denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14,680 Commits 1 Branch 0 Tags
1db918c4f89fa97ecf04ec29b07960e7cf91fa5c
Commit Graph
1727 Commits
Author SHA1 Message Date
Martin Willi 1db918c4f8 vici: Use an empty local auth round if none given 
While it hardly makes sense to use none for negotiated SAs, it actually does
when installing shunt policies.
 2015-12-07 10:05:07 +01:00
Martin Willi b26ba1b4a4 vici: Limit start action undoing to IKE_SAs using the base peer config name 
If two peer configs use the same child config names, potentailly delete
the wrong CHILD_SA. Check the peer config name as well to avoid that.
 2015-12-07 10:05:07 +01:00
Martin Willi 23b1f71372 vici: Close empty IKE_SAs after undoing CHILD_SA start actions 2015-12-07 10:05:07 +01:00
Martin Willi 2facf18833 vici: Use value based array to store CHILD_SA ids during restart 
The previous approach stored a pointer to a volatile stack variable, which
works for a single ID, but not for multiple.
 2015-12-07 10:05:07 +01:00
Martin Willi f3b2d4a9d8 vici: Undo start actions when unloading configs 2015-12-07 10:05:07 +01:00
Tobias Brunner 63a778a25d vici: Fix clean-local target for Perl bindings if they were not built 
This is called when running `make distclean` (or indirectly via `make
distcheck`).
 2015-12-04 12:10:57 +01:00
Andreas Steffen 7d24aa0624 Extended and refactored vici perl implementation 2015-12-01 14:52:43 +01:00
Andreas Steffen a17b6d469c Built the CPAN file structure for the Vici::Session perl module 2015-12-01 14:52:43 +01:00
Andreas Steffen a101bce862 Implement vici Perl binding 2015-12-01 14:52:43 +01:00
Tobias Brunner de34defcd0 vici: Add get-algorithms command to query loaded algorithms and implementations 2015-11-30 10:55:55 +01:00
Thom Troy ac36ede93c eap-radius: Add ability to configure RADIUS retransmission behavior 
Closes strongswan/strongswan#19.
 2015-11-17 14:25:08 +01:00
Tobias Brunner f9c5c80553 eap-mschapv2: Keep internal state to prevent authentication from succeeding prematurely 
We can't allow a client to send us MSCHAPV2_SUCCESS messages before it
was authenticated successfully.

Fixes CVE-2015-8023.
 2015-11-16 13:19:36 +01:00
Tobias Brunner 176c24b8e1 vici: Attribute certificates are not trusted 2015-11-12 14:45:43 +01:00
Tobias Brunner e5e352e631 vici: Properly add CRLs to the credential set 
add_crl() ensures that old CLRs are not stored in the credential set.
 2015-11-12 14:45:42 +01:00
Tobias Brunner fdfbd401c3 eap-radius: Compare address family when handing out virtual IPs 
This also ensures that the actually released virtual IP is removed from
the list of claimed IPs.

Fixes #1199.
 2015-11-12 14:32:11 +01:00
Tobias Brunner 1d4b767275 eap-mschapv2: Report username if different from EAP-Identity (or IKE identity) 2015-11-12 14:21:06 +01:00
Tobias Brunner 8f5e481953 eap-mschapv2: Provide EAP-MSCHAPv2 username as EAP-Identity 2015-11-12 14:21:06 +01:00
Tobias Brunner a6e0f14fd2 kernel-interface: Pass the same data to del_policy() that was passed to add_policy() 
The additional data can be helpful to identify the exact policy to
delete.
 2015-11-10 16:42:52 +01:00
Tobias Brunner ebeb8c87c5 traffic-selector: Don't end printf'ed list of traffic selectors with a space 2015-11-10 12:13:06 +01:00
Tobias Brunner f4641f9e45 vici: Add option to query leases of pools 
We could later perhaps add filter parameters similar to those of the
`ipsec leases` command (pool name/virtual IP).
 2015-11-10 10:43:25 +01:00
Tobias Brunner bdb8b76515 vici: Return local and remote virtual IPs when listing SAs 2015-11-10 10:43:24 +01:00
Tobias Brunner 0ddec0760a socket-dynamic: Refactor setting source address when sending messages 
Basically the same change as the one for the socket-default plugin.
 2015-11-09 16:44:22 +01:00
Tobias Brunner 47e113a639 socket-default: Refactor setting source address when sending messages 
This ensures we don't pass data (via msg_control) defined in a different
scope to sendmsg().  Actually, some compilers (e.g. GCC 5.2.1) might
optimize the memcpy() call away causing the packets not to get sent from
the intended source address.

It also makes the code clearer than with all these ifdefs.

Fixes #1171.
 2015-11-09 16:43:21 +01:00
Tobias Brunner 99747bed8f socket-default: Refactor retrieval of destination address of received packets 
This makes the code a bit clearer than with the interleaved ifdefs.
 2015-11-09 16:42:20 +01:00
Tobias Brunner 04f22cdabc vici: Add NAT information when listing IKE_SAs 
The `nat-local` and `nat-remote` keys contain information on the NAT
status of the local and remote IKE endpoints, respectively.  If a
responder did not detect a NAT but is configured to fake a NAT situation
this is indicated by `nat-fake` (if an initiator fakes a NAT situation
`nat-local` is set).  If any NAT is detected or faked `nat-any` is set.

Closes strongswan/strongswan#16.
 2015-11-09 11:55:51 +01:00
Tobias Brunner 7b95688124 stroke: Make down-nb actually non-blocking 
Fixes #1191.
 2015-11-09 10:55:46 +01:00
Andreas Steffen a88d958933 Explicitly mention SHA2 algorithm in BLISS OIDs and signature schemes 2015-11-06 14:55:31 +01:00
Tobias Brunner 00c2c87b06 eap-radius: Fix creation of host_t objects based on Framed-IPv6-Address attributes 
Fixes ec490e68ae ("eap-radius: Add support for some basic IPv6-specific RADIUS attributes").
References #1001.
 2015-08-28 16:52:57 +02:00
Tobias Brunner fbb593092e eap-ttls: Limit maximum length of tunneled EAP packet to EAP-TTLS packet 2015-08-27 15:29:16 +02:00
Tobias Brunner e3e208fb9f ha: Close control FIFO if it is not valid 2015-08-27 14:31:42 +02:00
Tobias Brunner c605a96d7f Fix some Doxygen issues 2015-08-27 12:03:11 +02:00
Tobias Brunner 735f929ca7 ike: Only consider number of half-open SAs as responder when deciding whether COOKIEs are sent 2015-08-27 11:18:51 +02:00
Evan Broder 78ed330099 vici: Handle closed sockets in the Ruby gem 
From recvfrom(2) (which UDPSocket#recv backs into):

  The return value will be 0 when the peer has performed an orderly
  shutdown.

(i.e. it will return an empty string)

Previously in this scenario, Vici::Transport#recv_all would spin
forever trying to pull more data off the socket. I'm not entirely
clear what happened that caused strongSwan to shutdown the socket, but
it probably should not cause vici Ruby apps to spin.

Closes strongswan/strongswan#13.
 2015-08-24 11:24:05 +02:00
Tobias Brunner 256e666d22 vici: Optionally check limits when initiating connections 
If the init-limits parameter is set (disabled by default) init limits
will be checked and might prevent new SAs from getting initiated.
 2015-08-21 18:21:13 +02:00
Tobias Brunner b9d7319fb3 vici: Add get_bool() convenience getter for VICI messages 2015-08-21 18:21:13 +02:00
Tobias Brunner ff0abde9ed controller: Optionally adhere to init limits also when initiating IKE_SAs 2015-08-21 18:21:13 +02:00
Tobias Brunner ffa20bad63 stroke: Allow %any as local address 
Actually, resolving addresses in `left` might be overkill as we'll assume
left=local anyway (the only difference is the log message).
 2015-08-21 18:19:26 +02:00
Tobias Brunner 8212f3d9a4 stroke: Add an option to disable side-swapping of configuration options 
In some scenarios it might be preferred to ensure left is always local
and no unintended swaps occur.
 2015-08-21 18:19:26 +02:00
Tobias Brunner 517cc501ef stroke: Change how CA certificates are stored 
Since 11c14bd2f5 CA certificates referenced in ca sections were
enumerated by two credential sets if they were also stored in
ipsec.d/cacerts.  This caused duplicate certificate requests to
get sent.  All CA certificates, whether loaded automatically or
via a ca section, are now stored in stroke_ca_t.

Certificates referenced in ca sections are now also reloaded
when `ipsec rereadcacerts` is used.
 2015-08-20 19:33:41 +02:00
Tobias Brunner 01d3ecbaf0 stroke: Combine CA certificate load methods 
Also use the right credential set for CA cert references loaded from
stroke_ca_t.
 2015-08-20 19:19:38 +02:00
Tobias Brunner 99610f406d stroke: Atomically replace CA and AA certificates when reloading them 
Previously it was possible that certificates were not found between the
time the credential sets were cleared and the certificates got readded.
 2015-08-20 19:19:37 +02:00
Tobias Brunner 6927d6224e sql: Also do a reversed ID match 
This is required for the case where IDr is not sent (i.e. is %any).
The backend manager does the same.

Fixes #1044.
 2015-08-17 18:58:14 +02:00
Tobias Brunner fffee7c759 ha: Recreate the control FIFO if the file exists but is not a FIFO 
This may happen if something like `echo ... > /path/to/fifo` is used
before the plugin was able to create the FIFO. In that case we'd end
up in a loop always reading the same values from the static file.
 2015-08-17 17:51:20 +02:00
Tobias Brunner 9322e5b398 vici: Add option to disable policy installation for CHILD_SAs 2015-08-17 12:01:36 +02:00
Tobias Brunner 39afe6e9d0 eap-radius: Use Framed-IPv6-Address attributes to send IPv6 VIPs in accounting messages 
This attribute is more appropriate for single IPv6 virtual IPs than the
Framed-IPv6-Prefix attribute.

Fixes #1001.
 2015-08-17 11:23:41 +02:00
Tobias Brunner ec490e68ae eap-radius: Add support for some basic IPv6-specific RADIUS attributes 
These are defined in RFC 6911.

Fixes #1001.
 2015-08-17 11:23:33 +02:00
Tobias Brunner b3d91cc64e vici: Add listen methods to receive arbitrary events in Python library 2015-08-17 11:12:18 +02:00
Tobias Brunner cf4cefee42 vici: Move event (un-)registration to a helper method in Python library 
Also make sure events are unregistered in case of exceptions in
streamed_request().
 2015-08-17 11:12:17 +02:00
Tobias Brunner 65ac0851c0 vici: Add ike/child-rekey events 2015-08-17 11:12:17 +02:00
Tobias Brunner 7f21363ee5 vici: Document the ike/child-updown events 2015-08-17 11:12:17 +02:00