| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | x509: CERT_DECODE actually requires KEY_ANY | Tobias Brunner | 2014-03-31 | 1 | -3/+1 | |
| | | | | | | More specific decoders might still be needed, but the x509 plugin should not care which ones. | |||||
| * | pkcs1: KEY_ANY public key decoder soft depends on specific decoders | Tobias Brunner | 2014-03-31 | 1 | -0/+3 | |
| | | ||||||
| * | eap-radius: Add option to not close IKE_SAs on timeouts during interim ↵ | Tobias Brunner | 2014-03-31 | 1 | -1/+6 | |
| | | | | | | | accouting updates Fixes #528. | |||||
| * | ikev1: Accept SPI size of any length <= 16 in ISAKMP proposal | Tobias Brunner | 2014-03-31 | 1 | -4/+12 | |
| | | | | | Fixes #533. | |||||
| * | proposal: Don't fail DH proposal matching if peer includes NONE | Tobias Brunner | 2014-03-31 | 1 | -4/+19 | |
| | | | | | | | | | The DH transform is optional for ESP/AH proposals. The initiator can include NONE (0) in its proposal to indicate that while it prefers to do a DH exchange, the responder may still decide to not do so. Fixes #532. | |||||
| * | openac: Remove obsolete openac utility | Martin Willi | 2014-03-31 | 7 | -744/+1 | |
| | | | | | The same functionality is now provided by the pki --acert subcommand. | |||||
| * | pki: Document --not-before/after and --dateform options in manpages | Martin Willi | 2014-03-31 | 4 | -7/+99 | |
| | | ||||||
| * | pki: Support absolute --this/next-update CRL lifetimes | Martin Willi | 2014-03-31 | 1 | -6/+22 | |
| | | ||||||
| * | pki: Support absolute --not-before/after issued certificate lifetimes | Martin Willi | 2014-03-31 | 2 | -7/+22 | |
| | | ||||||
| * | pki: Support absolute --not-before/after self-signed certificate lifetimes | Martin Willi | 2014-03-31 | 1 | -5/+22 | |
| | | ||||||
| * | pki: Support absolute --not-before/after acert lifetimes | Martin Willi | 2014-03-31 | 1 | -7/+26 | |
| | | ||||||
| * | pki: Add a certificate lifetime calculation helper function | Martin Willi | 2014-03-31 | 2 | -1/+69 | |
| | | ||||||
| * | ikev2: Cache all received attribute certificates to auth config | Martin Willi | 2014-03-31 | 1 | -1/+27 | |
| | | ||||||
| * | ikev2: Send all known and valid attribute certificates for subject cert | Martin Willi | 2014-03-31 | 1 | -0/+46 | |
| | | ||||||
| * | ikev2: Slightly refactor certificate payload construction to separate functions | Martin Willi | 2014-03-31 | 1 | -37/+56 | |
| | | ||||||
| * | ike: Support encoding of attribute certificates in CERT payloads | Martin Willi | 2014-03-31 | 1 | -1/+6 | |
| | | ||||||
| * | auth-cfg: Declare an attribute certificate helper type to exchange acerts | Martin Willi | 2014-03-31 | 3 | -2/+15 | |
| | | ||||||
| * | acert: Implement a plugin finding, validating and evaluating attribute certs | Martin Willi | 2014-03-31 | 6 | -0/+363 | |
| | | | | | | | This validator checks for any attribute certificate it can find for validated end entity certificates and tries to extract group membership information used for connection authorization rules. | |||||
| * | x509: Match acert has_subject() against entityName or holder serial | Martin Willi | 2014-03-31 | 1 | -5/+25 | |
| | | | | | | This allows us to find attribute certificates for a subject certificate in credential sets. | |||||
| * | pki: Add acert and extend pki/print manpages | Martin Willi | 2014-03-31 | 4 | -2/+115 | |
| | | ||||||
| * | pki: Implement an acert command to issue attribute certificates | Martin Willi | 2014-03-31 | 3 | -1/+275 | |
| | | ||||||
| * | pki: Support printing attribute certificates | Martin Willi | 2014-03-31 | 1 | -1/+89 | |
| | | ||||||
| * | pki: Don't generate negative random serial numbers in X.509 certificates | Martin Willi | 2014-03-31 | 2 | -0/+2 | |
| | | | | | According to RFC 5280 4.1.2.2 we MUST force non-negative serial numbers. | |||||
| * | pem: Support encoding of attribute certificates | Martin Willi | 2014-03-31 | 1 | -1/+6 | |
| | | | | | | | | While there is no widely used PEM header for attribute certificates, at least IAIK-JCE uses BEGIN ATTRIBUTE CERTIFICATE: http://javadoc.iaik.tugraz.at/iaik_jce/current/iaik/utils/Util.html#toPemString(iaik.x509.attr.AttributeCertificate) | |||||
| * | x509: Replace the comma separated string AC group builder with a list based one | Martin Willi | 2014-03-31 | 4 | -10/+22 | |
| | | ||||||
| * | x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t | Martin Willi | 2014-03-31 | 6 | -639/+186 | |
| | | | | | | The ietf_attributes_t class is used for attribute certificates only these days, and integrating them to x509_ac_t simplifies things significantly. | |||||
| * | x509: Replace fixed acert group string getter by a more dynamic group enumerator | Martin Willi | 2014-03-31 | 5 | -69/+131 | |
| | | ||||||
| * | x509: Skip parsing of acert chargingIdentity, as we don't use it anyway | Martin Willi | 2014-03-31 | 1 | -9/+1 | |
| | | ||||||
| * | x509: Fix some whitespaces and do some minor style cleanups in acert | Martin Willi | 2014-03-31 | 1 | -72/+76 | |
| | | ||||||
| * | ac: Remove unimplemented equals_holder() method from ac_t | Martin Willi | 2014-03-31 | 1 | -8/+0 | |
| | | ||||||
| * | unit-tests: Fix filtered enumerator tests on 64-bit big-endian platforms | Tobias Brunner | 2014-03-27 | 1 | -12/+12 | |
| | | | | | | In case of sizeof(void*) == 8 and sizeof(int) == 4 on big-endian hosts the tests failed as the actual integer value got cut off. | |||||
| * | unit-tests: Fix memory leak in ntru tests | Tobias Brunner | 2014-03-27 | 1 | -3/+5 | |
| | | ||||||
| * | unit-test: added missing TEST_FUNCTION macros | Andreas Steffen | 2014-03-22 | 1 | -8/+16 | |
| | | ||||||
| * | openssl: Add default fallback when calculating fingerprints of RSA keys | Tobias Brunner | 2014-03-22 | 1 | -1/+15 | |
| | | | | | | | We still try to calculate these directly as it can avoid a dependency on the pkcs1 or other plugins. But for e.g. PGPv3 keys we need to delegate the actual fingerprint calculation to the pgp plugin. | |||||
| * | Completed integration of ntru_crypto library into ntru plugin | Andreas Steffen | 2014-03-22 | 21 | -1711/+1227 | |
| | | ||||||
| * | crypto-tester: Don't fail if key size is not supported | Tobias Brunner | 2014-03-20 | 1 | -6/+3 | |
| | | | | | | | | | The Blowfish and Twofish implementations provided by the gcrypt plugin only support specific key lengths, which we don't know when testing against vectors (either during unit tests or during algorithm registration). The on_create test with a specific key length will be skipped anyway, so there is no point in treating this failure differently. | |||||
| * | unit-tests: Add an option to increase the verbosity when running tests | Tobias Brunner | 2014-03-20 | 1 | -1/+9 | |
| | | | | | | The TESTS_VERBOSITY option takes an integer from -1 to 4 that sets the default debug level. | |||||
| * | unit-tests: Add an option to run only a subset of all test suites | Tobias Brunner | 2014-03-20 | 1 | -8/+54 | |
| | | | | | | The TESTS_SUITES environment variable can contain a comma separated list of names of test suites to run. | |||||
| * | unit-tests: Actually verify registered algorithms against test vectors | Tobias Brunner | 2014-03-20 | 2 | -5/+47 | |
| | | | | | | | | | Previously, the {ns}.crypto_test.on_add option had to be enabled to actually test the algorithms, which we can't enforce for the tests in the test_runner as the option is already read when the crypto factory is initialized. Even so, we wouldn't want to do this for every unit test, which would be the result of enabling that option. | |||||
| * | unit-tests: Use TEST_FUNCTION macro in ntru tests | Tobias Brunner | 2014-03-20 | 1 | -34/+44 | |
| | | ||||||
| * | unit-tests: Implement registered functions without __builtin_apply() | Tobias Brunner | 2014-03-20 | 1 | -17/+17 | |
| | | | | | | This makes the tests work with clang, which does not implement said builtin. | |||||
| * | unit-tests: Call functions with TEST_ prefix in ntru test | Tobias Brunner | 2014-03-20 | 1 | -36/+38 | |
| | | ||||||
| * | unit-tests: Prefix imported testable functions with TEST_ | Tobias Brunner | 2014-03-20 | 1 | -3/+3 | |
| | | | | | This avoids any clashes with existing functions in the monolithic build. | |||||
| * | unit-tests: Change how hashtable for testable functions is created | Tobias Brunner | 2014-03-20 | 3 | -28/+49 | |
| | | | | | | | | | Because GCC does not adhere to the priorities defined for constructors when building with --enable-monolithic (not sure if it was just luck that it worked in non-monolithic mode - anyway, it's not very portable) function registration would fail because the hashtable would not be created yet. | |||||
| * | unit-tests: Generate weak keys with gcrypt plugin (but quickly) | Tobias Brunner | 2014-03-20 | 1 | -0/+3 | |
| | | ||||||
| * | tnc-pdp: Fix monolithic build | Tobias Brunner | 2014-03-20 | 1 | -1/+2 | |
| | | ||||||
| * | plugin-feature: Hash only the actually used feature argument | Tobias Brunner | 2014-03-20 | 1 | -1/+31 | |
| | | | | | | | | | Clang does not initialize padding in union members so hashing the complete "arg" union could lead to different hashes if the hashed plugin_feature_t does not have static storage duration. Fixes #549. | |||||
| * | Added TPMRA workitem support for [dummy] Trusted Boot measurements | Andreas Steffen | 2014-03-19 | 1 | -0/+16 | |
| | | ||||||
| * | pki: When dispatching commands, don't look beyond non-null-terminated array | Martin Willi | 2014-03-19 | 1 | -1/+1 | |
| | | ||||||
| * | pki: Check length of commands array before accessing command in --help | Martin Willi | 2014-03-19 | 1 | -1/+1 | |
| | | | | | | | | As --help is counted as command as well, the array is not null-terminated and we have to check for MAX_COMMANDS. Fixes #550. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |