denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,689 Commits 1 Branch 0 Tags
5a22a02156816fc9f56ca56c70fbfda6574b285d
Commit Graph
182 Commits
Author SHA1 Message Date
Martin Willi 5a22a02156 DNS resolving of ike_cfg hosts dynamically on demand 2008-06-06 15:05:54 +00:00
Andreas Steffen be1585c587 log received DH groups and PRFs if no common proposal is found 2008-05-22 14:18:44 +00:00
Tobias Brunner 346e9c5712 added the ECP groups from RFC 5114 2008-05-22 11:55:05 +00:00
Tobias Brunner fc1a31d54b added ECDH with OpenSSL (see RFC 4753) 2008-05-22 11:39:17 +00:00
Andreas Steffen 8bbb212f3a list proposed ESP ENCRYPTION and INTEGRITY algorithms if no proposal is chosen 2008-05-20 21:54:33 +00:00
Tobias Brunner 68ac3b44d1 fixed a bug introduced in [3973] 2008-05-19 08:48:44 +00:00
Andreas Steffen 15c508c708 ccm and gcm icv_sizes are accepted both in bits and octets 2008-05-17 21:51:47 +00:00
Tobias Brunner 3f730ec1cd Added support for AES-CCM and AES-GCM (authenticated encryption algorithms) in charon. 2008-05-16 13:27:21 +00:00
Tobias Brunner d4aad55434 IPComp for IKEv2 2008-05-08 16:19:11 +00:00
Martin Willi 240e727fde renamed PRF_AES128_CBC to PRF_AES128_XCBC 2008-05-08 12:43:27 +00:00
Martin Willi ff6836716c returning reference pointer on get_ref() 2008-05-06 10:55:42 +00:00
Martin Willi 27d04e055d implemented XCBC algorithms (signer, prf) for IKE on top of a crypter 
supporting ike=...-aesxcbc-... in ipsec.conf 
added AUTH_AES_XCBC_96 and PRF_AES128_CBC to default IKE proposal
AES XCBC testcase
 2008-04-30 14:26:24 +00:00
Martin Willi 4075225466 fixed peer config equality check 2008-04-18 10:30:52 +00:00
Martin Willi 0644ebd3de implemented IKE_SA uniqueness using ipsec.conf uniqueids paramater 
additionally supports a "keep" value to keep the old IKE_SA
 2008-04-14 13:23:24 +00:00
Martin Willi 348af092ac added close_action as a seperate config option to dpd_action 2008-04-14 08:17:18 +00:00
Martin Willi 96926b006d using dpd actions to enforce connection state 
dpd actions a per child-, not peer ike-sa
 2008-04-11 08:14:48 +00:00
Martin Willi cdcfe777f4 implementation of an CFG attribute framework, currently supporting virtual IPs 
updated ipsec.conf sourceip parameter to support
	CIDR notatation to serve from a pool
	%poolname to query a separate (database?) pool
 2008-04-09 12:54:47 +00:00
Tobias Brunner 471f923071 fixed two other memory leaks 2008-04-03 15:13:25 +00:00
Tobias Brunner dc04b7c743 mediation extension adapted to the naming convention of the current version of the draft. note: the external interface (config, autotools) has not yet been changed 2008-03-26 18:40:19 +00:00
Martin Willi 3c7e72f5b0 added equals() method to peer_cfg, ike_cfg, proposals, auth_info 
allows easier merging of ipsec.conf connections
replaced some iterators through enumerators
made proposals algorithm_t private using enumerator
 2008-03-26 10:06:45 +00:00
Martin Willi 3c448f019b fixed peer_cfg lookup when omitting IDr 2008-03-19 10:08:59 +00:00
Martin Willi 552cc11b1f merged the modularization branch (credentials) back to trunk 2008-03-13 14:14:44 +00:00
Martin Willi 0f806802ae implemented Expanded EAP types to support vendor specific methods 2007-12-13 17:31:21 +00:00
Martin Willi ee61471113 implemented RFC4478 (repeated authentication) 
changed %V printf handler to take a time delta, %#V now takes two arguments
 2007-11-20 12:06:40 +00:00
Andreas Steffen b073aada23 search : delimiter in ipsec.secrets entries from the rear 2007-11-16 20:23:29 +00:00
Martin Willi b9bc74979e fixed sqlite_backend compilation to respect changes from [3238] 2007-10-04 08:18:42 +00:00
Tobias Brunner d5cc175833 experimental P2P-NAT-T for IKEv2 merged back from branch 2007-10-03 15:10:41 +00:00
Martin Willi e4c9b92171 fixed sqlite database path 2007-10-02 11:55:19 +00:00
Martin Willi a3f100fa09 improved debugging code for traffic selector processing 2007-10-02 07:39:56 +00:00
Martin Willi f53b74c96f moved force_encap to ike_config, enables responder to enforce udp encapsulation 
fixed bugs in force_encap code
 2007-10-01 16:41:34 +00:00
Martin Willi 9dae1bed00 implemented IKEv2 force_encap connection parameter 
enforces UDP encapsulation by faking NAT detection payloads
  to hurdle restrictive firewalls
 2007-10-01 12:19:39 +00:00
Andreas Steffen cb23c49143 return argument has type size_t 2007-09-18 11:21:55 +00:00
Martin Willi 8f561d4409 prototype implemementation of an sqlite configuration backend 2007-09-18 07:12:21 +00:00
Andreas Steffen 15a9d460c0 peer_cfg now knows about group memberships 2007-09-13 15:33:17 +00:00
Andreas Steffen 2f9f5149c4 check hash algorithms used in signatures 2007-09-11 20:10:38 +00:00
Andreas Steffen c1ff717690 removed rsa_private_key clone() function 2007-09-11 16:26:08 +00:00
Andreas Steffen f0c156fbc9 replaced get_rsa_private_key() by rsa_signature() in order restrict the distribution of private key material 2007-09-11 10:18:25 +00:00
Andreas Steffen 7bac086733 overwrite storage used for shared secrets with pseudo-random bytes before releasing it 2007-09-10 19:12:01 +00:00
Martin Willi 9164e49ac0 added mobike=yes|no connection option 
yes: include mobike support notifies as initiator
  no: only enable mobike as responder when initiator supports it
  default: yes
 2007-08-29 12:11:25 +00:00
Andreas Steffen 929b9e367a append new attribute certs at the end 2007-08-14 13:04:36 +00:00
Andreas Steffen 06faefe43d adding attribute certficates to a chained list 2007-08-14 12:27:02 +00:00
Andreas Steffen 8f687a7591 has_rsa_private_key() must also be protected by keys_mutex 2007-08-10 12:10:36 +00:00
Andreas Steffen 84db83336b support of ipsec rereadsecrets for stroke 2007-08-10 07:16:32 +00:00
Andreas Steffen 037575682a bug fix in linked_list deletion - instead of acerts destroyed certs twice 2007-08-08 06:02:59 +00:00
Andreas Steffen f51d505e5e implemented listing of attribute certificates 2007-08-07 20:32:11 +00:00
Martin Willi fa1bd44f23 ignoring unkown crl/ocsp uris 2007-07-04 12:00:33 +00:00
Martin Willi face844a87 proper update of IPsec SA when roaming a host-to-host tunnel 
roaming of IPsec SAs using virtual IPs
 2007-07-02 09:49:22 +00:00
Andreas Steffen ad8c6c60dc moved assignment of CERT_UNKNOWN 2007-05-25 14:04:39 +00:00
Andreas Steffen 3f9834a491 log trust pathlen 2007-05-25 11:41:06 +00:00
Andreas Steffen 89eeedc243 included a certificate label in the is_trusted() method 2007-05-25 11:10:35 +00:00