denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19,540 Commits 1 Branch 0 Tags
4c85b9d21b68ef3fbe2e17278f0cd9f18f9e432e
Commit Graph
398 Commits
Author SHA1 Message Date
Thomas Egerer c8a0781334 ikev2: Diversify signature scheme rule 
This allows for different signature schemes for IKE authentication and
trustchain verification.

Signed-off-by: Thomas Egerer <[email protected]>
 2016-03-04 16:19:53 +01:00
Andreas Steffen cc874350b8 Apply pubkey and signature constraints in vici plugin 2015-12-17 17:49:48 +01:00
Andreas Steffen 02d431022c Refactored certificate management for the vici and stroke interfaces 2015-12-12 00:19:24 +01:00
Andreas Steffen 9dd8bfb2ce Changed some certificate_type_names and added x509_flag_names 2015-12-11 18:26:55 +01:00
Andreas Steffen fd90f0613c Print OCSP single responses 2015-12-11 18:26:53 +01:00
Andreas Steffen 3317d0e77b Standardized printing of certificate information 
The certificate_printer class allows the printing of certificate
information to a text file (usually stdout). This class is used
by the pki --print and swanctl --list-certs commands as well as
by the stroke plugin.
 2015-12-11 18:26:53 +01:00
Tobias Brunner 310a099be4 auth-cfg: Prefer merged rules over existing ones when moving them 
This is particularly important for single valued rules (e.g.
identities).  When copying values this is already handled correctly
by the enumerator and add().
 2015-11-12 14:21:06 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Andreas Steffen f6fede934b Support BLISS signatures with SHA-3 hash 2015-11-03 21:35:09 +01:00
Tobias Brunner fdb90723b7 auth-cfg: Don't enforce EAP_RADIUS 
Basically the same as e79b0e07e4.  EAP_RADIUS is also a virtual method
that will identify itself as a different EAP method later.
 2015-08-21 11:40:07 +02:00
Tobias Brunner 58db4edb2c mem-cred: We don't need a write lock when looking for a certificate 2015-08-20 19:19:37 +02:00
Tobias Brunner 522b1920b6 mem-cred: Add a method to atomically replace all certificates 2015-08-20 19:19:12 +02:00
Tobias Brunner e79b0e07e4 auth-cfg: Don't enforce EAP_DYNAMIC 
We now store the actual method on the auth config, which won't match
anymore if rightauth=eap-dynamic is configured.
 2015-08-20 18:38:16 +02:00
Tobias Brunner 774c8c3847 auth-cfg: Matching one CA should be enough, similar to peer certificates 
Not sure if defining multiple CA constraints and enforcing _all_ of them,
i.e. the previous behavior, makes even sense.  To ensure a very specific
chain it should be enough to define the last intermediate CA.  On the
other hand, the ability to define multiple CAs could simplify configuration.

This can currently only be used with swanctl/VICI based configs as `rightca`
only takes a single DN.
 2015-08-17 14:04:19 +02:00
Tobias Brunner f809e485fb Fixed some typos 2015-08-13 15:12:34 +02:00
Tobias Brunner 83dcb2d46d credential-manager: Store BLISS key strength in auth config 2015-03-04 13:54:11 +01:00
Tobias Brunner ddb09a0603 auth-cfg: Add BLISS key strength constraint 2015-03-04 13:54:11 +01:00
Tobias Brunner 1f648d756b public-key: Add helper to determine acceptable signature schemes for keys 2015-03-04 13:54:10 +01:00
Tobias Brunner 353294ea5c public-key: Add helper to map signature schemes to ASN.1 OIDs 
There is a similar function to map key_type_t and hasher_t to an OID,
but this maps schemes directly (and to use the other function we'd
have to have a function to map schemes to hash algorithms first).
 2015-03-04 13:54:08 +01:00
Tobias Brunner 0f29f5ed02 public-key: Add helper to determine key type from signature scheme 2015-03-04 13:54:08 +01:00
Martin Willi ef2c61bc92 mem-cred: Add a method to unify certificate references, without adding it 
In contrast to add_cert_ref(), get_cert_ref() does not add the certificate to
the set, but only finds a reference to the same certificate, if found.
 2015-03-03 13:50:26 +01:00
Andreas Steffen 27bd0fed93 Allow SHA256 and SHA384 data hash for BLISS signatures. 
The default is SHA512 since this hash function is also
used for the c_indices random oracle.
 2015-02-26 08:56:12 +01:00
Andreas Steffen f673966b9f Started implementing BLISS signature generation 2014-11-29 14:51:16 +01:00
Andreas Steffen 56009f2001 Store and parse BLISS private and public keys in DER and PEM format 
Additionally generate SHA-1 fingerprints of raw BLISS subjectPublicKey
and subjectPublicKeyInfo objects.

Some basic functions used by the bliss_public_key class are shared
with the bliss_private_key class.
 2014-11-29 14:51:16 +01:00
Andreas Steffen 9d5b91d198 Created framework for BLISS post-quantum signature algorithm 2014-11-29 14:51:14 +01:00
Tobias Brunner a9f87d118e cert-cache: Prevent that a cached issuer is freed too early 
Previously we got no reference to the cached issuer certificate
before releasing the lock of the cache line, this allowed other
threads, or even the same thread if it replaces a cache line, to
destroy that issuer certificate in cache() (or flush()) before
get_ref() for the issuer certificate is finally called.
 2014-10-24 11:23:04 +02:00
Tobias Brunner 8ca9a67fac auth-cfg: Fix crash after several reauthentications with multiple authentication rounds 
Due to the issue described in c641974, purge() inadvertently destroyed
CA certificates that should have been kept (while the pointer to these
objects remained in the array).  This lead to incorrect reference counts
and after a few reauthentications with multiple authentication rounds,
which cause calls to purge(TRUE), to crashes.
 2014-09-11 17:52:37 +02:00
Thomas Egerer 8d80528a60 credmgr: Fix copy and paste error in add_validator 
This won't hurt as long as sets and validators are of the same class.
But as soon as one of the object's class is changed this will cause
either a compile error (best option), or result (most likely) in a
crash.

Signed-off-by: Thomas Egerer <[email protected]>
 2014-08-29 13:22:23 +02:00
Martin Willi 266ee0a190 windows: Provide a sched_yield() implementation 2014-06-04 15:53:01 +02:00
Martin Willi 40a924090e crl: Undefine <wincrypt.h>'s CRL_REASON_* and use our enum values instead 2014-06-03 12:24:34 +02:00
Martin Willi e163427d9f auth-cfg: Cast literal default value to pointer type 
Fixes a clang warning.
 2014-05-16 15:42:07 +02:00
Martin Willi d4368689a0 mem-cred: Replace existing equal shared keys during add_shared() 2014-05-07 14:13:34 +02:00
Martin Willi f8223f5f7e mem-cred: Replace existing equal private keys during add_key() 2014-05-07 14:13:34 +02:00
Andreas Steffen a81bd670b0 Added PUBKEY_RSA_MODULUS encoding type 2014-05-02 19:50:43 +02:00
Andreas Steffen 98ae0492b6 Added support for msSmartcardLogon EKU 2014-04-08 13:09:03 +02:00
Tobias Brunner 3b09c02ec0 Properly hash pointers for hash tables where appropriate 
Simply using the pointer is not optimal for our hash table
implementation, which simply masks the key to determine the bucket.
 2014-03-31 14:32:44 +02:00
Martin Willi 83f8cdde46 auth-cfg: Declare an attribute certificate helper type to exchange acerts 2014-03-31 11:14:58 +02:00
Martin Willi 8f9e2dbcd5 x509: Replace the comma separated string AC group builder with a list based one 2014-03-31 11:14:58 +02:00
Martin Willi a17598bc69 x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t 
The ietf_attributes_t class is used for attribute certificates only these days,
and integrating them to x509_ac_t simplifies things significantly.
 2014-03-31 11:14:58 +02:00
Martin Willi 61b2d815b9 x509: Replace fixed acert group string getter by a more dynamic group enumerator 2014-03-31 11:14:58 +02:00
Martin Willi 883a63adc1 ac: Remove unimplemented equals_holder() method from ac_t 2014-03-31 11:14:57 +02:00
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Tobias Brunner 71c9565a3a pki: Replace BUILD_FROM_FD with passing a chunk via BUILD_BLOB 
This allows more than one builder to try parsing the data read from STDIN.
 2013-10-23 17:20:39 +02:00
Tobias Brunner f40e9f4d16 sshkey: Add encoder for RSA keys 2013-09-13 15:23:49 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi 4d7a762871 credmgr: introduce a hook function to catch trust chain validation errors 2013-07-18 16:00:30 +02:00
Martin Willi 5d36f04ee2 credmgr: stop querying for secrets once we get a perfect match 2013-07-18 12:17:54 +02:00
Martin Willi 69039e83f8 credmgr: don't use pointers for id_match_t enum values 2013-07-18 12:17:54 +02:00
Martin Willi 926776ec80 auth-cfg: use array instead of linked list 
Saves another 4 linked lists (1KB) per IKE_SA
 2013-07-17 17:20:18 +02:00
Tobias Brunner abc04e6b3f Remove pluto specific certificate types 2013-05-08 15:02:40 +02:00