denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,904 Commits 1 Branch 0 Tags
20df9d315c80d95a5a268a5675c48075d5c0394c
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andreas Steffen 35babdf43f Initialize ts variable 2016-03-11 08:29:23 +01:00
Andreas Steffen 6b8acc49ed Merge branch 'subnet-identities' 
Implemented IKEv1 IPv4/IPv6 address subnet and range identities to
be used as owners for shared secrets.

swanctl supports configuration of traffic selectors with IPv4/IPv6
address ranges.
 2016-03-10 15:26:03 +01:00
Andreas Steffen 3f1de98678 Support of IP address ranges in traffic selectors 2016-03-10 13:59:37 +01:00
Andreas Steffen 90ef7e8af6 Updated swanctl/rw-psk-ikev1 scenario 2016-03-10 13:59:37 +01:00
Andreas Steffen 1d86d1d65a Implemented IPv4/IPv6 subnet and range identities 
The IKEv1 IPV4_ADDR_SUBNET, IPV6_ADDR_SUBNET, IPV4_ADDR_RANGE and
IPV6_ADDR_RANGE identities have been fully implemented and can be
used as owners of shared secrets (PSKs).
 2016-03-10 13:59:37 +01:00
Andreas Steffen c2523355a4 testing: Added swanctl/mult-auth-rsa-eap-sim-id scenario 2016-03-06 19:09:03 +01:00
Andreas Steffen 70ff382e41 testing: Added swanctl/xauth-rsa scenario 2016-03-06 12:28:55 +01:00
Andreas Steffen 99b794a4cf Display IKE ports with swanctl --list-sas 2016-03-05 18:19:00 +01:00
Andreas Steffen 724f590711 Version bump to 5.4.0rc1 2016-03-05 18:18:12 +01:00
Andreas Steffen 07b0eac4b1 testing: attr-sql is a charon plugin 2016-03-05 15:53:22 +01:00
Andreas Steffen 26d2011b14 testing: Added swanctl/rw-psk-ikev1 scenario 2016-03-05 13:50:41 +01:00
Andreas Steffen 1989c7a381 testing: Include IKE port information in evaltests 2016-03-05 13:44:06 +01:00
Andreas Steffen fe1f915b07 Version bump to 5.4.0dr8 2016-03-04 20:55:55 +01:00
Andreas Steffen ad82c95f0a Set PLUTO port variables to 0 in the case of no port restrictions 2016-03-04 12:52:35 +01:00
Andreas Steffen 5c25780ce0 Added port range support to NEWS 2016-03-04 10:03:12 +01:00
Andreas Steffen ba919f393d testing: Added swanctl/protoport-range scenario 2016-03-04 09:52:34 +01:00
Andreas Steffen 0d7202c7c5 Port range support in updown script 2016-03-04 09:52:34 +01:00
Andreas Steffen 6abae81f86 Implemented port ranges in kernel_netlink interface 2016-03-04 09:52:34 +01:00
Andreas Steffen f00f679af9 Request missing SWID tags in a directed PA-TNC message 2016-03-04 01:04:44 +01:00
Andreas Steffen efefa0c6a1 testing: Added swanctl/shunt-policies-nat-rw 2016-02-28 22:25:50 +01:00
Andreas Steffen 13891e2a4f testing: Some minor fixes in test scenarios 2016-02-28 22:25:21 +01:00
Andreas Steffen 794cfbad71 Version bump to 5.4.0dr7 2016-02-28 15:56:06 +01:00
Andreas Steffen 68c9f0bb80 testing: Added swanctl/protoport-dual scenario 2016-02-28 14:33:48 +01:00
Andreas Steffen ddf1fc7692 testing: converted af-alg scenarios to swanctl 2016-02-26 13:31:36 +01:00
Andreas Steffen 963b080810 testing: Increased ping interval in ikev2/trap-any scenario 2016-02-16 18:21:19 +01:00
Andreas Steffen fc0f8466db Version bump to 5.4.0dr6 2016-02-16 18:17:44 +01:00
Andreas Steffen 726a45b2f2 Corrected the description of the swanctl/dhcp-dynamic scenario 2016-02-16 18:17:17 +01:00
Andreas Steffen 4d83c5b4a6 Fix of the mutual TNC measurement use case 
If the IKEv2 initiator acting as a TNC server receives invalid TNC measurements
from the IKEv2 responder acting as a TNC clienti, the exchange of PB-TNC batches
is continued until the IKEv2 responder acting as a TNC server has also finished
its TNC measurements.

In the past if these measurements in the other direction were correct
the IKEv2 responder acting as EAP server declared the IKEv2 EAP authentication
successful and the IPsec connection was established even though the TNC
measurement verification on the EAP peer side failed.

The fix adds an "allow" group membership on each endpoint if the corresponding
TNC measurements of the peer are successful. By requiring a "allow" group
membership in the IKEv2 connection definition the IPsec connection succeeds
only if the TNC measurements on both sides are valid.
 2016-02-16 18:00:27 +01:00
Andreas Steffen ac134b470a testing: Added swanctl/dhcp-dynamic scenario 2016-02-03 12:10:59 +01:00
Andreas Steffen 927f733159 Version bump to 5.4.0dr5 2016-01-28 09:41:05 +01:00
Andreas Steffen 7c81942357 Support pseudonym RDN 2016-01-27 11:38:18 +01:00
Andreas Steffen 67a38ac6f1 testing: Added swanctl/config-payload scenario 2016-01-14 06:31:28 +01:00
Andreas Steffen e7b5171e43 testing: Use include statement in swanctl/rw-pubkey-keyid scenario 2016-01-14 01:44:17 +01:00
Andreas Steffen 9492e12e61 Version bump to 5.4.0dr4 2016-01-10 01:39:08 +01:00
Andreas Steffen ffd29ab30a vici: Support multiple named raw ublic keys 2016-01-10 00:12:57 +01:00
Andreas Steffen 2aa2b17d41 testing: swanctl/rw-pubkey-anon uses anonymous public keys in remote access scenario 2016-01-09 07:23:30 +01:00
Andreas Steffen abe6d07463 swanctl: Load pubkeys with load-creds 2016-01-09 07:23:30 +01:00
Andreas Steffen b83cef2412 testing: added swanctl scenarios net2net-pubkey, rw-pubkey-keyid and rw-dnssec 2016-01-09 07:23:30 +01:00
Andreas Steffen 4c38c79452 vici: list-cert sends subject, not-before and not-after attributes for pubkeys 2016-01-09 07:23:30 +01:00
Andreas Steffen 87371460f6 vici: Support of raw public keys 2016-01-09 07:23:29 +01:00
Andreas Steffen bffbf2f5fd testing: Fixed description of swanctl/frags-iv4 scenario 2016-01-09 00:17:31 +01:00
Andreas Steffen e333d4c0f1 swanctl.conf: IKEv2 fragmentation supported 2016-01-09 00:06:12 +01:00
Andreas Steffen 1990eeebfe Version bump to 5.4.0dr3 2016-01-03 06:28:49 +01:00
Andreas Steffen 9121f6cce1 vici: Enable transport encoding of CERT_TRUSTED_PUBKEY objects 2016-01-03 06:28:49 +01:00
Andreas Steffen 9db530493f testing: Change sql scenarios to swanctl 2016-01-03 06:28:48 +01:00
Andreas Steffen 92b051bd4a vici: allow legacy shortcuts in cert queries 2015-12-19 10:30:17 +01:00
Andreas Steffen 6943db5679 Version bump to 5.4.0dr2 2015-12-18 15:25:50 +01:00
Andreas Steffen 490ba67682 testing: Fixed description in swanctl/rw-ntru-bliss scenario 2015-12-18 15:24:59 +01:00
Andreas Steffen 9463350943 testing: swanctl is enabled by default 2015-12-18 15:22:29 +01:00
Andreas Steffen f553aea2c2 Use 128 bit security in README.pod examples 2015-12-18 15:08:33 +01:00
Andreas Steffen 2d9c68b8a8 configure: Enable vici plugin and swanctl by default 2015-12-17 17:49:48 +01:00
Andreas Steffen 76cbf1df34 testing: Added swanctl/rw-ntru-bliss scenario 2015-12-17 17:49:48 +01:00
Andreas Steffen cc874350b8 Apply pubkey and signature constraints in vici plugin 2015-12-17 17:49:48 +01:00
Andreas Steffen a78e1c3b11 128 bit default security strength for IKE and ESP algorithms 
The default ESP cipher suite is now
    AES_CBC-128/HMAC_SHA2_256_128
and requires SHA-2 HMAC support in the Linux kernel (correctly implemented
since 2.6.33).

The default IKE cipher suite is now
   AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
if the openssl plugin is loaded or
   AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
if ECC is not available.

The use of the SHA-1 hash algorithm and the MODP_2048 DH group has been
deprecated and ENCR_CHACHA20_POLY1305 has been added to the default
IKE AEAD algorithms.
 2015-12-17 17:49:48 +01:00
Andreas Steffen 5e2b740a00 128 bit default security strength requires 3072 bit prime DH group 2015-12-14 10:39:40 +01:00
Andreas Steffen 47e5640378 swanctl --stats lists loaded plugins 2015-12-13 17:07:28 +01:00
Andreas Steffen 36b6d400d2 testing: swanctl/rw-cert scenario tests password-protected RSA key 2015-12-12 17:12:44 +01:00
Andreas Steffen 4f7f2538c4 Upgraded IKE and ESP proposals in swanctl scenarios to consistent 128 bit security 2015-12-12 15:54:48 +01:00
Andreas Steffen 02d431022c Refactored certificate management for the vici and stroke interfaces 2015-12-12 00:19:24 +01:00
Andreas Steffen 4df09fe563 Modified vici_cert_info class for use with load_creds and vici_cred 2015-12-11 22:14:38 +01:00
Andreas Steffen 9dd8bfb2ce Changed some certificate_type_names and added x509_flag_names 2015-12-11 18:26:55 +01:00
Andreas Steffen 44d3b02b57 Removed VICI protocol versioning 2015-12-11 18:26:55 +01:00
Andreas Steffen b6dba6db74 Use of certificate_printer by swanctl --list-certs command 2015-12-11 18:26:55 +01:00
Andreas Steffen 334119b843 Share vici_cert_info.c with vici_cred.c 2015-12-11 18:26:55 +01:00
Andreas Steffen ef43df6cbe Allow msSmartcardLogon EKU to be built 2015-12-11 18:26:54 +01:00
Andreas Steffen fad851e2d3 Use VICI 2.0 protocol version for certificate queries 2015-12-11 18:26:54 +01:00
Andreas Steffen 5d909303d8 Sort certificate types during enumeration 2015-12-11 18:26:54 +01:00
Andreas Steffen 75749971e1 Define VICI protocol versions 2015-12-11 18:26:54 +01:00
Andreas Steffen 6789d79d46 testing: Added swanctl --list-algs output 2015-12-11 18:26:54 +01:00
Andreas Steffen 6aa7703122 testing: Converted tnc scenarios to swanctl 2015-12-11 18:26:54 +01:00
Andreas Steffen fd90f0613c Print OCSP single responses 2015-12-11 18:26:53 +01:00
Andreas Steffen 3317d0e77b Standardized printing of certificate information 
The certificate_printer class allows the printing of certificate
information to a text file (usually stdout). This class is used
by the pki --print and swanctl --list-certs commands as well as
by the stroke plugin.
 2015-12-11 18:26:53 +01:00
Andreas Steffen fc235f90fe Version bump to 5.4.0dr1 2015-12-01 15:06:23 +01:00
Andreas Steffen b5eed58a39 Added Vici:Session Perl CPAN module to NEWS 2015-12-01 15:02:18 +01:00
Andreas Steffen 7d24aa0624 Extended and refactored vici perl implementation 2015-12-01 14:52:43 +01:00
Andreas Steffen a17b6d469c Built the CPAN file structure for the Vici::Session perl module 2015-12-01 14:52:43 +01:00
Andreas Steffen a101bce862 Implement vici Perl binding 2015-12-01 14:52:43 +01:00
Andreas Steffen cbc43f1b43 testing: Some more timing fixes 2015-12-01 14:51:23 +01:00
Andreas Steffen 66021f7263 Version bump to 5.3.5 2015-11-26 09:56:10 +01:00
Andreas Steffen dddb32329c testing: Updated expired mars.strongswan.org certificate 2015-11-26 09:55:28 +01:00
Andreas Steffen 8e9adf3d09 Version bump to 5.4.0dr1 2015-11-16 16:36:50 +01:00
Andreas Steffen 722714bdfe Version bump to 5.3.4 2015-11-16 13:22:25 +01:00
Andreas Steffen 1c1f713431 testing: Error messages of curl plugin have changed 2015-11-13 14:02:45 +01:00
Andreas Steffen c4b9b7ef2c testing: Fixed another timing issue 2015-11-13 14:02:06 +01:00
Andreas Steffen bec682e1da Version bump to 5.3.4rc1 2015-11-13 12:18:28 +01:00
Andreas Steffen 019c7c2310 testing: Check for leases in swanctl/ip-pool scenario 2015-11-11 08:43:43 +01:00
Andreas Steffen 0748517582 Version bump to 5.3.4dr3 2015-11-10 16:54:38 +01:00
Andreas Steffen 946bc3a3f5 testing: Fixed some more timing issues 2015-11-10 16:54:38 +01:00
Andreas Steffen 2533c857ba testing: Added Debian 7.9 to IMV database 2015-11-09 15:18:39 +01:00
Andreas Steffen 529357f09a testing: Use sha3 plugin in ikev2/rw-cert scenario 2015-11-09 15:18:38 +01:00
Andreas Steffen f1f7134ecb Version bump to 5.3.4dr2 2015-11-06 16:07:04 +01:00
Andreas Steffen 23a50e66f1 testing: Updated hasher tests 2015-11-06 16:05:44 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Andreas Steffen 6590298dad Version bump to 5.3.4dr1 2015-11-04 19:42:17 +01:00
Andreas Steffen 83c1883d0b Use word-aligned XOR in sha3_absorb() 2015-11-03 21:35:09 +01:00
Andreas Steffen a98360a64c testing: BLISS CA uses SHA-3 in its CRL 2015-11-03 21:35:09 +01:00
Andreas Steffen f6fede934b Support BLISS signatures with SHA-3 hash 2015-11-03 21:35:09 +01:00
Andreas Steffen a488584b5f Implemented SHA-3 hash algorithm including test vectors 2015-11-03 21:35:09 +01:00
Andreas Steffen de61e2cef4 Defined SHA-3 hashers 2015-11-03 19:07:15 +01:00
Andreas Steffen a215008c11 Version bump to 5.3.3 2015-09-06 15:05:36 +02:00