denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,249 Commits 1 Branch 0 Tags
985d7b1c67213400a7c9ca389caaab0a09f80eb5
Commit Graph
12005 Commits
Author SHA1 Message Date
Tobias Brunner 985d7b1c67 openssl: Update PKCS#12 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner a9f388e368 openssl: Update PKCS#7 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 989ba4b6cd openssl: Update CRL API to OpenSSL 1.1.0 
There is currently no way to compare the outer and inner algorithms
encoded in a parsed CRL.  X509_CRL_verify() does not seem to check that
either, though (unlike X509_verify()).
 2016-06-29 11:09:37 +02:00
Tobias Brunner 08d7e1f190 openssl: Update x509 API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 6688f7986e openssl: Update ECDSA API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 3fb2c8edb7 openssl: Update RSA API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 375a5ed240 openssl: Make some utilities take const BIGNUM pointers 2016-06-29 11:09:37 +02:00
Tobias Brunner 6d5df086f7 openssl: Add macro to define fallback functions for non-opaque OpenSSL versions 2016-06-29 11:09:37 +02:00
Tobias Brunner 54d629b7ad openssl: Update DH API to OpenSSL 1.1.0 2016-06-29 11:09:37 +02:00
Tobias Brunner 1b36fbedf5 openssl: Update crypter API to OpenSSL 1.1.0 
EVP_CIPHER and EVP_CIPHER_CTX are now opaque types, the getters already
existed before.
 2016-06-29 11:09:37 +02:00
Tobias Brunner faa904fb0b openssl: Fix mapping from ASN1 to chunk_t with OpenSSL 1.1.0 
ASN1_OBJECT is now opaque.
 2016-06-29 11:09:37 +02:00
Tobias Brunner e2abe7ae97 openssl: Update initialization and cleanup for OpenSSL 1.1.0 
We can't call OPENSSL_cleanup() as that would prevent us from
re-initializing the library again (which we use in the Android app, that
loads/unloads plugins).
 2016-06-29 11:09:36 +02:00
Tobias Brunner a6c43a8d8a openssl: OpenSSL 1.1.0 is thread-safe so we don't have to setup callbacks 2016-06-29 11:09:36 +02:00
Tobias Brunner 08fe609ce2 android: Actually add Android.mk for libtpmtss 2016-06-28 14:34:13 +02:00
Tobias Brunner 6b726b6fb2 android: Fix build after adding libtpmtss 2016-06-28 11:28:15 +02:00
Andreas Steffen b031593641 libtpmtss: Added to integrity checks 2016-06-26 18:19:05 +02:00
Andreas Steffen 2343c48341 aikpub2: Output AIK signature algorithm 2016-06-26 18:19:05 +02:00
Andreas Steffen 721ed31b39 Refactoring to tpm_tss_quote_info object 2016-06-26 18:19:05 +02:00
Andreas Steffen 12e1a06987 libimcv: Changed debug level for functional components from 2 to 3 2016-06-26 18:19:05 +02:00
Andreas Steffen 57e80492eb libtpmtss: Implemented TSS2 quote() method 2016-06-26 18:19:05 +02:00
Andreas Steffen bc67802ac8 libtpmtss: Implemented TSS2 read_pcr() method 2016-06-22 15:33:44 +02:00
Andreas Steffen 30d4989aec libimcv: migrate pts to tpm_tss 2016-06-22 15:33:44 +02:00
Andreas Steffen 8301dc859c libtpmtss: Get TPM 2.0 capabilities 2016-06-22 15:33:44 +02:00
Andreas Steffen fedc6769dc libtpmtss: Retrieve TPM 1.2 version info 2016-06-22 15:33:43 +02:00
Andreas Steffen c08753bdf4 Created libtpmtss library handling access to v1.2 and v2.0 TPMs 2016-06-22 15:33:43 +02:00
Andreas Steffen 6337770845 aikpub2: --handle option retrieves public key from TPM 2.0 NVRAM 2016-06-22 15:33:43 +02:00
Andreas Steffen 87d356dc47 aikpub2: Convert TSS 2.0 AIK public key blob into PKCS#1 format 2016-06-22 15:33:43 +02:00
Tobias Brunner 5435a9a062 unit-tests: Add tests for expires after CHILD_SA rekeying 2016-06-17 18:48:08 +02:00
Tobias Brunner 15cea08adc child-rekey: Only rekey installed CHILD_SAs 
Depending on the lifetimes a CHILD_SA we rekeyed as responder might
expire shortly afterwards.  We don't want to rekey it again.

When retrying due to an INVALID_KE_PAYLOAD notify the expected state
is CHILD_REKEYING if it is anything else (e.g. due to a collision) we
ignore it.

We also abort the exchange properly if we don't find the CHILD_SA, no
need for an empty INFORMATIONAL exchange anymore.
 2016-06-17 18:48:08 +02:00
Tobias Brunner de4e4687ff Report test coverage of libcharon and starter 2016-06-17 18:48:08 +02:00
Tobias Brunner d707a19733 unit-tests: Add test for CHILD_SA rekey if a retry due to an INVALID_KE_PAYLOAD is delayed 2016-06-17 18:48:08 +02:00
Tobias Brunner 6d8041d46b child-rekey: Ignore failed colliding CHILD_SA rekeyings 
If a passive rekeying fails due to an INVALID_KE_PAYLOAD we don't want
to consider this task later when resolving collisions.  This previously
might have caused the wrong SA to get deleted/installed based on the nonces
in the unsuccessful exchange.
 2016-06-17 18:48:08 +02:00
Tobias Brunner b4f24ac0f6 unit-tests: Add test for collision between IKE_SA rekey and CHILD_SA creation 2016-06-17 18:48:08 +02:00
Tobias Brunner b92f11c3bd child-create: Retry creating the CHILD_SA if TEMPORARY_FAILURE is received 
We queue a delayed task that is initiated after a while.
 2016-06-17 18:48:07 +02:00
Tobias Brunner 208678e6e1 ikev2: Add possibility to delay initiation of a queued task 
Such a task is not initiated unless a certain time has passed.  This
allows delaying certain tasks but avoids problems if we'd do this
via a scheduled job (e.g. if the IKE_SA is rekeyed in the meantime).

If the IKE_SA is rekeyed the delay of such tasks is reset when the
tasks are adopted i.e. they get executed immediately on the new IKE_SA.

This hasn't been implemented for IKEv1 yet.
 2016-06-17 18:48:07 +02:00
Tobias Brunner 4e2e7d4fec ike: Reduce RETRY_INTERVAL a bit 
Retry exchanges between 5 and 15 seconds after a temporary failure.
 2016-06-17 18:48:07 +02:00
Tobias Brunner 2045cadc1c ike-rekey: Return TEMPORARY_FAILURE when concurrently creating a CHILD_SA 2016-06-17 18:48:07 +02:00
Tobias Brunner 46cbdcace9 unit-tests: Add tests for IKE rekeying if INVALID_KE_PAYLOAD notifies are received 2016-06-17 18:48:07 +02:00
Tobias Brunner 0a954d6789 ike: Add configuration option to switch to preferring supplied proposals over local ones 2016-06-17 18:48:07 +02:00
Tobias Brunner f2ea230b91 child-cfg: Add option to prefer supplied proposals over locally configured ones 2016-06-17 18:48:07 +02:00
Tobias Brunner 3a40d572c6 ike-cfg: Add option to prefer supplied proposals over locally configured ones 2016-06-17 18:48:07 +02:00
Tobias Brunner f5e8bc18fd proposal: Remove MODP_NONE from IKE proposals parsed from strings 2016-06-17 18:48:07 +02:00
Tobias Brunner aae9510148 proposal: Handle MODP_NONE in both directions when selecting proposals 2016-06-17 18:48:07 +02:00
Tobias Brunner 2f211ced9c proposal: Parse modpnone as MODP_NONE(0) 2016-06-17 18:48:07 +02:00
Tobias Brunner 09711198a7 ike-rekey: Make sure to ignore task when detecting collisions if ike-init subtask failed 
For instance, if INVALID_KE_PAYLOAD is returned we don't want this task
to affect any active rekeying (no new SA has been established so far).
 2016-06-17 18:48:06 +02:00
Tobias Brunner 2e33d1f9ae unit-tests: Add test for rekey collision if one CREATE_CHILD_SA response is delayed 2016-06-17 18:48:06 +02:00
Tobias Brunner 566134b25a unit-tests: Add tests for IKE_SA rekeying if collision is not detected by one peer 2016-06-17 18:48:06 +02:00
Tobias Brunner f67199378d ike-rekey: Handle undetected collisions also if delete is delayed 
If the peer does not detect the rekey collision and deletes the old
IKE_SA and then receives the colliding rekey request it will respond with
TEMPORARY_FAILURE.  That notify may arrive before the DELETE does, in
which case we may just conclude the rekeying initiated by the peer.

Also, since the IKE_SA is destroyed in any case when we receive a delete
there is no point in storing the delete task in collide() as process_i()
in the ike-rekey task will never be called.
 2016-06-17 18:48:06 +02:00
Tobias Brunner 7426576184 ike-rekey: There is no passive reauth task, so it will never collide with one 2016-06-17 18:48:06 +02:00
Tobias Brunner 724d65900c ike-rekey: Ignore colliding rekey tasks that did not create an IKE_SA 
This simplifies collision handling and we don't need to know about these
tasks when concluding the rekeying we initiated.
 2016-06-17 18:48:06 +02:00