denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
5,395 Commits 1 Branch 0 Tags
6e862e215251b0b6d9c4c876054f3d6630a744c6
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi 6e862e2152 Added PKCS#11 token plugin stub 2010-08-04 09:26:18 +02:00
Martin Willi 0f82a47063 Moved TLS stack to its own library 2010-08-03 15:39:26 +02:00
Martin Willi 0b71bc7af0 Moved eap-tls plugin to libcharon, updated to 4.4.1 APIs 2010-08-03 15:39:25 +02:00
Martin Willi 400df4ca7c Implemented EAP-TLS server functionality 2010-08-03 15:39:25 +02:00
Martin Willi 97abf95412 TLS stack keeps a copy of server/peer identities 2010-08-03 15:39:25 +02:00
Martin Willi c8a2fca58c Limit the number of EAP-TLS packets allowed 2010-08-03 15:39:25 +02:00
Martin Willi 8fef06a683 Use stricter state handling while processing TLS messages 2010-08-03 15:39:25 +02:00
Martin Willi dc9f34be4d Cleaned up the public TLS interface 2010-08-03 15:39:25 +02:00
Martin Willi 84d67ead4e Refactored common used operations into TLS crypto helper 2010-08-03 15:39:25 +02:00
Martin Willi 3e7e777941 Properly send empty EAP-TLS messages 2010-08-03 15:39:25 +02:00
Martin Willi 51313a39d1 Derive MSK for EAP-TLS authentication 2010-08-03 15:39:25 +02:00
Martin Willi 110364b042 Verify Server Finished message 2010-08-03 15:39:25 +02:00
Martin Willi f139b5786f Implemented input record decryption and verification 2010-08-03 15:39:25 +02:00
Martin Willi 84543e6efa Implemented key derivation, output record signing and encryption 2010-08-03 15:39:25 +02:00
Martin Willi 18010de23d Derive master secret, create Finished message 2010-08-03 15:39:25 +02:00
Martin Willi 149b7e6d01 Implemented the TLS specific PRF in its TLSv1.0 and TLSv1.2 variants 2010-08-03 15:39:24 +02:00
Martin Willi 3ddd164e5e Implemented sending of Certificate, ClientKeyExchange, CertificateVerify and ChangeCipherSpec as peer 2010-08-03 15:39:24 +02:00
Martin Willi 3a1640dea1 Implemented a tls_writer class to simplify TLS data generation 2010-08-03 15:39:24 +02:00
Martin Willi 4ef946dd64 Implemented a tls_reader class to simplify TLS data parsing 2010-08-03 15:39:24 +02:00
Martin Willi 3e962b0843 Process ServerHello(Done), Certificate(Request) messages 2010-08-03 15:39:24 +02:00
Martin Willi 698674c7f3 Send a ClientHello to start TLS negotiation 2010-08-03 15:39:24 +02:00
Martin Willi 536dbc00b9 Added TLS crypto helper, currently supports cipher suite selection 2010-08-03 15:39:24 +02:00
Martin Willi 9dc73cd21c Added support for AUTH_HMAC_SHA2_256_256, used in TLS 2010-08-03 15:39:24 +02:00
Martin Willi 4c0c2283a5 Added stubs for handshake handling, server and peer variants 2010-08-03 15:39:24 +02:00
Martin Willi 4c0124a0a2 Accept follow-up fragments with a TLS message length 2010-08-03 15:39:24 +02:00
Martin Willi 40e384ea01 Added dummy/identity implementations of the different TLS record layers 2010-08-03 15:39:24 +02:00
Martin Willi dcbbeb2d09 Pass TLS records to newly introduced TLS stack 2010-08-03 15:39:24 +02:00
Martin Willi f7f63c52e1 Added some TLS constants 2010-08-03 15:39:24 +02:00
Martin Willi b173819e5d (De-)fragment EAP-TLS packets, pass TLS records to upper layer 2010-08-03 15:39:24 +02:00
Martin Willi 2107953804 Added EAP-TLS plugin stub 2010-08-03 15:39:24 +02:00
Martin Willi 63163cc340 The va_list trick does not seem to be portable, revert dots-in-section fix 
This reverts commit 8f50d06c35.
 2010-07-30 10:57:59 +02:00
Martin Willi 8f50d06c35 Fixed settings lookup if the section/key contains dots 2010-07-29 12:14:32 +02:00
Martin Willi c5c921bfa3 Added NEWS for snprintf() fixes 2010-07-28 11:06:49 +02:00
Martin Willi b8aeaea80c Fix use of snprintf() in pluto subjectAltName enumeration 2010-07-28 10:54:48 +02:00
Martin Willi c118559afe Fix use of snprintf() in IETF attributes to string conversion 2010-07-28 10:54:48 +02:00
Martin Willi 018543f3a8 Fix use of snprintf() in identification DN to ASCII conversion 2010-07-28 10:54:47 +02:00
Martin Willi c8bd06c7cf More NEWS for HA functionality 2010-07-28 10:49:58 +02:00
Martin Willi 98d0343870 Implemented a HA enabled in-memory address pool 2010-07-28 10:06:19 +02:00
Martin Willi 7455ab063f Added a function to segmentate a generic integer 2010-07-28 10:06:19 +02:00
Martin Willi c03b64a4ac Reserving does not work, as our pools do not support acquiring arbitrary addresses 
This reverts commit d1384080b3.
 2010-07-27 12:05:39 +02:00
Martin Willi 45c992474c Mem pool does not support multiple leases for an identity 2010-07-27 09:54:27 +02:00
Martin Willi 7eeb687d59 Flush any remaining cache state if an IKE_SA goes down 2010-07-27 09:18:06 +02:00
Martin Willi 1c1f132abe Added NEWS related to HA functionality 2010-07-26 15:41:33 +02:00
Martin Willi fa4f71c819 Synchronize EAP-Identity of remote peer 2010-07-26 15:10:54 +02:00
Martin Willi d1384080b3 Reserve virtual IP of passive IKE_SAs in the local pool 2010-07-26 15:01:24 +02:00
Martin Willi 65d15aff73 Added strongswan.conf options for HA heartbeat 2010-07-26 14:30:19 +02:00
Martin Willi 08e266a119 Log CHILD_SA segment responsibility 2010-07-26 13:53:54 +02:00
Martin Willi 3e6736f67e Pass initiator parameter to distinguish between original and exchange initiator 2010-07-26 13:53:53 +02:00
Martin Willi b2e447e24a Pass the CREATE_CHILD_SA initiator flag to the child_keys parameter 2010-07-26 13:53:53 +02:00
Martin Willi aa334daa9b Use a sync message cache to resynchronize IKE_SAs without rekeying 2010-07-26 13:53:49 +02:00
Martin Willi 2031002d42 Log received HA message types 2010-07-26 11:33:00 +02:00
Martin Willi f2eebed2a3 Add enum names for HA message types 2010-07-26 11:33:00 +02:00
Martin Willi 51217527e6 Delay resynchronization request until starter has loaded the configurations 2010-07-26 11:33:00 +02:00
Martin Willi 2cbc48ecab Replaces in_segment() by a more generic get_segment() function 2010-07-26 11:33:00 +02:00
Martin Willi ad2488fcdf Use distinct message types for HA message ID updates 2010-07-26 10:15:17 +02:00
Martin Willi 00c1bd0606 Migrated ha plugin to INIT/METHOD macros 2010-07-26 10:15:17 +02:00
Martin Willi fe2434cfd7 Added NEWS for the eap-simaka-sql plugin 2010-07-23 16:02:28 +02:00
Martin Willi e87b78c6ad Multiple RADIUS server NEWS 2010-07-21 17:27:06 +02:00
Martin Willi ce7967c50c Implemented support for multiple RADIUS servers 2010-07-21 17:25:09 +02:00
Martin Willi 58d2ef6e14 Migrated eap-radius plugin to INIT/METHOD macros 2010-07-21 17:09:27 +02:00
Martin Willi 5b6c220d13 Added log statement if peer requests EAP, but current config does not allow it 2010-07-21 17:09:15 +02:00
Martin Willi 83b957107f Revert "Warn about manual plugin load directives for pluto/charon" 
This reverts commit 5c46726d0d.
 2010-07-14 07:17:16 +02:00
Martin Willi 5c46726d0d Warn about manual plugin load directives for pluto/charon 2010-07-13 14:43:45 +02:00
Martin Willi 15d9904406 Remove plugin load directives from default strongswan.conf 2010-07-13 14:28:11 +02:00
Martin Willi 7f3a946874 Added NEWS about --signcrl and PEM support in pki utility 2010-07-13 14:18:19 +02:00
Martin Willi b5b95c75de Added pki PEM encoding support for certificates, CRLs and PKCS10 requests 2010-07-13 14:14:39 +02:00
Martin Willi e3b987f79b Added support for Certificate, CRL and PKCS10 encoding to PEM plugin 2010-07-13 13:53:33 +02:00
Martin Willi 0406eeaacb Support different encoding types in certificate.get_encoding() 2010-07-13 13:53:20 +02:00
Martin Willi da9724e6d0 Renamed key_encod{ing,der}_t and constants, prepare for generic credential encoding 2010-07-13 11:29:35 +02:00
Martin Willi 24d327ab4d Moved keys/key_encoding.[ch] to cred_encoding.[ch] 2010-07-13 11:02:35 +02:00
Martin Willi e1c51fd859 Fixed doxygen group of cert_validator interface 2010-07-13 10:42:02 +02:00
Martin Willi e9448cfc2f Added NEWS for revocation/addrblock plugin 2010-07-13 10:26:07 +02:00
Martin Willi f90d465ce2 Added addrblock plugin to RFC3779 test cases 2010-07-13 10:26:07 +02:00
Martin Willi 1f457546c1 Added revocation plugin to ikev2 crl/ocsp test cases 2010-07-13 10:26:07 +02:00
Martin Willi e57a29c731 Moved X509 ipAddrBlock checking to the addrblock plugin 2010-07-13 10:26:07 +02:00
Martin Willi be715344c2 Added a hook to narrow traffic selectors for CHILD_SAs 2010-07-13 10:26:07 +02:00
Martin Willi 88fa56b1ad Moved bus_t to METHOD/INIT macros 2010-07-13 10:26:07 +02:00
Martin Willi 1c8c924610 Moved addrblock plugin to libcharon 2010-07-13 10:26:07 +02:00
Martin Willi c2e5cee413 Moved CRL/OCSP checking to a dedicated plugin called revocation 2010-07-13 10:26:07 +02:00
Martin Willi c1f9dad672 Made some useful methods in the credential manager public 2010-07-13 10:26:07 +02:00
Martin Willi 5f9e62c54f Moved X509 addrBlock validation to a separate addrblock plugin 2010-07-13 10:26:07 +02:00
Martin Willi 2feb16f5dd Added a certificate validation hook to the credential manager 2010-07-13 10:26:07 +02:00
Martin Willi c3a9bef08e Migrated credential manager to INIT/METHOD macros 2010-07-13 10:26:07 +02:00
Martin Willi 2ccc02a4fd Moved credential manager to libstrongswan 2010-07-13 10:26:07 +02:00
Martin Willi 2ca7db1337 Move pathlen constraint checking to X509 specific checks 2010-07-13 10:26:06 +02:00
Martin Willi 5db798c8e0 Charon uses a generic trunstchain length limit, not only for X509 certificates 2010-07-13 10:26:06 +02:00
Martin Willi 01bb70e4ad Combined the OCSP/CRL options to a signle Online check option 2010-07-13 10:26:06 +02:00
Martin Willi 52f97c3893 Do not interpret long class attributes (such as from NPS) as group 2010-07-09 13:53:43 +02:00
Martin Willi cfa1c07604 Group membership constraint is fulfilled if subject is member in one of the groups 2010-07-09 13:51:58 +02:00
Martin Willi 6f07f5e3d4 The file logger supports a time prefix using a strftime() format specifier 2010-07-08 17:44:19 +02:00
Martin Willi 4cc9afe35f Print identity to a lease address on the same line for simpler greping 2010-07-08 17:44:19 +02:00
Martin Willi 6c4cd8fa15 Implemented missing bypass_socket() method in load-testers faked kernel interface 2010-07-07 10:01:32 +02:00
Martin Willi 4f99093235 Show mallinfo() data in statusall, if available 2010-07-06 16:28:25 +02:00
Martin Willi 380106ab0d Avoid relocking while enumerator is alive 2010-07-06 16:28:25 +02:00
Martin Willi a4c0da1669 Added support for group membership information containted in the RADIUS class attribute 2010-07-05 09:41:04 +02:00
Martin Willi 4172574bfb Use the group constraint in a more generic fashion, not only for attribute certificates 2010-07-05 09:41:04 +02:00
Martin Willi 53913d764e Use the responder side configured EAP-Identity directly, if given 2010-07-05 09:41:04 +02:00
Martin Willi ec6caa1367 Copy EAP specific attributes to auth config only 2010-07-05 09:41:04 +02:00
Martin Willi 02571374c4 Recreate IKE_SA_INIT related tasks only if they have completed 2010-06-30 13:48:47 +02:00
Martin Willi 6a4a47511f Show contents of the CP payload in message_t stringification 2010-06-24 15:46:28 +02:00