Tobias Brunner
6133770db4
x509: Use subjectKeyIdentifier provided by issuer cert when checking CRL issuer
...
Some CAs don't use SHA-1 hashes of the public key as subjectKeyIdentifier and
authorityKeyIdentifier. If that's the case we can't force the
calculation of the hash to compare that to authorityKeyIdentifier in the CRL,
instead we use the subjectKeyIdentifier stored in the issuer certificate, if
available. Otherwise, we fall back to the SHA-1 hash (or comparing the
DNs) as before.
2015-03-06 16:49:12 +01:00
Martin Willi
b851f0a105
x509: Fix public key reference leak if authority key identifier does not match
2015-02-06 13:58:58 +01:00
Andreas Steffen
b6bb32e658
Implemented full BLISS support for IKEv2 public key authentication and the pki tool
2014-11-29 14:51:18 +01:00
Tobias Brunner
8dc6e71632
lib: All settings use configured namespace
2014-02-12 14:34:32 +01:00
Andreas Steffen
126778679f
Recognize critical IssuingDistributionPoint CRL extension
2013-07-12 09:00:47 +02:00
Tobias Brunner
f05b427265
Moved debug.[ch] to utils folder
2012-10-24 16:00:51 +02:00
Tobias Brunner
12642a6831
Moved data structures to new collections subfolder
2012-10-24 16:00:49 +02:00
Tobias Brunner
10b116aa13
Properly initialize chunk for extension OID when parsing CRLs
2012-09-28 15:41:32 +02:00
Martin Willi
a37f2d2006
certificate_t->issued_by takes an argument to receive signature scheme
2012-06-12 14:24:49 +02:00
Tobias Brunner
e86b685da5
Allow callers to force ASN.1 date encoding as GENERALIZEDTIME.
2011-12-23 18:07:39 +01:00
Tobias Brunner
1267127c11
Properly ASN.1 encode dates in certificates depending on the year.
2011-12-23 16:29:41 +01:00
Tobias Brunner
eb497205e3
Log most X.509 related messages in new ASN log group.
2011-12-16 16:44:38 +01:00
Andreas Steffen
c4fd3b2f42
introduced libstrongswan.x509.enforce_critical parameter
2011-02-05 09:01:18 +01:00
Tobias Brunner
6f61b32e52
Properly initialize variable 'critical'.
2011-02-04 18:02:49 +01:00
Martin Willi
55e4d8982f
Added support for delta CRLs to x509 plugin
2011-01-05 16:46:03 +01:00
Martin Willi
51b7e9ce72
Respect enforce_critical setting in x509 plugin CRLs
2011-01-05 16:46:03 +01:00
Martin Willi
d14d3b31b8
Parse CRL extensions in a switch statement
2011-01-05 16:46:03 +01:00
Martin Willi
6ffd9f88ce
Use subject, not issuer, of CRL issuing certificate
2011-01-05 16:45:56 +01:00
Martin Willi
dffb176f2b
CRLSign keyUsage or CA basicConstraint are sufficient for CRL validation
2011-01-05 16:45:56 +01:00
Martin Willi
0406eeaacb
Support different encoding types in certificate.get_encoding()
2010-07-13 13:53:20 +02:00
Martin Willi
da9724e6d0
Renamed key_encod{ing,der}_t and constants, prepare for generic credential encoding
2010-07-13 11:29:35 +02:00
Martin Willi
09f38ebe54
Use CAs subjectKeyIdentifier as CRLs authorityKeyIdentifier
2010-05-21 16:38:19 +02:00
Martin Willi
13c593f126
Added support for CRL generation to x509 plugin
2010-05-21 16:25:51 +02:00
Martin Willi
aab861608a
Removed is_newer() from certificate_t, obsoleting all implementations
2010-05-21 16:25:51 +02:00
Martin Willi
654218a31b
Migrated x509_crl_t to INIT/METHOD macros
2010-05-21 16:25:51 +02:00
Tobias Brunner
8b0e09103b
Adding DBG_LIB to all calls of libstrongswan's version of DBG*.
2010-04-06 12:47:40 +02:00
Andreas Steffen
cf85e1319b
streamlined output from get_validity()
2009-10-06 14:22:27 +02:00
Martin Willi
d73f453c29
Updated x509 plugin to the new builder API
2009-09-10 16:20:21 +02:00
Martin Willi
b9b8a98f47
remove spaces within tabs (\t( )+\t)
2009-09-04 15:00:19 +02:00
Martin Willi
7daf5226b7
removed trailing spaces ([[:space:]]+$)
2009-09-04 13:46:09 +02:00
Andreas Steffen
f561d6f2e9
changed prefix of crl_reason_t values from CRL_ to CRL_REASON_
2009-08-31 23:21:50 +02:00
Martin Willi
6b6ece636c
updated x509 plugin to public key/x509 API changes
2009-08-26 11:23:52 +02:00
Martin Willi
280469923d
make use of the pem helper plugin to load credentials
2009-08-26 11:23:49 +02:00
Andreas Steffen
f3e87f5935
created signature_scheme_from_oid() helper function
2009-06-09 11:03:34 +02:00
Tobias Brunner
8c5d72cd0b
removing svn keyword $Id$ from all files
2009-04-30 13:19:35 +00:00
Tobias Brunner
d24a74c5b4
merging changes from portability branch back to trunk
...
important change for developers: %Y replaces %D to print identities!
2009-04-30 11:37:54 +00:00
Tobias Brunner
d25ce3701e
printf hooks refactored to increase portability (i.e. support for platforms without glibc-compatible customizable printf - the Vstr string library is currently required on such platforms).
2009-03-12 18:07:32 +00:00
Martin Willi
e13389a7f7
got rid of deprecated create_iterator_locked()
2008-11-05 08:32:38 +00:00
Martin Willi
f7c17aa15c
refactored credential builder
...
allow enumeration of matching builders
try a second builder if the first one fails
builder clones resources internally on demand
caller frees added resources on failure and success
stricter handling of non-supported build parts
2008-09-02 11:00:13 +00:00
Andreas Steffen
0d12006def
support of ECDSA signatures for all certificate types
2008-06-22 17:41:07 +00:00
Andreas Steffen
460025e253
introduced ASN1_EXIT command in ASN.1 object syntax definition
2008-04-28 16:00:52 +00:00
Andreas Steffen
c3628ebc35
optimized parser->success()
2008-04-26 11:08:36 +00:00
Andreas Steffen
d3d7e46b8c
refactoring of the ASN.1 parser
2008-04-26 09:24:14 +00:00
Martin Willi
b5dbcc6270
compare certificates against full encoding to allow equality check of untrusted certs
2008-04-07 08:28:35 +00:00
Martin Willi
7b88a983d8
caching of ocsp responses (experimental), no crl caching yet
2008-03-26 15:21:50 +00:00
Andreas Steffen
5298777ad8
treat sig_alg and algorithm comparison in a consistent way over all certificate types
2008-03-26 13:10:36 +00:00
Martin Willi
a852928a6f
fixed compiler warnings
2008-03-26 09:29:30 +00:00
Andreas Steffen
26930a8c3e
certificate factory can load certs from file
2008-03-25 22:28:27 +00:00
Andreas Steffen
384ebaa57a
included utils/linked_list.h
2008-03-20 09:28:58 +00:00
Andreas Steffen
8d49b51f8b
made is_newer() a certificate_t method
2008-03-18 10:36:08 +00:00
Tobias Brunner