denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,232 Commits 1 Branch 0 Tags
804ba5bb5051289e54f09ff5a127427b75317db9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 804ba5bb50 Implement get_attribute() in openssl PKCS#7 backend 2012-12-19 10:32:08 +01:00
Martin Willi 063ae4e52a Allocate data returned by pkcs7_t.get_attribute() 2012-12-19 10:32:08 +01:00
Martin Willi c61723c69f Implement OpenSSL PKCS#7 signed-data parsing and verification 2012-12-19 10:32:08 +01:00
Martin Willi 568ad938d1 Add a stub for OpenSSL PKCS#7 parsing 2012-12-19 10:32:08 +01:00
Martin Willi 1865fb929a Remove unused monolithic PKCS#7 code 2012-12-19 10:32:08 +01:00
Martin Willi 74cc41c704 Migrated scepclient to new modular PKCS# API 2012-12-19 10:32:08 +01:00
Martin Willi 6d21c61a09 Fix encryption algorithm/key size argument processing in PKCS#7 enveloped-data 2012-12-19 10:32:08 +01:00
Martin Willi ee97055835 Properly clone PKCS#7 attributes passed to builder 2012-12-19 10:32:08 +01:00
Martin Willi 8ccf5a4731 Fix enum names for container_type_t 2012-12-19 10:32:08 +01:00
Martin Willi 24b2dae2b6 Add a --show option to pki --pkcs7 to print contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi 9e967d7dda Add an enumerator for PKCS#7 contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi 9afbe59953 pki --pkcs7 --verify shows prints the signing time, if available 2012-12-19 10:32:08 +01:00
Martin Willi d3d706f4fc Add a getter for signed PKCS#7 attributes 2012-12-19 10:32:08 +01:00
Martin Willi 5a50bec9d2 Fix leak in pki --pkcs7 --decrypt 2012-12-19 10:32:08 +01:00
Martin Willi b95b4730f5 Support multiple signerInfos while parsing PKCS#7 signed-data 2012-12-19 10:32:07 +01:00
Martin Willi 47120d4977 Add a pki command to sign, verify, encrypt and decrypt PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi 5d932e4f01 Support encoding of PKCS#7 enveloped-data containers 2012-12-19 10:32:07 +01:00
Martin Willi 32745a28cf Support encoding of PKCS#7 signed-data containers 2012-12-19 10:32:07 +01:00
Martin Willi 3c2986bf0a Support encoding of PKCS#7 "data" containers 2012-12-19 10:32:07 +01:00
Martin Willi 637a8abb72 Add builder parts to generate PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi d7aa09104f Implement PKCS#7 enveloped-data parsing and decryption 2012-12-19 10:32:07 +01:00
Martin Willi 98bbe0760f Implement PKCS#7 signed-data parsing and verification 2012-12-19 10:32:07 +01:00
Martin Willi 83ed1464e3 Implement PKCS#7 "data" content type parsing 2012-12-19 10:32:07 +01:00
Martin Willi ed1c430334 certificate_t.has_subject() matches for certificate serialNumber 2012-12-19 10:32:07 +01:00
Martin Willi 9de6a7a85c Implement generic PKCS#7 contentInfo parsing 2012-12-19 10:32:07 +01:00
Martin Willi bd20f040fd Add a plugin stub for PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi 692f560546 Add container plugin features 2012-12-19 10:32:07 +01:00
Martin Willi fc67a932ba Add a generic interface for crypto containers and a more specific PKCS#7 interface 2012-12-19 10:32:07 +01:00
Martin Willi 67ca44ccbd Rebuild PKCS#9 encoding after adding new attributes 2012-12-19 10:32:07 +01:00
Martin Willi 60c9b5da8d Don't store additional encoding for each PKCS#9 attribute 2012-12-19 10:32:07 +01:00
Martin Willi 7f9fedc9bd Unify PKCS#9 set_attribute* methods to a single add_attribute 
This way the PKCS#9 implementation does not have to know
the encoding types for values
 2012-12-19 10:32:07 +01:00
Martin Willi c1005c120c PKCS#9 coding style cleanups 2012-12-19 10:32:07 +01:00
Martin Willi f0c02e27c4 Remove external build_encoding method in PKCS#9 2012-12-19 10:32:07 +01:00
Martin Willi 4185c64464 Use a ./configure check to detect pthread spinlock availability 
_POSIX_SPIN_LOCKS does not seem to be defined correctly on all
systems (Debian libc 2.3.6). Fixes #262.
 2012-12-18 09:51:33 +01:00
Martin Willi 544c2e3d7b kernel-netlinks get_interface() considers virtual IPs, too 
When using load-tester, we can install tunnel outer addresses on
demand. As these are installed as "virtual", we have to consider
virtual IPs in the get_interface() lookup to install "real" virtual
IPs to these dynamic external addresses.
 2012-12-17 14:23:44 +01:00
Martin Willi d9d0f12222 If load-tester requests a virtual IP, use a dynamic local traffic selector 2012-12-17 14:22:25 +01:00
Martin Willi fe3060f5d0 Add missing CHILD_SA specific proposal keyword in conftest README 2012-12-17 10:58:47 +01:00
Martin Willi df75cc5c5f Migrate RADIUS accounting state while IKE_SA unique id changes during rekey 2012-12-11 10:40:59 +01:00
Martin Willi 251b740712 Migrate cache and fire lookip events for unique_id change during IKE_SA rekey 2012-12-10 17:04:26 +01:00
Martin Willi 43b4c2ea75 Inherit virtual IP and attributes from old to new, not from new to old 2012-12-10 17:01:00 +01:00
Martin Willi 137ea41f45 Properly trigger ike_updown() event if IKEv1 DPD times out 
Fixes missing RADIUS Accounting Stop, #257.
 2012-12-04 11:11:50 +01:00
Martin Willi b091d80aff Replace optionsfrom LGPLv2 header by a GPLv2 2012-11-30 18:00:39 +01:00
Martin Willi 01bc9bf428 Fix GPL license header to properly "sed" it 2012-11-30 18:00:33 +01:00
Martin Willi c543616315 Add locking to IMC/IMV managers to add/remove IMC/IMVs on the fly 2012-11-30 15:49:23 +01:00
Martin Willi 7e45257f7d Reuse generic constructor in IMV/IMC message 2012-11-30 15:49:12 +01:00
Martin Willi a6722e5653 Add getters for the raw encoding in IMV/IMC messages 2012-11-30 15:49:07 +01:00
Martin Willi 2a433075e2 Clean up whitespaces in IMC/IMV messages 2012-11-30 15:49:03 +01:00
Martin Willi fdce28c49c Don't remove IETF standard errors while parsing IMC/IMV messages 2012-11-30 15:48:55 +01:00
Martin Willi 18bb1a1540 Remove unused get_vendor_id() method in IETF error IF-M attributes 2012-11-30 15:48:44 +01:00
Martin Willi 55b323c224 Check os_version when reading release file, os_name is not set for Debian 2012-11-30 15:48:39 +01:00
Martin Willi dd685d55e5 Don't unload IMC/IMV managers if no IMC/IMVs loaded from tnc_config 2012-11-30 15:48:26 +01:00
Martin Willi 016d343a50 Add wrappers to IMC/IMV managers loading IMC/IMVs from function pointers 2012-11-30 15:48:20 +01:00
Martin Willi be18ee8123 If adding an IMC/IMV fails, terminate() it only if it has been initialize()d 2012-11-30 15:48:13 +01:00
Martin Willi fd885fd390 Add an IMV constructor taking a set of custom TNC_IMV functions 2012-11-30 15:48:02 +01:00
Martin Willi f1f500c724 Add an IMC constructor taking a set of custom TNC_IMC functions 2012-11-30 15:47:59 +01:00
Martin Willi cd74959465 Clean up memory management when loading IMC/IMVs from files 2012-11-30 15:47:34 +01:00
Martin Willi db9c8b6fba Fix passing of IKE_SA unique_id over lookip socket 2012-11-30 13:44:12 +01:00
Martin Willi 78b2a2b148 Add load-tester NEWS 2012-11-29 10:29:17 +01:00
Martin Willi 48828ff0db Store load-tester address leases in a hashtable for fast removal 2012-11-29 10:22:52 +01:00
Martin Willi 7277e4719e Consolidated %any(6) host_t parsing 2012-11-29 10:22:52 +01:00
Martin Willi 98d0fd25a8 Remove numeric conversion from resolver, it is done directly in host_t 2012-11-29 10:22:52 +01:00
Martin Willi 47f35b46a1 host_create_from_dns() tries a numeric conversion before asking resolver 2012-11-29 10:22:51 +01:00
Martin Willi f5fe52bf9a Add a host_t constructor from string, but with a specific family 2012-11-29 10:22:51 +01:00
Martin Willi d88597f0dd Don't wait while removing external IPs used for load testing 2012-11-29 10:22:51 +01:00
Martin Willi b185cdd16d Install virtual IPs via interface name, and use an interface lookup where required 2012-11-29 10:22:51 +01:00
Martin Willi 0a54d3e1a1 load-tester can dynamically install a dedicated external IP for each IKE_SA 
For consistency, the local/remote parameters have been replaced by the
initiator/responder options. As initiator, the initiator option can
be overriden by an addrs section taking key/value pairs with address
pools to use on a specific interface.
 2012-11-29 10:22:51 +01:00
Martin Willi 50bd755871 Add an optional kernel-interface parameter to install IPs with a custom prefix 2012-11-29 10:22:51 +01:00
Martin Willi fdd94fc846 Add a delay option to load-tester socket 2012-11-29 10:22:51 +01:00
Martin Willi cf85f6b296 Indicate message retransmissions while initiating load-test batches 2012-11-29 10:22:51 +01:00
Martin Willi 3c79b7b7db Add alerts for sent/received message retransmissions and timeout 2012-11-29 10:22:51 +01:00
Martin Willi 93ceaa7e64 Initiate each load-testing connection with a fresh peer config 2012-11-29 10:22:51 +01:00
Martin Willi b7acd90763 Initiate IKE_SAs trigger over load-tester socket in parallel 2012-11-29 10:22:51 +01:00
Martin Willi 965f7bd54f Add a simple load-tester utility to initiate over control socket 2012-11-29 10:22:51 +01:00
Martin Willi d65683eef4 Add a load-tester control socket to manually trigger initiation 2012-11-29 10:22:50 +01:00
Martin Willi 2685020ace Lookip plugin additionally reports the IKE_SA unique identifier 2012-11-29 10:00:45 +01:00
Martin Willi b5d27839ad Do not send 0.0.0.0/0 traffic selectors as Split-Include Unity attributes 
It seems that iOS devices don't like them.
 2012-11-22 12:13:44 +01:00
Martin Willi 2354b10576 Add an ikesa_limit option to limit number of IKE_SAs as responder 2012-11-16 10:27:36 +01:00
Martin Willi 5b89e3b061 Pass PLUTO_XAUTH_ID to updown script 2012-11-16 09:56:05 +01:00
Martin Willi 07474b6062 libtnc can be initialized more than once 2012-11-14 10:14:40 +01:00
Martin Willi de4c1def83 libcharon can be initialized more than once 2012-11-14 10:14:37 +01:00
Martin Willi 8edb6248f8 libhydra can be initialized more than once 2012-11-14 10:14:34 +01:00
Martin Willi 1e5e1fb685 libstrongswan can be initialized more than once 2012-11-14 10:14:31 +01:00
Martin Willi 6e8f88dba3 Exclude dynamic TS from Unity Split-Include attributes 2012-10-30 09:14:44 +01:00
Martin Willi 828cefc313 Fix RSA encryption padding terminator in gmp plugin, broken with 5025135f 2012-10-24 20:26:10 +02:00
Martin Willi 2fc0232a39 Add a scepclient option to specify a CA identifier to fetch certs for 2012-10-24 16:28:58 +02:00
Martin Willi c4894cc172 Send certificate requests in load-tester 2012-10-24 13:25:45 +02:00
Martin Willi 0f3c5f8502 Add load-tester traffic selector configuration options 2012-10-24 13:25:13 +02:00
Martin Willi 1efd6c6f2a Make use of new CIDR string ts constructor where appropriate 2012-10-24 13:25:08 +02:00
Martin Willi fd6c0c8fb4 Add a traffic selector constructor creating a TS directly from a CIDR string 2012-10-24 13:25:02 +02:00
Martin Willi 8fc7bbc6ba Add NEWS about explicitly loaded pkcs11 certificates from ipsec.conf 2012-10-24 13:16:39 +02:00
Martin Willi 712e81306f PKCS#11 library search using keyid uses a fallback to look for certificates 2012-10-24 13:07:54 +02:00
Martin Willi aa51d5dd25 Increase the limit of acceptable IKEv1 CERTREQ payloads to 20 2012-10-24 13:07:53 +02:00
Martin Willi 4ce55ffb0b Use explicit, larger buffer sizes for smartcard keyids and modules 2012-10-24 13:07:53 +02:00
Martin Willi cd844e1c97 Remove obsolete pluto smartcard syntax in ipsec.secrets.5 2012-10-24 13:07:53 +02:00
Martin Willi f6d8fb3687 Updated ipsec.conf.5 regarding (CA) certificates loaded from smartcards 2012-10-24 13:07:53 +02:00
Martin Willi 434902b302 Add a strongswan.conf option to disable loading of all certificates from a pkcs11 module 2012-10-24 13:07:53 +02:00
Martin Willi 794d713dca Support loading cacert certificates in ipsec.conf ca sections from smartcard 2012-10-24 13:07:53 +02:00
Martin Willi 2abe404927 Refactored stroke smartcard token parsing, support module and slot in leftcert option 2012-10-24 13:07:53 +02:00
Martin Willi 36e47a409b Explicit pkcs11 certificate loading can enforce a module and a slot 2012-10-24 13:07:53 +02:00
Martin Willi 5d4c27d077 Be less verbose if loading PKCS#11 certificate fails 2012-10-24 13:07:53 +02:00