denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
2,550 Commits 1 Branch 0 Tags
ff6836716c1bacbca74bce6965a11523d35fab66
Commit Graph
172 Commits
Author SHA1 Message Date
Martin Willi ff6836716c returning reference pointer on get_ref() 2008-05-06 10:55:42 +00:00
Martin Willi 27d04e055d implemented XCBC algorithms (signer, prf) for IKE on top of a crypter 
supporting ike=...-aesxcbc-... in ipsec.conf 
added AUTH_AES_XCBC_96 and PRF_AES128_CBC to default IKE proposal
AES XCBC testcase
 2008-04-30 14:26:24 +00:00
Martin Willi 4075225466 fixed peer config equality check 2008-04-18 10:30:52 +00:00
Martin Willi 0644ebd3de implemented IKE_SA uniqueness using ipsec.conf uniqueids paramater 
additionally supports a "keep" value to keep the old IKE_SA
 2008-04-14 13:23:24 +00:00
Martin Willi 348af092ac added close_action as a seperate config option to dpd_action 2008-04-14 08:17:18 +00:00
Martin Willi 96926b006d using dpd actions to enforce connection state 
dpd actions a per child-, not peer ike-sa
 2008-04-11 08:14:48 +00:00
Martin Willi cdcfe777f4 implementation of an CFG attribute framework, currently supporting virtual IPs 
updated ipsec.conf sourceip parameter to support
	CIDR notatation to serve from a pool
	%poolname to query a separate (database?) pool
 2008-04-09 12:54:47 +00:00
Tobias Brunner 471f923071 fixed two other memory leaks 2008-04-03 15:13:25 +00:00
Tobias Brunner dc04b7c743 mediation extension adapted to the naming convention of the current version of the draft. note: the external interface (config, autotools) has not yet been changed 2008-03-26 18:40:19 +00:00
Martin Willi 3c7e72f5b0 added equals() method to peer_cfg, ike_cfg, proposals, auth_info 
allows easier merging of ipsec.conf connections
replaced some iterators through enumerators
made proposals algorithm_t private using enumerator
 2008-03-26 10:06:45 +00:00
Martin Willi 3c448f019b fixed peer_cfg lookup when omitting IDr 2008-03-19 10:08:59 +00:00
Martin Willi 552cc11b1f merged the modularization branch (credentials) back to trunk 2008-03-13 14:14:44 +00:00
Martin Willi 0f806802ae implemented Expanded EAP types to support vendor specific methods 2007-12-13 17:31:21 +00:00
Martin Willi ee61471113 implemented RFC4478 (repeated authentication) 
changed %V printf handler to take a time delta, %#V now takes two arguments
 2007-11-20 12:06:40 +00:00
Andreas Steffen b073aada23 search : delimiter in ipsec.secrets entries from the rear 2007-11-16 20:23:29 +00:00
Martin Willi b9bc74979e fixed sqlite_backend compilation to respect changes from [3238] 2007-10-04 08:18:42 +00:00
Tobias Brunner d5cc175833 experimental P2P-NAT-T for IKEv2 merged back from branch 2007-10-03 15:10:41 +00:00
Martin Willi e4c9b92171 fixed sqlite database path 2007-10-02 11:55:19 +00:00
Martin Willi a3f100fa09 improved debugging code for traffic selector processing 2007-10-02 07:39:56 +00:00
Martin Willi f53b74c96f moved force_encap to ike_config, enables responder to enforce udp encapsulation 
fixed bugs in force_encap code
 2007-10-01 16:41:34 +00:00
Martin Willi 9dae1bed00 implemented IKEv2 force_encap connection parameter 
enforces UDP encapsulation by faking NAT detection payloads
  to hurdle restrictive firewalls
 2007-10-01 12:19:39 +00:00
Andreas Steffen cb23c49143 return argument has type size_t 2007-09-18 11:21:55 +00:00
Martin Willi 8f561d4409 prototype implemementation of an sqlite configuration backend 2007-09-18 07:12:21 +00:00
Andreas Steffen 15a9d460c0 peer_cfg now knows about group memberships 2007-09-13 15:33:17 +00:00
Andreas Steffen 2f9f5149c4 check hash algorithms used in signatures 2007-09-11 20:10:38 +00:00
Andreas Steffen c1ff717690 removed rsa_private_key clone() function 2007-09-11 16:26:08 +00:00
Andreas Steffen f0c156fbc9 replaced get_rsa_private_key() by rsa_signature() in order restrict the distribution of private key material 2007-09-11 10:18:25 +00:00
Andreas Steffen 7bac086733 overwrite storage used for shared secrets with pseudo-random bytes before releasing it 2007-09-10 19:12:01 +00:00
Martin Willi 9164e49ac0 added mobike=yes|no connection option 
yes: include mobike support notifies as initiator
  no: only enable mobike as responder when initiator supports it
  default: yes
 2007-08-29 12:11:25 +00:00
Andreas Steffen 929b9e367a append new attribute certs at the end 2007-08-14 13:04:36 +00:00
Andreas Steffen 06faefe43d adding attribute certficates to a chained list 2007-08-14 12:27:02 +00:00
Andreas Steffen 8f687a7591 has_rsa_private_key() must also be protected by keys_mutex 2007-08-10 12:10:36 +00:00
Andreas Steffen 84db83336b support of ipsec rereadsecrets for stroke 2007-08-10 07:16:32 +00:00
Andreas Steffen 037575682a bug fix in linked_list deletion - instead of acerts destroyed certs twice 2007-08-08 06:02:59 +00:00
Andreas Steffen f51d505e5e implemented listing of attribute certificates 2007-08-07 20:32:11 +00:00
Martin Willi fa1bd44f23 ignoring unkown crl/ocsp uris 2007-07-04 12:00:33 +00:00
Martin Willi face844a87 proper update of IPsec SA when roaming a host-to-host tunnel 
roaming of IPsec SAs using virtual IPs
 2007-07-02 09:49:22 +00:00
Andreas Steffen ad8c6c60dc moved assignment of CERT_UNKNOWN 2007-05-25 14:04:39 +00:00
Andreas Steffen 3f9834a491 log trust pathlen 2007-05-25 11:41:06 +00:00
Andreas Steffen 89eeedc243 included a certificate label in the is_trusted() method 2007-05-25 11:10:35 +00:00
Andreas Steffen f44dbc639b DBG1 level now shows stepping up through the certifiate hierarchy up to the trust anchor 2007-05-25 08:29:35 +00:00
Andreas Steffen 13b872ebd2 set certinfo status to CERT_UNKNOWN before crl and|or ocsp verification 2007-05-25 08:21:27 +00:00
Martin Willi 1f2a0f8098 removed paranoid module checking 2007-05-25 05:45:41 +00:00
Martin Willi 1fa9bdc4fb added compatibility names (pluto) for sha2 algorithms (sha2_256, ...) 2007-05-25 05:44:53 +00:00
Martin Willi 16878f6823 support for virtual IP definition on client side: 
if leftsourceip is defined, it is requested.
  server may define rightsourceip=%config to accept any,
  or it may overwrite it using rightsourceip.
  if server does not return an IP, client enforces its configured leftsourceip.
 2007-05-22 13:49:31 +00:00
Andreas Steffen 3388e7674d fixed nextUpdate and until behaviour in the non-strict case 2007-05-19 19:46:13 +00:00
Andreas Steffen 6e04f25313 support of CA-based ipsec policies 2007-05-18 12:25:37 +00:00
Andreas Steffen ca78602304 verification of locally loaded peer certificates 2007-05-15 14:51:04 +00:00
Andreas Steffen 2e324229c0 support of multiple certificates with same peer id 2007-05-15 12:46:05 +00:00
Martin Willi 6874bf698c changing UID/GID after startup of pluto/charon 
added --with-uid/--with-gid configure option
 2007-05-07 12:38:46 +00:00