strongswan.git
10 years agoImplemented hasher_t using PKCS#11
Martin Willi [Tue, 20 Jul 2010 09:01:39 +0000 (11:01 +0200)]
Implemented hasher_t using PKCS#11

10 years agoDefer certificate loading until all PKCS#11 modules are loaded
Martin Willi [Tue, 20 Jul 2010 08:59:21 +0000 (10:59 +0200)]
Defer certificate loading until all PKCS#11 modules are loaded

10 years agoDestroy IKE_SA Managers crypto primitives during flush, the plugins are gone in destroy
Martin Willi [Tue, 20 Jul 2010 08:58:17 +0000 (10:58 +0200)]
Destroy IKE_SA Managers crypto primitives during flush, the plugins are gone in destroy

10 years agoProvide a public PKCS#11 mechanism enumerator
Martin Willi [Tue, 20 Jul 2010 07:16:05 +0000 (09:16 +0200)]
Provide a public PKCS#11 mechanism enumerator

10 years agoAdded PKCS#11 private key support to the pki tool
Martin Willi [Mon, 19 Jul 2010 15:36:17 +0000 (17:36 +0200)]
Added PKCS#11 private key support to the pki tool

10 years agoThe pki tool uses a callback credential set to read in passphrase/PIN
Martin Willi [Mon, 19 Jul 2010 15:35:42 +0000 (17:35 +0200)]
The pki tool uses a callback credential set to read in passphrase/PIN

10 years agoPass type of requested key in the callback credential set
Martin Willi [Mon, 19 Jul 2010 14:25:26 +0000 (16:25 +0200)]
Pass type of requested key in the callback credential set

10 years agoSupport PKCS#11 keys requiring reauthentication for each operation
Martin Willi [Mon, 19 Jul 2010 14:02:57 +0000 (16:02 +0200)]
Support PKCS#11 keys requiring reauthentication for each operation

10 years agoDo not try to log in if we already have a user session
Martin Willi [Mon, 19 Jul 2010 13:53:31 +0000 (15:53 +0200)]
Do not try to log in if we already have a user session

10 years agoObseleted BUILD_PASSPHRASE(_CALLBACK) for private key loading, use credential sets
Martin Willi [Mon, 19 Jul 2010 12:12:05 +0000 (14:12 +0200)]
Obseleted BUILD_PASSPHRASE(_CALLBACK) for private key loading, use credential sets

10 years agoUse a dedicated build part for challenge passwords, BUILD_PASSPHRASE gets obsolete
Martin Willi [Mon, 19 Jul 2010 11:16:32 +0000 (13:16 +0200)]
Use a dedicated build part for challenge passwords, BUILD_PASSPHRASE gets obsolete

10 years agoUse credential sets to load smartcard keys
Martin Willi [Mon, 19 Jul 2010 08:25:51 +0000 (10:25 +0200)]
Use credential sets to load smartcard keys

10 years agoHandle PIN: as a magic keyword for prompt, use getpass() to silently read credentials
Martin Willi [Mon, 19 Jul 2010 07:43:11 +0000 (09:43 +0200)]
Handle PIN: as a magic keyword for prompt, use getpass() to silently read credentials

10 years agoImplemented a callback based credential set, currently for shared keys only
Martin Willi [Fri, 16 Jul 2010 14:55:29 +0000 (16:55 +0200)]
Implemented a callback based credential set, currently for shared keys only

10 years agoImplemented a generic in-memory credential set, currently for shared keys only
Martin Willi [Fri, 16 Jul 2010 14:53:03 +0000 (16:53 +0200)]
Implemented a generic in-memory credential set, currently for shared keys only

10 years agommap() ipsec.secrets instead malloc(), proper error checking
Martin Willi [Fri, 16 Jul 2010 12:40:02 +0000 (14:40 +0200)]
mmap() ipsec.secrets instead malloc(), proper error checking

10 years agoSplitted up the load_secrets() function
Martin Willi [Fri, 16 Jul 2010 12:31:50 +0000 (14:31 +0200)]
Splitted up the load_secrets() function

10 years agoUpdated ipsec.secrets.5 regarding IKEv2 smartcard support
Martin Willi [Fri, 16 Jul 2010 10:18:20 +0000 (12:18 +0200)]
Updated ipsec.secrets.5 regarding IKEv2 smartcard support

10 years ago%prompt support for smartcard PIN via "ipsec secrets"
Martin Willi [Fri, 16 Jul 2010 10:17:21 +0000 (12:17 +0200)]
%prompt support for smartcard PIN via "ipsec secrets"

10 years agoImplemented callback PIN invocation for PKCS#11 login
Martin Willi [Fri, 16 Jul 2010 10:16:32 +0000 (12:16 +0200)]
Implemented callback PIN invocation for PKCS#11 login

10 years agoImplemented keyid discovery on all modules/slots
Martin Willi [Fri, 16 Jul 2010 09:17:06 +0000 (11:17 +0200)]
Implemented keyid discovery on all modules/slots

10 years agoPass the PKCS11 keyid as chunk, not as string
Martin Willi [Fri, 16 Jul 2010 08:48:29 +0000 (10:48 +0200)]
Pass the PKCS11 keyid as chunk, not as string

10 years agoReuse generic passphrase build part, not a dedicated PIN part
Martin Willi [Fri, 16 Jul 2010 08:12:22 +0000 (10:12 +0200)]
Reuse generic passphrase build part, not a dedicated PIN part

10 years agoImplemented private key on top of a PKCS#11 token
Martin Willi [Thu, 15 Jul 2010 15:54:26 +0000 (17:54 +0200)]
Implemented private key on top of a PKCS#11 token

10 years agoExtended the PKCS#11 object enumerator by attribute retrieval
Martin Willi [Thu, 15 Jul 2010 14:25:30 +0000 (16:25 +0200)]
Extended the PKCS#11 object enumerator by attribute retrieval

10 years agoUse the PKCS#11 object enumerator
Martin Willi [Thu, 15 Jul 2010 13:44:17 +0000 (15:44 +0200)]
Use the PKCS#11 object enumerator

10 years agoImplemented a generic PKCS#11 object enumerator
Martin Willi [Thu, 15 Jul 2010 13:43:30 +0000 (15:43 +0200)]
Implemented a generic PKCS#11 object enumerator

10 years agoUnload plugins in reverse order
Martin Willi [Thu, 15 Jul 2010 12:05:02 +0000 (14:05 +0200)]
Unload plugins in reverse order

10 years agoSupport module names in %smartcard specifier, streamlined smartcard building
Martin Willi [Thu, 15 Jul 2010 10:23:50 +0000 (12:23 +0200)]
Support module names in %smartcard specifier, streamlined smartcard building

10 years agoAdded enumerator for PKCS#11 tokens
Martin Willi [Thu, 15 Jul 2010 10:22:36 +0000 (12:22 +0200)]
Added enumerator for PKCS#11 tokens

10 years agoHandle NOT_SUPPORT return value from WaitForSlot
Martin Willi [Thu, 15 Jul 2010 08:10:14 +0000 (10:10 +0200)]
Handle NOT_SUPPORT return value from WaitForSlot

10 years agoReenabled dlclose
Martin Willi [Thu, 15 Jul 2010 06:26:46 +0000 (08:26 +0200)]
Reenabled dlclose

10 years agoImplemented a credential set on top of a PKCS#11 token
Martin Willi [Wed, 14 Jul 2010 15:44:27 +0000 (17:44 +0200)]
Implemented a credential set on top of a PKCS#11 token

10 years agoAdded NSPR PR_CallOnce to leak detective whitelist
Martin Willi [Wed, 14 Jul 2010 15:42:18 +0000 (17:42 +0200)]
Added NSPR PR_CallOnce to leak detective whitelist

10 years agoAdded buffer checking variants of syslog functions to leak detective
Martin Willi [Wed, 14 Jul 2010 15:40:06 +0000 (17:40 +0200)]
Added buffer checking variants of syslog functions to leak detective

10 years agoMoved gmp plugin before users of it
Martin Willi [Wed, 14 Jul 2010 15:34:48 +0000 (17:34 +0200)]
Moved gmp plugin before users of it

10 years agoAdded a token add/remove callback function to the manager
Martin Willi [Wed, 14 Jul 2010 13:09:12 +0000 (15:09 +0200)]
Added a token add/remove callback function to the manager

10 years agoEnumerate tokens and their mechanisms, wait for slot events
Martin Willi [Wed, 14 Jul 2010 12:44:08 +0000 (14:44 +0200)]
Enumerate tokens and their mechanisms, wait for slot events

10 years agoDepend on libcharon until we have a thread pool to use
Martin Willi [Wed, 14 Jul 2010 12:13:24 +0000 (14:13 +0200)]
Depend on libcharon until we have a thread pool to use

10 years agoAdd enum names for CK_MECHANISM_TYPE constants
Martin Willi [Wed, 14 Jul 2010 12:13:02 +0000 (14:13 +0200)]
Add enum names for CK_MECHANISM_TYPE constants

10 years agoMake the PKCS#11 padding string trimming public, add null terminator
Martin Willi [Wed, 14 Jul 2010 10:43:42 +0000 (12:43 +0200)]
Make the PKCS#11 padding string trimming public, add null terminator

10 years agoAdded a getter for the library alias
Martin Willi [Wed, 14 Jul 2010 10:32:40 +0000 (12:32 +0200)]
Added a getter for the library alias

10 years agoMoved PKCS#11 library loading to dedicated manager
Martin Willi [Wed, 14 Jul 2010 09:15:22 +0000 (11:15 +0200)]
Moved PKCS#11 library loading to dedicated manager

10 years agoUse locking, prefer our mutex abstraction layer
Martin Willi [Wed, 14 Jul 2010 08:39:28 +0000 (10:39 +0200)]
Use locking, prefer our mutex abstraction layer

10 years agoAdded enum names for PKCS#11 return values
Martin Willi [Wed, 14 Jul 2010 08:22:42 +0000 (10:22 +0200)]
Added enum names for PKCS#11 return values

10 years agoLoad PKCS#11 modules defined in strongswan.conf
Martin Willi [Wed, 14 Jul 2010 07:48:29 +0000 (09:48 +0200)]
Load PKCS#11 modules defined in strongswan.conf

10 years agoImplemented an abstraction layer for PKCS#11 module loading
Martin Willi [Wed, 14 Jul 2010 07:47:37 +0000 (09:47 +0200)]
Implemented an abstraction layer for PKCS#11 module loading

10 years agoImported the free pkcs11.h header form the Scute project
Martin Willi [Wed, 14 Jul 2010 07:46:24 +0000 (09:46 +0200)]
Imported the free pkcs11.h header form the Scute project

10 years agoAdded PKCS#11 token plugin stub
Martin Willi [Tue, 13 Jul 2010 15:34:34 +0000 (17:34 +0200)]
Added PKCS#11 token plugin stub

10 years agoadded ikev2/rw-eap-tls-only scenario
Andreas Steffen [Wed, 4 Aug 2010 06:36:27 +0000 (08:36 +0200)]
added ikev2/rw-eap-tls-only scenario

10 years ago--enable eap-tls and --disable-load-warning in uml build
Andreas Steffen [Wed, 4 Aug 2010 05:47:08 +0000 (07:47 +0200)]
--enable eap-tls and --disable-load-warning in uml build

10 years agotest_cert adapted to extended signature of get_encoding().
Tobias Brunner [Tue, 3 Aug 2010 16:59:27 +0000 (18:59 +0200)]
test_cert adapted to extended signature of get_encoding().

10 years agoFixed compiler warnings.
Tobias Brunner [Tue, 3 Aug 2010 16:59:12 +0000 (18:59 +0200)]
Fixed compiler warnings.

10 years agoMoved TLS stack to its own library
Martin Willi [Tue, 3 Aug 2010 13:17:40 +0000 (15:17 +0200)]
Moved TLS stack to its own library

10 years agoMoved eap-tls plugin to libcharon, updated to 4.4.1 APIs
Martin Willi [Fri, 19 Mar 2010 17:55:23 +0000 (18:55 +0100)]
Moved eap-tls plugin to libcharon, updated to 4.4.1 APIs

10 years agoImplemented EAP-TLS server functionality
Martin Willi [Tue, 9 Feb 2010 17:19:25 +0000 (18:19 +0100)]
Implemented EAP-TLS server functionality

10 years agoTLS stack keeps a copy of server/peer identities
Martin Willi [Tue, 9 Feb 2010 13:57:50 +0000 (14:57 +0100)]
TLS stack keeps a copy of server/peer identities

10 years agoLimit the number of EAP-TLS packets allowed
Martin Willi [Tue, 9 Feb 2010 11:53:42 +0000 (12:53 +0100)]
Limit the number of EAP-TLS packets allowed

10 years agoUse stricter state handling while processing TLS messages
Martin Willi [Tue, 9 Feb 2010 11:37:29 +0000 (12:37 +0100)]
Use stricter state handling while processing TLS messages

10 years agoCleaned up the public TLS interface
Martin Willi [Fri, 5 Feb 2010 13:39:19 +0000 (13:39 +0000)]
Cleaned up the public TLS interface

10 years agoRefactored common used operations into TLS crypto helper
Martin Willi [Fri, 5 Feb 2010 13:25:38 +0000 (14:25 +0100)]
Refactored common used operations into TLS crypto helper

10 years agoProperly send empty EAP-TLS messages
Martin Willi [Fri, 5 Feb 2010 11:30:01 +0000 (11:30 +0000)]
Properly send empty EAP-TLS messages

10 years agoDerive MSK for EAP-TLS authentication
Martin Willi [Fri, 5 Feb 2010 11:28:48 +0000 (11:28 +0000)]
Derive MSK for EAP-TLS authentication

10 years agoVerify Server Finished message
Martin Willi [Fri, 5 Feb 2010 11:27:52 +0000 (11:27 +0000)]
Verify Server Finished message

10 years agoImplemented input record decryption and verification
Martin Willi [Fri, 5 Feb 2010 10:50:29 +0000 (10:50 +0000)]
Implemented input record decryption and verification

10 years agoImplemented key derivation, output record signing and encryption
Martin Willi [Thu, 4 Feb 2010 17:18:10 +0000 (18:18 +0100)]
Implemented key derivation, output record signing and encryption

10 years agoDerive master secret, create Finished message
Martin Willi [Thu, 4 Feb 2010 10:17:48 +0000 (11:17 +0100)]
Derive master secret, create Finished message

10 years agoImplemented the TLS specific PRF in its TLSv1.0 and TLSv1.2 variants
Martin Willi [Thu, 4 Feb 2010 09:08:07 +0000 (10:08 +0100)]
Implemented the TLS specific PRF in its TLSv1.0 and TLSv1.2 variants

10 years agoImplemented sending of Certificate, ClientKeyExchange, CertificateVerify and ChangeCi...
Martin Willi [Wed, 3 Feb 2010 18:53:40 +0000 (19:53 +0100)]
Implemented sending of Certificate, ClientKeyExchange, CertificateVerify and ChangeCipherSpec as peer

10 years agoImplemented a tls_writer class to simplify TLS data generation
Martin Willi [Mon, 1 Feb 2010 14:12:18 +0000 (15:12 +0100)]
Implemented a tls_writer class to simplify TLS data generation

10 years agoImplemented a tls_reader class to simplify TLS data parsing
Martin Willi [Mon, 1 Feb 2010 10:25:44 +0000 (10:25 +0000)]
Implemented a tls_reader class to simplify TLS data parsing

10 years agoProcess ServerHello(Done), Certificate(Request) messages
Martin Willi [Mon, 25 Jan 2010 16:31:55 +0000 (17:31 +0100)]
Process ServerHello(Done), Certificate(Request) messages

10 years agoSend a ClientHello to start TLS negotiation
Martin Willi [Mon, 25 Jan 2010 11:23:59 +0000 (11:23 +0000)]
Send a ClientHello to start TLS negotiation

10 years agoAdded TLS crypto helper, currently supports cipher suite selection
Martin Willi [Mon, 25 Jan 2010 11:21:57 +0000 (11:21 +0000)]
Added TLS crypto helper, currently supports cipher suite selection

10 years agoAdded support for AUTH_HMAC_SHA2_256_256, used in TLS
Martin Willi [Mon, 25 Jan 2010 11:15:05 +0000 (11:15 +0000)]
Added support for AUTH_HMAC_SHA2_256_256, used in TLS

10 years agoAdded stubs for handshake handling, server and peer variants
Martin Willi [Mon, 25 Jan 2010 09:44:35 +0000 (10:44 +0100)]
Added stubs for handshake handling, server and peer variants

10 years agoAccept follow-up fragments with a TLS message length
Martin Willi [Mon, 25 Jan 2010 09:42:44 +0000 (10:42 +0100)]
Accept follow-up fragments with a TLS message length

10 years agoAdded dummy/identity implementations of the different TLS record layers
Martin Willi [Fri, 22 Jan 2010 16:24:17 +0000 (17:24 +0100)]
Added dummy/identity implementations of the different TLS record layers

10 years agoPass TLS records to newly introduced TLS stack
Martin Willi [Fri, 22 Jan 2010 14:35:29 +0000 (15:35 +0100)]
Pass TLS records to newly introduced TLS stack

10 years agoAdded some TLS constants
Martin Willi [Thu, 21 Jan 2010 14:11:38 +0000 (15:11 +0100)]
Added some TLS constants

10 years ago(De-)fragment EAP-TLS packets, pass TLS records to upper layer
Martin Willi [Thu, 21 Jan 2010 13:39:39 +0000 (14:39 +0100)]
(De-)fragment EAP-TLS packets, pass TLS records to upper layer

10 years agoAdded EAP-TLS plugin stub
Martin Willi [Mon, 11 Jan 2010 13:21:58 +0000 (14:21 +0100)]
Added EAP-TLS plugin stub

10 years agoDo not touch child from collision if peer deleted it
Thomas Egerer [Mon, 2 Aug 2010 14:46:29 +0000 (16:46 +0200)]
Do not touch child from collision if peer deleted it

10 years agosubstitute obsolete function calls(bzero/index)
Waldemar Brodkorb [Sun, 1 Aug 2010 19:20:15 +0000 (21:20 +0200)]
substitute obsolete function calls(bzero/index)

10 years agodelete tarball files
Andreas Steffen [Fri, 30 Jul 2010 20:27:41 +0000 (22:27 +0200)]
delete tarball files

10 years agoversion bump to 4.4.2
Andreas Steffen [Fri, 30 Jul 2010 20:26:14 +0000 (22:26 +0200)]
version bump to 4.4.2

10 years agoThe va_list trick does not seem to be portable, revert dots-in-section fix 4.4.1
Martin Willi [Fri, 30 Jul 2010 08:57:59 +0000 (10:57 +0200)]
The va_list trick does not seem to be portable, revert dots-in-section fix

This reverts commit 8f50d06c354cd31fc295afc5598afff4096b5e77.

10 years agoFix segfault on 'ipsec stroke up ]' command
Thomas Egerer [Thu, 29 Jul 2010 11:03:01 +0000 (13:03 +0200)]
Fix segfault on 'ipsec stroke up ]' command

10 years agoFixed settings lookup if the section/key contains dots
Martin Willi [Thu, 29 Jul 2010 10:00:21 +0000 (12:00 +0200)]
Fixed settings lookup if the section/key contains dots

10 years agoAdded NEWS for snprintf() fixes
Martin Willi [Wed, 28 Jul 2010 09:06:49 +0000 (11:06 +0200)]
Added NEWS for snprintf() fixes

10 years agoFix use of snprintf() in pluto subjectAltName enumeration
Martin Willi [Fri, 18 Jun 2010 07:15:45 +0000 (09:15 +0200)]
Fix use of snprintf() in pluto subjectAltName enumeration

10 years agoFix use of snprintf() in IETF attributes to string conversion
Martin Willi [Fri, 18 Jun 2010 07:18:49 +0000 (09:18 +0200)]
Fix use of snprintf() in IETF attributes to string conversion

10 years agoFix use of snprintf() in identification DN to ASCII conversion
Martin Willi [Fri, 18 Jun 2010 07:18:27 +0000 (09:18 +0200)]
Fix use of snprintf() in identification DN to ASCII conversion

10 years agoMore NEWS for HA functionality
Martin Willi [Wed, 28 Jul 2010 08:49:58 +0000 (10:49 +0200)]
More NEWS for HA functionality

10 years agoImplemented a HA enabled in-memory address pool
Martin Willi [Wed, 28 Jul 2010 07:51:41 +0000 (09:51 +0200)]
Implemented a HA enabled in-memory address pool

10 years agoAdded a function to segmentate a generic integer
Martin Willi [Wed, 28 Jul 2010 07:43:53 +0000 (09:43 +0200)]
Added a function to segmentate a generic integer

10 years agoadded NETMAP rules for the reverse direction
Andreas Steffen [Tue, 27 Jul 2010 19:16:44 +0000 (21:16 +0200)]
added NETMAP rules for the reverse direction

10 years agofixed description of ikev2/net2net-same-nets scenario
Andreas Steffen [Tue, 27 Jul 2010 18:49:48 +0000 (20:49 +0200)]
fixed description of ikev2/net2net-same-nets scenario

10 years agoReserving does not work, as our pools do not support acquiring arbitrary addresses
Martin Willi [Tue, 27 Jul 2010 10:05:39 +0000 (12:05 +0200)]
Reserving does not work, as our pools do not support acquiring arbitrary addresses

This reverts commit d1384080b3ba74f366eaf8b5f027babca3f5d607.

10 years agoMem pool does not support multiple leases for an identity
Martin Willi [Tue, 27 Jul 2010 07:54:27 +0000 (09:54 +0200)]
Mem pool does not support multiple leases for an identity