denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,442 Commits 1 Branch 0 Tags
5dd638f45c374eb69b4d644e9de28cb3d34d1e42
Commit Graph
257 Commits
Author SHA1 Message Date
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Tobias Brunner 71c9565a3a pki: Replace BUILD_FROM_FD with passing a chunk via BUILD_BLOB 
This allows more than one builder to try parsing the data read from STDIN.
 2013-10-23 17:20:39 +02:00
Tobias Brunner f40e9f4d16 sshkey: Add encoder for RSA keys 2013-09-13 15:23:49 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi 4d7a762871 credmgr: introduce a hook function to catch trust chain validation errors 2013-07-18 16:00:30 +02:00
Martin Willi 5d36f04ee2 credmgr: stop querying for secrets once we get a perfect match 2013-07-18 12:17:54 +02:00
Martin Willi 69039e83f8 credmgr: don't use pointers for id_match_t enum values 2013-07-18 12:17:54 +02:00
Martin Willi 926776ec80 auth-cfg: use array instead of linked list 
Saves another 4 linked lists (1KB) per IKE_SA
 2013-07-17 17:20:18 +02:00
Tobias Brunner abc04e6b3f Remove pluto specific certificate types 2013-05-08 15:02:40 +02:00
Tobias Brunner feef637368 Add pkcs12 plugin which adds support for decoding PKCS#12 containers 2013-05-08 15:02:39 +02:00
Tobias Brunner 8e48e0009a Add support for PKCS#7/CMS encrypted-data 2013-05-08 15:02:39 +02:00
Tobias Brunner d41e54c68d Move PKCS#12 key derivation to a separate file 2013-05-08 15:02:39 +02:00
Tobias Brunner cc4408abcb sshkey: Added builder for SSHKEY RSA keys 2013-05-07 15:38:28 +02:00
Tobias Brunner d307be7f6c Add a method to replace all secrets in a mem_cred_t object 2013-03-20 15:27:34 +01:00
Martin Willi e82deaf6ce Merge branch 'multi-cert' 
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
 2013-03-01 11:35:32 +01:00
Martin Willi adf239abca Merge branch 'systime' 
Add a systime-fix plugin allowing an embedded system to validate certificates
if the system time has not been synchronized after boot. Certificates of
established tunnels can be re-validated after the system time gets valid.
 2013-03-01 11:33:47 +01:00
Tobias Brunner 8656f35ae1 Fix auth_cfg_t.clone() for single-valued auth rules 
By using the default list enumerator and adding the rules with the public
add() method, clones of auth_cfg_t objects would return the values for
single-valued auth rules in the wrong order (i.e. the oldest instead of the
newest value was returned).  Using the internal enumerator (which the comment
already suggested) fixes this, but the clone will not be a full clone as
it does not contain any old values for single-valued auth rules.  Since
these will never be used anyway, this should be fine.
 2013-02-28 18:11:38 +01:00
Martin Willi de399f550d Add a cert_validator hook allowing plugins to provide custom lifetime checking 2013-02-19 14:31:18 +01:00
Martin Willi 790e00aaa9 Make cert_validator_t.validate optional to implement 2013-02-19 14:31:18 +01:00
Andreas Steffen a4ddc0bb26 Encode RSA public keys in RFC 3110 DNSKEY format 2013-02-19 12:25:00 +01:00
Martin Willi 51dbcf6497 After merging the used trustchain with config, move used certificate to front 2013-01-18 11:59:27 +01:00
Martin Willi 9a06a93ce7 Try to build a trustchain for all configured certificates before enforcing one 
This enables the daemon to select from multiple configured certificates
by building trustchains against the received certificate requests.
 2013-01-18 09:33:15 +01:00
Martin Willi f29783af8c Make AUTH_RULE_SUBJECT cert multi-valued 
Constraints having multiple subject certs defined are fulfilled if
authentication used one of the listed certificates.
 2013-01-18 09:33:15 +01:00
Martin Willi e96d945dcd Fix doxygen grouping regarding containers and PKCS#7 2012-12-19 10:32:08 +01:00
Martin Willi 063ae4e52a Allocate data returned by pkcs7_t.get_attribute() 2012-12-19 10:32:08 +01:00
Martin Willi 8ccf5a4731 Fix enum names for container_type_t 2012-12-19 10:32:08 +01:00
Martin Willi 9e967d7dda Add an enumerator for PKCS#7 contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi d3d706f4fc Add a getter for signed PKCS#7 attributes 2012-12-19 10:32:08 +01:00
Martin Willi 637a8abb72 Add builder parts to generate PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi fc67a932ba Add a generic interface for crypto containers and a more specific PKCS#7 interface 2012-12-19 10:32:07 +01:00
Andreas Steffen 48b23d06a8 allow the optional sharing if RSA private keys 2012-11-22 00:34:42 +01:00
Andreas Steffen 168ee460c6 implemented generation of safe primes 2012-11-18 19:22:31 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 35e2afd459 Fix equality comparison of auth_cfg_t 
We previously only confirmed that rules contained in the first config are also
contained in the second, but since the number of rules does not have to
be equal, it might be that the second config contains rules that the
first one doesn't.
 2012-09-18 14:40:41 +02:00
Tobias Brunner 3a8852c76f Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator 
If it is set on an auth config IDr will not be sent, and later the configured
identity will not only be checked against the returned IDr, but also
against other identities contained in the responder's certificate.
 2012-09-18 11:16:10 +02:00
Tobias Brunner 36a3981d47 Comment fixed 2012-08-13 13:17:53 +02:00
Martin Willi 6a8786b55f Show which group would be required when failing in constraint check 2012-07-26 12:39:53 +02:00
Martin Willi dfd34c5a77 Add an option to disable libstrongswan certificate caching 2012-07-09 19:03:10 +02:00
Martin Willi 918e92c4c9 Support multiple different public key strength types in constraints 2012-06-12 14:24:49 +02:00
Martin Willi fd4ff11858 Add signature schemes to auth_cfg during trustchain validation 2012-06-12 14:24:49 +02:00
Martin Willi a37f2d2006 certificate_t->issued_by takes an argument to receive signature scheme 2012-06-12 14:24:49 +02:00
Martin Willi 439d0742e9 Define auth_cfg rules for signature schemes 2012-06-12 14:24:49 +02:00
Martin Willi b24be29646 Merge branch 'ikev1' 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/encoding/generator.c
	src/libcharon/encoding/payloads/notify_payload.c
	src/libcharon/encoding/payloads/notify_payload.h
	src/libcharon/encoding/payloads/payload.c
	src/libcharon/network/receiver.c
	src/libcharon/sa/authenticator.c
	src/libcharon/sa/authenticator.h
	src/libcharon/sa/ikev2/tasks/ike_init.c
	src/libcharon/sa/task_manager.c
	src/libstrongswan/credentials/auth_cfg.c
 2012-05-02 11:12:31 +02:00
Tobias Brunner 7e84c4275c Removed auth_cfg_t.replace_value() and replaced usages with add(). 
replace_value() was used to replace identities. Since for these the latest is
now returned by get(), adding the new identity with add() is sufficient.
 2012-04-18 18:50:14 +02:00
Tobias Brunner ebc1ffe451 Changed the order and semantics of rules we expect only once in auth_cfg_t. 
These rules are now inserted at the front of the internal list, this
allows to retrieve the rule added last with get(). For other rules the
order in which they are added is maintained (this allows to properly
enumerate them).
 2012-04-18 18:50:14 +02:00
Tobias Brunner 68cca941cf Added a simple method to replace the value of a rule in auth_cfg_t. 2012-04-16 13:44:27 +02:00
Martin Willi b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
 2012-03-20 17:57:53 +01:00
Martin Willi 5aef6bd0f3 Accept NULL auth_cfg_t passed to credential_manager_t.get_private() 2012-03-20 17:31:39 +01:00
Martin Willi 3d86d76b86 Fixed create_shared_enumerator method description 2012-03-20 17:31:31 +01:00