summaryrefslogtreecommitdiffstats
path: root/src/openvpn/crypto_polarssl.c
Commit message (Collapse)AuthorAgeFilesLines
* polarssl: Improve PolarSSL loggingSteffan Karger2015-10-081-16/+19
| | | | | | | | | | | Use the new polar_log_err() and polar_ok() functions introduced in the previous commit to provide more log/debug output for polarssl errors. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1444148440-10564-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/10197 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* polarssl: add easy logging for PolarSSL errorsSteffan Karger2015-10-061-0/+27
| | | | | | | | | | | | | | | | | Add the functions polar_log_err(), polar_log_func_line() and a macro polar_ok(), to easily log human-readable PolarSSL errors from polarssl-specific code. This does not provide the full logging interface as msg(), because I would have to add a lot more of macro-magic to achieve that on the various supported compilers and platforms, and this suffices too (for now at least). Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1425810005-11893-1-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9528 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Fix assertion error when using --cipher noneSteffan Karger2014-11-081-2/+2
| | | | | | | | | | | | Some commits ago, the cipher mode checks were cleaned up to remove code duplication (and fix the issue in #471), but broke '--cipher none' (reported in #473). This commit fixes that. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <545DED2C.5070002@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/9217 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Add proper check for crypto modes (CBC or OFB/CFB)Steffan Karger2014-07-071-0/+21
| | | | | | | | | | | | | | | | | | OpenSSL has added AEAD-CBC mode ciphers like AES-128-CBC-HMAC-SHA1, which have mode EVP_CIPH_CBC_MODE, but require a different API (the AEAD API). So, add extra checks to filter out those AEAD-mode ciphers. Adding these made the crypto library agnostic function cfb_ofb_mode() superfuous, so removed that on the go. Also update all cipher mode checks to use the new cipher_kt_mode_*() functions for consistency. Signed-off-by: Steffan Karger <steffan@karger.me> Acked-by: Arne Schwabe <arne@rfc2549.org> Message-Id: <1402244175-31462-3-git-send-email-steffan@karger.me> URL: http://article.gmane.org/gmane.network.openvpn.devel/8779 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Upgrade to PolarSSL 1.3Steffan Karger2014-04-211-1/+6
| | | | | | | | | | | | | | | This removes support for PolarSSL 1.2. The mimimum version of PolarSSL required is now 1.3.3. The upgrade brings OpenVPN-with-PolarSSL: * Support for EC-crypto in TLS (but not yet for external pkcs11/management keys) * Support for AES-NI (if PolarSSL is compiled with AES-NI support) Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Message-Id: <53528943.3090205@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/8555 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Config compatibility patch. Added translate_cipher_name.Steffan Karger2013-03-221-2/+50
| | | | | | | | | | | | | | | Added translate_cipher name to crypto_openssl.c and crypto_polarssl.c to translate between OpenVPN(/OpenSSL) and PolarSSL data channel cipher algorithm names. OpenSSL does not require any translating, PolarSSL does for a small number of algorithms. This improves on config file compatibility between the OpenSSL and PolarSSL builds. Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: Gert Doering <gert@greenie.muc.de> Message-Id: <1363942465-3251-5-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7435 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* PolarSSL-1.2 supportSteffan Karger2013-03-221-1/+4
| | | | | | | | | | | | | | Add support for PolarSSL-1.2, which has changed the API in several places. This is a minimal port, new features have not been enabled. Only PolarSSL 1.2.5 and newer are accepted, as earlier versions contain unresolved (security) issues. Signed-off-by: Joachim Schipper <joachim.schipper@fox-it.com> Signed-off-by: Steffan Karger <steffan.karger@fox-it.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Message-Id: <1363942465-3251-2-git-send-email-steffan.karger@fox-it.com> URL: http://article.gmane.org/gmane.network.openvpn.devel/7436 Signed-off-by: Gert Doering <gert@greenie.muc.de>
* Removed support for PolarSSL < 1.1Adriaan de Jong2012-04-271-34/+0
| | | | | | | | | | | | | | | | | | PolarSSL 1.0 and earlier use only the Havege RNG. Havege is based on timing certain operations, using the RDTSC instruction. Although this is fine on bare metal PCs, the RDTSC instruction is virtualised on some virtual machine implementations. This can result in issues on those virtual machines. PolarSSL fixes this potential issue by also using platform entropy. To ensure that OpenVPN is always built against a decent RNG, PolarSSL <1.1 is therefore no longer supported. Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: David Sommerseth <davids@redhat.com> Message-Id: 1333351687-3732-4-git-send-email-dejong@fox-it.com URL: http://article.gmane.org/gmane.network.openvpn.devel/6211 Signed-off-by: David Sommerseth <davids@redhat.com>
* Added a configuration option to enable prediction resistance in the PolarSSL ↵Adriaan de Jong2012-04-271-0/+9
| | | | | | | | | | | | | | | | | | random number generator. Signed-off-by: Eelse-jan Stutvoet <stutvoet@fox-it.com> Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Message-Id: 1333351687-3732-2-git-send-email-dejong@fox-it.com URL: http://article.gmane.org/gmane.network.openvpn.devel/6213 Signed-off-by: David Sommerseth <davids@redhat.com> Notes: This patch was ACKed by James Yonan in an IRC meeting March 29, 2012. Currently, the meeting minutes have not been made public. (David Sommerseth, Fri Apr 27 21:36:04 UTC 2012)
* Added support for new PolarSSL 1.1 RNGAdriaan de Jong2012-04-271-10/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch, while retaining PolarSSL 1.0 support, introduces the PolarSSL 1.1 DRBG. This RNG adds a number of features, including support for personalisation strings and multiple entropy sources. Personalisation strings have been implemented, based on PID, program name, place within memory, and a hash of the user's certificate. The entropy sources used are the platform default ones. Which ones these are depends on how PolarSSL was built, but usually this includes: - /dev/urandom or the Windows CryptoAPI RNG - the HAVEGE RNG - the output of PolarSSL's hardclock() call (usually RDTSC) Finally, this patch moves to only one instance of the RNG per OpenVPN instance, instead of one per keystate Signed-off-by: Adriaan de Jong <dejong@fox-it.com> Signed-off-by: Eelse-jan Stutvoet <stutvoet@fox-it.com> Acked-by: James Yonan <james@openvpn.net> Message-Id: 1333351687-3732-1-git-send-email-dejong@fox-it.com URL: http://article.gmane.org/gmane.network.openvpn.devel/6210 Signed-off-by: David Sommerseth <davids@redhat.com> Notes: This patch was ACKed by James Yonan in an IRC meeting March 29, 2012 under the condition that PolarSSL 1.0 and havege support is removed later on. Currently, the meeting minutes have not been made public. (David Sommerseth, Fri Apr 27 21:31:03 UTC 2012)
* build: move out config.h include from sysheadAlon Bar-Lev2012-03-221-0/+6
| | | | | | | | | | | Yet another step in reducing the syshead.h content. Conditional compilation of sources needs to be based on a minimum program prefix (config.h only). Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: David Sommerseth <davids@redhat.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* build: proper crypto detection and usageAlon Bar-Lev2012-03-221-2/+2
| | | | | | Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Signed-off-by: David Sommerseth <davids@redhat.com>
* build: standard directory layoutAlon Bar-Lev2012-03-221-0/+560
Suitable for mature project. root - administrative stuff doc - documents src - sources tests - tests distro - distro specific files sample - samples SIDE EFFECT: many changes to rpm spec. Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com> Acked-by: Adriaan de Jong <dejong@fox-it.com> Signed-off-by: David Sommerseth <davids@redhat.com>
generated by cgit (git 2.34.1) at 2024-04-28 07:15:17 +0000