denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,155 Commits 1 Branch 0 Tags
5443762491890c3472bc1416fd57ad43f13a3b45
Commit Graph
1047 Commits
Author SHA1 Message Date
Andreas Steffen 5443762491 Use strongSwan hash plugins for SHA-1 and SHA-256 2013-11-27 20:21:41 +01:00
Andreas Steffen a7047cda59 Cleaned up ntru-crypto library 2013-11-27 20:21:41 +01:00
Andreas Steffen 98c6421674 Implemented NIST SP 800-90A DRBG_HMAC with SHA-256 2013-11-27 20:21:41 +01:00
Andreas Steffen 9013973cc8 unit-tests: Added ntru wrong ciphertext test 2013-11-27 20:21:41 +01:00
Andreas Steffen 885e699b58 unit-tests: Added ntru entropy, retransmission and ciphertext tests 2013-11-27 20:21:41 +01:00
Andreas Steffen 802eaf3789 Any of the four NTRU parameter sets can be selected 2013-11-27 20:21:41 +01:00
Andreas Steffen 1f73969eb5 Make the NTRU parameter set configurable 2013-11-27 20:21:41 +01:00
Andreas Steffen 2c620cb089 unit-tests: first NTRU test case 2013-11-27 20:21:40 +01:00
Andreas Steffen 146ad86be5 Prototype implementation of IKE key exchange via NTRU encryption 2013-11-27 20:21:40 +01:00
Tobias Brunner 3bff80aee3 openssl: Verify that a peer's ECDH public value is a point on the elliptic curve 
This check is mandated by RFC 6989.  Since we don't reuse DH secrets,
it is mostly a sanity check.
 2013-11-19 15:00:28 +01:00
Andreas Steffen b63246c5db Implemented libstrongswan.plugins.random.strong_equals_true option 2013-11-16 00:11:40 +01:00
Tobias Brunner 8d2450d8b8 plugin-loader: Convenience function added to add plugin dirs in build tree 2013-11-06 10:31:07 +01:00
Tobias Brunner 71c9565a3a pki: Replace BUILD_FROM_FD with passing a chunk via BUILD_BLOB 
This allows more than one builder to try parsing the data read from STDIN.
 2013-10-23 17:20:39 +02:00
Tobias Brunner 606aae3aa1 openssl: Add workaround if ECC Brainpool curves are not defined 2013-10-17 13:36:08 +02:00
Tobias Brunner 3c29d2822f openssl: Add support for ECC Brainpool curves for DH, if defined by OpenSSL 
OpenSSL does not include them in releases before 1.0.2.
 2013-10-17 13:36:08 +02:00
Tobias Brunner 0f6f7ba22c ccm: Add missing comma in get_iv_gen method signature 2013-10-11 17:42:25 +02:00
Tobias Brunner 50bd28d549 iv_gen: aead_t implementations provide an IV generator 2013-10-11 15:55:40 +02:00
Tobias Brunner 6ecf1aab35 unbound: Add support for DLV (DNSSEC Lookaside Validation) 
Fixes #392.
 2013-10-11 15:45:25 +02:00
Tobias Brunner b283a6e9ef database: Add support for serializable transactions 2013-10-11 15:29:10 +02:00
Tobias Brunner fad11d602d sqlite: Implement transaction handling 2013-10-11 15:16:05 +02:00
Tobias Brunner f3cb889c9b mysql: Implement transaction handling 2013-10-11 15:16:04 +02:00
Tobias Brunner 947b76cda8 database: Add interface to handle transactions 2013-10-11 15:16:04 +02:00
Tobias Brunner 5f6a40827e mysql: Ensure connections are properly released in multi-threaded environments 2013-10-11 15:16:04 +02:00
Tobias Brunner e2c9a03d15 Remove HASH_PREFERRED, usages are replaced with HASH_SHA1, which is required for IKEv2 anyway 2013-10-11 15:13:25 +02:00
Tobias Brunner c8f34ba7b6 openssl: Properly log FIPS mode when enabled via openssl.conf 
Enabling FIPS mode twice will fail, so if it is enabled in openssl.conf
it should be disabled in strongswan.conf (or the other way around).

Either way, we should log whether FIPS mode is enabled or not.

References #412.
 2013-09-27 09:24:03 +02:00
Tobias Brunner 075e80368b sshkey: Add support for parsing keys from files 2013-09-13 15:23:49 +02:00
Tobias Brunner b2a5317596 sshkey: Add encoding for ECDSA keys 2013-09-13 15:23:49 +02:00
Tobias Brunner d6b3cc87ca openssl: Add support for generic encoding of EC public keys 2013-09-13 15:23:49 +02:00
Tobias Brunner f40e9f4d16 sshkey: Add encoder for RSA keys 2013-09-13 15:23:49 +02:00
Tobias Brunner 3b939e20a9 openssl: Add generic RSA public key encoding 2013-09-13 15:23:49 +02:00
Tobias Brunner b5cc7053c8 openssl: Add helper function to convert BIGNUMs to chunks 2013-09-13 15:23:49 +02:00
Martin Willi 83a0b74da8 keychain: be less verbose when loading certificates 2013-07-31 11:41:16 +02:00
Tobias Brunner 8f1b44b40c keychain: Use AM_CPPFLAGS instead of INCLUDES 2013-07-19 09:01:39 +02:00
Martin Willi 4d7a762871 credmgr: introduce a hook function to catch trust chain validation errors 2013-07-18 16:00:30 +02:00
Martin Willi 19cb07b890 automake: replace INCLUDES by AM_CPPFLAGS 
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
 2013-07-18 14:59:19 +02:00
Martin Willi 2d5a20061a soup: omit deprecated g_type_init() when using >= GLIB 2.36 2013-07-18 14:20:57 +02:00
Martin Willi 55dacbfac2 keychain: flush certificate cache after reloading System keychain 2013-07-18 12:17:54 +02:00
Martin Willi 57dce77ba6 keychain: monitor changes in the system keychain, reload when necessary 2013-07-18 12:17:54 +02:00
Martin Willi dcd8bdde4f keychain: use SearchCopyNext keychain enumeration for System certs as well 
SecItemCopyMatching seems to be problematic regarding memory management. And
as there does not seem to be a good alternative to enumerate the System Roots
keychain using the SecItemCopyMatching API, we stick to the deprecated
enumeration functions for now.
 2013-07-18 12:17:54 +02:00
Martin Willi 0bdd453392 keychain: load certificates from System Roots Keychain 2013-07-18 12:17:54 +02:00
Martin Willi bc6c7bf39e keychain: load certificates only once during startup, improving performance 2013-07-18 12:17:54 +02:00
Martin Willi 6f00ddb90c keychain: support on-the-fly enumeration of trusted/untrusted certificates 2013-07-18 12:17:54 +02:00
Martin Willi 7b8edabd8a keychain: add a stub for a credential plugin using OS X Keychain Services 2013-07-18 12:17:54 +02:00
Martin Willi c3e7b3de0b openssl: parse X.509 extended key usage from extension parsing loop 
Otherwise parsing gets aborted if unknown critical extensions are handled as
error.
 2013-07-18 12:17:53 +02:00
Martin Willi 3f55f203ee openssl: show which critical X.509 extension is not supported 2013-07-18 12:17:53 +02:00
Tobias Brunner e0b868f79e pkcs12: Add plugin dependencies with soft dependencies on the most common algorithms 2013-07-15 10:48:19 +02:00
Andreas Steffen 126778679f Recognize critical IssuingDistributionPoint CRL extension 2013-07-12 09:00:47 +02:00
Tobias Brunner d27f225d9a Use strpfx() helper where appropriate 2013-07-08 18:49:30 +02:00
Martin Willi 324b90cc46 openssl: RAND_pseudo_bytes() returns 0 if bytes are not cryptographically strong 
For our purposes with RNG_WEAK this is fine, so accept a zero return value.
 2013-07-04 11:09:54 +02:00
Tobias Brunner b18a531715 plugin-loader: Removed unused path argument of load() method 
Multiple additional search paths can be added with the add_path()
method.
 2013-06-28 10:44:15 +02:00