denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
18,358 Commits 1 Branch 0 Tags
3fa3d2666a547580b40822f3eb7f2dfd6a5861a3
Commit Graph
63 Commits
Author SHA1 Message Date
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Andreas Steffen df6441a13f pki: Allow inclusion of [unsupported] critical X.509 extension 2019-05-08 14:56:48 +02:00
Tobias Brunner a0902d1ae0 x509: Fail CRL validity check if thisUpdate is in the future 2018-05-22 09:50:47 +02:00
Tobias Brunner 9ba01ce380 x509: Fix leak if a CRL contains multiple authorityKeyIdentifiers 2018-02-21 11:13:42 +01:00
Tobias Brunner bbfe39f597 x509: Add support for signature schemes with parameters 
Also adds support for specifying the hash algorithm for attribute
certificate signatures.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 024b979522 certificate: Return signature scheme and parameters from issued_by() method 
This also required some include restructuring (avoid including library.h
in headers) to avoid unresolvable circular dependencies.
 2017-11-08 16:48:10 +01:00
Tobias Brunner de280c2e03 private-key: Add optional parameters argument to sign() method 2017-11-08 16:48:10 +01:00
Tobias Brunner a413571f3b public-key: Add optional parameters argument to verify() method 2017-11-08 16:48:10 +01:00
Tobias Brunner 4e7b7db62f certificates: Use shared destructor for x509_cdp_t 2017-09-18 10:54:19 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Andreas Steffen b0dcf33f0f x509: Evaluate return codes of parsing functions 2017-05-08 16:44:25 +02:00
Tobias Brunner 6133770db4 x509: Use subjectKeyIdentifier provided by issuer cert when checking CRL issuer 
Some CAs don't use SHA-1 hashes of the public key as subjectKeyIdentifier and
authorityKeyIdentifier.  If that's the case we can't force the
calculation of the hash to compare that to authorityKeyIdentifier in the CRL,
instead we use the subjectKeyIdentifier stored in the issuer certificate, if
available.  Otherwise, we fall back to the SHA-1 hash (or comparing the
DNs) as before.
 2015-03-06 16:49:12 +01:00
Martin Willi b851f0a105 x509: Fix public key reference leak if authority key identifier does not match 2015-02-06 13:58:58 +01:00
Andreas Steffen b6bb32e658 Implemented full BLISS support for IKEv2 public key authentication and the pki tool 2014-11-29 14:51:18 +01:00
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Andreas Steffen 126778679f Recognize critical IssuingDistributionPoint CRL extension 2013-07-12 09:00:47 +02:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 10b116aa13 Properly initialize chunk for extension OID when parsing CRLs 2012-09-28 15:41:32 +02:00
Martin Willi a37f2d2006 certificate_t->issued_by takes an argument to receive signature scheme 2012-06-12 14:24:49 +02:00
Tobias Brunner e86b685da5 Allow callers to force ASN.1 date encoding as GENERALIZEDTIME. 2011-12-23 18:07:39 +01:00
Tobias Brunner 1267127c11 Properly ASN.1 encode dates in certificates depending on the year. 2011-12-23 16:29:41 +01:00
Tobias Brunner eb497205e3 Log most X.509 related messages in new ASN log group. 2011-12-16 16:44:38 +01:00
Andreas Steffen c4fd3b2f42 introduced libstrongswan.x509.enforce_critical parameter 2011-02-05 09:01:18 +01:00
Tobias Brunner 6f61b32e52 Properly initialize variable 'critical'. 2011-02-04 18:02:49 +01:00
Martin Willi 55e4d8982f Added support for delta CRLs to x509 plugin 2011-01-05 16:46:03 +01:00
Martin Willi 51b7e9ce72 Respect enforce_critical setting in x509 plugin CRLs 2011-01-05 16:46:03 +01:00
Martin Willi d14d3b31b8 Parse CRL extensions in a switch statement 2011-01-05 16:46:03 +01:00
Martin Willi 6ffd9f88ce Use subject, not issuer, of CRL issuing certificate 2011-01-05 16:45:56 +01:00
Martin Willi dffb176f2b CRLSign keyUsage or CA basicConstraint are sufficient for CRL validation 2011-01-05 16:45:56 +01:00
Martin Willi 0406eeaacb Support different encoding types in certificate.get_encoding() 2010-07-13 13:53:20 +02:00
Martin Willi da9724e6d0 Renamed key_encod{ing,der}_t and constants, prepare for generic credential encoding 2010-07-13 11:29:35 +02:00
Martin Willi 09f38ebe54 Use CAs subjectKeyIdentifier as CRLs authorityKeyIdentifier 2010-05-21 16:38:19 +02:00
Martin Willi 13c593f126 Added support for CRL generation to x509 plugin 2010-05-21 16:25:51 +02:00
Martin Willi aab861608a Removed is_newer() from certificate_t, obsoleting all implementations 2010-05-21 16:25:51 +02:00
Martin Willi 654218a31b Migrated x509_crl_t to INIT/METHOD macros 2010-05-21 16:25:51 +02:00
Tobias Brunner 8b0e09103b Adding DBG_LIB to all calls of libstrongswan's version of DBG*. 2010-04-06 12:47:40 +02:00
Andreas Steffen cf85e1319b streamlined output from get_validity() 2009-10-06 14:22:27 +02:00
Martin Willi d73f453c29 Updated x509 plugin to the new builder API 2009-09-10 16:20:21 +02:00
Martin Willi b9b8a98f47 remove spaces within tabs (\t( )+\t) 2009-09-04 15:00:19 +02:00
Martin Willi 7daf5226b7 removed trailing spaces ([[:space:]]+$) 2009-09-04 13:46:09 +02:00
Andreas Steffen f561d6f2e9 changed prefix of crl_reason_t values from CRL_ to CRL_REASON_ 2009-08-31 23:21:50 +02:00
Martin Willi 6b6ece636c updated x509 plugin to public key/x509 API changes 2009-08-26 11:23:52 +02:00
Martin Willi 280469923d make use of the pem helper plugin to load credentials 2009-08-26 11:23:49 +02:00
Andreas Steffen f3e87f5935 created signature_scheme_from_oid() helper function 2009-06-09 11:03:34 +02:00
Tobias Brunner 8c5d72cd0b removing svn keyword $Id$ from all files 2009-04-30 13:19:35 +00:00
Tobias Brunner d24a74c5b4 merging changes from portability branch back to trunk 
important change for developers: %Y replaces %D to print identities!
 2009-04-30 11:37:54 +00:00
Tobias Brunner d25ce3701e printf hooks refactored to increase portability (i.e. support for platforms without glibc-compatible customizable printf - the Vstr string library is currently required on such platforms). 2009-03-12 18:07:32 +00:00
Martin Willi e13389a7f7 got rid of deprecated create_iterator_locked() 2008-11-05 08:32:38 +00:00
Martin Willi f7c17aa15c refactored credential builder 
allow enumeration of matching builders
	try a second builder if the first one fails
	builder clones resources internally on demand
	caller frees added resources on failure and success
	stricter handling of non-supported build parts
 2008-09-02 11:00:13 +00:00