[strongSwan] BUG: DN with email

2009-08-18 Thread Dimitrios Siganos
, emailaddress=ho...@somewhere.com not confirmed by certificate, defaulting to subject DN: C=UK, CN=host2, e=ho...@somewhere.com That looks wrong, doesn't it? Regards, Dimitrios Siganos ___ Users mailing list Users@lists.strongswan.org https

[strongSwan] bashism in ipsec script

2009-08-18 Thread Dimitrios Siganos
The ipsec script has the following bashism (line 324 of ipsec script, git commit 333b461aa689c29197dadb2a15abc3ccade0c89a): loop=$(($loop - 1)) This doesn't work on my embedded board running busybox msh. I suggest changing the live above, to: loop=`expr $loop - 1` to make it more portable.

Re: [strongSwan] BUG: DN with email

2009-08-18 Thread Dimitrios Siganos
Yes, it does fix it. Thank you. I noticed that you commited some more changes related to email OIDs. Are they important? Should I get those too? I am referring to http://wiki.strongswan.org/repositories/revision/strongswan/fc0ed07c1f44d56ac9a5353c23e4cd79ee2594dd. Regards, Dimitrios Siganos

Re: [strongSwan] Problem signing the certificate by CA

2009-08-19 Thread Dimitrios Siganos
it is wrong. I am guessing that you need to set dir like this (absolute path): dir = /etc/ssl You had it set as : ./etc/dir, which is relative to the current working directory (probably not what you intended). Regards, Dimitrios Siganos Sushil Chaudhari wrote: Hi Everyone, I am trying

[strongSwan] IPv4 only and minimal kernel modules

2009-09-01 Thread Dimitrios Siganos
Cryptographic API Select algorithms you want to use... If we only want Ipv4 support, can this required kernel modules list be shortened? It seems that I I remove all of the Ipv6 modules the IPsec doesn't work so there is some dependency. Can you tell what it is? Regards, Dimitrios Siganos

Re: [strongSwan] IPv4 only and minimal kernel modules

2009-09-02 Thread Dimitrios Siganos
will brake v6/v4 mixed operation) Can you confirm that this is correct and complete? I plan to stick with 2.6.28 because changing kernel would require a lot of discussions and testing. Regards, Dimitrios Siganos ___ Users mailing list Users

Re: [strongSwan] a particular ``no trusted third party'' setup with X.509

2009-09-09 Thread Dimitrios Siganos
and shared passwords, wouldn't. Regards, Dimitrios Siganos ___ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users

Re: [strongSwan] a particular ``no trusted third party'' setup with X.509

2009-09-09 Thread Dimitrios Siganos
Oops. I fell into the trap of thinking small scale. If you are talking about large scale installations then your way is probably recommended. Dimitrios Siganos Dimitrios Siganos wrote: Ivan Shmakov wrote: Consider, e. g., two sites which are going to establish secure

Re: [strongSwan] IPSEC_CONFDIR does not work?

2009-09-10 Thread Dimitrios Siganos
on the behaviour of all the other scripts/binaries, which I don't know. Dimitrios Siganos Zhang, Long (Roger) wrote: Hi, I want to put all configuration file under my directory. Then I exported IPSEC_CONFDIR, but seems the IPSEC_CONFDIR does not work. Not sure why. My shell is bash. Tried two ways

Re: [strongSwan] esalg: No test for authenc(hmac(sha1), cbc(aes)) (authenc(hmac(sha1-generic), cbc(aes-generic)))

2009-09-11 Thread Dimitrios Siganos
I have found out that the message is coming from the linux kernel and not from charon as I thought. It comes from the function: int alg_test(const char *driver, const char *alg, u32 type, u32 mask) I still don't know if it something to worry about though. Regards, Dimitrios Siganos Dimitrios

Re: [strongSwan] ARM and I386 ?

2009-09-14 Thread Dimitrios Siganos
I also have a problem on the arm platform. I am cross compiling from Linux/Intel to arm platform. The latest release that works for me is 4.3.3. I don't know if have the same problem. I am investigating right now. Dimitrios Siganos Nguyễn Hoàng Anh wrote: Hi Andreas and all members! Today

Re: [strongSwan] ARM and I386 ?

2009-09-14 Thread Dimitrios Siganos
critical signal Regards, Dimitris Dimitrios Siganos wrote: I also have a problem on the arm platform. I am cross compiling from Linux/Intel to arm platform. The latest release that works for me is 4.3.3. I don't know if have the same problem. I am investigating right now. Dimitrios Siganos

[strongSwan] esp=null-sha1-modp1024,null-null

2009-09-15 Thread Dimitrios Siganos
Hi, Is the following esp line, valid configuration? conn west-east esp=null-sha1-modp1024,null-null Does it mean: add null-sha1-modp1024 and null-null to the default list of proposals to be negotiated? How do I know what the default list proposal list is? Regards, Dimitrios Siganos

Re: [strongSwan] ip xfrm state / ip xfrm policy

2009-09-30 Thread Dimitrios Siganos
Busybox doesn't have iproute2. They have a simple utility that looks and feels like iproute2 and it doesn't have support for xfrm and many other features of iproute2. You'll need to download the proper iproute2 package. Dimitrios Siganos Jessie Liu wrote: Hi Andreas, ip route list

[strongSwan] charon: how to determine minimum number of threads

2009-11-03 Thread Dimitrios Siganos
? Is a single threaded mode possible, realistically, or would it require complete re-engineering of charon? Regards, Dimitrios Siganos ___ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users

[strongSwan] installing DNS server %any to /etc/resolv.conf

2009-12-01 Thread Dimitrios Siganos
or bug. The IPsec gateway is a: Linux strongSwan U4.2.11/K2.6.28-11-generic The IPsec client is a: Linux strongSwan U4.3.3/K2.6.28 Regards, Dimitrios Siganos ___ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo

Re: [strongSwan] installing DNS server %any to /etc/resolv.conf

2009-12-01 Thread Dimitrios Siganos
I should add that we are not trying to use DNS. As far as we can see, we are not setting any DNS settings, in ipsec.conf or strongswan.conf, in neither the gateway nor the client. Dimitrios Siganos wrote: Hi, I am getting this strange log when I setup a strongswan tunnel installing DNS

Re: [strongSwan] installing DNS server %any to /etc/resolv.conf

2009-12-01 Thread Dimitrios Siganos
, Dimitrios Siganos Martin Willi wrote: Hi, I am assuming it is a mis-configuration or bug. Maybe both. It seems that your client requests a DNS server, but your server returns an empty or a 0.0.0.0 address. The IPsec gateway is a: Linux strongSwan U4.2.11/K2.6.28-11-generic

Re: [strongSwan] Please help - Using strongSwan to connect to CheckPoint VPN-1

2010-03-05 Thread Dimitrios Siganos
Sucha Singh wrote: Hi Andreas, Reviewing the above settings I added the following line to the ipsec.conf: ike=3des-sha1-md5-modp1024 I then get the following errors: 002 test #1: initiating Main Mode 003 test #1: no IKE algorithms for this connection (check ike algorithm string) 003

Re: [strongSwan] Ikev2 on initiator side and ikev1 on responder side

2010-03-11 Thread Dimitrios Siganos
ashish mahalka wrote: In the ipsec.conf file for Initiator, keyexchange is specified as ikev2 whereas for the Responder it is specified as ikev1. But still i am able to establish a ikev2 association between the two peers. The keyexhange setting has no effect on the responder. keyexchange =

Re: [strongSwan] bare minimum required kernel modules/version

2010-03-18 Thread Dimitrios Siganos
No, the IPv6 related modules are not necessary but you have to have linux-2.6.29 or above. Look at this thread for more details and workaround for earlier kernels: http://www.mail-archive.com/users@lists.strongswan.org/msg00920.html I am using 2.6.28 and I worked around the problem by applying

[strongSwan] charon IKEv2 usb smartcard dongle integration

2010-04-08 Thread Dimitrios Siganos
for this. Obviously a ready made solution would be ideal but if we will have to develop it ourselves. Regards, Dimitrios Siganos ___ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users

Re: [strongSwan] Need help reviewing a tutorial on smartcards

2010-04-09 Thread Dimitrios Siganos
upgrade to 4.3.5 at least. Thank you for your reply to my question and i would be interested in buying a usb dongle. But it would be better to reply separately to my question (for future reference), because our questions, although related, are not on the same topic. Regards, Dimitrios Siganos

Re: [strongSwan] encryption of packets failing

2010-04-14 Thread Dimitrios Siganos
NAGARAJAN, ANIL (ANIL) wrote: Hi All, I am trying to establish SA for site-to-site with ikev2. I am using strongswan4.3.5. I have added connection and brought up the connection using stroke message framework. SA gets established. However when I try to send packets from

Re: [strongSwan] strongswan with ocf or hardware accelator

2010-06-03 Thread Dimitrios Siganos
for an example. Beware that the linux crypto api is actively developed as we speak and is constantly changing. Dimitrios Siganos ___ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users