denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,049 Commits 1 Branch 0 Tags
f48c26bce314684a11fbe5b4d9124a8ed3997c2a
Commit Graph
101 Commits
Author SHA1 Message Date
Martin Willi f48c26bce3 pki: Support complex trustchain and revocation checking in --verify 2014-06-04 16:34:16 +02:00
Martin Willi 13298719e3 pki: Switch to binary mode on Windows when reading/writing DER to FDs 2014-06-04 15:53:11 +02:00
Martin Willi 064fe9c963 enum: Return boolean result for enum_from_name() lookup 
Handling the result for enum_from_name() is difficult, as checking for
negative return values requires a cast if the enum type is unsigned. The new
signature clearly differentiates lookup result from lookup value.

Further, this actually allows to convert real -1 enum values, which could not
be distinguished from "not-found" and the -1 return value.

This also fixes several clang warnings where enums are unsigned.
 2014-05-16 15:42:07 +02:00
Tobias Brunner 297bc06ca9 pki: Fix memory leak when printing unknown AC group OIDs 2014-04-09 15:56:11 +02:00
Tobias Brunner ce845838ea pki: Removed extra continue statement 2014-04-09 15:12:27 +02:00
Andreas Steffen 98ae0492b6 Added support for msSmartcardLogon EKU 2014-04-08 13:09:03 +02:00
Martin Willi 2769a22e1f pki: Support absolute --this/next-update CRL lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi d6e921181a pki: Support absolute --not-before/after issued certificate lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi aa8732eb68 pki: Support absolute --not-before/after self-signed certificate lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi 6f90e8e664 pki: Support absolute --not-before/after acert lifetimes 2014-03-31 11:14:59 +02:00
Martin Willi 35a783cff7 pki: Implement an acert command to issue attribute certificates 2014-03-31 11:14:58 +02:00
Martin Willi 20ea84daec pki: Support printing attribute certificates 2014-03-31 11:14:58 +02:00
Martin Willi e49197f15e pki: Don't generate negative random serial numbers in X.509 certificates 
According to RFC 5280 4.1.2.2 we MUST force non-negative serial numbers.
 2014-03-31 11:14:58 +02:00
Tobias Brunner 435aed8287 pki: Fix minor resource leak on failure to read the private key in --req 2014-02-18 16:46:25 +01:00
Martin Willi 1c4a3459f7 chunk: Use dynamically allocated buffer in chunk_from_fd() 
When acting on files, we can use fstat() to estimate the buffer size. On
non-file FDs, we dynamically increase an allocated buffer.

Additionally we slightly change the function signature to properly handle
zero-length files and add appropriate unit tests.
 2014-01-23 15:55:32 +01:00
Tobias Brunner 71c9565a3a pki: Replace BUILD_FROM_FD with passing a chunk via BUILD_BLOB 
This allows more than one builder to try parsing the data read from STDIN.
 2013-10-23 17:20:39 +02:00
Tobias Brunner 90afd2c929 pki: --pub also accepts public keys (i.e. to convert them to a different format) 2013-09-13 15:23:49 +02:00
Tobias Brunner 21626bdf77 pki: Add support to encode public keys in SSH key format 2013-09-13 15:23:49 +02:00
Tobias Brunner b068c4ec9d pki: Add pki --verify man page 2013-09-13 15:07:36 +02:00
Tobias Brunner 4adeaa5eb9 pki: Add pki --pub man page 2013-09-13 15:07:36 +02:00
Tobias Brunner 558771400e pki: Add pki --pkcs7 man page 2013-09-13 15:07:35 +02:00
Tobias Brunner bb8e2e1759 pki: Add pki --req man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 96aa5a1ddd pki: Add pki --signcrl man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 42e3a21e24 pki: Add pki --issue man page 2013-09-13 15:07:35 +02:00
Tobias Brunner 3a643b8901 pki: Add pki --self man page 
Can be opened with "man pki --self".
 2013-09-13 15:07:35 +02:00
Tobias Brunner a612f6e338 pki: Add pki --gen man page 
Can be opened with "man pki --gen".
 2013-09-13 15:07:29 +02:00
Andreas Steffen a4ddc0bb26 Encode RSA public keys in RFC 3110 DNSKEY format 2013-02-19 12:25:00 +01:00
Tobias Brunner 4cd3fb788d Properly read data from stream in pki --pkcs7 2013-01-24 19:13:41 +01:00
Tobias Brunner 27a814b527 Properly destroy mem_cred object on pki --pkcs7 --help 2013-01-24 19:13:41 +01:00
Martin Willi 063ae4e52a Allocate data returned by pkcs7_t.get_attribute() 2012-12-19 10:32:08 +01:00
Martin Willi 24b2dae2b6 Add a --show option to pki --pkcs7 to print contained certificates 2012-12-19 10:32:08 +01:00
Martin Willi 9afbe59953 pki --pkcs7 --verify shows prints the signing time, if available 2012-12-19 10:32:08 +01:00
Martin Willi 5a50bec9d2 Fix leak in pki --pkcs7 --decrypt 2012-12-19 10:32:08 +01:00
Martin Willi 47120d4977 Add a pki command to sign, verify, encrypt and decrypt PKCS#7 containers 2012-12-19 10:32:07 +01:00
Andreas Steffen 48b23d06a8 allow the optional sharing if RSA private keys 2012-11-22 00:34:42 +01:00
Andreas Steffen 168ee460c6 implemented generation of safe primes 2012-11-18 19:22:31 +01:00
Tobias Brunner f05b427265 Moved debug.[ch] to utils folder 2012-10-24 16:00:51 +02:00
Tobias Brunner 12642a6831 Moved data structures to new collections subfolder 2012-10-24 16:00:49 +02:00
Martin Willi c63fb853e8 Use centralized hasher names in pki utility 2012-07-17 17:32:05 +02:00
Tobias Brunner e93bb353d5 Check rng return value when generating serial numbers in pki utility 2012-07-16 14:53:35 +02:00
Martin Willi a37f2d2006 certificate_t->issued_by takes an argument to receive signature scheme 2012-06-12 14:24:49 +02:00
Martin Willi b24be29646 Merge branch 'ikev1' 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/encoding/generator.c
	src/libcharon/encoding/payloads/notify_payload.c
	src/libcharon/encoding/payloads/notify_payload.h
	src/libcharon/encoding/payloads/payload.c
	src/libcharon/network/receiver.c
	src/libcharon/sa/authenticator.c
	src/libcharon/sa/authenticator.h
	src/libcharon/sa/ikev2/tasks/ike_init.c
	src/libcharon/sa/task_manager.c
	src/libstrongswan/credentials/auth_cfg.c
 2012-05-02 11:12:31 +02:00
Andreas Steffen 5ff99529e6 ASN.1 two's complement encoding prevents overflow in CRL serial number 2012-04-04 11:29:12 +02:00
Andreas Steffen 320fd5fe62 moved chunk_skip_zero to chunk.h 2012-04-03 14:12:50 +02:00
Andreas Steffen e464894e8b remove leading zeros in ASN.1 encoded serial numbers 2012-03-27 15:05:36 +02:00
Martin Willi b1f2f05c92 Merge branch 'ikev1-clean' into ikev1-master 
Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/daemon.c
	src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
	src/libcharon/plugins/eap_radius/eap_radius_accounting.c
	src/libcharon/plugins/eap_radius/eap_radius_forward.c
	src/libcharon/plugins/farp/farp_listener.c
	src/libcharon/sa/ike_sa.c
	src/libcharon/sa/keymat.c
	src/libcharon/sa/task_manager.c
	src/libcharon/sa/trap_manager.c
	src/libstrongswan/plugins/x509/x509_cert.c
	src/libstrongswan/utils.h

Applied lost changes of moved files keymat.c and task_manager.c.
Updated listener_t.message hook signature in new plugins.
 2012-03-20 17:57:53 +01:00
Tobias Brunner 4bc4e8e17b Added support for iKEIntermediate flag to ipsec pki. 2012-03-20 17:31:25 +01:00
Tobias Brunner 20d752b4ff pki: Avoid integer overflow when calculating certificate lifetimes. 
This only works properly if sizeof(time_t) > 4.
 2011-12-23 16:33:24 +01:00
Tobias Brunner 29388829fa Do proper cleanup in error case in pki req. 2011-04-14 18:11:45 +02:00
Tobias Brunner 3fe6c0b27e Do proper cleanup in some error cases in pki signcrl. 2011-04-14 18:11:44 +02:00