denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,047 Commits 1 Branch 0 Tags
8a072fc50ac76af682e9fd0e21a31cf8411b9838
Commit Graph
270 Commits
Author SHA1 Message Date
Martin Willi 266ee0a190 windows: Provide a sched_yield() implementation 2014-06-04 15:53:01 +02:00
Martin Willi 40a924090e crl: Undefine <wincrypt.h>'s CRL_REASON_* and use our enum values instead 2014-06-03 12:24:34 +02:00
Martin Willi e163427d9f auth-cfg: Cast literal default value to pointer type 
Fixes a clang warning.
 2014-05-16 15:42:07 +02:00
Martin Willi d4368689a0 mem-cred: Replace existing equal shared keys during add_shared() 2014-05-07 14:13:34 +02:00
Martin Willi f8223f5f7e mem-cred: Replace existing equal private keys during add_key() 2014-05-07 14:13:34 +02:00
Andreas Steffen a81bd670b0 Added PUBKEY_RSA_MODULUS encoding type 2014-05-02 19:50:43 +02:00
Andreas Steffen 98ae0492b6 Added support for msSmartcardLogon EKU 2014-04-08 13:09:03 +02:00
Tobias Brunner 3b09c02ec0 Properly hash pointers for hash tables where appropriate 
Simply using the pointer is not optimal for our hash table
implementation, which simply masks the key to determine the bucket.
 2014-03-31 14:32:44 +02:00
Martin Willi 83f8cdde46 auth-cfg: Declare an attribute certificate helper type to exchange acerts 2014-03-31 11:14:58 +02:00
Martin Willi 8f9e2dbcd5 x509: Replace the comma separated string AC group builder with a list based one 2014-03-31 11:14:58 +02:00
Martin Willi a17598bc69 x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t 
The ietf_attributes_t class is used for attribute certificates only these days,
and integrating them to x509_ac_t simplifies things significantly.
 2014-03-31 11:14:58 +02:00
Martin Willi 61b2d815b9 x509: Replace fixed acert group string getter by a more dynamic group enumerator 2014-03-31 11:14:58 +02:00
Martin Willi 883a63adc1 ac: Remove unimplemented equals_holder() method from ac_t 2014-03-31 11:14:57 +02:00
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Tobias Brunner 71c9565a3a pki: Replace BUILD_FROM_FD with passing a chunk via BUILD_BLOB 
This allows more than one builder to try parsing the data read from STDIN.
 2013-10-23 17:20:39 +02:00
Tobias Brunner f40e9f4d16 sshkey: Add encoder for RSA keys 2013-09-13 15:23:49 +02:00
Tobias Brunner 0ceb288815 Fix various API doc issues and typos 
Partially based on an old patch by Adrian-Ken Rueegsegger.
 2013-07-18 18:30:36 +02:00
Martin Willi 4d7a762871 credmgr: introduce a hook function to catch trust chain validation errors 2013-07-18 16:00:30 +02:00
Martin Willi 5d36f04ee2 credmgr: stop querying for secrets once we get a perfect match 2013-07-18 12:17:54 +02:00
Martin Willi 69039e83f8 credmgr: don't use pointers for id_match_t enum values 2013-07-18 12:17:54 +02:00
Martin Willi 926776ec80 auth-cfg: use array instead of linked list 
Saves another 4 linked lists (1KB) per IKE_SA
 2013-07-17 17:20:18 +02:00
Tobias Brunner abc04e6b3f Remove pluto specific certificate types 2013-05-08 15:02:40 +02:00
Tobias Brunner feef637368 Add pkcs12 plugin which adds support for decoding PKCS#12 containers 2013-05-08 15:02:39 +02:00
Tobias Brunner 8e48e0009a Add support for PKCS#7/CMS encrypted-data 2013-05-08 15:02:39 +02:00
Tobias Brunner d41e54c68d Move PKCS#12 key derivation to a separate file 2013-05-08 15:02:39 +02:00
Tobias Brunner cc4408abcb sshkey: Added builder for SSHKEY RSA keys 2013-05-07 15:38:28 +02:00
Tobias Brunner d307be7f6c Add a method to replace all secrets in a mem_cred_t object 2013-03-20 15:27:34 +01:00
Martin Willi e82deaf6ce Merge branch 'multi-cert' 
Allows the configuration of multiple certificates in leftcert, and select
the correct certificate to use based on the received certificate requests.
 2013-03-01 11:35:32 +01:00
Martin Willi adf239abca Merge branch 'systime' 
Add a systime-fix plugin allowing an embedded system to validate certificates
if the system time has not been synchronized after boot. Certificates of
established tunnels can be re-validated after the system time gets valid.
 2013-03-01 11:33:47 +01:00
Tobias Brunner 8656f35ae1 Fix auth_cfg_t.clone() for single-valued auth rules 
By using the default list enumerator and adding the rules with the public
add() method, clones of auth_cfg_t objects would return the values for
single-valued auth rules in the wrong order (i.e. the oldest instead of the
newest value was returned).  Using the internal enumerator (which the comment
already suggested) fixes this, but the clone will not be a full clone as
it does not contain any old values for single-valued auth rules.  Since
these will never be used anyway, this should be fine.
 2013-02-28 18:11:38 +01:00
Martin Willi de399f550d Add a cert_validator hook allowing plugins to provide custom lifetime checking 2013-02-19 14:31:18 +01:00
Martin Willi 790e00aaa9 Make cert_validator_t.validate optional to implement 2013-02-19 14:31:18 +01:00
Andreas Steffen a4ddc0bb26 Encode RSA public keys in RFC 3110 DNSKEY format 2013-02-19 12:25:00 +01:00
Martin Willi 51dbcf6497 After merging the used trustchain with config, move used certificate to front 2013-01-18 11:59:27 +01:00
Martin Willi 9a06a93ce7 Try to build a trustchain for all configured certificates before enforcing one 
This enables the daemon to select from multiple configured certificates
by building trustchains against the received certificate requests.
 2013-01-18 09:33:15 +01:00
Martin Willi f29783af8c Make AUTH_RULE_SUBJECT cert multi-valued 
Constraints having multiple subject certs defined are fulfilled if
authentication used one of the listed certificates.
 2013-01-18 09:33:15 +01:00
Martin Willi e96d945dcd Fix doxygen grouping regarding containers and PKCS#7 2012-12-19 10:32:08 +01:00
Martin Willi 063ae4e52a Allocate data returned by pkcs7_t.get_attribute() 2012-12-19 10:32:08 +01:00
Martin Willi 8ccf5a4731 Fix enum names for container_type_t 2012-12-19 10:32:08 +01:00
Martin Willi 9e967d7dda Add an enumerator for PKCS#7 contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi d3d706f4fc Add a getter for signed PKCS#7 attributes 2012-12-19 10:32:08 +01:00
Martin Willi 637a8abb72 Add builder parts to generate PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi fc67a932ba Add a generic interface for crypto containers and a more specific PKCS#7 interface 2012-12-19 10:32:07 +01:00
Andreas Steffen 48b23d06a8 allow the optional sharing if RSA private keys 2012-11-22 00:34:42 +01:00
Andreas Steffen 168ee460c6 implemented generation of safe primes 2012-11-18 19:22:31 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 35e2afd459 Fix equality comparison of auth_cfg_t 
We previously only confirmed that rules contained in the first config are also
contained in the second, but since the number of rules does not have to
be equal, it might be that the second config contains rules that the
first one doesn't.
 2012-09-18 14:40:41 +02:00
Tobias Brunner 3a8852c76f Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator 
If it is set on an auth config IDr will not be sent, and later the configured
identity will not only be checked against the returned IDr, but also
against other identities contained in the responder's certificate.
 2012-09-18 11:16:10 +02:00
Tobias Brunner 36a3981d47 Comment fixed 2012-08-13 13:17:53 +02:00