denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
9,771 Commits 1 Branch 0 Tags
35e2afd459e43970f76ffabc8aee74df7490f2bb
Commit Graph
9771 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Tobias Brunner 35e2afd459 Fix equality comparison of auth_cfg_t 
We previously only confirmed that rules contained in the first config are also
contained in the second, but since the number of rules does not have to
be equal, it might be that the second config contains rules that the
first one doesn't.
 2012-09-18 14:40:41 +02:00
Tobias Brunner b7a500e985 Set AUTH_RULE_IDENTITY_LOOSE for rightid=%<identity> 2012-09-18 14:40:41 +02:00
Tobias Brunner e6fcc172f8 Use AUTH_RULE_IDENTITY_LOOSE in NetworkManager backend 2012-09-18 14:40:40 +02:00
Tobias Brunner e596d0ef1e android: Use AUTH_RULE_IDENTITY_LOOSE 2012-09-18 11:21:49 +02:00
Tobias Brunner 3a8852c76f Add AUTH_RULE_IDENTITY_LOOSE which allows to use IDr loosely as initiator 
If it is set on an auth config IDr will not be sent, and later the configured
identity will not only be checked against the returned IDr, but also
against other identities contained in the responder's certificate.
 2012-09-18 11:16:10 +02:00
Tobias Brunner cf1ec85207 New Android release after fixing Unicode conversion bug 2012-09-17 10:55:10 +02:00
Tobias Brunner b7c54cf226 android: Fix conversion of actual Unicode strings (i.e. bytes!=chars) 2012-09-17 10:30:39 +02:00
Tobias Brunner 6d30954ae8 Removed the unneeded socket-raw plugin 2012-09-14 14:10:14 +02:00
Tobias Brunner a889cfe5e1 Change traffic selectors during Quick Mode in case of a NAT in transport mode 
Windows 7 sends its internal address as TSi.  While we don't support the
NAT-T drafts as used by Windows XP it is interesting to note that the
client there omits the TSi payload which then would automatically get set
to the public IP address of the client.

Fixes #220.
 2012-09-14 09:40:18 +02:00
Tobias Brunner 7d786057b4 Merge branch 'custom-crypto' 
This provides plugins with an interface to register keywords for
proposals (e.g. when parsing the esp and ike options from ipsec.conf)
and the possibility to register identifiers for kernel algorithms.

It is based on patches contributed by Nanoteq Pty Ltd.
 2012-09-13 15:50:52 +02:00
Tobias Brunner 08ad639f32 Added algorithm lookup via kernel_interface_t to the various kernel interfaces 2012-09-13 15:48:49 +02:00
Tobias Brunner 524fb37ccd Added possibility to register custom kernel algorithms to kernel interface 2012-09-13 15:44:47 +02:00
Tobias Brunner 4c57c63062 Added possibility to register custom proposal keywords 
Keyword lookup and registration are handled via the new lib->proposal object.
 2012-09-13 15:44:46 +02:00
Tobias Brunner 995875210a Removed len argument from proposal_get_token() 
Also use enumerators instead of lexparser.h to parse proposal strings.
 2012-09-13 15:44:01 +02:00
Tobias Brunner 1962e12fd3 Make arguments for enumerator_create_token|directory const 2012-09-13 15:42:38 +02:00
Francois ten Krooden 8c2ec47149 Moved proposal_keywords to proposal_keywords_static 
Added new proposal keywords with function to reference the static keywords.
 2012-09-13 15:42:38 +02:00
Tobias Brunner bc6ec4de73 Option added to enforce a configured destination address for DHCP packets 2012-09-13 10:59:24 +02:00
Andreas Steffen 493f85b696 version bump to 5.0.1rc1 2012-09-12 23:56:12 +02:00
Tobias Brunner 4a4d20de9d Allow calls to set_address() for any host-sized TS, not only dynamic ones 
This fixes CHILD_SA updates (e.g. due to MOBIKE), which were broken
since 4cb0783.
 2012-09-12 18:14:01 +02:00
Tobias Brunner 455accc687 Ensure traffic selectors are dynamic before calling set_address() when deriving them 2012-09-12 18:13:47 +02:00
Tobias Brunner fa96a350c2 Consistently log XFRM mark masks with 0 prefix in kernel-netlink plugin 2012-09-12 17:40:36 +02:00
Tobias Brunner dc80ef0cde starter: Added --nolog option to suppress logging in starter itself 
Fixes #224.
 2012-09-12 17:15:14 +02:00
Tobias Brunner 629cdca82c Updates to strongswan.conf(5) man page (added several missing options) 2012-09-12 16:53:45 +02:00
Tobias Brunner 72970b458d Some updates to ipsec.conf(5) man page 2012-09-12 16:53:45 +02:00
Tobias Brunner 23b4d3a52f starter: Allow %any also for protocol in left|rightprotoport 2012-09-12 16:53:45 +02:00
Martin Willi ab2c989c32 Don't allow NULL encryption with PEAP 2012-09-12 13:19:52 +02:00
Martin Willi acada66a35 Use memmove on overlapping regions, and operate with correct sizeof() 2012-09-12 13:19:52 +02:00
Martin Willi fb3cf1b708 Whitespace cleanups in tls_eap 2012-09-12 13:19:52 +02:00
Martin Willi 5b96503e13 Use uintptr_t in mem pool to avoid compiler warning if sizeof(void*) != sizeof(int) 2012-09-12 13:19:52 +02:00
Andreas Steffen 979027ae04 ikev1 hybrid authentication does not need client certificates 2012-09-12 12:42:24 +02:00
Andreas Steffen e1588893f5 corrected topology in ikev2/rw-radius-accounting scenario 2012-09-12 12:26:39 +02:00
Andreas Steffen 9ce931f3af added ikev2/rw-eap-dynamic scenario 2012-09-12 12:15:17 +02:00
Martin Willi d4cca1beea Always send a configuration payload in IKEv1 TRANSACTIONs, even if it is empty 2012-09-11 17:20:17 +02:00
Martin Willi c4acf37502 Don't use host address for dynamic TS in IKEv1 if a virtual IP was expected 2012-09-11 16:18:29 +02:00
Martin Willi 7d82aaea8d Don't use host address for dynamic TS in IKEv2 if a virtual IP was expected 2012-09-11 16:18:28 +02:00
Martin Willi 4cb0783f3c Don't return a subset for a dynamic TS unless set_address has been called 2012-09-11 16:18:28 +02:00
Martin Willi c7294f7a58 Send FAILED_CP_REQUIRED if a configuration payload was expected, but not received 2012-09-11 16:18:28 +02:00
Martin Willi 1e04488f32 Check for an existing lease in all stroke pools before creating a new one 2012-09-11 16:18:28 +02:00
Martin Willi 28a3d5bfbd Pass full pool list to release_address 2012-09-11 16:18:28 +02:00
Martin Willi 594c58e111 Pass the full list of pools to acquire_address, enumerate in providers 
If the provider has access to the full pool list, it can enumerate
them twice, for example to search for existing leases first, and
only search for new leases in a second step.

Fixes lease enumeration in attr-sql using multiple pools.
 2012-09-11 16:18:28 +02:00
Martin Willi dc7b79d8a5 Add a linked list constructor initializing from an enumerator 2012-09-11 16:18:28 +02:00
Martin Willi f942588f95 Add a responder narrow() hook to change TS in the kernel, but not on the wire 2012-09-11 16:14:39 +02:00
Martin Willi cf85ebbfec Support RADIUS accounting when using IKEv1 with xauth-eap and eap-radius 2012-09-11 15:22:22 +02:00
Martin Willi 37095ce1c1 Fix leak while enumerating RADIUS Framed-IPs from IKE_SA 2012-09-11 15:22:22 +02:00
Tobias Brunner f4cc7ea11b Add uniqueids=never to ignore INITIAL_CONTACT notifies 
With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received.  With this new option
it also ignores these notifies.
 2012-09-10 17:37:18 +02:00
Martin Willi c51af950b1 Add random plugin options to strongswan.conf.5 2012-09-10 17:07:51 +02:00
Martin Willi 7b68cd9212 Add strongswan.conf runtime options for /dev/[u]random files 
Fixes #221.
 2012-09-10 17:07:51 +02:00
Andreas Steffen 98521f0821 this is the correct evaltest 2012-09-10 15:53:03 +02:00
Andreas Steffen 2dd0883fb7 recovered ikev2/ip-two-pools-mixed evaltest 2012-09-10 15:46:50 +02:00
Andreas Steffen d401bcfe97 adapted ip-pool evaltests 2012-09-10 15:41:27 +02:00