denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,707 Commits 1 Branch 0 Tags
5e2b740a009a29cd560f00199ecbeb25fa7a4b29
Commit Graph
88 Commits
Author SHA1 Message Date
Andreas Steffen 5e2b740a00 128 bit default security strength requires 3072 bit prime DH group 2015-12-14 10:39:40 +01:00
Martin Willi 13a5a906e9 gcrypt: Explicitly initialize RNG backend to allocate static data 
The libgcrypt RNG implementation uses static buffer allocation which it does
not free. There is no symbol we can catch in leak-detective, hence we explicitly
initialize the RNG during the whitelisted gcrypt_plugin_create() function.
 2015-04-15 14:38:42 +02:00
Martin Willi 41421b85a9 gcrypt: Support setting private value and testing of DH backend 2015-04-15 14:38:42 +02:00
Martin Willi 0356089d0f diffie-hellman: Verify public DH values in backends 2015-03-23 17:54:03 +01:00
Martin Willi a777155ffe diffie-hellman: Add a bool return value to set_other_public_value() 2015-03-23 17:54:03 +01:00
Martin Willi 42431690e0 diffie-hellman: Add a bool return value to get_my_public_value() 2015-03-23 17:54:03 +01:00
Martin Willi bace1d6479 diffie-hellman: Use bool instead of status_t as get_shared_secret() return value 
While such a change is not unproblematic, keeping status_t makes the API
inconsistent once we introduce return values for the public value operations.
 2015-03-23 17:54:02 +01:00
Tobias Brunner e13ef5c434 crypto: Define MODP_CUSTOM outside of IKE DH range 
Before this fix it was possible to crash charon with an IKE_SA_INIT
message containing a KE payload with DH group MODP_CUSTOM(1025).
Defining MODP_CUSTOM outside of the two byte IKE DH identifier range
prevents it from getting negotiated.

Fixes CVE-2014-9221.
 2014-12-23 15:40:01 +01:00
Martin Willi a336aefa89 curl: For SSL features, depend on thread-safety provided by our crypto plugins 
To use SSL in curl, we need to initialize the SSL library in a thread-safe
manner and provide the appropriate callbacks. As we already do that in our
crypto plugins using these libraries, we depend on these features.

This implies that we need the same plugin enabled (openssl, gcrypt) as the
curl backend is configured to use to fetch from HTTPS URIs.
 2014-09-24 17:35:16 +02:00
Martin Willi 6fb1283242 gcrypt: Use predefined pthread locking functions instead of custom hooks 
Starting with libgcrypt 1.6, it seems that custom locking functions are not
supported anymore. Instead, the user has to select from one of the pre-defined
set of locking functions.

Given that we have a proper threading abstraction API with optional profiling
on all platforms, this is somewhat annoying. However, there does not seem to be
a way to use custom functions, and we have no other choice than using the
provided macro magic to support all libgcrypt versions.

Fixes #630.
 2014-07-01 12:23:19 +02:00
Martin Willi 4163421f91 plugins: Don't link with -rdynamic on Windows 2014-06-04 15:53:02 +02:00
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Tobias Brunner e2c9a03d15 Remove HASH_PREFERRED, usages are replaced with HASH_SHA1, which is required for IKEv2 anyway 2013-10-11 15:13:25 +02:00
Martin Willi 19cb07b890 automake: replace INCLUDES by AM_CPPFLAGS 
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
 2013-07-18 14:59:19 +02:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Martin Willi e3b2e900e6 Add a return value to hasher_t.reset() 2012-07-16 14:55:06 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Martin Willi 8bd6a30af1 Add a return value to hasher_t.get_hash() 2012-07-16 14:55:06 +02:00
Martin Willi ce73fc19db Add a return value to crypter_t.set_key() 2012-07-16 14:53:38 +02:00
Martin Willi 3b96189a2a Add a return value to crypter_t.decrypt() 2012-07-16 14:53:38 +02:00
Martin Willi e35abbe588 Add a return value to crypter_t.encrypt 2012-07-16 14:53:37 +02:00
Tobias Brunner 1f5291b1ce Check rng return value when generating DH secret in gcrypt plugin 2012-07-16 14:53:36 +02:00
Tobias Brunner 39e807728e RNGs' get_bytes and allocate_bytes return boolean 2012-07-16 14:53:34 +02:00
Tobias Brunner 8122ae8cd8 gcrypt: Register SHA1 first as HASH_PREFERRED depends on it 2012-06-27 11:31:16 +02:00
Andreas Steffen 99246a4fc2 gcrypt does not support MD2 2011-11-09 06:48:55 +01:00
Tobias Brunner 7bc24c598f Add features support to gcrypt plugin. 2011-10-17 13:51:48 +02:00
Tobias Brunner f3bb1bd039 Fixed common misspellings. 
Mostly found by 'codespell'.
 2011-07-20 16:14:10 +02:00
Martin Willi 513701f41b Fix some warnings triggered by gcc 4.6 -Wunused-but-set-variable 2011-05-19 15:47:40 +02:00
Martin Willi c55818ebb0 Added a (not yet implemented) plugin_t method to reload plugin configuration 2011-04-15 10:07:13 +02:00
Martin Willi 787b5884aa Added a get_name() function to plugin_t, create_plugin_enumerator enumerates over plugin_t 2011-04-15 10:07:12 +02:00
Andreas Steffen 5932f41fcc trace back crypto algorithms to the plugins that registered them 2010-12-18 16:31:12 +01:00
Martin Willi d987946e80 Added a final flag to builder registration to enumerate the actually supported algorithms 2010-09-03 18:09:48 +02:00
Martin Willi ed60dfa14f Added support for MODP_CUSTOM to gcrypt plugin 2010-09-03 09:33:15 +02:00
Martin Willi ba31fe1fd6 Use a seperate section for each nested struct member in INIT macro 2010-08-18 12:15:03 +02:00
Martin Willi e2c3b4820b Variable key length crypters use default key length if zero given 2010-08-16 17:06:27 +02:00
Martin Willi 42cbe87fc7 Implemented AES/Camellia counter mode in gcrypt 2010-08-13 17:11:53 +02:00
Martin Willi f7c04c5b37 Add dedicated getter for the IV size to the crypter_t interface 2010-08-13 17:11:53 +02:00
Martin Willi a944d2092b Use bits instead of bytes for a private/public key 2010-08-10 18:46:30 +02:00
Martin Willi 33ddaaabec Added support for different encryption schemes to private/public keys 2010-08-10 18:46:30 +02:00
Martin Willi 646babd354 Migraded gcrypt plugin to INIT/METHOD macros 2010-08-10 18:46:30 +02:00
Martin Willi da9724e6d0 Renamed key_encod{ing,der}_t and constants, prepare for generic credential encoding 2010-07-13 11:29:35 +02:00
Martin Willi 42df8beeb6 Explicitly link gpg-error to gcrypt plugin 2010-05-17 12:36:30 +02:00
Martin Willi eadbc3da2f Fixed RSA key generation with gcrypt 2010-04-29 09:51:37 +02:00
Martin Willi 4590260b2d Added support for DH groups 22, 23 and 24, patch contributed by Joy Latten 2010-04-19 14:41:20 +02:00
Martin Willi b34b93dbf7 Store DH generator in a chunk, hide non-public data in a private struct 2010-04-08 15:08:35 +02:00
Tobias Brunner 8b0e09103b Adding DBG_LIB to all calls of libstrongswan's version of DBG*. 2010-04-06 12:47:40 +02:00
Tobias Brunner 908d571796 Provide the Diffie Hellman parameters from a central location, so that we do not have to replicate them in every plugin that implements the DH interface. 
The main reason for this change is that Android's libcrypto does not
include the get_rfcX_prime_Y functions by default.  Therefore we would
have had to replicate the primes a third time.
 2010-03-09 17:15:16 +01:00
Tobias Brunner afb364fff9 Reverting eba28948a5 which was only necessary when cross-compiling the plugins for Android 2.0. 
With the coming monolithic build using Android.mk files this won't be
necessary anymore.
 2010-03-02 12:03:44 +01:00
Tobias Brunner 4e657051f7 Streamlined the source file list formatting in plugin makefiles. 2010-03-02 10:40:50 +01:00
Tobias Brunner 6ec60bb92b Link all enabled libstrongswan plugins into the library, link all enabled charon plugins into libcharon. 2010-03-02 10:38:52 +01:00