denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,778 Commits 1 Branch 0 Tags
92a10e4645af25b390b7c7e05fe9650d4e83a070
Commit Graph
216 Commits
Author SHA1 Message Date
Tobias Brunner 92a10e4645 x509: Manually print CRL/OCSP URIs when fuzzing 
This avoids a warning about the custom %Y printf specifier.
 2017-05-23 18:29:12 +02:00
Tobias Brunner 388351609d x509: Fix leak if there is an empty CDP 2017-05-23 18:29:11 +02:00
Tobias Brunner 5e37f7e550 x509: Fix leak if a certificate contains multiple authorityKeyIdentifiers 2017-05-23 18:29:11 +02:00
Andreas Steffen b0dcf33f0f x509: Evaluate return codes of parsing functions 2017-05-08 16:44:25 +02:00
Martin Willi a115f48428 x509: Do not mark generated addrblock extension as critical 
While RFC 3779 says we SHOULD mark it is critical, this has severe side effects
in practice. The addrblock extension is not widely used nor implemented, and
only a few applications can handle this extension. By marking it critical,
none of these applications can make use of such certificates where included
addrblocks do not matter, such as TLS/HTTPS.

If an application wants to make use of addrblocks, that is usually an explicit
decision. Then the very same application obviously can handle addrblocks, and
there is no need for the extension to be critical. In other words, for local
policy checks it is a local matter to handle the extension, hence making it
critical is usually not of much help.
 2017-02-27 09:36:48 +01:00
Martin Willi 6734d7a51a x509: Support encoding the RFC 3779 addrblock extension 2017-02-27 09:36:48 +01:00
Tobias Brunner 9aaea4dbfe x509: Properly wrap keyid in authorityKeyIdentifier in attribute certificates 
The correct encoding got lost in bdec2e4f52 ("refactored openac and
its attribute certificate factory").

Fixes #1370.
 2016-06-06 13:46:11 +02:00
Andreas Steffen ef43df6cbe Allow msSmartcardLogon EKU to be built 2015-12-11 18:26:54 +01:00
Andreas Steffen fd90f0613c Print OCSP single responses 2015-12-11 18:26:53 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Tobias Brunner 6133770db4 x509: Use subjectKeyIdentifier provided by issuer cert when checking CRL issuer 
Some CAs don't use SHA-1 hashes of the public key as subjectKeyIdentifier and
authorityKeyIdentifier.  If that's the case we can't force the
calculation of the hash to compare that to authorityKeyIdentifier in the CRL,
instead we use the subjectKeyIdentifier stored in the issuer certificate, if
available.  Otherwise, we fall back to the SHA-1 hash (or comparing the
DNs) as before.
 2015-03-06 16:49:12 +01:00
Martin Willi b851f0a105 x509: Fix public key reference leak if authority key identifier does not match 2015-02-06 13:58:58 +01:00
Andreas Steffen b6bb32e658 Implemented full BLISS support for IKEv2 public key authentication and the pki tool 2014-11-29 14:51:18 +01:00
Andreas Steffen 7143667bdd Skip the unused bits field of the ASN.1 BIT STRING encoding 2014-11-29 14:51:17 +01:00
Martin Willi c079c098c4 x509: Check return value when signing attribute certificates 
In addition that this lets AC generation fail properly if private key signing
fails, it also fixes an issue when compiling on Windows with MinGW 4.8.1, where
for some reason the attributeCertificateInfo got encoded incorrectly.
 2014-06-04 15:53:12 +02:00
Martin Willi 2dbb719b76 x509: Undef OCSP_RESPONSE from <wincrypt.h> before using it 2014-06-04 15:53:02 +02:00
Martin Willi 4163421f91 plugins: Don't link with -rdynamic on Windows 2014-06-04 15:53:02 +02:00
Martin Willi fb515325cc x509: Remove some unused ASN1 OID constants 2014-05-16 15:42:06 +02:00
Tobias Brunner f7d04ba6c4 x509: Don't include authKeyIdentifier in self-signed certificates 
As the comment indicates this was the intention in
d7be290643 all along.
 2014-04-09 16:06:18 +02:00
Tobias Brunner 3f3680ec3f x509: Initialize certs when building optionalSignature for OCSP requests 2014-04-09 16:06:17 +02:00
Andreas Steffen 98ae0492b6 Added support for msSmartcardLogon EKU 2014-04-08 13:09:03 +02:00
Tobias Brunner 5119c5fe97 x509: CERT_DECODE actually requires KEY_ANY 
More specific decoders might still be needed, but the x509
plugin should not care which ones.
 2014-03-31 14:32:44 +02:00
Martin Willi b06283f1e3 x509: Match acert has_subject() against entityName or holder serial 
This allows us to find attribute certificates for a subject certificate in
credential sets.
 2014-03-31 11:14:58 +02:00
Martin Willi 8f9e2dbcd5 x509: Replace the comma separated string AC group builder with a list based one 2014-03-31 11:14:58 +02:00
Martin Willi a17598bc69 x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t 
The ietf_attributes_t class is used for attribute certificates only these days,
and integrating them to x509_ac_t simplifies things significantly.
 2014-03-31 11:14:58 +02:00
Martin Willi 61b2d815b9 x509: Replace fixed acert group string getter by a more dynamic group enumerator 2014-03-31 11:14:58 +02:00
Martin Willi a9bfd4b055 x509: Skip parsing of acert chargingIdentity, as we don't use it anyway 2014-03-31 11:14:58 +02:00
Martin Willi 3134379ac7 x509: Fix some whitespaces and do some minor style cleanups in acert 2014-03-31 11:14:57 +02:00
Tobias Brunner ab13364c65 uclibc only defines strndup(3) if _GNU_SOURCE is defined 
References #516.
 2014-02-19 16:11:47 +01:00
Tobias Brunner 8dc6e71632 lib: All settings use configured namespace 2014-02-12 14:34:32 +01:00
Martin Willi 19cb07b890 automake: replace INCLUDES by AM_CPPFLAGS 
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
 2013-07-18 14:59:19 +02:00
Andreas Steffen 126778679f Recognize critical IssuingDistributionPoint CRL extension 2013-07-12 09:00:47 +02:00
Martin Willi ed1c430334 certificate_t.has_subject() matches for certificate serialNumber 2012-12-19 10:32:07 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner a05f3b2021 Make sure first argument is an int when using %.*s to print e.g. chunks 2012-09-28 18:01:49 +02:00
Tobias Brunner 10b116aa13 Properly initialize chunk for extension OID when parsing CRLs 2012-09-28 15:41:32 +02:00
Martin Willi 87dd205b61 Add a return value to hasher_t.allocate_hash() 2012-07-16 14:55:06 +02:00
Tobias Brunner ae56e1eb97 Check rng return value when generating OCSP nonces 2012-07-16 14:53:35 +02:00
Martin Willi a37f2d2006 certificate_t->issued_by takes an argument to receive signature scheme 2012-06-12 14:24:49 +02:00
Tobias Brunner 79d5c4f06b Fixed return values of several functions (e.g. return FALSE for pointer types). 2012-05-31 17:39:04 +02:00
Martin Willi 0c7af2ce27 Certificate decoding soft-depends on public key decoding of specific types 2012-05-02 14:05:52 +02:00
Martin Willi b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
 2012-03-20 17:57:53 +01:00
Tobias Brunner f29a4f1c64 Added support for iKEIntermediate X.509 extended key usage flag. 
Mac OS X requires server certificates to have this flag set.
 2012-03-20 17:31:24 +01:00
Tobias Brunner 00cc2188d4 Some whitespace fixes. 2012-03-20 17:31:24 +01:00
Adrian-Ken Rueegsegger d887b8e134 Fix whitespaces 2012-01-12 11:25:18 +01:00
Tobias Brunner e86b685da5 Allow callers to force ASN.1 date encoding as GENERALIZEDTIME. 2011-12-23 18:07:39 +01:00
Tobias Brunner 1267127c11 Properly ASN.1 encode dates in certificates depending on the year. 2011-12-23 16:29:41 +01:00
Tobias Brunner eb497205e3 Log most X.509 related messages in new ASN log group. 2011-12-16 16:44:38 +01:00
Thomas Egerer c230885a07 Fix resource leak in x509_ocsp_response 2011-11-04 11:11:17 +01:00