aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* NEWS: Updates for the recent mergesTobias Brunner2013-10-111-1/+18
|
* Merge branch 'iv-gen'Tobias Brunner2013-10-1119-17/+416
|\ | | | | | | | | | | | | Modularizes the generation of initialization vectors, which allows to use different methods depending on the algorithms. For instance for AES-GCM sequential IVs are now used instead of the earlier random IVs, which are still used for other algorithms e.g. AES-CBC.
| * iv_gen: Mask sequential IVs with a random saltTobias Brunner2013-10-111-0/+24
| | | | | | | | | | This makes it harder to attack a HA setup, even if the sequence numbers were not fully in sync.
| * iv_gen: Provide external sequence number (IKE, ESP)Tobias Brunner2013-10-117-23/+18
| | | | | | | | This prevents duplicate sequential IVs in case of a HA failover.
| * ipsec: Use IV generator to encrypt ESP messagesTobias Brunner2013-10-112-9/+7
| |
| * ikev2: Use IV generator to encrypt encrypted payloadTobias Brunner2013-10-111-1/+9
| |
| * iv_gen: aead_t implementations provide an IV generatorTobias Brunner2013-10-116-1/+84
| |
| * iv_gen: Add IV generator that allocates IVs sequentiallyTobias Brunner2013-10-114-2/+121
| |
| * iv_gen: Add IV generator that allocates IVs randomlyTobias Brunner2013-10-114-0/+113
| | | | | | | | Uses RNG_WEAK as the code currently does elsewhere to allocate IVs.
| * crypto: Add generic interface for IV generatorsTobias Brunner2013-10-112-1/+60
| |
| * apidoc: Move mac_prf to prf Doxygen groupTobias Brunner2013-10-111-1/+1
|/
* Merge branch 'radius-unity'Tobias Brunner2013-10-111-3/+123
|\ | | | | | | | | | | Adds support for Cisco Unity specific RADIUS attributes. References #383.
| * eap-radius: Forward RAT_FRAMED_IP_NETMASK as INTERNAL_IP4_NETMASKTobias Brunner2013-10-111-0/+5
| |
| * eap-radius: Forward UNITY_SPLIT_INCLUDE or UNITY_LOCAL_LAN attributesTobias Brunner2013-10-111-0/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Depending on the value of the CVPN3000-IPSec-Split-Tunneling-Policy(55) radius attribute, the subnets in the CVPN3000-IPSec-Split-Tunnel-List(27) attribute are sent in either a UNITY_SPLIT_INCLUDE (if the value is 1) or a UNITY_LOCAL_LAN (if the value is 2). So if the following attributes would be configured for a RADIUS user CVPN3000-IPSec-Split-Tunnel-List := "10.0.1.0/255.255.255.0,10.0.2.0/255.255.255.0" CVPN3000-IPSec-Split-Tunneling-Policy := 1 A UNITY_SPLIT_INCLUDE configuration payload containing these two subnets would be sent to the client during the ModeCfg exchange.
| * eap-radius: Forward UNITY_DEF_DOMAIN and UNITY_SPLITDNS_NAME attributesTobias Brunner2013-10-111-3/+25
|/ | | | | | The contents of the CVPN3000-IPSec-Default-Domain(28) and CVPN3000-IPSec-Split-DNS-Names(29) radius attributes are forwarded in the corresponding Unity configuration attributes.
* Merge branch 'dnscert'Tobias Brunner2013-10-1131-133/+1253
|\ | | | | | | | | The new dnscert plugin adds support for authentication via CERT resource records that are protected with DNSSEC.
| * testing: Add ikev2/net2net-dnscert scenarioTobias Brunner2013-10-1115-0/+224
| |
| * testing: Provide moon's and sun's certificate as CERT RRTobias Brunner2013-10-111-0/+51
| |
| * testing: Enable dnscert pluginTobias Brunner2013-10-111-0/+1
| |
| * testing: Load testing.conf.local from the same directory as testing.confTobias Brunner2013-10-111-2/+3
| |
| * dnscert: Add DNS CERT support for pubkey authenticationRuslan N. Marchenko2013-10-119-0/+832
| | | | | | | | | | | | | | | | | | | | | | Add DNSSEC protected CERT RR delivered certificate authentication. The new dnscert plugin is based on the ipseckey plugin and relies on the existing PEM decoder as well as x509 and PGP parsers. As such the plugin expects PEM encoded PKIX(x509) or PGP(GPG) certificate payloads. The plugin is targeted to improve interoperability with Racoon, which supports this type of authentication, ignoring in-stream certificates and using only DNS provided certificates for FQDN IDs.
| * ipseckey: Properly handle failure to create a certificateTobias Brunner2013-10-111-33/+28
| | | | | | | | Also, try the next key (if available) if parsing an IPSECKEY failed.
| * ipseckey: Refactor creation of certificate enumeratorTobias Brunner2013-10-111-86/+81
| | | | | | | | Reduces nesting and fixes a memory leak (rrsig_enum).
| * ipseckey: Depend on plugin features to create public key and certificate objectsTobias Brunner2013-10-111-0/+2
| |
| * unbound: Add support for DLV (DNSSEC Lookaside Validation)Tobias Brunner2013-10-112-13/+32
|/ | | | Fixes #392.
* Merge branch 'fwmarks'Tobias Brunner2013-10-118-53/+160
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allows setting a mark on outbound packets and the routing rule installed by charon. With those settings it is possible to setup tunnels with kernel-libipsec where the remote peer is part of the remote traffic selector. The following example settings in strongswan.conf show how this can be configured: charon { plugins { kernel-netlink { fwmark = !0x42 } socket-default { fwmark = 0x42 } kernel-libipsec { allow_peer_ts = yes } } } To make it work it is necessary to set net.ipv4.conf.all.rp_filter appropriately, otherwise the kernel drops the packets. References #380.
| * kernel-libipsec: Don't ignore policies of type != POLICY_IPSECTobias Brunner2013-10-111-5/+0
| | | | | | | | | | | | This actually broke rekeying due to the DROP policies that are temporarily added, which broke the refcount as the ignored policies were not ignored in del_policy() (the type is not known there).
| * kernel-libipsec: Add an option to allow remote TS to match the IKE peerTobias Brunner2013-10-112-2/+16
| | | | | | | | | | | | | | | | Setting the fwmark options for the kernel-netlink and socket-default plugins allow this kind of setup. It is probably required to set net.ipv4.conf.all.rp_filter to 2 to make it work.
| * socket-default: Allow setting firewall mark on outbound packetsTobias Brunner2013-10-112-0/+21
| |
| * kernel-netlink: Allow setting firewall marks on routing ruleTobias Brunner2013-10-112-0/+25
| |
| * ipsec_types: Add utility function to parse mark_t from stringsTobias Brunner2013-10-114-46/+98
|/
* Merge branch 'database-transactions'Tobias Brunner2013-10-1115-121/+378
|\ | | | | | | | | | | | | This adds support for transactions to the database_t interface and the two current implementations. The pool utility is also moved to its own directory in src/.
| * attr-sql: Use a serializable transaction when inserting identitiesTobias Brunner2013-10-111-12/+5
| |
| * database: Add support for serializable transactionsTobias Brunner2013-10-114-9/+27
| |
| * sql: Don't use MyISAM engine and set collation/charset for all tablesTobias Brunner2013-10-111-26/+25
| | | | | | | | The MyISAM engine doesn't support transactions.
| * pool: Change transaction handlingTobias Brunner2013-10-111-46/+8
| |
| * pool: Move the pool utility to its own directory in srcTobias Brunner2013-10-1110-21/+28
| |
| * attr-sql: Handle concurrent insertion of identitiesTobias Brunner2013-10-111-2/+12
| | | | | | | | | | | | | | | | | | If the same identity is added concurrently by two threads (or by the pool utility) INSERT might fail even though the SELECT was unsuccessful before. We are currently not able to lock the identities table in a portable way (something like SELECT ... FOR UPDATE on MySQL).
| * attr-sql: Don't use database transactions in create_attribute_enumeratorTobias Brunner2013-10-111-5/+0
| | | | | | | | | | | | | | | | | | There could, of course, be race conditions when enumerating the attributes, but those probably don't matter (e.g. missing an attribute that was concurrently added). Transactions are more intended to revert multiple changes if anything fails in the process.
| * sqlite: Implement transaction handlingTobias Brunner2013-10-111-6/+83
| |
| * mysql: Implement transaction handlingTobias Brunner2013-10-111-7/+119
| |
| * database: Add interface to handle transactionsTobias Brunner2013-10-113-1/+76
| |
| * mysql: Ensure connections are properly released in multi-threaded environmentsTobias Brunner2013-10-111-14/+23
|/
* crypto-factory: Try next available RNG implementation if constructor failsTobias Brunner2013-10-111-13/+6
|
* crypto-factory: Order entries by algorithm identifier and (optionally) speedTobias Brunner2013-10-111-22/+18
|
* Remove HASH_PREFERRED, usages are replaced with HASH_SHA1, which is required ↵Tobias Brunner2013-10-119-26/+18
| | | | for IKEv2 anyway
* vstr: Forward actual field widthTobias Brunner2013-10-111-1/+1
| | | | | fmt_field_width is a flag that indicates if a field width is defined in obj_field_width.
* unit-tests: support testing when leak-detective has not been enabledMartin Willi2013-10-111-5/+14
|
* NEWS: Updates for the ah, libipsec-usestats and printf-hook mergesMartin Willi2013-10-111-0/+13
|
* Merge branch 'printf-hook'Martin Willi2013-10-1116-385/+2039
|\ | | | | | | | | | | Adds a custom printf hook implementation as a fallback if neither the glibc style hooks nor vstr is available. This can avoid the Vstr dependency on some systems at the cost of slower and less complete printf functions.
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 09:07:34 +0000