denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,308 Commits 1 Branch 0 Tags
37fb404833e6cac479e512055c9645f73071185f
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 54a1a75b2f Don't use bio_writer_t.skip() to write length field when appending more data 
If the writer reallocates its buffer, the length pointer might not be valid
anymore, or even worse, point to an arbitrary allocation.
 2013-01-11 14:57:08 +01:00
Martin Willi 2f0441a3a6 Add rdrand NEWS 2013-01-11 10:48:57 +01:00
Martin Willi 2cd6c5115b Use raw opcodes for rdrand to build with older binutils 2013-01-11 10:45:14 +01:00
Martin Willi 19ae23452a Provide RNG_TRUE quality in rdrand by mixing reseeded outputs using AES 2013-01-11 10:45:14 +01:00
Martin Willi b9148ea232 Provide RNG_STRONG quality in rdrand by forcing PRNG reseed after every sample 2013-01-11 10:45:14 +01:00
Martin Willi 9fe24b004d Provide RNG_WEAK quality random generator in rdrand 2013-01-11 10:45:14 +01:00
Martin Willi ed8dc6f132 Add a rdrand plugin stub detecting availability of RDRAND instructions 2013-01-11 10:45:14 +01:00
Martin Willi 0e0870aef7 Add NEWS about improved Windows IKEv1 compatibility 2013-01-11 10:31:25 +01:00
Martin Willi 1954cc7720 Streamline debug output when receiving intermediate CA certificates in IKEv1 2013-01-11 10:24:23 +01:00
Martin Willi cde6a9ec9f Refactored IKEv2 cert/certreq payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi bf10ee9495 Refactored IKEv1 cert payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi ff318ad3e1 Include opensslconf.h before checking its defines 2013-01-03 11:12:05 +01:00
Martin Willi 2b9e597b54 Don't build OpenSSL PKCS#7 code if OPENSSL_NO_CMS defined 2013-01-03 11:05:49 +01:00
Martin Willi 656e01eab3 Add parantheses to avoid compiler warning 2012-12-24 10:12:23 +01:00
Martin Willi ecdd5aedac NEWS about error-notify 2012-12-19 10:43:35 +01:00
Martin Willi 32c3ac95e4 Add missing error_notify_msg.h to distribution tarball 2012-12-19 10:40:33 +01:00
Martin Willi 3044085006 Add an error-notify sample application to listen to error notifications 2012-12-19 10:40:33 +01:00
Martin Willi 0aaf5ccfa6 Add an error-notify plugin to send catched alerts to listening applications 2012-12-19 10:40:33 +01:00
Martin Willi 578f72ceb0 Raise an alert if half-open timeout limit reached 2012-12-19 10:40:33 +01:00
Martin Willi c57fe7ac6f Raise an alert if an authorize() hook fails 2012-12-19 10:40:33 +01:00
Martin Willi 45d6134218 Raise an alert if allocating virtual IPs fails 2012-12-19 10:40:33 +01:00
Martin Willi f285b9efc8 Raise an alert if kernel policy installation fails 2012-12-19 10:40:33 +01:00
Martin Willi bcf3147e0a Raise an alert if kernel SA installation fails 2012-12-19 10:40:33 +01:00
Martin Willi 24f30ec92f Raise an alert on traffic selector mismatch 2012-12-19 10:40:32 +01:00
Martin Willi c794455666 Raise alerts when enforcing IKE_SA unique policy 2012-12-19 10:40:32 +01:00
Martin Willi 5dd9c3087f Raise an alert if CHILD_SA proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi bab949bb26 Raise an alert if IKE proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi 3f7f5388a5 Raise an alert of generating local authentication data fails 2012-12-19 10:40:32 +01:00
Martin Willi cc0cc3b54d Add NEWS about BER capable OpenSSL PKCS#7 backend 2012-12-19 10:38:42 +01:00
Martin Willi 644be5d537 Free leaking scep attributes 2012-12-19 10:32:08 +01:00
Martin Willi 429e6d5eee Corrected error message if enveloped-data decryption fails 2012-12-19 10:32:08 +01:00
Martin Willi 0a344da291 Fix up serialNumber in openssl PKCS#7 if it has a leading MSB set 2012-12-19 10:32:08 +01:00
Martin Willi 71dd4e7895 Don't handle PKCS#7 containers with infinite length encodings in pkcs7 plugin 2012-12-19 10:32:08 +01:00
Martin Willi 3c820cdc23 Implement PKCS#7 decryption using openssl 2012-12-19 10:32:08 +01:00
Martin Willi 2a87944a33 Make available wrapped certificates while verifying PKCS#7 signatures in openssl 2012-12-19 10:32:08 +01:00
Martin Willi 04884be3b5 Implement openssl PKCS#7 certficiate enumeration 2012-12-19 10:32:08 +01:00
Martin Willi e96d945dcd Fix doxygen grouping regarding containers and PKCS#7 2012-12-19 10:32:08 +01:00
Martin Willi 36f2e11c70 Enable pkcs7 plugin when building scepclient on Android 2012-12-19 10:32:08 +01:00
Martin Willi 03ba8f9e8c Move PKCS#9 attribute lists to pkcs7 plugin, as we currently use it there only 2012-12-19 10:32:08 +01:00
Martin Willi 804ba5bb50 Implement get_attribute() in openssl PKCS#7 backend 2012-12-19 10:32:08 +01:00
Martin Willi 063ae4e52a Allocate data returned by pkcs7_t.get_attribute() 2012-12-19 10:32:08 +01:00
Martin Willi c61723c69f Implement OpenSSL PKCS#7 signed-data parsing and verification 2012-12-19 10:32:08 +01:00
Martin Willi 568ad938d1 Add a stub for OpenSSL PKCS#7 parsing 2012-12-19 10:32:08 +01:00
Martin Willi 1865fb929a Remove unused monolithic PKCS#7 code 2012-12-19 10:32:08 +01:00
Martin Willi 74cc41c704 Migrated scepclient to new modular PKCS# API 2012-12-19 10:32:08 +01:00
Martin Willi 6d21c61a09 Fix encryption algorithm/key size argument processing in PKCS#7 enveloped-data 2012-12-19 10:32:08 +01:00
Martin Willi ee97055835 Properly clone PKCS#7 attributes passed to builder 2012-12-19 10:32:08 +01:00
Martin Willi 8ccf5a4731 Fix enum names for container_type_t 2012-12-19 10:32:08 +01:00
Martin Willi 24b2dae2b6 Add a --show option to pki --pkcs7 to print contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi 9e967d7dda Add an enumerator for PKCS#7 contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi 9afbe59953 pki --pkcs7 --verify shows prints the signing time, if available 2012-12-19 10:32:08 +01:00
Martin Willi d3d706f4fc Add a getter for signed PKCS#7 attributes 2012-12-19 10:32:08 +01:00
Martin Willi 5a50bec9d2 Fix leak in pki --pkcs7 --decrypt 2012-12-19 10:32:08 +01:00
Martin Willi b95b4730f5 Support multiple signerInfos while parsing PKCS#7 signed-data 2012-12-19 10:32:07 +01:00
Martin Willi 47120d4977 Add a pki command to sign, verify, encrypt and decrypt PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi 5d932e4f01 Support encoding of PKCS#7 enveloped-data containers 2012-12-19 10:32:07 +01:00
Martin Willi 32745a28cf Support encoding of PKCS#7 signed-data containers 2012-12-19 10:32:07 +01:00
Martin Willi 3c2986bf0a Support encoding of PKCS#7 "data" containers 2012-12-19 10:32:07 +01:00
Martin Willi 637a8abb72 Add builder parts to generate PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi d7aa09104f Implement PKCS#7 enveloped-data parsing and decryption 2012-12-19 10:32:07 +01:00
Martin Willi 98bbe0760f Implement PKCS#7 signed-data parsing and verification 2012-12-19 10:32:07 +01:00
Martin Willi 83ed1464e3 Implement PKCS#7 "data" content type parsing 2012-12-19 10:32:07 +01:00
Martin Willi ed1c430334 certificate_t.has_subject() matches for certificate serialNumber 2012-12-19 10:32:07 +01:00
Martin Willi 9de6a7a85c Implement generic PKCS#7 contentInfo parsing 2012-12-19 10:32:07 +01:00
Martin Willi bd20f040fd Add a plugin stub for PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi 692f560546 Add container plugin features 2012-12-19 10:32:07 +01:00
Martin Willi fc67a932ba Add a generic interface for crypto containers and a more specific PKCS#7 interface 2012-12-19 10:32:07 +01:00
Martin Willi 67ca44ccbd Rebuild PKCS#9 encoding after adding new attributes 2012-12-19 10:32:07 +01:00
Martin Willi 60c9b5da8d Don't store additional encoding for each PKCS#9 attribute 2012-12-19 10:32:07 +01:00
Martin Willi 7f9fedc9bd Unify PKCS#9 set_attribute* methods to a single add_attribute 
This way the PKCS#9 implementation does not have to know
the encoding types for values
 2012-12-19 10:32:07 +01:00
Martin Willi c1005c120c PKCS#9 coding style cleanups 2012-12-19 10:32:07 +01:00
Martin Willi f0c02e27c4 Remove external build_encoding method in PKCS#9 2012-12-19 10:32:07 +01:00
Martin Willi 4185c64464 Use a ./configure check to detect pthread spinlock availability 
_POSIX_SPIN_LOCKS does not seem to be defined correctly on all
systems (Debian libc 2.3.6). Fixes #262.
 2012-12-18 09:51:33 +01:00
Martin Willi 544c2e3d7b kernel-netlinks get_interface() considers virtual IPs, too 
When using load-tester, we can install tunnel outer addresses on
demand. As these are installed as "virtual", we have to consider
virtual IPs in the get_interface() lookup to install "real" virtual
IPs to these dynamic external addresses.
 2012-12-17 14:23:44 +01:00
Martin Willi d9d0f12222 If load-tester requests a virtual IP, use a dynamic local traffic selector 2012-12-17 14:22:25 +01:00
Martin Willi fe3060f5d0 Add missing CHILD_SA specific proposal keyword in conftest README 2012-12-17 10:58:47 +01:00
Martin Willi df75cc5c5f Migrate RADIUS accounting state while IKE_SA unique id changes during rekey 2012-12-11 10:40:59 +01:00
Martin Willi 251b740712 Migrate cache and fire lookip events for unique_id change during IKE_SA rekey 2012-12-10 17:04:26 +01:00
Martin Willi 43b4c2ea75 Inherit virtual IP and attributes from old to new, not from new to old 2012-12-10 17:01:00 +01:00
Martin Willi 137ea41f45 Properly trigger ike_updown() event if IKEv1 DPD times out 
Fixes missing RADIUS Accounting Stop, #257.
 2012-12-04 11:11:50 +01:00
Martin Willi b091d80aff Replace optionsfrom LGPLv2 header by a GPLv2 2012-11-30 18:00:39 +01:00
Martin Willi 01bc9bf428 Fix GPL license header to properly "sed" it 2012-11-30 18:00:33 +01:00
Martin Willi c543616315 Add locking to IMC/IMV managers to add/remove IMC/IMVs on the fly 2012-11-30 15:49:23 +01:00
Martin Willi 7e45257f7d Reuse generic constructor in IMV/IMC message 2012-11-30 15:49:12 +01:00
Martin Willi a6722e5653 Add getters for the raw encoding in IMV/IMC messages 2012-11-30 15:49:07 +01:00
Martin Willi 2a433075e2 Clean up whitespaces in IMC/IMV messages 2012-11-30 15:49:03 +01:00
Martin Willi fdce28c49c Don't remove IETF standard errors while parsing IMC/IMV messages 2012-11-30 15:48:55 +01:00
Martin Willi 18bb1a1540 Remove unused get_vendor_id() method in IETF error IF-M attributes 2012-11-30 15:48:44 +01:00
Martin Willi 55b323c224 Check os_version when reading release file, os_name is not set for Debian 2012-11-30 15:48:39 +01:00
Martin Willi dd685d55e5 Don't unload IMC/IMV managers if no IMC/IMVs loaded from tnc_config 2012-11-30 15:48:26 +01:00
Martin Willi 016d343a50 Add wrappers to IMC/IMV managers loading IMC/IMVs from function pointers 2012-11-30 15:48:20 +01:00
Martin Willi be18ee8123 If adding an IMC/IMV fails, terminate() it only if it has been initialize()d 2012-11-30 15:48:13 +01:00
Martin Willi fd885fd390 Add an IMV constructor taking a set of custom TNC_IMV functions 2012-11-30 15:48:02 +01:00
Martin Willi f1f500c724 Add an IMC constructor taking a set of custom TNC_IMC functions 2012-11-30 15:47:59 +01:00
Martin Willi cd74959465 Clean up memory management when loading IMC/IMVs from files 2012-11-30 15:47:34 +01:00
Martin Willi db9c8b6fba Fix passing of IKE_SA unique_id over lookip socket 2012-11-30 13:44:12 +01:00
Martin Willi 78b2a2b148 Add load-tester NEWS 2012-11-29 10:29:17 +01:00
Martin Willi 48828ff0db Store load-tester address leases in a hashtable for fast removal 2012-11-29 10:22:52 +01:00
Martin Willi 7277e4719e Consolidated %any(6) host_t parsing 2012-11-29 10:22:52 +01:00
Martin Willi 98d0fd25a8 Remove numeric conversion from resolver, it is done directly in host_t 2012-11-29 10:22:52 +01:00