denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
17,652 Commits 1 Branch 0 Tags
f8242127a21377941ee582636e006cbaa2ab9433
Commit Graph
13754 Commits
Author SHA1 Message Date
Tobias Brunner 228d096e42 Simplified creation of PRFs and signers in openssl and hmac plugins 2012-06-25 16:35:06 +02:00
Tobias Brunner 01850f5d55 Function to convert PRFs to hash algorithms added 2012-06-25 16:35:06 +02:00
Tobias Brunner 903093d439 hasher_algorithm_from_integrity() optionally returns truncation length 2012-06-25 16:35:06 +02:00
Tobias Brunner 73d032e412 Use simple wrappers for HMAC based PRF and signer in openssl plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 63420c6e13 Use simple wrappers for HMAC based PRF and signer in hmac plugin 2012-06-25 16:35:06 +02:00
Tobias Brunner 57ff4be874 Simple wrappers for HMAC based prf_t and signer_t implementations added 2012-06-25 16:35:06 +02:00
Tobias Brunner 8391c1d0b1 Refactored OpenSSL based HMAC implementation 2012-06-25 16:35:06 +02:00
Aleksandr Grinberg 54081897cf Adding OpenSSL HMAC signer functions to openssl plugin 2012-06-25 16:35:05 +02:00
Aleksandr Grinberg 0504b0a09f Adding OpenSSL HMAC pseudo random functions to openssl plugin 2012-06-25 16:35:05 +02:00
Aleksandr Grinberg 4faece7b1e Adding OpenSSL random number functions to openssl plugin 2012-06-25 16:35:05 +02:00
Tobias Brunner 7beb31aae4 Fixed IPv6 source address lookup 
Because Linux kernels prior to 3.0 do not support RTA_PREFSRC for
IPv6 routes we didn't use NLM_F_DUMP to get all routes.
Still routes installed with policies are installed also for IPv6.
So since only one route is returned without DUMP, and we ignore
all routes from our own routing table, no source address was found
during roaming if DST of the installed route included the IKE peer.

With newer kernels we can now use DUMP as we did for IPv4 already,
for older kernels we do so if our own routes are installed in a
separate routing table, otherwise we still use GET.
 2012-06-25 16:29:59 +02:00
Andreas Steffen 554a697a84 support Cisco Unity VID 2012-06-25 11:09:06 +02:00
Tobias Brunner c236f19e50 ldaphost and ldapbase ca section keywords are deprecated 2012-06-25 10:52:16 +02:00
Tobias Brunner 693805cc98 Removed pluto-specifics from ipsec script 2012-06-25 10:52:16 +02:00
Martin Willi 0ba1ddaa24 Enforce uniqueids=keep based on XAuth identity 2012-06-25 10:18:35 +02:00
Martin Willi f145ea29e0 Don't send XAUTH_OK if a hook prevents SA to establish 2012-06-25 10:18:35 +02:00
Martin Willi 0c32b9c62f Enforce uniqueids=keep only for non-XAuth Main/Agressive Modes 2012-06-25 10:18:35 +02:00
Martin Willi dd1381e7d3 Show EAP/XAuth identity in "ipsec status", if available 2012-06-25 10:18:35 +02:00
Martin Willi 0fbfcf2a3a Use XAuth/EAP remote identity for uniqueness check 2012-06-25 10:18:34 +02:00
Martin Willi de5e8fb4e0 Add missing XAuth name variable when complaining about missing XAuth backend 2012-06-25 10:09:27 +02:00
Andreas Steffen a7b8e380dc some copyright additions 2012-06-23 12:09:29 +02:00
Andreas Steffen e398dfb4c3 update copyright 2012-06-23 11:57:42 +02:00
Tobias Brunner e91157a4b6 Fix SIGSEGV if kernel install fails during Quick Mode as responder. 2012-06-22 11:34:38 +02:00
Tobias Brunner aa8898bc45 Fixed compile error because of charon->name in certexpire plugin. 2012-06-21 13:59:18 +02:00
Martin Willi e2dd114f37 Select requested virtual IP family based on remote TS, if no local TS available 2012-06-20 10:02:01 +02:00
Tobias Brunner 5d227c79a9 Doxygen fix in PKCS#7 wrapper 2012-06-19 13:32:59 +02:00
Tobias Brunner 5c1332bf7c NLM_F_DUMP includes NLM_F_ROOT. 2012-06-15 16:46:27 +02:00
Tobias Brunner 8ec51f83e5 Don't create roam jobs based on cached/cloned routes. 2012-06-15 16:44:18 +02:00
Tobias Brunner 9896b6bd58 Don't compare ports when comparing cached routes. 
At least src_ip has a port set sometimes.
 2012-06-15 16:44:07 +02:00
Tobias Brunner 31bcaf604a starter: Fixed parsing of %defaultroute. 2012-06-15 10:46:56 +02:00
Martin Willi af518b450e Adopt children as XAuth initiator (which is IKE responder) 2012-06-14 14:49:19 +02:00
Martin Willi e36497700c Print the kind of *Swan during starter startup 2012-06-14 10:25:48 +02:00
Martin Willi 137035cc78 Show what kind of *Swan we run in "ipsec status" 2012-06-14 10:25:48 +02:00
Martin Willi b31a56f128 Require a scary option to respond to Aggressive Mode PSK requests 
While Aggressive Mode PSK is widely used, it is known to be subject
to dictionary attacks by passive attackers. We don't complain as
initiator to be compatible with existing (insecure) setups, but
require a scary strongswan.conf option if someone wants to use it
as responder.
 2012-06-14 10:25:48 +02:00
Andreas Steffen e49f18f74d thanks to narrowing treat right|leftsubnetwithin as synonyms for right|leftsubnet 2012-06-14 07:55:12 +02:00
Tobias Brunner dd38e9fc83 scepclient: Fixed Makefile after removing enable-smartcard configure option. 2012-06-13 15:08:14 +02:00
Tobias Brunner f7cbc0fafe Use proper defines for IPV6_PKTINFO on Mac OS X Lion and newer. 2012-06-13 15:02:10 +02:00
Tobias Brunner 25fb9d3f4a starter: Print additional help texts for selected deprecated keywords. 2012-06-12 16:15:03 +02:00
Tobias Brunner 9707d9db79 starter: Improved how deprecated keywords are handled. 
We only throw a warning now instead of rejecting the config.
 2012-06-12 16:15:03 +02:00
Tobias Brunner 5c7a219804 Revert "starter: Don't treat unsupported keywords as fatal errors just report them." 
This reverts commit e55876a657.
 2012-06-12 16:15:03 +02:00
Martin Willi e35bbb9740 Added signature scheme options left/rightauth 2012-06-12 15:01:39 +02:00
Martin Willi 918e92c4c9 Support multiple different public key strength types in constraints 2012-06-12 14:24:49 +02:00
Martin Willi fd4ff11858 Add signature schemes to auth_cfg during trustchain validation 2012-06-12 14:24:49 +02:00
Martin Willi a37f2d2006 certificate_t->issued_by takes an argument to receive signature scheme 2012-06-12 14:24:49 +02:00
Martin Willi 439d0742e9 Define auth_cfg rules for signature schemes 2012-06-12 14:24:49 +02:00
Tobias Brunner e7c01bed49 starter: Fixed parsing of left|right=%any. 2012-06-12 10:16:51 +02:00
Tobias Brunner 4d21846912 starter: Fix comparison of connections. 2012-06-11 17:33:32 +02:00
Tobias Brunner 3e2ff81e5d starter: Removed all unsupported keywords. 2012-06-11 17:33:32 +02:00
Tobias Brunner e55876a657 starter: Don't treat unsupported keywords as fatal errors just report them. 2012-06-11 17:33:32 +02:00
Tobias Brunner fff4b74db2 Bye bye Pluto! 
Charon will take over IKEv1 duties from here.  This also removes
libfreeswan and whack.
 2012-06-11 17:33:32 +02:00