Andreas Steffen
aaa4e478b1
Use u_int32_t legacy type in blowfish header file
2016-03-24 20:58:32 +01:00
Andreas Steffen
b12c53ce77
Use standard unsigned integer types
2016-03-24 18:52:48 +01:00
Andreas Steffen
7a117eeaec
Version bump to 5.4.0
2016-03-22 11:20:36 +01:00
Andreas Steffen
bebccf9876
Updated NEWS
2016-03-11 11:31:02 +01:00
Andreas Steffen
35babdf43f
Initialize ts variable
2016-03-11 08:29:23 +01:00
Andreas Steffen
6b8acc49ed
Merge branch 'subnet-identities'
...
Implemented IKEv1 IPv4/IPv6 address subnet and range identities to
be used as owners for shared secrets.
swanctl supports configuration of traffic selectors with IPv4/IPv6
address ranges.
2016-03-10 15:26:03 +01:00
Andreas Steffen
3f1de98678
Support of IP address ranges in traffic selectors
2016-03-10 13:59:37 +01:00
Andreas Steffen
90ef7e8af6
Updated swanctl/rw-psk-ikev1 scenario
2016-03-10 13:59:37 +01:00
Andreas Steffen
1d86d1d65a
Implemented IPv4/IPv6 subnet and range identities
...
The IKEv1 IPV4_ADDR_SUBNET, IPV6_ADDR_SUBNET, IPV4_ADDR_RANGE and
IPV6_ADDR_RANGE identities have been fully implemented and can be
used as owners of shared secrets (PSKs).
2016-03-10 13:59:37 +01:00
Andreas Steffen
c2523355a4
testing: Added swanctl/mult-auth-rsa-eap-sim-id scenario
2016-03-06 19:09:03 +01:00
Andreas Steffen
70ff382e41
testing: Added swanctl/xauth-rsa scenario
2016-03-06 12:28:55 +01:00
Andreas Steffen
99b794a4cf
Display IKE ports with swanctl --list-sas
2016-03-05 18:19:00 +01:00
Andreas Steffen
724f590711
Version bump to 5.4.0rc1
2016-03-05 18:18:12 +01:00
Andreas Steffen
07b0eac4b1
testing: attr-sql is a charon plugin
2016-03-05 15:53:22 +01:00
Andreas Steffen
26d2011b14
testing: Added swanctl/rw-psk-ikev1 scenario
2016-03-05 13:50:41 +01:00
Andreas Steffen
1989c7a381
testing: Include IKE port information in evaltests
2016-03-05 13:44:06 +01:00
Andreas Steffen
fe1f915b07
Version bump to 5.4.0dr8
2016-03-04 20:55:55 +01:00
Andreas Steffen
ad82c95f0a
Set PLUTO port variables to 0 in the case of no port restrictions
2016-03-04 12:52:35 +01:00
Andreas Steffen
5c25780ce0
Added port range support to NEWS
2016-03-04 10:03:12 +01:00
Andreas Steffen
ba919f393d
testing: Added swanctl/protoport-range scenario
2016-03-04 09:52:34 +01:00
Andreas Steffen
0d7202c7c5
Port range support in updown script
2016-03-04 09:52:34 +01:00
Andreas Steffen
6abae81f86
Implemented port ranges in kernel_netlink interface
2016-03-04 09:52:34 +01:00
Andreas Steffen
f00f679af9
Request missing SWID tags in a directed PA-TNC message
2016-03-04 01:04:44 +01:00
Andreas Steffen
efefa0c6a1
testing: Added swanctl/shunt-policies-nat-rw
2016-02-28 22:25:50 +01:00
Andreas Steffen
13891e2a4f
testing: Some minor fixes in test scenarios
2016-02-28 22:25:21 +01:00
Andreas Steffen
794cfbad71
Version bump to 5.4.0dr7
2016-02-28 15:56:06 +01:00
Andreas Steffen
68c9f0bb80
testing: Added swanctl/protoport-dual scenario
2016-02-28 14:33:48 +01:00
Andreas Steffen
ddf1fc7692
testing: converted af-alg scenarios to swanctl
2016-02-26 13:31:36 +01:00
Andreas Steffen
963b080810
testing: Increased ping interval in ikev2/trap-any scenario
2016-02-16 18:21:19 +01:00
Andreas Steffen
fc0f8466db
Version bump to 5.4.0dr6
2016-02-16 18:17:44 +01:00
Andreas Steffen
726a45b2f2
Corrected the description of the swanctl/dhcp-dynamic scenario
2016-02-16 18:17:17 +01:00
Andreas Steffen
4d83c5b4a6
Fix of the mutual TNC measurement use case
...
If the IKEv2 initiator acting as a TNC server receives invalid TNC measurements
from the IKEv2 responder acting as a TNC clienti, the exchange of PB-TNC batches
is continued until the IKEv2 responder acting as a TNC server has also finished
its TNC measurements.
In the past if these measurements in the other direction were correct
the IKEv2 responder acting as EAP server declared the IKEv2 EAP authentication
successful and the IPsec connection was established even though the TNC
measurement verification on the EAP peer side failed.
The fix adds an "allow" group membership on each endpoint if the corresponding
TNC measurements of the peer are successful. By requiring a "allow" group
membership in the IKEv2 connection definition the IPsec connection succeeds
only if the TNC measurements on both sides are valid.
2016-02-16 18:00:27 +01:00
Andreas Steffen
ac134b470a
testing: Added swanctl/dhcp-dynamic scenario
2016-02-03 12:10:59 +01:00
Andreas Steffen
927f733159
Version bump to 5.4.0dr5
2016-01-28 09:41:05 +01:00
Andreas Steffen
7c81942357
Support pseudonym RDN
2016-01-27 11:38:18 +01:00
Andreas Steffen
67a38ac6f1
testing: Added swanctl/config-payload scenario
2016-01-14 06:31:28 +01:00
Andreas Steffen
e7b5171e43
testing: Use include statement in swanctl/rw-pubkey-keyid scenario
2016-01-14 01:44:17 +01:00
Andreas Steffen
9492e12e61
Version bump to 5.4.0dr4
2016-01-10 01:39:08 +01:00
Andreas Steffen
ffd29ab30a
vici: Support multiple named raw ublic keys
2016-01-10 00:12:57 +01:00
Andreas Steffen
2aa2b17d41
testing: swanctl/rw-pubkey-anon uses anonymous public keys in remote access scenario
2016-01-09 07:23:30 +01:00
Andreas Steffen
abe6d07463
swanctl: Load pubkeys with load-creds
2016-01-09 07:23:30 +01:00
Andreas Steffen
b83cef2412
testing: added swanctl scenarios net2net-pubkey, rw-pubkey-keyid and rw-dnssec
2016-01-09 07:23:30 +01:00
Andreas Steffen
4c38c79452
vici: list-cert sends subject, not-before and not-after attributes for pubkeys
2016-01-09 07:23:30 +01:00
Andreas Steffen
87371460f6
vici: Support of raw public keys
2016-01-09 07:23:29 +01:00
Andreas Steffen
bffbf2f5fd
testing: Fixed description of swanctl/frags-iv4 scenario
2016-01-09 00:17:31 +01:00
Andreas Steffen
e333d4c0f1
swanctl.conf: IKEv2 fragmentation supported
2016-01-09 00:06:12 +01:00
Andreas Steffen
1990eeebfe
Version bump to 5.4.0dr3
2016-01-03 06:28:49 +01:00
Andreas Steffen
9121f6cce1
vici: Enable transport encoding of CERT_TRUSTED_PUBKEY objects
2016-01-03 06:28:49 +01:00
Andreas Steffen
9db530493f
testing: Change sql scenarios to swanctl
2016-01-03 06:28:48 +01:00
Andreas Steffen
92b051bd4a
vici: allow legacy shortcuts in cert queries
2015-12-19 10:30:17 +01:00
Andreas Steffen
6943db5679
Version bump to 5.4.0dr2
2015-12-18 15:25:50 +01:00
Andreas Steffen
490ba67682
testing: Fixed description in swanctl/rw-ntru-bliss scenario
2015-12-18 15:24:59 +01:00
Andreas Steffen
9463350943
testing: swanctl is enabled by default
2015-12-18 15:22:29 +01:00
Andreas Steffen
f553aea2c2
Use 128 bit security in README.pod examples
2015-12-18 15:08:33 +01:00
Andreas Steffen
2d9c68b8a8
configure: Enable vici plugin and swanctl by default
2015-12-17 17:49:48 +01:00
Andreas Steffen
76cbf1df34
testing: Added swanctl/rw-ntru-bliss scenario
2015-12-17 17:49:48 +01:00
Andreas Steffen
cc874350b8
Apply pubkey and signature constraints in vici plugin
2015-12-17 17:49:48 +01:00
Andreas Steffen
a78e1c3b11
128 bit default security strength for IKE and ESP algorithms
...
The default ESP cipher suite is now
AES_CBC-128/HMAC_SHA2_256_128
and requires SHA-2 HMAC support in the Linux kernel (correctly implemented
since 2.6.33).
The default IKE cipher suite is now
AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
if the openssl plugin is loaded or
AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
if ECC is not available.
The use of the SHA-1 hash algorithm and the MODP_2048 DH group has been
deprecated and ENCR_CHACHA20_POLY1305 has been added to the default
IKE AEAD algorithms.
2015-12-17 17:49:48 +01:00
Andreas Steffen
5e2b740a00
128 bit default security strength requires 3072 bit prime DH group
2015-12-14 10:39:40 +01:00
Andreas Steffen
47e5640378
swanctl --stats lists loaded plugins
2015-12-13 17:07:28 +01:00
Andreas Steffen
36b6d400d2
testing: swanctl/rw-cert scenario tests password-protected RSA key
2015-12-12 17:12:44 +01:00
Andreas Steffen
4f7f2538c4
Upgraded IKE and ESP proposals in swanctl scenarios to consistent 128 bit security
2015-12-12 15:54:48 +01:00
Andreas Steffen
02d431022c
Refactored certificate management for the vici and stroke interfaces
2015-12-12 00:19:24 +01:00
Andreas Steffen
4df09fe563
Modified vici_cert_info class for use with load_creds and vici_cred
2015-12-11 22:14:38 +01:00
Andreas Steffen
9dd8bfb2ce
Changed some certificate_type_names and added x509_flag_names
2015-12-11 18:26:55 +01:00
Andreas Steffen
44d3b02b57
Removed VICI protocol versioning
2015-12-11 18:26:55 +01:00
Andreas Steffen
b6dba6db74
Use of certificate_printer by swanctl --list-certs command
2015-12-11 18:26:55 +01:00
Andreas Steffen
334119b843
Share vici_cert_info.c with vici_cred.c
2015-12-11 18:26:55 +01:00
Andreas Steffen
ef43df6cbe
Allow msSmartcardLogon EKU to be built
2015-12-11 18:26:54 +01:00
Andreas Steffen
fad851e2d3
Use VICI 2.0 protocol version for certificate queries
2015-12-11 18:26:54 +01:00
Andreas Steffen
5d909303d8
Sort certificate types during enumeration
2015-12-11 18:26:54 +01:00
Andreas Steffen
75749971e1
Define VICI protocol versions
2015-12-11 18:26:54 +01:00
Andreas Steffen
6789d79d46
testing: Added swanctl --list-algs output
2015-12-11 18:26:54 +01:00
Andreas Steffen
6aa7703122
testing: Converted tnc scenarios to swanctl
2015-12-11 18:26:54 +01:00
Andreas Steffen
fd90f0613c
Print OCSP single responses
2015-12-11 18:26:53 +01:00
Andreas Steffen
3317d0e77b
Standardized printing of certificate information
...
The certificate_printer class allows the printing of certificate
information to a text file (usually stdout). This class is used
by the pki --print and swanctl --list-certs commands as well as
by the stroke plugin.
2015-12-11 18:26:53 +01:00
Andreas Steffen
fc235f90fe
Version bump to 5.4.0dr1
2015-12-01 15:06:23 +01:00
Andreas Steffen
b5eed58a39
Added Vici:Session Perl CPAN module to NEWS
2015-12-01 15:02:18 +01:00
Andreas Steffen
7d24aa0624
Extended and refactored vici perl implementation
2015-12-01 14:52:43 +01:00
Andreas Steffen
a17b6d469c
Built the CPAN file structure for the Vici::Session perl module
2015-12-01 14:52:43 +01:00
Andreas Steffen
a101bce862
Implement vici Perl binding
2015-12-01 14:52:43 +01:00
Andreas Steffen
cbc43f1b43
testing: Some more timing fixes
2015-12-01 14:51:23 +01:00
Andreas Steffen
66021f7263
Version bump to 5.3.5
2015-11-26 09:56:10 +01:00
Andreas Steffen
dddb32329c
testing: Updated expired mars.strongswan.org certificate
2015-11-26 09:55:28 +01:00
Andreas Steffen
8e9adf3d09
Version bump to 5.4.0dr1
2015-11-16 16:36:50 +01:00
Andreas Steffen
722714bdfe
Version bump to 5.3.4
2015-11-16 13:22:25 +01:00
Andreas Steffen
1c1f713431
testing: Error messages of curl plugin have changed
2015-11-13 14:02:45 +01:00
Andreas Steffen
c4b9b7ef2c
testing: Fixed another timing issue
2015-11-13 14:02:06 +01:00
Andreas Steffen
bec682e1da
Version bump to 5.3.4rc1
2015-11-13 12:18:28 +01:00
Andreas Steffen
019c7c2310
testing: Check for leases in swanctl/ip-pool scenario
2015-11-11 08:43:43 +01:00
Andreas Steffen
0748517582
Version bump to 5.3.4dr3
2015-11-10 16:54:38 +01:00
Andreas Steffen
946bc3a3f5
testing: Fixed some more timing issues
2015-11-10 16:54:38 +01:00
Andreas Steffen
2533c857ba
testing: Added Debian 7.9 to IMV database
2015-11-09 15:18:39 +01:00
Andreas Steffen
529357f09a
testing: Use sha3 plugin in ikev2/rw-cert scenario
2015-11-09 15:18:38 +01:00
Andreas Steffen
f1f7134ecb
Version bump to 5.3.4dr2
2015-11-06 16:07:04 +01:00
Andreas Steffen
23a50e66f1
testing: Updated hasher tests
2015-11-06 16:05:44 +01:00
Andreas Steffen
a88d958933
Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes
2015-11-06 14:55:31 +01:00
Andreas Steffen
6590298dad
Version bump to 5.3.4dr1
2015-11-04 19:42:17 +01:00
Andreas Steffen
83c1883d0b
Use word-aligned XOR in sha3_absorb()
2015-11-03 21:35:09 +01:00
Andreas Steffen
a98360a64c
testing: BLISS CA uses SHA-3 in its CRL
2015-11-03 21:35:09 +01:00
Andreas Steffen