denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
11,804 Commits 1 Branch 0 Tags
3adffcd9ebc8af1699c1c3d5d431ff4c99b08786
Commit Graph
11804 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andreas Steffen 3adffcd9eb Implemented targeted SWID request 2013-09-06 22:06:39 +02:00
Tobias Brunner 70aefb9430 Store object files in the same directory as the source files 
Future automake releases will apparently do that implicitly, but current
releases spit out nasty warning messages.
 2013-09-05 14:24:26 +02:00
Andreas Steffen ae32172619 Make SWID directory where tags are stored configurable 2013-09-05 12:25:02 +02:00
Andreas Steffen 9b8137fdd3 Added tags table and some tag samples 2013-09-05 11:29:23 +02:00
Andreas Steffen b28686d530 swid_inventory object has a get_count method 2013-09-04 21:56:25 +02:00
Andreas Steffen bd3eaaef9b Count collected SWID tags or tag IDs 2013-09-04 21:30:36 +02:00
Andreas Steffen cee1a86385 Proceed with attestation only if Attestation IMC returns a discovery response 2013-09-04 21:30:36 +02:00
Tobias Brunner a4b996c0bc libipsec: Properly initialize variables when creating AEAD wrapper 2013-09-04 16:18:29 +02:00
Tobias Brunner c742905f50 android: Fix compilation after PTS header files were moved 2013-09-04 16:18:29 +02:00
Tobias Brunner cd764f42b9 libpts: Android.mk updated 2013-09-04 16:18:29 +02:00
Andreas Steffen de4637718e Version bump to 5.1.1dr3 2013-09-04 16:15:52 +02:00
Martin Willi 38fb8e4ed5 NEWS: 5.1.1 update for merged branches 2013-09-04 11:06:58 +02:00
Martin Willi 1fd5c7fbac load-tester: support extended traffic selector syntax, as in leftsubnet 
In addition the initiator may use %unique as port, using a distinct port for
each connection, starting from 1025.
 2013-09-04 10:49:48 +02:00
Martin Willi 47b4a51402 load-tester: add an option to test transport/beet connections 2013-09-04 10:49:48 +02:00
Martin Willi 60fcbb8ba8 Merge branch 'ike-address-ranges' 
Adds support for multiple subnets and address ranges in left/right ipsec.conf
options. As responder the connection is acceptable if the address is in one of
the ranges/subnets. To initiate connections, at least one single IP or hostname
is required for the peer address.
 2013-09-04 10:43:35 +02:00
Martin Willi 6301ec0ac5 man: add support for multiple addresses/ranges/subnets in ipsec.conf left= 2013-09-04 10:38:37 +02:00
Martin Willi 3070697f9f ike: support multiple addresses, ranges and subnets in IKE address config 
Replace the allowany semantic by a more powerful subnet and IP range matching.
Multiple addresses, DNS names, subnets and ranges can be specified in a comma
separated list. Initiators ignore the ranges/subnets, responders match
configurations against all addresses, ranges and subnets.
 2013-09-04 10:38:37 +02:00
Martin Willi beffdc6ab8 ike-cfg: remove the to be obsoleted allow any parameter in get_my/other_addr 2013-09-04 10:38:37 +02:00
Martin Willi 62282ec0ed backends: use ike_cfg host matching functions 2013-09-04 10:38:37 +02:00
Martin Willi 6f666192bb ike-cfg: add methods to match a host against configured local/remote addresses 2013-09-04 10:38:37 +02:00
Martin Willi 7446fa2860 trap-manager: use ike_cfg resolver functions 2013-09-04 10:38:37 +02:00
Martin Willi 0edce68767 ike-sa: use ike_cfg resolver functions 2013-09-04 10:38:36 +02:00
Martin Willi e743275cae ike-cfg: add a method to resolve local/remote hosts with port 2013-09-04 10:38:36 +02:00
Martin Willi f7cb6eaaa8 Merge branch 'ikev1-pushmode' 
Implements Mode Config Push mode in IKEv1 using the existing modeconfig=push
ipsec.conf option.
 2013-09-04 10:35:26 +02:00
Martin Willi a858064455 stroke: ignore a leftsourceip if a rightsourceip is given as well 
As we always negotiate virtual IPs in charon, having both left- and
rightsourceip is not allowed. Both in IKEv1 and IKEv2 we support a single
configuration payload exchange only.
 2013-09-04 10:33:38 +02:00
Martin Willi 16149401e9 man: update ipsec.conf modeconfig keyword 2013-09-04 10:33:38 +02:00
Martin Willi e3311e9b87 ikev1: implement mode config push mode 2013-09-04 10:33:38 +02:00
Martin Willi 2bae838d5e stroke: re-enable modeconfig keyword 2013-09-04 10:33:38 +02:00
Martin Willi 9aeaa7396e peer-cfg: add a pull/push mode option to use with mode config 2013-09-04 10:33:37 +02:00
Tobias Brunner 0b47bb5377 pubkey_speed: Add missing plugins 
The pkcs1 plugin is required to test the gmp/gcrypt plugins. Likewise,
the pem plugin is required when testing the openssl plugin.

Fixes #401.
 2013-09-04 10:01:46 +02:00
Tobias Brunner f17322dccb pubkey_speed: sudo is not required 
Also, refer to pubkey_speed properly when not being called from the same
directory.
 2013-09-04 09:53:36 +02:00
Tobias Brunner f1d5d87619 pubkey_speed: Add header and fix usage 2013-09-04 09:53:36 +02:00
Martin Willi 478f9e772b Merge branch 'xauth-radius-multi' 
Introduces multiple rounds in the eap-radius XAuth backend, concatenating
answers to a single password to verify using a RADIUS User-Password attribute.
This is known to work fine with iOS and OS X clients, allowing two-factor
authentication with proper dialogs.

Different XAuth "profiles" for each backend can be selected using a generic
colon sperated suffix for the XAuth string.
 2013-09-03 16:36:25 +02:00
Martin Willi e8b36eb92f charon-cmd: support prompting for a PIN 
To support a Password and PIN XAuth combo, additionally support multiple
prompts for different credential types.
 2013-09-03 16:26:19 +02:00
Martin Willi 45797bd50b xauth-generic: honor requested XAuth credential types as a client 
Support requesting of XAuth PINs and print XAuth messages.
 2013-09-03 16:26:19 +02:00
Martin Willi 3482cc9cf6 attributes: shorten some Unity and XAuth attribute short names 2013-09-03 16:26:19 +02:00
Martin Willi 61b0079881 message: print type of configuration payload 2013-09-03 16:26:19 +02:00
Martin Willi 8e4b258030 message: print attributes for IKEv1 configuration payloads as well 2013-09-03 16:26:19 +02:00
Martin Willi d787ada894 eap-radius: support XAuth configuration profiles, defining multiple XAuth rounds 2013-09-03 16:26:19 +02:00
Martin Willi 510ecf612a xauth: add a configuration string option to be passed to XAuth instances 
The configuration string is appended to the XAuth backend name, separated by
a colon. The configuration string is passed untouched to the backend, where
it can change the behavior of the XAuth module.
 2013-09-03 16:26:19 +02:00
Andreas Steffen 7a425fb24c Use ipsec_DATA destination 2013-09-02 14:20:33 +02:00
Andreas Steffen 0c2348581c Install SWID tag also in /share/ 2013-09-02 14:01:05 +02:00
Andreas Steffen 9f85122af9 Generate strongSwan SWID tag 2013-09-02 13:08:41 +02:00
Andreas Steffen 86f00e6aff Added regids table and some sample reqid data 2013-09-02 12:00:47 +02:00
Andreas Steffen 6fc5cc003d Pull dave for OS info 2013-09-02 12:00:46 +02:00
Andreas Steffen d1696c0eaa Corrected debug class to DBG_IMC 2013-09-02 12:00:46 +02:00
Tobias Brunner 5ee0747cfd autoconf: Split PACKAGE_VERSION in four parts 
The parts can be accessed with the variables:

	PACKAGE_VERSION_MAJOR
	PACKAGE_VERSION_MINOR
	PACKAGE_VERSION_BUILD
	PACKAGE_VERSION_REVIEW

The last part will be empty for regular releases.
 2013-09-02 11:30:24 +02:00
Tobias Brunner 10a69c32c2 conftest: Fix hook constructor resolution via dlsym() 
AM_CPPFLAGS only takes preprocessor flags like -I or -D, so it did not
forward -rdynamic to the linker (--export-dynamic), which meant that the
symbols defined in the executable itself were not resolvable via dlsym().

Fixes #394.
 2013-08-30 19:45:51 +02:00
Andreas Steffen 4e2a176229 SWID IMC implements recursive tag collection in /usr/share 2013-08-30 16:25:55 +02:00
Tobias Brunner 2a7a9471dd aes-test: Rename crypt() as it conflicts with a library function on Mac OS X 
unistd.h on Linux defines this only if _XOPEN_SOURCE is defined.
 2013-08-30 08:51:09 +02:00