denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,447 Commits 1 Branch 0 Tags
82c884c015ec8d868d3566e03801139cb7492051
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 82c884c015 Set sockaddr family on ifreq instead of casted familiy specific sockaddr 
Fixes a strict-aliasing rule compiler warning with older gcc.
 2013-02-06 15:20:32 +01:00
Martin Willi 8d631ebabd Encode IETF Numeric Version Service Pack Version with two byte words 2013-01-22 14:45:56 +01:00
Martin Willi 325efdaca8 Filter TS list for Split-Includes before printing them to debug log 2013-01-21 12:15:51 +01:00
Martin Willi 1449e6dd55 Reseed rdrand after every 128bit sample only 2013-01-15 17:41:54 +01:00
Martin Willi c4a49008e8 Don't handle right=%any6 as "loose" identity, but as %any 2013-01-14 10:33:14 +01:00
Martin Willi 426f34baf9 Respect given address family when resolving "%any" 2013-01-14 10:26:12 +01:00
Martin Willi 54a1a75b2f Don't use bio_writer_t.skip() to write length field when appending more data 
If the writer reallocates its buffer, the length pointer might not be valid
anymore, or even worse, point to an arbitrary allocation.
 2013-01-11 14:57:08 +01:00
Martin Willi 2f0441a3a6 Add rdrand NEWS 2013-01-11 10:48:57 +01:00
Martin Willi 2cd6c5115b Use raw opcodes for rdrand to build with older binutils 2013-01-11 10:45:14 +01:00
Martin Willi 19ae23452a Provide RNG_TRUE quality in rdrand by mixing reseeded outputs using AES 2013-01-11 10:45:14 +01:00
Martin Willi b9148ea232 Provide RNG_STRONG quality in rdrand by forcing PRNG reseed after every sample 2013-01-11 10:45:14 +01:00
Martin Willi 9fe24b004d Provide RNG_WEAK quality random generator in rdrand 2013-01-11 10:45:14 +01:00
Martin Willi ed8dc6f132 Add a rdrand plugin stub detecting availability of RDRAND instructions 2013-01-11 10:45:14 +01:00
Martin Willi 0e0870aef7 Add NEWS about improved Windows IKEv1 compatibility 2013-01-11 10:31:25 +01:00
Martin Willi 1954cc7720 Streamline debug output when receiving intermediate CA certificates in IKEv1 2013-01-11 10:24:23 +01:00
Martin Willi cde6a9ec9f Refactored IKEv2 cert/certreq payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi bf10ee9495 Refactored IKEv1 cert payload processing to multiple functions 2013-01-11 10:21:56 +01:00
Martin Willi ff318ad3e1 Include opensslconf.h before checking its defines 2013-01-03 11:12:05 +01:00
Martin Willi 2b9e597b54 Don't build OpenSSL PKCS#7 code if OPENSSL_NO_CMS defined 2013-01-03 11:05:49 +01:00
Martin Willi 656e01eab3 Add parantheses to avoid compiler warning 2012-12-24 10:12:23 +01:00
Martin Willi ecdd5aedac NEWS about error-notify 2012-12-19 10:43:35 +01:00
Martin Willi 32c3ac95e4 Add missing error_notify_msg.h to distribution tarball 2012-12-19 10:40:33 +01:00
Martin Willi 3044085006 Add an error-notify sample application to listen to error notifications 2012-12-19 10:40:33 +01:00
Martin Willi 0aaf5ccfa6 Add an error-notify plugin to send catched alerts to listening applications 2012-12-19 10:40:33 +01:00
Martin Willi 578f72ceb0 Raise an alert if half-open timeout limit reached 2012-12-19 10:40:33 +01:00
Martin Willi c57fe7ac6f Raise an alert if an authorize() hook fails 2012-12-19 10:40:33 +01:00
Martin Willi 45d6134218 Raise an alert if allocating virtual IPs fails 2012-12-19 10:40:33 +01:00
Martin Willi f285b9efc8 Raise an alert if kernel policy installation fails 2012-12-19 10:40:33 +01:00
Martin Willi bcf3147e0a Raise an alert if kernel SA installation fails 2012-12-19 10:40:33 +01:00
Martin Willi 24f30ec92f Raise an alert on traffic selector mismatch 2012-12-19 10:40:32 +01:00
Martin Willi c794455666 Raise alerts when enforcing IKE_SA unique policy 2012-12-19 10:40:32 +01:00
Martin Willi 5dd9c3087f Raise an alert if CHILD_SA proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi bab949bb26 Raise an alert if IKE proposals mismatch 2012-12-19 10:40:32 +01:00
Martin Willi 3f7f5388a5 Raise an alert of generating local authentication data fails 2012-12-19 10:40:32 +01:00
Martin Willi cc0cc3b54d Add NEWS about BER capable OpenSSL PKCS#7 backend 2012-12-19 10:38:42 +01:00
Martin Willi 644be5d537 Free leaking scep attributes 2012-12-19 10:32:08 +01:00
Martin Willi 429e6d5eee Corrected error message if enveloped-data decryption fails 2012-12-19 10:32:08 +01:00
Martin Willi 0a344da291 Fix up serialNumber in openssl PKCS#7 if it has a leading MSB set 2012-12-19 10:32:08 +01:00
Martin Willi 71dd4e7895 Don't handle PKCS#7 containers with infinite length encodings in pkcs7 plugin 2012-12-19 10:32:08 +01:00
Martin Willi 3c820cdc23 Implement PKCS#7 decryption using openssl 2012-12-19 10:32:08 +01:00
Martin Willi 2a87944a33 Make available wrapped certificates while verifying PKCS#7 signatures in openssl 2012-12-19 10:32:08 +01:00
Martin Willi 04884be3b5 Implement openssl PKCS#7 certficiate enumeration 2012-12-19 10:32:08 +01:00
Martin Willi e96d945dcd Fix doxygen grouping regarding containers and PKCS#7 2012-12-19 10:32:08 +01:00
Martin Willi 36f2e11c70 Enable pkcs7 plugin when building scepclient on Android 2012-12-19 10:32:08 +01:00
Martin Willi 03ba8f9e8c Move PKCS#9 attribute lists to pkcs7 plugin, as we currently use it there only 2012-12-19 10:32:08 +01:00
Martin Willi 804ba5bb50 Implement get_attribute() in openssl PKCS#7 backend 2012-12-19 10:32:08 +01:00
Martin Willi 063ae4e52a Allocate data returned by pkcs7_t.get_attribute() 2012-12-19 10:32:08 +01:00
Martin Willi c61723c69f Implement OpenSSL PKCS#7 signed-data parsing and verification 2012-12-19 10:32:08 +01:00
Martin Willi 568ad938d1 Add a stub for OpenSSL PKCS#7 parsing 2012-12-19 10:32:08 +01:00
Martin Willi 1865fb929a Remove unused monolithic PKCS#7 code 2012-12-19 10:32:08 +01:00
Martin Willi 74cc41c704 Migrated scepclient to new modular PKCS# API 2012-12-19 10:32:08 +01:00
Martin Willi 6d21c61a09 Fix encryption algorithm/key size argument processing in PKCS#7 enveloped-data 2012-12-19 10:32:08 +01:00
Martin Willi ee97055835 Properly clone PKCS#7 attributes passed to builder 2012-12-19 10:32:08 +01:00
Martin Willi 8ccf5a4731 Fix enum names for container_type_t 2012-12-19 10:32:08 +01:00
Martin Willi 24b2dae2b6 Add a --show option to pki --pkcs7 to print contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi 9e967d7dda Add an enumerator for PKCS#7 contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi 9afbe59953 pki --pkcs7 --verify shows prints the signing time, if available 2012-12-19 10:32:08 +01:00
Martin Willi d3d706f4fc Add a getter for signed PKCS#7 attributes 2012-12-19 10:32:08 +01:00
Martin Willi 5a50bec9d2 Fix leak in pki --pkcs7 --decrypt 2012-12-19 10:32:08 +01:00
Martin Willi b95b4730f5 Support multiple signerInfos while parsing PKCS#7 signed-data 2012-12-19 10:32:07 +01:00
Martin Willi 47120d4977 Add a pki command to sign, verify, encrypt and decrypt PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi 5d932e4f01 Support encoding of PKCS#7 enveloped-data containers 2012-12-19 10:32:07 +01:00
Martin Willi 32745a28cf Support encoding of PKCS#7 signed-data containers 2012-12-19 10:32:07 +01:00
Martin Willi 3c2986bf0a Support encoding of PKCS#7 "data" containers 2012-12-19 10:32:07 +01:00
Martin Willi 637a8abb72 Add builder parts to generate PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi d7aa09104f Implement PKCS#7 enveloped-data parsing and decryption 2012-12-19 10:32:07 +01:00
Martin Willi 98bbe0760f Implement PKCS#7 signed-data parsing and verification 2012-12-19 10:32:07 +01:00
Martin Willi 83ed1464e3 Implement PKCS#7 "data" content type parsing 2012-12-19 10:32:07 +01:00
Martin Willi ed1c430334 certificate_t.has_subject() matches for certificate serialNumber 2012-12-19 10:32:07 +01:00
Martin Willi 9de6a7a85c Implement generic PKCS#7 contentInfo parsing 2012-12-19 10:32:07 +01:00
Martin Willi bd20f040fd Add a plugin stub for PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi 692f560546 Add container plugin features 2012-12-19 10:32:07 +01:00
Martin Willi fc67a932ba Add a generic interface for crypto containers and a more specific PKCS#7 interface 2012-12-19 10:32:07 +01:00
Martin Willi 67ca44ccbd Rebuild PKCS#9 encoding after adding new attributes 2012-12-19 10:32:07 +01:00
Martin Willi 60c9b5da8d Don't store additional encoding for each PKCS#9 attribute 2012-12-19 10:32:07 +01:00
Martin Willi 7f9fedc9bd Unify PKCS#9 set_attribute* methods to a single add_attribute 
This way the PKCS#9 implementation does not have to know
the encoding types for values
 2012-12-19 10:32:07 +01:00
Martin Willi c1005c120c PKCS#9 coding style cleanups 2012-12-19 10:32:07 +01:00
Martin Willi f0c02e27c4 Remove external build_encoding method in PKCS#9 2012-12-19 10:32:07 +01:00
Martin Willi 4185c64464 Use a ./configure check to detect pthread spinlock availability 
_POSIX_SPIN_LOCKS does not seem to be defined correctly on all
systems (Debian libc 2.3.6). Fixes #262.
 2012-12-18 09:51:33 +01:00
Martin Willi 544c2e3d7b kernel-netlinks get_interface() considers virtual IPs, too 
When using load-tester, we can install tunnel outer addresses on
demand. As these are installed as "virtual", we have to consider
virtual IPs in the get_interface() lookup to install "real" virtual
IPs to these dynamic external addresses.
 2012-12-17 14:23:44 +01:00
Martin Willi d9d0f12222 If load-tester requests a virtual IP, use a dynamic local traffic selector 2012-12-17 14:22:25 +01:00
Martin Willi fe3060f5d0 Add missing CHILD_SA specific proposal keyword in conftest README 2012-12-17 10:58:47 +01:00
Martin Willi df75cc5c5f Migrate RADIUS accounting state while IKE_SA unique id changes during rekey 2012-12-11 10:40:59 +01:00
Martin Willi 251b740712 Migrate cache and fire lookip events for unique_id change during IKE_SA rekey 2012-12-10 17:04:26 +01:00
Martin Willi 43b4c2ea75 Inherit virtual IP and attributes from old to new, not from new to old 2012-12-10 17:01:00 +01:00
Martin Willi 137ea41f45 Properly trigger ike_updown() event if IKEv1 DPD times out 
Fixes missing RADIUS Accounting Stop, #257.
 2012-12-04 11:11:50 +01:00
Martin Willi b091d80aff Replace optionsfrom LGPLv2 header by a GPLv2 2012-11-30 18:00:39 +01:00
Martin Willi 01bc9bf428 Fix GPL license header to properly "sed" it 2012-11-30 18:00:33 +01:00
Martin Willi c543616315 Add locking to IMC/IMV managers to add/remove IMC/IMVs on the fly 2012-11-30 15:49:23 +01:00
Martin Willi 7e45257f7d Reuse generic constructor in IMV/IMC message 2012-11-30 15:49:12 +01:00
Martin Willi a6722e5653 Add getters for the raw encoding in IMV/IMC messages 2012-11-30 15:49:07 +01:00
Martin Willi 2a433075e2 Clean up whitespaces in IMC/IMV messages 2012-11-30 15:49:03 +01:00
Martin Willi fdce28c49c Don't remove IETF standard errors while parsing IMC/IMV messages 2012-11-30 15:48:55 +01:00
Martin Willi 18bb1a1540 Remove unused get_vendor_id() method in IETF error IF-M attributes 2012-11-30 15:48:44 +01:00
Martin Willi 55b323c224 Check os_version when reading release file, os_name is not set for Debian 2012-11-30 15:48:39 +01:00
Martin Willi dd685d55e5 Don't unload IMC/IMV managers if no IMC/IMVs loaded from tnc_config 2012-11-30 15:48:26 +01:00
Martin Willi 016d343a50 Add wrappers to IMC/IMV managers loading IMC/IMVs from function pointers 2012-11-30 15:48:20 +01:00
Martin Willi be18ee8123 If adding an IMC/IMV fails, terminate() it only if it has been initialize()d 2012-11-30 15:48:13 +01:00
Martin Willi fd885fd390 Add an IMV constructor taking a set of custom TNC_IMV functions 2012-11-30 15:48:02 +01:00
Martin Willi f1f500c724 Add an IMC constructor taking a set of custom TNC_IMC functions 2012-11-30 15:47:59 +01:00