denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12,011 Commits 1 Branch 0 Tags
71c9565a3a4935f6da55fcf74fd8ec8aafdd3df5
Commit Graph
12011 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 71c9565a3a pki: Replace BUILD_FROM_FD with passing a chunk via BUILD_BLOB 
This allows more than one builder to try parsing the data read from STDIN.
 2013-10-23 17:20:39 +02:00
Tobias Brunner 46cded2627 chunk: Add helper function to create a chunk from data read from a file descriptor 2013-10-23 17:20:39 +02:00
Martin Willi b08292a520 semaphore: Support cancellation in wait functions of semaphore fallback 
Semaphore wait functions should be a thread cancellation point, but did
not properly release the mutex in the fallback implementation.
 2013-10-23 16:08:40 +02:00
Martin Willi 47c76c1b05 rwlock: Re-acquire rwlock even if condvar wait times out 
A caller expects that the associated rwlock is held, whether the condvar
gets signaled or the wait times out.
 2013-10-23 11:52:26 +02:00
Andreas Steffen b891c22aa9 Updated and split data.sql 2013-10-23 00:26:02 +02:00
Andreas Steffen 252c04d3f9 Adapted recipe and patches to freeradius-2.2.1 2013-10-22 10:09:24 +02:00
Andreas Steffen 50d7a55c96 Support Ubuntu 13.10 measurements 2013-10-21 21:33:30 +02:00
Andreas Steffen 27bf5c06dc check it specified IF-TNCCS protocol is enabled 2013-10-21 21:03:53 +02:00
Tobias Brunner 8e8e97d10d kernel-netlink: Check existence of linux/fib_rules.h, don't include it in distribution 
This reverts commit b0761f1f0a.
 2013-10-18 09:52:54 +02:00
Tobias Brunner 3ea7165a27 Merge branch 'icmp' 
Improves handling of ICMP[v6] traffic selectors that specify message type and
code.

Fixes #421.
 2013-10-17 16:59:07 +02:00
Tobias Brunner 6956061197 ipsec.conf.5: Note about ICMP[v6] message type/code added 2013-10-17 16:57:39 +02:00
Tobias Brunner 4c185d11ad updown: Properly configure ICMP[v6] message type and code in firewall rules 2013-10-17 16:57:39 +02:00
Tobias Brunner 9739a0bf67 updown: Pass ICMP[v6] message type and code to updown script 
The type is passed in $PLUTO_MY_PORT and the code in $PLUTO_PEER_PORT.
 2013-10-17 16:57:39 +02:00
Tobias Brunner 59213396fa kernel-pfkey: Install ICMP[v6] type/code as expected by the Linux kernel 2013-10-17 16:57:39 +02:00
Tobias Brunner 406a504ca7 kernel-netlink: Convert ports in acquires to ICMP[v6] type and code 2013-10-17 16:57:39 +02:00
Tobias Brunner ddc2d3c8e4 kernel-netlink: Properly install policies with ICMP[v6] types and codes 2013-10-17 16:57:39 +02:00
Tobias Brunner 000235f1c5 traffic-selector: Print ICMP[v6] message type and code in a more readable way 2013-10-17 16:57:39 +02:00
Tobias Brunner 4bebe45abb traffic-selector: Store ICMP[v6] message type and code properly 
We now store them as defined in RFC 4301, section 4.4.1.1.
 2013-10-17 16:57:39 +02:00
Tobias Brunner d6a1960d34 traffic-selector: Move class to its own Doxygen group 2013-10-17 16:57:38 +02:00
Tobias Brunner 5eb802ab18 Merge branch 'ecc-brainpool' 
Adds support for ECC Brainpool curves for DH exchanges.
 2013-10-17 16:56:31 +02:00
Tobias Brunner 7313499914 proposal: Add ECC Brainpool DH groups to the default proposal 2013-10-17 13:36:09 +02:00
Tobias Brunner 606aae3aa1 openssl: Add workaround if ECC Brainpool curves are not defined 2013-10-17 13:36:08 +02:00
Tobias Brunner 3c29d2822f openssl: Add support for ECC Brainpool curves for DH, if defined by OpenSSL 
OpenSSL does not include them in releases before 1.0.2.
 2013-10-17 13:36:08 +02:00
Andreas Steffen cca372465d ecc: Added ECC Brainpool ECDH groups as registered with IANA 2013-10-17 11:57:04 +02:00
Tobias Brunner be97277bdb unit-tests: Make test for bio_writer_t more portable 2013-10-17 11:44:03 +02:00
Tobias Brunner f6cadb7f54 libipsec: Don't print ciphertext with ICV in log message 2013-10-17 11:43:58 +02:00
Tobias Brunner f5c5fd6f74 libipsec: Properly calculate padding length especially for AES-GCM 2013-10-17 11:42:45 +02:00
Tobias Brunner 812ae898bf utils: Add utility function to calculate padding length 2013-10-17 10:25:34 +02:00
Tobias Brunner 32fef0c6e9 stroke: Reuse reqids of established CHILD_SAs when routing connections 2013-10-17 10:23:32 +02:00
Tobias Brunner 6278e64230 trap-manager: Make sure a config is not trapped twice 2013-10-17 10:23:32 +02:00
Tobias Brunner dd438ee22c Doxygen fixes 2013-10-15 11:25:55 +02:00
Andreas Steffen a37ab690cc Set recommendation in the case of PCR measurement failures 2013-10-13 22:17:18 +02:00
Andreas Steffen b0761f1f0a Add linux/fip_rules.h to include files 2013-10-13 20:51:10 +02:00
Andreas Steffen 6623dfa84d Revert refactoring which broke CentOS build 2013-10-13 19:56:04 +02:00
Andreas Steffen 1ca57d497f Increase debug level in libipsec/rw-suite-b scenario 2013-10-11 21:34:59 +02:00
Andreas Steffen 1486fe786a Use bold font to display key size 2013-10-11 21:23:10 +02:00
Andreas Steffen fcf355036f Added swid_directory option 2013-10-11 20:59:24 +02:00
Andreas Steffen 3bd4536185 Added tnc/tnccs-11-supplicant scenario 2013-10-11 20:18:59 +02:00
Andreas Steffen cae778147a Define aaa.strongswan.org in /etc/hosts 2013-10-11 20:16:59 +02:00
Tobias Brunner d14ba7e7fd testing: Add libipsec/host2host-cert scenario 2013-10-11 18:04:48 +02:00
Tobias Brunner d9020264f4 checksum: The pool utility was moved to its own directory 2013-10-11 17:42:29 +02:00
Tobias Brunner 0f6f7ba22c ccm: Add missing comma in get_iv_gen method signature 2013-10-11 17:42:25 +02:00
Tobias Brunner bfeb8b5c47 iv-gen: Add missing header files to Makefile.am 2013-10-11 17:42:05 +02:00
Tobias Brunner 1c1ba803ac NEWS: Updates for the recent merges 2013-10-11 16:20:41 +02:00
Tobias Brunner 5ef630189a Merge branch 'iv-gen' 
Modularizes the generation of initialization vectors, which allows to use
different methods depending on the algorithms.  For instance for AES-GCM
sequential IVs are now used instead of the earlier random IVs, which are
still used for other algorithms e.g. AES-CBC.
 2013-10-11 15:55:49 +02:00
Tobias Brunner 0c6f6c4e34 iv_gen: Mask sequential IVs with a random salt 
This makes it harder to attack a HA setup, even if the sequence numbers were
not fully in sync.
 2013-10-11 15:55:40 +02:00
Tobias Brunner e8229ad558 iv_gen: Provide external sequence number (IKE, ESP) 
This prevents duplicate sequential IVs in case of a HA failover.
 2013-10-11 15:55:40 +02:00
Tobias Brunner d74c254dfd ipsec: Use IV generator to encrypt ESP messages 2013-10-11 15:55:40 +02:00
Tobias Brunner b5010707a0 ikev2: Use IV generator to encrypt encrypted payload 2013-10-11 15:55:40 +02:00
Tobias Brunner 50bd28d549 iv_gen: aead_t implementations provide an IV generator 2013-10-11 15:55:40 +02:00