denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
16,352 Commits 1 Branch 0 Tags
ac140220c470bae3a71abfc535e3155a2fc41dec
Commit Graph
498 Commits
Author SHA1 Message Date
Tobias Brunner ac140220c4 proposal: Add modp6144 to the default proposal 
We always had modp4096 and modp8192 included, not sure why this wasn't.
 2018-02-14 14:54:32 +01:00
Tobias Brunner 2db6d5b8b3 Fixed some typos, courtesy of codespell 2018-02-13 12:19:54 +01:00
Tobias Brunner d9c9b7b832 proposal: Add method to move a given DH group to the front 
This way a responder (like strongSwan) selecting a proposal first and
then checking if the KE payload matches sees the peer's preferred group
first.
 2018-02-09 10:20:05 +01:00
Tobias Brunner 2307bffe56 proposal: Move proposal_t from libcharon to libstrongswan 
This allows us to use it without having to initialize libcharon, which
was required for the logging (we probably could have included debug.h
instead of daemon.h to workaround that but this seems more correct).
 2017-11-17 18:09:54 +01:00
Tobias Brunner f7a73fe0f7 hashers: Change names of SHA2 hash algorithms 
Keep the lower case names as they are as we use them internally (parsing
and e.g. in OpenSSL as identifier).
 2017-11-17 09:32:47 +01:00
Tobias Brunner dfd5f090fb hasher: Add uppercase short names for hash algorithms 2017-11-17 09:30:53 +01:00
Tobias Brunner 54f8d09261 auth-cfg: Store signature schemes as signature_params_t objects 
Due to circular references the hasher_from_signature_scheme() helper
does not take a signature_params_t object.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 024b979522 certificate: Return signature scheme and parameters from issued_by() method 
This also required some include restructuring (avoid including library.h
in headers) to avoid unresolvable circular dependencies.
 2017-11-08 16:48:10 +01:00
Tobias Brunner 720a76c229 xof: Add identifiers for MGF1 XOFs based on SHA-224/384 2017-11-08 16:48:10 +01:00
Tobias Brunner 883e7fcd65 xof: Add helper to determine MGF1 XOF type from hash algorithm 2017-11-08 16:48:10 +01:00
Tobias Brunner c2b878cd61 hasher: Add function to determine length of hashes 2017-11-08 16:48:10 +01:00
Tobias Brunner 677072accc public-key: Add RSASSA-PSS signature scheme identifier 2017-11-08 16:48:10 +01:00
Tobias Brunner 43b59d1323 ikev2: Don't use SHA-1 for RFC 7427 signature authentication 
RFC 8247 demoted it to MUST NOT.

References #2427.
 2017-11-08 16:47:24 +01:00
Tobias Brunner 0ae19f0ced configure: Fix gperf length parameter determination 
gperf is not actually a build dependency as the generated files are
shipped in the tarball.  So the type depends on the gperf version on
the host that ran gperf and created the tarball, which might not be
the same as that on the actual build host, and gperf might not even
be installed there, leaving the type undetermined.

Fixes: e0e4322973 ("configure: Detect type of length parameter for gperf generated function")
 2017-10-02 17:21:42 +02:00
Tobias Brunner e0e4322973 configure: Detect type of length parameter for gperf generated function 
Since 3.1 gperf uses size_t for the length parameter instead of an
unsigned int.
 2017-09-19 13:24:43 +02:00
Tobias Brunner ca280574ba Fixed some typos, courtesy of codespell 2017-08-07 17:22:01 +02:00
Tobias Brunner e0c78d7516 prf-plus: Wipe seed and internal buffer 
The buffer contains key material we handed out last and the seed can
contain the DH secret.

References #2388.
 2017-08-07 16:55:28 +02:00
Tobias Brunner 2e4d110d1e linked-list: Change return value of find_first() and signature of its callback 
This avoids the unportable five pointer hack.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 525cc46cab Change interface for enumerator_create_filter() callback 
This avoids the unportable 5 pointer hack, but requires enumerating in
the callback.
 2017-05-26 13:56:44 +02:00
Tobias Brunner 95a63bf281 Migrate all enumerators to venumerate() interface change 2017-05-26 13:56:44 +02:00
Andreas Steffen efc1b98461 Allow x25519 as an alias of the curve25519 KE algorithm 2017-03-20 21:18:00 +01:00
Andreas Steffen db1ab1cd99 Reference Edwards-curve signature RFCs 2017-03-20 21:18:00 +01:00
Andreas Steffen 35bc60cc68 Added support of EdDSA signatures 2016-12-14 11:15:47 +01:00
Martin Willi 8935842c2e proposal: Add a curve25519 proposal keyword 2016-11-14 16:20:51 +01:00
Martin Willi a4195d3841 diffie-hellman: Add DH group identifiers for Curve25519 and Curve448 2016-11-14 16:20:51 +01:00
Andreas Steffen 40f2589abf gmp: Support of SHA-3 RSA signatures 2016-09-22 17:34:31 +02:00
Andreas Steffen 188b190a70 mgf1: Refactored MGF1 as an XOF 2016-09-21 06:40:52 +02:00
Thomas Egerer c6b9a3a485 proposal: Use proper list to get function pointer when adding custom parser 
Signed-off-by: Thomas Egerer <[email protected]>
 2016-08-29 16:02:07 +02:00
Andreas Steffen 393688aea0 Created newhope plugin implementing the New Hope key exchange algorithm 2016-08-10 14:22:00 +02:00
Andreas Steffen 1fddb0b92e xof: Added ChaCha20 stream as XOF 2016-08-06 12:09:05 +02:00
Andreas Steffen 04208ac5d4 xof: Defined Extended Output Functions 2016-07-29 12:36:14 +02:00
Tobias Brunner 2f211ced9c proposal: Parse modpnone as MODP_NONE(0) 2016-06-17 18:48:07 +02:00
Tobias Brunner 990c62cdcc crypto-factory: Stop after successfully creating one nonce generator 
Fixes: e2fc09c186 ("Add nonce generator interface")
 2016-06-17 18:48:02 +02:00
Tobias Brunner e8bddd64fc proposal: Use standard integer types for static keywords 2016-03-31 09:25:19 +02:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Tobias Brunner f6083d350c iv-gen: Use NULL IV generator for NULL encryption 
We don't need an IV for NULL encryption, so we wouldn't technically need
an IV generator.  But some of the code currently relies on an IV
generator to be present.  So we don't have to change that code and
handle IV size == 0 specially we use the new NULL IV generator, which
handles this transparently to the existing code.

Before 3c81cb6fc3 ("aead: Create AEAD using traditional transforms
with an explicit IV generator") iv_gen_rand_t was used for NULL
encryption, which would work too but this way it's clearer.
 2015-11-09 11:09:18 +01:00
Tobias Brunner 403acf8614 crypto: Add NULL IV generator 
This does not actually allocate an IV and only accepts requests
for size == 0.
 2015-11-09 11:08:22 +01:00
Andreas Steffen 23a50e66f1 testing: Updated hasher tests 2015-11-06 16:05:44 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Andreas Steffen f6fede934b Support BLISS signatures with SHA-3 hash 2015-11-03 21:35:09 +01:00
Andreas Steffen de61e2cef4 Defined SHA-3 hashers 2015-11-03 19:07:15 +01:00
Martin Willi b211f283b7 proposal: Add a chacha20poly1305 proposal keyword 2015-06-29 17:32:13 +02:00
Martin Willi 9e110cc54c crypter: Define a ChaCha20/Poly1305 AEAD algorithm identifier 2015-06-29 17:32:03 +02:00
Martin Willi b756eea4f4 ivgen: Allow reusing the same message ID twice in sequential IV gen 
We use the message ID and fragment number as IV generator. As IKEv2 uses
distinct message ID counters for actively and passively initiated exchanges,
each IV would be used twice. As we explicitly reject such message IDs since
d0ed1079, original-responder initiated exchanges fail with counter mode ciphers.

This commit separates IV space in two halves for sequential IVs, and
automatically assigns once reused sequence numbers to the second half.

Fixes #980.
 2015-06-05 13:44:42 +02:00
Martin Willi ef31254d34 iv-gen: Fail getting shorter IV values than the used counter size 
While no algorithm actually uses such short IVs, we add a check here to ensure
we won't return just the lower bits of the counter.
 2015-06-01 09:42:10 +02:00
Martin Willi d0ed107910 iv-gen: Ensure external sequential IVs are actually sequential 
We allow gaps in IVs, but ensure that an IV is never used more than once.
 2015-06-01 09:42:10 +02:00
Martin Willi 80469c2168 crypto-factory: Remove obsolete transform testing functions 2015-04-15 14:38:43 +02:00
Martin Willi 1d55e0756a transform: Add a getter for the enum_names for a specific transform type 2015-04-15 14:38:43 +02:00
Martin Willi e03fb1fb26 crypto-factory: Add enumerator method to support individual transform testing 2015-04-15 14:38:43 +02:00
Martin Willi a94955e88a crypto-tester: Support testing DH groups using DH test vectors 2015-04-15 14:37:38 +02:00