denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
20,067 Commits 1 Branch 0 Tags
main
Commit Graph
15501 Commits
Author SHA1 Message Date
Martin Willi 392618d4ec Support signing of RADIUS response messages 2012-03-05 18:06:13 +01:00
Martin Willi 2bf3858955 Act on RADIUS DAE Disconnect requests 2012-03-05 18:06:13 +01:00
Martin Willi 76b6b19f8d Verify received RADIUS DAE requests 2012-03-05 18:06:13 +01:00
Martin Willi e8a8179706 Support verification of RADIUS request messages 2012-03-05 18:06:13 +01:00
Martin Willi 3bc1829211 Rename RADIUS message constructors to handle both, requests and responses 2012-03-05 18:06:13 +01:00
Martin Willi 6319ce63cf Enable RADIUS DAE listening if configured 2012-03-05 18:06:13 +01:00
Martin Willi 85932ad24e Added infrastructure to listen to RADIUS Dynamic Authorization Extension requests 2012-03-05 18:06:13 +01:00
Martin Willi 3a42c08904 Added Dynamic Authorization Extension RADIUS message codes 2012-03-05 18:06:13 +01:00
Martin Willi c61341a58f Set IKE_SA lifetime based on RADIUS Session-Timeout attribute 2012-03-05 18:06:13 +01:00
Martin Willi bdcf441703 Set hard timeouts when setting a lifetime 2012-03-05 18:06:13 +01:00
Martin Willi e9fcf1c6cc Fix IKE_SA timeout debug output on 64bit platforms 2012-03-05 18:06:13 +01:00
Tobias Brunner 686cfd4e34 Added support for untruncated MD5 and SHA1 HMACs in ESP as used in RFC 4595. 
This requires a Linux kernel >= 2.6.33.
 2012-02-27 14:31:19 +01:00
Martin Willi 3a2660f189 Encode IPv6 virtual IPs in a Framed-IPv6-Prefix attribute 2012-02-24 11:20:16 +01:00
Martin Willi d15ae70c8c Refactored construction of RADIUS accounting messages 2012-02-24 11:12:18 +01:00
Martin Willi d93f204ca5 Include port numbers in Calling-Station-Id, too 2012-02-24 10:49:29 +01:00
Martin Willi 802ed08dff Use large enough buffers for IPv6 addresses in Calling-Station-Id 2012-02-24 10:13:08 +01:00
Martin Willi 434cdbac09 Send client external address as Calling-Station-Id in RADIUS accounting 2012-02-24 10:05:23 +01:00
Andreas Steffen e4f554404e handle case where subject = NULL but keyid is set 2012-02-20 12:12:31 +01:00
Andreas Steffen 1b9c613b77 fixed attest sql query in list_measurements() 2012-02-15 23:13:05 +01:00
Tobias Brunner a190ec0ac5 Compiler warnings fixed. 2012-02-14 16:09:44 +01:00
Tobias Brunner 0f7d381cfe pluto: Print expiry time more properly. 2012-02-14 09:38:00 +01:00
Tobias Brunner 7efde9011e pluto: Drop support for legacy PSK format. 
Any line in ipsec.secrets starting with " or ' was treated as PSK
without ID selectors by pluto.  This prevented it from supporting DNs
like "C=CH, O=Linux strongSwan, OU=Sales, [email protected]" as
ID selectors.

PSKs defined in this legacy format can easily be updated by changing

"thisIsASecret"

into

: PSK "thisIsASecret"
 2012-02-08 13:36:32 +01:00
Martin Willi ae10ee6d0b Double check if a cached suite is available, overwrite any old suite state 2012-02-07 11:42:57 +01:00
Tobias Brunner b96eb46d5c Some Doxygen fixes. 2012-02-07 11:20:46 +01:00
Martin Willi 06c150365d Fix TLS EAP-MSK derivation, uses different order of randoms than key expansion 2012-02-07 10:54:53 +01:00
Martin Willi 1dabf5bfc7 Filter TLS suite MAC by HMAC algorithm, as the hash is not necessarily the same 2012-02-07 10:54:53 +01:00
Martin Willi 32dc2b0243 Update usage for all children in RADIUS accounting just before sending Stop 2012-02-06 10:51:40 +01:00
Martin Willi e5747e7a83 Check if ClusterIP directory could be opened before enumerating it 2012-02-06 10:51:39 +01:00
Andreas Steffen a74fab640a ipsec attest adds and deletes key/component pairs 2012-02-05 22:23:45 +01:00
Andreas Steffen 32aee74c73 check if TNC client has a valid and registered AIK 2012-02-05 19:37:58 +01:00
Martin Willi 85dd6a8deb Trigger DPD not before IKE_SA state gets updated 2012-02-02 10:35:50 +01:00
Martin Willi 916cdca851 Don't retransmit, rekey, reauth or DPD check SAs when in PASSIVE state 2012-02-02 10:34:04 +01:00
Tobias Brunner e81260d426 Moved log message for unexpected ASN.1 objects to level 2. 
This avoids error messages if later builders can successfully decode something.
 2012-02-01 18:27:46 +01:00
Tobias Brunner fd1ff46f61 Added support for PKCS#5 v2 schemes when decrypting PKCS#8 files. 2012-02-01 18:27:46 +01:00
Tobias Brunner cab127cba6 Added support for encrypted PKCS#8 files (for some PKCS#5 v1.5 schemes). 2012-02-01 18:27:46 +01:00
Tobias Brunner db3334dc32 Added support to parse PKCS#8 encoded ECDSA private keys. 2012-02-01 18:27:45 +01:00
Tobias Brunner 27f8a61df3 OpenSSL plugin parses ECDSA private keys with explicitly specified EC parameters. 
This is needed in case the key itself does not contain the parameters,
which is the case for PKCS#8.
 2012-02-01 18:27:45 +01:00
Tobias Brunner b20c54ff3f Add builder part for parameters from algorithmIdentifier. 2012-02-01 18:27:45 +01:00
Tobias Brunner 25c6d26c1d Return parsed parameters from algorithmIdentifier if they are an OID (aka EC named curve). 
Explicit EC parameters are not supported with this function, but before this
change no parameters were actually ever returned.
 2012-02-01 18:27:45 +01:00
Tobias Brunner 9255aa87ec Parse RSA private keys from PKCS#8 encoded blobs. 2012-02-01 18:27:45 +01:00
Tobias Brunner 5ec525c1d1 Added PKCS#8 stub plugin. 2012-02-01 18:27:45 +01:00
Tobias Brunner 9ec66bc1a5 Added an option to load CA certificates without CA basic constraint. 
Enabling this option treats all certificates in ipsec.d/cacerts and
ipsec.conf ca sections as CA certificates even if they do not contain a
CA basic constraint.
 2012-02-01 14:34:52 +01:00
Martin Willi 0399edef71 Support RADIUS accounting messages containing Framed-IP and Inbound/Outbound-Octets 2012-01-30 19:16:49 +01:00
Martin Willi 8e5b4aa023 Open RADIUS accounting sockets to exchange accounting messages 2012-01-30 19:15:20 +01:00
Martin Willi a69aff5f17 Support signing of RADIUS accounting messages 2012-01-30 19:13:20 +01:00
Martin Willi 370de553f8 RADIUS message constructor accepts a message code parameter 2012-01-30 19:11:08 +01:00
Tobias Brunner 7171d8765e Disable crypto benchmarking if CLOCK_THREAD_CPUTIME_ID is not available. 2012-01-30 11:04:55 +01:00
Tobias Brunner f1ba06c1c6 Cache list of plugin names to further simplify its usage. 
Also helpful for ipsec statusall to avoid having to enumerate plugins.
 2012-01-19 12:37:42 +01:00
Tobias Brunner fdf1f239ef Log list of loaded plugins in main PKI help output. 2012-01-19 11:56:43 +01:00
Tobias Brunner 576298a3ef Simplified logging of list of loaded plugins. 2012-01-19 11:56:03 +01:00