denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4,731 Commits 1 Branch 0 Tags
52719d719cc04eda1f5496bbace936cfdcb93b38
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 7481f964ae Use child_updown hook in updown plugin, fixes doubled invocation of down script 2010-02-03 11:07:53 +01:00
Martin Willi 909c0c3d63 Updated NEWS about per-connection inactivity timeout 2010-01-27 16:08:06 +01:00
Martin Willi 8015c91cb9 Added a ipsec.conf "inactivity" option to configure inactivity timeout for CHILD_SAs 2010-01-27 16:05:11 +01:00
Martin Willi 71da001753 Made inactivity_timeout a per CHILD_SA config option 2010-01-27 15:47:08 +01:00
Martin Willi db05341916 Refactored EAP payload, avoid unaligned word access 2010-01-21 14:43:07 +01:00
Martin Willi 23d2bf84a3 Added a METHOD2() macro that implements a method for two different interfaces 2010-01-21 14:42:08 +01:00
Martin Willi 47498044c3 Support RADIUS messages up to 4096 bytes, RADIUS EAP-Message fragmentation 2010-01-19 16:47:21 +01:00
Martin Willi 7eab4a1be6 Support TLS client authentication Extended Key Usage in x509 generation 2010-01-14 12:00:43 +01:00
Martin Willi aa9eeb5deb Support for closing CHILD/IKE_SA if a CHILD_SA is inactive. 2010-01-12 10:23:42 +01:00
Martin Willi bc6ff2fc99 Added strongswan.conf options to configure retransmission timeouts 2010-01-11 16:42:12 +01:00
Martin Willi 527f7f9b1c Added a "double" getter to libstrongswan settings 2010-01-11 16:39:28 +01:00
Martin Willi dbee988e28 Cast unaligned memcpy() args to char*, avoids over-optimization on ARM 
See http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.faqs/ka3934.html
 2010-01-11 15:35:41 +01:00
Martin Willi aca9f9ab5a Added NEWS about mutual EAP-only authentication 2010-01-07 16:16:22 +01:00
Martin Willi 34948b9971 EAP-MSCHAPv2 is indeed mutual, but is prone to MITM dictionary attacks 2010-01-07 15:56:11 +01:00
Martin Willi f34702ff3f Support EAP-only authentication for mutual and key deriving EAP methods 2010-01-07 15:51:30 +01:00
Martin Willi 12fca6cc9f Indicate and dected support for EAP-only authentication 2010-01-07 14:30:28 +01:00
Martin Willi cdad91de49 Added NEWS for the new Vendor ID requirement for private use allocations 2010-01-07 11:14:33 +01:00
Martin Willi 023fd8f135 Match to private use algorithms only if we know we are talking to strongSwan 2010-01-07 11:07:53 +01:00
Martin Willi b3349c5694 Interpret private use BEET mode notify only if we know we are talking to strongSwan 2010-01-07 09:37:38 +00:00
Martin Willi a5a0bcaa04 Add an option to send a vendor ID, allows us to properly support private extensions 2010-01-07 09:37:27 +00:00
Martin Willi f8f4f31a77 Fixed untoh32 function 2009-12-23 13:08:56 +01:00
Martin Willi 2fcb2cc653 Migrated identification_t to INIT/METHOD macros 2009-12-21 15:24:08 +01:00
Martin Willi 83b760cb42 Migrated curl_fetcher to INIT/METHOD macros 2009-12-17 13:53:25 +01:00
Martin Willi 1a1ff9d127 Added a METHOD() macro to define methods with both public and private signatures 2009-12-17 13:53:24 +01:00
Martin Willi 74eed73a40 Added a INIT() macro to initialize class instances 2009-12-17 13:53:24 +01:00
Martin Willi 6ec949e022 Fixed BEET mode by installing SAs with negotiated address in traffic selector 2009-12-17 10:52:07 +01:00
Martin Willi 0be12e3546 Added htoun16/32 and untoh16/32 to read/write unaligned network order integers 2009-12-15 13:39:01 +01:00
Martin Willi fc85786921 Install v6 routes via outgoing interface for now 2009-12-14 14:44:24 +01:00
Martin Willi a6225e4936 Improved libfast session management, using a hashtable 2009-12-08 19:31:02 +01:00
Martin Willi 4e90d9de9f Removed obsolete curl interface specific destructor 2009-12-08 16:21:58 +01:00
Martin Willi 89d236f0da Support "_" and "-" variants of NetworkManager pkg-config packages 2009-12-08 14:36:22 +01:00
Martin Willi f469754f7f Undef PACKAGE_BUG/URL of strongSwan before including ruby variants 2009-12-08 14:36:22 +01:00
Martin Willi 88dbccc842 Remove generated config.h.in from source tree 2009-12-08 14:36:21 +01:00
Martin Willi cd51437e43 Do not execute the callback job if it has been cancelled since registration 2009-12-03 08:00:43 +01:00
Martin Willi c636bc7e17 Cleanup library if daemon initialization fails 2009-12-03 08:00:43 +01:00
Martin Willi 65c8bff7a1 To build strongSwan from git sources, gettext is required 2009-12-02 11:49:11 +01:00
Martin Willi 376a11db3c Do not install invalid 0.0.0.0 DNS servers 2009-12-01 15:46:56 +01:00
Martin Willi 5b4d0de7d4 Prefer EAP-Identity for provider attribute/address lookup 2009-12-01 14:24:07 +01:00
Martin Willi f6116e61fc Save EAP-Identity on auth config 2009-12-01 14:24:06 +01:00
Martin Willi 44ce749360 Store completed authentication rounds permanently on IKE_SA, with flush option 2009-12-01 11:35:30 +01:00
Martin Willi 5b2b4d190a Removed obsolete and unused [gs]et_eap_identity() methods 2009-11-30 16:59:23 +01:00
Martin Willi 5351e51951 Do not propose transport mode as initiator if connection is NATed 2009-11-30 11:32:26 +01:00
Martin Willi bff9f824ed Verify EAP-SIM/AKA AT_MAC before processing any attributes 2009-11-30 10:00:06 +01:00
Martin Willi b04e72c21c SIM/AKA/Request/Reauthentication AT_MAC does not include NONCE_S, only the response 2009-11-30 09:27:39 +01:00
Martin Willi 5a91fd4536 Invoke attribute/key hooks from libsimaka 2009-11-30 09:27:34 +01:00
Martin Willi 8434c88b5e Extended SIM manager by hooks, currently featuring attribute and key hooks 2009-11-30 09:27:26 +01:00
Martin Willi fb1ae8da52 Added a get_sa() method to the bus, allowing a thread to lookup its IKE_SA 2009-11-30 09:27:14 +01:00
Martin Willi c56d958243 Handle NOT_SUPPORTED or other errors properly in get_quintuplet 2009-11-30 09:26:35 +01:00
Martin Willi 2b2c69e992 Use transport mode ESP SA if IPcomp is used, IPcomp already applies outer IP header 2009-11-26 16:03:06 +01:00
Martin Willi 52fd0ef9e0 Added NEWS about SHA2 changes 2009-11-26 10:39:26 +01:00
Martin Willi 6780edc07e Use full algorithm name for SHA384/512 HMACs 2009-11-26 10:39:26 +01:00
Martin Willi 6546482a68 Support the Linux specific SHA256 96 bit truncation HMAC via "sha256_96" keyword 2009-11-26 10:39:25 +01:00
Martin Willi eebfa73fd5 Install SHA256_128 auth algorithm with specified 128 bit truncation 2009-11-26 10:39:25 +01:00
Martin Willi 2379fdba1e Updated XFRM linux header, includes specified truncations for auth algos 2009-11-26 10:39:25 +01:00
Martin Willi 5be75c2cb1 Added support for IPv6 source route installation 2009-11-26 10:31:00 +01:00
Martin Willi 387a6e6c32 Check existing path in mobike probing only if we still have a route 2009-11-26 10:30:59 +01:00
Martin Willi 06f02f993c Do not recreate existing create_child subtask when retrying with different DH group 2009-11-23 13:50:01 +01:00
Martin Willi 0d1d19b99d Avoid potentially unaligned half-word read 2009-11-23 13:49:19 +01:00
Martin Willi dd326c114f Use abort() instead of raising SIGKILL, gives us proper core dumps if enabled 2009-11-20 14:36:24 +01:00
Martin Willi 832f283150 Use status_t return value for get_quintuplet() dummy implementations 2009-11-20 11:02:06 +01:00
Martin Willi 10bc5d96cb Move comment out of register_printf_function test 2009-11-19 14:37:34 +01:00
Martin Willi 80b44cd71a Message stringification supports more detailed EAP payload information 2009-11-18 10:37:46 +01:00
Martin Willi 1860bfa2ea Correctly enumerate attributes to request as initiator with the actually requesting handler 2009-11-17 17:51:30 +01:00
Martin Willi 1427c93fcd Fixed memleak in attribute handling 2009-11-17 15:55:45 +00:00
Martin Willi d674c2ace0 attr plugin supports any custom attribute type having a v4/v6 IP under the charon.plugins.attr namespace 2009-11-17 15:53:57 +00:00
Martin Willi 3797b8e767 Support enumeration of key/value pairs in a section of strongswan.conf 2009-11-17 15:52:36 +00:00
Martin Willi 86813bef12 Whitelist register_printf_specifier in leak detective 2009-11-17 15:51:57 +00:00
Martin Willi b5a2055fb1 Give plugins more control of which configuration attributes to request, and pass received attributes back to the requesting handler 2009-11-17 14:51:50 +01:00
Martin Willi e6cf060275 Encrypt payloads with missing rule, fix insertion of non-encrypted payloads 2009-11-12 14:52:12 +00:00
Martin Willi 074444972a Build libsimaka with libtool, as we require a PIC-enabled version 2009-11-12 13:37:07 +00:00
Martin Willi 098466039f Fix word alignement in memxor() on 64-bit architectures 2009-11-12 13:37:06 +00:00
Martin Willi addfeeff9c Do not complain about missing payload order rules for private use payloads 2009-11-12 13:37:06 +00:00
Martin Willi 5bfe1b2529 Properly initialize attribute encoding/length values 2009-11-12 13:37:06 +00:00
Martin Willi 733538a421 Identation/whitespace cleanups 2009-11-12 13:37:06 +00:00
Martin Willi 82713deafd Simplified vendor ID payload interface 2009-11-12 13:37:06 +00:00
Martin Willi 20d144e72f Invoke message hook before generation, allowing plugins to mangle it 2009-11-12 13:37:06 +00:00
Martin Willi ee3d4ef801 Prefer MODP2048/1536 over ECP Diffie-Hellman groups 2009-11-12 13:10:30 +00:00
Martin Willi f6bbcec390 Use register_printf_specifier instead of deprecated register_printf_function, if available 2009-11-12 13:16:46 +01:00
Martin Willi 0850e33518 Fixed compiler warning about missing return value 2009-11-12 11:17:02 +01:00
Martin Willi 1a86be6e48 Support variable RES length in AKA quintuplets 2009-11-12 10:34:02 +01:00
Martin Willi 15b65bf15d Ported pseudonym/reauth functionality to EAP-AKA 2009-11-12 10:34:01 +01:00
Martin Willi 3374cb0f44 Passing other as NULL should not always result in a match if me matches 2009-11-12 10:34:01 +01:00
Martin Willi 947b03fd09 Use new identity constructor in EAP-SIM 2009-11-12 10:34:01 +01:00
Martin Willi 324528700d Added identification constructor using a chunk of data, guessing id type 2009-11-12 10:34:01 +01:00
Martin Willi 0109846aa1 Moved card/provider enumeration to SIM manager, providing wrapped functions for both SIM and AKA plugins 2009-11-12 10:34:01 +01:00
Martin Willi eb7bf91e12 Added option to disable identity requests completely (old behavior) 2009-11-12 10:34:01 +01:00
Martin Willi 0107f5b687 Fixed replacing existing reauthentication data 2009-11-12 10:34:01 +01:00
Martin Willi 2dbac2ab9c Initiate full authentication if reauthentication identity is unknown 2009-11-12 10:34:01 +01:00
Martin Willi edcb2dd35b Moved reauth/pseudonym functionality from eap-sim-file to separate plugins, usable by any SIM/AKA backend 2009-11-12 10:34:01 +01:00
Martin Willi acb561373a eap-sim-file plugin supports volatile in-memory storage of fast reauthentication data 2009-11-12 10:34:01 +01:00
Martin Willi c5ec0f48e7 Initial support for fast reauthentication in EAP-SIM 2009-11-12 10:34:00 +01:00
Martin Willi 454b59c5fd EAP-SIM/AKA crypto helper supports key derivation for fast reauthentication 2009-11-12 10:34:00 +01:00
Martin Willi e1a8729de0 Fallback to permanent identity request if pseudonym mapping failed 2009-11-12 10:34:00 +01:00
Martin Willi c2f8c6a11e Query triplet/quintuplet functions with permanent identity only, 
extended sim_provider with a is_pseudonym() function.
 2009-11-12 10:34:00 +01:00
Martin Willi 2d112ca310 eap-sim-file plugin can store pseudonym information volatile in memory 2009-11-12 10:34:00 +01:00
Martin Willi 8aad8f6faf Some coding style cleanups 2009-11-12 10:34:00 +01:00
Martin Willi 0328fe940d Impemented basic pseudonym support in EAP-SIM 2009-11-12 10:34:00 +01:00
Martin Willi f81760dcd1 A SIM/AKA message can be parsed twice, without and with decryption 2009-11-12 10:34:00 +01:00
Martin Willi 0e20893d81 Pass SIM/AKA crypto helper to constructor of message 2009-11-12 10:34:00 +01:00
Martin Willi 13f418b442 Added a doxygen group for libsimaka, some cleanups 2009-11-12 10:34:00 +01:00