| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | leak-detective: LEAK_DETECTIVE_DISABLE completely disables LD | Tobias Brunner | 2014-04-03 | 3 | -17/+23 | |
| | | | | | | If lib->leak_detective is non-null some code parts (e.g. the plugin loader) assume LD is actually used. | |||||
| * | unit-tests: Verify two bytes at once when testing chunk_clear() | Tobias Brunner | 2014-04-02 | 1 | -3/+6 | |
| | | | | | | This reduces the chances of arbitrary test failures if the memory area already got overwritten. | |||||
| * | tls: Add a test case to check correct enum name mapping of cipher suites | Martin Willi | 2014-04-01 | 3 | -0/+250 | |
| | | ||||||
| * | tls: Add socket based tests testing all supported suites with TLS 1.2/1.1/1.0 | Martin Willi | 2014-04-01 | 3 | -0/+527 | |
| | | ||||||
| * | tls: Remove superfluous initializers in TLS AEAD implementations | Martin Willi | 2014-04-01 | 4 | -4/+0 | |
| | | ||||||
| * | tls: Support a maximum TLS version to negotiate using TLS socket abstraction | Martin Willi | 2014-04-01 | 5 | -5/+7 | |
| | | ||||||
| * | tls: Support a null encryption flag on TLS socket abstraction | Martin Willi | 2014-04-01 | 5 | -7/+21 | |
| | | ||||||
| * | tls: Introduce a generic TLS purpose that accepts NULL encryption ciphers | Martin Willi | 2014-04-01 | 3 | -0/+6 | |
| | | ||||||
| * | tls: Export a function to list supported TLS cipher suites | Martin Willi | 2014-04-01 | 2 | -18/+66 | |
| | | ||||||
| * | tls: Create a unit-test runner | Martin Willi | 2014-04-01 | 5 | -0/+93 | |
| | | ||||||
| * | unit-tests: Catch timeouts during test runner deinit function | Martin Willi | 2014-04-01 | 1 | -6/+18 | |
| | | | | | | | The test runner deinit function often cancels all threads from the pool. This operation might hang on error conditions, hence we should include that hook in the test timeout to fail properly. | |||||
| * | unit-tests: Prevent a failing worker thread to go wild after it fails | Martin Willi | 2014-04-01 | 1 | -1/+2 | |
| | | | | | | | A worker raises SIGUSR1 to inform the main thread that the test fails. The main thread then starts cancelling workers, but the offending thread should be terminated immediately to prevent it from test continuation. | |||||
| * | Added Ubuntu 14.04 to IMV database | Andreas Steffen | 2014-03-31 | 1 | -0/+24 | |
| | | ||||||
| * | unit-tests: Always load address of testable functions | Tobias Brunner | 2014-03-31 | 1 | -1/+1 | |
| | | | | | | | | The addresses can actually change as plugins are loaded/unloaded for each test case. Fixes #551. | |||||
| * | settings: Reduce log verbosity if strongswan.conf does not exist | Tobias Brunner | 2014-03-31 | 1 | -1/+10 | |
| | | | | | | In some situations we expect strongswan.conf to not exist, for instance, when running the unit tests before installation. | |||||
| * | test-vectors: Renumber AES-GCM test vectors according to original source | Tobias Brunner | 2014-03-31 | 2 | -16/+100 | |
| | | | | | Also adds several missing ones. | |||||
| * | tls: Fix some TLS cipher suite enum names | Martin Willi | 2014-03-31 | 1 | -3/+3 | |
| | | | | | | It is important to have them mapped correctly, as we use these official TLS identifiers to configure specific TLS suites. | |||||
| * | tls: Include TLS version announced in Client Hello in encrypted premaster | Martin Willi | 2014-03-31 | 1 | -1/+7 | |
| | | | | | | | While a hardcoded 1.2 version is fine when we offer that in Client Hello, we should include the actually offered version if it has been reduced before starting the exchange. | |||||
| * | tls: Check for minimal TLS record length before each record iteration | Martin Willi | 2014-03-31 | 1 | -8/+8 | |
| | | | | | | | Fixes fragment reassembling if a buffer contains more than one record, but the last record contains a partial TLS record header. Thanks to Nick Saunders and Jamil Nimeh for identifying this issue and providing a fix for it. | |||||
| * | tls: Fix AEAD algorithm filtering, avoid filtering all suites if no AEAD found | Martin Willi | 2014-03-31 | 1 | -19/+52 | |
| | | ||||||
| * | tls: Offer TLS signature schemes in ClientHello in order of preference | Martin Willi | 2014-03-31 | 1 | -90/+59 | |
| | | | | | | Additionally, we now query plugin features to find out what schemes we exactly support. | |||||
| * | tls: Define AES-GCM cipher suites from RFC 5288/5289 | Martin Willi | 2014-03-31 | 1 | -0/+54 | |
| | | ||||||
| * | tls: Implement the TLS AEAD abstraction for real AEAD modes | Martin Willi | 2014-03-31 | 4 | -8/+262 | |
| | | ||||||
| * | tls: Separate TLS protection to abstracted AEAD modes | Martin Willi | 2014-03-31 | 8 | -325/+874 | |
| | | | | | | | To better separate the code path for different TLS versions and modes of operation, we introduce a TLS AEAD abstraction. We provide three implementations using traditional transforms, and get prepared for TLS AEAD modes. | |||||
| * | aead: Support custom AEAD salt sizes | Martin Willi | 2014-03-31 | 15 | -41/+129 | |
| | | | | | | | | | | The salt, or often called implicit nonce, varies between AEAD algorithms and their use in protocols. For IKE and ESP, GCM uses 4 bytes, while CCM uses 3 bytes. With TLS, however, AEAD mode uses 4 bytes for both GCM and CCM. Our GCM backends currently support 4 bytes and CCM 3 bytes only. This is fine until we go for CCM mode support in TLS, which requires 4 byte nonces. | |||||
| * | ikev2: Recreate a CHILD_SA that got a hard lifetime expire without rekeying | Martin Willi | 2014-03-31 | 1 | -0/+12 | |
| | | | | | | Works around issues related to system time changes and kernel backends using that system time, such as Linux XFRM. | |||||
| * | revocation: Log error if no OCSP signer candidate found | Martin Willi | 2014-03-31 | 1 | -1/+1 | |
| | | | | | Fixes evaluation of ikev2/ocsp-untrusted-cert. | |||||
| * | revocation: Restrict OCSP signing to specific certificates | Martin Willi | 2014-03-31 | 1 | -7/+63 | |
| | | | | | | | | | | | | | | To avoid considering each cached OCSP response and evaluating its trustchain, we limit the certificates considered for OCSP signing to: - The issuing CA of the checked certificate - A directly delegated signer by the same CA, having the OCSP signer constraint - Any locally installed (trusted) certificate having the OCSP signer constraint The first two options cover the requirements from RFC 6960 2.6. For compatibility with non-conforming CAs, we allow the third option as exception, but require the installation of such certificates locally. | |||||
| * | revocation: Don't merge auth config of CLR/OCSP trustchain validation | Martin Willi | 2014-03-31 | 1 | -39/+24 | |
| | | | | | | | | | | | This behavior was introduced with 6840a6fb to avoid key/signature strength checking for the revocation trustchain as we do it for end entity certificates. Unfortunately this breaks CA constraint checking under certain conditions, as we merge additional intermediate/CA certificates to the auth config. As key/signature strength checking of the revocation trustchain is a rather exotic requirement we drop support for that to properly enforce CA constraints. | |||||
| * | hashtable: Make key arguments const | Tobias Brunner | 2014-03-31 | 2 | -22/+23 | |
| | | | | | | This allows using const strings etc. for lookups without cast. And keys are not modifiable anyway. | |||||
| * | Properly hash pointers for hash tables where appropriate | Tobias Brunner | 2014-03-31 | 4 | -71/+7 | |
| | | | | | | Simply using the pointer is not optimal for our hash table implementation, which simply masks the key to determine the bucket. | |||||
| * | kernel-pfroute: Let get_nexthop() default to destination address | Tobias Brunner | 2014-03-31 | 1 | -3/+7 | |
| | | ||||||
| * | x509: CERT_DECODE actually requires KEY_ANY | Tobias Brunner | 2014-03-31 | 1 | -3/+1 | |
| | | | | | | More specific decoders might still be needed, but the x509 plugin should not care which ones. | |||||
| * | pkcs1: KEY_ANY public key decoder soft depends on specific decoders | Tobias Brunner | 2014-03-31 | 1 | -0/+3 | |
| | | ||||||
| * | eap-radius: Add option to not close IKE_SAs on timeouts during interim ↵ | Tobias Brunner | 2014-03-31 | 1 | -1/+6 | |
| | | | | | | | accouting updates Fixes #528. | |||||
| * | ikev1: Accept SPI size of any length <= 16 in ISAKMP proposal | Tobias Brunner | 2014-03-31 | 1 | -4/+12 | |
| | | | | | Fixes #533. | |||||
| * | proposal: Don't fail DH proposal matching if peer includes NONE | Tobias Brunner | 2014-03-31 | 1 | -4/+19 | |
| | | | | | | | | | The DH transform is optional for ESP/AH proposals. The initiator can include NONE (0) in its proposal to indicate that while it prefers to do a DH exchange, the responder may still decide to not do so. Fixes #532. | |||||
| * | openac: Remove obsolete openac utility | Martin Willi | 2014-03-31 | 7 | -744/+1 | |
| | | | | | The same functionality is now provided by the pki --acert subcommand. | |||||
| * | pki: Document --not-before/after and --dateform options in manpages | Martin Willi | 2014-03-31 | 4 | -7/+99 | |
| | | ||||||
| * | pki: Support absolute --this/next-update CRL lifetimes | Martin Willi | 2014-03-31 | 1 | -6/+22 | |
| | | ||||||
| * | pki: Support absolute --not-before/after issued certificate lifetimes | Martin Willi | 2014-03-31 | 2 | -7/+22 | |
| | | ||||||
| * | pki: Support absolute --not-before/after self-signed certificate lifetimes | Martin Willi | 2014-03-31 | 1 | -5/+22 | |
| | | ||||||
| * | pki: Support absolute --not-before/after acert lifetimes | Martin Willi | 2014-03-31 | 1 | -7/+26 | |
| | | ||||||
| * | pki: Add a certificate lifetime calculation helper function | Martin Willi | 2014-03-31 | 2 | -1/+69 | |
| | | ||||||
| * | ikev2: Cache all received attribute certificates to auth config | Martin Willi | 2014-03-31 | 1 | -1/+27 | |
| | | ||||||
| * | ikev2: Send all known and valid attribute certificates for subject cert | Martin Willi | 2014-03-31 | 1 | -0/+46 | |
| | | ||||||
| * | ikev2: Slightly refactor certificate payload construction to separate functions | Martin Willi | 2014-03-31 | 1 | -37/+56 | |
| | | ||||||
| * | ike: Support encoding of attribute certificates in CERT payloads | Martin Willi | 2014-03-31 | 1 | -1/+6 | |
| | | ||||||
| * | auth-cfg: Declare an attribute certificate helper type to exchange acerts | Martin Willi | 2014-03-31 | 3 | -2/+15 | |
| | | ||||||
| * | acert: Implement a plugin finding, validating and evaluating attribute certs | Martin Willi | 2014-03-31 | 6 | -0/+363 | |
| | | | | | | | This validator checks for any attribute certificate it can find for validated end entity certificates and tries to extract group membership information used for connection authorization rules. | |||||
 |
index : tteras/strongswan | |
| tteras' strongSwan tree | gitolite |
| aboutsummaryrefslogtreecommitdiffstats |