Martin Willi
f53b74c96f
moved force_encap to ike_config, enables responder to enforce udp encapsulation
...
fixed bugs in force_encap code
2007-10-01 16:41:34 +00:00
Martin Willi
011fb1b97e
removed accidentally checked in debugging code
2007-10-01 12:25:26 +00:00
Martin Willi
9dae1bed00
implemented IKEv2 force_encap connection parameter
...
enforces UDP encapsulation by faking NAT detection payloads
to hurdle restrictive firewalls
2007-10-01 12:19:39 +00:00
Martin Willi
92232dab33
fixed stuid()/setgid() and error handling
2007-10-01 09:07:10 +00:00
Martin Willi
f215e91999
implemented more aggressive MOBIKE path probing
...
do not queue more than one MOBIKE task
2007-09-28 08:22:37 +00:00
Martin Willi
052d58feaf
fixed CHILD_SA SPI byte order in XML interface
2007-09-28 07:05:15 +00:00
Martin Willi
055d016b49
changed inheritable capability set to the permitted one to execute firewall script with CAP_NET_ADMIN
2007-09-28 07:04:09 +00:00
Martin Willi
85c6fc0283
reduced debbugging level
2007-09-27 13:09:50 +00:00
Martin Willi
983d7cd292
made add_ip()/del_ip() calls synchron (waiting until kernel event received)
...
this should fix MOBIKE route migration with virtual IPs
2007-09-27 12:48:00 +00:00
Tobias Brunner
278396b6da
typos
2007-09-27 10:36:03 +00:00
Martin Willi
c295d0eb4b
refactored strongswan manager
...
removed buggy request parsing code, use ClearSilvers CGI kit instead
fixed CHILD_SA listing in manager (needs better design)
using secure XML communication through unix sockets
removed images with questionable (non-GPL) license
2007-09-26 14:02:21 +00:00
Martin Willi
d9d69536b0
improved MOBIKE roaming between interfaces
2007-09-24 12:15:25 +00:00
Andreas Steffen
b4979ff724
removed some empty lines
2007-09-18 11:23:52 +00:00
Andreas Steffen
cb23c49143
return argument has type size_t
2007-09-18 11:21:55 +00:00
Martin Willi
8f561d4409
prototype implemementation of an sqlite configuration backend
2007-09-18 07:12:21 +00:00
Andreas Steffen
703b4b0332
connection name to IKE_SA initiating
2007-09-15 20:30:04 +00:00
Andreas Steffen
a2ab401c56
put IKE_SA and CHILD_SA names in single quotes
2007-09-15 16:06:58 +00:00
Andreas Steffen
be682af3e8
log name of IKE_SA in state changes
2007-09-15 15:54:51 +00:00
Andreas Steffen
3f4076b7c8
log name of established IKE_SA
2007-09-15 15:54:30 +00:00
Andreas Steffen
21b3099ac4
log name of established CHILD_SA
2007-09-15 15:53:10 +00:00
Andreas Steffen
cf9cec125a
adapted format of IKE SPIs to strongSwan Manager's style
2007-09-15 15:35:02 +00:00
Martin Willi
c01f7bf989
added subnets of CHILD_SAs to xml interface
...
a first design of Managers IKE_SA list page
2007-09-14 14:07:30 +00:00
Andreas Steffen
15a9d460c0
peer_cfg now knows about group memberships
2007-09-13 15:33:17 +00:00
Tobias Brunner
eff806eb5a
added missing 'break' in checkout_by_peer
2007-09-13 13:00:23 +00:00
Martin Willi
6baca3b2f1
fixed 64bit issue with file descriptor
2007-09-13 08:19:15 +00:00
Martin Willi
b8c7453a82
manager can query and list IKE_SA status (no layout yet)
2007-09-13 07:45:04 +00:00
Martin Willi
dd52993068
only switch to port 4500 if we are on 500: fixed reauthentication in NAT
...
scenarios
2007-09-12 11:11:10 +00:00
Andreas Steffen
794d2526b4
removed unused chunk variable
2007-09-12 07:54:56 +00:00
Martin Willi
a8827c9b63
moving virtual IP when interface changes due mobike
2007-09-12 07:36:45 +00:00
Martin Willi
12fa4387c6
fixed NAT detection with mobike
2007-09-12 07:14:05 +00:00
Martin Willi
39cc6d1ad7
fixed shutdown order to prevent crash when kernel interface schedules events
2007-09-12 07:12:25 +00:00
Andreas Steffen
1cb2cb622e
overwrite shared_key with random bytes before freeing it
2007-09-11 21:06:46 +00:00
Andreas Steffen
2f9f5149c4
check hash algorithms used in signatures
2007-09-11 20:10:38 +00:00
Andreas Steffen
c1ff717690
removed rsa_private_key clone() function
2007-09-11 16:26:08 +00:00
Andreas Steffen
f0c156fbc9
replaced get_rsa_private_key() by rsa_signature() in order restrict the distribution of private key material
2007-09-11 10:18:25 +00:00
Andreas Steffen
7bac086733
overwrite storage used for shared secrets with pseudo-random bytes before releasing it
2007-09-10 19:12:01 +00:00
Martin Willi
5474dc6500
implemented routeability checks for mobike (experimental)
2007-09-03 12:37:25 +00:00
Andreas Steffen
f5da63e937
correct debug
2007-09-02 15:59:59 +00:00
Martin Willi
9164e49ac0
added mobike=yes|no connection option
...
yes: include mobike support notifies as initiator
no: only enable mobike as responder when initiator supports it
default: yes
2007-08-29 12:11:25 +00:00
Andreas Steffen
0bc5a23023
renamed integrity check to integrity test
2007-08-29 10:36:08 +00:00
Andreas Steffen
ab13376877
fips_verify_hmac_signature() now returns a boolean status
2007-08-29 09:43:02 +00:00
Andreas Steffen
2fb15ac606
changed interface of fips_verify_hmac_signature
2007-08-29 05:43:45 +00:00
Andreas Steffen
55434a1ba5
started implementation of libstrongswan code integrity check
2007-08-29 00:37:10 +00:00
Martin Willi
98f97433af
rerouting CHILD_SA if its IKE_SA gets deleted
2007-08-27 09:10:12 +00:00
Andreas Steffen
929b9e367a
append new attribute certs at the end
2007-08-14 13:04:36 +00:00
Andreas Steffen
06faefe43d
adding attribute certficates to a chained list
2007-08-14 12:27:02 +00:00
Andreas Steffen
8f687a7591
has_rsa_private_key() must also be protected by keys_mutex
2007-08-10 12:10:36 +00:00
Andreas Steffen
c045d90a8e
corrected debug output
2007-08-10 11:23:45 +00:00
Andreas Steffen
8ff58b051c
ipsec stroke rereadaacerts|rereadacerts supported
2007-08-10 09:17:34 +00:00
Andreas Steffen
84db83336b
support of ipsec rereadsecrets for stroke
2007-08-10 07:16:32 +00:00
Martin Willi