| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | ikev2: Move code in pubkey authenticator's build() method into separate ↵ | Tobias Brunner | 2015-03-09 | 1 | -85/+123 |
| | | | | | functions | ||||
| * | ikev2: Try all eligible signature schemes | Tobias Brunner | 2015-03-09 | 1 | -34/+71 |
| | | | | | | | Previously, we failed without recovery if a private key did not support a selected signature scheme (based on key strength and the other peer's supported hash algorithms). | ||||
| * | ikev2: Try all RSA signature schemes if none is configured | Tobias Brunner | 2015-03-04 | 1 | -4/+19 |
| | | |||||
| * | ikev2: Add an option to disable constraints against signature schemes | Tobias Brunner | 2015-03-04 | 1 | -1/+11 |
| | | | | | | | | | | | If this is disabled the schemes configured in `rightauth` are only checked against signature schemes used in the certificate chain and signature schemes used during IKEv2 are ignored. Disabling this could be helpful if existing connections with peers that don't support RFC 7427 use signature schemes in `rightauth` to verify certificate chains. | ||||
| * | ikev2: Fall back to SHA-1 signatures for RSA | Tobias Brunner | 2015-03-04 | 1 | -0/+7 |
| | | | | | | This is really just a fallback to "classic" IKEv2 authentication if the other peer supports no stronger hash algorithms. | ||||
| * | ikev2: Select a signature scheme appropriate for the given key | Tobias Brunner | 2015-03-04 | 1 | -18/+13 |
| | | | | | | By enumerating hashes we'd use SHA-1 by default. This way stronger signature schemes are preferred. | ||||
| * | ikev2: Log the actual signature scheme used for RFC 7427 authentication | Tobias Brunner | 2015-03-04 | 1 | -4/+6 |
| | | |||||
| * | ikev2: Store signature scheme used to verify peer in auth_cfg | Tobias Brunner | 2015-03-04 | 1 | -0/+1 |
| | | | | | | | | | | | This enables late connection switching based on the signature scheme used for IKEv2 and allows to enforce stronger signature schemes. This may break existing connections with peers that don't support RFC 7427 if signature schemes are currently used in `rightauth` for certificate chain validation and if the configured schemes are stronger than the default used for IKE (e.g. SHA-1 for RSA). | ||||
| * | ikev2: Remove private AUTH_BLISS method | Tobias Brunner | 2015-03-04 | 1 | -9/+0 |
| | | | | | | | We use the new signature authentication instead for this. This is not backward compatible but we only released one version with BLISS support, and the key format will change anyway with the next release. | ||||
| * | ikev2: Handle RFC 7427 signature authentication in pubkey authenticator | Tobias Brunner | 2015-03-04 | 1 | -49/+178 |
| | | |||||
| * | ikev2: Merge EAP client authentication details if EAP methods provides them | Martin Willi | 2015-03-03 | 1 | -0/+7 |
| | | |||||
| * | Implemented full BLISS support for IKEv2 public key authentication and the ↵ | Andreas Steffen | 2014-11-29 | 1 | -0/+9 |
| | | | | | pki tool | ||||
| * | payload: Use common prefixes for all payload type identifiers | Martin Willi | 2014-06-04 | 3 | -5/+5 |
| | | | | | | The old identifiers did not use a proper namespace and often clashed with other defines. | ||||
| * | Apply a mutual EAP auth_cfg not before the EAP method completes | Martin Willi | 2013-02-26 | 1 | -0/+10 |
| | | |||||
| * | Log the proper type for virtual EAP methods | Tobias Brunner | 2012-08-31 | 1 | -1/+5 |
| | | |||||
| * | Encode EAP-Naks in expanded format if we got an expanded type request | Tobias Brunner | 2012-08-31 | 1 | -2/+2 |
| | | | | | | Since methods defined by the IETF (vendor ID 0) could also be encoded in expanded type format the previous check was insufficient. | ||||
| * | Allow clients to request a configured EAP method via EAP-Nak | Tobias Brunner | 2012-08-31 | 1 | -4/+24 |
| | | |||||
| * | Virtual EAP methods handle EAP-Naks themselves | Tobias Brunner | 2012-08-31 | 1 | -5/+17 |
| | | |||||
| * | Send EAP-Nak with supported types if requested type is unsupported | Tobias Brunner | 2012-08-31 | 1 | -2/+4 |
| | | |||||
| * | Add a return value to keymat_v2_t.get_auth_octets() | Martin Willi | 2012-07-16 | 1 | -6/+9 |
| | | |||||
| * | Add a return value to keymat_v2_t.get_psk_sig() | Martin Willi | 2012-07-16 | 2 | -13/+27 |
| | | |||||
| * | Use separate Doxygen groups for IKEv1 and IKEv2 entities (authenticators, ↵ | Tobias Brunner | 2012-05-18 | 3 | -3/+3 |
| | | | | | tasks etc.). | ||||
| * | Merge branch 'ikev1' | Martin Willi | 2012-05-02 | 1 | -14/+3 |
| | | | | | | | | | | | | | | | | | Conflicts: configure.in man/ipsec.conf.5.in src/libcharon/encoding/generator.c src/libcharon/encoding/payloads/notify_payload.c src/libcharon/encoding/payloads/notify_payload.h src/libcharon/encoding/payloads/payload.c src/libcharon/network/receiver.c src/libcharon/sa/authenticator.c src/libcharon/sa/authenticator.h src/libcharon/sa/ikev2/tasks/ike_init.c src/libcharon/sa/task_manager.c src/libstrongswan/credentials/auth_cfg.c | ||||
| * | Moved eap/xauth classes out of protocol specific subdirectories | Martin Willi | 2012-03-20 | 5 | -463/+1 |
| | | |||||
| * | Separated libcharon/sa directory with ikev1 and ikev2 subfolders | Martin Willi | 2012-03-20 | 10 | -0/+1877 |
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |