denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,500 Commits 1 Branch 0 Tags
91d71abb16a9b15bbcd7f6cbefb806408be3b92d
Commit Graph
12500 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 91d71abb16 revocation: Restrict OCSP signing to specific certificates 
To avoid considering each cached OCSP response and evaluating its trustchain,
we limit the certificates considered for OCSP signing to:

- The issuing CA of the checked certificate
- A directly delegated signer by the same CA, having the OCSP signer constraint
- Any locally installed (trusted) certificate having the OCSP signer constraint

The first two options cover the requirements from RFC 6960 2.6. For
compatibility with non-conforming CAs, we allow the third option as exception,
but require the installation of such certificates locally.
 2014-03-31 14:40:33 +02:00
Martin Willi a844b65890 revocation: Don't merge auth config of CLR/OCSP trustchain validation 
This behavior was introduced with 6840a6fb to avoid key/signature strength
checking for the revocation trustchain as we do it for end entity certificates.
Unfortunately this breaks CA constraint checking under certain conditions, as
we merge additional intermediate/CA certificates to the auth config.

As key/signature strength checking of the revocation trustchain is a rather
exotic requirement we drop support for that to properly enforce CA constraints.
 2014-03-31 14:40:33 +02:00
Tobias Brunner efce234de4 hashtable: Make key arguments const 
This allows using const strings etc. for lookups without cast. And keys
are not modifiable anyway.
 2014-03-31 14:32:45 +02:00
Tobias Brunner 3b09c02ec0 Properly hash pointers for hash tables where appropriate 
Simply using the pointer is not optimal for our hash table
implementation, which simply masks the key to determine the bucket.
 2014-03-31 14:32:44 +02:00
Tobias Brunner 7522fcffd2 kernel-pfroute: Let get_nexthop() default to destination address 2014-03-31 14:32:44 +02:00
Tobias Brunner 5119c5fe97 x509: CERT_DECODE actually requires KEY_ANY 
More specific decoders might still be needed, but the x509
plugin should not care which ones.
 2014-03-31 14:32:44 +02:00
Tobias Brunner 0524028054 pkcs1: KEY_ANY public key decoder soft depends on specific decoders 2014-03-31 14:32:44 +02:00
Tobias Brunner 00b91c4325 eap-radius: Add option to not close IKE_SAs on timeouts during interim accouting updates 
Fixes #528.
 2014-03-31 14:32:44 +02:00
Tobias Brunner a30e0001e4 ikev1: Accept SPI size of any length <= 16 in ISAKMP proposal 
Fixes #533.
 2014-03-31 14:32:44 +02:00
Tobias Brunner a213944d4a proposal: Don't fail DH proposal matching if peer includes NONE 
The DH transform is optional for ESP/AH proposals. The initiator can
include NONE (0) in its proposal to indicate that while it prefers to
do a DH exchange, the responder may still decide to not do so.

Fixes #532.
 2014-03-31 14:32:44 +02:00
Tobias Brunner 9fa7b03769 conf: Order settings in man page alphabetically 
For the config snippets the options are now explicitly ordered before
subsections.
 2014-03-31 14:32:44 +02:00
Martin Willi 1766ede330 Merge branch 'acerts' 
(Re-)Introduces X.509 Attribute Certificate support in IKE, and cleans up the
x509 AC parser/generator. ACs may be stored locally or exchanged in IKEv2
CERT payloads, Attribute Authorities must be installed locally. pki --acert
issues Attribute Certificates and replaces the removed openac utility.
 2014-03-31 12:14:55 +02:00
Martin Willi 8101e6aa17 NEWS: Add acert and pki changes for 5.1.3 2014-03-31 11:39:25 +02:00
Martin Willi dbd4fc074a openac: Remove obsolete openac utility 
The same functionality is now provided by the pki --acert subcommand.
 2014-03-31 11:39:25 +02:00
Martin Willi 3941d55f01 pki: Document --not-before/after and --dateform options in manpages 2014-03-31 11:39:25 +02:00
Martin Willi 2769a22e1f pki: Support absolute --this/next-update CRL lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi d6e921181a pki: Support absolute --not-before/after issued certificate lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi aa8732eb68 pki: Support absolute --not-before/after self-signed certificate lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi 6f90e8e664 pki: Support absolute --not-before/after acert lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi 06d3b6e9c9 pki: Add a certificate lifetime calculation helper function 2014-03-31 11:14:59 +02:00
Martin Willi babd848778 testing: Add an acert test that forces a fallback connection based on groups 2014-03-31 11:14:59 +02:00
Martin Willi 1a4d3222be testing: Add an acert test case sending attribute certificates inline 2014-03-31 11:14:59 +02:00
Martin Willi 9f676321a9 testing: Add an acert test using locally cached attribute certificates 2014-03-31 11:14:59 +02:00
Martin Willi c602ee65dc testing: build strongSwan with acert plugin 2014-03-31 11:14:59 +02:00
Martin Willi 3a2deb98bc ikev2: Cache all received attribute certificates to auth config 2014-03-31 11:14:59 +02:00
Martin Willi d417900335 ikev2: Send all known and valid attribute certificates for subject cert 2014-03-31 11:14:59 +02:00
Martin Willi a14f7edfb2 ikev2: Slightly refactor certificate payload construction to separate functions 2014-03-31 11:14:58 +02:00
Martin Willi f316116c88 ike: Support encoding of attribute certificates in CERT payloads 2014-03-31 11:14:58 +02:00
Martin Willi 83f8cdde46 auth-cfg: Declare an attribute certificate helper type to exchange acerts 2014-03-31 11:14:58 +02:00
Martin Willi 5ac0e66879 acert: Implement a plugin finding, validating and evaluating attribute certs 
This validator checks for any attribute certificate it can find for validated
end entity certificates and tries to extract group membership information
used for connection authorization rules.
 2014-03-31 11:14:58 +02:00
Martin Willi b06283f1e3 x509: Match acert has_subject() against entityName or holder serial 
This allows us to find attribute certificates for a subject certificate in
credential sets.
 2014-03-31 11:14:58 +02:00
Martin Willi 6e8c665a51 pki: Add acert and extend pki/print manpages 2014-03-31 11:14:58 +02:00
Martin Willi 35a783cff7 pki: Implement an acert command to issue attribute certificates 2014-03-31 11:14:58 +02:00
Martin Willi 20ea84daec pki: Support printing attribute certificates 2014-03-31 11:14:58 +02:00
Martin Willi e49197f15e pki: Don't generate negative random serial numbers in X.509 certificates 
According to RFC 5280 4.1.2.2 we MUST force non-negative serial numbers.
 2014-03-31 11:14:58 +02:00
Martin Willi 0226ca886d pem: Support encoding of attribute certificates 
While there is no widely used PEM header for attribute certificates, at least
IAIK-JCE uses BEGIN ATTRIBUTE CERTIFICATE:

  http://javadoc.iaik.tugraz.at/iaik_jce/current/iaik/utils/Util.html#toPemString(iaik.x509.attr.AttributeCertificate)
 2014-03-31 11:14:58 +02:00
Martin Willi 8f9e2dbcd5 x509: Replace the comma separated string AC group builder with a list based one 2014-03-31 11:14:58 +02:00
Martin Willi a17598bc69 x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t 
The ietf_attributes_t class is used for attribute certificates only these days,
and integrating them to x509_ac_t simplifies things significantly.
 2014-03-31 11:14:58 +02:00
Martin Willi 61b2d815b9 x509: Replace fixed acert group string getter by a more dynamic group enumerator 2014-03-31 11:14:58 +02:00
Martin Willi a9bfd4b055 x509: Skip parsing of acert chargingIdentity, as we don't use it anyway 2014-03-31 11:14:58 +02:00
Martin Willi 3134379ac7 x509: Fix some whitespaces and do some minor style cleanups in acert 2014-03-31 11:14:57 +02:00
Martin Willi 883a63adc1 ac: Remove unimplemented equals_holder() method from ac_t 2014-03-31 11:14:57 +02:00
Andreas Steffen 959ef1a2e4 Added libipsec/net2net-3des scenario 2014-03-28 09:21:51 +01:00
Andreas Steffen 7afd217ff9 Renewed self-signed OCSP signer certificate 2014-03-27 22:52:11 +01:00
Tobias Brunner 0462304dbb unit-tests: Fix filtered enumerator tests on 64-bit big-endian platforms 
In case of sizeof(void*) == 8 and sizeof(int) == 4 on big-endian hosts
the tests failed as the actual integer value got cut off.
 2014-03-27 15:35:32 +01:00
Tobias Brunner 29b7377530 travis: Run the "all" test case with leak detective enabled 
But disable the gcrypt plugin, as it causes leaks.

Also disable the backtraces by libunwind as they seem to cause
threads to get cleaned up after the leak detective already has been
disabled, which leads to invalid free()s.
 2014-03-27 10:52:45 +01:00
Tobias Brunner 58d8c52190 unit-tests: Fix memory leak in ntru tests 2014-03-27 10:52:45 +01:00
Andreas Steffen 045f25fc81 Version bump to 5.1.3rc1 2014-03-26 22:00:00 +01:00
Andreas Steffen c6d173a1f1 Check that valid OCSP responses are received in the ikev2/ocsp-multi-level scenario 2014-03-24 23:57:55 +01:00
Andreas Steffen bee64a82d7 Updated expired certificates issued by the Research and Sales Intermediate CAs 2014-03-24 23:38:45 +01:00