strongswan.git
9 years agoExport scheme_to_mechanism conversion function
Martin Willi [Fri, 6 Aug 2010 15:02:01 +0000 (17:02 +0200)]
Export scheme_to_mechanism conversion function

9 years agoLoad certificate after enumeration
Martin Willi [Fri, 6 Aug 2010 15:00:23 +0000 (17:00 +0200)]
Load certificate after enumeration

9 years agofix error-type range in parsing of NOTIFY payloads
Jiri Bohac [Thu, 5 Aug 2010 15:13:38 +0000 (17:13 +0200)]
fix error-type range in parsing of NOTIFY payloads

9 years agoadded TTLS to EAP short names, too
Andreas Steffen [Fri, 6 Aug 2010 04:06:40 +0000 (06:06 +0200)]
added TTLS to EAP short names, too

9 years agoadded EAP_TTLS method
Andreas Steffen [Thu, 5 Aug 2010 19:01:39 +0000 (21:01 +0200)]
added EAP_TTLS method

9 years agoadded ikev2/rw-eap-tls-radius
Andreas Steffen [Thu, 5 Aug 2010 17:28:06 +0000 (19:28 +0200)]
added ikev2/rw-eap-tls-radius

9 years agoWhitespace cleanups
Martin Willi [Thu, 5 Aug 2010 11:58:49 +0000 (13:58 +0200)]
Whitespace cleanups

9 years agoUse certificate subject to get a public key of the TLS server
Martin Willi [Thu, 5 Aug 2010 11:13:04 +0000 (13:13 +0200)]
Use certificate subject to get a public key of the TLS server

9 years agono need for strongSwan VID since the EAP_ONLY notification has been officially regist...
Andreas Steffen [Thu, 5 Aug 2010 10:47:09 +0000 (12:47 +0200)]
no need for strongSwan VID since the EAP_ONLY notification has been officially registered with IANA

9 years agoSome Doxygen fixes.
Tobias Brunner [Thu, 5 Aug 2010 09:53:35 +0000 (11:53 +0200)]
Some Doxygen fixes.

9 years agoadded some more TLS debug output
Andreas Steffen [Thu, 5 Aug 2010 07:51:05 +0000 (09:51 +0200)]
added some more TLS debug output

9 years agofixed type in cipher suite list build
Andreas Steffen [Wed, 4 Aug 2010 23:26:10 +0000 (01:26 +0200)]
fixed type in cipher suite list build

9 years agolog selected TLS version and cipher suite
Andreas Steffen [Wed, 4 Aug 2010 23:21:59 +0000 (01:21 +0200)]
log selected TLS version and cipher suite

9 years agolog TLS handshake messages in debug level 2
Andreas Steffen [Wed, 4 Aug 2010 14:55:47 +0000 (16:55 +0200)]
log TLS handshake messages in debug level 2

9 years agoFixed loading of secrets with IDs.
Tobias Brunner [Wed, 4 Aug 2010 13:59:15 +0000 (15:59 +0200)]
Fixed loading of secrets with IDs.

Since the ID string is manually terminated by a null character, write
permission is required for the mmapped ipsec.secrets.

9 years agoFixed loading of private keys without password.
Tobias Brunner [Wed, 4 Aug 2010 12:22:48 +0000 (14:22 +0200)]
Fixed loading of private keys without password.

The chunk storing the password was not correctly initialized, resulting
in a segmentation fault when no password was specified in ipsec.secrets.

9 years agoAccept EAP_ONLY_AUTHENTICATION notifies from any client, now that IANA allocated...
Tobias Brunner [Wed, 4 Aug 2010 10:55:09 +0000 (12:55 +0200)]
Accept EAP_ONLY_AUTHENTICATION notifies from any client, now that IANA allocated an ID.

9 years agogenerated aaa certificate
Andreas Steffen [Wed, 4 Aug 2010 10:44:32 +0000 (12:44 +0200)]
generated aaa certificate

9 years agoIKEv2 notification types updated.
Tobias Brunner [Wed, 4 Aug 2010 08:02:09 +0000 (10:02 +0200)]
IKEv2 notification types updated.

9 years agoReimplemented mem pool to support multiple leases for a single identity
Martin Willi [Tue, 27 Jul 2010 10:04:19 +0000 (12:04 +0200)]
Reimplemented mem pool to support multiple leases for a single identity

9 years agoSave/Load state of PKCS#11 hasher
Martin Willi [Tue, 20 Jul 2010 10:37:06 +0000 (12:37 +0200)]
Save/Load state of PKCS#11 hasher

9 years agoRegister hmac/xcbc algorithms after potentially underlying PKCS#11
Martin Willi [Tue, 20 Jul 2010 10:35:45 +0000 (12:35 +0200)]
Register hmac/xcbc algorithms after potentially underlying PKCS#11

9 years agoDo initial slot enumeration manually
Martin Willi [Tue, 20 Jul 2010 10:23:06 +0000 (12:23 +0200)]
Do initial slot enumeration manually

9 years agoImplemented hasher_t using PKCS#11
Martin Willi [Tue, 20 Jul 2010 09:01:39 +0000 (11:01 +0200)]
Implemented hasher_t using PKCS#11

9 years agoDefer certificate loading until all PKCS#11 modules are loaded
Martin Willi [Tue, 20 Jul 2010 08:59:21 +0000 (10:59 +0200)]
Defer certificate loading until all PKCS#11 modules are loaded

9 years agoDestroy IKE_SA Managers crypto primitives during flush, the plugins are gone in destroy
Martin Willi [Tue, 20 Jul 2010 08:58:17 +0000 (10:58 +0200)]
Destroy IKE_SA Managers crypto primitives during flush, the plugins are gone in destroy

9 years agoProvide a public PKCS#11 mechanism enumerator
Martin Willi [Tue, 20 Jul 2010 07:16:05 +0000 (09:16 +0200)]
Provide a public PKCS#11 mechanism enumerator

9 years agoAdded PKCS#11 private key support to the pki tool
Martin Willi [Mon, 19 Jul 2010 15:36:17 +0000 (17:36 +0200)]
Added PKCS#11 private key support to the pki tool

9 years agoThe pki tool uses a callback credential set to read in passphrase/PIN
Martin Willi [Mon, 19 Jul 2010 15:35:42 +0000 (17:35 +0200)]
The pki tool uses a callback credential set to read in passphrase/PIN

9 years agoPass type of requested key in the callback credential set
Martin Willi [Mon, 19 Jul 2010 14:25:26 +0000 (16:25 +0200)]
Pass type of requested key in the callback credential set

9 years agoSupport PKCS#11 keys requiring reauthentication for each operation
Martin Willi [Mon, 19 Jul 2010 14:02:57 +0000 (16:02 +0200)]
Support PKCS#11 keys requiring reauthentication for each operation

9 years agoDo not try to log in if we already have a user session
Martin Willi [Mon, 19 Jul 2010 13:53:31 +0000 (15:53 +0200)]
Do not try to log in if we already have a user session

9 years agoObseleted BUILD_PASSPHRASE(_CALLBACK) for private key loading, use credential sets
Martin Willi [Mon, 19 Jul 2010 12:12:05 +0000 (14:12 +0200)]
Obseleted BUILD_PASSPHRASE(_CALLBACK) for private key loading, use credential sets

9 years agoUse a dedicated build part for challenge passwords, BUILD_PASSPHRASE gets obsolete
Martin Willi [Mon, 19 Jul 2010 11:16:32 +0000 (13:16 +0200)]
Use a dedicated build part for challenge passwords, BUILD_PASSPHRASE gets obsolete

9 years agoUse credential sets to load smartcard keys
Martin Willi [Mon, 19 Jul 2010 08:25:51 +0000 (10:25 +0200)]
Use credential sets to load smartcard keys

9 years agoHandle PIN: as a magic keyword for prompt, use getpass() to silently read credentials
Martin Willi [Mon, 19 Jul 2010 07:43:11 +0000 (09:43 +0200)]
Handle PIN: as a magic keyword for prompt, use getpass() to silently read credentials

9 years agoImplemented a callback based credential set, currently for shared keys only
Martin Willi [Fri, 16 Jul 2010 14:55:29 +0000 (16:55 +0200)]
Implemented a callback based credential set, currently for shared keys only

9 years agoImplemented a generic in-memory credential set, currently for shared keys only
Martin Willi [Fri, 16 Jul 2010 14:53:03 +0000 (16:53 +0200)]
Implemented a generic in-memory credential set, currently for shared keys only

9 years agommap() ipsec.secrets instead malloc(), proper error checking
Martin Willi [Fri, 16 Jul 2010 12:40:02 +0000 (14:40 +0200)]
mmap() ipsec.secrets instead malloc(), proper error checking

9 years agoSplitted up the load_secrets() function
Martin Willi [Fri, 16 Jul 2010 12:31:50 +0000 (14:31 +0200)]
Splitted up the load_secrets() function

9 years agoUpdated ipsec.secrets.5 regarding IKEv2 smartcard support
Martin Willi [Fri, 16 Jul 2010 10:18:20 +0000 (12:18 +0200)]
Updated ipsec.secrets.5 regarding IKEv2 smartcard support

9 years ago%prompt support for smartcard PIN via "ipsec secrets"
Martin Willi [Fri, 16 Jul 2010 10:17:21 +0000 (12:17 +0200)]
%prompt support for smartcard PIN via "ipsec secrets"

9 years agoImplemented callback PIN invocation for PKCS#11 login
Martin Willi [Fri, 16 Jul 2010 10:16:32 +0000 (12:16 +0200)]
Implemented callback PIN invocation for PKCS#11 login

9 years agoImplemented keyid discovery on all modules/slots
Martin Willi [Fri, 16 Jul 2010 09:17:06 +0000 (11:17 +0200)]
Implemented keyid discovery on all modules/slots

9 years agoPass the PKCS11 keyid as chunk, not as string
Martin Willi [Fri, 16 Jul 2010 08:48:29 +0000 (10:48 +0200)]
Pass the PKCS11 keyid as chunk, not as string

9 years agoReuse generic passphrase build part, not a dedicated PIN part
Martin Willi [Fri, 16 Jul 2010 08:12:22 +0000 (10:12 +0200)]
Reuse generic passphrase build part, not a dedicated PIN part

9 years agoImplemented private key on top of a PKCS#11 token
Martin Willi [Thu, 15 Jul 2010 15:54:26 +0000 (17:54 +0200)]
Implemented private key on top of a PKCS#11 token

9 years agoExtended the PKCS#11 object enumerator by attribute retrieval
Martin Willi [Thu, 15 Jul 2010 14:25:30 +0000 (16:25 +0200)]
Extended the PKCS#11 object enumerator by attribute retrieval

9 years agoUse the PKCS#11 object enumerator
Martin Willi [Thu, 15 Jul 2010 13:44:17 +0000 (15:44 +0200)]
Use the PKCS#11 object enumerator

9 years agoImplemented a generic PKCS#11 object enumerator
Martin Willi [Thu, 15 Jul 2010 13:43:30 +0000 (15:43 +0200)]
Implemented a generic PKCS#11 object enumerator

9 years agoUnload plugins in reverse order
Martin Willi [Thu, 15 Jul 2010 12:05:02 +0000 (14:05 +0200)]
Unload plugins in reverse order

9 years agoSupport module names in %smartcard specifier, streamlined smartcard building
Martin Willi [Thu, 15 Jul 2010 10:23:50 +0000 (12:23 +0200)]
Support module names in %smartcard specifier, streamlined smartcard building

9 years agoAdded enumerator for PKCS#11 tokens
Martin Willi [Thu, 15 Jul 2010 10:22:36 +0000 (12:22 +0200)]
Added enumerator for PKCS#11 tokens

9 years agoHandle NOT_SUPPORT return value from WaitForSlot
Martin Willi [Thu, 15 Jul 2010 08:10:14 +0000 (10:10 +0200)]
Handle NOT_SUPPORT return value from WaitForSlot

9 years agoReenabled dlclose
Martin Willi [Thu, 15 Jul 2010 06:26:46 +0000 (08:26 +0200)]
Reenabled dlclose

9 years agoImplemented a credential set on top of a PKCS#11 token
Martin Willi [Wed, 14 Jul 2010 15:44:27 +0000 (17:44 +0200)]
Implemented a credential set on top of a PKCS#11 token

9 years agoAdded NSPR PR_CallOnce to leak detective whitelist
Martin Willi [Wed, 14 Jul 2010 15:42:18 +0000 (17:42 +0200)]
Added NSPR PR_CallOnce to leak detective whitelist

9 years agoAdded buffer checking variants of syslog functions to leak detective
Martin Willi [Wed, 14 Jul 2010 15:40:06 +0000 (17:40 +0200)]
Added buffer checking variants of syslog functions to leak detective

9 years agoMoved gmp plugin before users of it
Martin Willi [Wed, 14 Jul 2010 15:34:48 +0000 (17:34 +0200)]
Moved gmp plugin before users of it

9 years agoAdded a token add/remove callback function to the manager
Martin Willi [Wed, 14 Jul 2010 13:09:12 +0000 (15:09 +0200)]
Added a token add/remove callback function to the manager

9 years agoEnumerate tokens and their mechanisms, wait for slot events
Martin Willi [Wed, 14 Jul 2010 12:44:08 +0000 (14:44 +0200)]
Enumerate tokens and their mechanisms, wait for slot events

9 years agoDepend on libcharon until we have a thread pool to use
Martin Willi [Wed, 14 Jul 2010 12:13:24 +0000 (14:13 +0200)]
Depend on libcharon until we have a thread pool to use

9 years agoAdd enum names for CK_MECHANISM_TYPE constants
Martin Willi [Wed, 14 Jul 2010 12:13:02 +0000 (14:13 +0200)]
Add enum names for CK_MECHANISM_TYPE constants

9 years agoMake the PKCS#11 padding string trimming public, add null terminator
Martin Willi [Wed, 14 Jul 2010 10:43:42 +0000 (12:43 +0200)]
Make the PKCS#11 padding string trimming public, add null terminator

9 years agoAdded a getter for the library alias
Martin Willi [Wed, 14 Jul 2010 10:32:40 +0000 (12:32 +0200)]
Added a getter for the library alias

9 years agoMoved PKCS#11 library loading to dedicated manager
Martin Willi [Wed, 14 Jul 2010 09:15:22 +0000 (11:15 +0200)]
Moved PKCS#11 library loading to dedicated manager

9 years agoUse locking, prefer our mutex abstraction layer
Martin Willi [Wed, 14 Jul 2010 08:39:28 +0000 (10:39 +0200)]
Use locking, prefer our mutex abstraction layer

9 years agoAdded enum names for PKCS#11 return values
Martin Willi [Wed, 14 Jul 2010 08:22:42 +0000 (10:22 +0200)]
Added enum names for PKCS#11 return values

9 years agoLoad PKCS#11 modules defined in strongswan.conf
Martin Willi [Wed, 14 Jul 2010 07:48:29 +0000 (09:48 +0200)]
Load PKCS#11 modules defined in strongswan.conf

9 years agoImplemented an abstraction layer for PKCS#11 module loading
Martin Willi [Wed, 14 Jul 2010 07:47:37 +0000 (09:47 +0200)]
Implemented an abstraction layer for PKCS#11 module loading

9 years agoImported the free pkcs11.h header form the Scute project
Martin Willi [Wed, 14 Jul 2010 07:46:24 +0000 (09:46 +0200)]
Imported the free pkcs11.h header form the Scute project

9 years agoAdded PKCS#11 token plugin stub
Martin Willi [Tue, 13 Jul 2010 15:34:34 +0000 (17:34 +0200)]
Added PKCS#11 token plugin stub

9 years agoadded ikev2/rw-eap-tls-only scenario
Andreas Steffen [Wed, 4 Aug 2010 06:36:27 +0000 (08:36 +0200)]
added ikev2/rw-eap-tls-only scenario

9 years ago--enable eap-tls and --disable-load-warning in uml build
Andreas Steffen [Wed, 4 Aug 2010 05:47:08 +0000 (07:47 +0200)]
--enable eap-tls and --disable-load-warning in uml build

9 years agotest_cert adapted to extended signature of get_encoding().
Tobias Brunner [Tue, 3 Aug 2010 16:59:27 +0000 (18:59 +0200)]
test_cert adapted to extended signature of get_encoding().

9 years agoFixed compiler warnings.
Tobias Brunner [Tue, 3 Aug 2010 16:59:12 +0000 (18:59 +0200)]
Fixed compiler warnings.

9 years agoMoved TLS stack to its own library
Martin Willi [Tue, 3 Aug 2010 13:17:40 +0000 (15:17 +0200)]
Moved TLS stack to its own library

9 years agoMoved eap-tls plugin to libcharon, updated to 4.4.1 APIs
Martin Willi [Fri, 19 Mar 2010 17:55:23 +0000 (18:55 +0100)]
Moved eap-tls plugin to libcharon, updated to 4.4.1 APIs

9 years agoImplemented EAP-TLS server functionality
Martin Willi [Tue, 9 Feb 2010 17:19:25 +0000 (18:19 +0100)]
Implemented EAP-TLS server functionality

9 years agoTLS stack keeps a copy of server/peer identities
Martin Willi [Tue, 9 Feb 2010 13:57:50 +0000 (14:57 +0100)]
TLS stack keeps a copy of server/peer identities

9 years agoLimit the number of EAP-TLS packets allowed
Martin Willi [Tue, 9 Feb 2010 11:53:42 +0000 (12:53 +0100)]
Limit the number of EAP-TLS packets allowed

9 years agoUse stricter state handling while processing TLS messages
Martin Willi [Tue, 9 Feb 2010 11:37:29 +0000 (12:37 +0100)]
Use stricter state handling while processing TLS messages

9 years agoCleaned up the public TLS interface
Martin Willi [Fri, 5 Feb 2010 13:39:19 +0000 (13:39 +0000)]
Cleaned up the public TLS interface

9 years agoRefactored common used operations into TLS crypto helper
Martin Willi [Fri, 5 Feb 2010 13:25:38 +0000 (14:25 +0100)]
Refactored common used operations into TLS crypto helper

9 years agoProperly send empty EAP-TLS messages
Martin Willi [Fri, 5 Feb 2010 11:30:01 +0000 (11:30 +0000)]
Properly send empty EAP-TLS messages

9 years agoDerive MSK for EAP-TLS authentication
Martin Willi [Fri, 5 Feb 2010 11:28:48 +0000 (11:28 +0000)]
Derive MSK for EAP-TLS authentication

9 years agoVerify Server Finished message
Martin Willi [Fri, 5 Feb 2010 11:27:52 +0000 (11:27 +0000)]
Verify Server Finished message

9 years agoImplemented input record decryption and verification
Martin Willi [Fri, 5 Feb 2010 10:50:29 +0000 (10:50 +0000)]
Implemented input record decryption and verification

9 years agoImplemented key derivation, output record signing and encryption
Martin Willi [Thu, 4 Feb 2010 17:18:10 +0000 (18:18 +0100)]
Implemented key derivation, output record signing and encryption

9 years agoDerive master secret, create Finished message
Martin Willi [Thu, 4 Feb 2010 10:17:48 +0000 (11:17 +0100)]
Derive master secret, create Finished message

9 years agoImplemented the TLS specific PRF in its TLSv1.0 and TLSv1.2 variants
Martin Willi [Thu, 4 Feb 2010 09:08:07 +0000 (10:08 +0100)]
Implemented the TLS specific PRF in its TLSv1.0 and TLSv1.2 variants

9 years agoImplemented sending of Certificate, ClientKeyExchange, CertificateVerify and ChangeCi...
Martin Willi [Wed, 3 Feb 2010 18:53:40 +0000 (19:53 +0100)]
Implemented sending of Certificate, ClientKeyExchange, CertificateVerify and ChangeCipherSpec as peer

9 years agoImplemented a tls_writer class to simplify TLS data generation
Martin Willi [Mon, 1 Feb 2010 14:12:18 +0000 (15:12 +0100)]
Implemented a tls_writer class to simplify TLS data generation

9 years agoImplemented a tls_reader class to simplify TLS data parsing
Martin Willi [Mon, 1 Feb 2010 10:25:44 +0000 (10:25 +0000)]
Implemented a tls_reader class to simplify TLS data parsing

9 years agoProcess ServerHello(Done), Certificate(Request) messages
Martin Willi [Mon, 25 Jan 2010 16:31:55 +0000 (17:31 +0100)]
Process ServerHello(Done), Certificate(Request) messages

9 years agoSend a ClientHello to start TLS negotiation
Martin Willi [Mon, 25 Jan 2010 11:23:59 +0000 (11:23 +0000)]
Send a ClientHello to start TLS negotiation

9 years agoAdded TLS crypto helper, currently supports cipher suite selection
Martin Willi [Mon, 25 Jan 2010 11:21:57 +0000 (11:21 +0000)]
Added TLS crypto helper, currently supports cipher suite selection

9 years agoAdded support for AUTH_HMAC_SHA2_256_256, used in TLS
Martin Willi [Mon, 25 Jan 2010 11:15:05 +0000 (11:15 +0000)]
Added support for AUTH_HMAC_SHA2_256_256, used in TLS

9 years agoAdded stubs for handshake handling, server and peer variants
Martin Willi [Mon, 25 Jan 2010 09:44:35 +0000 (10:44 +0100)]
Added stubs for handshake handling, server and peer variants

9 years agoAccept follow-up fragments with a TLS message length
Martin Willi [Mon, 25 Jan 2010 09:42:44 +0000 (10:42 +0100)]
Accept follow-up fragments with a TLS message length