denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,052 Commits 1 Branch 0 Tags
3bd498284ef27e7dfd41db06447918d544c6ea70
Commit Graph
8621 Commits
Author SHA1 Message Date
Tobias Brunner 3bd498284e PEM plugin loads PKCS#12 containers from (DER-encoded) files 
It is not actually able to handle PEM encoded PKCS#12 files produced
by OpenSSL.
 2013-05-08 15:02:40 +02:00
Tobias Brunner abc04e6b3f Remove pluto specific certificate types 2013-05-08 15:02:40 +02:00
Tobias Brunner f77d6e16d2 charon-cmd: match_me/match_other are optional in callback credentials 2013-05-08 15:02:40 +02:00
Tobias Brunner 89d350f46a charon-cmd: Request password for private keys 2013-05-08 15:02:40 +02:00
Tobias Brunner 1f2a34d6d8 Add support for untruncated HMAC-SHA-512 2013-05-08 15:02:39 +02:00
Tobias Brunner d8be7d38bf Also support 128-bit RC2 2013-05-08 15:02:39 +02:00
Tobias Brunner feef637368 Add pkcs12 plugin which adds support for decoding PKCS#12 containers 2013-05-08 15:02:39 +02:00
Tobias Brunner 199fdcadae Function added to convert a hash algorithm to an HMAC integrity algorithm 2013-05-08 15:02:39 +02:00
Tobias Brunner 047fca1169 Support the PKCS#5/PKCS#12 encryption scheme used by OpenSSL for private keys 2013-05-08 15:02:39 +02:00
Tobias Brunner 0d0929fa0c Register PKCS#8 builder for KEY_ANY 2013-05-08 15:02:39 +02:00
Tobias Brunner 8e48e0009a Add support for PKCS#7/CMS encrypted-data 2013-05-08 15:02:39 +02:00
Tobias Brunner d41e54c68d Move PKCS#12 key derivation to a separate file 2013-05-08 15:02:39 +02:00
Tobias Brunner 594d847f79 PKCS#5 wrapper can decrypt PKCS#12-like schemes 2013-05-08 15:02:38 +02:00
Tobias Brunner cb38e2f30a Add test vectors for RC2 2013-05-08 15:02:38 +02:00
Tobias Brunner 162c06f2f5 Fix cleanup in crypto_tester if a crypter fails 2013-05-08 15:02:38 +02:00
Tobias Brunner 9d4fc8677f Add implementation of the RC2 block cipher (RFC 2268) 2013-05-08 15:02:34 +02:00
Tobias Brunner c734c2d875 Extract function to convert ASN.1 INTEGER object to u_int64_t 2013-05-08 14:53:08 +02:00
Tobias Brunner 4076e3ee91 Extract PKCS#5 handling from pkcs8 plugin to separate helper class 2013-05-08 14:53:08 +02:00
Tobias Brunner 4d38a698b8 charon-cmd: Changed formatting of optional arguments in usage information 
Optional arguments have to be specified with = after the option.
 2013-05-08 12:30:36 +02:00
Tobias Brunner 6a6d0ea7cd charon-cmd: --agent optionally takes the path to an ssh-agent socket 
If not given it is read from the SSH_AUTH_SOCK environment variable.
 2013-05-08 12:30:36 +02:00
Tobias Brunner efb4cb0bf9 charon-cmd: Stop processing options if an argument is missing or an option not recognized 2013-05-08 12:30:33 +02:00
Tobias Brunner 410abbd35f charon-cmd: Properly initialize options with no additional lines 2013-05-07 17:08:31 +02:00
Tobias Brunner e07e489d5f agent: Use sshkey plugin to parse keys, adds support for ECDSA 2013-05-07 17:08:31 +02:00
Tobias Brunner dd9e366814 sshkey: Add support for ECDSA keys 2013-05-07 17:08:31 +02:00
Tobias Brunner 87692be215 Load any type (RSA/ECDSA) of public key via left|rightsigkey 2013-05-07 17:08:31 +02:00
Tobias Brunner fa1d3d39dc left|rightrsasigkey accepts SSH keys but the key format has to be specified explicitly 
The default is now PKCS#1. With the dns: and ssh: prefixes other formats
can be selected.
 2013-05-07 15:38:28 +02:00
Tobias Brunner cc4408abcb sshkey: Added builder for SSHKEY RSA keys 2013-05-07 15:38:28 +02:00
Tobias Brunner 584d656b77 Add sshkey plugin stub that will parse RFC 4253 public keys 2013-05-07 14:08:51 +02:00
Tobias Brunner c0bbddfa42 Try to load raw keys from ipsec.conf as PKCS#1 blob first 
The DNSKEY builder is quite eager and parses pretty much anything
as RSA key, so this has to be done before.
 2013-05-07 14:08:51 +02:00
Tobias Brunner ee7b73832c charon-cmd: Add --agent option to authenticate using ssh-agent(1) 
The socket path is read from the SSH_AUTH_SOCK environment variable.
So using this with sudo might require the -E command line (or an appropriate
sudoers config) to preserve the environment.
 2013-05-07 14:08:51 +02:00
Tobias Brunner 4dc50bf9de charon-cmd: Use loose matching of gateway identity 2013-05-07 13:53:48 +02:00
Martin Willi c9a323c1d9 kernel-pfroute: allow only one thread to do a route look up simultaneously 
Otherwise we mess up the sequence number another thread is waiting for.
 2013-05-06 17:01:13 +02:00
Martin Willi 5c12700f9a kernel-interface: query SAD for last use time if SPD query didn't yield one 2013-05-06 17:01:13 +02:00
Martin Willi bdaf9f97e6 child-sa: query SAD/SPD just for what we actually need to update statistics 2013-05-06 17:01:13 +02:00
Martin Willi 470aad7e0c kernel-pfkey: be less verbose about unexpected sequence numbers 2013-05-06 17:01:13 +02:00
Martin Willi df919d50d0 kernel-pfkey: install exclude routes if kernel-net requires them 2013-05-06 17:01:13 +02:00
Martin Willi 580b768d03 kernel-pfroute: add a feature flag requesting "exclude" routes 
If routes installed along with policies covering the peer address affect local
IKE/ESP packets, they won't get routed correctly. To work around this issue,
the kernel interface can install "exclude" routes for the IKE peer. Not all
networking backends require this workaround, hence we export a flag for it
if it is required.
 2013-05-06 17:01:13 +02:00
Martin Willi bd520193a4 kernel-pfroute: remove unused interface address refcounting 2013-05-06 17:01:13 +02:00
Martin Willi 77b6f19694 kernel-pfroute: mark IPs installed on tun device as virtual 2013-05-06 17:00:55 +02:00
Martin Willi 2a2d7a4dc8 kernel-pfroute: install virtual IPs using dedicated tun devices 2013-05-06 16:10:13 +02:00
Martin Willi ca4a14ae83 kernel-pfkey: when installing a route for a virtual IP, use its interface 
When installing a route over a tun device for a virtual IP, the route must
be set over the tun, not the IKE interface.
 2013-05-06 16:10:13 +02:00
Martin Willi f52cf07532 kernel-interface: get_address_by_ts() can tell if a returned IP is virtual 2013-05-06 16:10:13 +02:00
Martin Willi 1a2a8bffed kernel-interface: support enumeration of virtual-only IPs 2013-05-06 16:10:13 +02:00
Martin Willi 5f7f8c92ca kernel-pfkey: refactor route installation to a dedicate function 2013-05-06 16:10:13 +02:00
Martin Willi 121783035c kernel-pfroute: split /0 routes to avoid conflict with default route 2013-05-06 16:10:13 +02:00
Martin Willi f8646dd65e kernel-pfkey: check if we have a gateway before comparing them 2013-05-06 16:10:13 +02:00
Martin Willi d4260c5f7f kernel-pfkey: install route along with input, not forward policies 
As forwarding policies are not available on all systems (OS X), using the
forward policy to attach the route is a bad pick. Using input policies allows
OS X to install routes.
 2013-05-06 16:10:13 +02:00
Martin Willi 6e879a59fc kernel-pfroute: rescan address list for an interface if its state changes 
It seems that we don't get address notifications if the interface is down
on OS X.
 2013-05-06 16:10:13 +02:00
Martin Willi 0fd409db77 kernel-pfroute: add newly appearing interfaces to the interface cache 2013-05-06 16:10:12 +02:00
Martin Willi 9bc342eae4 kernel-pfroute: implement get_nexthop() 2013-05-06 16:10:12 +02:00