denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
19,561 Commits 1 Branch 0 Tags
5cab5672e7288aeb3da81eec989e995cb20d4b08
Commit Graph
26 Commits
Author SHA1 Message Date
Tobias Brunner 135ed6aada openssl: Simplify wrapping private key objects 2025-08-21 16:11:13 +02:00
Gerardo Ravago 44e241fccc openssl: Handle BoringSSL-style ASN1_INTEGERs in cert serials 
OpenSSL stores the serial number for an X509 certificate as an
`ASN1_INTEGER` type. Within BoringSSL (and AWS-LC), the library
represents the value of zero as an empty array [1] which is different
from OpenSSL which represents it as the 1-byte array [0x00]. Though the
value of zero for the certificate serial number is illegal under
X.509 [2], we need to handle/encode it consistently within strongSwan.
From 18082ce2b0 ("certificates: Retrieve serial numbers in canonical
form"), we infer that the canonical representation of the zero serial
is [0x00]. To do this, we introduce `openssl_asn1_int2chunk` to
complement the existing string version that allows us to handle the
special case for zero instead of always returning a reference to the
library-dependent encodings.

References strongswan/strongswan#1907
Closes strongswan/strongswan#2138

[1] https://github.com/google/boringssl/commit/bdc35b63617f78037768f4897d8835696f02181a
[2] https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.2
 2024-03-05 08:51:16 +01:00
Tobias Brunner 14bd0bc743 Fixed some typos, courtesy of codespell 2023-11-14 10:11:16 +01:00
Tobias Brunner c58ba0cb9f openssl: Remove unused openssl_hash_chunk() helper 
Was used by the ECDSA implementation before 293a912c7d ("openssl: Fixes
for ECDSA with OpenSSL 3.0").
 2022-10-05 18:15:26 +02:00
Tobias Brunner 19ef2aec15 Update copyright headers after acquisition by secunet 2022-06-28 10:22:56 +02:00
Tobias Brunner 293a912c7d openssl: Fixes for ECDSA with OpenSSL 3.0 2022-04-14 19:05:44 +02:00
Tobias Brunner 57e68ab9c5 openssl: Improve compatibility to newer BoringSSL releases 
Closes strongswan/strongswan#352
 2021-08-24 14:20:37 +02:00
Tobias Brunner 781ad0b93b openssl: Allocate our own buffer for i2d_* wrapper macro 
If we pass a pointer to NULL, the memory allocated by OpenSSL has to be
freed with OPENSSL_free().  Otherwise, this can lead to random
crashes/freezes for Windows builds as seen on AppVeyor.  To not
complicate things for callers of this macro, we allocate our own memory,
which we already do for other i2d_* calls.
 2021-02-11 16:40:58 +01:00
Tobias Brunner 5fdc979770 openssl: Extract helper function to derive a shared DH secret 2021-01-20 17:53:35 +01:00
Josh Soref b3ab7a48cc Spelling fixes 
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior

Closes strongswan/strongswan#164.
 2020-02-11 18:23:07 +01:00
Thomas Egerer cf18951efd openssl: Make some additional arguments const 
Related to openssl 1.1.x changes.

Signed-off-by: Thomas Egerer <[email protected]>
 2019-12-11 13:09:04 +01:00
Tobias Brunner 8b4c2a1d8e openssl: Fix some const issues with OpenSSL 1.1.0 2018-10-31 15:50:36 +01:00
Tobias Brunner 1b67166921 Unify format of HSR copyright statements 2018-05-23 16:32:53 +02:00
Tobias Brunner 4a6f97d00b openssl: Add a generic private key loader 2016-10-05 11:32:52 +02:00
Tobias Brunner 375a5ed240 openssl: Make some utilities take const BIGNUM pointers 2016-06-29 11:09:37 +02:00
Tobias Brunner 6d5df086f7 openssl: Add macro to define fallback functions for non-opaque OpenSSL versions 2016-06-29 11:09:37 +02:00
Martin Willi 4f310a2e75 openssl: Undef OpenSSLs X509_NAME defined by <wincrypt.h> 2014-06-04 15:53:02 +02:00
Tobias Brunner b5cc7053c8 openssl: Add helper function to convert BIGNUMs to chunks 2013-09-13 15:23:49 +02:00
Tobias Brunner 83b23011de Some Doxygen fixes. 2010-07-05 15:04:30 +02:00
Martin Willi 5728c6aa7e Implemented X.509 certificate reading using OpenSSL 2010-05-21 16:25:51 +02:00
Martin Willi 7daf5226b7 removed trailing spaces ([[:space:]]+$) 2009-09-04 13:46:09 +02:00
Martin Willi b12c6d163d do openssl fingerprinting/encoding directly, openssl provides all functions 2009-08-27 09:58:38 +02:00
Martin Willi e35c3e2a03 updated openssl plugin to new private/public key API, use encoder framework 2009-08-26 11:23:52 +02:00
Tobias Brunner 8c5d72cd0b removing svn keyword $Id$ from all files 2009-04-30 13:19:35 +00:00
Martin Willi 1490ff4d9b updated Doxyfile 
properly close all doxygen groups
fixed remaining doxygen warnings
 2009-03-24 17:43:01 +00:00
Tobias Brunner ea0823dffd ECDSA with OpenSSL 2008-06-10 09:08:27 +00:00