denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
15,759 Commits 1 Branch 0 Tags
a080cfece0c19cd73ce731b124d68a601b34867e
Commit Graph
12392 Commits
Author SHA1 Message Date
Andreas Steffen c3024a0848 fixed typo 2010-08-31 21:42:14 +02:00
Martin Willi 93709d1093 Do not process any more TLS handshake messages on fatal alerts 2010-08-31 18:10:24 +02:00
Martin Willi 33b1a2567f Load a left/rightcert2 for EAP-TLS even if no left/rightauth2 is defined 2010-08-31 18:10:23 +02:00
Martin Willi c811479986 Strictly check if the server certificate matches the TLS server identity 2010-08-31 18:10:23 +02:00
Martin Willi 36eafea232 Use the AAA Identity for EAP authentication, if given 2010-08-31 18:10:23 +02:00
Martin Willi 64d7b0733f Added support for the ipsec.conf aaa_identity keyword 2010-08-31 17:52:52 +02:00
Martin Willi 81137552e5 Added an AAA identity authentication config option 2010-08-31 17:26:20 +02:00
Martin Willi f9fc5f2045 Added strongswan.conf options for EAP-TLS/TTLS fragment size 2010-08-31 16:17:01 +02:00
Martin Willi 743f94067e Support processing of partial TLS record headers 2010-08-31 16:17:01 +02:00
Martin Willi 1cf8c5f746 Migrated EAP-TTLS to the generic TLS helper 2010-08-31 16:17:01 +02:00
Martin Willi be751012c3 Migrated EAP-TLS to the generic TLS helper 2010-08-31 16:17:01 +02:00
Martin Willi 877c910f04 Implemented a generic TLS EAP helper to implement EAP-TLS, TTLS and other variants 2010-08-31 16:16:58 +02:00
Martin Willi ecd98efa9d Support output fragmentation of TLS records 2010-08-31 15:54:37 +02:00
Martin Willi f13a03add0 Moved EAP type/code definitions to a seprate header file in libstrongswan 2010-08-31 15:35:29 +02:00
Martin Willi ce1af73907 Implemented buffering of partial records in TLS stack 2010-08-31 15:35:29 +02:00
Martin Willi d169aab35e Log TLS handshake subtypes as handshakes 2010-08-31 15:35:29 +02:00
Martin Willi 4332b5af89 Do not strdup() zero length strings in identification_create_from_string() 2010-08-31 15:34:45 +02:00
Tobias Brunner 9b698a771c Enable the generation of unencrypted messages (e.g. ME connectivity checks). 2010-08-30 17:25:12 +02:00
Andreas Steffen 6ade82d5b7 fixed copy-and-paste errors 2010-08-30 15:42:44 +02:00
Andreas Steffen d93e2e5409 created an eap-tnc method hull 2010-08-30 15:36:34 +02:00
Andreas Steffen 577893612f for the time being assume a single request/response exchange for a given EAP method 2010-08-30 15:36:34 +02:00
Tobias Brunner 2402dee177 Port floating patch partially reversed. 
If MOBIKE is enabled, we do have to switch to port 4500 with the
IKE_AUTH request, that is, before we know whether the other peer
actually supports MOBIKE or not.
 2010-08-30 14:54:31 +02:00
Tobias Brunner 277f02ce9e Slightly refactored port floating. 
In case of MOBIKE, only float to port 4500 if the other peer actually supports MOBIKE.
 2010-08-30 13:42:58 +02:00
Andreas Steffen be63a48c36 defined EAP-TNC 2010-08-30 13:13:39 +02:00
Martin Willi 2291754ddf Unwrap crlNumber INTEGER in openssl CRL parsing 2010-08-30 11:23:46 +02:00
Martin Willi 21f80e9dbc Added crl support to pki --print 2010-08-30 11:23:45 +02:00
Tobias Brunner 0433b4172b Typo in doxygen comment fixed. 2010-08-30 10:49:32 +02:00
Tobias Brunner fde2d34d0f Fixed ME after introduction of AEAD wrapper. 2010-08-30 10:48:09 +02:00
Martin Willi 45684ee65c Fixed pluto smartcard support after introducing encryption schemes 2010-08-30 10:14:45 +02:00
Andreas Steffen 897c7a72cf Win7 might send up to 7k of certificate requests 2010-08-27 16:30:05 +02:00
Tobias Brunner cb7a0cef48 Fixed documentation of XAUTH in ipsec.secrets. 2010-08-26 10:25:08 +02:00
Martin Willi 2bf0e74c38 Prefer AES/Camellia suites over 3DES/NULL encryption 2010-08-25 18:30:09 +02:00
Martin Willi a596006e3f Send TLS alerts for errors in TLS handshake building 2010-08-25 18:24:27 +02:00
Martin Willi ee88ddd6aa Refactored fragment building, use correct TLS content type for non-first fragments 2010-08-25 18:04:59 +02:00
Martin Willi dfde6570c7 Update delete_payload length when adding SPIs 2010-08-25 17:04:25 +02:00
Martin Willi 5299719569 Migrated delete_payload to INIT/METHOD macros, replaced iterator 2010-08-25 17:03:00 +02:00
Martin Willi e5c6ebb697 Use different return values in payload decryption to distinguish between integrity and syntax errors 2010-08-25 15:29:53 +02:00
Martin Willi 17102f7b58 Added a simple high level TLS wrapper for sockets 2010-08-25 12:52:53 +02:00
Martin Willi bd23b9086e Initialize output chunk before appending data to it 2010-08-25 12:43:21 +02:00
Martin Willi 3dd06bd4ed Added private key support to in-memory credential set 2010-08-25 10:28:23 +02:00
Martin Willi 72c6335de9 Added certificate support to in-memory credential set 2010-08-25 10:28:22 +02:00
Thomas Egerer e54e86cb49 Check if colliding rekey actually created an IKE_INIT 
In some cases (especially if a child is half-open) the colliding
rekey-job might not have created the ike_init member. If so, the
nonce check fails with SIGSEGV.
 2010-08-25 10:16:42 +02:00
Martin Willi 8427c78611 Added a ike_name logger option to prefix the IKE_SA name on each line 2010-08-25 09:55:37 +02:00
Andreas Steffen d9b85e28b9 removed tls_record_t definition 2010-08-24 19:19:13 +02:00
Martin Willi 69e8bb2e8d Pass NULL peer identity to omit TLS peer authentication, added eap-ttls.request_peer_auth option 2010-08-24 11:34:43 +02:00
Martin Willi a2c1235969 Skip the close notify if application layer completes successfully 2010-08-24 10:30:24 +02:00
Andreas Steffen 79a5e391f8 support fragmentation in AVPs 2010-08-24 09:02:51 +02:00
Andreas Steffen c1a929daa7 removed some redundant debug output 2010-08-24 09:02:51 +02:00
Martin Willi bda7d9d940 Added generic TLS purposes 2010-08-24 08:45:49 +02:00
Martin Willi f55f9c4e1e Client sends empty EAP-TTLS packet on fatal alerts to properly shut down TLS 2010-08-24 08:45:49 +02:00