aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Wipe auxiliary key store5.3.0Andreas Steffen2015-03-281-1/+1
|
* crypto-tester: Explicitly exclude FIPS-PRF from append mode testsMartin Willi2015-03-281-8/+11
| | | | | This was implicitly done by the seed length check before 58dda5d6, but we now require an explicit check to avoid that unsupported use.
* fips-prf: Fail when trying to use append mode on FIPS-PRFMartin Willi2015-03-281-1/+6
| | | | | Append mode hardly makes sense for the special stateful FIPS-PRF, which is different to other PRFs.
* Added PB-TNC test options to strongswan.conf man pageAndreas Steffen2015-03-271-0/+6
|
* Added tnc/tnccs-20-fail-init and tnc/tnccs-20-fail-resp scenariosAndreas Steffen2015-03-2738-8/+582
|
* Version bump to 5.3.0Andreas Steffen2015-03-271-1/+1
|
* Fixed PB-TNC error handlingAndreas Steffen2015-03-274-35/+32
|
* Added configurations for 3.18 and 3.19 KMV guest kernelsAndreas Steffen2015-03-272-0/+4346
|
* Fixed strongswan.conf man page entry of imc-attestationAndreas Steffen2015-03-272-18/+18
|
* Added tnc/tnccs-20-pt-tls scenarioAndreas Steffen2015-03-2724-5/+114
|
* cmac: Reset state before doing set_key()Martin Willi2015-03-271-0/+3
|
* af-alg: Reset hmac/xcbc state before doing set_key()Martin Willi2015-03-272-0/+2
|
* xcbc: Reset XCBC state in set_key()Martin Willi2015-03-271-0/+4
| | | | | If some partial data has been appended, a truncated key gets invalid if it is calculated from the pending state.
* hmac: Reset the underlying hasher before doing set_key() with longer keysMartin Willi2015-03-271-1/+2
| | | | | | | The user might have done a non-complete append, having some state in the hasher. Fixes #909.
* crypto-tester: Test set_key() after a doing a partial append on prf/signersMartin Willi2015-03-271-2/+20
| | | | | While that use is uncommon in real-world use, nonetheless should HMAC set a correct key and reset any underlying hasher.
* stroke: Properly parse bliss key strength in public key constraintTobias Brunner2015-03-251-1/+1
|
* eap-tnc: Free eap-tnc object if IKE_SA not found to get IPsTobias Brunner2015-03-251-0/+1
|
* tnccs-20: Fix error handling in build()Tobias Brunner2015-03-251-9/+5
|
* android: Add messages/ita directory to tnccs-20 pluginTobias Brunner2015-03-251-1/+1
|
* android: Sync libstrongswan Makefile.am and Android.mkTobias Brunner2015-03-251-0/+1
|
* libtnccs: Set apidoc category to libtnccs and move pluginsTobias Brunner2015-03-2510-11/+14
|
* libtnccs: Fix apidoc category for split IF-TNCCS 2.0 header filesTobias Brunner2015-03-253-5/+5
| | | | | Fixes 80322d2cee75 ("Split IF-TNCCS 2.0 protocol processing into separate TNC client and server handlers").
* Fixed some typos, courtesy of codespellTobias Brunner2015-03-253-3/+3
|
* kernel-netlink: Copy current usage stats to new SA in update_sa()Tobias Brunner2015-03-251-6/+34
| | | | | | | | | | | | This is needed to fix usage stats sent via RADIUS Accounting if clients use MOBIKE or e.g. the kernel notifies us about a changed NAT mapping. The upper layers won't expect the stats to get reset if only the IPs have changed (and some kernel interface might actually allow such updates without reset). It also fixes traffic based lifetimes in such situations. Fixes #799.
* child-sa: Add a new state to track rekeyed IKEv1 CHILD_SAsTobias Brunner2015-03-257-5/+15
| | | | | | This is needed to handle DELETEs properly, which was previously done via CHILD_REKEYING, which we don't use anymore since 5c6a62ceb6 as it prevents reauthentication.
* ikev1: Inverse check when applying received KE value during Quick Mode5.3.0rc1Martin Willi2015-03-241-1/+1
| | | | Fixes Quick Mode negotiation when PFS is in use.
* Version bump to 5.3.0rc1Andreas Steffen2015-03-231-1/+1
|
* testing: added tnc/tnccs-20-mutual scenarioAndreas Steffen2015-03-2311-0/+151
|
* Implemented PB-TNC mutual half-duplex protocolAndreas Steffen2015-03-236-35/+143
|
* Optionally announce PB-TNC mutual protocol capabilityAndreas Steffen2015-03-2311-13/+428
|
* Split IF-TNCCS 2.0 protocol processing into separate TNC client and server ↵Andreas Steffen2015-03-239-799/+1746
| | | | handlers
* Merge branch 'dh-checks'Martin Willi2015-03-2334-253/+465
|\ | | | | | | | | Extend the diffie-hellman interface by success return values, and do some basic length checks for DH public values.
| * encoding: Remove DH public value verification from KE payloadMartin Willi2015-03-231-73/+0
| | | | | | | | | | | | | | | | This commit reverts 84738b1a and 2ed5f569. As we have no DH group available in the KE payload for IKEv1, the verification can't work in that stage. Instead, we now verify DH groups in the DH backends, which works for any IKE version or any other purpose.
| * diffie-hellman: Verify public DH values in backendsMartin Willi2015-03-237-1/+107
| |
| * diffie-hellman: Add a bool return value to set_other_public_value()Martin Willi2015-03-2319-55/+123
| |
| * diffie-hellman: Add a bool return value to get_my_public_value()Martin Willi2015-03-2323-39/+87
| |
| * libimcv: Allow pts_t.set_peer_public_value() to failMartin Willi2015-03-234-7/+11
| |
| * libimcv: Allow pts_t.get_my_public_value() to failMartin Willi2015-03-234-4/+14
| |
| * encoding: Allow ke_payload_create_from_diffie_hellman() to failMartin Willi2015-03-235-13/+59
| |
| * diffie-hellman: Use bool instead of status_t as get_shared_secret() return valueMartin Willi2015-03-2318-43/+41
| | | | | | | | | | While such a change is not unproblematic, keeping status_t makes the API inconsistent once we introduce return values for the public value operations.
| * load-tester: Migrate NULL DH implementation to INIT/METHOD macrosMartin Willi2015-03-231-21/+26
|/
* ikev1: Make sure SPIs in an IKEv1 DELETE payload match the current SATobias Brunner2015-03-231-0/+39
| | | | | | | | | | | | | | | | | | | | OpenBSD's isakmpd uses the latest ISAKMP SA to delete other expired SAs. This caused strongSwan to delete e.g. a rekeyed SA even though isakmpd meant to delete the old one. What isakmpd does might not be standard compliant. As RFC 2408 puts it: Deletion which is concerned with an ISAKMP SA will contain a Protocol-Id of ISAKMP and the SPIs are the initiator and responder cookies from the ISAKMP Header. This could either be interpreted as "copy the SPIs from the ISAKMP header of the current message to the DELETE payload" (which is what strongSwan assumed, and the direction IKEv2 took it, by not sending SPIs for IKE), or as clarification that ISAKMP "cookies" are actually the SPIs meant to be put in the payload (but that any ISAKMP SA may be deleted).
* encoding: Add getter for IKE SPIs in IKEv1 DELETE payloadsTobias Brunner2015-03-232-0/+25
|
* pki: Choose default digest based on the signature keyTobias Brunner2015-03-2312-20/+69
|
* pki: Use SHA-256 as default for signaturesTobias Brunner2015-03-2310-55/+15
| | | | | | Since the BLISS private key supports this we don't do any special handling anymore (if the user choses a digest that is not supported, signing will simply fail later because no signature scheme will be found).
* trap-manager: Add option to ignore traffic selectors from acquire eventsTobias Brunner2015-03-232-1/+19
| | | | | | | | The specific traffic selectors from the acquire events, which are derived from the triggering packet, are usually prepended to those from the config. Some implementations might not be able to handle these properly. References #860.
* unit-tests: Fix settings test after merging multi-line stringsTobias Brunner2015-03-231-2/+2
|
* swanctl: Append /ESN to proposal for a CHILD_SA using Extended Sequence NumbersMartin Willi2015-03-231-1/+1
| | | | | | | We previously printed just the value for the "esn" keyword, which is "1", and not helpful as such. Fixes #904.
* unit-tests: Depend on SHA1/SHA256 features for mgf1 test casesMartin Willi2015-03-232-5/+16
|
* man: More accurately describe features of the new parser in ipsec.conf(5)Tobias Brunner2015-03-201-46/+34
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-03 16:24:40 +0000