denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,364 Commits 1 Branch 0 Tags
392f4e17c2c949338411345196bab5f7068131e9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 45d66f5af6 some simplifications to trusted_enumerator_t 2008-04-01 10:56:08 +00:00
Martin Willi 1bb85edffe checking pretrusted but bad certificates only once 2008-04-01 10:43:44 +00:00
Martin Willi dd2efc2c03 replaced the example manager database by a sql script 2008-04-01 07:16:48 +00:00
Martin Willi e411f94d44 changed enumerator implementation to handle reentrant code 2008-04-01 06:51:55 +00:00
Martin Willi 9e72d3bcaf defining ME globally, as we need it in plugins 2008-03-31 15:01:43 +00:00
Martin Willi 0f7ef3d2a0 received certificates have least priority 
fixed manager unlocking
 2008-03-31 08:43:18 +00:00
Martin Willi d69b267d58 fixed refcounting in certificate trustchain validation 2008-03-31 07:16:12 +00:00
Martin Willi b7ef3f625d leak detective detects heap over- and underflow 2008-03-28 14:51:26 +00:00
Martin Willi 7939864dec updated leak_detective whitelist: libxml and clearsilver functions 2008-03-28 13:16:36 +00:00
Martin Willi 6b9290ff12 renamed xml plugin to smp to avoid confusion 
added some dependency checks to configure
configure checks ClearSilver and fastcgi
cleanups in the build system here and there
 2008-03-28 12:44:01 +00:00
Martin Willi 892fb43b12 fixed manager plugin loading 
manager uses strongswan.conf to read its configuration
 2008-03-28 12:41:05 +00:00
Martin Willi 35b6e2301f fixed crash if crl fetching fails 2008-03-28 12:00:51 +00:00
Martin Willi dca40a9483 fixed all pluto compiler warnings 2008-03-28 11:48:14 +00:00
Martin Willi 7539b1d1aa fixed compiler warning in openace 
fixed pem loading bug
 2008-03-28 11:47:11 +00:00
Martin Willi acf7956c68 fixed compiler warning in libfreeswan 2008-03-28 11:46:30 +00:00
Martin Willi a43eb5aa3f fixed compiler warning in scepclient 2008-03-28 11:45:56 +00:00
Martin Willi 0d2670e7e6 removed unused yynuput to fix compiler warning 2008-03-28 11:45:01 +00:00
Martin Willi 15e21c5cba fixed compiler warning 2008-03-28 10:21:04 +00:00
Martin Willi d55fa9aff7 reentrant save cert_cache 2008-03-28 08:38:51 +00:00
Martin Willi ac1fefc2de caching of CRLs 2008-03-28 08:14:47 +00:00
Martin Willi d20e5c6ab5 replaced get_public() by create_public_enumerator() to try multiple public keys for signature verification 2008-03-27 19:07:23 +00:00
Martin Willi 0d30ba3343 use trusted self-signed root CA certificates as trust anchor only 2008-03-27 13:38:02 +00:00
Martin Willi 52a61742e7 reusing generic shared_key_t implementation in med_db 2008-03-27 11:45:49 +00:00
Martin Willi cf4caefab1 whitelisted FCGX_Init 
reporting count of leaks suppressed by whitelist
 2008-03-27 11:42:35 +00:00
Martin Willi 4204db116b fixed memory leak in dispatcher 2008-03-27 10:24:37 +00:00
Martin Willi f957f7dfb3 implemented cert cache flushing, ipsec purgeocsp 2008-03-27 06:37:29 +00:00
Martin Willi 685232670a added uptime statistics to statusall 2008-03-26 16:13:14 +00:00
Martin Willi 7b88a983d8 caching of ocsp responses (experimental), no crl caching yet 2008-03-26 15:21:50 +00:00
Martin Willi 391abda082 fixed compile error if --enable-p2p is set 2008-03-26 14:45:24 +00:00
Martin Willi e37f7715bf fixed rightca= constraint checking 
implemented rightca= for intermediate CAs we do not have the certificate at config load
 2008-03-26 12:23:46 +00:00
Martin Willi 2d84da89b9 fixed auth_info_t.equals() 2008-03-26 10:58:19 +00:00
Martin Willi 0b14fdb92b splitted stroke plugin to several files: 
socket: reads messages from socket, dispatching
  config: process add/del conn, serves configs through backend_t
  control: controlling of the daemon (up/down/route/...(
  cred: credential loading, serves creds through credential_set_t
  ca: ca sections from ipsec.conf, serves cdp's through credential_set_t
  list: log status information to stroke console (status/statusall/list*)
  shared_key: shared key implementation for keys read from ipsec.secrets
  plugin: registers stroke plugin and starts socket w/ thread
 2008-03-26 10:10:40 +00:00
Martin Willi 3c7e72f5b0 added equals() method to peer_cfg, ike_cfg, proposals, auth_info 
allows easier merging of ipsec.conf connections
replaced some iterators through enumerators
made proposals algorithm_t private using enumerator
 2008-03-26 10:06:45 +00:00
Martin Willi a852928a6f fixed compiler warnings 2008-03-26 09:29:30 +00:00
Martin Willi dfd5cdcb88 cert_cache_t caches subject-issuer relations and subject certificates 
ocsp/crl do not benefit yet due missing lookup function
 2008-03-20 14:31:36 +00:00
Martin Willi fe8f7626d1 fallback to random end entity certificate if trustchain building fails 2008-03-20 13:14:55 +00:00
Martin Willi 629e55434a 2008-03-20 11:38:51 +00:00
Martin Willi a86e3ab37a some C libraries need _GNU_SOURCE for rwlocks 2008-03-20 11:27:55 +00:00
Martin Willi 36524c4844 added support for certificate requests for not yet known CAs 2008-03-20 10:09:56 +00:00
Martin Willi 9be0dc922e fixed verification of preinstalled certificates 2008-03-20 09:30:02 +00:00
Martin Willi 44ab7c85d7 more trustchain verification improvements 
should fix crl-revoked and two-certs scenarios
 2008-03-20 09:27:57 +00:00
Martin Willi ca7663ece6 CA certificates are allowed to sign OCSP responsed without OCSP_SIGNER flag 2008-03-20 07:21:44 +00:00
Martin Willi 48acfe98ae refactored trustchain verification, this should fix #33 
moved auth_info/ocsp_response credset wrapper to separate files
 2008-03-19 17:54:54 +00:00
Martin Willi de7062a280 removed unimplemented private/public key function declarations 2008-03-19 14:21:56 +00:00
Martin Willi cfede7f6e2 The introduced SHA1_NOFINAL hasher was not sufficient for EAP-AKA, 
as it requires to XOR the key into the hashers state.
A new SHA1 based keyed hash function, implemented as PRF, enables EAP-AKA
and the FIPS-PRF function to properly use the existing SHA1 implementation.
 2008-03-19 14:02:52 +00:00
Martin Willi d3a6993777 fixed shared key lookup in stroke 2008-03-19 10:24:51 +00:00
Martin Willi 3c448f019b fixed peer_cfg lookup when omitting IDr 2008-03-19 10:08:59 +00:00
Martin Willi 081ae2eb61 fixed CRL check return value on revoked certificates 
fixed possible refcounting bugs
generic return_null() implementation
 2008-03-19 09:44:47 +00:00
Martin Willi a40708e511 fixed compiler warning 2008-03-18 14:06:11 +00:00
Martin Willi bed94c8aeb added generic payload order rules for notifies 2008-03-18 12:45:23 +00:00
Martin Willi 7162be5772 fixed ike_cfg lookup in stroke 2008-03-18 12:40:41 +00:00
Martin Willi 4bfa63ed25 added false positive signature check 2008-03-18 12:25:39 +00:00
Martin Willi 18be601fcd added missing test case file ([3607]) 2008-03-18 12:16:36 +00:00
Martin Willi d7c529f5a6 creating public key from RSA private key 
RSA key generation and signature test
 2008-03-18 12:13:51 +00:00
Martin Willi 50045c3b14 better normalized tables for SQL plugin (IDs) 2008-03-18 09:07:04 +00:00
Martin Willi 34e281ed32 enforcing x509_flags on certificate construction 2008-03-17 08:06:49 +00:00
Martin Willi d4ba109c9c fixed CRL revoked certs enumeration 2008-03-17 07:25:32 +00:00
Martin Willi 933f80c391 logging to SQL database 2008-03-15 14:17:09 +00:00
Martin Willi 72d68379dc correctly unregister IKE_SA at the bus 2008-03-15 14:08:43 +00:00
Martin Willi 8d04f78d07 removed X509_PEER flag; flags are meant to read cert, not to store additional state in cert 
removed x509_t.set_flags for the reason above
implemented a simple, generic shared_key_t
 2008-03-14 15:11:29 +00:00
Martin Willi 39ea88f694 credential lookup in mysql/sqlite database 2008-03-14 15:06:42 +00:00
Martin Willi 9c410a8806 refactored buggy trustchain building, fixed refcount bug 2008-03-14 15:04:16 +00:00
Martin Willi dbcf4e7451 reduced mysql pool verbosity 2008-03-14 15:03:19 +00:00
Martin Willi 8f1596d606 SQL schema for MySQL and SQLite, test data 2008-03-14 07:39:01 +00:00
Martin Willi e42db695e2 fixed apidoc grouping 2008-03-13 14:53:57 +00:00
Martin Willi 419ee1072e added NetworkManager prototype DBUS policy, applet config 2008-03-13 14:41:27 +00:00
Martin Willi 2d94fdfab7 added old and unmaintained prototype of NetworkManager applet and authenticator 2008-03-13 14:37:11 +00:00
Martin Willi b820f8aa8e reverted accidentally commited testing config 2008-03-13 14:20:20 +00:00
Martin Willi 552cc11b1f merged the modularization branch (credentials) back to trunk 2008-03-13 14:14:44 +00:00
Martin Willi e633b1998f creating sysconfdir if it does not exist 
moved all directory creations into starters Makefile
 2008-02-22 14:50:38 +00:00
Martin Willi 5bbac9ffff split connections with different virtual IPs in different peer_cfgs 
respect different peer_cfg's when initiating a CHILD_SA within an existing IKE_SA
 2008-02-05 12:39:30 +00:00
Martin Willi 3b1692c058 use identifiers in EAP_SUCCESS/EAP_FAILURE payloads 2008-02-04 11:43:10 +00:00
Martin Willi 3a36ce1164 added missing hasher include 2008-01-03 10:42:21 +00:00
Martin Willi b8461a37db fixed EAP-MD5 to accept Name attribute in challenge 2007-12-18 10:44:44 +00:00
Martin Willi fdc7c943f9 updated NEWS 2007-12-13 17:52:49 +00:00
Martin Willi 0f806802ae implemented Expanded EAP types to support vendor specific methods 2007-12-13 17:31:21 +00:00
Martin Willi 3243ac6d5e fixed actual ID length when AT_IDENTITY gets padded 2007-12-13 14:39:38 +00:00
Martin Willi 26e2467692 ported EAP-AKA branch into trunk 2007-12-13 10:54:29 +00:00
Martin Willi 4b403e7672 merged EAP-MD5 into trunk 2007-12-12 14:29:10 +00:00
Martin Willi f9d80d53c3 accept unknown attributes in config payloads 2007-12-09 19:43:41 +00:00
Martin Willi 98d0002644 fixed build when using --disable-pluto 2007-12-07 10:25:01 +00:00
Martin Willi 3895125275 removed c++ style comments 
fixed compiler warnings
 2007-12-04 10:48:27 +00:00
Martin Willi b8249ff5ed fixed mobike/auth_lifetime in conjunction with p2p-natt 2007-12-04 10:05:36 +00:00
Martin Willi 8b678ad461 updated NEWS 2007-12-03 14:48:04 +00:00
Martin Willi cbfb2aff50 added more ./configure build options for 
EAP-Identity module
  ipsec tools (openac, scepclient)
  optional charon/pluto build
  charon stroke interface
 2007-12-03 14:47:15 +00:00
Martin Willi 7805ad302d moved AUTH_LIFETIME handling in its own task (cleaner separation, proper payload order) 2007-12-03 10:52:18 +00:00
Martin Willi 8e78e43220 added a "libcharon-" prefix to plugins to avoid conflicts 2007-12-03 09:03:22 +00:00
Martin Willi 733f336ad3 socket_t implementation withouth raw sockets 
--disable-raw-socket configure option
  prevents charon/pluto to run in parallel
 2007-11-26 11:20:00 +00:00
Martin Willi 8499042452 updated TODO 2007-11-20 12:26:37 +00:00
Martin Willi 6f274c2ae1 updated NEWS 2007-11-20 12:23:39 +00:00
Martin Willi ee61471113 implemented RFC4478 (repeated authentication) 
changed %V printf handler to take a time delta, %#V now takes two arguments
 2007-11-20 12:06:40 +00:00
Martin Willi 7b36b734a4 fixed callback_job cancellation for threads waiting in the bus 2007-11-19 12:32:28 +00:00
Martin Willi e533b928f0 fixed memrchr compiler warning 2007-11-19 12:27:08 +00:00
Martin Willi 729a6ec965 fixed two leaks in stroke_interface 2007-11-19 11:28:11 +00:00
Martin Willi e101f162ab refactored bus and interface to resolve threading issues (WIP) 2007-11-15 18:35:54 +00:00
Martin Willi 1871cffdc4 be less agressive, but more verbose in killing charon 2007-11-15 18:34:05 +00:00
Martin Willi 73294df547 added IKE IP addresses to config list for manager 2007-11-15 10:09:48 +00:00
Martin Willi 5d4aea685f filtering out IKEv1 configurations for manager 2007-11-15 10:09:14 +00:00
Martin Willi 93fc29c6cf fixed daemon kill before threads are spawned 2007-11-14 10:12:34 +00:00
Martin Willi 91b16af0fa fixed NO_PROPOSAL_CHOSEN response on IKE_SA_INIT 2007-11-14 09:41:08 +00:00