denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,756 Commits 1 Branch 0 Tags
db57f5702b62adadf4fd28c4c3a8d556a9692713
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Andreas Steffen 927f733159 Version bump to 5.4.0dr5 2016-01-28 09:41:05 +01:00
Andreas Steffen 7c81942357 Support pseudonym RDN 2016-01-27 11:38:18 +01:00
Andreas Steffen 67a38ac6f1 testing: Added swanctl/config-payload scenario 2016-01-14 06:31:28 +01:00
Andreas Steffen e7b5171e43 testing: Use include statement in swanctl/rw-pubkey-keyid scenario 2016-01-14 01:44:17 +01:00
Andreas Steffen 9492e12e61 Version bump to 5.4.0dr4 2016-01-10 01:39:08 +01:00
Andreas Steffen ffd29ab30a vici: Support multiple named raw ublic keys 2016-01-10 00:12:57 +01:00
Andreas Steffen 2aa2b17d41 testing: swanctl/rw-pubkey-anon uses anonymous public keys in remote access scenario 2016-01-09 07:23:30 +01:00
Andreas Steffen abe6d07463 swanctl: Load pubkeys with load-creds 2016-01-09 07:23:30 +01:00
Andreas Steffen b83cef2412 testing: added swanctl scenarios net2net-pubkey, rw-pubkey-keyid and rw-dnssec 2016-01-09 07:23:30 +01:00
Andreas Steffen 4c38c79452 vici: list-cert sends subject, not-before and not-after attributes for pubkeys 2016-01-09 07:23:30 +01:00
Andreas Steffen 87371460f6 vici: Support of raw public keys 2016-01-09 07:23:29 +01:00
Andreas Steffen bffbf2f5fd testing: Fixed description of swanctl/frags-iv4 scenario 2016-01-09 00:17:31 +01:00
Andreas Steffen e333d4c0f1 swanctl.conf: IKEv2 fragmentation supported 2016-01-09 00:06:12 +01:00
Andreas Steffen 1990eeebfe Version bump to 5.4.0dr3 2016-01-03 06:28:49 +01:00
Andreas Steffen 9121f6cce1 vici: Enable transport encoding of CERT_TRUSTED_PUBKEY objects 2016-01-03 06:28:49 +01:00
Andreas Steffen 9db530493f testing: Change sql scenarios to swanctl 2016-01-03 06:28:48 +01:00
Andreas Steffen 92b051bd4a vici: allow legacy shortcuts in cert queries 2015-12-19 10:30:17 +01:00
Andreas Steffen 6943db5679 Version bump to 5.4.0dr2 2015-12-18 15:25:50 +01:00
Andreas Steffen 490ba67682 testing: Fixed description in swanctl/rw-ntru-bliss scenario 2015-12-18 15:24:59 +01:00
Andreas Steffen 9463350943 testing: swanctl is enabled by default 2015-12-18 15:22:29 +01:00
Andreas Steffen f553aea2c2 Use 128 bit security in README.pod examples 2015-12-18 15:08:33 +01:00
Andreas Steffen 2d9c68b8a8 configure: Enable vici plugin and swanctl by default 2015-12-17 17:49:48 +01:00
Andreas Steffen 76cbf1df34 testing: Added swanctl/rw-ntru-bliss scenario 2015-12-17 17:49:48 +01:00
Andreas Steffen cc874350b8 Apply pubkey and signature constraints in vici plugin 2015-12-17 17:49:48 +01:00
Andreas Steffen a78e1c3b11 128 bit default security strength for IKE and ESP algorithms 
The default ESP cipher suite is now
    AES_CBC-128/HMAC_SHA2_256_128
and requires SHA-2 HMAC support in the Linux kernel (correctly implemented
since 2.6.33).

The default IKE cipher suite is now
   AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
if the openssl plugin is loaded or
   AES_CBC-128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_3072
if ECC is not available.

The use of the SHA-1 hash algorithm and the MODP_2048 DH group has been
deprecated and ENCR_CHACHA20_POLY1305 has been added to the default
IKE AEAD algorithms.
 2015-12-17 17:49:48 +01:00
Andreas Steffen 5e2b740a00 128 bit default security strength requires 3072 bit prime DH group 2015-12-14 10:39:40 +01:00
Andreas Steffen 47e5640378 swanctl --stats lists loaded plugins 2015-12-13 17:07:28 +01:00
Andreas Steffen 36b6d400d2 testing: swanctl/rw-cert scenario tests password-protected RSA key 2015-12-12 17:12:44 +01:00
Andreas Steffen 4f7f2538c4 Upgraded IKE and ESP proposals in swanctl scenarios to consistent 128 bit security 2015-12-12 15:54:48 +01:00
Andreas Steffen 02d431022c Refactored certificate management for the vici and stroke interfaces 2015-12-12 00:19:24 +01:00
Andreas Steffen 4df09fe563 Modified vici_cert_info class for use with load_creds and vici_cred 2015-12-11 22:14:38 +01:00
Andreas Steffen 9dd8bfb2ce Changed some certificate_type_names and added x509_flag_names 2015-12-11 18:26:55 +01:00
Andreas Steffen 44d3b02b57 Removed VICI protocol versioning 2015-12-11 18:26:55 +01:00
Andreas Steffen b6dba6db74 Use of certificate_printer by swanctl --list-certs command 2015-12-11 18:26:55 +01:00
Andreas Steffen 334119b843 Share vici_cert_info.c with vici_cred.c 2015-12-11 18:26:55 +01:00
Andreas Steffen ef43df6cbe Allow msSmartcardLogon EKU to be built 2015-12-11 18:26:54 +01:00
Andreas Steffen fad851e2d3 Use VICI 2.0 protocol version for certificate queries 2015-12-11 18:26:54 +01:00
Andreas Steffen 5d909303d8 Sort certificate types during enumeration 2015-12-11 18:26:54 +01:00
Andreas Steffen 75749971e1 Define VICI protocol versions 2015-12-11 18:26:54 +01:00
Andreas Steffen 6789d79d46 testing: Added swanctl --list-algs output 2015-12-11 18:26:54 +01:00
Andreas Steffen 6aa7703122 testing: Converted tnc scenarios to swanctl 2015-12-11 18:26:54 +01:00
Andreas Steffen fd90f0613c Print OCSP single responses 2015-12-11 18:26:53 +01:00
Andreas Steffen 3317d0e77b Standardized printing of certificate information 
The certificate_printer class allows the printing of certificate
information to a text file (usually stdout). This class is used
by the pki --print and swanctl --list-certs commands as well as
by the stroke plugin.
 2015-12-11 18:26:53 +01:00
Andreas Steffen fc235f90fe Version bump to 5.4.0dr1 2015-12-01 15:06:23 +01:00
Andreas Steffen b5eed58a39 Added Vici:Session Perl CPAN module to NEWS 2015-12-01 15:02:18 +01:00
Andreas Steffen 7d24aa0624 Extended and refactored vici perl implementation 2015-12-01 14:52:43 +01:00
Andreas Steffen a17b6d469c Built the CPAN file structure for the Vici::Session perl module 2015-12-01 14:52:43 +01:00
Andreas Steffen a101bce862 Implement vici Perl binding 2015-12-01 14:52:43 +01:00
Andreas Steffen cbc43f1b43 testing: Some more timing fixes 2015-12-01 14:51:23 +01:00
Andreas Steffen 66021f7263 Version bump to 5.3.5 2015-11-26 09:56:10 +01:00
Andreas Steffen dddb32329c testing: Updated expired mars.strongswan.org certificate 2015-11-26 09:55:28 +01:00
Andreas Steffen 8e9adf3d09 Version bump to 5.4.0dr1 2015-11-16 16:36:50 +01:00
Andreas Steffen 722714bdfe Version bump to 5.3.4 2015-11-16 13:22:25 +01:00
Andreas Steffen 1c1f713431 testing: Error messages of curl plugin have changed 2015-11-13 14:02:45 +01:00
Andreas Steffen c4b9b7ef2c testing: Fixed another timing issue 2015-11-13 14:02:06 +01:00
Andreas Steffen bec682e1da Version bump to 5.3.4rc1 2015-11-13 12:18:28 +01:00
Andreas Steffen 019c7c2310 testing: Check for leases in swanctl/ip-pool scenario 2015-11-11 08:43:43 +01:00
Andreas Steffen 0748517582 Version bump to 5.3.4dr3 2015-11-10 16:54:38 +01:00
Andreas Steffen 946bc3a3f5 testing: Fixed some more timing issues 2015-11-10 16:54:38 +01:00
Andreas Steffen 2533c857ba testing: Added Debian 7.9 to IMV database 2015-11-09 15:18:39 +01:00
Andreas Steffen 529357f09a testing: Use sha3 plugin in ikev2/rw-cert scenario 2015-11-09 15:18:38 +01:00
Andreas Steffen f1f7134ecb Version bump to 5.3.4dr2 2015-11-06 16:07:04 +01:00
Andreas Steffen 23a50e66f1 testing: Updated hasher tests 2015-11-06 16:05:44 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Andreas Steffen 6590298dad Version bump to 5.3.4dr1 2015-11-04 19:42:17 +01:00
Andreas Steffen 83c1883d0b Use word-aligned XOR in sha3_absorb() 2015-11-03 21:35:09 +01:00
Andreas Steffen a98360a64c testing: BLISS CA uses SHA-3 in its CRL 2015-11-03 21:35:09 +01:00
Andreas Steffen f6fede934b Support BLISS signatures with SHA-3 hash 2015-11-03 21:35:09 +01:00
Andreas Steffen a488584b5f Implemented SHA-3 hash algorithm including test vectors 2015-11-03 21:35:09 +01:00
Andreas Steffen de61e2cef4 Defined SHA-3 hashers 2015-11-03 19:07:15 +01:00
Andreas Steffen a215008c11 Version bump to 5.3.3 2015-09-06 15:05:36 +02:00
Andreas Steffen 2b5c543051 testing: added ikev2/alg-chacha20poly1305 scenario 2015-09-01 17:30:15 +02:00
Andreas Steffen 57eb3b2b25 testing: update to Linux 4.2 kernel 2015-09-01 17:29:30 +02:00
Andreas Steffen 01604016f7 Version bump to 5.3.3rc2 2015-09-01 13:16:43 +02:00
Andreas Steffen 5de8703ee0 Version bump to 5.3.3rc1 2015-08-25 15:10:13 +02:00
Andreas Steffen cdb61c3e88 Added some spaces in swanctl.conf 2015-08-25 15:10:13 +02:00
Andreas Steffen 46686372c6 Version bump to 5.3.3dr6 2015-08-19 07:18:30 +02:00
Andreas Steffen 5f60c55919 Extend HCD attribute data for tnc/tnccs-20-hcd-eap scenario 2015-08-18 21:25:39 +02:00
Andreas Steffen b19ef52d51 Added reason string support to HCD IMV 2015-08-18 21:25:39 +02:00
Andreas Steffen 627e4b9659 Fixed patches format delimited by CR/LF 2015-08-18 21:25:39 +02:00
Andreas Steffen 6a3d035505 Added imc-hcd attributes to strongswan.conf 2015-08-18 21:25:39 +02:00
Andreas Steffen ac28daac38 testing: Added tnc/tnccs-20-hcd-eap scenario 2015-08-18 21:25:39 +02:00
Andreas Steffen 18472ac21c Use PWG HCD PA-TNC subtypes to transport HCD attributes 2015-08-18 21:25:39 +02:00
Andreas Steffen 6b68719dd3 Add default password determination capability to os_info 2015-08-18 21:25:39 +02:00
Andreas Steffen 9e13c2b2cc Reintroduced ietf_attr_fwd_enabled() 2015-08-18 21:25:39 +02:00
Andreas Steffen 860df6bf75 Defined PWG HCD PA-TNC subtypes 2015-08-18 21:25:39 +02:00
Andreas Steffen 9c2e0a50a3 Added os_info support to HCD IMC 2015-08-18 21:25:38 +02:00
Andreas Steffen 9e88bb987d Subscribed Scanner IMC/IMV to IETF_FIREWALL PA subtype 2015-08-18 21:25:38 +02:00
Andreas Steffen ebed384887 testing: enable HCD IMC and IMV 2015-08-18 21:25:38 +02:00
Andreas Steffen b48ffcb1b3 Implemented HCD IMC and IMV 2015-08-18 21:25:38 +02:00
Andreas Steffen 92a9c99c38 Defined HCD PA subtype in PWG namespace 2015-08-18 21:25:38 +02:00
Andreas Steffen 21b8051c10 Completed implementation of PWG HCD attributes 2015-08-18 21:25:38 +02:00
Andreas Steffen 981653a437 Defined generic non-nul terminated string PA-TNC attribute 2015-08-18 21:25:38 +02:00
Andreas Steffen 6a11c8a3f3 Support of HCD Firewall Setting PA-TNC attribute 2015-08-18 21:25:38 +02:00
Andreas Steffen abb8a1ecd2 Defined generic boolean PA-TNC attribute 2015-08-18 21:25:38 +02:00
Andreas Steffen 5e1b06ff08 Defined PWG HCD IF-M attributes 2015-08-18 21:25:38 +02:00
Andreas Steffen 10f25a3dd9 Fixed the implemention of the IF-M segmentation protocol 
The first segment only fit if the segmentation envelope attribute
was preceded by a Max Attribute Size Response attribute. The
improved implementation fills up the first PA-TNC message with
the first segment up to the maximum message size.
 2015-08-18 21:24:26 +02:00
Andreas Steffen cdd7d2b197 Version bump to 5.3.3dr5 2015-08-16 09:04:42 +02:00
Andreas Steffen a330f72ecf Fixed AR identities in mutual TNC measurements case 2015-08-15 22:46:21 +02:00
Andreas Steffen 16c4dd8f26 Version bump to 5.3.3dr4 2015-08-10 07:48:14 +02:00