aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
| * Provide TKM credential encoderReto Buerki2013-03-195-26/+150
| | | | | | | | | | | | | | | | The TKM credential encoder creates fingerprints of type KEYID_PUBKEY_INFO_SHA1 and KEYID_PUBKEY_SHA1 using CRED_PART_RSA_PUB_ASN1_DER. This makes the pkcs1 plugin unnecessary.
| * Switch to openssl pluginReto Buerki2013-03-191-8/+1
| |
| * Implement multiple-clients integration testReto Buerki2013-03-1912-0/+158
| | | | | | | | | | | | | | | | Two transport connections to gateway sun are set up, one from client carol and the other from client dave. The gateway sun uses the Trusted Key Manager (TKM) and is the responder for both connections. The authentication is based on X.509 certificates. In order to test the connections, both carol and dave ping gateway sun.
| * Implement net2net-xfrmproxy integration testReto Buerki2013-03-1910-0/+108
| |
| * Implement net2net-initiator integration testReto Buerki2013-03-199-0/+104
| |
| * Add xfrm_proxy integration testReto Buerki2013-03-1910-0/+102
| |
| * Provide script to build Ada XFRM proxyReto Buerki2013-03-191-0/+21
| |
| * Add TKM responder integration testReto Buerki2013-03-1910-0/+97
| |
| * Add initial TKM integration testReto Buerki2013-03-1910-0/+96
| | | | | | | | | | | | A connection between the hosts moon and sun is set up. The host moon uses the Trusted Key Manager (TKM) and is the initiator of the transport connection. The authentication is based on X.509 certificates.
| * Add expect-file guest image scriptReto Buerki2013-03-191-0/+29
| | | | | | | | | | This script can be used in pretest.dat files to wait until a given file appears.
| * Add /usr/local/lib/ipsec to linker cacheReto Buerki2013-03-192-0/+3
| |
| * Provide recipes to build tkm and required librariesReto Buerki2013-03-196-1/+105
| |
| * Add GNAT compiler and Ada libs to base imageReto Buerki2013-03-191-0/+2
| |
| * Don't manually register kernel_netlink_netReto Buerki2013-03-194-16/+11
| | | | | | | | | | | | | | | | | | Load complete kernel_netlink plugin instead. Registering the TKM specific plugins first still ensures that the correct ipsec plugin is used. Lazy initialize the RNG_WEAK plugin to avoid the unsatisfiable soft dependency on startup.
| * Move stroke plugin to the end of PLUGINS listReto Buerki2013-03-191-2/+2
| | | | | | | | | | This fixes the problem of stroke being unable to load the ca certificates on startup.
| * Make sure IP_XFRM_POLICY is definedReto Buerki2013-03-191-0/+5
| |
| * Call isa_skip_create_first when keeping IKE SAAdrian-Ken Rueegsegger2013-03-191-0/+20
| | | | | | | | | | | | | | An ALERT_KEEP_ON_CHILD_SA_FAILURE alert is issued when child SA establishment fails but the corresponding IKE SA is not destroyed. To allow later creation of child SAs the ISA context must be signaled that the implicity first child SA creation was skipped.
| * Make IKE and EES sockets configurableAdrian-Ken Rueegsegger2013-03-191-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | The IKE and EES sockets are now read from strongswan.conf. They can be specified like this: charon-tkm { ike_socket = /tmp/tkm.rpc.ike ees_socket = /tmp/tkm.rpc.ees } The socket names given above are used by default if none are configured.
| * Implement TKM-specific credential setReto Buerki2013-03-195-21/+206
| | | | | | | | | | | | | | The TKM credential set extends the in-memory credential set. It provides a private key enumerator which is used to instantiate private key proxy objects on-demand. This allows the usage of private keys with arbitrary identifiers.
| * Initialize libstrongswan in test_runner main()Reto Buerki2013-03-192-54/+41
| |
| * Set ri_id to reqid when setting user certificateAdrian-Ken Rueegsegger2013-03-191-2/+29
| | | | | | | | | | | | | | | | | | Pass the reqid (of the first child config of an IKE SA) as remote identity id when calling cc_set_user_certificate. May lead to the usage of the wrong id in case an IKE SA has multiple child configurations/reqids. This must be replaced with a proper lookup once the configuration backend is implemented and provides remote identity ids to charon-tkm.
| * Set sp_id to reqid when creating ESAAdrian-Ken Rueegsegger2013-03-191-3/+3
| | | | | | | | The reqid corresponds to the sp_id (security policy id) on the TKM side.
| * Call Esa_Select after creation of child SAAdrian-Ken Rueegsegger2013-03-191-0/+10
| | | | | | | | This tells the TKM which child SA is the currently active SA.
| * Check that chunk fits into sequence when convertingAdrian-Ken Rueegsegger2013-03-191-1/+13
| |
| * Remove result out parameter from EES InitReto Buerki2013-03-193-21/+4
| | | | | | | | Error processing is done by the registered exception handler.
| * Drop support for pre-shared key authenticationAdrian-Ken Rueegsegger2013-03-191-23/+1
| |
| * charon-tkm: Register TKM private key on startupReto Buerki2013-03-191-0/+13
| |
| * Add TKM private key implementationReto Buerki2013-03-192-0/+206
| | | | | | | | | | | | | | | | | | | | | | | | | | The key currently imitates the private key of alice@strongswan.org by returning it's fingerprint in the get_fingerprint function. This associates the private key with alice's X.509 cert and charon will use it to create a signature over the local AUTH octets of the test connection. The private key serves as a proxy to the TKM ike_isa_sign operation and extracts the required information from the auth octets chunk passed on by the keymat.
| * keymat: Store signature info in auth octetsReto Buerki2013-03-191-2/+14
| | | | | | | | | | | | Store the ISA context id and the initial message in the auth octets chunk using the sign_info_t struct. Charon will pass on this information to the TKM private key sign operation where it is extracted.
| * Add AUTH signature info data structureReto Buerki2013-03-191-0/+26
| | | | | | | | | | The sign_info_t type is used to transfer an ISA context id and the initial message from the keymat to the TKM private key sign operation.
| * charon-tkm: Register TKM public key on startupAdrian-Ken Rueegsegger2013-03-191-0/+5
| |
| * Add TKM public key implementationAdrian-Ken Rueegsegger2013-03-192-0/+213
| | | | | | | | | | | | | | The key unconditionally returns TRUE for the verify operation if it is called with a supported signature algorithm. All such verification operations are performed by the TKM (e.g. trustchain or auth octets verification) anyway, so this is safe.
| * Authenticate ISA using certificatesAdrian-Ken Rueegsegger2013-03-191-1/+11
| | | | | | | | | | The authentication of the ISA is now done using the certificate provided by the peer.
| * Store peer IKE init messageAdrian-Ken Rueegsegger2013-03-192-0/+26
| | | | | | | | | | | | The IKE init message sent to us by the peer is needed for authentication in the authorization hook. Store the message as chunk in the keymat and provide a getter to make it available.
| * Build cc context in tkm listener authorize hookAdrian-Ken Rueegsegger2013-03-191-0/+143
| | | | | | | | | | | | Extract peer certificate information and build a TKM certificate chain context in the authorize hook of the tkm_listener_t. The cc context will be used for ISA authentication using certificates.
| * Add TKM_CTX_CC (Certificate chain context id)Adrian-Ken Rueegsegger2013-03-194-2/+5
| |
| * Add typelen parameter to chunk_to_sequence functionAdrian-Ken Rueegsegger2013-03-196-10/+14
| | | | | | | | The parameter is used to initialize the given sequence to zero.
| * Implement Ada exception processingReto Buerki2013-03-198-1/+146
| | | | | | | | | | Register a global exception action with the Ada runtime to log uncaught exceptions to the daemon log and terminate.
| * Implement Esa Event Service (EES)Reto Buerki2013-03-1910-7/+272
| | | | | | | | | | | | The Esa Event Service can be used to trigger ESP SA (ESA) events such as acquire or expire. The incoming events are forwarded to the hydra kernel interface for processing.
| * Conditionally reset AE context in keymat destroyAdrian-Ken Rueegsegger2013-03-192-12/+66
| | | | | | | | | | | | | | The responsibility to reset an authenticated endpoint context is passed from a parent IKE SA keymat to the new keymat by including it in the ISA info data contained in the skd chunk. The last IKE SA to be destroyed will also reset the associated AE context.
| * Let tkm_keymat_t extend keymat_v2_tAdrian-Ken Rueegsegger2013-03-193-102/+31
| |
| * Implement IKE SA rekeyingAdrian-Ken Rueegsegger2013-03-191-9/+29
| | | | | | | | | | Use the TKM ike_isa_create_child exchange to rekey an IKE SA. The isa context id is passed on (ab)using the rekey_skd chunk.
| * Add test for keymat derive_child_keys operationAdrian-Ken Rueegsegger2013-03-191-0/+89
| |
| * Implement ESA rekeying with and without PFSAdrian-Ken Rueegsegger2013-03-191-13/+97
| | | | | | | | | | | | | | | | | | | | A child SA is being rekeyed if the esa information passed to the add_sa function contains nonces. If it also contains a valid Diffie-Hellman context id PFS is used. The fact that the encr_r encryption key is passed to add_sa in the inbound case can be used to determine if we are initiator or not by inspecting the is_encr_r flag of the esa information struct.
| * Extend esa_info_t structAdrian-Ken Rueegsegger2013-03-193-17/+87
| | | | | | | | | | | | | | | | | | | | Add additional fields to the esa_info_t struct so the necessary data can be passed from the keymat to the kernel ipsec interface, where ESA creation and key generation using the TKM takes place. The information is used during the inbound add_sa call to create an ESP SA. This makes the hack of storing the local SPI in a kernel interface variable between subsequent add_sa calls unnecessary.
| * Use SAD to manage TKM ESA context informationAdrian-Ken Rueegsegger2013-03-191-6/+43
| | | | | | | | | | | | An SAD entry is added after successfull creation of a TKM ESA context in the add_sa() function. The corresponding entry is removed in del_sa() using the SAD, src, dst, spi and protocol parameters.
| * Implement TKM kernel SA database (SAD)Adrian-Ken Rueegsegger2013-03-195-0/+452
| | | | | | | | | | The TKM kernel SAD (security association database) stores information about CHILD SAs.
| * Add TKM_CTX_ESA (ESP SA context id)Adrian-Ken Rueegsegger2013-03-194-5/+8
| |
| * Use rng to generate local ESP SPIsAdrian-Ken Rueegsegger2013-03-193-4/+19
| |
| * charon-tkm: Register kernel_netlink_netAdrian-Ken Rueegsegger2013-03-193-1/+10
| | | | | | | | | | | | Explicitly register kernel netlink net implementation and avoid loading the whole kernel-netlink plugin since the kernel netlink ipsec part is unwanted.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 19:14:55 +0000