Tobias Brunner
06e5462a4b
credential-factory: Enforce an upper limit when creating nested credentials
...
This mainly intended as defense-in-depth measure to avoid parsing
massively nested structures that could cause a call stack overflow due
to the massive recursion. In particular PKCS#7 signed data is prone to
this as these can be nested basically infinitely. When used in IKEv1 via
ENC_PKCS7_WRAPPED_X509 CERT payloads, our default of 10000 bytes for IKE
messages guards against this, but that's configurable and there might be
a chance for some bug that triggers problematic recursive parsing for
smaller input.
The upper limit is chosen arbitrarily, but there are currently no known
cases that require a depth of more than 10 levels.
2026-04-02 08:16:07 +02:00
Tobias Brunner
4c85b9d21b
credential-factory: Avoid deadlock during unit tests
...
If a unit test times out while generating a private key (e.g. because of
a lack of entropy), this avoids a deadlock by still releasing the read
lock that'd prevent acquiring the write lock when plugins are unloaded.
Closes strongswan/strongswan#2850
2025-08-21 16:13:24 +02:00
Tobias Brunner
4cf0a5b631
credential-factory: Fix build with DEBUG_LEVEL < 1
...
Newer versions of clang complain here.
2025-01-10 18:53:57 +01:00
Tobias Brunner
b39105b5b4
credential-factory: Fix build with DEBUG_LEVEL < 1
2023-05-08 14:06:43 +02:00
Tobias Brunner
19ef2aec15
Update copyright headers after acquisition by secunet
2022-06-28 10:22:56 +02:00
Andreas Steffen
e0044e5f48
credential_factory: Store name of plugin registering a builder
2021-06-01 21:12:46 +02:00
Tobias Brunner
1b67166921
Unify format of HSR copyright statements
2018-05-23 16:32:53 +02:00
Tobias Brunner
525cc46cab
Change interface for enumerator_create_filter() callback
...
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
2017-05-26 13:56:44 +02:00
Martin Willi
fc67a932ba
Add a generic interface for crypto containers and a more specific PKCS#7 interface
2012-12-19 10:32:07 +01:00
Tobias Brunner
f05b427265
Moved debug.[ch] to utils folder
2012-10-24 16:00:51 +02:00
Tobias Brunner
12642a6831
Moved data structures to new collections subfolder
2012-10-24 16:00:49 +02:00
Martin Willi
d987946e80
Added a final flag to builder registration to enumerate the actually supported algorithms
2010-09-03 18:09:48 +02:00
Martin Willi
0ac49c3292
Added an enumerator for registered credential builders
2010-09-02 10:49:02 +02:00
Martin Willi
b019136596
Migrated credential_factory to INIT/METHOD macros
2010-09-02 10:49:02 +02:00
Tobias Brunner
8b0e09103b
Adding DBG_LIB to all calls of libstrongswan's version of DBG*.
2010-04-06 12:47:40 +02:00
Tobias Brunner
4a5a5dd290
Using the thread wrapper in charon, libstrongswan and their plugins.
2009-12-23 17:03:41 +01:00
Tobias Brunner
eba64cef41
Separated the public interfaces of the threading primitives.
2009-12-23 17:01:53 +01:00
Tobias Brunner
14f7091280
Moved mutex.c to a separate folder in order to cleanly wrap other threading primitives (and utils/mutex.h is now threading.h).
2009-12-23 17:00:58 +01:00
Martin Willi
f678f5c77e
Replaced builder_t objects by simple builder_function_t functions
2009-09-10 16:20:17 +02:00
Martin Willi
7631aac20c
x509 certificates support encoding of email, DNS and IP subjectAltNames
2009-09-08 13:17:41 +02:00
Martin Willi
7daf5226b7
removed trailing spaces ([[:space:]]+$)
2009-09-04 13:46:09 +02:00
Andreas Steffen
be04eef270
allow choice of digest algorithm in certificate generation
2009-08-28 09:08:03 +02:00
Martin Willi
6a8791cd1f
complain about build errors in non-recursive cases only
2009-08-26 14:44:05 +02:00
Martin Willi
df5c60bc5d
added a BUILD_FROM_FD option, supporting credential parsing from stdin
2009-08-26 13:03:23 +02:00
Martin Willi
3addf4e937
renamed BUILD_BLOB_RFC_3110 to BUILD_BLOB_DNSKEY, we potentially support other key types
2009-08-26 11:23:51 +02:00
Martin Willi
1e0f69373a
implemented a pkcs1 plugin providing PKCS#1 key parsing builders
2009-08-26 11:23:50 +02:00
Martin Willi
7c2d883af7
show more information if building a credential fails
2009-08-26 11:23:50 +02:00
Martin Willi
ddf7c6ac7b
do not enumerate builders returning NULL
2009-08-26 11:23:50 +02:00
Martin Willi
11aa7e7869
use a pluto specific credential builder to build pluto cert_t's
2009-08-26 11:23:49 +02:00
Martin Willi
160f4c225d
moved PEM parsing functionality to its own plugin
2009-08-26 11:23:48 +02:00
Tobias Brunner
3901937d14
OpenSolaris defines MUTEX_DEFAULT therefore we rename the members of the enums mutex/condvar/rwlock_type_t.
2009-08-14 13:30:59 +02:00
Andreas Steffen
8b799d55ce
pluto and scepclient use private and public key plugins of libstrongswan
2009-06-09 11:03:32 +02:00
Tobias Brunner
8c5d72cd0b
removing svn keyword $Id$ from all files
2009-04-30 13:19:35 +00:00
Martin Willi
d5d5bc0f16
using rwlock to parallel build credentials
2008-12-09 15:57:51 +00:00
Tobias Brunner
83c42156a2
add support for smartcards in charon by using the ENGINE API provided by OpenSSL, based on patches by Michael Roßberg.
2008-12-03 10:12:20 +00:00
Martin Willi
f7c17aa15c
refactored credential builder
...
allow enumeration of matching builders
try a second builder if the first one fails
builder clones resources internally on demand
caller frees added resources on failure and success
stricter handling of non-supported build parts
2008-09-02 11:00:13 +00:00
Martin Willi
66860d3b8f
loading PEM encoded public keys
2008-06-11 14:10:02 +00:00
Tobias Brunner
550690d23b
fixed the cleanup code when the credential factory fails to create a builder
2008-05-19 12:43:01 +00:00
Andreas Steffen
ff98c85b57
added component BUILD_FROM_FILE
2008-03-25 13:26:33 +00:00
Andreas Steffen
c081a9bfe6
added ietf group attribute support to attibute certificate factory
2008-03-21 16:59:21 +00:00
Andreas Steffen
104c96a63c
added BUILD_SERIAL component and fixed several ac bugs
2008-03-21 12:44:15 +00:00
Andreas Steffen
6ac3a7acbb
added credential factory support for BULD_NOT_BEFORE_TIME and BUILD_NOT_AFTER_TIME
2008-03-21 11:32:33 +00:00
Martin Willi
34e281ed32
enforcing x509_flags on certificate construction
2008-03-17 08:06:49 +00:00
Martin Willi
552cc11b1f
merged the modularization branch (credentials) back to trunk
2008-03-13 14:14:44 +00:00
Tobias Brunner