aboutsummaryrefslogtreecommitdiffstats
path: root/src/libstrongswan/plugins
Commit message (Collapse)AuthorAgeFilesLines
* curl: For SSL features, depend on thread-safety provided by our crypto pluginsMartin Willi2014-09-243-7/+57
| | | | | | | | | To use SSL in curl, we need to initialize the SSL library in a thread-safe manner and provide the appropriate callbacks. As we already do that in our crypto plugins using these libraries, we depend on these features. This implies that we need the same plugin enabled (openssl, gcrypt) as the curl backend is configured to use to fetch from HTTPS URIs.
* curl: Dynamically query supported protocols and register appropriate featuresMartin Willi2014-09-241-10/+64
|
* curl: Try to initialize with SSL support to handle https:// URIsMartin Willi2014-09-241-1/+6
| | | | If initialization fails, we fall back to the old behavior.
* plugin-loader: Support a reload() callback for static featuresMartin Willi2014-09-222-4/+35
|
* curl: Log error code tooTobias Brunner2014-09-091-2/+5
| | | | It seems libcurl does not always return an error message.
* openssl: Report correct key length for EC keys when not using NIST curvesTobias Brunner2014-09-022-22/+2
| | | | Fixes #688.
* winhttp: Do not use countof() on pointer argumentTobias Brunner2014-07-021-1/+1
|
* gcrypt: Use predefined pthread locking functions instead of custom hooksMartin Willi2014-07-011-50/+4
| | | | | | | | | | | | | Starting with libgcrypt 1.6, it seems that custom locking functions are not supported anymore. Instead, the user has to select from one of the pre-defined set of locking functions. Given that we have a proper threading abstraction API with optional profiling on all platforms, this is somewhat annoying. However, there does not seem to be a way to use custom functions, and we have no other choice than using the provided macro magic to support all libgcrypt versions. Fixes #630.
* charon: Set CLOEXEC flag on daemon PID file and /dev/(u)random source FDsMartin Willi2014-06-241-0/+5
| | | | | | | | | | | | | On Fedora, SELinux complains about these open file descriptors when the updown script invokes iptables. While it seems difficult to set the flag on all file descriptors, this at least fixes those covered by the SELinux policy. As these two cases are in code executed while the daemon is still single threaded, we avoid the use of atomic but not fully portable fdopen("e") or open(O_CLOEXEC) calls. Fixes #519.
* winhttp: Fix a typo to properly release connection handleMartin Willi2014-06-191-1/+1
| | | | Fixes a rather large memory leak in HTTP fetches.
* sshkey: Fix loading of ECDSA keys from filesTobias Brunner2014-06-182-3/+3
|
* sshkey: Add support to parse SSH public keys from files with left|rightsigkeyTobias Brunner2014-06-183-3/+59
|
* winhttp: Support basic authentication for URLs having credentialsMartin Willi2014-06-041-3/+23
|
* winhttp: Support new response code fetcher optionMartin Willi2014-06-041-0/+34
|
* winhttp: Implement a http(s) fetcher based on Microsofts WinHTTP APIMartin Willi2014-06-045-0/+522
|
* x509: Check return value when signing attribute certificatesMartin Willi2014-06-041-9/+16
| | | | | | In addition that this lets AC generation fail properly if private key signing fails, it also fixes an issue when compiling on Windows with MinGW 4.8.1, where for some reason the attributeCertificateInfo got encoded incorrectly.
* openssl: Don't re-enter FIPS mode if we are already using itMartin Willi2014-06-041-2/+3
| | | | | | If FIPS mode has been enabled by other means, under some environments it can't be entered again. It fails with "FIPS mode already set". To avoid it, we first check the mode before changing it.
* openssl: Be less verbose about FIPS mode when not running as daemonMartin Willi2014-06-041-2/+2
| | | | | While this is valuable information, printing it for pki and other tools is annoying.
* sqlite: Avoid name clash when building on WindowsMartin Willi2014-06-041-2/+2
|
* mysql: Add Windows supportMartin Willi2014-06-042-5/+8
| | | | | | As the mysql_config script is not available for Windows, we use a hardcoded library name and no additional CFLAGS. This builds fine against the binary MySQL Connector/C distribution.
* openssl: Fix includes to prevent <winsock2.h> to complain about include orderMartin Willi2014-06-042-6/+8
|
* openssl: Undef OpenSSLs X509_NAME defined by <wincrypt.h>Martin Willi2014-06-041-0/+6
|
* openssl: Check and link against libeay32 instead of libcrypto on WindowsMartin Willi2014-06-041-1/+1
| | | | Most Windows OpenSSL builds come with the crypto library named libeay32.
* sha1: Include <library.h> instead of directly including <arpa/inet.h>Martin Willi2014-06-042-4/+3
| | | | On Windows we don't have <arpa/inet.h>
* x509: Undef OCSP_RESPONSE from <wincrypt.h> before using itMartin Willi2014-06-041-0/+5
|
* plugins: Don't link with -rdynamic on WindowsMartin Willi2014-06-0447-49/+48
|
* windows: Provide wrappers for dlopen() function familyMartin Willi2014-06-031-0/+2
|
* curl: Don't set CURLOPT_FAILONERRORTobias Brunner2014-05-311-14/+5
| | | | | With the strongTNC REST API some errors will actually be accompanied by a response we want to receive completely.
* soup: Add support to retrieve the response codeTobias Brunner2014-05-191-2/+14
|
* curl: Add support to return the response codeTobias Brunner2014-05-191-1/+27
|
* enum: Don't directly include enum.hMartin Willi2014-05-162-3/+2
| | | | | To allow enum.h to depend on utils.h definitions, avoid its direct inclusion. Instead include utils.h, which includes enum.h as well.
* unbound: Explicitly cast from ldns RR type/class to our typesMartin Willi2014-05-161-2/+2
| | | | | | These definitions are directly derived from the RFC, so it should be safe to cast them. clang complains about the different types, so cast them explicitly.
* x509: Remove some unused ASN1 OID constantsMartin Willi2014-05-162-25/+0
|
* aes: Remove unused build variantsMartin Willi2014-05-161-622/+65
| | | | | | The AES code historically has different build options for various size/speed trade-offs. We never made use of them, so just drop the obsolete code. The code now has four hard-coded fixed tables, both inverse and original.
* Added PUBKEY_RSA_MODULUS encoding typeAndreas Steffen2014-05-021-12/+35
|
* sqlite: Allow query arguments to be freed before starting the enumerationTobias Brunner2014-04-301-2/+4
| | | | | By marking the string/blob arguments as transient, SQLite will copy and free them automatically.
* x509: Don't include authKeyIdentifier in self-signed certificatesTobias Brunner2014-04-091-1/+1
| | | | | As the comment indicates this was the intention in d7be2906433a7dcfefc1fd732587865688dbfe1b all along.
* x509: Initialize certs when building optionalSignature for OCSP requestsTobias Brunner2014-04-091-1/+1
|
* Added support for msSmartcardLogon EKUAndreas Steffen2014-04-081-3/+10
|
* Initialize m1 to suppress compiler warningAndreas Steffen2014-04-071-1/+1
|
* test-vectors: Renumber AES-GCM test vectors according to original sourceTobias Brunner2014-03-312-16/+100
| | | | Also adds several missing ones.
* aead: Support custom AEAD salt sizesMartin Willi2014-03-318-25/+68
| | | | | | | | | The salt, or often called implicit nonce, varies between AEAD algorithms and their use in protocols. For IKE and ESP, GCM uses 4 bytes, while CCM uses 3 bytes. With TLS, however, AEAD mode uses 4 bytes for both GCM and CCM. Our GCM backends currently support 4 bytes and CCM 3 bytes only. This is fine until we go for CCM mode support in TLS, which requires 4 byte nonces.
* revocation: Log error if no OCSP signer candidate foundMartin Willi2014-03-311-1/+1
| | | | Fixes evaluation of ikev2/ocsp-untrusted-cert.
* revocation: Restrict OCSP signing to specific certificatesMartin Willi2014-03-311-7/+63
| | | | | | | | | | | | | To avoid considering each cached OCSP response and evaluating its trustchain, we limit the certificates considered for OCSP signing to: - The issuing CA of the checked certificate - A directly delegated signer by the same CA, having the OCSP signer constraint - Any locally installed (trusted) certificate having the OCSP signer constraint The first two options cover the requirements from RFC 6960 2.6. For compatibility with non-conforming CAs, we allow the third option as exception, but require the installation of such certificates locally.
* revocation: Don't merge auth config of CLR/OCSP trustchain validationMartin Willi2014-03-311-39/+24
| | | | | | | | | | This behavior was introduced with 6840a6fb to avoid key/signature strength checking for the revocation trustchain as we do it for end entity certificates. Unfortunately this breaks CA constraint checking under certain conditions, as we merge additional intermediate/CA certificates to the auth config. As key/signature strength checking of the revocation trustchain is a rather exotic requirement we drop support for that to properly enforce CA constraints.
* x509: CERT_DECODE actually requires KEY_ANYTobias Brunner2014-03-311-3/+1
| | | | | More specific decoders might still be needed, but the x509 plugin should not care which ones.
* pkcs1: KEY_ANY public key decoder soft depends on specific decodersTobias Brunner2014-03-311-0/+3
|
* acert: Implement a plugin finding, validating and evaluating attribute certsMartin Willi2014-03-315-0/+356
| | | | | | This validator checks for any attribute certificate it can find for validated end entity certificates and tries to extract group membership information used for connection authorization rules.
* x509: Match acert has_subject() against entityName or holder serialMartin Willi2014-03-311-5/+25
| | | | | This allows us to find attribute certificates for a subject certificate in credential sets.
* pem: Support encoding of attribute certificatesMartin Willi2014-03-311-1/+6
| | | | | | | While there is no widely used PEM header for attribute certificates, at least IAIK-JCE uses BEGIN ATTRIBUTE CERTIFICATE: http://javadoc.iaik.tugraz.at/iaik_jce/current/iaik/utils/Util.html#toPemString(iaik.x509.attr.AttributeCertificate)
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-01 18:33:14 +0000