denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
4,523 Commits 1 Branch 0 Tags
c5ec0f48e748f94c6074309f8d87155426bf6db4
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Martin Willi c5ec0f48e7 Initial support for fast reauthentication in EAP-SIM 2009-11-12 10:34:00 +01:00
Martin Willi 454b59c5fd EAP-SIM/AKA crypto helper supports key derivation for fast reauthentication 2009-11-12 10:34:00 +01:00
Martin Willi e1a8729de0 Fallback to permanent identity request if pseudonym mapping failed 2009-11-12 10:34:00 +01:00
Martin Willi c2f8c6a11e Query triplet/quintuplet functions with permanent identity only, 
extended sim_provider with a is_pseudonym() function.
 2009-11-12 10:34:00 +01:00
Martin Willi 2d112ca310 eap-sim-file plugin can store pseudonym information volatile in memory 2009-11-12 10:34:00 +01:00
Martin Willi 8aad8f6faf Some coding style cleanups 2009-11-12 10:34:00 +01:00
Martin Willi 0328fe940d Impemented basic pseudonym support in EAP-SIM 2009-11-12 10:34:00 +01:00
Martin Willi f81760dcd1 A SIM/AKA message can be parsed twice, without and with decryption 2009-11-12 10:34:00 +01:00
Martin Willi 0e20893d81 Pass SIM/AKA crypto helper to constructor of message 2009-11-12 10:34:00 +01:00
Martin Willi 13f418b442 Added a doxygen group for libsimaka, some cleanups 2009-11-12 10:34:00 +01:00
Martin Willi bcf8a0ff94 Added missing hasher include 2009-11-12 10:33:59 +01:00
Martin Willi 4735965fc0 EAP servers check if the received EAP message was expected 2009-11-12 10:33:59 +01:00
Martin Willi 02f785b050 Use existing triplet length definitions 2009-11-12 10:33:59 +01:00
Martin Willi aea334ec1c Splitted EAP-AKA in peer and server implementations, use libsimaka helper library 2009-11-12 10:33:59 +01:00
Martin Willi 6d90881573 Proper handling of non-skippable attributes and client error codes in EAP-SIM 2009-11-12 10:33:59 +01:00
Martin Willi fad4e5f393 Centralized SIM/AKA notifications and client errors 2009-11-12 10:33:59 +01:00
Martin Willi e9c03f5243 Use the EAP-SIM/AKA crypto helper in EAP-SIM 2009-11-12 10:33:59 +01:00
Martin Willi 55916dcc9e libsimaka provides cryptographic functionality used in EAP-SIM and EAP-AKA 2009-11-12 10:33:58 +01:00
Martin Willi ac4dd5439b Migrated EAP-SIM to libsimaka, separated server/peer implementations 2009-11-12 10:33:58 +01:00
Martin Willi f8330d0395 Added a libsimaka library with shared message handling code for EAP-SIM/AKA 2009-11-12 10:33:58 +01:00
Martin Willi 44e8eea17a sim_provider_t API gained support for pseudonym/fast reauthentication 2009-11-12 10:33:58 +01:00
Martin Willi 8f364b5433 sim_card_t API gained support for pseudonym/fast reauthentication 2009-11-12 10:33:58 +01:00
Martin Willi 5269150ebc If cross-compiling, test for the existence of pthread_condattr_setclock only 2009-11-09 15:07:01 +01:00
Martin Willi 67c3875c02 Install bypass policies after creating XFRM netlink socket, loading xfrm_user module 2009-11-09 15:07:00 +01:00
Martin Willi 4a38687ae7 Use XFRM instead of PF_KEY IKE bypass policies in netlink based kernel interface 2009-10-30 11:19:32 +01:00
Martin Willi 140816b055 Query secrets in EAP-MD5 with me/other identities, fixing lookup in NetworkManager 2009-10-26 08:47:40 +01:00
Martin Willi 3dc40325d5 Show the number of times a lock was acquired in lock profiler 2009-10-23 08:12:17 +02:00
Martin Willi c5f36782ca Hand out shared secret of load tester for all identities 2009-10-22 16:44:07 +02:00
Martin Willi 4952dc11da Fixed all doxygen warnings 2009-10-22 14:34:10 +02:00
Martin Willi 80252c8a46 Store return value of getc() in an int to correctly test it against EOF 2009-10-22 13:13:06 +02:00
Martin Willi 0d73fe88b2 Load-testers PSK is used for all purposes, including EAP authentication 2009-10-20 15:54:13 +02:00
Martin Willi 1eab115a8b Do not null-terminate url in hash-and-url payloads 2009-10-16 09:21:28 +02:00
Martin Willi b42bfc79d9 Added NEWS about streamlined plugin names 2009-10-15 11:12:13 +02:00
Martin Willi f48ceeb1d1 Renamed plugin configuration sections to the actual plugin name 2009-10-15 10:36:17 +02:00
Martin Willi c4d53fe06b Streamlined EAP plugins to use a dash between eap-method, as used in all other places 2009-10-15 10:36:17 +02:00
Martin Willi b76b867c70 Renamed --enable-load-tests to --enable-load-tester, like the plugin itself 2009-10-15 10:36:17 +02:00
Martin Willi 406f335938 Updated configuration directive of resolve plugin, renamed from resolv_conf 2009-10-15 10:14:10 +02:00
Martin Willi d38eb3355e Migrated the lease_history option to the new libstrongswan plugin namespace 2009-10-15 10:14:10 +02:00
Martin Willi bb56e3f962 Improved debugging log in SIM triplet lookup 2009-10-14 09:55:14 +02:00
Martin Willi a2b50c5d60 Fixed assignment of get_triplet() dummy implementation 2009-10-13 11:05:01 +02:00
Martin Willi 073e7dc062 Merged SIM/USIM manager/card/provider, avoids code duplication 2009-10-12 14:40:21 +02:00
Martin Willi f7897b64f6 Added ${shlibs:Depends} dependency to Debian package 2009-10-12 14:06:51 +02:00
Martin Willi 3690d31a2a Added .gitignore for NM Debian package build 2009-10-12 14:06:51 +02:00
Martin Willi 68d23d2401 Pass NULL as other identity in EAP-AKA 3GPP2 to find a match with all plugins 2009-10-12 09:51:46 +02:00
Martin Willi 9b2942f68d Stroke plugin interprets NULL identities as ID_ANY in shared key lookup 2009-10-12 09:51:45 +02:00
Martin Willi 55b045abb5 Added NEWS about EAP-AKA split 2009-10-09 13:31:19 +02:00
Martin Willi 5d5e2853b6 SIM card interface takes IMSI as parameter (same as in USIM) 2009-10-09 13:02:20 +02:00
Martin Willi 31f5280cee Fixed USIM parameter description 2009-10-09 13:02:20 +02:00
Martin Willi 424ddf801c Do not use monotonic time for AKA sequence numbers, it has an undefined starting point 2009-10-09 13:02:20 +02:00
Martin Willi 655728621b Use constants instead of sizeof(), sizeof() does not work for function arguments 2009-10-09 13:02:20 +02:00
Martin Willi aba93dcc32 Calculate missing CK/IK values in USIM 2009-10-09 13:02:20 +02:00
Martin Willi aca7ba0ffc Link 3gpp2 EAP-AKA plugin to libgmp 2009-10-09 13:02:20 +02:00
Martin Willi 53a16b72ab Separated 3gpp2 USIM card and provider functionality 2009-10-09 13:02:20 +02:00
Martin Willi 0030880c6b Ported AKA functions to 3gpp2 plugin 2009-10-09 13:02:19 +02:00
Martin Willi 4720815774 Added a stub for the EAP-AKA backend implementing the 3GPP2 functions in software 2009-10-09 13:02:19 +02:00
Martin Willi 36a3bccfcf Implemented a manager for USIM cards/providers very similar to the SIM manager 2009-10-09 13:02:19 +02:00
Martin Willi a4eb37eed0 Added medsrv.fcgi to gitignore 2009-10-08 13:10:02 +02:00
Martin Willi 4b1cd5a367 Reenabled acq_expires SA timer using rekey timeout 
While not using a SA expiration for allocating SPIs works fine,
the situation is much more problematic for kernel-created temporary
SAs from acquires. If the negotiation of such a CHILD_SA fails,
the created temporary SA can not be deleted.
 2009-10-07 13:09:59 +02:00
Martin Willi 991f7ccd6c Catch CHILD_SA state changes during acquire 
If an acquire fails due to a TS_UNACCEPTABLE or other CHILD_SA only errors,
we have to reset the pending state in the trap manager.
 2009-10-07 13:09:59 +02:00
Martin Willi 6eacaffc72 Cleaned up EAP-AKA en/decoding, eliminated unaligned half-word reads 2009-10-05 14:06:32 +02:00
Martin Willi 3b836fc759 Cleaned up EAP-SIM en/decoding, eliminated unaligned half-word reads 2009-10-05 13:32:41 +02:00
Martin Willi 587ebae722 Distinguish invalid free()s between corrupted magic and invalid pointer 2009-10-05 11:02:54 +02:00
Martin Willi f12d8cf719 Do not increase the invalid-KE/Cookie retry counter for additional keyingtry attempts 2009-09-24 14:49:41 +02:00
Martin Willi cf76c42903 Do not create a replacement IKE_SA if we have CHILD_SAs to route only 2009-09-24 14:49:41 +02:00
Martin Willi 17859fe6cf Right-align short options in pki usage 2009-09-24 11:28:53 +02:00
Martin Willi 840743479a Use mysql_config to query MySQL LIBS and CFLAGS 2009-09-23 12:45:03 +02:00
Martin Willi 0406ed7a16 Fixed a crash in source address lookup 2009-09-23 11:18:30 +02:00
Martin Willi a7f79ee9c1 Define ME for all charon plugins 2009-09-23 11:13:27 +02:00
Martin Willi e20b792108 Correctly handle --enable-mediation option 2009-09-23 10:50:00 +02:00
Martin Willi b262680175 Emit a ALERT_SHUTDOWN_SIGNAL before shutting down the daemon 2009-09-22 17:00:00 +02:00
Martin Willi f1092e20f4 Fixed encoding of hash-and-url cert payload 2009-09-22 10:07:04 +02:00
Martin Willi cb64b21217 Do not assign SIM version to a volatile buffer on stack 2009-09-22 09:11:35 +02:00
Martin Willi 91cb348cc2 CA certificates are looked up using the subjectPublicKeyInfo keyid 2009-09-21 18:13:25 +02:00
Martin Willi c84b139a87 Credential backends use has_fingerprint() methods to select keys/certificates 2009-09-21 17:03:00 +02:00
Martin Willi 640ed4d5a5 Public/Private keys implement a has_fingerprint() method 2009-09-21 16:47:25 +02:00
Martin Willi fde7f5abf8 Correctly serve certificates if CERT_ANY requested 2009-09-21 15:34:29 +02:00
Martin Willi c6a8990bc5 Enforce a local address of the same family as remote address 2009-09-21 15:30:40 +02:00
Martin Willi c331bce51d Return certificates of requested kind only 2009-09-21 14:43:57 +02:00
Martin Willi c7a64d6f41 Use helper functions to handle (non-)skippable attributes 2009-09-18 15:08:43 +02:00
Martin Willi e466139c91 Clients can handle AKA-Identity requests by sending the full identity 2009-09-18 14:51:35 +02:00
Martin Willi 85af7a89c6 nm uses the distributions trusted root CAs if none is explicitly specified 2009-09-18 14:34:27 +02:00
Martin Willi 7aa495d9d0 get_private() in listcacerts requires a valid auth cfg 2009-09-17 12:47:03 +02:00
Martin Willi 4a03e85b37 Fixed nexthop lookup, used by source route installation 2009-09-16 13:55:32 +02:00
Martin Willi 36b7ba5ee3 Use continue to advance to next iteration 2009-09-16 13:32:47 +02:00
Martin Willi 075448fbc8 Complain about missing %defaultroute support only if one is actually used 2009-09-16 13:27:49 +02:00
Martin Willi b538b606da Use the default debug hook if possible 2009-09-16 13:16:00 +02:00
Martin Willi 5289249449 Default logger implementation can be modified by dbg_default_set_level/stream 2009-09-16 13:06:16 +02:00
Martin Willi a474081f1f Removed obsolete per-command debug level option 2009-09-16 12:52:56 +02:00
Martin Willi 4e1cade52f Fixed loading of DER encoded certificate files 2009-09-16 11:24:35 +02:00
Martin Willi 88fdf88a1f Disable rtnetlink defaultroute lookup if pluto is disabled 
As we do not support Pluto on BSD/Mac, exclude the Linux specific
rtnetlink routing lookup; Charon doesn't require it anyway.
 2009-09-15 13:16:39 +02:00
Martin Willi ae7452e87c Handle pki --debug and --options in a generic way for all command 2009-09-15 11:53:46 +02:00
Martin Willi 4fdb9f6f74 pki tool supports single letter short options 2009-09-15 10:20:22 +02:00
Martin Willi 012f62a820 Exponents of a RSA key in openssl are optional (for PGP) 2009-09-15 09:33:00 +02:00
Martin Willi b6b90b68a1 Added some NEWS 2009-09-15 09:13:31 +02:00
Martin Willi 9f45b19fe7 Use ID_KEY_ID as PGP user id, as it can contain any string 2009-09-15 08:45:08 +02:00
Martin Willi e4be5ef8fb Fall back to default credential set lookup if fingerprint lookup fails 2009-09-15 08:44:10 +02:00
Martin Willi 79c6f16212 Implemented support for preinstalled PGP certificates in charon 2009-09-15 08:23:48 +02:00
Martin Willi 4cb0e1bb76 Added basic support for PGP certificates (no trust relationships yet) 2009-09-15 08:23:48 +02:00
Martin Willi 88f3ffa1b1 Moved generic PGP parsing functions to pgp_utils.[ch] 2009-09-15 08:23:47 +02:00
Martin Willi 0912f0d2bc replaced the missed ${confdir} by ${sysconfdir} 2009-09-14 21:38:36 +02:00