Tobias Brunner
9fe093c4e2
callback-cred: Document missing callback argument
2022-11-28 17:18:18 +01:00
Tobias Brunner
19ef2aec15
Update copyright headers after acquisition by secunet
2022-06-28 10:22:56 +02:00
Tobias Brunner
dceed8e099
cert-cache: Prevent crash due to integer overflow/sign change
...
random() allocates values in the range [0, RAND_MAX], with RAND_MAX usually
equaling INT_MAX = 2^31-1. Previously, values between 0 and 31 were added
directly to that offset before applying`% CACHE_SIZE` to get an index into
the cache array. If the random value was very high, this resulted in an
integer overflow and a negative index value and, therefore, an out-of-bounds
access of the array and in turn dereferencing invalid pointers when trying
to acquire the read lock. This most likely results in a segmentation fault.
Fixes: 764e8b2211
2021-10-14 18:59:07 +02:00
Tobias Brunner
306c0c9f8e
certificate: Extract helper function to filter certificates
2020-07-20 14:05:38 +02:00
Josh Soref
b3ab7a48cc
Spelling fixes
...
* accumulating
* acquire
* alignment
* appropriate
* argument
* assign
* attribute
* authenticate
* authentication
* authenticator
* authority
* auxiliary
* brackets
* callback
* camellia
* can't
* cancelability
* certificate
* choinyambuu
* chunk
* collector
* collision
* communicating
* compares
* compatibility
* compressed
* confidentiality
* configuration
* connection
* consistency
* constraint
* construction
* constructor
* database
* decapsulated
* declaration
* decrypt
* derivative
* destination
* destroyed
* details
* devised
* dynamic
* ecapsulation
* encoded
* encoding
* encrypted
* enforcing
* enumerator
* establishment
* excluded
* exclusively
* exited
* expecting
* expire
* extension
* filter
* firewall
* foundation
* fulfillment
* gateways
* hashing
* hashtable
* heartbeats
* identifier
* identifiers
* identities
* identity
* implementers
* indicating
* initialize
* initiate
* initiation
* initiator
* inner
* instantiate
* legitimate
* libraries
* libstrongswan
* logger
* malloc
* manager
* manually
* measurement
* mechanism
* message
* network
* nonexistent
* object
* occurrence
* optional
* outgoing
* packages
* packets
* padding
* particular
* passphrase
* payload
* periodically
* policies
* possible
* previously
* priority
* proposal
* protocol
* provide
* provider
* pseudo
* pseudonym
* public
* qualifier
* quantum
* quintuplets
* reached
* reading
* recommendation to
* recommendation
* recursive
* reestablish
* referencing
* registered
* rekeying
* reliable
* replacing
* representing
* represents
* request
* request
* resolver
* result
* resulting
* resynchronization
* retriable
* revocation
* right
* rollback
* rule
* rules
* runtime
* scenario
* scheduled
* security
* segment
* service
* setting
* signature
* specific
* specified
* speed
* started
* steffen
* strongswan
* subjectaltname
* supported
* threadsafe
* traffic
* tremendously
* treshold
* unique
* uniqueness
* unknown
* until
* upper
* using
* validator
* verification
* version
* version
* warrior
Closes strongswan/strongswan#164 .
2020-02-11 18:23:07 +01:00
SophieK
3aa7b2dc3a
Avoid enumerating certificates with non-matching key type
...
If the key type was specified but the ID was NULL or matched a subject, it
was possible that a certificate was returned that didn't actually match
the requested key type.
Closes strongswan/strongswan#141 .
2019-05-21 10:22:30 +02:00
Tobias Brunner
1b67166921
Unify format of HSR copyright statements
2018-05-23 16:32:53 +02:00
Tobias Brunner
2db6d5b8b3
Fixed some typos, courtesy of codespell
2018-02-13 12:19:54 +01:00
Tobias Brunner
024b979522
certificate: Return signature scheme and parameters from issued_by() method
...
This also required some include restructuring (avoid including library.h
in headers) to avoid unresolvable circular dependencies.
2017-11-08 16:48:10 +01:00
Tobias Brunner
b2473e94a2
Fixed some typos, courtesy of codespell
2017-05-26 14:44:06 +02:00
Tobias Brunner
2e4d110d1e
linked-list: Change return value of find_first() and signature of its callback
...
This avoids the unportable five pointer hack.
2017-05-26 13:56:44 +02:00
Tobias Brunner
525cc46cab
Change interface for enumerator_create_filter() callback
...
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
2017-05-26 13:56:44 +02:00
Tobias Brunner
95a63bf281
Migrate all enumerators to venumerate() interface change
2017-05-26 13:56:44 +02:00
Tobias Brunner
bafd851896
mem-cred: Add methods to add/remove shared keys with unique identifiers
...
Also added is a method to enumerate the unique identifiers.
2017-02-16 19:21:12 +01:00
Tobias Brunner
dd5ee9d415
mem-cred: Add method to remove a private key with a specific fingerprint
2017-02-16 19:21:12 +01:00
Andreas Steffen
880c312458
Fixed in-place update of cached base and delta CRLs
2016-10-30 16:37:24 +01:00
Andreas Steffen
2271ebb325
Newer CRLs replace older versions of the CRL in the cache
2016-10-26 12:48:54 +02:00
Tobias Brunner
9ba6548766
mem-cred: Support storing a delta CRL together with its base
...
So far every "newer" CRL (higher serial or by date) replaced an existing
"older" CRL. This meant that delta CRLs replaced an existing base CRL
and that base CRLs weren't added if a delta CRL was already stored. So
the base had to be re-fetched every time after a delta CRL was added.
With this change one delta CRL to the latest base may be stored. A newer
delta CRL will replace an existing delta CRL (but not its base, older
base CRLs are removed, though). And a newer base will replace the existing
base and optional delta CRL.
2016-10-11 17:18:22 +02:00
Tobias Brunner
8efcc78f2b
auth-cfg-wrapper: Fix memory leak with hash-and-URL certificates
...
We wrap the auth-cfg object and its contents, so there is no need to get
an additional reference for the enumerated certificate.
Fixes a44bb9345f
2016-09-12 16:20:34 +02:00
Tobias Brunner
0ba905cf24
mem-cred: Fix memory leak when replacing existing CRLs
...
Fixes #1442 .
2016-05-11 12:16:36 +02:00
Tobias Brunner
58db4edb2c
mem-cred: We don't need a write lock when looking for a certificate
2015-08-20 19:19:37 +02:00
Tobias Brunner
522b1920b6
mem-cred: Add a method to atomically replace all certificates
2015-08-20 19:19:12 +02:00
Martin Willi
ef2c61bc92
mem-cred: Add a method to unify certificate references, without adding it
...
In contrast to add_cert_ref(), get_cert_ref() does not add the certificate to
the set, but only finds a reference to the same certificate, if found.
2015-03-03 13:50:26 +01:00
Tobias Brunner
a9f87d118e
cert-cache: Prevent that a cached issuer is freed too early
...
Previously we got no reference to the cached issuer certificate
before releasing the lock of the cache line, this allowed other
threads, or even the same thread if it replaces a cache line, to
destroy that issuer certificate in cache() (or flush()) before
get_ref() for the issuer certificate is finally called.
2014-10-24 11:23:04 +02:00
Martin Willi
266ee0a190
windows: Provide a sched_yield() implementation
2014-06-04 15:53:01 +02:00
Martin Willi
d4368689a0
mem-cred: Replace existing equal shared keys during add_shared()
2014-05-07 14:13:34 +02:00
Martin Willi
f8223f5f7e
mem-cred: Replace existing equal private keys during add_key()
2014-05-07 14:13:34 +02:00
Martin Willi
83f8cdde46
auth-cfg: Declare an attribute certificate helper type to exchange acerts
2014-03-31 11:14:58 +02:00
Tobias Brunner
d307be7f6c
Add a method to replace all secrets in a mem_cred_t object
2013-03-20 15:27:34 +01:00
Tobias Brunner
f05b427265
Moved debug.[ch] to utils folder
2012-10-24 16:00:51 +02:00
Tobias Brunner
12642a6831
Moved data structures to new collections subfolder
2012-10-24 16:00:49 +02:00
Martin Willi
fd4ff11858
Add signature schemes to auth_cfg during trustchain validation
2012-06-12 14:24:49 +02:00
Martin Willi
a37f2d2006
certificate_t->issued_by takes an argument to receive signature scheme
2012-06-12 14:24:49 +02:00
Andreas Steffen
fabc874155
Migrated auth_cfg_wrapper to INIT/METHOD macros
2011-09-29 22:10:30 +02:00
Andreas Steffen
6d5907fddf
Migrated cert_cache to INIT/METHOD macros
2011-09-29 22:04:22 +02:00
Andreas Steffen
c9698de891
Migrated ocsp_response_wrapper to INIT/METHOD macros
2011-09-29 21:48:31 +02:00
Martin Willi
1a79d76abc
Added an AUTH_HELPER for revocation certificates
2011-01-05 16:46:06 +01:00
Martin Willi
85b9e9be99
Added CDP support to mem_cred
2011-01-05 16:46:06 +01:00
Andreas Steffen
7883e7ce33
fixed bug in mem_cred.c:add_crl()
2010-12-12 21:34:27 +01:00
Tobias Brunner
75827463fa
Insert certificates and secrets at the front of the lists.
...
As the lookup is also from front to back, certificates added later are
now found first, which is useful in case of e.g. "reread cacerts".
2010-12-03 18:00:00 +01:00
Tobias Brunner
5ad4fa295a
Function add_crl added to mem_cred_t.
2010-12-03 18:00:00 +01:00
Tobias Brunner
982de5a5f5
Function added to clear secrets (but not certs) from mem_cred_t.
2010-12-03 18:00:00 +01:00
Tobias Brunner
68c7f18643
Alternative to mem_cred_t.add_cert added, which returns the certificate.
...
If the certificate is already cached, the cached version is returned.
2010-12-03 17:59:59 +01:00
Tobias Brunner
3023a75e67
Function added to mem_cred_t to add shared secret with a linked list of owners.
2010-12-03 17:59:59 +01:00
Martin Willi
c8f5aaf0a4
Renamed mem_cred_t clear function internally to clear_, fixes potential name conflict
2010-10-28 13:06:19 +00:00
Tobias Brunner
889c7947a6
Avoid duplicate certificates in mem_cred_t.
2010-10-14 17:36:20 +02:00
Tobias Brunner
5232ebb1b4
Added function to clear all credentials from mem_cred_t.
2010-10-14 17:36:19 +02:00
Tobias Brunner
e29aa7696f
Fixed possible segmentation fault.
2010-10-14 17:36:18 +02:00
Martin Willi
3dd06bd4ed
Added private key support to in-memory credential set
2010-08-25 10:28:23 +02:00
Martin Willi
72c6335de9
Added certificate support to in-memory credential set
2010-08-25 10:28:22 +02:00
Tobias Brunner