aboutsummaryrefslogtreecommitdiffstats
path: root/src/libstrongswan/credentials
Commit message (Collapse)AuthorAgeFilesLines
* Fixed some typos, courtesy of codespellTobias Brunner2017-05-261-1/+1
|
* linked-list: Change return value of find_first() and signature of its callbackTobias Brunner2017-05-262-13/+15
| | | | This avoids the unportable five pointer hack.
* Change interface for enumerator_create_filter() callbackTobias Brunner2017-05-262-111/+129
| | | | | This avoids the unportable 5 pointer hack, but requires enumerating in the callback.
* Migrate all enumerators to venumerate() interface changeTobias Brunner2017-05-267-73/+104
|
* credential-manager: Prefer local over global setsAdrian-Ken Rueegsegger2017-05-231-7/+7
| | | | | Invert set enumeration order to first enumerate local and then global credential sets.
* Reference Edwards-curve signature RFCsAndreas Steffen2017-03-201-5/+5
|
* builder: Define a builder part for X.509 RFC 3779 address blocksMartin Willi2017-02-272-0/+3
|
* mem-cred: Add methods to add/remove shared keys with unique identifiersTobias Brunner2017-02-162-6/+107
| | | | Also added is a method to enumerate the unique identifiers.
* mem-cred: Add method to remove a private key with a specific fingerprintTobias Brunner2017-02-162-2/+38
|
* Implemented EdDSA for IKEv2 using a pro forma Identity hash functionAndreas Steffen2016-12-141-17/+31
|
* Added support of EdDSA signaturesAndreas Steffen2016-12-145-17/+51
|
* Fixed in-place update of cached base and delta CRLsAndreas Steffen2016-10-301-4/+4
|
* Newer CRLs replace older versions of the CRL in the cacheAndreas Steffen2016-10-261-0/+39
|
* mem-cred: Support storing a delta CRL together with its baseTobias Brunner2016-10-111-8/+30
| | | | | | | | | | | | So far every "newer" CRL (higher serial or by date) replaced an existing "older" CRL. This meant that delta CRLs replaced an existing base CRL and that base CRLs weren't added if a delta CRL was already stored. So the base had to be re-fetched every time after a delta CRL was added. With this change one delta CRL to the latest base may be stored. A newer delta CRL will replace an existing delta CRL (but not its base, older base CRLs are removed, though). And a newer base will replace the existing base and optional delta CRL.
* gmp: Support of SHA-3 RSA signaturesAndreas Steffen2016-09-223-34/+67
|
* auth-cfg-wrapper: Fix memory leak with hash-and-URL certificatesTobias Brunner2016-09-121-1/+1
| | | | | | | We wrap the auth-cfg object and its contents, so there is no need to get an additional reference for the enumerated certificate. Fixes a44bb9345f04 ("merged multi-auth branch back into trunk")
* mem-cred: Fix memory leak when replacing existing CRLsTobias Brunner2016-05-111-0/+1
| | | | Fixes #1442.
* Use standard unsigned integer typesAndreas Steffen2016-03-243-7/+7
|
* Fix some Doxygen issuesTobias Brunner2016-03-111-5/+5
|
* auth-cfg: Add a rule to suspend certificate validation constraintsTobias Brunner2016-03-102-0/+18
|
* credential-manager: Check cache queue when destroying trusted certificate ↵Tobias Brunner2016-03-101-1/+2
| | | | | | | | | | enumerator We already do this in the trusted public key enumerator (which internally uses the trusted certificate enumerator) but should do so also when this enumerator is used directly (since the public key enumerator has the read lock the additional call will just be skipped there).
* credential-manager: Make online revocation checks optional for public key ↵Tobias Brunner2016-03-102-3/+9
| | | | enumerator
* auth-cfg: Make IKE signature schemes configurableTobias Brunner2016-03-042-37/+63
| | | | | | This also restores the charon.signature_authentication_constraints functionality, that is, if no explicit IKE signature schemes are configured we apply all regular signature constraints as IKE constraints.
* ikev2: Diversify signature scheme ruleThomas Egerer2016-03-042-30/+68
| | | | | | | This allows for different signature schemes for IKE authentication and trustchain verification. Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
* Apply pubkey and signature constraints in vici pluginAndreas Steffen2015-12-172-0/+117
|
* Refactored certificate management for the vici and stroke interfaces5.4.0dr1Andreas Steffen2015-12-122-30/+130
|
* Changed some certificate_type_names and added x509_flag_namesAndreas Steffen2015-12-113-4/+36
|
* Print OCSP single responsesAndreas Steffen2015-12-112-3/+82
|
* Standardized printing of certificate informationAndreas Steffen2015-12-112-0/+651
| | | | | | | The certificate_printer class allows the printing of certificate information to a text file (usually stdout). This class is used by the pki --print and swanctl --list-certs commands as well as by the stroke plugin.
* auth-cfg: Prefer merged rules over existing ones when moving themTobias Brunner2015-11-121-3/+3
| | | | | | This is particularly important for single valued rules (e.g. identities). When copying values this is already handled correctly by the enumerator and add().
* Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemesAndreas Steffen2015-11-062-28/+28
|
* Support BLISS signatures with SHA-3 hashAndreas Steffen2015-11-032-4/+28
|
* auth-cfg: Don't enforce EAP_RADIUSTobias Brunner2015-08-211-1/+2
| | | | | Basically the same as e79b0e07e4ab. EAP_RADIUS is also a virtual method that will identify itself as a different EAP method later.
* mem-cred: We don't need a write lock when looking for a certificateTobias Brunner2015-08-201-1/+1
|
* mem-cred: Add a method to atomically replace all certificatesTobias Brunner2015-08-202-10/+58
|
* auth-cfg: Don't enforce EAP_DYNAMICTobias Brunner2015-08-201-1/+2
| | | | | We now store the actual method on the auth config, which won't match anymore if rightauth=eap-dynamic is configured.
* auth-cfg: Matching one CA should be enough, similar to peer certificatesTobias Brunner2015-08-171-15/+20
| | | | | | | | | | Not sure if defining multiple CA constraints and enforcing _all_ of them, i.e. the previous behavior, makes even sense. To ensure a very specific chain it should be enough to define the last intermediate CA. On the other hand, the ability to define multiple CAs could simplify configuration. This can currently only be used with swanctl/VICI based configs as `rightca` only takes a single DN.
* Fixed some typosTobias Brunner2015-08-132-2/+2
|
* credential-manager: Store BLISS key strength in auth configTobias Brunner2015-03-041-0/+3
|
* auth-cfg: Add BLISS key strength constraintTobias Brunner2015-03-042-21/+43
|
* public-key: Add helper to determine acceptable signature schemes for keysTobias Brunner2015-03-042-0/+78
|
* public-key: Add helper to map signature schemes to ASN.1 OIDsTobias Brunner2015-03-042-3/+54
| | | | | | There is a similar function to map key_type_t and hasher_t to an OID, but this maps schemes directly (and to use the other function we'd have to have a function to map schemes to hash algorithms first).
* public-key: Add helper to determine key type from signature schemeTobias Brunner2015-03-042-0/+43
|
* mem-cred: Add a method to unify certificate references, without adding itMartin Willi2015-03-032-0/+31
| | | | | In contrast to add_cert_ref(), get_cert_ref() does not add the certificate to the set, but only finds a reference to the same certificate, if found.
* Allow SHA256 and SHA384 data hash for BLISS signatures.Andreas Steffen2015-02-262-0/+10
| | | | | The default is SHA512 since this hash function is also used for the c_indices random oracle.
* Started implementing BLISS signature generationAndreas Steffen2014-11-292-7/+7
|
* Store and parse BLISS private and public keys in DER and PEM formatAndreas Steffen2014-11-291-0/+4
| | | | | | | | Additionally generate SHA-1 fingerprints of raw BLISS subjectPublicKey and subjectPublicKeyInfo objects. Some basic functions used by the bliss_public_key class are shared with the bliss_private_key class.
* Created framework for BLISS post-quantum signature algorithmAndreas Steffen2014-11-292-5/+16
|
* cert-cache: Prevent that a cached issuer is freed too earlyTobias Brunner2014-10-241-7/+10
| | | | | | | | Previously we got no reference to the cached issuer certificate before releasing the lock of the cache line, this allowed other threads, or even the same thread if it replaces a cache line, to destroy that issuer certificate in cache() (or flush()) before get_ref() for the issuer certificate is finally called.
* auth-cfg: Fix crash after several reauthentications with multiple ↵Tobias Brunner2014-09-111-1/+1
| | | | | | | | | | authentication rounds Due to the issue described in c641974, purge() inadvertently destroyed CA certificates that should have been kept (while the pointer to these objects remained in the array). This lead to incorrect reference counts and after a few reauthentications with multiple authentication rounds, which cause calls to purge(TRUE), to crashes.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-14 16:30:26 +0000