ims-volte-vowifi
/
strongswan
9
0
Fork 0
Code Pull Requests Releases Activity
17,780 Commits 6 Branches 233 Tags 88 MiB
Commit Graph

11 Commits

Author SHA1 Message Date
Pascal Knecht d2fc9b0961 tls-server: Mutual authentication support for TLS 1.3 
This commit also addresses the side effect that additional messages have
an influence on the derivation of the application traffic secrets. Therefore,
key derivation is relocated after the server finished message has been sent,
so the additional messages from the client (Certificate, CertificateVerify)
don't affect the key derivation. Only the outbound key is switched there, the
inbound key remains in use until the client's finished message has been
processed.
 2021-02-12 14:35:23 +01:00
Pascal Knecht 0aaf1242d9 libtls: Add unit tests for Ed25519 and Ed448 keys 
TLS 1.0 to TLS 1.3 socket connection tests with each key type.
 2021-02-12 14:35:23 +01:00
Pascal Knecht 64e2506f5b libtls: Add TLS version negotiation test cases 
These client to server negotiation test cases are implemented:
- TLS 1.0 => TLS 1.3
- TLS 1.1 => TLS 1.3
- TLS 1.2 => TLS 1.3
- TLS 1.3 => TLS 1.3

- TLS 1.3 => TLS 1.0
- TLS 1.3 => TLS 1.1
- TLS 1.3 => TLS 1.2
- TLS 1.3 => TLS 1.3

- TLS 1.0 => TLS 1.2
- TLS 1.1 => TLS 1.2
- TLS 1.2 => TLS 1.2
- TLS 1.3 => TLS 1.2
 2021-02-12 14:35:23 +01:00
Pascal Knecht e53bee9dbe tls-crypto: Add support to configure DH groups to use 
And add new test cases to test TLS 1.3 connections for each supported DH
group.
 2021-02-12 14:35:23 +01:00
Pascal Knecht 7fbe2e27ec tls-server: TLS 1.3 support for TLS server implementation 
Add basic support to establish a TLS 1.3 connection with a client capable
of the same protocol version.
 2021-02-12 14:35:23 +01:00
Tobias Brunner a7f2818832 tls-socket: Allow configuring both minimum and maximum TLS versions 2021-02-12 11:45:44 +01:00
Tobias Brunner 281766c5e6 tls-crypto: Filter TLS cipher suites by min/max version 
There is no point proposing legacy (or future) cipher suites depending on
the proposed TLS versions. It was actually possible to negotiate and use
cipher suites only defined for TLS 1.2 with earlier TLS versions.
 2021-02-12 11:45:44 +01:00
Tobias Brunner 6987f6b3eb unit-tests: Update expired certificates for TLS tests 2020-03-25 15:31:07 +01:00
Tobias Brunner 67849f4972 libtls: Replace expired certificates for unit tests 
Only the tests with client authentication failed, the client accepted
the trusted self-signed certificate even when it was expired.  On the
server the lookup (based on the pre-configured SAN) first found the ECDSA
cert, which it dismissed for the RSA authentication the client used, and
since only the first "pretrusted" cert is considered the following RSA
cert was verified more thoroughly.
The lookup on the client always uses the full DN of the server certificate
not the pre-configured identity so it found the correct certificate on
the first try.
 2017-03-24 10:46:14 +01:00
Andreas Steffen b12c53ce77 Use standard unsigned integer types 2016-03-24 18:52:48 +01:00
Martin Willi 2c8d77394c tls: Add socket based tests testing all supported suites with TLS 1.2/1.1/1.0 2014-04-01 14:52:18 +02:00