denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
3,065 Commits 1 Branch 0 Tags
a066f7e6c260bc46eb9b54ca5333121766d8c438
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi e301a69d6c removed 0-byte truncation, fixes random Openssl RSA signature verification failures 2008-10-31 17:07:04 +00:00
Martin Willi a13862be61 fixed crash in openssl signature verification if sizeof(size_t) != sizeof(int) (64bit) 2008-10-31 17:05:40 +00:00
Martin Willi 19aff61b19 reverted changeset 4529: 
Camellia is 22 in IKEv1, but not-yet defined in IKEv2
	in IKEv2, 22 is reserved for AES-XTS
 2008-10-30 13:21:21 +00:00
Martin Willi 5dffdea1d7 added hooks for IKE and CHILD keymat 2008-10-30 12:58:54 +00:00
Martin Willi 5a76bb7f7a store plain skd, not the prf 2008-10-30 09:18:52 +00:00
Martin Willi 80853d8498 moved CHILD_SA key derivation to keymat_t 
passing key chunks to CHILD_SA, not the PRF
 2008-10-29 16:06:16 +00:00
Martin Willi f65ba4e978 prf handles zero-length allocations graceful 2008-10-29 14:12:54 +00:00
Martin Willi a64cc8f75f do not store DH redundant in keymat 2008-10-29 13:35:06 +00:00
Martin Willi 6faa0c3392 replaced not-maintained ChangeLog 2008-10-29 09:27:51 +00:00
Martin Willi 6a4ff35cc4 moved key derivation and management into keymat object 
allows secured implementation of key management (e.g. in kernel or HW)
	only IKE keys for now
 2008-10-28 16:07:06 +00:00
Martin Willi 3c8234d408 store IKE proposal implicitly during derive_keys 2008-10-28 10:12:21 +00:00
Martin Willi 20fb671904 fixed reauthentication time in statusall 2008-10-28 09:41:33 +00:00
Martin Willi 85ac2fa547 use more generic stats getter, introducing new stats 2008-10-27 14:51:00 +00:00
Martin Willi ddc5b90db2 new release of NM debs 2008-10-27 12:01:23 +00:00
Martin Willi 0935ba328b including a "none" tundev to make NM happy 2008-10-27 11:30:27 +00:00
Martin Willi a1db79b31a fixed some compiler warnings 2008-10-27 11:13:33 +00:00
Martin Willi 82d20c0588 additional getters for ipcomp and UDP encap 2008-10-24 09:51:48 +00:00
Martin Willi 6e10aeadab more CHILD_SA refactorings 2008-10-24 08:02:35 +00:00
Martin Willi f2a5aa4a9d initiate connections simultaneously in load tester 2008-10-22 09:01:36 +00:00
Martin Willi 0fd6e95562 a load testing plugin, to: 
find multi-threading issues
	do performance profiling
 2008-10-21 13:00:38 +00:00
Martin Willi 6df2837a8c fixed enumeration of CHILD_SA traffic selectors 2008-10-21 10:57:40 +00:00
Martin Willi f2e1ff59ab reset threads IKE_SA after checking other IKE_SAs 
invoke updown script only if we have valid IKE_SA
 2008-10-20 11:38:16 +00:00
Martin Willi 104c28d603 fixed perl oid generation 2008-10-16 15:38:48 +00:00
Martin Willi 6f3ea4a516 loading updown plugin if required 2008-10-16 12:48:27 +00:00
Martin Willi ad3af574a4 moved updown script invocation to an optional plugin 2008-10-16 11:48:18 +00:00
Martin Willi e17353fc31 bus uses finally recusive locking 
other small fixes
 2008-10-16 11:32:43 +00:00
Martin Willi f868dc0ca2 condvar->wait() can handle recursive mutex 2008-10-16 11:29:42 +00:00
Martin Willi 229ee197a3 added missing EAP-AKA RFC 2008-10-16 07:21:30 +00:00
Martin Willi 61508be2f5 added a guest.mconsole() method to script mconsole (e.g. add additional conX=) 2008-10-15 14:47:52 +00:00
Martin Willi 1df106bf39 cache keys for in and outbound ESP SAs 
removed redundant storing of traffic selectors in CHILD_SA (sa_policy_t)
creating TS pairs dynamically using create_policy_enumerator()
 2008-10-15 12:24:44 +00:00
Martin Willi 0b9728986a reverted changeset [4440], [4443] uses old algorithm name again 2008-10-15 08:50:14 +00:00
Martin Willi 9f4e5f8c47 store ESP keys in CHILD_SA 2008-10-15 08:37:56 +00:00
Martin Willi e517b4b174 passing chunks, not prf+, to kernel interface 
gives us better control of keymat in CHILD_SA
 2008-10-14 15:17:44 +00:00
Martin Willi a985db3ff3 reintegrated bus-refactoring branch 2008-10-14 08:52:13 +00:00
Martin Willi 405e8ecfe3 set guest-specific kernel parameters 
removed memory setting, use mem= instead
 2008-10-10 11:20:04 +00:00
Martin Willi 79a878466c reintegrated two-sim branch providing SIM card plugin API 2008-10-10 08:36:01 +00:00
Martin Willi c5ebb635a1 trimming additial / in some cases 2008-10-10 07:33:37 +00:00
Martin Willi 88f65cd589 use busybox compatible kill 2008-10-10 06:59:03 +00:00
Martin Willi f0974eb2c2 fixed MOBIKE roaming if clients address changes 2008-10-09 08:25:11 +00:00
Martin Willi bb2059c60a added proposal parsing of uncommon DH groups 3072/6144 2008-10-08 12:57:11 +00:00
Martin Willi 4f0241e6cf some mobike improvement NEWS 2008-10-08 12:24:08 +00:00
Martin Willi 85be7e5b75 ignore routing events for our own routes 2008-10-08 08:29:49 +00:00
Martin Willi ce5b17082d mobike: try to keep existing source address before switching to another 2008-10-08 08:23:46 +00:00
Martin Willi c8ba5125d6 guest bootup waits for init, not for network stack (fixes 2.6.27 guest kernels) 2008-10-07 16:31:41 +00:00
Martin Willi 693a244d0f ported mconsole-exec patch to 2.6.27-rc7 2008-10-07 09:09:34 +00:00
Martin Willi aa9a300677 userland support to process notifies for new NAT mappings detected in UDP encapsulation 2008-10-07 07:55:28 +00:00
Martin Willi 9d9a772ee1 use MOBIKE enabled DPD if we are NATed 
update SAs if we detect changes in NAT mappings
 2008-10-06 13:37:04 +00:00
Martin Willi 0592212f23 fixed builder_cancel macro to return NULL on failed build 2008-10-06 13:08:49 +00:00
Martin Willi aa1b90a5b2 do not run CHILD_SA delete action if rekeying 2008-10-03 16:01:14 +00:00
Martin Willi 9c0aa46b64 use dpd_action also for remotely closed tunnels 2008-10-02 13:47:19 +00:00
Martin Willi 7827997346 also respect the mobike=no setting as responder 2008-09-30 12:36:58 +00:00
Martin Willi ceff3064fe using signed return value for read() 2008-09-30 06:27:50 +00:00
Martin Willi cdaf57ec34 fixed DH value range testing 2008-09-17 09:02:30 +00:00
Martin Willi 73f6886a50 checking mpz_export return value properly 
fixes a potential DoS attack if a DH value of zero gets processed
 2008-09-17 08:10:48 +00:00
Martin Willi bb34d2611f updated ubuntu packages for release compatible with NM svn20080908 2008-09-12 13:48:11 +00:00
Martin Willi f061d83358 ported NM plugin to upstream NetworkManager changes 
splitted secrets (4031)
	using uuid in auth-dialog (4053)
 2008-09-12 13:28:31 +00:00
Martin Willi 346bb576a2 allow multiple DELETE payloads in an informational message 2008-09-11 11:14:09 +00:00
Martin Willi b1f4785428 updated NEWS 2008-09-05 15:10:56 +00:00
Martin Willi 07447ea597 fixed ubuntu distribution/typos 2008-09-05 14:44:21 +00:00
Martin Willi f494dbd494 new ubuntu package release 2008-09-05 14:01:47 +00:00
Martin Willi 1d03954aad NM plugin supports (encrypted) private key files 2008-09-05 13:26:58 +00:00
Martin Willi e376d75f96 some NEWS 2008-09-04 14:52:33 +00:00
Martin Willi 0c6a489046 fixed some translations/encoding 2008-09-04 13:51:35 +00:00
Martin Willi f0e8a8f7f3 an initial German translation for NM plugin 2008-09-04 13:39:37 +00:00
Martin Willi 3876c44175 updated debian build to extended nm plugin 2008-09-04 11:55:31 +00:00
Martin Willi 82840e6c92 reduced nm verbosity 2008-09-04 10:35:20 +00:00
Martin Willi aff26a62c3 implemented NetworkManager certificate/private key authentication using ssh-agent 2008-09-04 08:40:37 +00:00
Martin Willi 994ed35312 added a configure option to select charon binary 2008-09-04 08:37:31 +00:00
Martin Willi 6af6f88a79 agent plugin optionally accepts a BUILD_PUBLIC_KEY to select a specific private key from the agent 2008-09-04 08:35:11 +00:00
Martin Willi 703791715b handle INFORMATIONAL exchanges with NATD payloads in mobike task 2008-09-02 14:02:40 +00:00
Martin Willi 21c9546321 libstrongswan agent plugin to use ssh-agent for RSA signatures 2008-09-02 11:04:26 +00:00
Martin Willi 46eb41644d ported openac to credential factory changes 2008-09-02 11:01:05 +00:00
Martin Willi f7c17aa15c refactored credential builder 
allow enumeration of matching builders
	try a second builder if the first one fails
	builder clones resources internally on demand
	caller frees added resources on failure and success
	stricter handling of non-supported build parts
 2008-09-02 11:00:13 +00:00
Martin Willi eb3e27059b use libcap for capability dropping 
optional, must be enabled --with-capabilities=libcap
	will be extended to support --with-capabilities=libcap2
 2008-08-29 09:24:14 +00:00
Martin Willi e609b1cda2 capability API to allow plugin-controlled capability set 2008-08-28 16:27:48 +00:00
Martin Willi dc98e50153 cosmetics 2008-08-28 11:15:01 +00:00
Martin Willi e577ad3985 creating default IKE proposals dynamically using algorithm enumeration API 2008-08-28 11:07:57 +00:00
Martin Willi f1b014b9a3 separated sha1_prf implementation from sha1_hasher 2008-08-28 10:57:24 +00:00
Martin Willi 9482208633 crypto_factory algorithm enumeration API 
implementation of "ipsec listalgs"
 2008-08-28 09:24:42 +00:00
Martin Willi 018ae7c1aa build scripts for ubuntu NetworkManager packages 2008-08-27 13:51:05 +00:00
Martin Willi ee210ca353 check user account validity after PAM authentication 2008-08-27 13:48:54 +00:00
Martin Willi 609166f49f additional NEWS for 4.2.6 2008-08-27 08:39:09 +00:00
Martin Willi 281dd55891 using strongSwan, not NetworkManager version number 2008-08-26 14:27:53 +00:00
Martin Willi be49236373 fixing charon path for now for ubuntu package 2008-08-26 14:27:12 +00:00
Martin Willi f6ecd44fc6 added NM gnome plugin to distribution 2008-08-25 08:21:51 +00:00
Martin Willi c1ee908e4c removed generated Makefile.in.in from svn 2008-08-25 08:15:57 +00:00
Martin Willi a88aae3df6 enforce DN of configured gateway certificate 2008-08-25 07:50:21 +00:00
Martin Willi 7945c90adb new EAP-Identity handling uses ID_EAP in plugins 2008-08-25 07:49:48 +00:00
Martin Willi 1a109c9fc6 disabled PSK option until we have a way to enforce strong secrets 2008-08-25 07:48:11 +00:00
Martin Willi 1995f79f10 use username part of RFC822 IDs for PAM authentication 2008-08-25 07:47:16 +00:00
Martin Willi 822901061b ported parts of two-sim branch 
eap_identity parameter to exchange in eap_identity
	some auth_info/peer_cfg refactorings
	fixed some bugs, introduced new ones
 2008-08-22 10:44:51 +00:00
Martin Willi 7c112a12c0 run guests with some niceness 2008-08-22 08:37:15 +00:00
Martin Willi 5ba7efb083 pool names are unique 2008-08-22 07:38:59 +00:00
Martin Willi 3e45b3a1ad do not return IPv6 src addresses for IPv4 destinations 2008-08-21 15:17:45 +00:00
Martin Willi b848f0377c fixed EAP-GTC secret lookup 
improved error logging
PAM authentication needs CAP_AUDIT_WRITE capability
 2008-08-21 14:40:03 +00:00
Martin Willi 1caa265c61 a (incomplete) implementation of draft-sheffer-ikev2-gtc-00.txt using PAM 2008-08-21 12:10:07 +00:00
Martin Willi 2d6559b107 added sqlite busy handler: retries on locking conflicts 2008-08-21 09:25:06 +00:00
Martin Willi 02e907fe66 avoid too many alloca()s in netlink send, problematic on MIPS 2008-08-21 07:55:16 +00:00
Martin Willi bdbf3c49fc some string fixes 2008-08-20 13:59:37 +00:00
Martin Willi 6368a58ffc added missing tooltip 2008-08-20 12:02:53 +00:00