denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
6,432 Commits 1 Branch 0 Tags
58be32e88e605ef5374244dceb249689a3547ea6
Commit Graph
4629 Commits
Author SHA1 Message Date
Martin Willi 58be32e88e Added a cert_policy option to conftest configurations 2011-01-05 16:46:03 +01:00
Martin Willi 5595d2bcff Validate simple certificatePolicy inheritance 2011-01-05 16:46:03 +01:00
Martin Willi 77a288e960 Added a certificate policy OID auth_cfg constraint 2011-01-05 16:46:03 +01:00
Martin Willi a864eb37b1 Added policyConstraints support to pki tool 2011-01-05 16:46:02 +01:00
Martin Willi a742d97fb8 Added support for policyConstraints to x509 plugin 2011-01-05 16:46:02 +01:00
Martin Willi 5dba5852fc Slightly renamed X509_NO_PATH_LEN_CONSTRAINT to use it for PolicyConstraints, too 2011-01-05 16:46:02 +01:00
Martin Willi 3ffc9d9a88 Added policyMappings support to pki tool 2011-01-05 16:46:02 +01:00
Martin Willi 5a0caa4b3a Added policyMappings support to x509 plugin 2011-01-05 16:46:02 +01:00
Martin Willi 5122fa1e02 Added policyMappings OID identifier 2011-01-05 16:46:02 +01:00
Martin Willi 6c3ac04478 Added certificatePolicy options to pki tool 2011-01-05 16:46:02 +01:00
Martin Willi 20bd78106e Added certificatePolicy support to x509 plugin 2011-01-05 16:46:02 +01:00
Martin Willi 1038d9fee5 Added a null-safe strdup variant 2011-01-05 16:46:02 +01:00
Martin Willi b0892d094c Fail when parsing unsupported critical extensions in openssl_x509 2011-01-05 16:46:02 +01:00
Martin Willi 2d3ae93832 Added CertificatePolicy OID identifier 2011-01-05 16:46:02 +01:00
Martin Willi feac4a8162 Added conversion functions between string OIDs and its DER encoding 2011-01-05 16:46:02 +01:00
Martin Willi a6850b8499 Do not parse certificates with invalid version in openssl plugin 2011-01-05 16:46:01 +01:00
Martin Willi a2b340764f Implemented NameConstraint matching in constraints plugin 2011-01-05 16:46:00 +01:00
Martin Willi e6fbe5933b pki --issue/self support permitted/excluded NameConstraints 2011-01-05 16:46:00 +01:00
Martin Willi 64bcaae203 pki --print prints NameConstraints 2011-01-05 16:46:00 +01:00
Martin Willi 7eeb37dea9 Added support for generating NameConstraints in x509 plugin 2011-01-05 16:46:00 +01:00
Martin Willi 7c325cee5c Added support for parsing NameConstraints in x509 plugin 2011-01-05 16:46:00 +01:00
Martin Willi dbfbbec368 Added name constraint enumerator to x509 interface 2011-01-05 16:46:00 +01:00
Martin Willi a199ef15e6 Migrated x509_cert_t to INIT/METHOD macros 2011-01-05 16:46:00 +01:00
Martin Willi be8858e9b6 Moved X509 pathlen constraint checking to constraints plugin 2011-01-05 16:46:00 +01:00
Martin Willi 01d3038137 Added plugin stub for advanced X509 constraint checking 2011-01-05 16:46:00 +01:00
Martin Willi 0beb1d6fbb Added a hook to reset ESP sequence numbers 2011-01-05 16:46:00 +01:00
Martin Willi 48ef001133 Accept a suffix to differentiate x509, crl, ecdsa and rsa files 2011-01-05 16:45:59 +01:00
Martin Willi c7f7a0ba06 Use strncaseeq instead of strncasecmp 2011-01-05 16:45:59 +01:00
Martin Willi 7a3e0a6321 Added a strncaseeq variant to the string comparison macros 2011-01-05 16:45:59 +01:00
Martin Willi 04a1279f91 Added tfc_padding option, changes signature to master changes 2011-01-05 16:45:59 +01:00
Martin Willi 6840a6fb98 CRL/OCSP validation stores trustchain information in auth_cfg 2011-01-05 16:45:56 +01:00
Martin Willi 473d5aa868 Key strength checking stores all key sizes in auth_cfg, verifies all in complies() 2011-01-05 16:45:56 +01:00
Martin Willi 37b3fad782 Install "ipsec" script with tools or conftest 2011-01-05 16:45:56 +01:00
Martin Willi 6ffd9f88ce Use subject, not issuer, of CRL issuing certificate 2011-01-05 16:45:56 +01:00
Martin Willi dffb176f2b CRLSign keyUsage or CA basicConstraint are sufficient for CRL validation 2011-01-05 16:45:56 +01:00
Martin Willi ece5ac2271 Parse and encode crlSign keyUsage flag in x509 plugin 2011-01-05 16:45:56 +01:00
Martin Willi bb0cda2fa9 pki tool shows and builds crlSign keyUsage 2011-01-05 16:45:56 +01:00
Martin Willi 6807c0ca2c Added a flag for X509 CRLSign keyUsage 2011-01-05 16:45:56 +01:00
Martin Willi e49bd37b5d Remove x509_flag_names, flags do not work with ENUM() 2011-01-05 16:45:56 +01:00
Martin Willi 7d7beaa1fa Use certificate CRLIssuer information to look up cacched CRLs or CDPs 2011-01-05 16:45:56 +01:00
Martin Willi 630d58724a Added --crlissuer option to pki --issue 2011-01-05 16:45:56 +01:00
Martin Willi 4e508517d7 Added support for CRL Issuers to x509 and OpenSSL plugins 2011-01-05 16:45:55 +01:00
Martin Willi 9992cb1c10 Generate payload to rebuild_auth, works with injected unknown payloads 2011-01-05 16:45:55 +01:00
Martin Willi 5c95bf7b93 Move rebuild_auth functionality to a standalone hook 
This reverts commit 3c12b239fd55aa36c59eb60224d27af8b8d915d1.
 2011-01-05 16:45:54 +01:00
Martin Willi a73e040cd5 Added key strength constraints support to conftest 2011-01-05 16:45:53 +01:00
Martin Willi 963b4d9477 Added key strength constraints for RSA or ECDSA trustchains 2011-01-05 16:45:53 +01:00
Martin Willi 586070d2ce Implemented hook to log traffic selectors 2011-01-05 16:45:53 +01:00
Martin Willi 6bd3a1c220 The set_reserved() hook rebuilds AUTH if it mangles ID payload fields 2011-01-05 16:45:53 +01:00
Martin Willi 5f15faebc8 Include the used reserved bytes from ID payloads in AUTH calculation 2011-01-05 16:45:53 +01:00
Martin Willi 502edf425f Migrated psk/pubkey_authenticators to INIT/METHOD macros 2011-01-05 16:45:53 +01:00