aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ikev1: Inverse check when applying received KE value during Quick Mode5.3.0rc1Martin Willi2015-03-241-1/+1
| | | | Fixes Quick Mode negotiation when PFS is in use.
* Version bump to 5.3.0rc1Andreas Steffen2015-03-231-1/+1
|
* testing: added tnc/tnccs-20-mutual scenarioAndreas Steffen2015-03-2311-0/+151
|
* Implemented PB-TNC mutual half-duplex protocolAndreas Steffen2015-03-236-35/+143
|
* Optionally announce PB-TNC mutual protocol capabilityAndreas Steffen2015-03-2311-13/+428
|
* Split IF-TNCCS 2.0 protocol processing into separate TNC client and server ↵Andreas Steffen2015-03-239-799/+1746
| | | | handlers
* Merge branch 'dh-checks'Martin Willi2015-03-2334-253/+465
|\ | | | | | | | | Extend the diffie-hellman interface by success return values, and do some basic length checks for DH public values.
| * encoding: Remove DH public value verification from KE payloadMartin Willi2015-03-231-73/+0
| | | | | | | | | | | | | | | | This commit reverts 84738b1a and 2ed5f569. As we have no DH group available in the KE payload for IKEv1, the verification can't work in that stage. Instead, we now verify DH groups in the DH backends, which works for any IKE version or any other purpose.
| * diffie-hellman: Verify public DH values in backendsMartin Willi2015-03-237-1/+107
| |
| * diffie-hellman: Add a bool return value to set_other_public_value()Martin Willi2015-03-2319-55/+123
| |
| * diffie-hellman: Add a bool return value to get_my_public_value()Martin Willi2015-03-2323-39/+87
| |
| * libimcv: Allow pts_t.set_peer_public_value() to failMartin Willi2015-03-234-7/+11
| |
| * libimcv: Allow pts_t.get_my_public_value() to failMartin Willi2015-03-234-4/+14
| |
| * encoding: Allow ke_payload_create_from_diffie_hellman() to failMartin Willi2015-03-235-13/+59
| |
| * diffie-hellman: Use bool instead of status_t as get_shared_secret() return valueMartin Willi2015-03-2318-43/+41
| | | | | | | | | | While such a change is not unproblematic, keeping status_t makes the API inconsistent once we introduce return values for the public value operations.
| * load-tester: Migrate NULL DH implementation to INIT/METHOD macrosMartin Willi2015-03-231-21/+26
|/
* ikev1: Make sure SPIs in an IKEv1 DELETE payload match the current SATobias Brunner2015-03-231-0/+39
| | | | | | | | | | | | | | | | | | | | OpenBSD's isakmpd uses the latest ISAKMP SA to delete other expired SAs. This caused strongSwan to delete e.g. a rekeyed SA even though isakmpd meant to delete the old one. What isakmpd does might not be standard compliant. As RFC 2408 puts it: Deletion which is concerned with an ISAKMP SA will contain a Protocol-Id of ISAKMP and the SPIs are the initiator and responder cookies from the ISAKMP Header. This could either be interpreted as "copy the SPIs from the ISAKMP header of the current message to the DELETE payload" (which is what strongSwan assumed, and the direction IKEv2 took it, by not sending SPIs for IKE), or as clarification that ISAKMP "cookies" are actually the SPIs meant to be put in the payload (but that any ISAKMP SA may be deleted).
* encoding: Add getter for IKE SPIs in IKEv1 DELETE payloadsTobias Brunner2015-03-232-0/+25
|
* pki: Choose default digest based on the signature keyTobias Brunner2015-03-2312-20/+69
|
* pki: Use SHA-256 as default for signaturesTobias Brunner2015-03-2310-55/+15
| | | | | | Since the BLISS private key supports this we don't do any special handling anymore (if the user choses a digest that is not supported, signing will simply fail later because no signature scheme will be found).
* trap-manager: Add option to ignore traffic selectors from acquire eventsTobias Brunner2015-03-232-1/+19
| | | | | | | | The specific traffic selectors from the acquire events, which are derived from the triggering packet, are usually prepended to those from the config. Some implementations might not be able to handle these properly. References #860.
* unit-tests: Fix settings test after merging multi-line stringsTobias Brunner2015-03-231-2/+2
|
* swanctl: Append /ESN to proposal for a CHILD_SA using Extended Sequence NumbersMartin Willi2015-03-231-1/+1
| | | | | | | We previously printed just the value for the "esn" keyword, which is "1", and not helpful as such. Fixes #904.
* unit-tests: Depend on SHA1/SHA256 features for mgf1 test casesMartin Willi2015-03-232-5/+16
|
* man: More accurately describe features of the new parser in ipsec.conf(5)Tobias Brunner2015-03-201-46/+34
|
* settings: Merge quoted strings that span multiple linesTobias Brunner2015-03-201-3/+2
|
* starter: Merge quoted strings that span multiple linesTobias Brunner2015-03-201-3/+2
|
* encoding: Don't verify length of IKEv1 KE payloadsTobias Brunner2015-03-201-0/+6
| | | | | | The verification introduced with 84738b1aed95 ("encoding: Verify the length of KE payload data for known groups") can't be done for IKEv1 as the KE payload does not contain the DH group.
* charon-systemd: Optionally load plugin list from charon-systemd.loadTobias Brunner2015-03-191-1/+2
|
* apidoc: Limit INPUT to src subdirectory and README.mdMartin Willi2015-03-192-2/+2
| | | | | | While 0909bf6c explicitly includes the whole source tree (to cover README.md), this has the unpleasant side effect of covering a workspace under "testing" with all its sources, or any other potential subdirectory that exists.
* utils: Fix enum_flags_to_string parameter name to match Doxygen descriptionMartin Willi2015-03-191-1/+1
|
* attr-sql: Rename sql_attribute_t to attr_sql_provider_tMartin Willi2015-03-195-32/+32
| | | | | | As the plugin has its origins in the sql plugin, it still uses the naming scheme for the attribute provider implementation. Rename the class to better match the naming scheme we use in any other plugin
* ikev1: Adopt virtual IPs on new IKE_SA during re-authenticationTobias Brunner2015-03-193-45/+156
| | | | | | | | | | | Some clients like iOS/Mac OS X don't do a mode config exchange on the new SA during re-authentication. If we don't adopt the previous virtual IP Quick Mode rekeying will later fail. If a client does do Mode Config we directly reassign the VIPs we migrated from the old SA, without querying the attributes framework. Fixes #807, #810.
* ikev1: Mark rekeyed CHILD_SAs as INSTALLEDTobias Brunner2015-03-191-0/+2
| | | | | Since we keep them around until they finally expire they otherwise would block IKE_SA rekeying/reauthentication.
* mem-pool: Remove entries without online or offline leasesTobias Brunner2015-03-191-6/+22
| | | | | | This avoids filling up the hash table with unused/old identities. References #841.
* kernel-handler: Log new endpoint if NAT mapping changedTobias Brunner2015-03-191-2/+3
|
* child-sa: Remove policies before states to avoid acquire events for ↵Tobias Brunner2015-03-191-16/+16
| | | | untrapped policies
* Merge branch 'vici-python'Martin Willi2015-03-1823-30/+947
|\ | | | | | | Introduce a Python Egg for the vici plugin, contributed by Björn Schuberg.
| * NEWS: Introduce vici Python EggMartin Willi2015-03-181-0/+4
| |
| * travis: Install pip to install pytest in "all" testsMartin Willi2015-03-182-1/+8
| | | | | | | | | | This allows ./configure to detect py.test, and execute python unit tests we provide in the vici python egg.
| * vici: Add support for python 3Björn Schuberg2015-03-185-8/+29
| |
| * vici: Execute python tests during "check" if py.test is availableMartin Willi2015-03-181-0/+4
| |
| * configure: Check optional py.test availability when building with python eggsMartin Willi2015-03-181-0/+2
| |
| * vici: Add test of Packet layer in python libraryBjörn Schuberg2015-03-181-1/+47
| |
| * vici: Add test of Message (de)serialization in python libraryBjörn Schuberg2015-03-183-0/+100
| |
| * vici: Evaluate Python streamed command results, and raise CommandExceptionMartin Willi2015-03-181-1/+10
| |
| * vici: Catch Python GeneratorExit to properly cancel streamed event iterationMartin Willi2015-03-182-1/+12
| |
| * vici: Fall back to heap buffer when vararg printing on stack failsMartin Willi2015-03-181-21/+44
| | | | | | | | This avoids failures when building log event messages including larger hexdumps.
| * vici: Return a Python generator instead of a list for streamed responsesMartin Willi2015-03-182-47/+25
| | | | | | | | | | | | | | In addition that it may reduce memory usage and improve performance for large responses, it returns immediate results. This is important for longer lasting commands, such as initiate/terminate, where immediate log feedback is preferable when interactively calling such commands.
| * vici: Raise a Python CommandException instead of returning a CommandResultMartin Willi2015-03-182-82/+42
| |
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-04 03:14:05 +0000