denozord/strongswan-ext
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,945 Commits 3 Branches 0 Tags
facf1c76eaf43e5a1cb6a7bbf84fa0b237edff0a
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andreas Steffen facf1c76ea testing: Adaptation to ISO 19770-2:2015 SWID standard 2017-07-08 23:19:51 +02:00
Andreas Steffen 3bf8392d36 pt-tls-client: Support for TPM keyids 2017-07-08 23:19:51 +02:00
Andreas Steffen 49d56e1b39 imv-swima: Implemented SW event processing 2017-07-08 23:19:51 +02:00
Andreas Steffen 74aa1626d2 sw-collector: Query central collector database 2017-07-08 23:19:51 +02:00
Andreas Steffen 8ba6bf511e libimcv: Moved REST API from imv_swid and imv_swima to libimcv 2017-07-08 23:19:51 +02:00
Andreas Steffen 7e796bba67 swidtag: strongSwan swidtag file with double underscores 2017-07-08 23:19:51 +02:00
Andreas Steffen 032a5767ad sw-collector: Collects endpoint software events 2017-07-08 23:19:51 +02:00
Andreas Steffen 3a7c594c14 imv-swima: Created SWIMA IMV plugin 2017-07-08 23:19:51 +02:00
Andreas Steffen 2821c0f740 imc-swima: Created SWIMA IMC plugin 2017-07-08 23:19:51 +02:00
Andreas Steffen bf22470623 unit-tests: Added IETF SWIMA PA-TNC attribute tests 2017-07-08 23:19:51 +02:00
Andreas Steffen 84c0366bd3 libimcv: Implemented IETF SW PA-TNC attributes 2017-07-08 23:19:51 +02:00
Andreas Steffen bb87af2a73 libimcv: Fixed memory leak 2017-07-08 23:19:51 +02:00
Andreas Steffen 37205b05e6 libimcv: Corrected order of subscription flags 2017-07-08 23:19:51 +02:00
Andreas Steffen 0cc0b53b2f libimcv: Added IETF Software PA-TNC attributes 2017-07-08 23:19:51 +02:00
Andreas Steffen 8c4c824706 libtncif: Added IETF Software PA-TNC message subtype 2017-07-08 23:19:51 +02:00
Andreas Steffen 6795de0408 libimcv: SWID tag generation and discovery 2017-07-08 23:19:51 +02:00
Andreas Steffen 60da0153ee libimcv: Update database to ISO 19770-2:2015 SWID standard 2017-07-08 23:19:51 +02:00
Andreas Steffen 88b941939f testing: Fixed typo in openssl-ikev2/rw-suite-b-192 scenario 2017-07-08 23:19:18 +02:00
Andreas Steffen 65ce7ec0c4 Version bump to 5.5.3 2017-05-29 12:02:48 +02:00
Andreas Steffen 38a8ecadb7 x509: nameConstraints sequence does not require a loop 
Fixes: CVE-2017-9023
 2017-05-29 11:05:04 +02:00
Andreas Steffen f2f9edbbc0 unit-tests: Updated asn1-parser tests 2017-05-29 11:05:04 +02:00
Andreas Steffen 407fcca200 asn1-parser: Fix CHOICE parsing 
Fixes: CVE-2017-9023
 2017-05-29 11:05:04 +02:00
Andreas Steffen 89f05ed5a9 imv-swid: Fixed memory leak in http REST interface 2017-05-29 10:59:22 +02:00
Andreas Steffen 29e1c58643 leak-detective: Whitelisted memory leaks in FHH IMCs and IMVs 2017-05-29 10:59:04 +02:00
Andreas Steffen c82be739bc imv-test: Fixed memory leak in server retry use case 2017-05-29 10:58:33 +02:00
Andreas Steffen fca4e70bd3 libtnccs: Fixed memory leak of global variables in libxml2 2017-05-29 10:57:34 +02:00
Andreas Steffen 2d5a79bf59 testing: Added swanctl/rw-eap-md5-id-rsa scenario 2017-05-26 14:36:25 +02:00
Andreas Steffen 7272fa0c8d README: Converted to swanctl configuration scheme 2017-05-26 14:36:25 +02:00
Andreas Steffen a5f7a4c790 Version bump to 5.3.3dr2 2017-05-08 22:38:12 +02:00
Andreas Steffen b0dcf33f0f x509: Evaluate return codes of parsing functions 2017-05-08 16:44:25 +02:00
Andreas Steffen d38d1fcd68 Version bump to 5.5.3dr1 2017-04-26 21:29:42 +02:00
Andreas Steffen 25217488d2 testing: Created swanctl/rw-eap-aka-sql-rsa scenario 2017-04-26 20:38:23 +02:00
Andreas Steffen 64f9fa9e9f testing: Created ikev2/rw-eap-aka-sql-rsa scenario 
This test scenario tests the eap-simaka-sql plugin.
 2017-04-26 20:38:23 +02:00
Andreas Steffen 2fad3460fa eap-simaka-sql: Fixed database column from use to used 2017-04-26 20:38:00 +02:00
Andreas Steffen bb2ba9f15d Version bump to 5.5.2 2017-03-27 16:57:03 +02:00
Andreas Steffen c5ccf933ec testing: List BLIS certs in swanctl/rw-newhope-bliss scenario 2017-03-27 16:56:50 +02:00
Andreas Steffen 7c672e6118 Version bump to 5.2.2rc1 2017-03-21 09:09:43 +01:00
Andreas Steffen 1732ca7b5b testing: Updated OCSP certificate for carol 2017-03-21 09:09:06 +01:00
Andreas Steffen efc1b98461 Allow x25519 as an alias of the curve25519 KE algorithm 2017-03-20 21:18:00 +01:00
Andreas Steffen db1ab1cd99 Reference Edwards-curve signature RFCs 2017-03-20 21:18:00 +01:00
Andreas Steffen 2b233c8a64 The tpm plugin offers random number generation 
The tpm plugin can be used to derive true random numbers from a
TPM 2.0 device. The get_random method must be explicitly enabled
in strongswan.conf with the plugin.tpm.use_rng = yes option.
 2017-03-20 21:16:10 +01:00
Andreas Steffen 25bfb338a2 Version bump to 5.5.2dr7 2017-03-06 20:21:40 +01:00
Andreas Steffen 4a620a97a0 aikpub2: Removed aikpub2 tool 
The aikpub2 tool has been replaced by pki --pub|--req --keyid hex ..
where keyid indicates the TPM 2.0 private key object handle. Thus
either the public key in PKCS#1 format can be extracted or a PKCS#10
certificate request signed by the TPM private key can be generated.
 2017-03-06 19:35:05 +01:00
Andreas Steffen ab94f76df6 pki: Add key object handle of smartcard or TPM private key as an argument to pki --keyid 2017-03-06 18:54:09 +01:00
Andreas Steffen cfdccc93f5 utils: chunk_from_hex() skips optional 0x prefix 2017-03-06 18:54:09 +01:00
Andreas Steffen 2d41e1c51c pki: Edited keyid parameter use in various pki man pages and usage outputs 2017-03-06 18:54:09 +01:00
Andreas Steffen 6885375e66 Version bump to 5.5.2dr6 2017-03-03 09:34:50 +01:00
Andreas Steffen 2da6a5f541 Add keyid of smartcard or TPM private key as an argument to pki --req 2017-03-02 20:30:24 +01:00
Andreas Steffen f43850b3b9 Version bump to 5.5.2dr5 2017-02-23 17:31:11 +01:00
Andreas Steffen af9341c2c0 Use of TPM 2.0 private keys for signatures via tpm plugin 2017-02-22 12:18:26 +01:00
Andreas Steffen e8736028e6 Implement signatures with private keys bound to TPM 2.0 2017-02-21 20:37:32 +01:00
Andreas Steffen 9ad147ac63 Version bump to 5.5.2dr4 2017-01-02 15:46:27 +01:00
Andreas Steffen bda3a573f4 Merge branch 'disable_ocsp' 2017-01-02 14:35:39 +01:00
Andreas Steffen 91a4a4aa83 testing: Added swanctl/ocsp-disabled scenario 2017-01-02 14:34:39 +01:00
Andreas Steffen db0953d41f testing: Added swanctl/ocsp-signer-cert scenario 2017-01-02 14:34:18 +01:00
Andreas Steffen e3f63c6469 revocation: OCSP and/or CRL fetching can be disabled 2016-12-30 18:12:53 +01:00
Andreas Steffen 08253bbba3 testing: Convert swanctl scenarios to curve-25519 2016-12-30 16:22:12 +01:00
Andreas Steffen 65797c9faf Version bump to 5.5.2dr3 and Linux kernel 4.9 2016-12-17 18:10:13 +01:00
Andreas Steffen 470e61ae77 testing: strongTNC does not come with django.db any more 2016-12-17 18:09:20 +01:00
Andreas Steffen 3c1e5ad6ce testing: Added ikev2/net2net-ed25519 scenario 2016-12-17 18:07:29 +01:00
Andreas Steffen bd2f2b11fc stroke: Load general PKCS#8 private keys 2016-12-17 18:06:11 +01:00
Andreas Steffen 9da89eeb4f Merge branch 'Ed25519' 2016-12-16 12:24:54 +01:00
Andreas Steffen 4f19112b1f Moved Ed25519 tests to libstrongswan 2016-12-14 11:57:36 +01:00
Andreas Steffen e9c2b6658b unit-tests: Completed coverage of hasher, crypter and libnttfft 2016-12-14 11:15:48 +01:00
Andreas Steffen 94ae1ac18e Added swanctl/net2net-ed2559 scenario and needed Ed25519 certificates 2016-12-14 11:15:48 +01:00
Andreas Steffen f2eb367adc Implemented EdDSA for IKEv2 using a pro forma Identity hash function 2016-12-14 11:15:48 +01:00
Andreas Steffen d47ad3d67e Added Ed25519 ref10 implementation from libsodium 2016-12-14 11:15:47 +01:00
Andreas Steffen 35bc60cc68 Added support of EdDSA signatures 2016-12-14 11:15:47 +01:00
Andreas Steffen 011195f1a9 Version bump to 5.5.2dr2 2016-11-14 16:20:51 +01:00
Andreas Steffen 99c03e9a11 testing: make curve25519 the default DH group 2016-11-14 16:20:51 +01:00
Andreas Steffen 4a97999466 Version bump to 5.5.2dr1 2016-10-30 17:34:05 +01:00
Andreas Steffen 880c312458 Fixed in-place update of cached base and delta CRLs 2016-10-30 16:37:24 +01:00
Andreas Steffen 2271ebb325 Newer CRLs replace older versions of the CRL in the cache 2016-10-26 12:48:54 +02:00
Andreas Steffen e6a4bd83ff Version bump to 5.5.1 2016-10-20 12:57:00 +02:00
Andreas Steffen 4d77fcbec9 Version bump to 5.5.1rc2 2016-10-18 18:14:57 +02:00
Andreas Steffen ba6c7a52c0 testing: Renewed expired certificates 2016-10-18 18:13:58 +02:00
Andreas Steffen cb8f436112 added XOF dependencies of bliss and ntru plugins 2016-10-18 16:28:43 +02:00
Andreas Steffen d167776ff9 testing: enable MACsec in guest kernel 2016-10-18 16:25:19 +02:00
Andreas Steffen a617223ed5 Version bump to 5.5.1rc1 2016-10-11 19:21:36 +02:00
Andreas Steffen 8a56405a82 Merge branch 'cache-crls' 2016-10-11 17:19:29 +02:00
Andreas Steffen 85b5a6ace2 Save both base and delta CRLs to disk 2016-10-11 17:18:22 +02:00
Andreas Steffen 2a2669ee3e vici: strongswan.conf cache_crls = yes saves fetched CRLs to disk 2016-10-11 17:18:22 +02:00
Andreas Steffen a9562a3f58 testing: Added swanctl/net2net-multicast scenario 2016-09-27 18:36:28 +02:00
Andreas Steffen d7e0ce2878 testing: Added ikev2/net2net-multicast scenario 2016-09-27 18:36:28 +02:00
Andreas Steffen 6b3e408ba5 Version bump to 5.5.1dr5 2016-09-22 17:36:37 +02:00
Andreas Steffen d505658038 testing: Added swanctl/net2net-sha3-rsa-cert and swanctl/rw-eap-tls-sha3-rsa scenarios 2016-09-22 17:34:31 +02:00
Andreas Steffen 40f2589abf gmp: Support of SHA-3 RSA signatures 2016-09-22 17:34:31 +02:00
Andreas Steffen c54d1ef12c bliss sampler unit-test: Fixed enumeration type 2016-09-22 10:46:39 +02:00
Andreas Steffen a3a8b4acae bliss: bliss_sampler expects XOF type 2016-09-22 09:23:47 +02:00
Andreas Steffen e31ed9ab98 Version bump to 5.5.1dr4 2016-09-21 14:14:42 +02:00
Andreas Steffen 188b190a70 mgf1: Refactored MGF1 as an XOF 2016-09-21 06:40:52 +02:00
Andreas Steffen 8aaa6de322 Version bump to 5.5.1dr3 2016-09-15 11:45:17 +02:00
Andreas Steffen 29a48b4c69 Merge branch 'flush-certs' 2016-09-15 11:39:16 +02:00
Andreas Steffen 2c7cfe7630 vici: flush-certs command flushes certificate cache 
When fresh CRLs are released with a high update frequency (e.g.
every 24 hours) or OCSP is used then the certificate cache gets
quickly filled with stale CRLs or OCSP responses. The new VICI
flush-certs command allows to flush e.g. cached CRLs or OCSP
responses only. Without the type argument all kind of certificates
(e.g. also received end entity and intermediate CA certificates)
are purged.
 2016-09-13 17:02:59 +02:00
Andreas Steffen de44fd748a pt-tls-client: Added support of ECDSA keys 2016-08-31 17:06:47 +02:00
Andreas Steffen 288ee54875 libimcv: No need to load AIK pubkey if AIK certificate is available 2016-08-31 16:12:55 +02:00
Andreas Steffen d2577aa3c5 Version bump to 5.5.1dr2 2016-08-26 22:55:41 +02:00
Andreas Steffen d125941802 libtpmtss: TCTI finalization call changed 2016-08-25 13:22:51 +02:00
Andreas Steffen 36bf2b1bc5 conf: aikpub2.opt added to Makefile.am 2016-08-25 13:22:51 +02:00
Andreas Steffen ce20979ce2 testing: Virtual IPs went missing 2016-08-16 17:18:17 +02:00