 Martin Willi
|
7d7711aba4
|
Added a generic function to check if a DH group is an EC group
|
2010-09-03 16:22:10 +02:00 |
|
|
Martin Willi
|
2066918da2
|
Add ECDHE enabled cipher suites, including ECDSA variants
|
2010-09-03 14:54:43 +02:00 |
|
|
Martin Willi
|
033fe95f0b
|
Added support for a non-truncated SHA384 HMAC variant, as used by TLS
|
2010-09-03 14:54:43 +02:00 |
|
|
Martin Willi
|
4cdade5aae
|
Select private key based on received cipher suites
|
2010-09-03 14:54:43 +02:00 |
|
|
Martin Willi
|
37a59a8fbf
|
Support for EC curve Hello extension, EC curve fallback
|
2010-09-03 14:54:43 +02:00 |
|
|
Martin Willi
|
141d7f7abd
|
Added server support for ECDHE key exchange
|
2010-09-03 14:54:43 +02:00 |
|
|
Martin Willi
|
5fc7297e38
|
Added client support for ECDHE key exchange
|
2010-09-03 14:54:43 +02:00 |
|
|
Martin Willi
|
691ca54db5
|
Added TLS EC curve type and name identifiers
|
2010-09-03 14:54:43 +02:00 |
|
|
Martin Willi
|
ccb65463e7
|
Check for queued TLS alerts after each handshake part
|
2010-09-03 09:33:15 +02:00 |
|
|
Martin Willi
|
ed60dfa14f
|
Added support for MODP_CUSTOM to gcrypt plugin
|
2010-09-03 09:33:15 +02:00 |
|
|
Martin Willi
|
42b1ac91c4
|
Added support for MODP_CUSTOM to openssl plugin
|
2010-09-03 09:33:15 +02:00 |
|
|
Martin Willi
|
ef0a8e5892
|
Add DHE enabled RSA variants to the supported TLS suites
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
f14358a9b5
|
Added TLS server side support for DHE suites
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
da3f4a9fd0
|
Added TLS client side support for DHE suites
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
35d9c15d5e
|
Store a MODP group we use for each TLS suite
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
08d8b9405b
|
Added support for MODP_CUSTOM to gmp plugin
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
0abd558a65
|
Added a MODP_CUSTOM DH group which takes g and p as constructor arguments
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
06109c4717
|
Implemented "signature algorithm" hello extension
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
731611c525
|
Added TLS extension identifiers
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
d29a82a9d4
|
Added generic TLS data sign/verify, hash/sig algorithm construction
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
60c4b3b545
|
Continue with a randomized premaster if decryption failed / version mismatches
|
2010-09-02 19:33:08 +02:00 |
|
|
Martin Willi
|
dbb7c0306c
|
Support different hash/sig algorithms in handshake signing, including ECDSA
|
2010-09-02 13:07:25 +02:00 |
|
|
Martin Willi
|
99dcaea9bd
|
Added TLS ClientCertificateType identifiers
|
2010-09-02 13:07:24 +02:00 |
|
|
Martin Willi
|
9dd2ca924e
|
Added TLS specific Hash and Signature Algorithm identifiers
|
2010-09-02 13:07:24 +02:00 |
|
|
Martin Willi
|
ea6d7cb4be
|
Fixed typos in tls_writer method descriptions
|
2010-09-02 13:07:24 +02:00 |
|
|
Martin Willi
|
bbdc85b66e
|
Respect key types in stroke key/certificate backend
|
2010-09-02 13:07:23 +02:00 |
|
|
Martin Willi
|
0ac49c3292
|
Added an enumerator for registered credential builders
|
2010-09-02 10:49:02 +02:00 |
|
|
Martin Willi
|
b019136596
|
Migrated credential_factory to INIT/METHOD macros
|
2010-09-02 10:49:02 +02:00 |
|
|
Martin Willi
|
93709d1093
|
Do not process any more TLS handshake messages on fatal alerts
|
2010-08-31 18:10:24 +02:00 |
|
|
Martin Willi
|
33b1a2567f
|
Load a left/rightcert2 for EAP-TLS even if no left/rightauth2 is defined
|
2010-08-31 18:10:23 +02:00 |
|
|
Martin Willi
|
c811479986
|
Strictly check if the server certificate matches the TLS server identity
|
2010-08-31 18:10:23 +02:00 |
|
|
Martin Willi
|
36eafea232
|
Use the AAA Identity for EAP authentication, if given
|
2010-08-31 18:10:23 +02:00 |
|
|
Martin Willi
|
64d7b0733f
|
Added support for the ipsec.conf aaa_identity keyword
|
2010-08-31 17:52:52 +02:00 |
|
|
Martin Willi
|
81137552e5
|
Added an AAA identity authentication config option
|
2010-08-31 17:26:20 +02:00 |
|
|
Martin Willi
|
f9fc5f2045
|
Added strongswan.conf options for EAP-TLS/TTLS fragment size
|
2010-08-31 16:17:01 +02:00 |
|
|
Martin Willi
|
743f94067e
|
Support processing of partial TLS record headers
|
2010-08-31 16:17:01 +02:00 |
|
|
Martin Willi
|
1cf8c5f746
|
Migrated EAP-TTLS to the generic TLS helper
|
2010-08-31 16:17:01 +02:00 |
|
|
Martin Willi
|
be751012c3
|
Migrated EAP-TLS to the generic TLS helper
|
2010-08-31 16:17:01 +02:00 |
|
|
Martin Willi
|
877c910f04
|
Implemented a generic TLS EAP helper to implement EAP-TLS, TTLS and other variants
|
2010-08-31 16:16:58 +02:00 |
|
|
Martin Willi
|
ecd98efa9d
|
Support output fragmentation of TLS records
|
2010-08-31 15:54:37 +02:00 |
|
|
Martin Willi
|
f13a03add0
|
Moved EAP type/code definitions to a seprate header file in libstrongswan
|
2010-08-31 15:35:29 +02:00 |
|
|
Martin Willi
|
ce1af73907
|
Implemented buffering of partial records in TLS stack
|
2010-08-31 15:35:29 +02:00 |
|
|
Martin Willi
|
d169aab35e
|
Log TLS handshake subtypes as handshakes
|
2010-08-31 15:35:29 +02:00 |
|
|
Martin Willi
|
fd0bde9a60
|
Added a TLS debug level option, use debugging hook
|
2010-08-31 15:35:29 +02:00 |
|
|
Martin Willi
|
4332b5af89
|
Do not strdup() zero length strings in identification_create_from_string()
|
2010-08-31 15:34:45 +02:00 |
|
|
Martin Willi
|
2291754ddf
|
Unwrap crlNumber INTEGER in openssl CRL parsing
|
2010-08-30 11:23:46 +02:00 |
|
|
Martin Willi
|
21f80e9dbc
|
Added crl support to pki --print
|
2010-08-30 11:23:45 +02:00 |
|
|
Martin Willi
|
45684ee65c
|
Fixed pluto smartcard support after introducing encryption schemes
|
2010-08-30 10:14:45 +02:00 |
|
|
Martin Willi
|
2bf0e74c38
|
Prefer AES/Camellia suites over 3DES/NULL encryption
|
2010-08-25 18:30:09 +02:00 |
|
|
Martin Willi
|
a596006e3f
|
Send TLS alerts for errors in TLS handshake building
|
2010-08-25 18:24:27 +02:00 |
|
|
Martin Willi
|
ee88ddd6aa
|
Refactored fragment building, use correct TLS content type for non-first fragments
|
2010-08-25 18:04:59 +02:00 |
|
|
Martin Willi
|
dfde6570c7
|
Update delete_payload length when adding SPIs
|
2010-08-25 17:04:25 +02:00 |
|
|
Martin Willi
|
5299719569
|
Migrated delete_payload to INIT/METHOD macros, replaced iterator
|
2010-08-25 17:03:00 +02:00 |
|
|
Martin Willi
|
e5c6ebb697
|
Use different return values in payload decryption to distinguish between integrity and syntax errors
|
2010-08-25 15:29:53 +02:00 |
|
|
Martin Willi
|
f1a74a3cab
|
Implemented a TLS utility to test on any TLS secured TCP connection
|
2010-08-25 12:57:13 +02:00 |
|
|
Martin Willi
|
17102f7b58
|
Added a simple high level TLS wrapper for sockets
|
2010-08-25 12:52:53 +02:00 |
|
|
Martin Willi
|
bd23b9086e
|
Initialize output chunk before appending data to it
|
2010-08-25 12:43:21 +02:00 |
|
|
Martin Willi
|
3dd06bd4ed
|
Added private key support to in-memory credential set
|
2010-08-25 10:28:23 +02:00 |
|
|
Martin Willi
|
72c6335de9
|
Added certificate support to in-memory credential set
|
2010-08-25 10:28:22 +02:00 |
|
|
Martin Willi
|
8427c78611
|
Added a ike_name logger option to prefix the IKE_SA name on each line
|
2010-08-25 09:55:37 +02:00 |
|
|
Martin Willi
|
69e8bb2e8d
|
Pass NULL peer identity to omit TLS peer authentication, added eap-ttls.request_peer_auth option
|
2010-08-24 11:34:43 +02:00 |
|
|
Martin Willi
|
a2c1235969
|
Skip the close notify if application layer completes successfully
|
2010-08-24 10:30:24 +02:00 |
|
|
Martin Willi
|
bda7d9d940
|
Added generic TLS purposes
|
2010-08-24 08:45:49 +02:00 |
|
|
Martin Willi
|
f55f9c4e1e
|
Client sends empty EAP-TTLS packet on fatal alerts to properly shut down TLS
|
2010-08-24 08:45:49 +02:00 |
|
|
Martin Willi
|
c5142f110e
|
Check if the application layer has completed successfully
|
2010-08-24 08:45:49 +02:00 |
|
|
Martin Willi
|
1475800080
|
Moved TLS record parsing/generation to tls.c
|
2010-08-24 08:45:49 +02:00 |
|
|
Martin Willi
|
c310881a11
|
Added a TLS purpose for EAP-TTLS with client authentication
|
2010-08-23 15:13:48 +02:00 |
|
|
Martin Willi
|
5ff8c62707
|
EAP-TLS clients send an empty packet on failure to properly shut down a TLS session
|
2010-08-23 15:13:41 +02:00 |
|
|
Martin Willi
|
e6f3ef1330
|
Implemented TLS Alert handling
|
2010-08-23 15:13:37 +02:00 |
|
|
Martin Willi
|
908e752201
|
Rebuild library.lo after changing ./configure options
|
2010-08-23 12:01:48 +02:00 |
|
|
Martin Willi
|
e0fcf43cf8
|
Build a trustchain even if no trust anchor is given
|
2010-08-23 12:01:43 +02:00 |
|
|
Martin Willi
|
c49475dae1
|
Accept encryption payloads with no wrapped payloads
|
2010-08-23 11:30:36 +02:00 |
|
|
Martin Willi
|
4f60466a01
|
Fall back to shifting with 32-bit words if 64-bit byte order conversion function missing
|
2010-08-23 10:10:36 +02:00 |
|
|
Martin Willi
|
835ec23aff
|
Use enum mappings to resolve debug group
|
2010-08-23 09:47:04 +02:00 |
|
|
Martin Willi
|
f9efac2ba3
|
Implemented generic enum name to enum value mapping
|
2010-08-23 09:47:03 +02:00 |
|
|
Martin Willi
|
f154e30431
|
Verify negotiated TLS version
|
2010-08-23 09:47:03 +02:00 |
|
|
Martin Willi
|
3c19b3461f
|
Introducing a dedicated debug message group for libtls
|
2010-08-23 09:47:03 +02:00 |
|
|
Martin Willi
|
0bcef5fe7a
|
Streamlined TLS debugging output
|
2010-08-23 09:45:33 +02:00 |
|
|
Martin Willi
|
96b2fbcc2c
|
Introducing simple purposes for the TLS stack, switches various options
|
2010-08-20 15:09:08 +02:00 |
|
|
Martin Willi
|
6291fbedcb
|
Fixed compiler warning
|
2010-08-20 15:09:08 +02:00 |
|
|
Martin Willi
|
cb3f0c9b31
|
Register missing SHA256 authenticator with no truncation, as used by TLS
|
2010-08-20 12:11:21 +02:00 |
|
|
Martin Willi
|
6e413d9ce9
|
Added more TLS cipher suites we already support
|
2010-08-20 12:11:21 +02:00 |
|
|
Martin Willi
|
a2bfc45bfd
|
Build TLS cipher suite list in a generic fashion
|
2010-08-20 12:11:21 +02:00 |
|
|
Martin Willi
|
2e64455ee1
|
Fixed crypter keymat derivation bug
|
2010-08-19 19:28:08 +02:00 |
|
|
Martin Willi
|
44582075e0
|
Added ctr, ccm, gcm plugin NEWS
|
2010-08-19 19:09:01 +02:00 |
|
|
Martin Willi
|
23cf96773a
|
Improve GCM performance by factor 2-3 by shifting full 32/64 bit words
|
2010-08-19 19:08:57 +02:00 |
|
|
Martin Willi
|
1a64981048
|
Implemented a gcm plugin providing GCM mode based on CBC crypters
|
2010-08-19 19:05:15 +02:00 |
|
|
Martin Willi
|
026355af42
|
Added AES-GCM test vectors
|
2010-08-19 19:05:15 +02:00 |
|
|
Martin Willi
|
37e52c3fbf
|
Added a crypto transform stress test for profiling
|
2010-08-19 19:05:14 +02:00 |
|
|
Martin Willi
|
9d3e174a1e
|
Give a benchmark point for each operation to compare different transforms
|
2010-08-19 19:05:14 +02:00 |
|
|
Martin Willi
|
80a93a1335
|
Implemented a ccm plugin providing CCM mode based on CBC crypters
|
2010-08-19 19:05:14 +02:00 |
|
|
Martin Willi
|
7ba89ccd7f
|
Added helper macros to define portable bitfields with gcc
|
2010-08-19 19:05:14 +02:00 |
|
|
Martin Willi
|
f9277ac426
|
Added AES-CCM test vectors
|
2010-08-19 19:05:14 +02:00 |
|
|
Martin Willi
|
8ca9e255d8
|
Added support for AEAD test vectors to test-vectors plugin
|
2010-08-19 19:05:13 +02:00 |
|
|
Martin Willi
|
08a5a708fc
|
Include CCM/GCM algorithms in IKEv2 proposals, if supported
|
2010-08-19 19:05:05 +02:00 |
|
|
Martin Willi
|
3f6a2d3343
|
Added proposal strings for Camellia CCM algorithm identifiers
|
2010-08-19 19:02:34 +02:00 |
|
|
Martin Willi
|
84eb3aa456
|
Implemented IKEv2 keymat derivation for AEAD algorithms
|
2010-08-19 19:02:34 +02:00 |
|
|
Martin Willi
|
9d49f79f55
|
List registered AEAD algorithms in listalgs
|
2010-08-19 19:02:34 +02:00 |
|
|
Martin Willi
|
77b55e8a96
|
Added support for AEAD algorithms to crypto factory
|
2010-08-19 19:02:34 +02:00 |
|
|
Martin Willi
|
e09a87d652
|
Added AEAD support to crypto tester
|
2010-08-19 19:02:33 +02:00 |
|