denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,962 Commits 1 Branch 0 Tags
1fdd62ffcea8835f61be5ee38e9ce2ebc6d00f94
Commit Graph
970 Commits
Author SHA1 Message Date
Martin Willi 1fdd62ffce Remove version argument on peer_cfg constructor, use ike_cfg version instead 2012-10-24 10:19:33 +02:00
Martin Willi 9fc7cc6f9b Add IKE version information to ike_cfg_t 2012-10-24 10:18:35 +02:00
Tobias Brunner d2c8bc4df0 Handle type of first EAP-RADIUS response more sophisticated 2012-10-18 14:48:11 +02:00
Tobias Brunner 3555bacac7 Reload logger configuration on SIGHUP 
Besides changing the configuration this allows to easily rotate log files.

Also moved logger initialization back to daemon_t.
 2012-10-18 14:42:10 +02:00
Martin Willi a70851c941 Remove unused this parameter to load_issuer_cert/key(), as it is uninitialized 2012-10-16 14:11:14 +02:00
Martin Willi c1024a6bd6 Generate a load-tester certificate only for DN or subjectAltName identities 2012-10-16 13:43:54 +02:00
Martin Willi db97d67825 Add a load-tester initiator_match option to match custom initiator_id 2012-10-16 13:43:54 +02:00
Martin Willi 5359c7a437 Encode non-DN load-tester identities as subjectAltNames 2012-10-16 13:43:54 +02:00
Martin Willi 562b89ccee Add a load-tester digest option for issuing peer certificates 2012-10-16 13:43:54 +02:00
Martin Willi 3f6e13f553 Load a multiple load-tester CA certificates from a directory 2012-10-16 13:43:54 +02:00
Martin Willi 24eb73b4fa Added load-tester options to read issuing CA certificate and key from files 2012-10-16 13:43:53 +02:00
Tobias Brunner 418dcf3aae Fixed compilation of android_handler_t 2012-10-11 11:12:52 +02:00
Martin Willi 82f3549fe2 Fix leak of PINs from ipsec.secrets 2012-10-09 11:54:00 +02:00
Andreas Steffen 41d344e8ea allow has_noskip_flag to contain TRUE_OR_FALSE 2012-10-07 16:26:02 +02:00
Andreas Steffen cd198f48f2 test first and up in the outer while loop 2012-10-07 12:46:19 +02:00
Tobias Brunner a13c6a900e Added missing continue statement in ha socket error handling 2012-09-28 18:52:43 +02:00
Tobias Brunner 0273245877 Fixed snprintf check in tnc-ifmap plugin 2012-09-28 18:49:16 +02:00
Tobias Brunner 911e3156a0 Use %x to print uint32 as long ints are 64-bit long on x64 Linux 2012-09-28 18:09:08 +02:00
Tobias Brunner a05f3b2021 Make sure first argument is an int when using %.*s to print e.g. chunks 2012-09-28 18:01:49 +02:00
Tobias Brunner 4bc24ba794 Avoid memory leak when sending RADIUS accounting start message failed 2012-09-28 17:43:02 +02:00
Tobias Brunner 9f22002706 The eap argument of send_response is never NULL 2012-09-28 16:28:54 +02:00
Tobias Brunner 9d5b688a11 Properly initialize sockaddr_in struct in fast and dhcp plugins 2012-09-28 16:28:46 +02:00
Tobias Brunner 45178362c8 Clarified error message if enabling UDP decapsulation fails 2012-09-27 10:49:17 +02:00
Tobias Brunner 4106aea8e4 Made IP address enumeration more flexible 
Also added an option to enumerate addresses on ignored interfaces.
 2012-09-21 18:16:26 +02:00
Tobias Brunner 9ba36c0f7f Make it easy to check if an address is locally usable via changed get_interface() method 2012-09-21 18:16:26 +02:00
Tobias Brunner aed33805ce Don't ignore loopback devices and allow addresses on them being enumerated 2012-09-21 18:16:26 +02:00
Martin Willi 77c37ea5e0 As Unity responder, don't change the proposed TS at all, racoon doesn't like that 2012-09-18 17:17:48 +02:00
Martin Willi 7a7deec283 As initiator, narrow received Unity attributes to configured TS 2012-09-18 17:17:48 +02:00
Martin Willi b8db3775f3 When using Unity, bump up remote TS as initiator to 0.0.0.0/0, too 2012-09-18 17:17:48 +02:00
Martin Willi 284ed1b352 Enable Cisco Unity only if Unity vendor id received 2012-09-18 17:17:48 +02:00
Martin Willi 6e60807637 Exchange 0.0.0.0/0 traffic selectors with Unity, narrowing after exchange 2012-09-18 17:17:48 +02:00
Martin Willi f2463f1bd6 Add a Unity attribute provider that adds Split-Includes for TS 2012-09-18 17:17:47 +02:00
Martin Willi e39e697429 Check if subset calculation actually yields a TS in Unity narrowing 2012-09-18 17:17:47 +02:00
Martin Willi 92b5066705 Request Unity configuration attributes for IKEv1 only 2012-09-18 17:17:47 +02:00
Martin Willi 5ff012f717 Add Cisco Unity client support for Split-Include and Local-LAN 2012-09-18 17:17:47 +02:00
Tobias Brunner 8c19323c37 Make stroke user-creds work with XAuth configs 2012-09-18 16:56:17 +02:00
Tobias Brunner b7a500e985 Set AUTH_RULE_IDENTITY_LOOSE for rightid=%<identity> 2012-09-18 14:40:41 +02:00
Tobias Brunner 6d30954ae8 Removed the unneeded socket-raw plugin 2012-09-14 14:10:14 +02:00
Tobias Brunner bc6ec4de73 Option added to enforce a configured destination address for DHCP packets 2012-09-13 10:59:24 +02:00
Martin Willi 1e04488f32 Check for an existing lease in all stroke pools before creating a new one 2012-09-11 16:18:28 +02:00
Martin Willi 28a3d5bfbd Pass full pool list to release_address 2012-09-11 16:18:28 +02:00
Martin Willi 594c58e111 Pass the full list of pools to acquire_address, enumerate in providers 
If the provider has access to the full pool list, it can enumerate
them twice, for example to search for existing leases first, and
only search for new leases in a second step.

Fixes lease enumeration in attr-sql using multiple pools.
 2012-09-11 16:18:28 +02:00
Martin Willi cf85ebbfec Support RADIUS accounting when using IKEv1 with xauth-eap and eap-radius 2012-09-11 15:22:22 +02:00
Martin Willi 37095ce1c1 Fix leak while enumerating RADIUS Framed-IPs from IKE_SA 2012-09-11 15:22:22 +02:00
Tobias Brunner f4cc7ea11b Add uniqueids=never to ignore INITIAL_CONTACT notifies 
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received.  With this new option
it also ignores these notifies.
 2012-09-10 17:37:18 +02:00
Tobias Brunner 383c174a79 Print the name of mem pools instead of the confusing <base>/<size> 2012-09-10 12:42:09 +02:00
Andreas Steffen 6f93927b6c introduced sending of standard IETF Assessment Result PA-TNC attribute by IMVs 2012-09-09 05:13:50 +02:00
Tobias Brunner d2e8f20d94 Clear virtual IPs before storing assigned ones on the IKE_SA 
Otherwise we'll end up with duplicate or invalid VIPs stored on the
IKE_SA.
 2012-09-05 14:35:57 +02:00
Martin Willi 1323dc1138 Merge branch 'multi-vip' 
Brings support for multiple virtual IPs and multiple pools in
left/rigthsourceip definitions. Also introduces the new left/rightdns
options to configure requested DNS server address family and respond
with multiple connection specific servers.
 2012-08-31 12:55:56 +02:00
Tobias Brunner 868409139b Merge branch 'eap-client-select' 
This brings support for EAP-Nak payloads on the client (to select a
specific or supported method), and the server (via the eap-dynamic
plugin which selects a method supported/requested by the client).
 2012-08-31 12:25:41 +02:00