Andreas Steffen
554a697a84
support Cisco Unity VID
2012-06-25 11:09:06 +02:00
Tobias Brunner
c236f19e50
ldaphost and ldapbase ca section keywords are deprecated
2012-06-25 10:52:16 +02:00
Tobias Brunner
693805cc98
Removed pluto-specifics from ipsec script
2012-06-25 10:52:16 +02:00
Martin Willi
0ba1ddaa24
Enforce uniqueids=keep based on XAuth identity
2012-06-25 10:18:35 +02:00
Martin Willi
f145ea29e0
Don't send XAUTH_OK if a hook prevents SA to establish
2012-06-25 10:18:35 +02:00
Martin Willi
0c32b9c62f
Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes
2012-06-25 10:18:35 +02:00
Martin Willi
dd1381e7d3
Show EAP/XAuth identity in "ipsec status", if available
2012-06-25 10:18:35 +02:00
Martin Willi
0fbfcf2a3a
Use XAuth/EAP remote identity for uniqueness check
2012-06-25 10:18:34 +02:00
Martin Willi
de5e8fb4e0
Add missing XAuth name variable when complaining about missing XAuth backend
2012-06-25 10:09:27 +02:00
Andreas Steffen
a7b8e380dc
some copyright additions
2012-06-23 12:09:29 +02:00
Andreas Steffen
e398dfb4c3
update copyright
2012-06-23 11:57:42 +02:00
Tobias Brunner
e91157a4b6
Fix SIGSEGV if kernel install fails during Quick Mode as responder.
2012-06-22 11:34:38 +02:00
Tobias Brunner
aa8898bc45
Fixed compile error because of charon->name in certexpire plugin.
2012-06-21 13:59:18 +02:00
Martin Willi
e2dd114f37
Select requested virtual IP family based on remote TS, if no local TS available
2012-06-20 10:02:01 +02:00
Tobias Brunner
5d227c79a9
Doxygen fix in PKCS#7 wrapper
2012-06-19 13:32:59 +02:00
Tobias Brunner
5c1332bf7c
NLM_F_DUMP includes NLM_F_ROOT.
2012-06-15 16:46:27 +02:00
Tobias Brunner
8ec51f83e5
Don't create roam jobs based on cached/cloned routes.
2012-06-15 16:44:18 +02:00
Tobias Brunner
9896b6bd58
Don't compare ports when comparing cached routes.
...
At least src_ip has a port set sometimes.
2012-06-15 16:44:07 +02:00
Tobias Brunner
31bcaf604a
starter: Fixed parsing of %defaultroute.
2012-06-15 10:46:56 +02:00
Martin Willi
af518b450e
Adopt children as XAuth initiator (which is IKE responder)
2012-06-14 14:49:19 +02:00
Martin Willi
e36497700c
Print the kind of *Swan during starter startup
2012-06-14 10:25:48 +02:00
Martin Willi
137035cc78
Show what kind of *Swan we run in "ipsec status"
2012-06-14 10:25:48 +02:00
Martin Willi
b31a56f128
Require a scary option to respond to Aggressive Mode PSK requests
...
While Aggressive Mode PSK is widely used, it is known to be subject
to dictionary attacks by passive attackers. We don't complain as
initiator to be compatible with existing (insecure) setups, but
require a scary strongswan.conf option if someone wants to use it
as responder.
2012-06-14 10:25:48 +02:00
Andreas Steffen
e49f18f74d
thanks to narrowing treat right|leftsubnetwithin as synonyms for right|leftsubnet
2012-06-14 07:55:12 +02:00
Tobias Brunner
dd38e9fc83
scepclient: Fixed Makefile after removing enable-smartcard configure option.
2012-06-13 15:08:14 +02:00
Tobias Brunner
f7cbc0fafe
Use proper defines for IPV6_PKTINFO on Mac OS X Lion and newer.
2012-06-13 15:02:10 +02:00
Tobias Brunner
25fb9d3f4a
starter: Print additional help texts for selected deprecated keywords.
2012-06-12 16:15:03 +02:00
Tobias Brunner
9707d9db79
starter: Improved how deprecated keywords are handled.
...
We only throw a warning now instead of rejecting the config.
2012-06-12 16:15:03 +02:00
Tobias Brunner
5c7a219804
Revert "starter: Don't treat unsupported keywords as fatal errors just report them."
...
This reverts commit e55876a657
2012-06-12 16:15:03 +02:00
Martin Willi
e35bbb9740
Added signature scheme options left/rightauth
2012-06-12 15:01:39 +02:00
Martin Willi
918e92c4c9
Support multiple different public key strength types in constraints
2012-06-12 14:24:49 +02:00
Martin Willi
fd4ff11858
Add signature schemes to auth_cfg during trustchain validation
2012-06-12 14:24:49 +02:00
Martin Willi
a37f2d2006
certificate_t->issued_by takes an argument to receive signature scheme
2012-06-12 14:24:49 +02:00
Martin Willi
439d0742e9
Define auth_cfg rules for signature schemes
2012-06-12 14:24:49 +02:00
Tobias Brunner
e7c01bed49
starter: Fixed parsing of left|right=%any.
2012-06-12 10:16:51 +02:00
Tobias Brunner
4d21846912
starter: Fix comparison of connections.
2012-06-11 17:33:32 +02:00
Tobias Brunner
3e2ff81e5d
starter: Removed all unsupported keywords.
2012-06-11 17:33:32 +02:00
Tobias Brunner
e55876a657
starter: Don't treat unsupported keywords as fatal errors just report them.
2012-06-11 17:33:32 +02:00
Tobias Brunner
fff4b74db2
Bye bye Pluto!
...
Charon will take over IKEv1 duties from here. This also removes
libfreeswan and whack.
2012-06-11 17:33:32 +02:00
Tobias Brunner
4a54860986
_copyright: Replicate copyright text here instead of calling libfreeswan.
2012-06-11 17:33:32 +02:00
Tobias Brunner
ee3026a1e2
starter: Remove all ties to pluto/libfreeswan.
...
Moved some types/constants in the process.
2012-06-11 17:33:32 +02:00
Tobias Brunner
5b09310e67
starter: Use custom type for SA specific options (flags).
2012-06-11 17:33:31 +02:00
Tobias Brunner
29906e0eab
starter: Parse left|rightprotoport directly in confread.c.
2012-06-11 17:33:31 +02:00
Tobias Brunner
eca839b0a7
starter: No special handling for left|rightsubnet, just pass it on as string.
2012-06-11 17:33:31 +02:00
Tobias Brunner
6ce841b213
starter: Use host_t to parse left|rightsourceip.
...
Also for the yet unused natip option.
2012-06-11 17:33:31 +02:00
Tobias Brunner
0ac29be793
starter: Remove left|rightsubnetwithin option (charon narrows left|rightsubnet down accordingly).
2012-06-11 17:33:31 +02:00
Tobias Brunner
8dd094e185
starter: Don't resolve any addresses in starter.
...
Also removed remains of some unknown iface option.
2012-06-11 17:33:31 +02:00
Tobias Brunner
efc69e9f38
starter: Removed pfs and pfsgroup options (handled via esp option).
2012-06-11 17:33:31 +02:00
Tobias Brunner
6d065f14ae
starter: Store mode of the IPsec SA/policy in a separate member.
2012-06-11 17:33:30 +02:00
Tobias Brunner
f82365ad27
starter: Use custom type to mark seen keywords.
2012-06-11 17:33:30 +02:00
Andreas Steffen