Tobias Brunner
8dc6e71632
lib: All settings use configured namespace
2014-02-12 14:34:32 +01:00
Martin Willi
4d7a762871
credmgr: introduce a hook function to catch trust chain validation errors
2013-07-18 16:00:30 +02:00
Martin Willi
5d36f04ee2
credmgr: stop querying for secrets once we get a perfect match
2013-07-18 12:17:54 +02:00
Martin Willi
69039e83f8
credmgr: don't use pointers for id_match_t enum values
2013-07-18 12:17:54 +02:00
Martin Willi
e82deaf6ce
Merge branch 'multi-cert'
...
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
2013-03-01 11:35:32 +01:00
Martin Willi
de399f550d
Add a cert_validator hook allowing plugins to provide custom lifetime checking
2013-02-19 14:31:18 +01:00
Martin Willi
790e00aaa9
Make cert_validator_t.validate optional to implement
2013-02-19 14:31:18 +01:00
Martin Willi
51dbcf6497
After merging the used trustchain with config, move used certificate to front
2013-01-18 11:59:27 +01:00
Martin Willi
9a06a93ce7
Try to build a trustchain for all configured certificates before enforcing one
...
This enables the daemon to select from multiple configured certificates
by building trustchains against the received certificate requests.
2013-01-18 09:33:15 +01:00
Tobias Brunner
f05b427265
Moved debug.[ch] to utils folder
2012-10-24 16:00:51 +02:00
Tobias Brunner
12642a6831
Moved data structures to new collections subfolder
2012-10-24 16:00:49 +02:00
Martin Willi
dfd34c5a77
Add an option to disable libstrongswan certificate caching
2012-07-09 19:03:10 +02:00
Martin Willi
fd4ff11858
Add signature schemes to auth_cfg during trustchain validation
2012-06-12 14:24:49 +02:00
Martin Willi
b1f2f05c92
Merge branch 'ikev1-clean' into ikev1-master
...
Conflicts:
configure.in
man/ipsec.conf.5.in
src/libcharon/daemon.c
src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
src/libcharon/plugins/eap_radius/eap_radius_accounting.c
src/libcharon/plugins/eap_radius/eap_radius_forward.c
src/libcharon/plugins/farp/farp_listener.c
src/libcharon/sa/ike_sa.c
src/libcharon/sa/keymat.c
src/libcharon/sa/task_manager.c
src/libcharon/sa/trap_manager.c
src/libstrongswan/plugins/x509/x509_cert.c
src/libstrongswan/utils.h
Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
2012-03-20 17:57:53 +01:00
Martin Willi
5aef6bd0f3
Accept NULL auth_cfg_t passed to credential_manager_t.get_private()
2012-03-20 17:31:39 +01:00
Martin Willi
747f837cce
Added a flag to register local credential sets exclusively, disabling all others
2012-03-20 17:31:28 +01:00
Martin Willi
45956d15ea
Free list after removing the last local credential set, fixes a leak report
2012-03-20 17:31:19 +01:00
Adrian-Ken Rueegsegger
2a375e62f3
Some documentation corrections
2012-01-12 11:25:12 +01:00
Martin Willi
a846bf06e8
Add missing AUTH_RULE for trusted self-signed peer certificates
2011-02-01 09:25:10 +01:00
Martin Willi
76cfaf13c1
Verify trustchain for each candidate certificate only once
2011-01-05 16:46:06 +01:00
Martin Willi
8469625fdc
Include subject cert to temporary auth info before completing trustchain
2011-01-05 16:46:04 +01:00
Martin Willi
6aba6ff061
Pass an additional anchor flag to validate() hook if we reach the root CA
2011-01-05 16:46:04 +01:00
Martin Willi
09e319d419
Always pass auth info to validate(), use pathlen to check for user certificate
2011-01-05 16:46:04 +01:00
Martin Willi
be8858e9b6
Moved X509 pathlen constraint checking to constraints plugin
2011-01-05 16:46:00 +01:00
Martin Willi
473d5aa868
Key strength checking stores all key sizes in auth_cfg, verifies all in complies()
2011-01-05 16:45:56 +01:00
Martin Willi
963b4d9477
Added key strength constraints for RSA or ECDSA trustchains
2011-01-05 16:45:53 +01:00
Martin Willi
e0fcf43cf8
Build a trustchain even if no trust anchor is given
2010-08-23 12:01:43 +02:00
Tobias Brunner
56bceda7b5
Fixed compiler warnings.
2010-08-03 19:00:46 +02:00
Martin Willi
da9724e6d0
Renamed key_encod{ing,der}_t and constants, prepare for generic credential encoding
2010-07-13 11:29:35 +02:00
Martin Willi
c2e5cee413
Moved CRL/OCSP checking to a dedicated plugin called revocation
2010-07-13 10:26:07 +02:00
Martin Willi
c1f9dad672
Made some useful methods in the credential manager public
2010-07-13 10:26:07 +02:00
Martin Willi
5f9e62c54f
Moved X509 addrBlock validation to a separate addrblock plugin
2010-07-13 10:26:07 +02:00
Martin Willi
2feb16f5dd
Added a certificate validation hook to the credential manager
2010-07-13 10:26:07 +02:00
Martin Willi
c3a9bef08e
Migrated credential manager to INIT/METHOD macros
2010-07-13 10:26:07 +02:00
Martin Willi
2ccc02a4fd
Moved credential manager to libstrongswan
2010-07-13 10:26:07 +02:00
Tobias Brunner