aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAgeFilesLines
...
* Add TKM private key implementationReto Buerki2013-03-192-0/+206
| | | | | | | | | | | | | The key currently imitates the private key of alice@strongswan.org by returning it's fingerprint in the get_fingerprint function. This associates the private key with alice's X.509 cert and charon will use it to create a signature over the local AUTH octets of the test connection. The private key serves as a proxy to the TKM ike_isa_sign operation and extracts the required information from the auth octets chunk passed on by the keymat.
* keymat: Store signature info in auth octetsReto Buerki2013-03-191-2/+14
| | | | | | Store the ISA context id and the initial message in the auth octets chunk using the sign_info_t struct. Charon will pass on this information to the TKM private key sign operation where it is extracted.
* Add AUTH signature info data structureReto Buerki2013-03-191-0/+26
| | | | | The sign_info_t type is used to transfer an ISA context id and the initial message from the keymat to the TKM private key sign operation.
* charon-tkm: Register TKM public key on startupAdrian-Ken Rueegsegger2013-03-191-0/+5
|
* Add TKM public key implementationAdrian-Ken Rueegsegger2013-03-192-0/+213
| | | | | | | The key unconditionally returns TRUE for the verify operation if it is called with a supported signature algorithm. All such verification operations are performed by the TKM (e.g. trustchain or auth octets verification) anyway, so this is safe.
* Authenticate ISA using certificatesAdrian-Ken Rueegsegger2013-03-191-1/+11
| | | | | The authentication of the ISA is now done using the certificate provided by the peer.
* Store peer IKE init messageAdrian-Ken Rueegsegger2013-03-192-0/+26
| | | | | | The IKE init message sent to us by the peer is needed for authentication in the authorization hook. Store the message as chunk in the keymat and provide a getter to make it available.
* Build cc context in tkm listener authorize hookAdrian-Ken Rueegsegger2013-03-191-0/+143
| | | | | | Extract peer certificate information and build a TKM certificate chain context in the authorize hook of the tkm_listener_t. The cc context will be used for ISA authentication using certificates.
* Add TKM_CTX_CC (Certificate chain context id)Adrian-Ken Rueegsegger2013-03-194-2/+5
|
* Add typelen parameter to chunk_to_sequence functionAdrian-Ken Rueegsegger2013-03-196-10/+14
| | | | The parameter is used to initialize the given sequence to zero.
* Implement Ada exception processingReto Buerki2013-03-198-1/+146
| | | | | Register a global exception action with the Ada runtime to log uncaught exceptions to the daemon log and terminate.
* Implement Esa Event Service (EES)Reto Buerki2013-03-1910-7/+272
| | | | | | The Esa Event Service can be used to trigger ESP SA (ESA) events such as acquire or expire. The incoming events are forwarded to the hydra kernel interface for processing.
* Conditionally reset AE context in keymat destroyAdrian-Ken Rueegsegger2013-03-192-12/+66
| | | | | | | The responsibility to reset an authenticated endpoint context is passed from a parent IKE SA keymat to the new keymat by including it in the ISA info data contained in the skd chunk. The last IKE SA to be destroyed will also reset the associated AE context.
* Let tkm_keymat_t extend keymat_v2_tAdrian-Ken Rueegsegger2013-03-193-102/+31
|
* Implement IKE SA rekeyingAdrian-Ken Rueegsegger2013-03-191-9/+29
| | | | | Use the TKM ike_isa_create_child exchange to rekey an IKE SA. The isa context id is passed on (ab)using the rekey_skd chunk.
* Add test for keymat derive_child_keys operationAdrian-Ken Rueegsegger2013-03-191-0/+89
|
* Implement ESA rekeying with and without PFSAdrian-Ken Rueegsegger2013-03-191-13/+97
| | | | | | | | | | A child SA is being rekeyed if the esa information passed to the add_sa function contains nonces. If it also contains a valid Diffie-Hellman context id PFS is used. The fact that the encr_r encryption key is passed to add_sa in the inbound case can be used to determine if we are initiator or not by inspecting the is_encr_r flag of the esa information struct.
* Extend esa_info_t structAdrian-Ken Rueegsegger2013-03-193-17/+87
| | | | | | | | | | Add additional fields to the esa_info_t struct so the necessary data can be passed from the keymat to the kernel ipsec interface, where ESA creation and key generation using the TKM takes place. The information is used during the inbound add_sa call to create an ESP SA. This makes the hack of storing the local SPI in a kernel interface variable between subsequent add_sa calls unnecessary.
* Use SAD to manage TKM ESA context informationAdrian-Ken Rueegsegger2013-03-191-6/+43
| | | | | | An SAD entry is added after successfull creation of a TKM ESA context in the add_sa() function. The corresponding entry is removed in del_sa() using the SAD, src, dst, spi and protocol parameters.
* Implement TKM kernel SA database (SAD)Adrian-Ken Rueegsegger2013-03-195-0/+452
| | | | | The TKM kernel SAD (security association database) stores information about CHILD SAs.
* Add TKM_CTX_ESA (ESP SA context id)Adrian-Ken Rueegsegger2013-03-194-5/+8
|
* Use rng to generate local ESP SPIsAdrian-Ken Rueegsegger2013-03-193-4/+19
|
* charon-tkm: Register kernel_netlink_netAdrian-Ken Rueegsegger2013-03-193-1/+10
| | | | | | Explicitly register kernel netlink net implementation and avoid loading the whole kernel-netlink plugin since the kernel netlink ipsec part is unwanted.
* Do not return shared secret in TKM Diffie-HellmanAdrian-Ken Rueegsegger2013-03-191-7/+1
| | | | | | Since the TKM handles all relevant key material, charon-tkm must not have access to it anymore. Thus the ike_dh_get_shared_secret operation is not available anymore.
* Remove keymat proxy from TKM keymatAdrian-Ken Rueegsegger2013-03-192-29/+11
| | | | | Since the TKM completely handles key derivation and installation there is no need for the keymat proxy anymore.
* Remove netlink proxy from TKM kernel interfaceReto Buerki2013-03-191-36/+10
| | | | | The TKM is now able to manage simple child SAs, so there is no need for the netlink proxy anymore.
* Avoid proxy for bypass_socket, enable_udp_decapReto Buerki2013-03-191-4/+47
| | | | | This is in preparation for the removal of the netlink kernel proxy. The code is copied as-is from the kernel_netlink_ipsec plugin.
* Implement CHILD SA key derivation using TKMAdrian-Ken Rueegsegger2013-03-193-5/+68
| | | | | | | | ESP SAs are created when adding CHILD SAs via the kernel ipsec interface. The encr_i key is used to transfer the context id of the parent IKE SA from the keymat to the TKM kernel ipsec interface.
* Register TKM kernel ipsec interface in charon-tkmAdrian-Ken Rueegsegger2013-03-191-0/+3
|
* Add TKM kernel ipsec skeletonAdrian-Ken Rueegsegger2013-03-192-0/+241
| | | | | | The existing kernel netlink ipsec interface is currently used as proxy to perform the actual work. It will be gradually removed as the TKM implements the needed features.
* chunk_map: Store key, value pair in entry_t structReto Buerki2013-03-191-16/+44
| | | | | | To make the chunk map more robust it now stores a clone of the data chunk given on insertion. The entry struct is needed to properly free the allocated chunk after use.
* Call ike_isa_auth_psk in listener authorize hookReto Buerki2013-03-191-3/+18
| | | | This exchange initiates the AUTH verification in the TKM.
* listener: Register message hookReto Buerki2013-03-191-0/+42
| | | | | | | | Use the message hook to save the AUTHENTICATION payload of an incoming IKE_AUTH message. The AUTH payload will be passed on to the TKM ike_isa_auth operation in the authorize hook.
* keymat: Add AUTH payload setter/getter functionsReto Buerki2013-03-192-0/+35
| | | | | These functions are used in the TKM specific bus listener to store/retrieve the AUTH payload chunk in the message/authorize hooks.
* Register TKM bus listener in charon-tkmReto Buerki2013-03-191-0/+12
|
* Add TKM specific bus listener skeletonReto Buerki2013-03-192-0/+124
| | | | | This listener gets informed about IKE authorization rounds and will be used to call ike_isa_auth on a given ISA.
* Add ISA context id getter to TKM keymatReto Buerki2013-03-193-0/+16
|
* keymat: Acquire AE context ID on initializationReto Buerki2013-03-191-3/+9
|
* Add TKM_CTX_AE (Authenticated Endpoint context)Reto Buerki2013-03-194-5/+8
|
* keymat: Acquire ISA context ID on initializationReto Buerki2013-03-191-2/+22
|
* Add TKM_CTX_ISA (IKE SA context)Reto Buerki2013-03-194-6/+8
|
* Use remote PSK signature computed by TKMReto Buerki2013-03-191-25/+19
|
* keymat: Check for aes256-sha512 in derive_ike_keysReto Buerki2013-03-191-0/+8
| | | | Return FALSE if peers try to use other algorithm combinations.
* keymat: Call ike_isa_sign_psk in get_psk_sigAdrian-Ken Rueegsegger2013-03-191-1/+26
| | | | Get PSK signed AUTH octets from TKM in initiator case.
* Factor out AEAD transform creationReto Buerki2013-03-191-61/+92
| | | | | Introduce static aead_create_from_keys function to initialize AEAD transforms from key chunks.
* Add keymat IKE key derivation test caseReto Buerki2013-03-193-0/+105
|
* keymat: Create inbound and outbound AEAD transformsReto Buerki2013-03-191-3/+85
| | | | | | | Create and initialize AEAD transforms with keys derived by the TKM. Return these transforms in the get_aead function. IKE keys used by charon are derived by TKM now.
* keymat: Extract enc,inc algorithms from proposalReto Buerki2013-03-191-0/+26
| | | | | Extract encryption and integrity algorithms from proposal and check them before deriving IKE keys.
* keymat: Call TKM Isa_Create procedureReto Buerki2013-03-191-4/+39
|
* Implement chunk_to_sequence functionReto Buerki2013-03-193-0/+40
| | | | This function converts a given chunk to a variable-length byte sequence.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-22 13:06:31 +0000