denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
10,428 Commits 1 Branch 0 Tags
9a06a93ce7195a14b0e33d68e127c9207b14878f
Commit Graph
236 Commits
Author SHA1 Message Date
Martin Willi 9a06a93ce7 Try to build a trustchain for all configured certificates before enforcing one 
This enables the daemon to select from multiple configured certificates
by building trustchains against the received certificate requests.
 2013-01-18 09:33:15 +01:00
Martin Willi f29783af8c Make AUTH_RULE_SUBJECT cert multi-valued 
Constraints having multiple subject certs defined are fulfilled if
authentication used one of the listed certificates.
 2013-01-18 09:33:15 +01:00
Martin Willi e96d945dcd Fix doxygen grouping regarding containers and PKCS#7 2012-12-19 10:32:08 +01:00
Martin Willi 063ae4e52a Allocate data returned by pkcs7_t.get_attribute() 2012-12-19 10:32:08 +01:00
Martin Willi 8ccf5a4731 Fix enum names for container_type_t 2012-12-19 10:32:08 +01:00
Martin Willi 9e967d7dda Add an enumerator for PKCS#7 contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi d3d706f4fc Add a getter for signed PKCS#7 attributes 2012-12-19 10:32:08 +01:00
Martin Willi 637a8abb72 Add builder parts to generate PKCS#7 containers 2012-12-19 10:32:07 +01:00
Martin Willi fc67a932ba Add a generic interface for crypto containers and a more specific PKCS#7 interface 2012-12-19 10:32:07 +01:00
Andreas Steffen 48b23d06a8 allow the optional sharing if RSA private keys 2012-11-22 00:34:42 +01:00
Andreas Steffen 168ee460c6 implemented generation of safe primes 2012-11-18 19:22:31 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Tobias Brunner 35e2afd459 Fix equality comparison of auth_cfg_t 
We previously only confirmed that rules contained in the first config are also
contained in the second, but since the number of rules does not have to
be equal, it might be that the second config contains rules that the
first one doesn't.
 2012-09-18 14:40:41 +02:00
Tobias Brunner 3a8852c76f Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator 
If it is set on an auth config IDr will not be sent, and later the configured
identity will not only be checked against the returned IDr, but also
against other identities contained in the responder's certificate.
 2012-09-18 11:16:10 +02:00
Tobias Brunner 36a3981d47 Comment fixed 2012-08-13 13:17:53 +02:00
Martin Willi 6a8786b55f Show which group would be required when failing in constraint check 2012-07-26 12:39:53 +02:00
Martin Willi dfd34c5a77 Add an option to disable libstrongswan certificate caching 2012-07-09 19:03:10 +02:00
Martin Willi 918e92c4c9 Support multiple different public key strength types in constraints 2012-06-12 14:24:49 +02:00
Martin Willi fd4ff11858 Add signature schemes to auth_cfg during trustchain validation 2012-06-12 14:24:49 +02:00
Martin Willi a37f2d2006 certificate_t->issued_by takes an argument to receive signature scheme 2012-06-12 14:24:49 +02:00
Martin Willi 439d0742e9 Define auth_cfg rules for signature schemes 2012-06-12 14:24:49 +02:00
Martin Willi b24be29646 Merge branch 'ikev1' 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/encoding/generator.c
	src/libcharon/encoding/payloads/notify_payload.c
	src/libcharon/encoding/payloads/notify_payload.h
	src/libcharon/encoding/payloads/payload.c
	src/libcharon/network/receiver.c
	src/libcharon/sa/authenticator.c
	src/libcharon/sa/authenticator.h
	src/libcharon/sa/ikev2/tasks/ike_init.c
	src/libcharon/sa/task_manager.c
	src/libstrongswan/credentials/auth_cfg.c
 2012-05-02 11:12:31 +02:00
Tobias Brunner 7e84c4275c Removed auth_cfg_t.replace_value() and replaced usages with add(). 
replace_value() was used to replace identities. Since for these the latest is
now returned by get(), adding the new identity with add() is sufficient.
 2012-04-18 18:50:14 +02:00
Tobias Brunner ebc1ffe451 Changed the order and semantics of rules we expect only once in auth_cfg_t. 
These rules are now inserted at the front of the internal list, this
allows to retrieve the rule added last with get(). For other rules the
order in which they are added is maintained (this allows to properly
enumerate them).
 2012-04-18 18:50:14 +02:00
Tobias Brunner 68cca941cf Added a simple method to replace the value of a rule in auth_cfg_t. 2012-04-16 13:44:27 +02:00
Martin Willi b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
 2012-03-20 17:57:53 +01:00
Martin Willi 5aef6bd0f3 Accept NULL auth_cfg_t passed to credential_manager_t.get_private() 2012-03-20 17:31:39 +01:00
Martin Willi 3d86d76b86 Fixed create_shared_enumerator method description 2012-03-20 17:31:31 +01:00
Martin Willi 747f837cce Added a flag to register local credential sets exclusively, disabling all others 2012-03-20 17:31:28 +01:00
Tobias Brunner f29a4f1c64 Added support for iKEIntermediate X.509 extended key usage flag. 
Mac OS X requires server certificates to have this flag set.
 2012-03-20 17:31:24 +01:00
Tobias Brunner 00cc2188d4 Some whitespace fixes. 2012-03-20 17:31:24 +01:00
Martin Willi f5e5c5edbd Added an XAUTH identity to use or require for XAuth authentication 2012-03-20 17:31:23 +01:00
Martin Willi fd2a491b31 Stop checking once a key size constraint is not fulfilled 2012-03-20 17:31:23 +01:00
Martin Willi 45956d15ea Free list after removing the last local credential set, fixes a leak report 2012-03-20 17:31:19 +01:00
Martin Willi 21c916886d Added missing XAuth auth_class enum name 2012-03-20 17:31:16 +01:00
Martin Willi 6ebcbc654c Added auth_cfg option to select XAUTH backend to use 2012-03-20 17:31:15 +01:00
Martin Willi 96c9159d96 Use a second authentication config to configure XAUTH authentication 2012-03-20 17:31:15 +01:00
Martin Willi b4e815354c Map auth_class to auth method and IKEv1 proposal attribute 2012-03-20 17:30:53 +01:00
Clavister OpenSource 23f4e4b42d IKEv1 XAUTH: Added ability to configure XAUTH+PSK. Added task to handle XAUTH requests. Modified task_manager_v1 to enable it to initiate new tasks immediately after finishing a response. 2012-03-20 17:30:49 +01:00
Tobias Brunner b20c54ff3f Add builder part for parameters from algorithmIdentifier. 2012-02-01 18:27:45 +01:00
Tobias Brunner 35a1986142 Fixed additional typos in comments and log messages. 2012-01-12 11:42:42 +01:00
Adrian-Ken Rueegsegger d887b8e134 Fix whitespaces 2012-01-12 11:25:18 +01:00
Adrian-Ken Rueegsegger 2a375e62f3 Some documentation corrections 2012-01-12 11:25:12 +01:00
Sansar Choinyambuu 95e37555c3 Reverse the changes made to openssl plugin for signature verification 2011-11-28 21:18:05 +01:00
Sansar Choinyambuu 5fbbfe0a48 use openssl rsa_verify function 2011-11-28 20:31:13 +01:00
Sansar Choinyambuu 19fa287f6e Reverse the changes made to openssl plugin for signature verification 2011-11-28 14:39:53 +01:00
Sansar Choinyambuu 3cd6077b75 use openssl rsa_verify function 2011-11-28 14:39:53 +01:00
Tobias Brunner a660f1426e Fixed missing initializer compiler warning. 2011-11-25 09:52:19 +01:00
Tobias Brunner edad908792 Fixed compiler warnings regarding enum comparison. 
Warnings like

  comparison of unsigned expression < 0 is always false

are reported with -Wextra when enum types that are compiled to an
unsigned type (which is up to the compiler) are checked for negativity.
 2011-11-25 09:40:30 +01:00