 Martin Willi
|
dbfbbec368
|
Added name constraint enumerator to x509 interface
|
2011-01-05 16:46:00 +01:00 |
|
|
Martin Willi
|
a199ef15e6
|
Migrated x509_cert_t to INIT/METHOD macros
|
2011-01-05 16:46:00 +01:00 |
|
|
Martin Willi
|
be8858e9b6
|
Moved X509 pathlen constraint checking to constraints plugin
|
2011-01-05 16:46:00 +01:00 |
|
|
Martin Willi
|
01d3038137
|
Added plugin stub for advanced X509 constraint checking
|
2011-01-05 16:46:00 +01:00 |
|
|
Martin Willi
|
0beb1d6fbb
|
Added a hook to reset ESP sequence numbers
|
2011-01-05 16:46:00 +01:00 |
|
|
Martin Willi
|
48ef001133
|
Accept a suffix to differentiate x509, crl, ecdsa and rsa files
|
2011-01-05 16:45:59 +01:00 |
|
|
Martin Willi
|
c7f7a0ba06
|
Use strncaseeq instead of strncasecmp
|
2011-01-05 16:45:59 +01:00 |
|
|
Martin Willi
|
7a3e0a6321
|
Added a strncaseeq variant to the string comparison macros
|
2011-01-05 16:45:59 +01:00 |
|
|
Martin Willi
|
04a1279f91
|
Added tfc_padding option, changes signature to master changes
|
2011-01-05 16:45:59 +01:00 |
|
|
Martin Willi
|
6840a6fb98
|
CRL/OCSP validation stores trustchain information in auth_cfg
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
473d5aa868
|
Key strength checking stores all key sizes in auth_cfg, verifies all in complies()
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
37b3fad782
|
Install "ipsec" script with tools or conftest
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
6ffd9f88ce
|
Use subject, not issuer, of CRL issuing certificate
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
dffb176f2b
|
CRLSign keyUsage or CA basicConstraint are sufficient for CRL validation
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
ece5ac2271
|
Parse and encode crlSign keyUsage flag in x509 plugin
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
bb0cda2fa9
|
pki tool shows and builds crlSign keyUsage
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
6807c0ca2c
|
Added a flag for X509 CRLSign keyUsage
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
e49bd37b5d
|
Remove x509_flag_names, flags do not work with ENUM()
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
7d7beaa1fa
|
Use certificate CRLIssuer information to look up cacched CRLs or CDPs
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
630d58724a
|
Added --crlissuer option to pki --issue
|
2011-01-05 16:45:56 +01:00 |
|
|
Martin Willi
|
4e508517d7
|
Added support for CRL Issuers to x509 and OpenSSL plugins
|
2011-01-05 16:45:55 +01:00 |
|
|
Martin Willi
|
9992cb1c10
|
Generate payload to rebuild_auth, works with injected unknown payloads
|
2011-01-05 16:45:55 +01:00 |
|
|
Martin Willi
|
5c95bf7b93
|
Move rebuild_auth functionality to a standalone hook
This reverts commit 3c12b239fd55aa36c59eb60224d27af8b8d915d1.
|
2011-01-05 16:45:54 +01:00 |
|
|
Martin Willi
|
a73e040cd5
|
Added key strength constraints support to conftest
|
2011-01-05 16:45:53 +01:00 |
|
|
Martin Willi
|
963b4d9477
|
Added key strength constraints for RSA or ECDSA trustchains
|
2011-01-05 16:45:53 +01:00 |
|
|
Martin Willi
|
586070d2ce
|
Implemented hook to log traffic selectors
|
2011-01-05 16:45:53 +01:00 |
|
|
Martin Willi
|
6bd3a1c220
|
The set_reserved() hook rebuilds AUTH if it mangles ID payload fields
|
2011-01-05 16:45:53 +01:00 |
|
|
Martin Willi
|
5f15faebc8
|
Include the used reserved bytes from ID payloads in AUTH calculation
|
2011-01-05 16:45:53 +01:00 |
|
|
Martin Willi
|
502edf425f
|
Migrated psk/pubkey_authenticators to INIT/METHOD macros
|
2011-01-05 16:45:53 +01:00 |
|
|
Martin Willi
|
b5bbc9506c
|
Extended set_reserved hook to mangle sa_payload substructures
|
2011-01-05 16:45:52 +01:00 |
|
|
Martin Willi
|
54f2bdd656
|
Added substructure enumerators to sa_payload, proposal_substructure
|
2011-01-05 16:45:52 +01:00 |
|
|
Martin Willi
|
9ca5d0280e
|
Moved check if packet already encoded to ike_sa, avoids message() hook invocation twice
|
2011-01-05 16:45:52 +01:00 |
|
|
Martin Willi
|
a6da3795d6
|
The set_ike_version hook supports version flag mangling
|
2011-01-05 16:45:52 +01:00 |
|
|
Martin Willi
|
2813be18f5
|
Added a message method to set the "higher version supported" flag
|
2011-01-05 16:45:52 +01:00 |
|
|
Martin Willi
|
357e960e40
|
Implemented hook to toggle initiator flag in IKE header
|
2011-01-05 16:45:52 +01:00 |
|
|
Martin Willi
|
446a4537e5
|
Implemented a hook to set reserved bits
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
166a2a45d9
|
Added reserved bit mangling wrapper functions to message
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
15a612efb2
|
Use payload_get_field() to look up payload fields
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
e662d62a76
|
Implemented a generic payload field lookup function
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
bf029696c6
|
Reserved field get parsed/generated like any other bit/byte field
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
c93c7a7560
|
Added member fields for reserved bits and bytes in all payloads
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
1b671248c2
|
Migrated vendor_id_payload to INIT/METHOD macros
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
102adb9bfd
|
Migrated ts_payload to INIT/METHOD macros
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
1f5b2bec4b
|
Use enumerator instead of deprecated iterator
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
9f8ecff2e2
|
Migrated transform_substructure to INIT/METHOD macros
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
6844c156fc
|
Removed obsolete clone mehtod from proposal_substructure
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
6b69c03d13
|
Migrated transform_attribute to INIT/METHOD macros
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
423745b652
|
Migrated traffic_selector_substructre to INIT/METHOD macros
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
3f0a2af2a6
|
Migrated notify_payload to INIT/METHOD macros
|
2011-01-05 16:45:51 +01:00 |
|
|
Martin Willi
|
e3c4c6a5ac
|
Migrated nonce_payload to INIT/METHOD macros
|
2011-01-05 16:45:50 +01:00 |
|