strongswan.git
9 years agoPrefer AES/Camellia suites over 3DES/NULL encryption
Martin Willi [Wed, 25 Aug 2010 16:30:09 +0000 (18:30 +0200)]
Prefer AES/Camellia suites over 3DES/NULL encryption

9 years agoSend TLS alerts for errors in TLS handshake building
Martin Willi [Wed, 25 Aug 2010 16:24:27 +0000 (18:24 +0200)]
Send TLS alerts for errors in TLS handshake building

9 years agoRefactored fragment building, use correct TLS content type for non-first fragments
Martin Willi [Wed, 25 Aug 2010 16:04:59 +0000 (18:04 +0200)]
Refactored fragment building, use correct TLS content type for non-first fragments

9 years agoUpdate delete_payload length when adding SPIs
Martin Willi [Wed, 25 Aug 2010 15:03:09 +0000 (17:03 +0200)]
Update delete_payload length when adding SPIs

9 years agoMigrated delete_payload to INIT/METHOD macros, replaced iterator
Martin Willi [Wed, 25 Aug 2010 15:00:01 +0000 (17:00 +0200)]
Migrated delete_payload to INIT/METHOD macros, replaced iterator

9 years agoUse different return values in payload decryption to distinguish between integrity...
Martin Willi [Wed, 25 Aug 2010 13:29:53 +0000 (15:29 +0200)]
Use different return values in payload decryption to distinguish between integrity and syntax errors

9 years agoImplemented a TLS utility to test on any TLS secured TCP connection
Martin Willi [Wed, 25 Aug 2010 10:57:13 +0000 (12:57 +0200)]
Implemented a TLS utility to test on any TLS secured TCP connection

9 years agoAdded a simple high level TLS wrapper for sockets
Martin Willi [Wed, 25 Aug 2010 10:51:01 +0000 (12:51 +0200)]
Added a simple high level TLS wrapper for sockets

9 years agoInitialize output chunk before appending data to it
Martin Willi [Wed, 25 Aug 2010 10:43:21 +0000 (12:43 +0200)]
Initialize output chunk before appending data to it

9 years agoAdded private key support to in-memory credential set
Martin Willi [Tue, 24 Aug 2010 16:17:34 +0000 (18:17 +0200)]
Added private key support to in-memory credential set

9 years agoAdded certificate support to in-memory credential set
Martin Willi [Tue, 24 Aug 2010 14:59:45 +0000 (16:59 +0200)]
Added certificate support to in-memory credential set

9 years agoCheck if colliding rekey actually created an IKE_INIT
Thomas Egerer [Tue, 24 Aug 2010 12:55:47 +0000 (14:55 +0200)]
Check if colliding rekey actually created an IKE_INIT

In some cases (especially if a child is half-open) the colliding
rekey-job might not have created the ike_init member. If so, the
nonce check fails with SIGSEGV.

9 years agoAdded a ike_name logger option to prefix the IKE_SA name on each line
Martin Willi [Wed, 25 Aug 2010 07:53:43 +0000 (09:53 +0200)]
Added a ike_name logger option to prefix the IKE_SA name on each line

9 years agoremoved tls_record_t definition
Andreas Steffen [Tue, 24 Aug 2010 17:18:44 +0000 (19:18 +0200)]
removed tls_record_t definition

9 years agoPass NULL peer identity to omit TLS peer authentication, added eap-ttls.request_peer_...
Martin Willi [Tue, 24 Aug 2010 09:34:43 +0000 (11:34 +0200)]
Pass NULL peer identity to omit TLS peer authentication, added eap-ttls.request_peer_auth option

9 years agoSkip the close notify if application layer completes successfully
Martin Willi [Tue, 24 Aug 2010 08:29:54 +0000 (10:29 +0200)]
Skip the close notify if application layer completes successfully

9 years agoadded ikev2/rw-eap-tls-fragments scenario
Andreas Steffen [Tue, 24 Aug 2010 08:12:15 +0000 (10:12 +0200)]
added ikev2/rw-eap-tls-fragments scenario

9 years agouse correct network diagram
Andreas Steffen [Tue, 24 Aug 2010 08:09:58 +0000 (10:09 +0200)]
use correct network diagram

9 years agosupport fragmentation in AVPs
Andreas Steffen [Tue, 24 Aug 2010 07:02:40 +0000 (09:02 +0200)]
support fragmentation in AVPs

9 years agoremoved some redundant debug output
Andreas Steffen [Tue, 24 Aug 2010 07:00:52 +0000 (09:00 +0200)]
removed some redundant debug output

9 years agoAdded generic TLS purposes
Martin Willi [Tue, 24 Aug 2010 06:42:10 +0000 (08:42 +0200)]
Added generic TLS purposes

9 years agoClient sends empty EAP-TTLS packet on fatal alerts to properly shut down TLS
Martin Willi [Tue, 24 Aug 2010 06:41:12 +0000 (08:41 +0200)]
Client sends empty EAP-TTLS packet on fatal alerts to properly shut down TLS

9 years agoCheck if the application layer has completed successfully
Martin Willi [Tue, 24 Aug 2010 06:40:28 +0000 (08:40 +0200)]
Check if the application layer has completed successfully

9 years agoMoved TLS record parsing/generation to tls.c
Martin Willi [Mon, 23 Aug 2010 14:21:49 +0000 (16:21 +0200)]
Moved TLS record parsing/generation to tls.c

9 years agoadded debug-tls comand line option
Andreas Steffen [Mon, 23 Aug 2010 15:51:40 +0000 (17:51 +0200)]
added debug-tls comand line option

9 years agoAdded a TLS purpose for EAP-TTLS with client authentication
Martin Willi [Mon, 23 Aug 2010 12:31:21 +0000 (14:31 +0200)]
Added a TLS purpose for EAP-TTLS with client authentication

9 years agoEAP-TLS clients send an empty packet on failure to properly shut down a TLS session
Martin Willi [Mon, 23 Aug 2010 12:22:54 +0000 (14:22 +0200)]
EAP-TLS clients send an empty packet on failure to properly shut down a TLS session

9 years agoImplemented TLS Alert handling
Martin Willi [Mon, 23 Aug 2010 12:22:38 +0000 (14:22 +0200)]
Implemented TLS Alert handling

9 years agoRebuild library.lo after changing ./configure options
Martin Willi [Mon, 23 Aug 2010 10:01:48 +0000 (12:01 +0200)]
Rebuild library.lo after changing ./configure options

9 years agoBuild a trustchain even if no trust anchor is given
Martin Willi [Mon, 23 Aug 2010 09:57:40 +0000 (11:57 +0200)]
Build a trustchain even if no trust anchor is given

9 years agoAccept encryption payloads with no wrapped payloads
Martin Willi [Mon, 23 Aug 2010 09:30:36 +0000 (11:30 +0200)]
Accept encryption payloads with no wrapped payloads

9 years agoFall back to shifting with 32-bit words if 64-bit byte order conversion function...
Martin Willi [Mon, 23 Aug 2010 08:10:36 +0000 (10:10 +0200)]
Fall back to shifting with 32-bit words if 64-bit byte order conversion function missing

9 years agoUse enum mappings to resolve debug group
Martin Willi [Fri, 20 Aug 2010 18:45:31 +0000 (20:45 +0200)]
Use enum mappings to resolve debug group

9 years agoImplemented generic enum name to enum value mapping
Martin Willi [Fri, 20 Aug 2010 18:45:05 +0000 (20:45 +0200)]
Implemented generic enum name to enum value mapping

9 years agoVerify negotiated TLS version
Martin Willi [Fri, 20 Aug 2010 14:08:59 +0000 (16:08 +0200)]
Verify negotiated TLS version

9 years agoIntroducing a dedicated debug message group for libtls
Martin Willi [Fri, 20 Aug 2010 13:57:47 +0000 (15:57 +0200)]
Introducing a dedicated debug message group for libtls

9 years agoStreamlined TLS debugging output
Martin Willi [Fri, 20 Aug 2010 13:52:06 +0000 (15:52 +0200)]
Streamlined TLS debugging output

9 years agofixed build_cipher_suite_list()
Andreas Steffen [Sat, 21 Aug 2010 10:51:54 +0000 (12:51 +0200)]
fixed build_cipher_suite_list()

9 years agoIntroducing simple purposes for the TLS stack, switches various options
Martin Willi [Fri, 20 Aug 2010 13:02:25 +0000 (15:02 +0200)]
Introducing simple purposes for the TLS stack, switches various options

9 years agoFixed compiler warning
Martin Willi [Fri, 20 Aug 2010 12:57:14 +0000 (14:57 +0200)]
Fixed compiler warning

9 years agoenable the ccm and gcm plugins in the UML scenarios
Andreas Steffen [Fri, 20 Aug 2010 10:47:15 +0000 (12:47 +0200)]
enable the ccm and gcm plugins in the UML scenarios

9 years agoRegister missing SHA256 authenticator with no truncation, as used by TLS
Martin Willi [Fri, 20 Aug 2010 09:59:49 +0000 (11:59 +0200)]
Register missing SHA256 authenticator with no truncation, as used by TLS

9 years agoAdded more TLS cipher suites we already support
Martin Willi [Fri, 20 Aug 2010 09:01:57 +0000 (11:01 +0200)]
Added more TLS cipher suites we already support

9 years agoBuild TLS cipher suite list in a generic fashion
Martin Willi [Fri, 20 Aug 2010 10:10:21 +0000 (12:10 +0200)]
Build TLS cipher suite list in a generic fashion

9 years agoFixed crypter keymat derivation bug
Martin Willi [Thu, 19 Aug 2010 17:28:08 +0000 (19:28 +0200)]
Fixed crypter keymat derivation bug

9 years agoAdded ctr, ccm, gcm plugin NEWS
Martin Willi [Thu, 19 Aug 2010 17:01:03 +0000 (19:01 +0200)]
Added ctr, ccm, gcm plugin NEWS

9 years agoImprove GCM performance by factor 2-3 by shifting full 32/64 bit words
Martin Willi [Thu, 19 Aug 2010 16:49:35 +0000 (18:49 +0200)]
Improve GCM performance by factor 2-3 by shifting full 32/64 bit words

9 years agoImplemented a gcm plugin providing GCM mode based on CBC crypters
Martin Willi [Thu, 19 Aug 2010 15:58:30 +0000 (17:58 +0200)]
Implemented a gcm plugin providing GCM mode based on CBC crypters

9 years agoAdded AES-GCM test vectors
Martin Willi [Thu, 19 Aug 2010 15:57:03 +0000 (17:57 +0200)]
Added AES-GCM test vectors

9 years agoAdded a crypto transform stress test for profiling
Martin Willi [Thu, 19 Aug 2010 10:18:11 +0000 (12:18 +0200)]
Added a crypto transform stress test for profiling

9 years agoGive a benchmark point for each operation to compare different transforms
Martin Willi [Thu, 19 Aug 2010 10:17:03 +0000 (12:17 +0200)]
Give a benchmark point for each operation to compare different transforms

9 years agoImplemented a ccm plugin providing CCM mode based on CBC crypters
Martin Willi [Wed, 18 Aug 2010 18:38:02 +0000 (20:38 +0200)]
Implemented a ccm plugin providing CCM mode based on CBC crypters

9 years agoAdded helper macros to define portable bitfields with gcc
Martin Willi [Thu, 19 Aug 2010 09:23:07 +0000 (11:23 +0200)]
Added helper macros to define portable bitfields with gcc

9 years agoAdded AES-CCM test vectors
Martin Willi [Thu, 19 Aug 2010 09:24:34 +0000 (11:24 +0200)]
Added AES-CCM test vectors

9 years agoAdded support for AEAD test vectors to test-vectors plugin
Martin Willi [Thu, 19 Aug 2010 08:08:18 +0000 (10:08 +0200)]
Added support for AEAD test vectors to test-vectors plugin

9 years agoInclude CCM/GCM algorithms in IKEv2 proposals, if supported
Martin Willi [Wed, 18 Aug 2010 18:32:57 +0000 (20:32 +0200)]
Include CCM/GCM algorithms in IKEv2 proposals, if supported

9 years agoAdded proposal strings for Camellia CCM algorithm identifiers
Martin Willi [Wed, 18 Aug 2010 18:32:13 +0000 (20:32 +0200)]
Added proposal strings for Camellia CCM algorithm identifiers

9 years agoImplemented IKEv2 keymat derivation for AEAD algorithms
Martin Willi [Wed, 18 Aug 2010 18:18:20 +0000 (20:18 +0200)]
Implemented IKEv2 keymat derivation for AEAD algorithms

9 years agoList registered AEAD algorithms in listalgs
Martin Willi [Wed, 18 Aug 2010 18:17:09 +0000 (20:17 +0200)]
List registered AEAD algorithms in listalgs

9 years agoAdded support for AEAD algorithms to crypto factory
Martin Willi [Wed, 18 Aug 2010 18:16:03 +0000 (20:16 +0200)]
Added support for AEAD algorithms to crypto factory

9 years agoAdded AEAD support to crypto tester
Martin Willi [Wed, 18 Aug 2010 18:15:18 +0000 (20:15 +0200)]
Added AEAD support to crypto tester

9 years agoUse AEAD wrapper for encryption payload encryption/decryption
Martin Willi [Tue, 17 Aug 2010 15:36:09 +0000 (17:36 +0200)]
Use AEAD wrapper for encryption payload encryption/decryption

9 years agoMake function to test if an encryption algorithm is an AEAD alg public
Martin Willi [Tue, 17 Aug 2010 15:27:21 +0000 (17:27 +0200)]
Make function to test if an encryption algorithm is an AEAD alg public

9 years agoImplemented an AEAD wrapper for traditional crypter/signer transforms
Martin Willi [Tue, 17 Aug 2010 15:26:15 +0000 (17:26 +0200)]
Implemented an AEAD wrapper for traditional crypter/signer transforms

9 years agoMigrated generator_t to INIT/METHOD macros
Martin Willi [Tue, 17 Aug 2010 10:54:16 +0000 (12:54 +0200)]
Migrated generator_t to INIT/METHOD macros

9 years agoMigrated encryption_payload to INIT/METHOD macros
Martin Willi [Tue, 17 Aug 2010 10:05:51 +0000 (12:05 +0200)]
Migrated encryption_payload to INIT/METHOD macros

9 years agoMigrated message_t to INIT/METHOD macros
Martin Willi [Tue, 17 Aug 2010 09:10:38 +0000 (11:10 +0200)]
Migrated message_t to INIT/METHOD macros

9 years agoMigrated keymat to INIT/METHOD macros
Martin Willi [Tue, 17 Aug 2010 08:42:56 +0000 (10:42 +0200)]
Migrated keymat to INIT/METHOD macros

9 years agoTest append mode for signers verify_signature
Martin Willi [Tue, 17 Aug 2010 08:12:20 +0000 (10:12 +0200)]
Test append mode for signers verify_signature

9 years agoremoved debug output for TLS application data
Andreas Steffen [Thu, 19 Aug 2010 05:27:30 +0000 (07:27 +0200)]
removed debug output for TLS application data

9 years agoadded EAP-TTLS debug output
Andreas Steffen [Wed, 18 Aug 2010 21:21:00 +0000 (23:21 +0200)]
added EAP-TTLS debug output

9 years agoadded TLS record debug output
Andreas Steffen [Wed, 18 Aug 2010 20:52:42 +0000 (22:52 +0200)]
added TLS record debug output

9 years agoadd TLS handshake packet size to debug output
Andreas Steffen [Wed, 18 Aug 2010 20:07:27 +0000 (22:07 +0200)]
add TLS handshake packet size to debug output

9 years agoUse a seperate section for each nested struct member in INIT macro
Martin Willi [Wed, 18 Aug 2010 10:15:03 +0000 (12:15 +0200)]
Use a seperate section for each nested struct member in INIT macro

9 years agosome simplifications using the INIT macro
Andreas Steffen [Tue, 17 Aug 2010 18:09:32 +0000 (20:09 +0200)]
some simplifications using the INIT macro

9 years agodescribe EAP-TTLS phase2 start options using the phase2_piggyback parameter
Andreas Steffen [Mon, 16 Aug 2010 17:29:39 +0000 (19:29 +0200)]
describe EAP-TTLS phase2 start options using the phase2_piggyback parameter

9 years agoadded ikev2/rw-eap-ttls-phase2-piggyback scenario
Andreas Steffen [Mon, 16 Aug 2010 16:32:00 +0000 (18:32 +0200)]
added ikev2/rw-eap-ttls-phase2-piggyback scenario

9 years agoimplemented server-initiated phase2 of EAP-TTLS authentication
Andreas Steffen [Mon, 16 Aug 2010 16:30:29 +0000 (18:30 +0200)]
implemented server-initiated phase2 of EAP-TTLS authentication

9 years agochanged ikev2/rw-eap-ttls-only description
Andreas Steffen [Mon, 16 Aug 2010 15:29:20 +0000 (17:29 +0200)]
changed ikev2/rw-eap-ttls-only description

9 years agoDo not free registered algorithms, plugins are responsible for unregistering
Martin Willi [Mon, 16 Aug 2010 14:28:35 +0000 (16:28 +0200)]
Do not free registered algorithms, plugins are responsible for unregistering

9 years agoImplemented algorithm benchmarking during registration
Martin Willi [Mon, 16 Aug 2010 13:21:22 +0000 (15:21 +0200)]
Implemented algorithm benchmarking during registration

9 years agoVariable key length crypters use default key length if zero given
Martin Willi [Mon, 16 Aug 2010 13:12:49 +0000 (15:12 +0200)]
Variable key length crypters use default key length if zero given

9 years agoProperly handle zero length in chunk_alloc[a]/chunk_clone[a]
Martin Willi [Mon, 16 Aug 2010 13:11:51 +0000 (15:11 +0200)]
Properly handle zero length in chunk_alloc[a]/chunk_clone[a]

9 years agoMigrated crypto_factory to INIT/METHOD macros
Martin Willi [Mon, 16 Aug 2010 12:13:59 +0000 (14:13 +0200)]
Migrated crypto_factory to INIT/METHOD macros

9 years agoMigrated crypto_tester to INIT/METHOD macros
Martin Willi [Mon, 16 Aug 2010 07:34:54 +0000 (09:34 +0200)]
Migrated crypto_tester to INIT/METHOD macros

9 years agoadded ikev2/rw-eap-ttls-only scenario
Andreas Steffen [Mon, 16 Aug 2010 14:44:00 +0000 (16:44 +0200)]
added ikev2/rw-eap-ttls-only scenario

9 years agoimplemented server side support for EAP-TTLS
Andreas Steffen [Mon, 16 Aug 2010 14:40:24 +0000 (16:40 +0200)]
implemented server side support for EAP-TTLS

9 years agofixed typo in eap-mschapv2 plugin
Andreas Steffen [Mon, 16 Aug 2010 14:27:00 +0000 (16:27 +0200)]
fixed typo in eap-mschapv2 plugin

9 years agoOnly include certificates with CA flag in TLS cert request
Martin Willi [Mon, 16 Aug 2010 07:19:29 +0000 (09:19 +0200)]
Only include certificates with CA flag in TLS cert request

9 years agooptional certificate-based peer authentication on TLS server side
Andreas Steffen [Sun, 15 Aug 2010 11:02:57 +0000 (13:02 +0200)]
optional certificate-based peer authentication on TLS server side

9 years agoused default ipsec.secrets
Andreas Steffen [Sun, 15 Aug 2010 10:49:14 +0000 (12:49 +0200)]
used default ipsec.secrets

9 years agoincluded bad case in ikev2/rw-eap-ttls-radius scenario
Andreas Steffen [Sun, 15 Aug 2010 09:13:41 +0000 (11:13 +0200)]
included bad case in ikev2/rw-eap-ttls-radius scenario

9 years agoversion bumps in testing.conf
Andreas Steffen [Sat, 14 Aug 2010 19:41:52 +0000 (21:41 +0200)]
version bumps in testing.conf

9 years agoenable the eap-ttls and ctr plugins in the uml scenarios
Andreas Steffen [Sat, 14 Aug 2010 19:40:05 +0000 (21:40 +0200)]
enable the eap-ttls and ctr plugins in the uml scenarios

9 years agoadded rw-eap-ttls-radius scenario
Andreas Steffen [Sat, 14 Aug 2010 18:05:21 +0000 (20:05 +0200)]
added rw-eap-ttls-radius scenario

9 years agoremoved some raw EAP debug output
Andreas Steffen [Sat, 14 Aug 2010 10:01:45 +0000 (12:01 +0200)]
removed some raw EAP debug output

9 years agouse EAP plugin for tunneled client authentication
Andreas Steffen [Fri, 13 Aug 2010 23:14:28 +0000 (01:14 +0200)]
use EAP plugin for tunneled client authentication

9 years agosend tunneled EAP Identity response using eap-identity plugin
Andreas Steffen [Fri, 13 Aug 2010 20:45:22 +0000 (22:45 +0200)]
send tunneled EAP Identity response using eap-identity plugin

9 years agoallow to send an EAP Identity response without matching request
Andreas Steffen [Fri, 13 Aug 2010 20:41:00 +0000 (22:41 +0200)]
allow to send an EAP Identity response without matching request

9 years agodo not dump tls application data any more
Andreas Steffen [Fri, 13 Aug 2010 19:21:44 +0000 (21:21 +0200)]
do not dump tls application data any more