 Tobias Brunner
|
07df944c9c
|
Add support to create IKE fragments
All fragments currently use the same fragment ID (1) as that's what
other implementations are doing.
|
2012-12-24 12:29:30 +01:00 |
|
|
Tobias Brunner
|
c4daac2c0b
|
Log added NAT-T vendor IDs
|
2012-12-24 12:29:27 +01:00 |
|
|
Tobias Brunner
|
667720c801
|
Detect a peer's support for IKE fragmentation
Fragments are accepted even if this vendor ID is not seen.
|
2012-12-24 12:29:27 +01:00 |
|
|
Tobias Brunner
|
fe26ddada9
|
Map fragmented initial initial Main or Aggressive Mode messages to the same IKE_SA
|
2012-12-24 12:29:27 +01:00 |
|
|
Tobias Brunner
|
b816037739
|
Allow ID_PROT/AGGRESSIVE messages for established IKE_SAs if they contain fragments
Other implementations send fragments always in an initial message type
even for transaction or quick mode exchanges.
|
2012-12-24 12:29:27 +01:00 |
|
|
Tobias Brunner
|
8fc8383439
|
Don't handle fragmented messages larger than charon.max_packet
|
2012-12-24 12:29:27 +01:00 |
|
|
Tobias Brunner
|
7d85f94165
|
Don't update an IKE_SA-entry's cached message ID when handling fragments
|
2012-12-24 12:29:26 +01:00 |
|
|
Tobias Brunner
|
30216000d3
|
Store inbound IKE fragments and reassemble the message when all fragments are received
|
2012-12-24 12:29:26 +01:00 |
|
|
Andreas Steffen
|
6be6a52405
|
deleted newly constructed attributes in send_assessment
|
2012-12-24 12:06:12 +01:00 |
|
|
Dmitry Korzhevin
|
a0117b9122
|
Added Russian and Ukrainian strings for Android client
|
2012-12-24 12:06:12 +01:00 |
|
|
Tobias Brunner
|
9b1659f52c
|
Add message rules to properly handle IKE fragments
These are sent in unencrypted messages and are the only payload
contained in such messages.
|
2012-12-24 10:24:48 +01:00 |
|
|
Tobias Brunner
|
ddfad8b67e
|
Reset the encrypted flag when handling IKE messages that contain a fragment
Racoon sets the encrypted bit for messages containing a fragment, but these
messages are not really encrypted (the fragmented message is though).
|
2012-12-24 10:24:48 +01:00 |
|
|
Tobias Brunner
|
8f0ab6dd36
|
Payload added to handle IKE fragments
|
2012-12-24 10:24:48 +01:00 |
|
|
Martin Willi
|
656e01eab3
|
Add parantheses to avoid compiler warning
|
2012-12-24 10:12:23 +01:00 |
|
|
Andreas Steffen
|
9787b9f2e0
|
Send empty CDATA batch if TNC client has no data to send
|
2012-12-23 22:16:30 +01:00 |
|
|
Tobias Brunner
|
ef33a4ab82
|
Fixed some typos, courtesy of codespell
|
2012-12-20 09:35:26 +01:00 |
|
|
Adrian-Ken Rueegsegger
|
ba8b28b67f
|
Raise an alert if IKE SA is kept
This alert is raised when the establishment of a child SA fails but the
IKE SA is kept.
|
2012-12-20 09:15:07 +01:00 |
|
|
Reto Buerki
|
a7409773e6
|
stroke: Drop unneeded [MY|OTHER]_NETBITS
|
2012-12-19 11:24:02 +01:00 |
|
|
Reto Buerki
|
31944a4366
|
stroke: Enable install_policy in add_connection()
|
2012-12-19 11:23:52 +01:00 |
|
|
Volker Rümelin
|
0ff8d20a89
|
Add support for draft-ietf-ipsec-nat-t-ike-03 and earlier
This adds support for early versions of the draft that eventually
resulted in RFC 3947.
|
2012-12-19 11:03:42 +01:00 |
|
|
Martin Willi
|
ecdd5aedac
|
NEWS about error-notify
|
2012-12-19 10:43:35 +01:00 |
|
|
Martin Willi
|
32c3ac95e4
|
Add missing error_notify_msg.h to distribution tarball
|
2012-12-19 10:40:33 +01:00 |
|
|
Martin Willi
|
3044085006
|
Add an error-notify sample application to listen to error notifications
|
2012-12-19 10:40:33 +01:00 |
|
|
Martin Willi
|
0aaf5ccfa6
|
Add an error-notify plugin to send catched alerts to listening applications
|
2012-12-19 10:40:33 +01:00 |
|
|
Martin Willi
|
578f72ceb0
|
Raise an alert if half-open timeout limit reached
|
2012-12-19 10:40:33 +01:00 |
|
|
Martin Willi
|
c57fe7ac6f
|
Raise an alert if an authorize() hook fails
|
2012-12-19 10:40:33 +01:00 |
|
|
Martin Willi
|
45d6134218
|
Raise an alert if allocating virtual IPs fails
|
2012-12-19 10:40:33 +01:00 |
|
|
Martin Willi
|
f285b9efc8
|
Raise an alert if kernel policy installation fails
|
2012-12-19 10:40:33 +01:00 |
|
|
Martin Willi
|
bcf3147e0a
|
Raise an alert if kernel SA installation fails
|
2012-12-19 10:40:33 +01:00 |
|
|
Martin Willi
|
24f30ec92f
|
Raise an alert on traffic selector mismatch
|
2012-12-19 10:40:32 +01:00 |
|
|
Martin Willi
|
c794455666
|
Raise alerts when enforcing IKE_SA unique policy
|
2012-12-19 10:40:32 +01:00 |
|
|
Martin Willi
|
5dd9c3087f
|
Raise an alert if CHILD_SA proposals mismatch
|
2012-12-19 10:40:32 +01:00 |
|
|
Martin Willi
|
bab949bb26
|
Raise an alert if IKE proposals mismatch
|
2012-12-19 10:40:32 +01:00 |
|
|
Martin Willi
|
3f7f5388a5
|
Raise an alert of generating local authentication data fails
|
2012-12-19 10:40:32 +01:00 |
|
|
Martin Willi
|
cc0cc3b54d
|
Add NEWS about BER capable OpenSSL PKCS#7 backend
|
2012-12-19 10:38:42 +01:00 |
|
|
Martin Willi
|
644be5d537
|
Free leaking scep attributes
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
429e6d5eee
|
Corrected error message if enveloped-data decryption fails
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
0a344da291
|
Fix up serialNumber in openssl PKCS#7 if it has a leading MSB set
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
71dd4e7895
|
Don't handle PKCS#7 containers with infinite length encodings in pkcs7 plugin
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
3c820cdc23
|
Implement PKCS#7 decryption using openssl
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
2a87944a33
|
Make available wrapped certificates while verifying PKCS#7 signatures in openssl
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
04884be3b5
|
Implement openssl PKCS#7 certficiate enumeration
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
e96d945dcd
|
Fix doxygen grouping regarding containers and PKCS#7
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
36f2e11c70
|
Enable pkcs7 plugin when building scepclient on Android
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
03ba8f9e8c
|
Move PKCS#9 attribute lists to pkcs7 plugin, as we currently use it there only
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
804ba5bb50
|
Implement get_attribute() in openssl PKCS#7 backend
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
063ae4e52a
|
Allocate data returned by pkcs7_t.get_attribute()
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
c61723c69f
|
Implement OpenSSL PKCS#7 signed-data parsing and verification
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
568ad938d1
|
Add a stub for OpenSSL PKCS#7 parsing
|
2012-12-19 10:32:08 +01:00 |
|
|
Martin Willi
|
1865fb929a
|
Remove unused monolithic PKCS#7 code
|
2012-12-19 10:32:08 +01:00 |
|