62f certificates: Use shared destructor for x509_cdp_t 2017-09-18 10:54:19 +02:00
Tobias Brunner 578d893b4a credential-manager: Log issuer identity if not found 2017-07-27 13:28:13 +02:00
Tobias Brunner 0b756fbe95 auth-cfg: Don't limit subjectAltName check to received certificates 
Otherwise this won't work if the certificate is only locally available.
 2017-07-27 13:27:19 +02:00
Tobias Brunner b2473e94a2 Fixed some typos, courtesy of codespell 2017-05-26 14:44:06 +02:00
Tobias Brunner 2e4d110d1e linked-list: Change return value of find_first() and signature of its callback 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 95a63bf281 Migrate all enumerators to venumerate() interface change 2017-05-26 13:56:44 +02:00
Adrian-Ken Rueegsegger 6a8a44be88 credential-manager: Prefer local over global sets 
Invert set enumeration order to first enumerate local and then global
credential sets.
 2017-05-23 16:36:35 +02:00
Andreas Steffen db1ab1cd99 Reference Edwards-curve signature RFCs 2017-03-20 21:18:00 +01:00
Martin Willi 6c2465b446 builder: Define a builder part for X.509 RFC 3779 address blocks 2017-02-27 09:36:48 +01:00
Tobias Brunner bafd851896 mem-cred: Add methods to add/remove shared keys with unique identifiers 
Also added is a method to enumerate the unique identifiers.
 2017-02-16 19:21:12 +01:00
Tobias Brunner dd5ee9d415 mem-cred: Add method to remove a private key with a specific fingerprint 2017-02-16 19:21:12 +01:00
Andreas Steffen f2eb367adc Implemented EdDSA for IKEv2 using a pro forma Identity hash function 2016-12-14 11:15:48 +01:00
Andreas Steffen 35bc60cc68 Added support of EdDSA signatures 2016-12-14 11:15:47 +01:00
Andreas Steffen 880c312458 Fixed in-place update of cached base and delta CRLs 2016-10-30 16:37:24 +01:00
Andreas Steffen 2271ebb325 Newer CRLs replace older versions of the CRL in the cache 2016-10-26 12:48:54 +02:00
Tobias Brunner 9ba6548766 mem-cred: Support storing a delta CRL together with its base 
So far every "newer" CRL (higher serial or by date) replaced an existing
"older" CRL.  This meant that delta CRLs replaced an existing base CRL
and that base CRLs weren't added if a delta CRL was already stored.  So
the base had to be re-fetched every time after a delta CRL was added.

With this change one delta CRL to the latest base may be stored.  A newer
delta CRL will replace an existing delta CRL (but not its base, older
base CRLs are removed, though).  And a newer base will replace the existing
base and optional delta CRL.
 2016-10-11 17:18:22 +02:00
Andreas Steffen 40f2589abf gmp: Support of SHA-3 RSA signatures 2016-09-22 17:34:31 +02:00
Tobias Brunner 8efcc78f2b auth-cfg-wrapper: Fix memory leak with hash-and-URL certificates 
We wrap the auth-cfg object and its contents, so there is no need to get
an additional reference for the enumerated certificate.

Fixes a44bb9345f ("merged multi-auth branch back into trunk")
 2016-09-12 16:20:34 +02:00
Tobias Brunner 0ba905cf24 mem-cred: Fix memory leak when replacing existing CRLs 
Fixes #1442.
 2016-05-11 12:16:36 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner 755d076fec Fix some Doxygen issues 2016-03-11 12:25:14 +01:00
Tobias Brunner ef9171ad1e auth-cfg: Add a rule to suspend certificate validation constraints 2016-03-10 11:07:14 +01:00
Tobias Brunner f371effc5d credential-manager: Check cache queue when destroying trusted certificate enumerator 
We already do this in the trusted public key enumerator (which
internally uses the trusted certificate enumerator) but should do so
also when this enumerator is used directly (since the public key
enumerator has the read lock the additional call will just be skipped
there).
 2016-03-10 11:07:14 +01:00
Tobias Brunner 5452e3d66e credential-manager: Make online revocation checks optional for public key enumerator 2016-03-10 11:07:14 +01:00
Tobias Brunner 3c23a75120 auth-cfg: Make IKE signature schemes configurable 
This also restores the charon.signature_authentication_constraints
functionality, that is, if no explicit IKE signature schemes are
configured we apply all regular signature constraints as IKE constraints.
 2016-03-04 16:19:54 +01:00
Thomas Egerer c8a0781334 ikev2: Diversify signature scheme rule 
This allows for different signature schemes for IKE authentication and
trustchain verification.

Signed-off-by: Thomas Egerer <[email protected]>
 2016-03-04 16:19:53 +01:00
Andreas Steffen cc874350b8 Apply pubkey and signature constraints in vici plugin 2015-12-17 17:49:48 +01:00
Andreas Steffen 02d431022c Refactored certificate management for the vici and stroke interfaces 2015-12-12 00:19:24 +01:00