Commit Graph

Select branches

Hide Pull Requests

main

Mono Color

• a1fb5251e0 swanctl: Generalize private key decryption to support other credential types Martin Willi 2015-03-11 16:23:11 +01:00
• 84738b1aed encoding: Verify the length of KE payload data for known groups Martin Willi 2015-02-03 16:40:14 +01:00
• b8ecdfd895 ikev2: Migrate MOBIKE additional peer addresses to new SA after IKE_SA rekeying Martin Willi 2015-03-18 13:32:27 +01:00
• 80a1ebb1d9 ikev2: Immediately initiate queued tasks after establishing rekeyed IKE_SA Martin Willi 2015-03-11 11:30:51 +01:00
• afc1b67344 Version bump to 5.3.0dr2 Andreas Steffen 2015-03-16 17:15:58 +01:00
• 08feb4548a Replace kid by aik_id in ITA TBOOT functional component Andreas Steffen 2015-03-16 17:15:28 +01:00
• d35143bb8d Fixed two BLISS key type identifier strings Andreas Steffen 2015-03-15 19:29:25 +01:00
• 9c3c41f29b charon-systemd: Add missing semicolon Martin Willi 2015-03-16 09:31:17 +01:00
• 219821a78a osx: Include eap-gtc plugin in build instructions Martin Willi 2015-03-16 09:27:18 +01:00
• e035935068 Added availability of TNC AR IP address to IMVs to NEWS Andreas Steffen 2015-03-15 12:30:32 +01:00
• b6685211fb Create TPM TBOOT Measurement group Andreas Steffen 2015-03-15 12:24:05 +01:00
• 6d41927b42 vici: Use %u to print stats returned by mallinfo(3) Tobias Brunner 2015-03-13 15:20:39 +01:00
• 8286e2050b stroke: Use %u to print stats returned by mallinfo(3) Tobias Brunner 2015-03-13 15:20:08 +01:00
• f3c8332220 charon-systemd: Add support to configure user and group via strongswan.conf Tobias Brunner 2015-03-13 14:33:13 +01:00
• c4b6332211 eap-radius: Increase Acct-Session-ID string buffer Martin Willi 2015-03-13 09:39:42 +01:00
• 3d964213f5 testing: Remove obsolete leftnexthop option from configs Tobias Brunner 2015-03-12 15:51:25 +01:00
• 799f4c5db9 ikev2: Don't set old IKE_SA to REKEYING state during make-before-break reauth Martin Willi 2015-03-11 14:41:37 +01:00
• 438318c6c3 ha: Destroy synced IKE_SA if no configuration is found during update Martin Willi 2015-03-10 15:08:58 +01:00
• eb3e339a3c ikev1: Don't handle DPD timeout job if IKE_SA got passive Martin Willi 2015-03-10 13:59:49 +01:00
• 2b0f34a2ef testing: Don't check for exact IKEv1 fragment size Martin Willi 2015-03-10 10:21:16 +01:00
• 58c3e09918 testing: Fix active/passive role description in ha/both-active test case Martin Willi 2015-03-10 10:02:21 +01:00
• 607eebcfcf libipsec: Pass separate inbound/update flags to the IPsec SA manager Martin Willi 2015-03-09 18:08:52 +01:00
• 942797a5b5 kernel-interface: Add a separate "update" flag to add_sa() Martin Willi 2015-03-09 18:04:54 +01:00
• 68e5ada005 tkm: Use the inbound flag do determine peer role in CHILD_SA exchange Martin Willi 2015-03-09 17:44:55 +01:00
• acad5e9f51 Revert "child-sa: Remove the obsolete update logic" Martin Willi 2015-03-09 17:52:33 +01:00
• 8be21ae7ef Revert "ha: Always install the CHILD_SAs with the inbound flag set to FALSE" Martin Willi 2015-03-09 17:47:53 +01:00
• ab65a3e8fc tkm: Disable RFC 7427 signature authentication Tobias Brunner 2015-03-06 16:10:41 +01:00
• 708dff0700 ikev2: Move code in pubkey authenticator's build() method into separate functions Tobias Brunner 2015-03-09 14:50:34 +01:00
• 03a340c6c6 ikev2: Try all eligible signature schemes Tobias Brunner 2015-03-06 15:27:33 +01:00
• 1735d80f38 files: Add simple plugin to load files from file:// URIs Tobias Brunner 2015-02-11 12:11:04 +01:00
• 69bb1b8c18 daemon: Remove scheduled jobs before unloading plugins Tobias Brunner 2015-03-05 10:08:33 +01:00
• 11ac1dff9c scheduler: Add method to remove all scheduled jobs Tobias Brunner 2015-03-05 10:07:33 +01:00
• 1bfa5e0cac plugin-loader: Increase log level for warning about plugin features that failed to load Tobias Brunner 2015-03-04 10:48:33 +01:00
• 18597950fa tls-peer: Make sure to use the right trusted public key for peer Tobias Brunner 2015-02-20 11:29:02 +01:00
• e5009fbb66 pkcs11: Convert RFC 3279 ECDSA signatures when verifying Tobias Brunner 2015-03-05 15:14:40 +01:00
• b258ed0192 pkcs11: Properly encode RFC 3279 ECDSA signatures Tobias Brunner 2015-03-05 14:36:39 +01:00
• 8c9a0b5fb5 pkcs11: Properly encode EC_POINTs created on a token Tobias Brunner 2015-03-05 16:17:36 +01:00
• 4aab3153a4 pkcs11: Properly handle EC_POINTs returned as ASN.1 octet string Tobias Brunner 2015-03-05 14:33:59 +01:00
• 8fa9312f09 Updated products in imv database Andreas Steffen 2015-02-22 22:27:35 +01:00
• 20f90d7160 attest: output trusted flag and device description Andreas Steffen 2015-02-22 19:07:30 +01:00
• 00cd79b678 Make access requestor IP address available to TNC server Andreas Steffen 2015-02-19 11:44:11 +01:00
• 8b2af616ac testing: Update modified updown scripts to the latest template Tobias Brunner 2015-02-17 15:01:09 +01:00
• 4e92441d0c Remove obsolete _updown_espmark script Tobias Brunner 2015-02-17 14:51:53 +01:00
• fd25fb3118 _updown: Remove obsolete stuff from default script Tobias Brunner 2015-02-17 14:46:00 +01:00
• 9fda0bf007 ikev1: Set protocol ID and SPIs in INITIAL-CONTACT notification payloads Tobias Brunner 2015-02-10 19:03:44 +01:00
• 6133770db4 x509: Use subjectKeyIdentifier provided by issuer cert when checking CRL issuer Tobias Brunner 2014-12-18 09:13:38 +01:00
• 96e6130537 kernel-pfkey: Add option to set receive buffer size of event socket Tobias Brunner 2014-12-15 16:43:03 +01:00
• 3fcb59b62a use SHA512 for moon's BLISS signature Andreas Steffen 2015-03-04 14:08:37 +01:00
• 0a8268d0f1 Merge branch 'ikev2-signature-authentication' Tobias Brunner 2015-03-04 13:56:50 +01:00
• 3f1ef3a678 NEWS: Introduce RFC 7427 signature authentication Tobias Brunner 2015-02-27 19:19:13 +01:00
• 276cf3b725 man: Add documentation about IKEv2 signature schemes Tobias Brunner 2015-02-27 19:11:53 +01:00
• 26ebe5fea8 testing: Test classic public key authentication in ikev2/net2net-cert scenario Tobias Brunner 2015-03-03 19:38:51 +01:00
• 53217d70b0 testing: Disable signature authentication on dave in openssl-ikev2/ecdsa-certs scenario Tobias Brunner 2015-03-03 19:37:53 +01:00
• 4e6f102842 ikev2: Try all RSA signature schemes if none is configured Tobias Brunner 2015-03-03 19:32:35 +01:00
• 1d94b7950b ikev2: Consider signature schemes in rightauth when sending hash algorithms Tobias Brunner 2015-03-03 18:15:35 +01:00
• 1cbd34b9d4 tkm: Implement hash algorithm storage methods of keymat_v2_t interface Tobias Brunner 2015-03-03 18:09:33 +01:00
• f9e0caab6d keymat: Use hash algorithm set Tobias Brunner 2015-03-03 18:07:09 +01:00
• 1d384bf8aa hash-algorithm-set: Add class to manage a set of hash algorithms Tobias Brunner 2015-03-03 18:03:28 +01:00
• b67ae0f89c ikev2: Add an option to disable constraints against signature schemes Tobias Brunner 2015-02-27 18:45:56 +01:00
• 31bccf4ba1 stroke: Enable BLISS-based public key constraints Tobias Brunner 2015-03-02 15:40:30 +01:00
• 83dcb2d46d credential-manager: Store BLISS key strength in auth config Tobias Brunner 2015-03-02 15:51:16 +01:00
• ddb09a0603 auth-cfg: Add BLISS key strength constraint Tobias Brunner 2015-03-02 15:49:53 +01:00
• 7a9c0d51f4 testing: Don't check for exact IKEv2 fragment size Tobias Brunner 2015-02-27 17:58:47 +01:00
• 4aa24d4c13 testing: Update test conditions because signature schemes are now logged Tobias Brunner 2015-02-26 18:34:38 +01:00
• 2f1b2d9183 testing: Add ikev2/rw-sig-auth scenario Tobias Brunner 2015-02-26 18:24:47 +01:00
• 3b31245a0f testing: Add ikev2/net2net-cert-sha2 scenario Tobias Brunner 2015-02-26 09:18:10 +01:00
• cc048f0c50 ikev2: Fall back to SHA-1 signatures for RSA Tobias Brunner 2015-02-26 17:36:41 +01:00
• 0bdc79b5f9 ikev2: Select a signature scheme appropriate for the given key Tobias Brunner 2015-02-26 17:32:50 +01:00
• 1f648d756b public-key: Add helper to determine acceptable signature schemes for keys Tobias Brunner 2015-02-26 17:31:18 +01:00
• 0b14ce5802 ikev2: Log the actual signature scheme used for RFC 7427 authentication Tobias Brunner 2015-02-25 16:58:45 +01:00
• a7bbe59f85 ikev2: Store signature scheme used to verify peer in auth_cfg Tobias Brunner 2015-02-25 16:44:46 +01:00
• fff3576b6b ikev2: Add a global option to disable RFC 7427 signature authentication Tobias Brunner 2015-02-25 16:23:03 +01:00
• 6a2a9bfb48 ikev2: Remove private AUTH_BLISS method Tobias Brunner 2015-02-24 16:53:02 +01:00
• 295e37ab66 ikev2: Handle RFC 7427 signature authentication in pubkey authenticator Tobias Brunner 2015-02-23 17:54:14 +01:00
• d874101055 hasher: Add helper to determine hash algorithm from signature scheme Tobias Brunner 2015-02-24 15:35:33 +01:00
• 353294ea5c public-key: Add helper to map signature schemes to ASN.1 OIDs Tobias Brunner 2015-02-23 17:38:05 +01:00
• 0f29f5ed02 public-key: Add helper to determine key type from signature scheme Tobias Brunner 2015-02-23 16:56:31 +01:00
• f6329cae9c ikev2: Enable signature authentication by transmitting supported hash algorithms Tobias Brunner 2015-02-23 15:53:23 +01:00
• 828e71bd43 keymat: Add facility to store supported hash algorithms Tobias Brunner 2015-02-24 13:55:40 +01:00
• 247eadb73d hasher: Add filter function for algorithms permitted by RFC 7427 Tobias Brunner 2015-02-25 16:06:45 +01:00
• 4f9e1c49eb hasher: Redefine hash algorithms to match values defined by RFC 7427 Tobias Brunner 2015-02-25 16:05:35 +01:00
• 159b7bec9e ikev2: Add SIGNATURE_HASH_ALGORITHMS notify payload Tobias Brunner 2015-02-23 13:54:41 +01:00
• 7cd8371da2 ikev2: Add new authentication method defined by RFC 7427 Tobias Brunner 2015-02-23 13:48:34 +01:00
• dd0ebb5483 ikev2: Only accept initial messages in specific states Tobias Brunner 2015-02-25 08:30:33 +01:00
• 650a3ad515 ike-sa-manager: Make sure the message ID of initial messages is 0 Tobias Brunner 2015-02-25 08:09:11 +01:00
• eb25190629 ikev2: Don't destroy the SA if an IKE_SA_INIT with unexpected MID is received Tobias Brunner 2015-02-25 08:18:58 +01:00
• 1a31fe5580 ikev2: Don't adopt any CHILD_SA during make-before-break reauthentication Martin Willi 2015-03-04 11:16:00 +01:00
• 436cdae840 unit-tests: Base attributes get adopted by seg-env/seg-contract Tobias Brunner 2015-03-02 14:09:35 +01:00
• a2b400b16b seg-env: Destroy base attribute if segmentation is not possible Tobias Brunner 2015-03-02 14:07:40 +01:00
• ec57527475 Merge branch 'eap-constraints' Martin Willi 2015-03-03 14:08:55 +01:00
• f05a578b8b NEWS: Introduce EAP constraints support for EAP-(T)TLS Martin Willi 2015-01-29 11:57:44 +01:00
• f2e2cce2aa man: Describe trust chain constraints configuration for EAP methods Martin Willi 2015-01-29 11:41:08 +01:00
• f6b5952b32 stroke: Support public key constraints for EAP methods Martin Willi 2015-01-29 11:27:26 +01:00
• 0864a31d13 eap-ttls: Support EAP auth information getter in EAP-TTLS Martin Willi 2015-01-29 11:18:30 +01:00
• de2a62cfb6 eap-tls: Support EAP auth information getter in EAP-TLS Martin Willi 2015-01-29 11:15:17 +01:00
• 666c552381 libtls: Add getters for TLS handshake authentication details Martin Willi 2015-01-29 11:13:42 +01:00
• aba5b76ce1 libtls: Merge trustchain auth verification details done during TLS handhsake Martin Willi 2015-01-29 11:12:28 +01:00
• 0c608316dd ikev2: Merge EAP client authentication details if EAP methods provides them Martin Willi 2015-01-29 11:21:00 +01:00
• cfe7125357 eap: Add an optional authentication details getter to the EAP method interface Martin Willi 2015-01-29 11:14:21 +01:00
• 1fd7025499 Merge branch 'stroke-purge-on-reread' Martin Willi 2015-03-03 13:52:35 +01:00