denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,014 Commits 1 Branch 0 Tags
5a7e98231baae8dc8b7657d83175989d15db79b4
Commit Graph
9449 Commits
Author SHA1 Message Date
Andreas Steffen 5a7e98231b Added some example Debian SWID tags 2013-10-23 22:12:12 +02:00
Tobias Brunner 71c9565a3a pki: Replace BUILD_FROM_FD with passing a chunk via BUILD_BLOB 
This allows more than one builder to try parsing the data read from STDIN.
 2013-10-23 17:20:39 +02:00
Tobias Brunner 46cded2627 chunk: Add helper function to create a chunk from data read from a file descriptor 2013-10-23 17:20:39 +02:00
Martin Willi b08292a520 semaphore: Support cancellation in wait functions of semaphore fallback 
Semaphore wait functions should be a thread cancellation point, but did
not properly release the mutex in the fallback implementation.
 2013-10-23 16:08:40 +02:00
Martin Willi 47c76c1b05 rwlock: Re-acquire rwlock even if condvar wait times out 
A caller expects that the associated rwlock is held, whether the condvar
gets signaled or the wait times out.
 2013-10-23 11:52:26 +02:00
Andreas Steffen b891c22aa9 Updated and split data.sql 2013-10-23 00:26:02 +02:00
Andreas Steffen 50d7a55c96 Support Ubuntu 13.10 measurements 2013-10-21 21:33:30 +02:00
Andreas Steffen 27bf5c06dc check it specified IF-TNCCS protocol is enabled 2013-10-21 21:03:53 +02:00
Tobias Brunner 8e8e97d10d kernel-netlink: Check existence of linux/fib_rules.h, don't include it in distribution 
This reverts commit b0761f1f0a.
 2013-10-18 09:52:54 +02:00
Tobias Brunner 4c185d11ad updown: Properly configure ICMP[v6] message type and code in firewall rules 2013-10-17 16:57:39 +02:00
Tobias Brunner 9739a0bf67 updown: Pass ICMP[v6] message type and code to updown script 
The type is passed in $PLUTO_MY_PORT and the code in $PLUTO_PEER_PORT.
 2013-10-17 16:57:39 +02:00
Tobias Brunner 59213396fa kernel-pfkey: Install ICMP[v6] type/code as expected by the Linux kernel 2013-10-17 16:57:39 +02:00
Tobias Brunner 406a504ca7 kernel-netlink: Convert ports in acquires to ICMP[v6] type and code 2013-10-17 16:57:39 +02:00
Tobias Brunner ddc2d3c8e4 kernel-netlink: Properly install policies with ICMP[v6] types and codes 2013-10-17 16:57:39 +02:00
Tobias Brunner 000235f1c5 traffic-selector: Print ICMP[v6] message type and code in a more readable way 2013-10-17 16:57:39 +02:00
Tobias Brunner 4bebe45abb traffic-selector: Store ICMP[v6] message type and code properly 
We now store them as defined in RFC 4301, section 4.4.1.1.
 2013-10-17 16:57:39 +02:00
Tobias Brunner d6a1960d34 traffic-selector: Move class to its own Doxygen group 2013-10-17 16:57:38 +02:00
Tobias Brunner 7313499914 proposal: Add ECC Brainpool DH groups to the default proposal 2013-10-17 13:36:09 +02:00
Tobias Brunner 606aae3aa1 openssl: Add workaround if ECC Brainpool curves are not defined 2013-10-17 13:36:08 +02:00
Tobias Brunner 3c29d2822f openssl: Add support for ECC Brainpool curves for DH, if defined by OpenSSL 
OpenSSL does not include them in releases before 1.0.2.
 2013-10-17 13:36:08 +02:00
Andreas Steffen cca372465d ecc: Added ECC Brainpool ECDH groups as registered with IANA 2013-10-17 11:57:04 +02:00
Tobias Brunner be97277bdb unit-tests: Make test for bio_writer_t more portable 2013-10-17 11:44:03 +02:00
Tobias Brunner f6cadb7f54 libipsec: Don't print ciphertext with ICV in log message 2013-10-17 11:43:58 +02:00
Tobias Brunner f5c5fd6f74 libipsec: Properly calculate padding length especially for AES-GCM 2013-10-17 11:42:45 +02:00
Tobias Brunner 812ae898bf utils: Add utility function to calculate padding length 2013-10-17 10:25:34 +02:00
Tobias Brunner 32fef0c6e9 stroke: Reuse reqids of established CHILD_SAs when routing connections 2013-10-17 10:23:32 +02:00
Tobias Brunner 6278e64230 trap-manager: Make sure a config is not trapped twice 2013-10-17 10:23:32 +02:00
Tobias Brunner dd438ee22c Doxygen fixes 2013-10-15 11:25:55 +02:00
Andreas Steffen a37ab690cc Set recommendation in the case of PCR measurement failures 2013-10-13 22:17:18 +02:00
Andreas Steffen b0761f1f0a Add linux/fip_rules.h to include files 2013-10-13 20:51:10 +02:00
Andreas Steffen 6623dfa84d Revert refactoring which broke CentOS build 2013-10-13 19:56:04 +02:00
Tobias Brunner d9020264f4 checksum: The pool utility was moved to its own directory 2013-10-11 17:42:29 +02:00
Tobias Brunner 0f6f7ba22c ccm: Add missing comma in get_iv_gen method signature 2013-10-11 17:42:25 +02:00
Tobias Brunner bfeb8b5c47 iv-gen: Add missing header files to Makefile.am 2013-10-11 17:42:05 +02:00
Tobias Brunner 0c6f6c4e34 iv_gen: Mask sequential IVs with a random salt 
This makes it harder to attack a HA setup, even if the sequence numbers were
not fully in sync.
 2013-10-11 15:55:40 +02:00
Tobias Brunner e8229ad558 iv_gen: Provide external sequence number (IKE, ESP) 
This prevents duplicate sequential IVs in case of a HA failover.
 2013-10-11 15:55:40 +02:00
Tobias Brunner d74c254dfd ipsec: Use IV generator to encrypt ESP messages 2013-10-11 15:55:40 +02:00
Tobias Brunner b5010707a0 ikev2: Use IV generator to encrypt encrypted payload 2013-10-11 15:55:40 +02:00
Tobias Brunner 50bd28d549 iv_gen: aead_t implementations provide an IV generator 2013-10-11 15:55:40 +02:00
Tobias Brunner b3e1eb2afe iv_gen: Add IV generator that allocates IVs sequentially 2013-10-11 15:55:40 +02:00
Tobias Brunner 53d1f2dbfd iv_gen: Add IV generator that allocates IVs randomly 
Uses RNG_WEAK as the code currently does elsewhere to allocate IVs.
 2013-10-11 15:55:40 +02:00
Tobias Brunner 403057aa5a crypto: Add generic interface for IV generators 2013-10-11 15:55:40 +02:00
Tobias Brunner b38f7f703b apidoc: Move mac_prf to prf Doxygen group 2013-10-11 15:55:40 +02:00
Tobias Brunner feb3c4ff22 eap-radius: Forward RAT_FRAMED_IP_NETMASK as INTERNAL_IP4_NETMASK 2013-10-11 15:52:22 +02:00
Tobias Brunner 1a809e46f8 eap-radius: Forward UNITY_SPLIT_INCLUDE or UNITY_LOCAL_LAN attributes 
Depending on the value of the CVPN3000-IPSec-Split-Tunneling-Policy(55)
radius attribute, the subnets in the CVPN3000-IPSec-Split-Tunnel-List(27)
attribute are sent in either a UNITY_SPLIT_INCLUDE (if the value is 1)
or a UNITY_LOCAL_LAN (if the value is 2).

So if the following attributes would be configured for a RADIUS user

  CVPN3000-IPSec-Split-Tunnel-List := "10.0.1.0/255.255.255.0,10.0.2.0/255.255.255.0"
  CVPN3000-IPSec-Split-Tunneling-Policy := 1

A UNITY_SPLIT_INCLUDE configuration payload containing these two subnets
would be sent to the client during the ModeCfg exchange.
 2013-10-11 15:52:22 +02:00
Tobias Brunner 66229619cf eap-radius: Forward UNITY_DEF_DOMAIN and UNITY_SPLITDNS_NAME attributes 
The contents of the CVPN3000-IPSec-Default-Domain(28) and
CVPN3000-IPSec-Split-DNS-Names(29) radius attributes are forwarded in
the corresponding Unity configuration attributes.
 2013-10-11 15:52:22 +02:00
Ruslan N. Marchenko b638c131de dnscert: Add DNS CERT support for pubkey authentication 
Add DNSSEC protected CERT RR delivered certificate authentication.
The new dnscert plugin is based on the ipseckey plugin and relies on the
existing PEM decoder as well as x509 and PGP parsers.  As such the plugin
expects PEM encoded PKIX(x509) or PGP(GPG) certificate payloads.

The plugin is targeted to improve interoperability with Racoon, which
supports this type of authentication, ignoring in-stream certificates
and using only DNS provided certificates for FQDN IDs.
 2013-10-11 15:45:42 +02:00
Tobias Brunner 8ac54970f5 ipseckey: Properly handle failure to create a certificate 
Also, try the next key (if available) if parsing an IPSECKEY failed.
 2013-10-11 15:45:41 +02:00
Tobias Brunner e8130a9498 ipseckey: Refactor creation of certificate enumerator 
Reduces nesting and fixes a memory leak (rrsig_enum).
 2013-10-11 15:45:41 +02:00
Tobias Brunner de5ea570f1 ipseckey: Depend on plugin features to create public key and certificate objects 2013-10-11 15:45:41 +02:00